@microwiseai/snapshot 0.8.0 → 0.9.0

package/dist/lib/access-sync.js

@@ -1,260 +1,434 @@
 /**
- * Access Sync - Synchronize snapshot package access with license-api
+ * Install-set closure resolver (formerly "access sync").
  *
- * When a snapshot is published, this module registers all packages
- * in the snapshot's install list with the appropriate access level.
- */
-import chalk from 'chalk';
-import { LICENSE_API_URL, GITLAB_GROUP_ID, REGISTRY_PROXY_URL } from './config.js';
-/**
- * Resolve the admin API key from the environment.
+ * Walks a snapshot's install-set dependency closure through the registry-proxy.
+ * The result feeds access-index.json (see ./access-index.ts), the serving SSOT
+ * that registry-proxy reads to grant snapshot members.
  *
- * LICENSE_API_ADMIN_KEY is required. There is intentionally NO fallback —
- * a missing key must fail loudly rather than silently using a weak default.
+ * The former license-api write path (POST /admin/package-access/with-deps,
+ * LICENSE_API_ADMIN_KEY) was retired by the 2026-09-28 owner decision
+ * (global state `snapshot-tier-access`, `owner-decision-2026-09-28-proxy-snapshot-driven`):
+ * "license-api package_access 에 snapshot 의존 패키지를 등록하지 않음(access-sync 의
+ * license-api 쓰기 경로 폐기)". Nothing in this module writes anywhere.
  */
-function getAdminApiKey() {
-    const key = process.env.LICENSE_API_ADMIN_KEY;
-    if (!key) {
-        throw new Error('LICENSE_API_ADMIN_KEY environment variable is required for package access sync. ' +
-            'Set it before running access sync.');
-    }
-    return key;
+import chalk from 'chalk';
+import { createGunzip } from 'zlib';
+import { Readable } from 'stream';
+import { extract } from 'tar-stream';
+import { maxSatisfying, parseVersion } from './semver-range.js';
+import { REGISTRY_PROXY_URL, getLicenseKey, getProxyAuthToken } from './config.js';
+import { cachedGenericVersions, fetchGitlabGenericTarball, fetchGitlabPackument, } from './gitlab-publisher.js';
+function proxyAuthHeaders() {
+    const token = getLicenseKey() || getProxyAuthToken();
+    return token ? { Authorization: `Bearer ${token}` } : {};
 }
 /**
- * Parse package name into scope and name
- * @example "@ist/loggable-cli" -> { scope: "@ist", name: "loggable-cli" }
+ * Normalize a dependency spec. Handles `npm:` aliases (install the real
+ * package) and `workspace:`; other protocols (file:, git, url, link:) are not
+ * registry packages → null.
  */
-function parsePackageName(fullName) {
-    const match = fullName.match(/^(@[^/]+)\/(.+)$/);
-    if (!match)
+function normalizeSpec(name, spec) {
+    let s = (spec ?? '').trim();
+    if (s.startsWith('npm:')) {
+        const m = /^npm:(@?[^@]+)(?:@(.*))?$/.exec(s);
+        if (!m)
+            return null;
+        return { name: m[1], spec: m[2] ?? 'latest' };
+    }
+    if (s.startsWith('workspace:'))
+        s = s.slice('workspace:'.length);
+    if (/^(file:|link:|git\+|git:|https?:|github:)/.test(s) || /^[^@\s]+\/[^\s]+$/.test(s))
         return null;
-    return { scope: match[1], name: match[2] };
-}
-/**
- * Convert SnapshotAccess to license-api access level
- */
-function getAccessLevel(access) {
-    if (!access)
-        return 'licensed'; // Default to licensed
-    if (access === 'public')
-        return 'public';
-    if (access === 'authenticated')
-        return 'authenticated';
-    if (typeof access === 'object' && access.type === 'licensed')
-        return 'licensed';
-    return 'licensed';
+    return { name, spec: s === '' ? '*' : s };
 }
 /**
- * Get product ID from access config (for licensed packages)
+ * Resolve a spec against a version list: dist-tag → exact → highest version
+ * satisfying the range (prerelease allowed only for prerelease pins).
+ * @internal Exported for testing
  */
-function getProductId(access) {
-    if (typeof access === 'object' && access.type === 'licensed') {
-        return access.productId;
-    }
-    return undefined;
+export function resolveSpecVersion(versions, distTags, spec) {
+    if (distTags[spec])
+        return distTags[spec];
+    if (versions.includes(spec))
+        return spec;
+    return maxSatisfying(versions, spec);
 }
-/**
- * Register a package with license-api via a single idempotent upsert.
- *
- * Uses POST /admin/package-access/with-deps. The (scope, packageName) pair is a
- * unique key on the license-api side, so this call is idempotent — repeated
- * calls update the existing rule instead of creating duplicates. This replaces
- * the previous non-atomic find-then-create (GET + PUT/POST) flow.
- *
- * `dependencies` is intentionally sent as an empty array: access-sync already
- * enumerates the full (transitive) package set on the client side, so the
- * server-side automatic dependency resolution must be disabled to avoid
- * duplicate/conflicting rule creation.
- */
-async function registerPackage(rule) {
-    try {
-        const body = {
-            scope: rule.scope,
-            packageName: rule.packageName,
-            accessLevel: rule.accessLevel,
-            priority: rule.priority ?? 100,
-            description: rule.description,
-            requiredProductIds: rule.requiredProductIds,
-            parentPackage: rule.parentPackage,
-            // Disable server-side auto dependency resolution — the client enumerates
-            // all packages itself and registers each one individually.
-            dependencies: [],
-        };
-        const url = `${LICENSE_API_URL}/admin/package-access/with-deps`;
-        const response = await fetch(url, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-Admin-Api-Key': getAdminApiKey(),
-            },
-            body: JSON.stringify(body),
-        });
-        if (response.ok) {
-            return true;
+async function classifyNpm(name, cache, headers, source = 'proxy') {
+    const cached = cache.get(name);
+    if (cached)
+        return cached;
+    const p = (async () => {
+        if (!name.startsWith('@'))
+            return { kind: 'npmjs' };
+        if (source === 'gitlab') {
+            const r = await fetchGitlabPackument(name);
+            if (r.kind === 'npmjs')
+                return { kind: 'npmjs' };
+            if (r.kind === 'error')
+                return { kind: 'unknown', reason: r.reason };
+            const packument = r.packument;
+            return {
+                kind: 'ours',
+                versions: Object.keys(packument.versions ?? {}),
+                distTags: packument['dist-tags'] ?? {},
+                packument,
+            };
         }
-        const error = await response.json().catch(() => ({}));
-        console.error(chalk.yellow(`  Warning: Failed to upsert ${rule.scope}/${rule.packageName}: ${JSON.stringify(error)}`));
-        return false;
-    }
-    catch (error) {
-        console.error(chalk.yellow(`  Warning: Error with ${rule.scope}/${rule.packageName}: ${error}`));
-        return false;
-    }
+        try {
+            const res = await fetch(`${REGISTRY_PROXY_URL}/${name}`, { headers });
+            if (res.ok) {
+                const packument = (await res.json());
+                return {
+                    kind: 'ours',
+                    versions: Object.keys(packument.versions ?? {}),
+                    distTags: packument['dist-tags'] ?? {},
+                    packument,
+                };
+            }
+            if (res.status === 404)
+                return { kind: 'npmjs' };
+            const vres = await fetch(`${REGISTRY_PROXY_URL}/${name}/versions`, { headers });
+            if (vres.ok) {
+                const v = (await vres.json());
+                return {
+                    kind: 'ours',
+                    versions: v.versions ?? [],
+                    distTags: v.latest ? { latest: v.latest } : {},
+                    packument: null,
+                    packumentStatus: res.status,
+                };
+            }
+            if (vres.status === 404)
+                return { kind: 'npmjs' };
+            return { kind: 'unknown', reason: `HTTP ${res.status}/${vres.status}` };
+        }
+        catch (error) {
+            return { kind: 'unknown', reason: String(error) };
+        }
+    })();
+    cache.set(name, p);
+    return p;
 }
 /**
- * Resolve npm dependencies for a package via registry-proxy
+ * Pick the npm deps (name → spec) a kit's skit.json declares under
+ * `dependencies.npm`. Entries marked `source: "npm"` come from public npmjs
+ * and are excluded. Object entries use their `version` field.
+ * @internal Exported for testing
  */
-async function resolveNpmDeps(packageName) {
-    try {
-        const response = await fetch(`${REGISTRY_PROXY_URL}/resolve-deps`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                packages: [packageName],
-                // owner/admin-only path — intentionally pinned to the owner group + @ist
-                // scope. OUT OF cross-tool generality scope (generality-contract-r1 OQ2):
-                // do NOT generalize these to IST_GITLAB_GROUP / dynamic scopes. The :158
-                // '@ist/' filter below is part of the same owner-only assumption.
-                groupId: GITLAB_GROUP_ID,
-                scopes: ['@ist'],
-                includePeer: false,
-            }),
-        });
-        if (!response.ok) {
-            return [];
+export function kitNpmDeps(skitJson) {
+    const npm = skitJson
+        ?.dependencies?.npm;
+    if (!npm || typeof npm !== 'object')
+        return [];
+    const out = [];
+    for (const [name, spec] of Object.entries(npm)) {
+        if (spec && typeof spec === 'object') {
+            const o = spec;
+            if (o.source === 'npm')
+                continue;
+            out.push([name, o.version ?? 'latest']);
         }
-        const data = await response.json();
-        if (data.success && data.dependencies) {
-            // Filter to only @ist scoped packages
-            return data.dependencies
-                .map(d => d.name)
-                .filter(name => name.startsWith('@ist/'));
+        else {
+            out.push([name, typeof spec === 'string' ? spec : 'latest']);
         }
-        return [];
     }
-    catch {
+    return out;
+}
+/** @internal Exported for testing */
+export function kitNpmDepNames(skitJson) {
+    return kitNpmDeps(skitJson).map(([name]) => name);
+}
+/** Kit → kit deps from skit.json `dependencies.skit`. */
+function kitSkitDeps(skitJson) {
+    const skit = skitJson
+        ?.dependencies?.skit;
+    if (!skit || typeof skit !== 'object')
         return [];
-    }
+    return Object.entries(skit).map(([name, spec]) => [
+        name,
+        typeof spec === 'string' ? spec : (spec?.version ?? 'latest'),
+    ]);
+}
+/** Read skit.json out of a gzipped kit tarball. */
+function extractSkitJsonFromBuffer(buffer) {
+    return new Promise((resolve, reject) => {
+        const extractor = extract();
+        let skitJson = null;
+        extractor.on('entry', (header, stream, next) => {
+            const chunks = [];
+            stream.on('data', (chunk) => chunks.push(chunk));
+            stream.on('end', () => {
+                const name = header.name.replace(/^\.\//, '');
+                // Top-level skit.json only (either at root or under a single wrapper dir).
+                if (skitJson === null && (name === 'skit.json' || /^[^/]+\/skit\.json$/.test(name))) {
+                    try {
+                        skitJson = JSON.parse(Buffer.concat(chunks).toString('utf-8'));
+                    }
+                    catch {
+                        reject(new Error('Failed to parse skit.json'));
+                        return;
+                    }
+                }
+                next();
+            });
+            stream.on('error', reject);
+        });
+        extractor.on('finish', () => {
+            if (skitJson !== null)
+                resolve(skitJson);
+            else
+                reject(new Error('skit.json not found in kit tarball'));
+        });
+        extractor.on('error', reject);
+        Readable.from(buffer).pipe(createGunzip()).on('error', reject).pipe(extractor);
+    });
 }
+const pendingKey = (p) => `${p.kind}:${p.name}@${p.version}`;
 /**
- * Extract all packages from snapshot install config
+ * Walker over the install-set dependency closure (see the block comment
+ * above). `drain()` processes the queue; items whose deps cannot be read
+ * (kit tarball / packument 401, …) are kept in `pending` and reported as gaps.
+ *
+ * With `transitive: false` only declared entries are collected (install.*
+ * members + kit skit.json npm/skit deps); package.json is not descended.
  */
-function extractPackagesFromSnapshot(snapshot) {
-    const packages = [];
-    // New structure: install.<installer>.<package>
-    if (snapshot.install) {
-        for (const installerPackages of Object.values(snapshot.install)) {
-            packages.push(...Object.keys(installerPackages));
+class ClosureWalker {
+    opts;
+    register = new Set();
+    npmjs = new Set();
+    unresolved = [];
+    /** Non-retryable traversal gaps (e.g. no version satisfies the pin). */
+    unmatched = [];
+    pending = new Map();
+    /** `${kind}:${name}` → exact versions resolved by the walk. */
+    resolved = new Map();
+    queue = [];
+    seenSpec = new Set();
+    visited = new Set();
+    cache = new Map();
+    headers;
+    hasToken;
+    constructor(snapshot, opts) {
+        this.opts = opts;
+        // GitLab mode never sends the user's proxy token anywhere.
+        this.headers = opts.source === 'gitlab' ? {} : proxyAuthHeaders();
+        this.hasToken = opts.source === 'gitlab' || 'Authorization' in this.headers;
+        for (const [installer, pkgs] of Object.entries(snapshot.install ?? {})) {
+            const kind = installer === 'skit' ? 'kit' : 'npm';
+            for (const [name, spec] of Object.entries(pkgs))
+                this.queue.push({ kind, name, spec, declared: true });
+        }
+        for (const [name, spec] of Object.entries(snapshot.packages ?? {})) {
+            this.queue.push({ kind: 'npm', name, spec: String(spec), declared: true });
+        }
+        for (const [name, spec] of Object.entries(snapshot.skits ?? {})) {
+            this.queue.push({ kind: 'kit', name, spec, declared: true });
         }
     }
-    // Legacy structure: packages
-    if (snapshot.packages) {
-        packages.push(...Object.keys(snapshot.packages));
+    async drain() {
+        while (this.queue.length > 0) {
+            const item = this.queue.shift();
+            const specKey = `${item.kind}:${item.name}@${item.spec}:${item.declared}`;
+            if (this.seenSpec.has(specKey))
+                continue;
+            this.seenSpec.add(specKey);
+            if (item.kind === 'kit')
+                await this.processKit(item);
+            else
+                await this.processNpm(item);
+        }
     }
-    // Legacy structure: skits
-    if (snapshot.skits) {
-        packages.push(...Object.keys(snapshot.skits));
+    result() {
+        const pending = [...this.pending.values()];
+        return {
+            packages: [...this.register],
+            npmjsExcluded: [...this.npmjs].filter((n) => !this.register.has(n)),
+            skippedKits: pending.filter((p) => p.kind === 'kit').map((p) => `${p.name}@${p.version}`),
+            untraversed: [
+                ...pending.filter((p) => p.kind === 'npm').map((p) => `${p.name}@${p.version} (${p.reason})`),
+                ...this.unmatched,
+            ],
+            unresolved: [...this.unresolved],
+            resolved: [...this.resolved.values()].map((r) => ({ ...r, versions: [...r.versions] })),
+        };
     }
-    return [...new Set(packages)]; // Dedupe
-}
-/**
- * Sync snapshot packages with license-api
- *
- * @param snapshot - Parsed snapshot.json
- * @param options - Sync options
- */
-export async function syncPackageAccess(snapshot, options = {}) {
-    const { verbose = false, dryRun = false, includeTransitive = true } = options;
-    const result = {
-        success: true,
-        registered: [],
-        failed: [],
-        skipped: [],
-    };
-    const accessLevel = getAccessLevel(snapshot.access);
-    const productId = getProductId(snapshot.access);
-    console.log(chalk.cyan(`\nSyncing package access for ${snapshot.name}...`));
-    console.log(chalk.dim(`  Access level: ${accessLevel}`));
-    // 1. Extract direct packages from snapshot
-    const directPackages = extractPackagesFromSnapshot(snapshot);
-    if (verbose) {
-        console.log(chalk.dim(`  Direct packages: ${directPackages.length}`));
+    recordVersion(kind, name, version) {
+        const key = `${kind}:${name}`;
+        const entry = this.resolved.get(key) ?? { name, kind, versions: [] };
+        if (!entry.versions.includes(version))
+            entry.versions.push(version);
+        this.resolved.set(key, entry);
     }
-    // 2. Resolve transitive dependencies if requested
-    let allPackages = [...directPackages];
-    if (includeTransitive) {
-        console.log(chalk.dim('  Resolving transitive dependencies...'));
-        for (const pkg of directPackages) {
-            const deps = await resolveNpmDeps(pkg);
-            allPackages.push(...deps);
+    addPending(item) {
+        this.pending.set(pendingKey(item), item);
+    }
+    async processNpm(item) {
+        if (item.declared)
+            this.register.add(item.name);
+        if (!this.opts.transitive)
+            return;
+        const norm = normalizeSpec(item.name, item.spec);
+        if (!norm) {
+            if (this.opts.verbose)
+                console.log(chalk.dim(`  Skipping non-registry spec ${item.name}@${item.spec}`));
+            return;
+        }
+        const cls = await classifyNpm(norm.name, this.cache, this.headers, this.opts.source);
+        if (cls.kind === 'npmjs') {
+            if (!item.declared)
+                this.npmjs.add(norm.name);
+            return;
         }
-        allPackages = [...new Set(allPackages)]; // Dedupe
-        if (verbose) {
-            console.log(chalk.dim(`  Total packages (with deps): ${allPackages.length}`));
+        if (cls.kind === 'unknown') {
+            console.error(chalk.yellow(`  Warning: could not look up ${norm.name} (${cls.reason})`));
+            this.unresolved.push(`${norm.name} (${cls.reason})`);
+            return;
         }
+        this.register.add(norm.name);
+        let version = resolveSpecVersion(cls.versions, cls.distTags, norm.spec);
+        if (!version) {
+            const fallback = cls.distTags.latest ?? maxSatisfying(cls.versions, '*');
+            console.error(chalk.yellow(`  Warning: no version of ${norm.name} satisfies "${norm.spec}"` +
+                (fallback ? `; traversing ${fallback} instead` : '')));
+            if (!fallback) {
+                this.unmatched.push(`${norm.name}@${norm.spec} (no matching version)`);
+                return;
+            }
+            // Not an exact resolution: the install would not get this version, so it
+            // is a gap (not recorded in `resolved`), but deps are still walked.
+            this.unmatched.push(`${norm.name}@${norm.spec} (no matching version; traversed ${fallback})`);
+            version = fallback;
+        }
+        else {
+            this.recordVersion('npm', norm.name, version);
+        }
+        const key = `npm:${norm.name}@${version}`;
+        if (this.visited.has(key))
+            return;
+        this.visited.add(key);
+        const manifest = cls.packument?.versions?.[version];
+        if (!manifest) {
+            const reason = cls.packument
+                ? 'version missing from packument'
+                : `packument HTTP ${cls.packumentStatus}${this.hasToken ? '' : ', 토큰 없음'}`;
+            console.error(chalk.yellow(`  Warning: deps of ${norm.name}@${version} not traversed (${reason})`));
+            this.addPending({ kind: 'npm', name: norm.name, version, reason });
+            return;
+        }
+        this.expandManifest(norm.name, version, manifest);
     }
-    // 2b. Always register the snapshot's own artifact package.
-    //
-    // Member packages are registered above, but the snapshot artifact itself
-    // (e.g. "@ist/testing") was previously never registered. As a result the
-    // registry proxy had no access rule for the snapshot artifact and rejected
-    // downloads (e.g. testing -> 401). Register the snapshot's own package with
-    // the access level declared in snapshot.json so the proxy knows it.
-    if (snapshot.name && !allPackages.includes(snapshot.name)) {
-        allPackages.unshift(snapshot.name);
+    expandManifest(name, version, manifest) {
+        const deps = {
+            ...manifest.dependencies,
+            ...manifest.optionalDependencies,
+            ...manifest.peerDependencies,
+        };
+        if (this.opts.verbose && Object.keys(deps).length > 0) {
+            console.log(chalk.dim(`  ${name}@${version} deps: ${Object.keys(deps).join(', ')}`));
+        }
+        for (const [dep, spec] of Object.entries(deps)) {
+            this.queue.push({ kind: 'npm', name: dep, spec, declared: false });
+        }
     }
-    // 3. Register each package
-    console.log(chalk.dim(`  Registering ${allPackages.length} packages...`));
-    for (const pkg of allPackages) {
-        const parsed = parsePackageName(pkg);
-        if (!parsed) {
-            result.skipped.push(pkg);
-            continue;
+    async processKit(item) {
+        this.register.add(item.name);
+        const registryName = kitRegistryName(item.name);
+        let version = parseVersion(item.spec) ? item.spec : null;
+        if (!version) {
+            try {
+                if (this.opts.source === 'gitlab') {
+                    const versions = (await cachedGenericVersions(registryName)).map((p) => p.version);
+                    const latest = maxSatisfying(versions, '*');
+                    version = resolveSpecVersion(versions, latest ? { latest } : {}, item.spec);
+                }
+                else {
+                    const res = await fetch(`${REGISTRY_PROXY_URL}/generic/${registryName}/versions`, { headers: this.headers });
+                    if (res.ok) {
+                        const v = (await res.json());
+                        version = resolveSpecVersion(v.versions ?? [], v.latest ? { latest: v.latest } : {}, item.spec);
+                    }
+                }
+            }
+            catch {
+                // handled below
+            }
+            if (!version) {
+                this.unmatched.push(`${item.name}@${item.spec} (kit version not resolved)`);
+                console.error(chalk.yellow(`  Warning: could not resolve kit ${item.name}@${item.spec}; skipping its deps`));
+                return;
+            }
         }
-        const isSelf = pkg === snapshot.name;
-        const rule = {
-            scope: parsed.scope,
-            packageName: parsed.name,
-            accessLevel,
-            priority: 100,
-            description: isSelf
-                ? `Snapshot artifact ${snapshot.name}`
-                : `Auto-synced from ${snapshot.name}`,
-            // The snapshot's own package has no parent; member packages point to it.
-            parentPackage: isSelf ? undefined : snapshot.name,
-        };
-        if (accessLevel === 'licensed' && productId) {
-            rule.requiredProductIds = productId;
+        this.recordVersion('generic', item.name, version);
+        const key = `kit:${item.name}@${version}`;
+        if (this.visited.has(key))
+            return;
+        this.visited.add(key);
+        const kit = item.name;
+        const out = await this.fetchKit(kit, version);
+        if (out.ok)
+            return;
+        this.addPending({ kind: 'kit', name: kit, version, reason: out.reason });
+        if (out.status === undefined) {
+            console.error(chalk.yellow(`  Warning: could not read kit ${kit}@${version}: ${out.reason}; skipping its npm deps`));
         }
-        if (dryRun) {
-            console.log(chalk.yellow(`  [dry-run] Would register: ${pkg} (${accessLevel})`));
-            result.registered.push(pkg);
+        else if ((out.status === 401 || out.status === 403) && !this.hasToken) {
+            console.error(chalk.yellow(`  Warning: kit ${kit}@${version} 의 npm 의존을 등록하지 못함 (HTTP ${out.status}, 토큰 없음): ` +
+                'IST_SESSION_TOKEN(또는 SNAPSHOT_LICENSE_KEY) 설정 후 다시 실행'));
         }
         else {
-            const success = await registerPackage(rule);
-            if (success) {
-                result.registered.push(pkg);
-                if (verbose) {
-                    console.log(chalk.green(`  ✓ ${pkg}`));
-                }
+            console.error(chalk.yellow(`  Warning: could not fetch kit ${kit}@${version} (HTTP ${out.status}); skipping its npm deps`));
+        }
+    }
+    /** Fetch a kit tarball, read skit.json and enqueue its npm/skit deps. */
+    async fetchKit(kit, version) {
+        const registryName = kitRegistryName(kit);
+        try {
+            let buffer;
+            if (this.opts.source === 'gitlab') {
+                const r = await fetchGitlabGenericTarball(registryName, version);
+                if (!r.ok)
+                    return { ok: false, status: r.status, reason: r.reason };
+                buffer = r.body;
             }
             else {
-                result.failed.push(pkg);
-                result.success = false;
+                const url = `${REGISTRY_PROXY_URL}/generic/${registryName}/${version}/${registryName}-${version}.tar.gz`;
+                const response = await fetch(url, { headers: this.headers });
+                if (!response.ok)
+                    return { ok: false, status: response.status, reason: `HTTP ${response.status}` };
+                buffer = Buffer.from(await response.arrayBuffer());
+            }
+            const skitJson = await extractSkitJsonFromBuffer(buffer);
+            const npmDeps = kitNpmDeps(skitJson);
+            const skitDeps = kitSkitDeps(skitJson);
+            if (this.opts.verbose && npmDeps.length + skitDeps.length > 0) {
+                console.log(chalk.dim(`  Kit ${kit}@${version} deps: ${[...npmDeps, ...skitDeps].map(([n]) => n).join(', ')}`));
             }
+            for (const [name, spec] of npmDeps)
+                this.queue.push({ kind: 'npm', name, spec, declared: true });
+            for (const [name, spec] of skitDeps)
+                this.queue.push({ kind: 'kit', name, spec, declared: true });
+            return { ok: true };
+        }
+        catch (error) {
+            return { ok: false, reason: String(error) };
         }
     }
-    // 4. Summary
-    console.log();
-    if (result.registered.length > 0) {
-        console.log(chalk.green(`  ✓ Registered: ${result.registered.length} packages`));
-    }
-    if (result.failed.length > 0) {
-        console.log(chalk.red(`  ✗ Failed: ${result.failed.length} packages`));
-    }
-    if (result.skipped.length > 0) {
-        console.log(chalk.yellow(`  ⊘ Skipped: ${result.skipped.length} packages (invalid format)`));
-    }
-    return result;
+}
+/** `@ist/qa-kit` → `ist__qa-kit` (registry-proxy generic path form). */
+export function kitRegistryName(kit) {
+    return kit.replace(/^@/, '').replace(/\//g, '__');
+}
+/**
+ * Walk the install-set dependency closure once.
+ * @internal Exported for testing
+ */
+export async function resolveInstallClosure(snapshot, options = {}) {
+    const walker = new ClosureWalker(snapshot, {
+        transitive: options.transitive ?? true,
+        verbose: options.verbose ?? false,
+        source: options.source ?? 'proxy',
+    });
+    await walker.drain();
+    return walker.result();
 }
 //# sourceMappingURL=access-sync.js.map