@microwiseai/snapshot 0.6.0 → 0.8.0

package/dist/lib/ledger.js

@@ -0,0 +1,266 @@
+import { execSync } from 'child_process';
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
+import { dirname, join } from 'path';
+import { getConfig } from './config.js';
+/**
+ * ============================================================
+ * Install Ledger (S3 — beta-pipeline-robustness-2026-08-30 §4)
+ * ============================================================
+ *
+ * Records, at the END of an install, the provenance of every npm package that
+ * was installed: the manifest pin we asked for (`expected`), the version that
+ * actually landed on disk (`resolved`), the tarball URL it came from, the
+ * installer/step that produced it, and the ordered list of install steps.
+ *
+ * Goal (AC3.1): after any install, "이 버전이 어디서 왔나" ("where did this
+ * version come from?") is answerable from the ledger ALONE — no reverse
+ * engineering of the global node_modules.
+ *
+ * SCHEMA OWNERSHIP (manager freeze 2026-08-30): this file is the SSOT for the
+ * ledger schema; ledger.json is owned by S3 (this worker). Field names follow
+ * the 기획서. S1 (verify) and FB (pin override) live in verify-owned libs and
+ * do NOT own this schema. Dependency direction is one-way (verify → ledger):
+ * ledger.ts imports NOTHING from install-verify.ts / pin-override.ts.
+ *
+ * Writing the ledger MUST NOT break an install — every entry point here is
+ * best-effort and swallows its own errors.
+ */
+/** Current ledger schema version. Bump on breaking field changes. */
+export const LEDGER_SCHEMA_VERSION = 1;
+/**
+ * Accumulates install steps in execution order. One instance per install;
+ * threaded through installSnapshot via InstallSnapshotOptions.recorder.
+ */
+export class StepRecorder {
+    steps = [];
+    record(step) {
+        this.steps.push({ order: this.steps.length + 1, ...step });
+    }
+    getSteps() {
+        return this.steps.slice();
+    }
+}
+/** Path to the ledger file (sits next to current.json). */
+export function getLedgerPath() {
+    const config = getConfig();
+    return join(config.configDir, 'ledger.json');
+}
+/**
+ * Query the globally-installed version + tarball URL for the given package
+ * names via a single `npm ls -g ... --json` call, and return the raw tree too.
+ * Best-effort: on total failure returns an all-null map and raw=null.
+ *
+ * NOTE: this is provenance extraction (version + tarball + raw tree), NOT the
+ * verify worker's single-name readInstalledNpmVersion(). No duplication of
+ * that helper — S3 never imports install-verify.
+ */
+export function queryResolvedVersions(names) {
+    const map = new Map();
+    if (names.length === 0)
+        return { map, raw: null };
+    const parse = (text) => {
+        const data = JSON.parse(text);
+        const deps = data.dependencies || {};
+        for (const name of names) {
+            const node = deps[name];
+            map.set(name, { version: node?.version ?? null, tarballUrl: node?.resolved ?? null });
+        }
+        lastRaw = data;
+        return true;
+    };
+    let lastRaw = null;
+    try {
+        // --json gives { dependencies: { "<name>": { version, resolved } } }.
+        // depth=0 keeps the tree shallow (top-level globals only).
+        const cmd = `npm ls -g ${names.map((n) => JSON.stringify(n)).join(' ')} --json --depth=0`;
+        const out = execSync(cmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        parse(out);
+        return { map, raw: lastRaw };
+    }
+    catch (err) {
+        // `npm ls` exits non-zero on peer/extraneous warnings yet still prints valid
+        // JSON on stdout — recover it before giving up.
+        const stdout = err?.stdout;
+        if (stdout) {
+            try {
+                parse(stdout.toString());
+                return { map, raw: lastRaw };
+            }
+            catch {
+                /* fall through */
+            }
+        }
+        for (const name of names)
+            map.set(name, { version: null, tarballUrl: null });
+        return { map, raw: null };
+    }
+}
+/**
+ * Derive the canonical npm tarball URL for a resolved package.
+ *
+ * npm 7+ does NOT persist the fetched tarball URL for global installs
+ * (`npm ls -g --json` omits `resolved`, package.json is stripped of `_resolved`,
+ * and there is no global lockfile). So when the authoritative URL is missing we
+ * reconstruct the standard registry path — the same one npm would fetch from the
+ * scope's configured registry:  `<registry>/<name>/-/<unscoped>-<version>.tgz`.
+ *
+ * Returns null when the version is unknown (nothing to point at). Best-effort:
+ * the registry is the one configured for the scope during install (registry-proxy).
+ */
+export function deriveTarballUrl(registry, name, version) {
+    if (!version)
+        return null;
+    if (!registry)
+        return null;
+    const base = registry.replace(/\/+$/, '');
+    // Scoped "@ist/sesh" → unscoped "sesh"; unscoped "foo" → "foo".
+    const unscoped = name.includes('/') ? name.slice(name.indexOf('/') + 1) : name;
+    return `${base}/${name}/-/${unscoped}-${version}.tgz`;
+}
+/**
+ * Capture a DEEP dependency tree (`npm ls -g <names> --json --all`) for the
+ * ledger's `dependencyTreeRaw` and for coreFloorAssert (AC1.4).
+ *
+ * ★ Deliberately NOT `--depth=0`: nested copies must be visible (an old
+ * @ist/adapters-core buried under another package is exactly what re-fragments
+ * the registry). To avoid the cost of dumping the ENTIRE global tree, we scope
+ * the query to the install's npm packages + the singleton package — with filter
+ * args, `npm ls` prunes to the paths that reach those names (full depth), which
+ * is bounded yet still surfaces every nested copy of the targets.
+ *
+ * Best-effort: returns null on failure (ledger writing never fails an install).
+ */
+export function queryDependencyTree(names) {
+    if (names.length === 0)
+        return null;
+    const args = names.map((n) => JSON.stringify(n)).join(' ');
+    const cmd = `npm ls -g ${args} --json --all`;
+    try {
+        const out = execSync(cmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        return JSON.parse(out);
+    }
+    catch (err) {
+        // `npm ls` exits non-zero on peer/extraneous warnings yet still prints valid
+        // JSON on stdout — recover it before giving up.
+        const stdout = err?.stdout;
+        if (stdout) {
+            try {
+                return JSON.parse(stdout.toString());
+            }
+            catch {
+                /* fall through */
+            }
+        }
+        return null;
+    }
+}
+/** Derive the registry host label from a tarball URL, for resolutionSource. */
+function registryHostOf(tarballUrl, fallback) {
+    if (!tarballUrl)
+        return fallback;
+    try {
+        return new URL(tarballUrl).host;
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Find the step (if any) whose specs targeted this package name. */
+function findInstallingStep(name, steps) {
+    // Prefer the LAST step that targeted the package: fallbacks run after a failed
+    // batch, so the later step is the authoritative one.
+    let found;
+    for (const step of steps) {
+        if (step.specs.some((s) => s === name || s.startsWith(`${name}@`))) {
+            found = step;
+        }
+    }
+    return found;
+}
+/**
+ * Assemble the ledger: query disk for resolved versions/tarballs, then join
+ * against the expected pins and install steps to explain each package's origin.
+ * `now` is injected (callers stamp the timestamp) to keep this pure/testable.
+ * `resolver` is injectable for tests; defaults to the real `npm ls -g` query.
+ */
+export function buildLedger(input, now, resolver = queryResolvedVersions) {
+    const names = Object.keys(input.expected);
+    const { map: resolvedMap, raw } = resolver(names);
+    // Prefer the injected DEEP tree (nested-visible) for dependencyTreeRaw; the
+    // resolver's shallow (--depth=0) tree is only a fallback for provenance.
+    const dependencyTreeRaw = input.dependencyTreeRaw !== undefined ? input.dependencyTreeRaw : raw;
+    const packages = [...names].sort().map((name) => {
+        const expected = input.expected[name] ?? null;
+        const resolvedInfo = resolvedMap.get(name) ?? { version: null, tarballUrl: null };
+        const resolved = resolvedInfo.version;
+        // Prefer the authoritative tarball URL from `npm ls` if present; npm 7+ does
+        // not persist it for globals, so fall back to the canonical registry path
+        // derived from the configured registry + resolved version (provenance
+        // completeness). null only when the version itself is unknown.
+        const tarballUrl = resolvedInfo.tarballUrl ?? deriveTarballUrl(input.registry, name, resolved);
+        const step = findInstallingStep(name, input.steps);
+        const host = registryHostOf(tarballUrl, registryHostOf(input.registry, input.registry));
+        const parts = [];
+        parts.push(resolved
+            ? `resolved ${resolved} from ${host}`
+            : `not found on disk (expected ${expected ?? 'unknown'})`);
+        if (step) {
+            parts.push(`via ${step.installer} (${step.phase} step #${step.order}, ${step.result})`);
+        }
+        else {
+            parts.push(`via ${input.installer}`);
+        }
+        if (expected && resolved && expected !== resolved) {
+            parts.push(`⚠ manifest expected ${expected} — DIVERGED`);
+        }
+        else if (expected) {
+            parts.push(`manifest pin ${expected}`);
+        }
+        return {
+            name,
+            expected,
+            resolved,
+            tarballUrl,
+            resolutionSource: parts.join('; '),
+            installer: step?.installer ?? input.installer,
+        };
+    });
+    return {
+        schemaVersion: LEDGER_SCHEMA_VERSION,
+        snapshot: { name: input.snapshotName, version: input.snapshotVersion },
+        recordedAt: now,
+        cliVersion: input.cliVersion,
+        registry: input.registry,
+        packages,
+        installSteps: input.steps,
+        overrides: input.overrides ?? {},
+        dependencyTreeRaw,
+    };
+}
+/** Write the ledger to disk. Best-effort — never throws into the caller. */
+export function writeLedger(ledger) {
+    try {
+        const path = getLedgerPath();
+        const dir = dirname(path);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        writeFileSync(path, JSON.stringify(ledger, null, 2));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read the ledger from disk, or null if absent/unreadable. */
+export function readLedger() {
+    try {
+        const path = getLedgerPath();
+        if (!existsSync(path))
+            return null;
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=ledger.js.map

package/dist/lib/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../src/lib/ledger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAU,CAAC;AA+FhD;;;GAGG;AACH,MAAM,OAAO,YAAY;IACf,KAAK,GAAiB,EAAE,CAAC;IAEjC,MAAM,CAAC,IAA+B;QACpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAeD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAe;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiE,CAAC;IACrF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAElD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAW,EAAE;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,OAAO,GAAmB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1F,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClF,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,6EAA6E;QAC7E,gDAAgD;QAChD,MAAM,MAAM,GAAI,GAAoC,EAAE,MAAM,CAAC;QAC7D,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACzB,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,IAAY,EACZ,OAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,OAAO,GAAG,IAAI,IAAI,IAAI,MAAM,QAAQ,IAAI,OAAO,MAAM,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAe;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,aAAa,IAAI,eAAe,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,6EAA6E;QAC7E,gDAAgD;QAChD,MAAM,MAAM,GAAI,GAAoC,EAAE,MAAM,CAAC;QAC7D,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,UAAyB,EAAE,QAAgB;IACjE,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAmB;IAC3D,+EAA+E;IAC/E,qDAAqD;IACrD,IAAI,KAA6B,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YACnE,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,KAAuB,EACvB,GAAW,EACX,WAA+C,qBAAqB;IAEpE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC;IAEhG,MAAM,QAAQ,GAAoB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC9C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC;QACtC,6EAA6E;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,QAAQ;YACN,CAAC,CAAC,YAAY,QAAQ,SAAS,IAAI,EAAE;YACrC,CAAC,CAAC,+BAA+B,QAAQ,IAAI,SAAS,GAAG,CAC5D,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,uBAAuB,QAAQ,aAAa,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,QAAQ;YACR,UAAU;YACV,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,KAAK,CAAC,SAAS;SAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE,qBAAqB;QACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE;QACtE,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,KAAK;QACzB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QAChC,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAkB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/pin-override.d.ts

@@ -0,0 +1,53 @@
+/**
+ * FB — Pin override fallback (hotfix path).
+ *
+ * `snapshot install @ist/beta --pin @ist/sesh@0.4.0` (repeatable) lets an owner
+ * override a single package's version WITHOUT re-publishing the whole manifest.
+ * This is the "1-package hotfix / pullback" lever from
+ * architecture/beta-pipeline-robustness-2026-08-30 §4 (FB).
+ *
+ * Overrides are exact-pin only (same reproducibility rule as publish) and are
+ * recorded in the install ledger so the override leaves a trace (AC FB.2).
+ */
+export interface PinOverride {
+    name: string;
+    version: string;
+}
+/** Thrown when a --pin spec is malformed (fail-loud; never silently ignored). */
+export declare class PinParseError extends Error {
+}
+/**
+ * Parse a single `--pin` spec of the form `<name>@<exact-version>`.
+ *
+ * Handles scoped names ("@ist/sesh@0.4.0") by splitting on the LAST '@'. The
+ * version must be an exact semver — ranges/tags/wildcards are rejected so an
+ * override cannot re-introduce the non-determinism it exists to fix.
+ */
+export declare function parsePin(spec: string): PinOverride;
+/**
+ * Parse a repeatable list of `--pin` specs into an override map (name → version).
+ * A later spec for the same name wins (last-write). Throws on the first invalid
+ * spec (fail-loud).
+ */
+export declare function parsePins(specs: string[] | undefined): Record<string, string>;
+/**
+ * Apply pin overrides to an install map, returning a NEW map (input untouched).
+ * Only overrides packages that are already present in the map — an override for
+ * a package the snapshot doesn't declare is surfaced by the caller (see
+ * `unmatchedOverrides`) rather than silently injected.
+ */
+export declare function applyPinOverrides(installMap: Record<string, string>, overrides: Record<string, string>): Record<string, string>;
+/**
+ * Return the override names that did NOT match any package in the install map.
+ * The caller warns on these (a --pin for a package not in the snapshot is almost
+ * always a typo).
+ */
+export declare function unmatchedOverrides(installMap: Record<string, string>, overrides: Record<string, string>): string[];
+/**
+ * The effective version for a package given a set of overrides — the override
+ * if one exists, otherwise the manifest version. Used to thread overrides
+ * through the recursive installer so a base-snapshot layer cannot clobber an
+ * override with its original pin.
+ */
+export declare function effectiveVersion(name: string, version: string, overrides: Record<string, string>): string;
+//# sourceMappingURL=pin-override.d.ts.map

package/dist/lib/pin-override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-override.d.ts","sourceRoot":"","sources":["../../src/lib/pin-override.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iFAAiF;AACjF,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAE3C;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAqBlD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ7E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,MAAM,EAAE,CAEV;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,MAAM,CAER"}

package/dist/lib/pin-override.js

@@ -0,0 +1,77 @@
+import { isExactSemver } from './version-validator.js';
+/** Thrown when a --pin spec is malformed (fail-loud; never silently ignored). */
+export class PinParseError extends Error {
+}
+/**
+ * Parse a single `--pin` spec of the form `<name>@<exact-version>`.
+ *
+ * Handles scoped names ("@ist/sesh@0.4.0") by splitting on the LAST '@'. The
+ * version must be an exact semver — ranges/tags/wildcards are rejected so an
+ * override cannot re-introduce the non-determinism it exists to fix.
+ */
+export function parsePin(spec) {
+    const trimmed = spec.trim();
+    const atIdx = trimmed.lastIndexOf('@');
+    // atIdx <= 0 → no version separator, or only the leading scope '@'.
+    if (atIdx <= 0) {
+        throw new PinParseError(`Invalid --pin "${spec}": expected <name>@<version> (e.g. @ist/sesh@0.4.0)`);
+    }
+    const name = trimmed.substring(0, atIdx);
+    const version = trimmed.substring(atIdx + 1);
+    if (!name) {
+        throw new PinParseError(`Invalid --pin "${spec}": missing package name`);
+    }
+    if (!isExactSemver(version)) {
+        throw new PinParseError(`Invalid --pin "${spec}": "${version}" is not an exact semver ` +
+            `(ranges, tags, and wildcards are not allowed for overrides)`);
+    }
+    return { name, version };
+}
+/**
+ * Parse a repeatable list of `--pin` specs into an override map (name → version).
+ * A later spec for the same name wins (last-write). Throws on the first invalid
+ * spec (fail-loud).
+ */
+export function parsePins(specs) {
+    const overrides = {};
+    if (!specs)
+        return overrides;
+    for (const spec of specs) {
+        const { name, version } = parsePin(spec);
+        overrides[name] = version;
+    }
+    return overrides;
+}
+/**
+ * Apply pin overrides to an install map, returning a NEW map (input untouched).
+ * Only overrides packages that are already present in the map — an override for
+ * a package the snapshot doesn't declare is surfaced by the caller (see
+ * `unmatchedOverrides`) rather than silently injected.
+ */
+export function applyPinOverrides(installMap, overrides) {
+    const out = { ...installMap };
+    for (const [name, version] of Object.entries(overrides)) {
+        if (name in out) {
+            out[name] = version;
+        }
+    }
+    return out;
+}
+/**
+ * Return the override names that did NOT match any package in the install map.
+ * The caller warns on these (a --pin for a package not in the snapshot is almost
+ * always a typo).
+ */
+export function unmatchedOverrides(installMap, overrides) {
+    return Object.keys(overrides).filter((name) => !(name in installMap));
+}
+/**
+ * The effective version for a package given a set of overrides — the override
+ * if one exists, otherwise the manifest version. Used to thread overrides
+ * through the recursive installer so a base-snapshot layer cannot clobber an
+ * override with its original pin.
+ */
+export function effectiveVersion(name, version, overrides) {
+    return overrides[name] ?? version;
+}
+//# sourceMappingURL=pin-override.js.map

package/dist/lib/pin-override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-override.js","sourceRoot":"","sources":["../../src/lib/pin-override.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAmBvD,iFAAiF;AACjF,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,oEAAoE;IACpE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CACrB,kBAAkB,IAAI,qDAAqD,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,aAAa,CAAC,kBAAkB,IAAI,yBAAyB,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CACrB,kBAAkB,IAAI,OAAO,OAAO,2BAA2B;YAC7D,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAA2B;IACnD,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC5B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkC,EAClC,SAAiC;IAEjC,MAAM,GAAG,GAA2B,EAAE,GAAG,UAAU,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAkC,EAClC,SAAiC;IAEjC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAe,EACf,SAAiC;IAEjC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;AACpC,CAAC"}

package/dist/lib/skit-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skit-adapter.d.ts","sourceRoot":"","sources":["../../src/lib/skit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA8DD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AA+DD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAyD5B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAO5C;AAED;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;CACnC,CAAC,CASD"}
+{"version":3,"file":"skit-adapter.d.ts","sourceRoot":"","sources":["../../src/lib/skit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA8DD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAgFD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA8E5B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAO5C;AAED;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;CACnC,CAAC,CASD"}

package/dist/lib/skit-adapter.js

@@ -10,7 +10,7 @@
  * - SKIT_REGISTRY: registry-proxy URL
  */
 import { execSync } from 'child_process';
-import { REGISTRY_PROXY_URL } from './config.js';
+import { REGISTRY_PROXY_URL, getInstallerGroupFromEnv } from './config.js';
 // ============================================================
 // Lib Loader
 // ============================================================
@@ -85,13 +85,28 @@ function installSkitViaCli(spec, options) {
     if (!options?.silent) {
         options?.onProgress?.(`[skit-cli] ${command}`);
     }
-    // Build environment variables for skit CLI
-    // SKIT_SESSION_ID: registry-proxy session (skit doesn't know LICENSE_KEY)
-    // SKIT_REGISTRY: registry-proxy URL
+    // Build environment variables for skit CLI. Two independent injection groups
+    // (generality-contract-r1):
     const env = {};
+    // Group A — registry/proxy: sessionId-GATED (licensing-entangled; behavior
+    // unchanged). Also forward the common-env name IST_REGISTRY_URL alongside the
+    // existing SKIT_REGISTRY. Both carry the same resolved URL.
     if (options?.sessionId) {
         env['SKIT_SESSION_ID'] = options.sessionId;
         env['SKIT_REGISTRY'] = REGISTRY_PROXY_URL;
+        env['IST_REGISTRY_URL'] = REGISTRY_PROXY_URL;
+    }
+    // Group B — host/group routing: PASSTHROUGH-ONLY, sessionId-INDEPENDENT.
+    // Forward only values originating from env/manifest, NEVER snapshot's own
+    // built-in owner fallback (each tool's fallback is its single authority).
+    //  - IST_GITLAB_HOST: snapshot owns no host; forward only when env is present.
+    //  - IST_GITLAB_GROUP: forward only the env-origin value (getInstallerGroupFromEnv).
+    if (process.env.IST_GITLAB_HOST) {
+        env['IST_GITLAB_HOST'] = process.env.IST_GITLAB_HOST;
+    }
+    const groupFromEnv = getInstallerGroupFromEnv();
+    if (groupFromEnv) {
+        env['IST_GITLAB_GROUP'] = groupFromEnv;
     }
     const result = runSkitCli(command, Object.keys(env).length > 0 ? env : undefined);
     return {
@@ -118,18 +133,40 @@ export async function installSkitPackage(name, version, options) {
     const lib = await loadSkitLib();
     if (lib) {
         try {
-            // Set session environment variables for lib call
-            // skit lib reads SKIT_SESSION_ID and SKIT_REGISTRY from process.env
-            const prevSessionId = process.env.SKIT_SESSION_ID;
-            const prevRegistry = process.env.SKIT_REGISTRY;
+            // Set routing environment variables for the in-process lib call. skit lib
+            // reads these from process.env. Same two-group split as the CLI path
+            // (generality-contract-r1). Snapshot every key we may touch up-front and
+            // restore ALL of them in finally — no leak into the host process.
+            const TOUCHED_ENV_KEYS = [
+                'SKIT_SESSION_ID',
+                'SKIT_REGISTRY',
+                'IST_REGISTRY_URL',
+                'IST_GITLAB_HOST',
+                'IST_GITLAB_GROUP',
+            ];
+            const savedEnv = {};
+            for (const key of TOUCHED_ENV_KEYS) {
+                savedEnv[key] = process.env[key];
+            }
+            // Group A — registry/proxy: sessionId-GATED (behavior unchanged) + common
+            // env name IST_REGISTRY_URL.
             if (options?.sessionId) {
                 process.env.SKIT_SESSION_ID = options.sessionId;
                 process.env.SKIT_REGISTRY = REGISTRY_PROXY_URL;
+                process.env.IST_REGISTRY_URL = REGISTRY_PROXY_URL;
                 console.log(`[skit-adapter] Using session: ${options.sessionId.substring(0, 8)}...`);
             }
             else {
                 console.log(`[skit-adapter] No sessionId provided`);
             }
+            // Group B — host/group routing: PASSTHROUGH-ONLY, sessionId-INDEPENDENT.
+            // IST_GITLAB_HOST needs no assignment in-process (the lib reads the same
+            // process.env passthrough directly); forward only env-origin group, never
+            // snapshot's own built-in owner fallback.
+            const groupFromEnv = getInstallerGroupFromEnv();
+            if (groupFromEnv) {
+                process.env.IST_GITLAB_GROUP = groupFromEnv;
+            }
             try {
                 const libResult = await lib.installSkit(spec, {
                     onProgress: options?.silent ? undefined : options?.onProgress,
@@ -143,18 +180,15 @@ export async function installSkitPackage(name, version, options) {
                 };
             }
             finally {
-                // Restore previous environment
-                if (prevSessionId !== undefined) {
-                    process.env.SKIT_SESSION_ID = prevSessionId;
-                }
-                else {
-                    delete process.env.SKIT_SESSION_ID;
-                }
-                if (prevRegistry !== undefined) {
-                    process.env.SKIT_REGISTRY = prevRegistry;
-                }
-                else {
-                    delete process.env.SKIT_REGISTRY;
+                // Restore previous environment for EVERY touched key (no omissions).
+                for (const key of TOUCHED_ENV_KEYS) {
+                    const prev = savedEnv[key];
+                    if (prev !== undefined) {
+                        process.env[key] = prev;
+                    }
+                    else {
+                        delete process.env[key];
+                    }
                 }
             }
         }

package/dist/lib/skit-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"skit-adapter.js","sourceRoot":"","sources":["../../src/lib/skit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA4CjD,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAE/D,IAAI,OAAO,GAAmB,IAAI,CAAC;AACnC,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;GAGG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gBAAgB,GAAG,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEnD,6BAA6B;QAC7B,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC3C,OAAO,GAAG;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uCAAuC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,GAAG,IAAI,CAAC;IACf,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC;AAED,+DAA+D;AAC/D,eAAe;AACf,+DAA+D;AAE/D,SAAS,UAAU,CAAC,OAAe,EAAE,GAA4B;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;SACpD,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAA4B;IACnE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,OAAe,CAAC;IAEpB,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,IAAI,CAAC;QACZ,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,UAAU,EAAE,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,2CAA2C;IAC3C,0EAA0E;IAC1E,oCAAoC;IACpC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC3C,GAAG,CAAC,eAAe,CAAC,GAAG,kBAAkB,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAElF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,OAAO,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,OAAe,EACf,OAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnD,gBAAgB;IAChB,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAEhC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,iDAAiD;YACjD,oEAAoE;YACpE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAE/C,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,kBAAkB,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC5C,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU;iBAC9D,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;oBAC5B,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO;oBACrC,aAAa,EAAE,SAAS,CAAC,IAAI;oBAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;iBACvB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,+BAA+B;gBAC/B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,aAAa,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBACN,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;gBACrC,CAAC;gBACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC/B,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,YAAY,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uCAAuC;YACvC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,uDAAuD,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,eAAe;IACf,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAChC,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAKvC,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;KAC9C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"skit-adapter.js","sourceRoot":"","sources":["../../src/lib/skit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AA4C3E,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAE/D,IAAI,OAAO,GAAmB,IAAI,CAAC;AACnC,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;GAGG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gBAAgB,GAAG,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEnD,6BAA6B;QAC7B,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC3C,OAAO,GAAG;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uCAAuC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,GAAG,IAAI,CAAC;IACf,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC;AAED,+DAA+D;AAC/D,eAAe;AACf,+DAA+D;AAE/D,SAAS,UAAU,CAAC,OAAe,EAAE,GAA4B;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;SACpD,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAA4B;IACnE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,OAAe,CAAC;IAEpB,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,IAAI,CAAC;QACZ,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,UAAU,EAAE,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,6EAA6E;IAC7E,4BAA4B;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,2EAA2E;IAC3E,8EAA8E;IAC9E,4DAA4D;IAC5D,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC3C,GAAG,CAAC,eAAe,CAAC,GAAG,kBAAkB,CAAC;QAC1C,GAAG,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,+EAA+E;IAC/E,qFAAqF;IACrF,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,GAAG,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACvD,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAElF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,OAAO,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,OAAe,EACf,OAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnD,gBAAgB;IAChB,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAEhC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,gBAAgB,GAAG;gBACvB,iBAAiB;gBACjB,eAAe;gBACf,kBAAkB;gBAClB,iBAAiB;gBACjB,kBAAkB;aACV,CAAC;YACX,MAAM,QAAQ,GAAuC,EAAE,CAAC;YACxD,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;YAED,0EAA0E;YAC1E,6BAA6B;YAC7B,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,kBAAkB,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,kBAAkB,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;YAED,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,0CAA0C;YAC1C,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;YAChD,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,YAAY,CAAC;YAC9C,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC5C,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU;iBAC9D,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;oBAC5B,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO;oBACrC,aAAa,EAAE,SAAS,CAAC,IAAI;oBAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;iBACvB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,qEAAqE;gBACrE,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uCAAuC;YACvC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,uDAAuD,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,eAAe;IACf,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAChC,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAKvC,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;KAC9C,CAAC;AACJ,CAAC"}

package/dist/lib/transitive-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transitive-resolver.d.ts","sourceRoot":"","sources":["../../src/lib/transitive-resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,GAAG,CAAC,EAAE,KAAK,CAAC;YACV,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,uCAAuC;IACvC,GAAG,EAAE,eAAe,EAAE,CAAC;IACvB,sBAAsB;IACtB,IAAI,EAAE,eAAe,EAAE,CAAC;IACxB,kBAAkB;IAClB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAYD;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAmWD,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,0BAA0B,CAAC,CAqDrC;AAMD,MAAM,WAAW,6BAA6B;IAC5C,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,6BAA6B,CAAC,CAiGxC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}
+{"version":3,"file":"transitive-resolver.d.ts","sourceRoot":"","sources":["../../src/lib/transitive-resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,GAAG,CAAC,EAAE,KAAK,CAAC;YACV,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,uCAAuC;IACvC,GAAG,EAAE,eAAe,EAAE,CAAC;IACvB,sBAAsB;IACtB,IAAI,EAAE,eAAe,EAAE,CAAC;IACxB,kBAAkB;IAClB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAYD;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAmWD,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,0BAA0B,CAAC,CA+DrC;AAMD,MAAM,WAAW,6BAA6B;IAC5C,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,6BAA6B,CAAC,CAiGxC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/lib/transitive-resolver.js

@@ -294,7 +294,12 @@ async function resolveNpmTransitiveDeps(packages, scopes, groupId) {
  * options.scopes가 지정되면 해당 값 사용, 아니면 수집된 scopeGroups 사용
  */
 export async function resolveAllDependencies(snapshotName, options = {}) {
-    const { resolveTransitive = true, scopes: providedScopes, groupId = GITLAB_GROUP_ID, } = options;
+    const { resolveTransitive = true, scopes: providedScopes, 
+    // NOTE: do NOT default to GITLAB_GROUP_ID here. Pre-filling the installer
+    // group as the default masked the author group (manifest registry[scope].group)
+    // at the call-site below. Per generality-contract, group precedence is
+    // author-first → installer → owner fallback (see effectiveGroupId).
+    groupId: explicitGroupId, } = options;
     const ctx = {
         visitedSnapshots: new Set(),
         visitedSkits: new Set(),
@@ -312,8 +317,14 @@ export async function resolveAllDependencies(snapshotName, options = {}) {
         const effectiveScopes = providedScopes || Array.from(ctx.scopeGroups.keys());
         // 추적 대상 스코프의 패키지만 transitive 해석
         const trackedPackages = npmPackages.filter(p => effectiveScopes.some(scope => p.name.startsWith(scope)));
-        // snapshot.registry에서 수집한 group 또는 옵션에서 제공된 groupId 사용
-        const effectiveGroupId = groupId || Array.from(ctx.scopeGroups.values())[0] || '';
+        // Group precedence (generality-contract): author-first → installer → owner.
+        //   1. explicitGroupId  — per-invocation override (highest)
+        //   2. author group     — manifest registry[scope].group (ctx.scopeGroups)
+        //   3. installer/owner  — GITLAB_GROUP_ID const (IST_GITLAB_GROUP env →
+        //                         GITLAB_GROUP_ID legacy → owner fallback)
+        // Owner manifests declare the owner group, so no-config runs stay identical.
+        const authorGroup = Array.from(ctx.scopeGroups.values())[0];
+        const effectiveGroupId = explicitGroupId || authorGroup || GITLAB_GROUP_ID || '';
         if (trackedPackages.length > 0 && effectiveGroupId && effectiveScopes.length > 0) {
             const resolved = await resolveNpmTransitiveDeps(trackedPackages, effectiveScopes, effectiveGroupId);
             // 기존 수집된 것과 merge