@microwiseai/snapshot 0.5.0 → 0.5.2

package/node_modules/@gitdot/clone-lib/dist/types.d.ts

@@ -0,0 +1,225 @@
+/**
+ * Public type surface for @gitdot/clone-lib (RESOLVED-LOCK-SPEC S2/S3/S4).
+ *
+ * Consumers (snapshot / skit / glpkg) import these to type their adapters:
+ *   import type { ResolvedLock, Member, CloneReport, Manifest } from '@gitdot/clone-lib';
+ */
+/** Clone strategy: pin an exact commit, or track the default-branch HEAD. */
+export type CloneMode = 'pinned' | 'head';
+/** Resolved repo visibility (drives the S3 credential pre-flight). */
+export type Visibility = 'public' | 'private' | 'unknown';
+/** How a coordinate was resolved (makes GAP-1 guesswork explicit + checkable). */
+export type Provenance = 'manifest-repository' | 'gitlab-api' | 'package-lock-projectid' | 'convention-guess' | null;
+/** Member kind (reused enum from SUBSET-MANIFEST). */
+export type MemberType = 'npm-lib' | 'app/worker' | 'static-asset' | 'meta';
+/** Structured git failure kind emitted by the GitRunner. */
+export type GitErrorKind = 'not-found' | 'no-access' | 'failed';
+/** A real, git-clonable coordinate. `cloneUrl` is REQUIRED for a finished lock. */
+export interface RepoCoordinate {
+    cloneUrl?: string;
+    projectPath?: string;
+    projectId?: number;
+}
+/** Full resolved ref; `sha` === Member.commitSha. */
+export interface Ref {
+    branch: string | null;
+    tag: string | null;
+    sha: string | null;
+    dirty: boolean;
+}
+/** One fully-resolved node of the install closure. */
+export interface Member {
+    /** declared gitdot dot-identity, separate from npmName (F2). */
+    id: string;
+    npmName: string;
+    /** resolved GitLab group — pinned PER MEMBER (multi-tenant rule S2). */
+    gitlabGroup: string | null;
+    repoCoordinate: RepoCoordinate;
+    visibility: Visibility;
+    version: string | null;
+    /** exact commit the version was published from (tag → sha pin). */
+    commitSha: string | null;
+    ref: Ref;
+    memberType: MemberType;
+    /** install channel that declared it (glpkg | npm-proxy | skit | …). */
+    installer: string;
+    provenance: Provenance;
+}
+/** `source` block — the only part that differs between skit/snapshot/glpkg locks. */
+export interface LockSource {
+    manifest: string | null;
+    manifestVersion: string | null;
+    registry: Record<string, unknown>;
+    derivedFrom: 'package-lock.json' | 'manifest' | string;
+}
+/** The one resolved-lock schema; skit/snapshot/glpkg.lock.json are instances of it. */
+export interface ResolvedLock {
+    lockVersion: 1;
+    kind: 'resolved-lock';
+    subset?: string;
+    source: LockSource;
+    resolvedAt: string;
+    members: Member[];
+    edges: Array<[string, string]>;
+}
+export interface ClonedEntry {
+    id: string;
+    sha: string;
+    path: string;
+    coordinate: string;
+    visibility: Visibility;
+    provenance: Provenance;
+}
+export interface SkippedEntry {
+    id: string;
+    reason: string;
+}
+export interface NoAccessEntry {
+    id: string;
+    visibility: Visibility;
+    reason: string;
+}
+export interface BucketEntry {
+    id: string;
+    reason: string;
+}
+/** Structured, --json-serializable clone outcome. Every member lands in one bucket. */
+export interface CloneReport {
+    mode: CloneMode;
+    credentialsNeeded: number;
+    cloned: ClonedEntry[];
+    skipped: SkippedEntry[];
+    'skipped-no-access': NoAccessEntry[];
+    'not-found': BucketEntry[];
+    failed: BucketEntry[];
+    closureSize: number;
+}
+/** The git surface cloneFromLock depends on; inject a fake for deterministic tests. */
+export interface GitRunner {
+    exists(absPath: string): boolean;
+    isRepo(absPath: string): boolean;
+    clone(cloneUrl: string, absPath: string): void;
+    checkout(absPath: string, sha: string): void;
+    headSha(absPath: string): string;
+}
+export interface GitLabProject {
+    id: number | string;
+    path_with_namespace?: string;
+    http_url_to_repo?: string;
+    visibility?: Visibility;
+    default_branch?: string;
+    [k: string]: unknown;
+}
+export interface GitLabTag {
+    name: string;
+    commit?: {
+        id?: string;
+        sha?: string;
+    };
+}
+export interface PackumentVersion {
+    dist?: {
+        tarball?: string;
+    };
+    dependencies?: Record<string, string>;
+    [k: string]: unknown;
+}
+export interface Packument {
+    name?: string;
+    'dist-tags'?: {
+        latest?: string;
+    };
+    versions?: Record<string, PackumentVersion>;
+    [k: string]: unknown;
+}
+/** Read-only GitLab client; inject a fake in tests. */
+export interface GitLabApi {
+    getProject(id: number | string): Promise<GitLabProject>;
+    getTags(id: number | string): Promise<GitLabTag[]>;
+    getPackument(name: string, opts?: {
+        group?: string;
+    }): Promise<Packument>;
+}
+/** scope → group (+ optional url) default table. */
+export type RegistryMap = Record<string, {
+    group: string;
+    url?: string;
+}>;
+/** Install block: channelled ({channel:{name:ver}}) OR a flat {name:ver} map. */
+export type InstallBlock = Record<string, Record<string, string>> | Record<string, string>;
+/** snapshot.json-like input consumed by resolveFromManifest (B2). */
+export interface Manifest {
+    name?: string;
+    version?: string;
+    subset?: string;
+    registry?: RegistryMap;
+    install?: InstallBlock;
+    [k: string]: unknown;
+}
+/** Object form of a skit `dependencies.npm` value (source-pinned). */
+export interface NpmDependencySpec {
+    version: string;
+    source?: 'npm' | 'proxy';
+}
+/**
+ * skit.json (SkitManifest) shape — documented for consumers that map it into a
+ * {@link Manifest} before calling resolveFromManifest (a thin per-distribution shim).
+ */
+export interface SkitManifest {
+    name: string;
+    version: string;
+    registry?: RegistryMap;
+    dependencies?: {
+        npm?: Record<string, string | NpmDependencySpec>;
+        skit?: Record<string, string>;
+    };
+    glpkg?: {
+        groups?: Record<string, string[]>;
+        policy?: string;
+    };
+    [k: string]: unknown;
+}
+export interface CloneFromLockOptions {
+    mode?: CloneMode;
+    dest: string;
+    only?: string[];
+    installer?: string[];
+    git?: GitRunner;
+    workspaceDir?: string;
+}
+/** Reader that returns an installed package.json (path-1 manifest-repository). */
+export type ReadInstalledManifest = (name: string) => {
+    repository?: unknown;
+    [k: string]: unknown;
+} | null;
+export interface ResolveLockOptions {
+    packageLockPath: string;
+    nodeModulesDir?: string;
+    subset: string;
+    scopes?: string[];
+    source?: Partial<Pick<LockSource, 'manifest' | 'manifestVersion'>> & {
+        registry?: Record<string, unknown>;
+    };
+    api: GitLabApi;
+    installer?: string;
+    readInstalledManifest?: ReadInstalledManifest;
+    now?: () => string;
+    warn?: (msg: string) => void;
+}
+export interface ResolveFromManifestOptions {
+    api: GitLabApi;
+    scopes?: string[];
+    subset?: string;
+    source?: {
+        manifest?: string | null;
+        manifestVersion?: string | null;
+    };
+    readInstalledManifest?: ReadInstalledManifest;
+    now?: () => string;
+    warn?: (msg: string) => void;
+}
+export interface ResolveResult {
+    lock: ResolvedLock;
+    warnings: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/node_modules/@gitdot/clone-lib/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,6EAA6E;AAC7E,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1C,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1D,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAClB,qBAAqB,GACrB,YAAY,GACZ,wBAAwB,GACxB,kBAAkB,GAClB,IAAI,CAAC;AAET,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,GAAG,MAAM,CAAC;AAE5E,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAIhE,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qDAAqD;AACrD,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,sDAAsD;AACtD,MAAM,WAAW,MAAM;IACrB,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mEAAmE;IACnE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,GAAG,CAAC;IACT,UAAU,EAAE,UAAU,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,WAAW,EAAE,mBAAmB,GAAG,UAAU,GAAG,MAAM,CAAC;CACxD;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,CAAC,CAAC;IACf,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChC;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,UAAU,EAAE,UAAU,CAAC;CACxB;AACD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,mBAAmB,EAAE,aAAa,EAAE,CAAC;IACrC,WAAW,EAAE,WAAW,EAAE,CAAC;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAClC;AAID,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC;AACD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AACD,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC3E;AAID,oDAAoD;AACpD,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1E,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE3F,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC/B,CAAC;IACF,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAID,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC;AAE5G,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,iBAAiB,CAAC,CAAC,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAC5G,GAAG,EAAE,SAAS,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvE,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB"}

package/node_modules/@gitdot/clone-lib/dist/types.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Public type surface for @gitdot/clone-lib (RESOLVED-LOCK-SPEC S2/S3/S4).
+ *
+ * Consumers (snapshot / skit / glpkg) import these to type their adapters:
+ *   import type { ResolvedLock, Member, CloneReport, Manifest } from '@gitdot/clone-lib';
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/node_modules/@gitdot/clone-lib/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG"}

package/node_modules/@gitdot/clone-lib/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@gitdot/clone-lib",
+  "version": "0.2.0",
+  "description": "Shared resolved-lock library (TypeScript): resolve a distribution's install closure (from a package-lock or a snapshot.json manifest) into a resolved-lock (RESOLVED-LOCK-SPEC S2), then clone that closure. Zero runtime dependencies.",
+  "type": "commonjs",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./resolve": {
+      "types": "./dist/resolve/index.d.ts",
+      "default": "./dist/resolve/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "gitdot-resolve": "dist/bin/gitdot-resolve.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node --test",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "gitdot",
+    "resolved-lock",
+    "clone",
+    "gitlab",
+    "monorepo",
+    "typescript"
+  ],
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/microwiseai/gitdot.clone-lib.git"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.43",
+    "typescript": "^5.9.3"
+  }
+}

package/node_modules/@microwiseai/install-preflight/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @microwiseai/install-preflight
+ *
+ * Registry-agnostic install preflight engine. Given a flat list of package
+ * requests (direct + pre-expanded transitive closure), each tagged with a
+ * channel and an auth mode, it verifies:
+ *
+ *   [A] Resolvability for the declared auth mode (use `anonymous` to reproduce a
+ *       first-time end-user): 401 (private/hidden), 404 (unpublished/phantom),
+ *       and range-unsatisfied are reported per package.
+ *   [B] SemVer / dist-tag discipline: a stable tag (default `latest`) must not
+ *       point at a prerelease, and unversioned installs must resolve to stable.
+ *
+ * The engine knows nothing about snapshot/glpkg/skit — callers map their own
+ * manifest into channels + package requests.
+ *
+ * Usage:
+ *   import { preflight, createNpmPackumentResolver } from '@microwiseai/install-preflight';
+ *   const report = await preflight({ channels, packages, policy });
+ *   if (!report.ok) throw new Error(formatReport(report));
+ */
+export type { AuthMode, ResolverStrategy, RegistryChannel, PackageRequest, PreflightPolicy, PreflightCode, PreflightFinding, ResolvedPin, PreflightReport, PackumentResult, Resolver, PreflightInput, } from './types.js';
+export { preflight, formatReport } from './preflight.js';
+export { createNpmPackumentResolver, encodePackageName, type NpmPackumentResolverOptions, } from './resolvers.js';
+export { DEFAULT_POLICY, withDefaults, isDefaultResolveRange, resolveVersion, checkStableRelease, type VersionResolution, } from './policy.js';
+export { parse as parseSemver, isValid as isValidSemver, isPrerelease, compare as compareSemver, satisfies, maxSatisfying, isSupportedRange, type SemVer, } from './semver.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@microwiseai/install-preflight/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,YAAY,EACV,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,eAAe,EACf,QAAQ,EACR,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,KAAK,2BAA2B,GACjC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,IAAI,WAAW,EACpB,OAAO,IAAI,aAAa,EACxB,YAAY,EACZ,OAAO,IAAI,aAAa,EACxB,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,KAAK,MAAM,GACZ,MAAM,aAAa,CAAC"}

package/node_modules/@microwiseai/install-preflight/dist/index.js

@@ -0,0 +1,26 @@
+/**
+ * @microwiseai/install-preflight
+ *
+ * Registry-agnostic install preflight engine. Given a flat list of package
+ * requests (direct + pre-expanded transitive closure), each tagged with a
+ * channel and an auth mode, it verifies:
+ *
+ *   [A] Resolvability for the declared auth mode (use `anonymous` to reproduce a
+ *       first-time end-user): 401 (private/hidden), 404 (unpublished/phantom),
+ *       and range-unsatisfied are reported per package.
+ *   [B] SemVer / dist-tag discipline: a stable tag (default `latest`) must not
+ *       point at a prerelease, and unversioned installs must resolve to stable.
+ *
+ * The engine knows nothing about snapshot/glpkg/skit — callers map their own
+ * manifest into channels + package requests.
+ *
+ * Usage:
+ *   import { preflight, createNpmPackumentResolver } from '@microwiseai/install-preflight';
+ *   const report = await preflight({ channels, packages, policy });
+ *   if (!report.ok) throw new Error(formatReport(report));
+ */
+export { preflight, formatReport } from './preflight.js';
+export { createNpmPackumentResolver, encodePackageName, } from './resolvers.js';
+export { DEFAULT_POLICY, withDefaults, isDefaultResolveRange, resolveVersion, checkStableRelease, } from './policy.js';
+export { parse as parseSemver, isValid as isValidSemver, isPrerelease, compare as compareSemver, satisfies, maxSatisfying, isSupportedRange, } from './semver.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@microwiseai/install-preflight/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiBH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,IAAI,WAAW,EACpB,OAAO,IAAI,aAAa,EACxB,YAAY,EACZ,OAAO,IAAI,aAAa,EACxB,SAAS,EACT,aAAa,EACb,gBAAgB,GAEjB,MAAM,aAAa,CAAC"}

package/node_modules/@microwiseai/install-preflight/dist/policy.d.ts

@@ -0,0 +1,42 @@
+/**
+ * [B] SemVer / dist-tag discipline.
+ *
+ * Two rules:
+ *  (b1) A release promoted to a "stable" dist-tag (default: latest) must NOT
+ *       carry a prerelease identifier. `checkStableRelease` enforces this for a
+ *       single version (e.g. the manifest/snapshot being published).
+ *  (b2) A default-resolve install (`install @x/y`, no version) must land on a
+ *       stable release — enforced per-pin in the engine via `isDefaultResolve`
+ *       + this policy's `forbidPrereleaseDefaultResolve`.
+ */
+import type { PackumentResult, PreflightFinding, PreflightPolicy } from './types.js';
+export declare const DEFAULT_POLICY: Required<PreflightPolicy>;
+export declare function withDefaults(policy?: PreflightPolicy): Required<PreflightPolicy>;
+/** A range that means "give me the default (latest) version". */
+export declare function isDefaultResolveRange(range: string): boolean;
+export interface VersionResolution {
+    /** Resolved concrete version, or null if nothing satisfies. */
+    version: string | null;
+    /** Whether resolution went through the default (latest) path. */
+    viaDefaultResolve: boolean;
+    /** True when the range form could not be evaluated. */
+    unsupported?: boolean;
+}
+/**
+ * Resolve a requested selector against a package's metadata, mirroring how a
+ * client picks a version: default-resolve → `latest` dist-tag; named dist-tag →
+ * its target; exact/range → highest satisfying published version.
+ */
+export declare function resolveVersion(range: string, packument: Pick<PackumentResult, 'distTags' | 'versions'>, isSupported: (r: string) => boolean): VersionResolution;
+/**
+ * (b1) Is `version` acceptable for `distTag`? Returns a finding when a stable
+ * tag would point at a prerelease, else null. Registry-agnostic; the caller
+ * supplies package/channel context.
+ */
+export declare function checkStableRelease(version: string, ctx: {
+    package: string;
+    channel: string;
+    requested?: string;
+    requestedBy?: string;
+}, policy?: PreflightPolicy): PreflightFinding | null;
+//# sourceMappingURL=policy.d.ts.map

package/node_modules/@microwiseai/install-preflight/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGrF,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,eAAe,CAIpD,CAAC;AAEF,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC,CAOhF;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iEAAiE;IACjE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,uDAAuD;IACvD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,UAAU,CAAC,EACzD,WAAW,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,GAClC,iBAAiB,CAwBnB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EACnF,MAAM,CAAC,EAAE,eAAe,GACvB,gBAAgB,GAAG,IAAI,CAezB"}

package/node_modules/@microwiseai/install-preflight/dist/policy.js

@@ -0,0 +1,79 @@
+/**
+ * [B] SemVer / dist-tag discipline.
+ *
+ * Two rules:
+ *  (b1) A release promoted to a "stable" dist-tag (default: latest) must NOT
+ *       carry a prerelease identifier. `checkStableRelease` enforces this for a
+ *       single version (e.g. the manifest/snapshot being published).
+ *  (b2) A default-resolve install (`install @x/y`, no version) must land on a
+ *       stable release — enforced per-pin in the engine via `isDefaultResolve`
+ *       + this policy's `forbidPrereleaseDefaultResolve`.
+ */
+import { isPrerelease, isValid, maxSatisfying } from './semver.js';
+export const DEFAULT_POLICY = {
+    distTag: 'latest',
+    requireStableForTags: ['latest'],
+    forbidPrereleaseDefaultResolve: true,
+};
+export function withDefaults(policy) {
+    return {
+        distTag: policy?.distTag ?? DEFAULT_POLICY.distTag,
+        requireStableForTags: policy?.requireStableForTags ?? DEFAULT_POLICY.requireStableForTags,
+        forbidPrereleaseDefaultResolve: policy?.forbidPrereleaseDefaultResolve ?? DEFAULT_POLICY.forbidPrereleaseDefaultResolve,
+    };
+}
+/** A range that means "give me the default (latest) version". */
+export function isDefaultResolveRange(range) {
+    const r = range.trim();
+    return r === '' || r === '*' || r === 'latest' || r === 'x' || r === 'X';
+}
+/**
+ * Resolve a requested selector against a package's metadata, mirroring how a
+ * client picks a version: default-resolve → `latest` dist-tag; named dist-tag →
+ * its target; exact/range → highest satisfying published version.
+ */
+export function resolveVersion(range, packument, isSupported) {
+    const distTags = packument.distTags ?? {};
+    const versions = packument.versions ?? [];
+    const r = range.trim();
+    if (isDefaultResolveRange(r)) {
+        const latest = distTags.latest;
+        if (latest)
+            return { version: latest, viaDefaultResolve: true };
+        // No latest tag: fall back to highest published version.
+        const max = maxSatisfying(versions, '*');
+        return { version: max, viaDefaultResolve: true };
+    }
+    // Named dist-tag (e.g. "beta", "next").
+    if (!isValid(r) && distTags[r]) {
+        return { version: distTags[r], viaDefaultResolve: false };
+    }
+    if (!isSupported(r)) {
+        return { version: null, viaDefaultResolve: false, unsupported: true };
+    }
+    const match = maxSatisfying(versions, r);
+    return { version: match, viaDefaultResolve: false };
+}
+/**
+ * (b1) Is `version` acceptable for `distTag`? Returns a finding when a stable
+ * tag would point at a prerelease, else null. Registry-agnostic; the caller
+ * supplies package/channel context.
+ */
+export function checkStableRelease(version, ctx, policy) {
+    const p = withDefaults(policy);
+    if (!p.requireStableForTags.includes(p.distTag))
+        return null;
+    if (!isPrerelease(version))
+        return null;
+    return {
+        code: 'PRERELEASE_ON_STABLE_TAG',
+        package: ctx.package,
+        requested: ctx.requested ?? version,
+        resolved: version,
+        channel: ctx.channel,
+        requestedBy: ctx.requestedBy,
+        message: `"${version}" is a prerelease but is being promoted to the "${p.distTag}" tag. ` +
+            `Prereleases must publish to a dev/beta dist-tag only.`,
+    };
+}
+//# sourceMappingURL=policy.js.map

package/node_modules/@microwiseai/install-preflight/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAA8B;IACvD,OAAO,EAAE,QAAQ;IACjB,oBAAoB,EAAE,CAAC,QAAQ,CAAC;IAChC,8BAA8B,EAAE,IAAI;CACrC,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,OAAO;QACL,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,cAAc,CAAC,OAAO;QAClD,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,IAAI,cAAc,CAAC,oBAAoB;QACzF,8BAA8B,EAC5B,MAAM,EAAE,8BAA8B,IAAI,cAAc,CAAC,8BAA8B;KAC1F,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;AAC3E,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,SAAyD,EACzD,WAAmC;IAEnC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAEvB,IAAI,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAChE,yDAAyD;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,GAAmF,EACnF,MAAwB;IAExB,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,OAAO;QACnC,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EACL,IAAI,OAAO,mDAAmD,CAAC,CAAC,OAAO,SAAS;YAChF,uDAAuD;KAC1D,CAAC;AACJ,CAAC"}

package/node_modules/@microwiseai/install-preflight/dist/preflight.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Preflight engine core.
+ *
+ * For every package request, probe its channel (with that channel's auth mode)
+ * and decide whether an install would succeed and comply with semver/dist-tag
+ * policy. Closure expansion is the CALLER's job — the engine probes exactly the
+ * requests it is given. This keeps it registry-agnostic and lets a caller
+ * token-discover the true closure, then hand it here to probe anonymously.
+ */
+import type { PreflightInput, PreflightReport } from './types.js';
+/**
+ * Run preflight. Never throws for per-package failures — everything becomes a
+ * finding. Only argument/programming errors throw.
+ */
+export declare function preflight(input: PreflightInput): Promise<PreflightReport>;
+/** Human-readable, fail-loud rendering of a report's findings. */
+export declare function formatReport(report: PreflightReport): string;
+//# sourceMappingURL=preflight.d.ts.map

package/node_modules/@microwiseai/install-preflight/dist/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAIhB,MAAM,YAAY,CAAC;AAmBpB;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CA2H/E;AAmCD,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAa5D"}

package/node_modules/@microwiseai/install-preflight/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE7D,SAAS,cAAc,CAAC,KAAqB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAqB;IACnD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAa,KAAK,CAAC,QAAQ,IAAI,0BAA0B,EAAE,CAAC;IAE1E,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ;QAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,2CAA2C;IAC3C,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,SAAS,EAAE,GAAG,CAAC,KAAK;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EAAE,+BAA+B,GAAG,CAAC,OAAO,yCAAyC;aAC7F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE5D,2BAA2B;QAC3B,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAA6C;gBACpD,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,WAAW;gBAChB,GAAG,EAAE,WAAW;aACjB,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,SAAS,EAAE,GAAG,CAAC,KAAK;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,cAAc,EAAE,EAAE,CAAC,MAAM;gBACzB,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC;aACjE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAEnE,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,SAAS,EAAE,GAAG,CAAC,KAAK;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EACL,UAAU,GAAG,CAAC,KAAK,SAAS,GAAG,CAAC,IAAI,4CAA4C;oBAChF,4FAA4F;aAC/F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,SAAS,EAAE,GAAG,CAAC,KAAK;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EACL,2BAA2B,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,KAAK,IAAI;oBAC/D,eAAe,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,KAAK;YACpB,QAAQ;YACR,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;YAC/C,QAAQ,EAAE,EAAE,CAAC,QAAQ;SACtB,CAAC,CAAC;QAEH,oBAAoB;QACpB,MAAM,YAAY,GAChB,GAAG,CAAC,gBAAgB,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3D,IACE,MAAM,CAAC,8BAA8B;YACrC,YAAY;YACZ,YAAY,CAAC,QAAQ,CAAC,EACtB,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,SAAS,EAAE,GAAG,CAAC,KAAK,IAAI,QAAQ;gBAChC,QAAQ;gBACR,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EACL,aAAa,GAAG,CAAC,IAAI,2CAA2C,QAAQ,KAAK;oBAC7E,QAAQ,MAAM,CAAC,OAAO,8EAA8E;aACvG,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,OAAO;QACP,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,IAA8B,EAC9B,IAAY,EACZ,KAAa,EACb,OAAwB,EACxB,MAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,CACL,GAAG,IAAI,IAAI,KAAK,6BAA6B,OAAO,CAAC,EAAE,GAAG;gBAC1D,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,iDAAiD;gBAC9E,iDAAiD,MAAM,EAAE,CAC1D,CAAC;QACJ,KAAK,WAAW;YACd,OAAO,GAAG,IAAI,IAAI,KAAK,6BAA6B,OAAO,CAAC,EAAE,qBAAqB,MAAM,EAAE,CAAC;QAC9F,KAAK,WAAW;YACd,OAAO,CACL,GAAG,IAAI,IAAI,KAAK,6BAA6B,OAAO,CAAC,EAAE,oBAAoB;gBAC3E,4CAA4C,MAAM,EAAE,CACrD,CAAC;QACJ;YACE,OAAO,GAAG,IAAI,IAAI,KAAK,sCAAsC,OAAO,CAAC,EAAE,qBAAqB,MAAM,EAAE,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAG,GAAG,GAAG;IACpC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,kBAAkB,MAAM,CAAC,OAAO,kFAAkF,CAAC;IAC5H,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,MAAM,CAAC,OAAO,uBAAuB;YAClG,0DAA0D;KAC7D,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,IAAI,GAAG,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/node_modules/@microwiseai/install-preflight/dist/resolvers.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Default resolver: fetch an npm-style packument through a registry.
+ *
+ * `GET {registryUrl}/{name}` returns `{ "dist-tags": {...}, "versions": {...} }`.
+ * The auth mode decides whether an Authorization header is sent — omitting it
+ * reproduces a first-time, anonymous end-user (the whole point of preflight).
+ *
+ * Status mapping is HTTP-faithful: 401/403/404 flow straight to findings so the
+ * three real incidents (private 401, unpublished 404, phantom pin 404) are
+ * attributed per-package.
+ */
+import type { Resolver } from './types.js';
+/** Encode a (possibly scoped) package name for a registry path: @s/p → @s%2fp. */
+export declare function encodePackageName(name: string): string;
+export interface NpmPackumentResolverOptions {
+    /** Injectable fetch (defaults to global fetch). */
+    fetchImpl?: typeof fetch;
+    /** Per-request timeout in ms (default 15000). */
+    timeoutMs?: number;
+}
+/**
+ * Build the default npm-packument resolver. Reused for every channel whose
+ * strategy is 'npm-packument' (or unset).
+ */
+export declare function createNpmPackumentResolver(opts?: NpmPackumentResolverOptions): Resolver;
+//# sourceMappingURL=resolvers.d.ts.map

package/node_modules/@microwiseai/install-preflight/dist/resolvers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../src/resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAoC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE7E,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAMD,MAAM,WAAW,2BAA2B;IAC1C,mDAAmD;IACnD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,2BAAgC,GAAG,QAAQ,CA2C3F"}

package/node_modules/@microwiseai/install-preflight/dist/resolvers.js

@@ -0,0 +1,63 @@
+/**
+ * Default resolver: fetch an npm-style packument through a registry.
+ *
+ * `GET {registryUrl}/{name}` returns `{ "dist-tags": {...}, "versions": {...} }`.
+ * The auth mode decides whether an Authorization header is sent — omitting it
+ * reproduces a first-time, anonymous end-user (the whole point of preflight).
+ *
+ * Status mapping is HTTP-faithful: 401/403/404 flow straight to findings so the
+ * three real incidents (private 401, unpublished 404, phantom pin 404) are
+ * attributed per-package.
+ */
+/** Encode a (possibly scoped) package name for a registry path: @s/p → @s%2fp. */
+export function encodePackageName(name) {
+    return name.replace('/', '%2f');
+}
+function joinUrl(base, path) {
+    return `${base.replace(/\/+$/, '')}/${path}`;
+}
+/**
+ * Build the default npm-packument resolver. Reused for every channel whose
+ * strategy is 'npm-packument' (or unset).
+ */
+export function createNpmPackumentResolver(opts = {}) {
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? 15000;
+    return {
+        async fetchPackument(name, channel) {
+            if (!doFetch) {
+                return { status: 0, error: 'no fetch implementation available' };
+            }
+            const url = joinUrl(channel.registryUrl, encodePackageName(name));
+            const headers = { Accept: 'application/json' };
+            if (channel.auth.kind === 'token') {
+                headers.Authorization = `Bearer ${channel.auth.token}`;
+            }
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                const res = await doFetch(url, { headers, signal: controller.signal });
+                if (!res.ok) {
+                    const body = await res.text().catch(() => '');
+                    return { status: res.status, error: body || res.statusText };
+                }
+                const data = (await res.json());
+                return {
+                    status: 200,
+                    distTags: data['dist-tags'] ?? {},
+                    versions: data.versions ? Object.keys(data.versions) : [],
+                };
+            }
+            catch (err) {
+                return {
+                    status: 0,
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}
+//# sourceMappingURL=resolvers.js.map

package/node_modules/@microwiseai/install-preflight/dist/resolvers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvers.js","sourceRoot":"","sources":["../src/resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;AAC/C,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAoC,EAAE;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,OAAwB;YACzD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACnE,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACvE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClC,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACzD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC9C,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAC/D,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;gBACF,OAAO;oBACL,MAAM,EAAE,GAAG;oBACX,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;oBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;iBAC1D,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,MAAM,EAAE,CAAC;oBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}