@microwiseai/snapshot 0.8.0 → 0.9.0

package/dist/lib/skit-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skit-adapter.d.ts","sourceRoot":"","sources":["../../src/lib/skit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA8DD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAgFD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA8E5B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAO5C;AAED;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;CACnC,CAAC,CASD"}
+{"version":3,"file":"skit-adapter.d.ts","sourceRoot":"","sources":["../../src/lib/skit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAeH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA8DD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AA0FD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAY5B;AA2FD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAO5C;AAED;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;CACnC,CAAC,CASD"}

package/dist/lib/skit-adapter.js

@@ -11,6 +11,8 @@
  */
 import { execSync } from 'child_process';
 import { REGISTRY_PROXY_URL, getInstallerGroupFromEnv } from './config.js';
+import { maskSessionId } from './session.js';
+import { createProxyAuthGlobalconfig, GLOBALCONFIG_ENV_KEYS, } from './proxy-auth-globalconfig.js';
 // ============================================================
 // Lib Loader
 // ============================================================
@@ -68,7 +70,7 @@ function runSkitCli(command, env) {
         return { success: false, error };
     }
 }
-function installSkitViaCli(spec, options) {
+function installSkitViaCli(spec, options, authCarrier) {
     // Parse spec: "@ist/tda-kit@1.0.0" -> name: "@ist/tda-kit", version: "1.0.0"
     const atIndex = spec.lastIndexOf('@');
     let name;
@@ -108,6 +110,11 @@ function installSkitViaCli(spec, options) {
     if (groupFromEnv) {
         env['IST_GITLAB_GROUP'] = groupFromEnv;
     }
+    // Proxy auth for skit's kit npm-dep installs (skit overrides USERCONFIG, so
+    // the ~/.npmrc auth line is invisible to it) — see proxy-auth-globalconfig.ts.
+    if (authCarrier) {
+        Object.assign(env, authCarrier.env);
+    }
     const result = runSkitCli(command, Object.keys(env).length > 0 ? env : undefined);
     return {
         success: result.success,
@@ -129,6 +136,18 @@ function installSkitViaCli(spec, options) {
  */
 export async function installSkitPackage(name, version, options) {
     const spec = version ? `${name}@${version}` : name;
+    // Authenticated session → carry the proxy auth line into skit's npm installs
+    // via a temp GLOBALCONFIG (env reference only, no token value on disk).
+    // null in anonymous mode. Always removed in the finally below.
+    const authCarrier = createProxyAuthGlobalconfig({ proxyUrl: REGISTRY_PROXY_URL });
+    try {
+        return await installSkitPackageInner(name, version, spec, options, authCarrier);
+    }
+    finally {
+        authCarrier?.cleanup();
+    }
+}
+async function installSkitPackageInner(name, version, spec, options, authCarrier) {
     // Try lib first
     const lib = await loadSkitLib();
     if (lib) {
@@ -143,6 +162,7 @@ export async function installSkitPackage(name, version, options) {
                 'IST_REGISTRY_URL',
                 'IST_GITLAB_HOST',
                 'IST_GITLAB_GROUP',
+                ...GLOBALCONFIG_ENV_KEYS,
             ];
             const savedEnv = {};
             for (const key of TOUCHED_ENV_KEYS) {
@@ -154,7 +174,7 @@ export async function installSkitPackage(name, version, options) {
                 process.env.SKIT_SESSION_ID = options.sessionId;
                 process.env.SKIT_REGISTRY = REGISTRY_PROXY_URL;
                 process.env.IST_REGISTRY_URL = REGISTRY_PROXY_URL;
-                console.log(`[skit-adapter] Using session: ${options.sessionId.substring(0, 8)}...`);
+                console.log(`[skit-adapter] Using session: ${maskSessionId(options.sessionId)}`);
             }
             else {
                 console.log(`[skit-adapter] No sessionId provided`);
@@ -167,6 +187,9 @@ export async function installSkitPackage(name, version, options) {
             if (groupFromEnv) {
                 process.env.IST_GITLAB_GROUP = groupFromEnv;
             }
+            if (authCarrier) {
+                Object.assign(process.env, authCarrier.env);
+            }
             try {
                 const libResult = await lib.installSkit(spec, {
                     onProgress: options?.silent ? undefined : options?.onProgress,
@@ -201,7 +224,7 @@ export async function installSkitPackage(name, version, options) {
         }
     }
     // CLI fallback
-    return installSkitViaCli(spec, options);
+    return installSkitViaCli(spec, options, authCarrier);
 }
 /**
  * Check if skit lib is available

package/dist/lib/skit-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"skit-adapter.js","sourceRoot":"","sources":["../../src/lib/skit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AA4C3E,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAE/D,IAAI,OAAO,GAAmB,IAAI,CAAC;AACnC,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;GAGG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gBAAgB,GAAG,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEnD,6BAA6B;QAC7B,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC3C,OAAO,GAAG;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uCAAuC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,GAAG,IAAI,CAAC;IACf,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC;AAED,+DAA+D;AAC/D,eAAe;AACf,+DAA+D;AAE/D,SAAS,UAAU,CAAC,OAAe,EAAE,GAA4B;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;SACpD,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAA4B;IACnE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,OAAe,CAAC;IAEpB,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,IAAI,CAAC;QACZ,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,UAAU,EAAE,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,6EAA6E;IAC7E,4BAA4B;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,2EAA2E;IAC3E,8EAA8E;IAC9E,4DAA4D;IAC5D,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC3C,GAAG,CAAC,eAAe,CAAC,GAAG,kBAAkB,CAAC;QAC1C,GAAG,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,+EAA+E;IAC/E,qFAAqF;IACrF,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,GAAG,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACvD,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAElF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,OAAO,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,OAAe,EACf,OAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnD,gBAAgB;IAChB,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAEhC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,gBAAgB,GAAG;gBACvB,iBAAiB;gBACjB,eAAe;gBACf,kBAAkB;gBAClB,iBAAiB;gBACjB,kBAAkB;aACV,CAAC;YACX,MAAM,QAAQ,GAAuC,EAAE,CAAC;YACxD,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;YAED,0EAA0E;YAC1E,6BAA6B;YAC7B,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,kBAAkB,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,kBAAkB,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;YAED,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,0CAA0C;YAC1C,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;YAChD,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,YAAY,CAAC;YAC9C,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC5C,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU;iBAC9D,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;oBAC5B,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO;oBACrC,aAAa,EAAE,SAAS,CAAC,IAAI;oBAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;iBACvB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,qEAAqE;gBACrE,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uCAAuC;YACvC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,uDAAuD,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,eAAe;IACf,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAChC,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAKvC,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;KAC9C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"skit-adapter.js","sourceRoot":"","sources":["../../src/lib/skit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AA4CtC,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAE/D,IAAI,OAAO,GAAmB,IAAI,CAAC;AACnC,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;GAGG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gBAAgB,GAAG,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEnD,6BAA6B;QAC7B,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC3C,OAAO,GAAG;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,uCAAuC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,GAAG,IAAI,CAAC;IACf,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC;AAED,+DAA+D;AAC/D,eAAe;AACf,+DAA+D;AAE/D,SAAS,UAAU,CAAC,OAAe,EAAE,GAA4B;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;SACpD,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,OAA4B,EAC5B,WAA0C;IAE1C,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,OAAe,CAAC;IAEpB,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,IAAI,CAAC;QACZ,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,UAAU,EAAE,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,6EAA6E;IAC7E,4BAA4B;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,2EAA2E;IAC3E,8EAA8E;IAC9E,4DAA4D;IAC5D,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC3C,GAAG,CAAC,eAAe,CAAC,GAAG,kBAAkB,CAAC;QAC1C,GAAG,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,+EAA+E;IAC/E,qFAAqF;IACrF,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,GAAG,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACvD,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;IACzC,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAElF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,OAAO,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,OAAe,EACf,OAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnD,6EAA6E;IAC7E,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,WAAW,GAAG,2BAA2B,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,OAAO,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,OAAuC,EACvC,WAAyC;IAEzC,gBAAgB;IAChB,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAEhC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,gBAAgB,GAAG;gBACvB,iBAAiB;gBACjB,eAAe;gBACf,kBAAkB;gBAClB,iBAAiB;gBACjB,kBAAkB;gBAClB,GAAG,qBAAqB;aAChB,CAAC;YACX,MAAM,QAAQ,GAAuC,EAAE,CAAC;YACxD,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;YAED,0EAA0E;YAC1E,6BAA6B;YAC7B,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,kBAAkB,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,kBAAkB,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,iCAAiC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;YAED,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,0CAA0C;YAC1C,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;YAChD,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,YAAY,CAAC;YAC9C,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC5C,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU;iBAC9D,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;oBAC5B,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO;oBACrC,aAAa,EAAE,SAAS,CAAC,IAAI;oBAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;iBACvB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,qEAAqE;gBACrE,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uCAAuC;YACvC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,uDAAuD,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,eAAe;IACf,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAChC,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAKvC,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;KAC9C,CAAC;AACJ,CAAC"}

package/dist/lib/timing.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Opt-in stage timing for `snapshot install` (SNAPSHOT_TIMING=1).
+ * Prints `[timing] <label> <seconds>s` to stderr when a stage ends; no-op otherwise.
+ * Measurement harness lives in @microwiseai/snapshot-install-bench.
+ */
+export declare function timingStart(label: string): () => void;
+//# sourceMappingURL=timing.d.ts.map

package/dist/lib/timing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.d.ts","sourceRoot":"","sources":["../../src/lib/timing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CAMrD"}

package/dist/lib/timing.js

@@ -0,0 +1,14 @@
+/**
+ * Opt-in stage timing for `snapshot install` (SNAPSHOT_TIMING=1).
+ * Prints `[timing] <label> <seconds>s` to stderr when a stage ends; no-op otherwise.
+ * Measurement harness lives in @microwiseai/snapshot-install-bench.
+ */
+export function timingStart(label) {
+    if (process.env.SNAPSHOT_TIMING !== '1')
+        return () => { };
+    const t0 = Date.now();
+    return () => {
+        process.stderr.write(`[timing] ${label} ${((Date.now() - t0) / 1000).toFixed(2)}s\n`);
+    };
+}
+//# sourceMappingURL=timing.js.map

package/dist/lib/timing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.js","sourceRoot":"","sources":["../../src/lib/timing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,OAAO,GAAG,EAAE;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxF,CAAC,CAAC;AACJ,CAAC"}

package/dist/lib/types.d.ts

@@ -24,6 +24,9 @@ export interface Snapshot {
     install?: Record<string, Record<string, string>>;
     packages?: Record<string, string>;
     skits?: Record<string, string>;
+    policy?: {
+        onDowngrade?: 'refuse' | 'warn' | 'allow';
+    };
 }
 export interface InstalledSnapshot {
     name: string;

package/dist/lib/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,sBAAsB,CAAC;AAEjF,MAAM,WAAW,QAAQ;IAEvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAG1C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAGjD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,sBAAsB,CAAC;AAEjF,MAAM,WAAW,QAAQ;IAEvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAG1C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAGjD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAO/B,MAAM,CAAC,EAAE;QACP,WAAW,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;KAC3C,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/command-specs.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Parse the `name -> version` specs out of a GLOBAL install command string.
+ *
+ * This is the bridge that lets the downgrade guard sit at core's single
+ * npm-exec choke point (the raw `runCommand`/`runCommandSync` spawn wrappers),
+ * which are also used for uninstall / probe / hint commands. We only engage when
+ * the command is a *global install* carrying versioned specs; everything else
+ * returns {} so the guard is a no-op.
+ *
+ * Pure and tolerant: unknown shapes → {}. Only exact `name@version` tokens are
+ * extracted (scoped names supported: `@ist/sesh@0.3.0`). Tokens without a
+ * version (`@microwiseai/skit`), flags (`-g`), and the binary/subcommand words
+ * are ignored. Non-exact versions are still returned verbatim — the caller's
+ * detector treats non-exact semver as incomparable and skips it.
+ *
+ * Examples:
+ *   'npm install -g @ist/sesh@0.3.0 chalk@5.3.0' -> { '@ist/sesh':'0.3.0', chalk:'5.3.0' }
+ *   'glpkg install @ist/sesh@0.3.0'              -> { '@ist/sesh':'0.3.0' }  (glpkg installs globally)
+ *   'npm uninstall -g @ist/sesh'                 -> {}   (uninstall)
+ *   'npm install -g @microwiseai/skit'           -> {}   (no version)
+ *   'npm install @ist/x@1.0.0'                    -> {}   (not global)
+ *   'npm list -g @ist/sesh --json'               -> {}   (not an install)
+ */
+export declare function extractGlobalInstallSpecs(command: unknown): Record<string, string>;
+//# sourceMappingURL=command-specs.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/command-specs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-specs.d.ts","sourceRoot":"","sources":["../src/command-specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BlF"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/command-specs.js

@@ -0,0 +1,55 @@
+/**
+ * Parse the `name -> version` specs out of a GLOBAL install command string.
+ *
+ * This is the bridge that lets the downgrade guard sit at core's single
+ * npm-exec choke point (the raw `runCommand`/`runCommandSync` spawn wrappers),
+ * which are also used for uninstall / probe / hint commands. We only engage when
+ * the command is a *global install* carrying versioned specs; everything else
+ * returns {} so the guard is a no-op.
+ *
+ * Pure and tolerant: unknown shapes → {}. Only exact `name@version` tokens are
+ * extracted (scoped names supported: `@ist/sesh@0.3.0`). Tokens without a
+ * version (`@microwiseai/skit`), flags (`-g`), and the binary/subcommand words
+ * are ignored. Non-exact versions are still returned verbatim — the caller's
+ * detector treats non-exact semver as incomparable and skips it.
+ *
+ * Examples:
+ *   'npm install -g @ist/sesh@0.3.0 chalk@5.3.0' -> { '@ist/sesh':'0.3.0', chalk:'5.3.0' }
+ *   'glpkg install @ist/sesh@0.3.0'              -> { '@ist/sesh':'0.3.0' }  (glpkg installs globally)
+ *   'npm uninstall -g @ist/sesh'                 -> {}   (uninstall)
+ *   'npm install -g @microwiseai/skit'           -> {}   (no version)
+ *   'npm install @ist/x@1.0.0'                    -> {}   (not global)
+ *   'npm list -g @ist/sesh --json'               -> {}   (not an install)
+ */
+export function extractGlobalInstallSpecs(command) {
+    if (typeof command !== 'string' || command.length === 0)
+        return {};
+    // A command is a GLOBAL install when it carries the -g/--global flag OR is run
+    // through an installer whose installs are inherently global (glpkg /
+    // gitlab-install both install global npm packages, without a -g flag).
+    const hasGlobalFlag = /(?:^|\s)(?:-g|--global)(?:\s|$)/.test(command);
+    const isGlobalInstaller = /^\s*(?:glpkg|gitlab-install)(?:\s|$)/.test(command);
+    if (!hasGlobalFlag && !isGlobalInstaller)
+        return {};
+    const isUninstall = /(?:^|\s)(?:uninstall|remove|rm|un)(?:\s|$)/.test(command);
+    if (isUninstall)
+        return {};
+    const isInstall = /(?:^|\s)(?:install|add|i)(?:\s|$)/.test(command);
+    if (!isInstall)
+        return {};
+    const specs = {};
+    for (const tok of command.split(/\s+/)) {
+        if (!tok || tok.startsWith('-'))
+            continue; // flags / empty
+        const at = tok.lastIndexOf('@');
+        if (at <= 0)
+            continue; // no version, or a leading-@ scope with no version
+        const name = tok.slice(0, at);
+        const version = tok.slice(at + 1);
+        if (!name || !version)
+            continue;
+        specs[name] = version;
+    }
+    return specs;
+}
+//# sourceMappingURL=command-specs.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/command-specs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-specs.js","sourceRoot":"","sources":["../src/command-specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnE,+EAA+E;IAC/E,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,aAAa,GAAG,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,iBAAiB,GAAG,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,aAAa,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAEpD,MAAM,WAAW,GAAG,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,WAAW;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAE1B,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,gBAAgB;QAC3D,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS,CAAC,mDAAmD;QAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/config.d.ts

@@ -0,0 +1,52 @@
+import type { DowngradeMode } from './types.js';
+/**
+ * Machine-level snapshot config (~/.config/ist-snapshot/config.json).
+ * Only `install.onDowngrade` is meaningful here; unknown keys are preserved on
+ * round-trip so this package never clobbers config owned by other tools.
+ */
+export interface MachineConfig {
+    install?: {
+        onDowngrade?: DowngradeMode;
+        [k: string]: unknown;
+    };
+    [k: string]: unknown;
+}
+/** Minimal fs surface, injectable for hermetic tests. Defaults to node:fs. */
+export interface ConfigFs {
+    existsSync: (p: string) => boolean;
+    readFileSync: (p: string, enc: 'utf-8') => string;
+    writeFileSync: (p: string, data: string) => void;
+    mkdirSync: (p: string, opts: {
+        recursive: boolean;
+    }) => void;
+}
+export interface ConfigIoOptions {
+    /** Config directory. Defaults to ~/.config/ist-snapshot. Injectable for tests. */
+    configDir?: string;
+    /** fs implementation. Defaults to node:fs. Injectable for tests. */
+    fs?: ConfigFs;
+}
+/** Default config directory (~/.config/ist-snapshot). */
+export declare function getConfigDir(opts?: ConfigIoOptions): string;
+/** Absolute path to config.json. */
+export declare function getConfigPath(opts?: ConfigIoOptions): string;
+/**
+ * Read the machine config. Returns {} when the file is absent or unparseable
+ * (tolerant — a broken/foreign file must not crash an install decision).
+ */
+export declare function readMachineConfig(opts?: ConfigIoOptions): MachineConfig;
+/**
+ * Write the machine config (pretty JSON), creating the config dir if needed.
+ */
+export declare function writeMachineConfig(config: MachineConfig, opts?: ConfigIoOptions): void;
+/**
+ * Read `install.onDowngrade` from machine config, validated.
+ * Returns null when unset or invalid.
+ */
+export declare function getMachineDowngradeMode(opts?: ConfigIoOptions): DowngradeMode | null;
+/**
+ * Set `install.onDowngrade` in machine config (read-modify-write), preserving
+ * every other key. Returns the written config.
+ */
+export declare function setMachineDowngradeMode(mode: DowngradeMode, opts?: ConfigIoOptions): MachineConfig;
+//# sourceMappingURL=config.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,aAAa,CAAC;QAC5B,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;IACF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,8EAA8E;AAC9E,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAClD,aAAa,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CAC9D;AAED,MAAM,WAAW,eAAe;IAC9B,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAID,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,IAAI,GAAE,eAAoB,GAAG,MAAM,CAE/D;AAED,oCAAoC;AACpC,wBAAgB,aAAa,CAAC,IAAI,GAAE,eAAoB,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,eAAoB,GAAG,aAAa,CAU3E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,GAAE,eAAoB,GAAG,IAAI,CAO1F;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,eAAoB,GAAG,aAAa,GAAG,IAAI,CAExF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,EACnB,IAAI,GAAE,eAAoB,GACzB,aAAa,CAQf"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/config.js

@@ -0,0 +1,62 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { asDowngradeMode } from './policy.js';
+const DEFAULT_FS = { existsSync, readFileSync, writeFileSync, mkdirSync };
+/** Default config directory (~/.config/ist-snapshot). */
+export function getConfigDir(opts = {}) {
+    return opts.configDir ?? join(homedir(), '.config', 'ist-snapshot');
+}
+/** Absolute path to config.json. */
+export function getConfigPath(opts = {}) {
+    return join(getConfigDir(opts), 'config.json');
+}
+/**
+ * Read the machine config. Returns {} when the file is absent or unparseable
+ * (tolerant — a broken/foreign file must not crash an install decision).
+ */
+export function readMachineConfig(opts = {}) {
+    const fs = opts.fs ?? DEFAULT_FS;
+    const path = getConfigPath(opts);
+    try {
+        if (!fs.existsSync(path))
+            return {};
+        const parsed = JSON.parse(fs.readFileSync(path, 'utf-8'));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Write the machine config (pretty JSON), creating the config dir if needed.
+ */
+export function writeMachineConfig(config, opts = {}) {
+    const fs = opts.fs ?? DEFAULT_FS;
+    const dir = getConfigDir(opts);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(getConfigPath(opts), JSON.stringify(config, null, 2) + '\n');
+}
+/**
+ * Read `install.onDowngrade` from machine config, validated.
+ * Returns null when unset or invalid.
+ */
+export function getMachineDowngradeMode(opts = {}) {
+    return asDowngradeMode(readMachineConfig(opts).install?.onDowngrade);
+}
+/**
+ * Set `install.onDowngrade` in machine config (read-modify-write), preserving
+ * every other key. Returns the written config.
+ */
+export function setMachineDowngradeMode(mode, opts = {}) {
+    const current = readMachineConfig(opts);
+    const next = {
+        ...current,
+        install: { ...(current.install ?? {}), onDowngrade: mode },
+    };
+    writeMachineConfig(next, opts);
+    return next;
+}
+//# sourceMappingURL=config.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA+B9C,MAAM,UAAU,GAAa,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AAEpF,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,OAAwB,EAAE;IACrD,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACtE,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,aAAa,CAAC,OAAwB,EAAE;IACtD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE;IAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC;IACjC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB,EAAE,OAAwB,EAAE;IAClF,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAwB,EAAE;IAChE,OAAO,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAmB,EACnB,OAAwB,EAAE;IAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAkB;QAC1B,GAAG,OAAO;QACV,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;KAC3D,CAAC;IACF,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/detect.d.ts

@@ -0,0 +1,30 @@
+import type { DetectResult } from './types.js';
+/**
+ * Reads the currently-installed (global) version of a package, or null/undefined
+ * when it is not installed. MUST be injected — this package never shells out to
+ * npm, keeping it pure and side-effect-free. Core supplies a real implementation
+ * (e.g. `npm ls -g`); tests inject a stub.
+ */
+export type ReadVersionFn = (pkg: string) => string | null | undefined;
+export interface DetectOptions {
+    /** Injected version reader. Required — no default npm execution. */
+    readVersion: ReadVersionFn;
+}
+/**
+ * Detect which pinned packages would be DOWNGRADED relative to what is already
+ * installed globally.
+ *
+ * For each `pkg -> pinned` entry:
+ *   - not installed (readVersion returns null/undefined/empty) → OK (skip)
+ *   - installed === pinned                                     → OK (skip)
+ *   - installed  <  pinned (an upgrade)                        → OK (skip)
+ *   - installed  >  pinned (a downgrade, strict)              → OFFENDER
+ *   - either side not an exact semver (incomparable)           → OK (skip, tolerant)
+ *
+ * A clean Docker sandbox has nothing installed globally, so every entry skips
+ * and `wouldDowngrade` is false — the guard auto-passes with no config.
+ *
+ * Pure: no I/O, no mutation of `installMap`.
+ */
+export declare function detectDowngrades(installMap: Record<string, string>, opts?: DetectOptions): DetectResult;
+//# sourceMappingURL=detect.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,WAAW,EAAE,aAAa,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,IAAI,CAAC,EAAE,aAAa,GACnB,YAAY,CAwBd"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/detect.js

@@ -0,0 +1,39 @@
+import { compareExact } from './semver.js';
+/**
+ * Detect which pinned packages would be DOWNGRADED relative to what is already
+ * installed globally.
+ *
+ * For each `pkg -> pinned` entry:
+ *   - not installed (readVersion returns null/undefined/empty) → OK (skip)
+ *   - installed === pinned                                     → OK (skip)
+ *   - installed  <  pinned (an upgrade)                        → OK (skip)
+ *   - installed  >  pinned (a downgrade, strict)              → OFFENDER
+ *   - either side not an exact semver (incomparable)           → OK (skip, tolerant)
+ *
+ * A clean Docker sandbox has nothing installed globally, so every entry skips
+ * and `wouldDowngrade` is false — the guard auto-passes with no config.
+ *
+ * Pure: no I/O, no mutation of `installMap`.
+ */
+export function detectDowngrades(installMap, opts) {
+    const readVersion = opts?.readVersion;
+    if (typeof readVersion !== 'function') {
+        throw new Error('detectDowngrades: opts.readVersion injection is required (this package never runs npm itself).');
+    }
+    const offenders = [];
+    for (const [pkg, pinned] of Object.entries(installMap ?? {})) {
+        const installed = readVersion(pkg);
+        if (installed === null || installed === undefined || installed === '') {
+            continue; // not installed → no downgrade
+        }
+        const cmp = compareExact(installed, pinned);
+        if (cmp === null) {
+            continue; // incomparable (non-exact semver) → tolerant skip
+        }
+        if (cmp > 0) {
+            offenders.push({ pkg, installed, pinned });
+        }
+    }
+    return { wouldDowngrade: offenders.length > 0, offenders };
+}
+//# sourceMappingURL=detect.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB3C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkC,EAClC,IAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtE,SAAS,CAAC,+BAA+B;QAC3C,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,SAAS,CAAC,kDAAkD;QAC9D,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;AAC7D,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @microwiseai/snapshot-downgrade-guard
+ *
+ * Auto-detects when a snapshot install would DOWNGRADE already-installed global
+ * tooling, and resolves the layered refuse/warn/allow policy. Pure and
+ * dependency-injected: it never runs npm, touches the network, or mutates state
+ * except through the explicit machine-config writers. A clean Docker sandbox
+ * (nothing installed globally) produces zero offenders and auto-passes.
+ *
+ * Usage (in core, at the npm-exec boundary):
+ *   import {
+ *     detectDowngrades, resolveDowngradePolicy, readOneShotOverride,
+ *     readMachineConfig, formatDowngradeReport,
+ *   } from '@microwiseai/snapshot-downgrade-guard';
+ *
+ *   const { wouldDowngrade, offenders } = detectDowngrades(installMap, { readVersion });
+ *   const mode = resolveDowngradePolicy({
+ *     override: readOneShotOverride({ env: process.env, allowDowngradeFlag }),
+ *     machine:  readMachineConfig().install?.onDowngrade,
+ *     snapshot: snapshot.policy?.onDowngrade,
+ *   });
+ *   if (wouldDowngrade && mode === 'refuse') throw new Error(formatDowngradeReport(offenders, mode));
+ */
+export { detectDowngrades } from './detect.js';
+export type { DetectOptions, ReadVersionFn } from './detect.js';
+export { resolveDowngradePolicy, readOneShotOverride, asDowngradeMode, DEFAULT_DOWNGRADE_MODE, } from './policy.js';
+export type { PolicySources, OneShotOverrideInput } from './policy.js';
+export { getConfigDir, getConfigPath, readMachineConfig, writeMachineConfig, getMachineDowngradeMode, setMachineDowngradeMode, } from './config.js';
+export type { MachineConfig, ConfigFs, ConfigIoOptions } from './config.js';
+export { formatDowngradeReport } from './report.js';
+export { extractGlobalInstallSpecs } from './command-specs.js';
+export { isExactSemver, compareExact } from './semver.js';
+export type { DowngradeMode, Offender, DetectResult } from './types.js';
+export { DOWNGRADE_MODES } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/index.js

@@ -0,0 +1,31 @@
+/**
+ * @microwiseai/snapshot-downgrade-guard
+ *
+ * Auto-detects when a snapshot install would DOWNGRADE already-installed global
+ * tooling, and resolves the layered refuse/warn/allow policy. Pure and
+ * dependency-injected: it never runs npm, touches the network, or mutates state
+ * except through the explicit machine-config writers. A clean Docker sandbox
+ * (nothing installed globally) produces zero offenders and auto-passes.
+ *
+ * Usage (in core, at the npm-exec boundary):
+ *   import {
+ *     detectDowngrades, resolveDowngradePolicy, readOneShotOverride,
+ *     readMachineConfig, formatDowngradeReport,
+ *   } from '@microwiseai/snapshot-downgrade-guard';
+ *
+ *   const { wouldDowngrade, offenders } = detectDowngrades(installMap, { readVersion });
+ *   const mode = resolveDowngradePolicy({
+ *     override: readOneShotOverride({ env: process.env, allowDowngradeFlag }),
+ *     machine:  readMachineConfig().install?.onDowngrade,
+ *     snapshot: snapshot.policy?.onDowngrade,
+ *   });
+ *   if (wouldDowngrade && mode === 'refuse') throw new Error(formatDowngradeReport(offenders, mode));
+ */
+export { detectDowngrades } from './detect.js';
+export { resolveDowngradePolicy, readOneShotOverride, asDowngradeMode, DEFAULT_DOWNGRADE_MODE, } from './policy.js';
+export { getConfigDir, getConfigPath, readMachineConfig, writeMachineConfig, getMachineDowngradeMode, setMachineDowngradeMode, } from './config.js';
+export { formatDowngradeReport } from './report.js';
+export { extractGlobalInstallSpecs } from './command-specs.js';
+export { isExactSemver, compareExact } from './semver.js';
+export { DOWNGRADE_MODES } from './types.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.d.ts

@@ -0,0 +1,42 @@
+import { type DowngradeMode } from './types.js';
+/**
+ * Policy values read from each layer. Any field may be absent (undefined/null)
+ * or invalid; invalid values are ignored (treated as absent) so a typo never
+ * silently weakens the guard.
+ *
+ * Precedence (highest wins):
+ *   (a) override  — CLI flag / one-shot env (already mapped to a mode)
+ *   (b) machine   — machine config (~/.config/ist-snapshot/config.json)
+ *   (c) snapshot  — snapshot.json `policy.onDowngrade`
+ *   (d) default   — 'refuse'
+ */
+export interface PolicySources {
+    override?: DowngradeMode | string | null;
+    machine?: DowngradeMode | string | null;
+    snapshot?: DowngradeMode | string | null;
+}
+/** The default when no layer specifies a valid mode. */
+export declare const DEFAULT_DOWNGRADE_MODE: DowngradeMode;
+/** Narrow an arbitrary value to a valid DowngradeMode, or null if invalid. */
+export declare function asDowngradeMode(v: unknown): DowngradeMode | null;
+/**
+ * Resolve the effective downgrade policy from the layered sources.
+ * Pure: first valid value in precedence order (a > b > c), else the default.
+ */
+export declare function resolveDowngradePolicy(sources?: PolicySources): DowngradeMode;
+export interface OneShotOverrideInput {
+    /** Environment map (e.g. process.env). SNAPSHOT_ALLOW_LOCAL=1 → allow. */
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
+    /** CLI flag, e.g. --allow-downgrade → allow. */
+    allowDowngradeFlag?: boolean;
+}
+/**
+ * Map the one-shot escape hatches (CLI `--allow-downgrade` or env
+ * `SNAPSHOT_ALLOW_LOCAL=1`) to an override mode.
+ *
+ * Returns 'allow' when either hatch is engaged, otherwise null (no override).
+ * Pure — reads only the injected inputs. Core passes the result as
+ * `PolicySources.override`.
+ */
+export declare function readOneShotOverride(input?: OneShotOverrideInput): DowngradeMode | null;
+//# sourceMappingURL=policy.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,EAAE,aAAwB,CAAC;AAE9D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAIhE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,aAAkB,GAAG,aAAa,CAOjF;AAED,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,gDAAgD;IAChD,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,oBAAyB,GAAG,aAAa,GAAG,IAAI,CAK1F"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.js

@@ -0,0 +1,36 @@
+import { DOWNGRADE_MODES } from './types.js';
+/** The default when no layer specifies a valid mode. */
+export const DEFAULT_DOWNGRADE_MODE = 'refuse';
+/** Narrow an arbitrary value to a valid DowngradeMode, or null if invalid. */
+export function asDowngradeMode(v) {
+    return typeof v === 'string' && DOWNGRADE_MODES.includes(v)
+        ? v
+        : null;
+}
+/**
+ * Resolve the effective downgrade policy from the layered sources.
+ * Pure: first valid value in precedence order (a > b > c), else the default.
+ */
+export function resolveDowngradePolicy(sources = {}) {
+    return (asDowngradeMode(sources.override) ??
+        asDowngradeMode(sources.machine) ??
+        asDowngradeMode(sources.snapshot) ??
+        DEFAULT_DOWNGRADE_MODE);
+}
+/**
+ * Map the one-shot escape hatches (CLI `--allow-downgrade` or env
+ * `SNAPSHOT_ALLOW_LOCAL=1`) to an override mode.
+ *
+ * Returns 'allow' when either hatch is engaged, otherwise null (no override).
+ * Pure — reads only the injected inputs. Core passes the result as
+ * `PolicySources.override`.
+ */
+export function readOneShotOverride(input = {}) {
+    const env = input.env ?? {};
+    if (input.allowDowngradeFlag === true)
+        return 'allow';
+    if (env.SNAPSHOT_ALLOW_LOCAL === '1')
+        return 'allow';
+    return null;
+}
+//# sourceMappingURL=policy.js.map