@microwiseai/snapshot 0.9.1 → 0.9.3

package/node_modules/@microwiseai/skit/dist/types/skit.d.ts

@@ -16,6 +16,13 @@ export interface SkitProfileComponent extends SkitComponent {
 export interface SkitCli {
     name: string;
     package: string;
+    /**
+     * @deprecated DEAD FIELD — declared but never consumed. The CLI install path
+     * (`installCliTools` → `buildGlobalInstallCommand`) installs `package` globally
+     * and lets npm/glpkg link the package's own declared `bin`; skit never reads or
+     * applies this override. Retained (not removed) to avoid breaking manifests /
+     * downstream type importers. Do not rely on it.
+     */
     bin?: string;
 }
 export interface SkitStateComponent {
@@ -50,7 +57,14 @@ export interface SkitInstallPaths {
     post?: string[];
 }
 /**
- * CLI tool dependency (external tools like gitlab-install, npm, pip, etc.)
+ * CLI tool dependency (external tools like glpkg, npm, pip, etc.)
+ *
+ * @deprecated DEAD SHAPE — this interface (used only by `SkitDependencies.cli`)
+ * has NO consumer in the install path: nothing ever reads `install`/`check`/
+ * `optional`. It predates the working co-install paths and was never wired to an
+ * installer. Declare npm-based CLI tools under `dependencies.npm` (installed via
+ * `installNpmDeps`) or `components.clis` (installed via `installCliTools`)
+ * instead. Kept for backward-compatible typing; do not use.
  */
 export interface CliDependency {
     name: string;
@@ -58,29 +72,113 @@ export interface CliDependency {
     check?: string;
     optional?: boolean;
 }
+/**
+ * Per-dependency install source for `dependencies.npm` (free-pivot: plain-npm,
+ * NO glpkg binary required).
+ * - 'npm':   install from the PUBLIC npmjs registry (default registry). Use for
+ *            packages published to npmjs (e.g. @glpkg/cli). No proxy, no glpkg.
+ * - 'gitlab': install DIRECTLY from the scope's GitLab group package registry.
+ *            Anonymous-tolerant (like the kit-tarball path): a PUBLIC package
+ *            installs token-free; a PRIVATE one attaches the ambient GitLab PAT
+ *            (GITLAB_TOKEN env / glpkg token file). The concrete registry URL is
+ *            taken from the manifest `registry[scope].url`; a scope without a
+ *            declared URL degrades to the 'proxy' anonymous path (no regression).
+ * - 'proxy': install from the registry-proxy ANONYMOUSLY via plain npm + a
+ *            temporary scoped .npmrc (scope -> proxy registry, NO auth line).
+ *            Use as the token-bypass path (server-side license, client anonymous).
+ */
+export type NpmDependencySource = 'npm' | 'gitlab' | 'proxy';
+/**
+ * Object form of a `dependencies.npm` value, letting a kit author pin the
+ * install source per dependency. The bare-string form (`"1.2.3"`) is still
+ * accepted and defaults to `source: 'gitlab'` (gitlab-direct, anonymous-tolerant).
+ */
+export interface NpmDependencySpec {
+    version: string;
+    /** install source; defaults to 'gitlab' when omitted */
+    source?: NpmDependencySource;
+}
 /**
  * Dependencies structure for skit packages
  */
 export interface SkitDependencies {
-    /** npm 패키지 의존성 (권장) */
-    npm?: Record<string, string>;
-    /** 다른 skit 패키지 의존성 */
+    /**
+     * npm 패키지 의존성 (권장). A value may be a bare version string (defaults to
+     * source 'gitlab') OR an object `{ version, source }` to pin the install source
+     * per dependency ('npm' | 'gitlab' | 'proxy'). All npm deps install via plain
+     * `npm` — the glpkg binary is no longer required.
+     */
+    npm?: Record<string, string | NpmDependencySpec>;
+    /**
+     * @deprecated NO-OP FIELD — skit-to-skit recursive install is removed. No kit
+     * used `dependencies.skit`, and skit bundling is consolidated onto the snapshot
+     * package manager. The install path no longer reads this field: a declared
+     * value is IGNORED (never recursively installed). Retained for
+     * backward-compatible typing only; use the snapshot package manager to bundle
+     * skits together.
+     */
     skit?: Record<string, string>;
     /**
-     * CLI 도구 의존성 (deprecated)
-     * npm 패키지는 dependencies.npm 사용 권장
+     * 파이썬(pip/pypi) 의존성 — 아직 미지원.
+     *
+     * skit는 현재 pip/pypi 에코시스템 설치를 구현하지 않는다(로드맵: distkit
+     * ecosystem 축 확정 후 실제 설치 도입). 이 필드가 선언되면 설치는 실패하지
+     * 않고 계속되지만, silent skip 대신 loud 경고를 방출한 뒤 스킵한다.
+     * @example { "requests": ">=2.0.0", "pyyaml": "^6.0" }
+     */
+    pip?: Record<string, string>;
+    /**
+     * @deprecated DEAD FIELD — declared but never consumed by any install code
+     * path (verified: no reader for `dependencies.cli`). Use `dependencies.npm`
+     * (npm packages) or `components.clis` (glpkg-installed CLIs) instead. Retained
+     * for backward-compatible typing only.
      */
     cli?: CliDependency[];
 }
 /**
- * Scope to GitLab group mapping for npm dependencies
- * @example { "@ist": { "group": "microwiseai" }, "@mwd-tools": { "group": "microwiseai" } }
+ * Scope → registry routing entry. Declares, for a scope, WHICH GitLab group and
+ * (optionally) WHICH proxy/registry URL its packages resolve through. Routing
+ * ONLY — access decisions stay server-side (SSOT); this is never an access grant.
+ *
+ * `url` is OPTIONAL and additive (distkit ADR-0001 shared registry model v2,
+ * "snapshot.json 형태 정합"):
+ *   - present → the author's own proxy/registry for this scope (enables the
+ *     generalization / gitlab-direct / third-party-reuse cases where the bundled
+ *     proxy constant must not be assumed);
+ *   - absent  → the resolver falls back to the ambient/bundled registry, so the
+ *     current anonymous tokenless `source: 'proxy'` flow is unchanged.
+ * Manifests carrying only `{ group }` (no `url`) remain fully valid.
+ */
+export interface ScopeRegistryEntry {
+    /** GitLab group name (routing/provenance hint; authority is server-side). */
+    group: string;
+    /**
+     * Proxy/registry base URL this scope resolves through (e.g.
+     * "https://registry-proxy.example.dev/"). Optional: when omitted the resolver
+     * uses the ambient/bundled registry — preserves the anonymous tokenless flow.
+     */
+    url?: string;
+}
+/**
+ * Scope to GitLab group mapping for npm dependencies (legacy scope→group form,
+ * now extended with an optional per-scope `url` — see ScopeRegistryEntry).
+ * Retained for backward compatibility; superseded by the group-keyed
+ * `glpkg.groups` block (see GroupPackageMapping / §4C) for new manifests.
+ * @example { "@ist": { "group": "microwiseai", "url": "https://registry-proxy.../" } }
+ * @example { "@mwd-tools": { "group": "microwiseai" } }  // url omitted → bundled registry
  */
 export interface ScopeRegistryMapping {
-    [scope: string]: {
-        group: string;
-    };
+    [scope: string]: ScopeRegistryEntry;
 }
+/**
+ * Group-keyed package mapping (glpkg ADR §4C — dependency group provenance).
+ * Maps a GitLab group name to the packages resolved from that group. Group-keyed
+ * (rather than per-package) to keep the block short; auto-managed by glpkg on
+ * install (idempotent, sorted, deduped). This is a routing/provenance HINT — the
+ * authoritative access decision remains server-side (SSOT), never the manifest.
+ * @example { "microwiseai": ["@ist/foo", "@ist/bar"], "otherorg": ["@other/x"] }
+ */
+export type GroupPackageMapping = Record<string, string[]>;
 export interface SkitManifest {
     name: string;
     version: string;
@@ -89,11 +187,90 @@ export interface SkitManifest {
     files?: string[];
     exclude?: string[];
     dependencies?: SkitDependencies;
-    /** Scope to GitLab group mapping for npm dependencies */
+    /** Scope to GitLab group mapping for npm dependencies (legacy; see `glpkg.groups`) */
     registry?: ScopeRegistryMapping;
+    /**
+     * glpkg-managed namespace (§4C / glpkg G2 convention f7a5c3f). Native skit.json
+     * home for the group dimension of dependencies and this package's install policy.
+     * Auto-added/updated on install; read by glpkg from the manifest (no CLI flag).
+     */
+    glpkg?: {
+        /** group-keyed dependency provenance (§4C). Auto-managed. */
+        groups?: GroupPackageMapping;
+        /**
+         * Install-condition policy name for THIS package (named condition catalog, G1).
+         * DECLARATION ONLY — the server resolves policyRef → real install conditions at
+         * install time (SSOT); the client never asserts or enforces. glpkg reads this
+         * key (`glpkg.policy`) from the manifest and forwards it as `policyRef`.
+         * Format: ^[a-z0-9]+(?:[-/][a-z0-9]+)*$  (e.g. 'public', 'ist-login', 'tier/pro').
+         */
+        policy?: string;
+    };
     components: SkitComponents;
     install: SkitInstallPaths;
+    /** Pricing metadata (informational; access control is server-side / SSOT). */
+    pricing?: SkitPricing;
+    /**
+     * @deprecated DEAD FIELD — declared but never consumed. skit does NOT read
+     * `requires` at install time: prerequisite/first-install ordering is not
+     * resolved or enforced. (`dependencies.skit` recursive install has also been
+     * removed — skit bundling is consolidated onto the snapshot package manager.)
+     * Retained for backward-compatible typing only.
+     */
+    requires?: string[];
+    /**
+     * Runtime packages a purchase entitles (e.g. the binaries a prompt documents).
+     * Informational/provenance — the authoritative entitlement decision is server-side.
+     */
+    runtime?: SkitRuntimeEntitlement;
+    /**
+     * Profile permission overlays applied on install (and reverted on uninstall).
+     * Maps a target profile name to allowedTools entries to union into that
+     * profile's front-matter. Enables a paid add-on to grant execution permission
+     * (e.g. `Bash(smon:*)`) to a profile shipped by a separate (free) base kit.
+     * @example { "tda-manager": ["Bash(smon:*)"] }
+     */
+    profilePermissions?: ProfilePermissions;
+}
+/**
+ * Pricing metadata block.
+ */
+export interface SkitPricing {
+    price: number;
+    currency?: string;
+    billing?: 'one-time' | 'subscription' | string;
 }
+/**
+ * Runtime entitlement descriptor.
+ */
+export interface SkitRuntimeEntitlement {
+    description?: string;
+    entitlements: string[];
+}
+/**
+ * Profile permission overlay map: profileName -> allowedTools entries to add.
+ */
+export type ProfilePermissions = Record<string, string[]>;
+/**
+ * Named-policy identifier pattern (license G1 condition catalog). Lowercase
+ * alphanumerics separated by single '-' or '/'. e.g. 'public', 'ist-login', 'tier/pro'.
+ */
+export declare const POLICY_NAME_PATTERN: RegExp;
+/**
+ * Validate a policy name against the license G1 catalog format.
+ */
+export declare function isValidPolicyName(name: string): boolean;
+/**
+ * Read + validate a manifest's declared named-policy reference (glpkg G2
+ * convention f7a5c3f: `manifest.glpkg.policy`). Mirrors glpkg's readPolicy:
+ * returns the policy name, undefined when none declared, and THROWS (fail-fast)
+ * on a malformed name. The server (G1 catalog) resolves it — client only forwards.
+ */
+export declare function readManifestPolicy(manifest: {
+    glpkg?: {
+        policy?: string;
+    };
+} | null | undefined): string | undefined;
 /**
  * Component type names
  */

package/node_modules/@microwiseai/skit/dist/types/skit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skit.d.ts","sourceRoot":"","sources":["../../src/types/skit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;OAGG;IACH,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,CAAC,KAAK,EAAE,MAAM,GAAG;QACf,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC;AAEjD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;AAEnF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,iBAAiB,GAAG,OAAO,CAAC;AAEnE;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAInE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB,IAAI,EAAE,wBAAwB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"skit.d.ts","sourceRoot":"","sources":["../../src/types/skit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE7D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC;IACjD;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,6DAA6D;QAC7D,MAAM,CAAC,EAAE,mBAAmB,CAAC;QAC7B;;;;;;WAMG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,UAAU,GAAG,cAAc,GAAG,MAAM,CAAC;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAkC,CAAC;AAEnE;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE;IAAE,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC3D,MAAM,GAAG,SAAS,CAUpB;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC;AAEjD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;AAEnF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,iBAAiB,GAAG,OAAO,CAAC;AAEnE;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAInE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB,IAAI,EAAE,wBAAwB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/node_modules/@microwiseai/skit/dist/utils/dep-plan.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Global dependency planning for `skit install` (deps-control, 0.1.44).
+ *
+ * Decides, per declared global dependency (`dependencies.npm` entries and
+ * `components.clis` packages), whether to keep the installed copy, install it,
+ * change (reinstall) it, or skip it — based on the `--deps` mode, `--skip-dep`
+ * list and the version currently installed under `npm root -g`.
+ *
+ * The decision functions are PURE (no IO) so every mode is unit-testable; the
+ * only IO lives in {@link createGlobalVersionLookup} (one cached `npm root -g`
+ * spawn + fs reads — never one npm spawn per dependency).
+ */
+/** `--deps` mode. */
+export type DepsMode = 'satisfied' | 'missing' | 'all' | 'none';
+export declare const DEPS_MODES: readonly DepsMode[];
+/** Default mode (changed from the implicit `all` in <=0.1.43). */
+export declare const DEFAULT_DEPS_MODE: DepsMode;
+export type DepAction = 'keep' | 'install' | 'change' | 'skip';
+/** Risky-change markers attached to a `change` entry. */
+export type DepWarning = 'downgrade' | 'prerelease-to-stable';
+export interface DepPlanEntry {
+    /** npm package name */
+    name: string;
+    /** declared range ('latest' when none) */
+    range: string;
+    /** currently installed global version, if any */
+    installed?: string;
+    action: DepAction;
+    /** short human reason */
+    reason: string;
+    /** where the dep was declared */
+    kind: 'npm' | 'cli';
+    /** risky-change markers (only on `change`) */
+    warnings?: DepWarning[];
+    /** highest version in range newer than `installed` (dry-run registry lookup only) */
+    newerInRange?: string;
+    /**
+     * Installed version is ABOVE the declared range and was kept (no downgrade —
+     * D10 ②, official behavior) under `satisfied`. The installer prints a warning
+     * naming the kit + range responsible.
+     */
+    aboveRange?: boolean;
+    /**
+     * TEMP(D10 state P): installed is a PRERELEASE the range does not opt into
+     * (core inside the range). Kept under `satisfied` (replacing it may downgrade);
+     * the installer warns. The D10 package replaces this with a registry-guarded
+     * change (B-stage: select, then keep if not higher).
+     */
+    prereleaseKept?: boolean;
+}
+/** A declared global dependency, before planning. */
+export interface DeclaredDep {
+    name: string;
+    range: string;
+    kind: 'npm' | 'cli';
+    /** extra names `--skip-dep` may match (e.g. a CLI's command name) */
+    aliases?: string[];
+}
+/** Parse/validate a `--deps` value. Throws on an unknown mode. */
+export declare function parseDepsMode(value: string): DepsMode;
+/**
+ * Resolve the effective mode from the lib options: explicit `deps` wins, the
+ * legacy `skipDependencies: true` is an alias for `none`, else the default.
+ */
+export declare function resolveDepsMode(opts: {
+    deps?: DepsMode;
+    skipDependencies?: boolean;
+}): DepsMode;
+/**
+ * Does `installed` satisfy `range`? — D2 policy semantics (D10 design §3.2):
+ * node-semver DEFAULT rules (no `includePrerelease`). A stable version is judged
+ * normally; a PRERELEASE satisfies only a range that names a prerelease on the
+ * same M.m.p (`0.4.8-dev.1` does NOT satisfy `^0.4.7`; it does satisfy
+ * `^0.4.8-dev.0`). `''`/`*`/`latest` = any STABLE version (a prerelease does not
+ * match "unspecified"). `undefined` = the range cannot be judged.
+ */
+export declare function satisfiesRange(installed: string, range: string): boolean | undefined;
+/**
+ * Where `installed` sits relative to `range` (precedence over ALL versions,
+ * prereleases included):
+ *  - `in`    — satisfies (see {@link satisfiesRange});
+ *  - `above` — higher than every version the range admits (never downgrade);
+ *  - `below` — lower than the lowest version the range admits (safe upgrade);
+ *  - `prerelease-inside` — a prerelease whose core is inside the range but the
+ *    range does not opt into it (D10 state P): the range's best stable may be
+ *    lower OR higher, so it cannot be replaced without a registry lookup;
+ *  - `gap`   — stable, not satisfying, between `||` sets (npm picks a higher one).
+ * `undefined` when the range or the version cannot be judged.
+ * (Default-flag `gtr`/`ltr` are both true for `0.4.8-dev.1` vs `^0.4.7`, so they
+ * are not used for the prerelease case.)
+ */
+export type RangePosition = 'in' | 'above' | 'below' | 'prerelease-inside' | 'gap';
+export declare function rangePosition(installed: string, range: string): RangePosition | undefined;
+/**
+ * Risk markers for replacing `installed` with whatever npm resolves for `range`:
+ * - `downgrade`: installed is ABOVE the whole range (npm would go backwards);
+ * - `prerelease-to-stable`: installed is a prerelease and the range does not
+ *   opt into prereleases (npm would replace the dev build with a stable one).
+ */
+export declare function changeWarnings(installed: string, range: string): DepWarning[];
+/**
+ * Decide the action for ONE dependency. Pure.
+ *
+ *   skip-dep      -> skip
+ *   none          -> skip
+ *   absent        -> install (every mode except none)
+ *   all           -> change  (unconditional reinstall, old behavior)
+ *   missing       -> keep    (any installed version, even out of range)
+ *   satisfied     -> keep when installed satisfies range (D2 semantics); keep
+ *                    (NO downgrade, `aboveRange`) when above the range; keep
+ *                    (`prereleaseKept`) for a prerelease inside the range core;
+ *                    change when below the range (P keep is TEMP(D10))
+ */
+export declare function decideDep(dep: DeclaredDep, installed: string | undefined, mode: DepsMode, skipDeps?: ReadonlySet<string>): DepPlanEntry;
+/** Plan every declared dependency. Pure given `lookup`. */
+export declare function planDeps(deps: DeclaredDep[], opts: {
+    mode: DepsMode;
+    skipDeps?: Iterable<string>;
+    lookup: (name: string) => string | undefined;
+}): DepPlanEntry[];
+/** Entries the installer must act on (install or change). */
+export declare function needsInstall(entry: DepPlanEntry): boolean;
+/** True for a `change` that carries a downgrade / prerelease→stable risk. */
+export declare function isRiskyChange(entry: DepPlanEntry): boolean;
+/** Turn a declined risky change into a skip (keeps the installed version). */
+export declare function declineChange(entry: DepPlanEntry): DepPlanEntry;
+/**
+ * Annotate `keep` entries with the newest in-range version from the registry
+ * when it is newer than the installed one. Network — call only for dry-run.
+ * `resolveMax` returns the highest version satisfying the range (or null);
+ * lookup failures are ignored (annotation is best-effort).
+ */
+export declare function annotateNewerInRange(plan: DepPlanEntry[], resolveMax: (name: string, range: string) => Promise<string | null | undefined>): Promise<DepPlanEntry[]>;
+/**
+ * Render the plan as plain text lines (no colors; the CLI may colorize).
+ * Header + one aligned row per dep + a hint line per risky change.
+ */
+export declare function formatDepPlan(plan: DepPlanEntry[], mode: DepsMode): string[];
+/** @internal Reset the cached `npm root -g` (test-only). */
+export declare function resetGlobalRootCache(): void;
+/** `npm root -g`, spawned at most once per process; null when unavailable. */
+export declare function getGlobalNpmRoot(): string | null;
+/** Read `<root>/<name>/package.json` version; undefined when absent/unreadable. */
+export declare function readInstalledVersion(root: string, name: string): string | undefined;
+/**
+ * Build an installed-version lookup over the global npm root. When the root
+ * cannot be determined every dep reads as absent (=> install, the old behavior).
+ */
+export declare function createGlobalVersionLookup(root?: string | null): (name: string) => string | undefined;
+//# sourceMappingURL=dep-plan.d.ts.map

package/node_modules/@microwiseai/skit/dist/utils/dep-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-plan.d.ts","sourceRoot":"","sources":["../../src/utils/dep-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,qBAAqB;AACrB,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhE,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAA4C,CAAC;AAEvF,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,EAAE,QAAsB,CAAC;AAEvD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE/D,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,sBAAsB,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC3B,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGrD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,QAAQ,CAI/F;AAQD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAKpF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,mBAAmB,GAAG,KAAK,CAAC;AAEnF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAYzF;AAOD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAU7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,IAAI,EAAE,QAAQ,EACd,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,YAAY,CAkEd;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CACtB,IAAI,EAAE,WAAW,EAAE,EACnB,IAAI,EAAE;IACJ,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAC9C,GACA,YAAY,EAAE,CAKhB;AAUD,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAEzD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAE1D;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAM/D;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,YAAY,EAAE,EACpB,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAC9E,OAAO,CAAC,YAAY,EAAE,CAAC,CAiBzB;AASD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,CAyB5E;AAQD,4DAA4D;AAC5D,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAUhD;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAOpG"}

package/node_modules/@microwiseai/skit/dist/utils/file-copy.d.ts

@@ -10,17 +10,22 @@ export declare function getInstallPath(manifest: SkitManifest, componentType: Fi
 /**
  * Install a single component
  */
-export declare function installComponent(stagingDir: string, targetDir: string, componentFile: string, componentType: FileComponentType, componentName: string): Promise<InstallResult>;
+export declare function installComponent(stagingDir: string, targetDir: string, componentFile: string, componentType: FileComponentType, componentName: string, plan?: boolean): Promise<InstallResult>;
 /**
  * Install a single pack by merging into permission-packs.json
  */
-export declare function installPack(stagingDir: string, packFile: string, packName: string): Promise<InstallResult>;
+export declare function installPack(stagingDir: string, packFile: string, packName: string, plan?: boolean): Promise<InstallResult>;
 /**
  * Install a state directory (copies entire directory: state.json + *.md files)
  */
-export declare function installStateDirectory(stagingDir: string, targetBaseDir: string, stateDir: string, stateName: string): Promise<InstallResult>;
+export declare function installStateDirectory(stagingDir: string, targetBaseDir: string, stateDir: string, stateName: string, plan?: boolean): Promise<InstallResult>;
 /**
- * Install all components from a manifest
+ * Install all components from a manifest.
+ *
+ * `options.plan`: compute every component's target path WITHOUT touching the
+ * filesystem (used for the shared-path conflict check before writing).
  */
-export declare function installAllComponents(manifest: SkitManifest, stagingDir: string, defaultPaths: Record<FileComponentType, string>): Promise<InstallSummary>;
+export declare function installAllComponents(manifest: SkitManifest, stagingDir: string, defaultPaths: Record<FileComponentType, string>, options?: {
+    plan?: boolean;
+}): Promise<InstallSummary>;
 //# sourceMappingURL=file-copy.d.ts.map

package/node_modules/@microwiseai/skit/dist/utils/file-copy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-copy.d.ts","sourceRoot":"","sources":["../../src/utils/file-copy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,cAAc,EAKf,MAAM,kBAAkB,CAAC;AAG1B;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,YAAY,EACtB,aAAa,EAAE,iBAAiB,EAChC,YAAY,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAC9C,MAAM,CAIR;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,iBAAiB,EAChC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC,CA8BxB;AAyBD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAmCxB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAmBD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAC9C,OAAO,CAAC,cAAc,CAAC,CAoFzB"}
+{"version":3,"file":"file-copy.d.ts","sourceRoot":"","sources":["../../src/utils/file-copy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,cAAc,EAKf,MAAM,kBAAkB,CAAC;AAG1B;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,YAAY,EACtB,aAAa,EAAE,iBAAiB,EAChC,YAAY,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAC9C,MAAM,CAIR;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,iBAAiB,EAChC,aAAa,EAAE,MAAM,EACrB,IAAI,UAAQ,GACX,OAAO,CAAC,aAAa,CAAC,CAiCxB;AAyBD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,UAAQ,GACX,OAAO,CAAC,aAAa,CAAC,CAsCxB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,UAAQ,GACX,OAAO,CAAC,aAAa,CAAC,CA+BxB;AAmBD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,EAC/C,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,cAAc,CAAC,CAwFzB"}

package/node_modules/@microwiseai/skit/dist/utils/gitlab-registry.d.ts

@@ -0,0 +1,91 @@
+/**
+ * GitLab group registry URL resolution for the gitlab-direct npm-dependency
+ * install path.
+ *
+ * This module is PURE / dependency-injected (host + token are passed in, never
+ * imported from lib.ts) so it can be consumed by both `lib.ts` (installNpmDeps)
+ * and `commands/browse.ts` WITHOUT creating an import cycle
+ * (browse.ts -> lib.ts already exists).
+ *
+ * Fix A (proxy-leak): a `dependencies.npm` entry with `source: 'gitlab'` used to
+ * require the author to hand-declare `registry[scope].url`; when it was absent
+ * the installer SILENTLY degraded the dep to the anonymous registry-proxy path,
+ * where a selective proxy 401s private scopes (@ist / @microwiseai / @mwd-*).
+ * We now DERIVE the group registry URL from the declared `registry[scope].group`
+ * NAME (name -> numeric id -> group npm registry URL), so gitlab-direct works
+ * from a `{ group }`-only manifest and no silent degrade is needed.
+ */
+import type { ScopeRegistryMapping } from '../types/skit.js';
+/**
+ * Default timeout (ms) for the group-id lookup. Fix A newly inserts this network
+ * call into the DEFAULT (source-unset) install of a `{ group }`-only manifest —
+ * previously that path did no network and degraded to the proxy instantly. A
+ * private host that black-holes the request must NOT hang the install: we bound
+ * it so a timeout throws, is caught by installNpmDeps, and the default flow falls
+ * back to the proxy (explicit `--source gitlab` still fails loud). Override via
+ * `SKIT_GROUP_ID_TIMEOUT_MS` (positive integer) for slow networks.
+ */
+export declare const DEFAULT_GROUP_ID_TIMEOUT_MS = 5000;
+/** Resolve the group-id lookup timeout (ms), honoring SKIT_GROUP_ID_TIMEOUT_MS. */
+export declare function resolveGroupIdTimeoutMs(env?: Record<string, string | undefined>): number;
+/**
+ * Build a GitLab group npm registry base URL from a numeric group id. Mirrors
+ * glpkg's `buildGroupRegistryUrl` (api/client.ts) and the trailing-slash form
+ * `npmrcAuthKey` (utils/temp-npmrc.ts) expects.
+ *
+ * @example
+ * buildGitlabGroupNpmRegistryUrl('gitlab.com', 456)
+ * // => 'https://gitlab.com/api/v4/groups/456/-/packages/npm/'
+ */
+export declare function buildGitlabGroupNpmRegistryUrl(host: string, groupId: number): string;
+/**
+ * Resolve a GitLab group PATH → numeric id. Anonymous for a public group; a
+ * token (when present) enables private groups.
+ *
+ * Moved here from `commands/browse.ts` (re-exported there for backward compat)
+ * so the gitlab-direct install path can reuse it cycle-free. @internal
+ */
+export declare function resolveGroupId(host: string, group: string, token: string | null, timeoutMs?: number): Promise<number>;
+/**
+ * Resolve the gitlab-direct npm registry base URL for a scope from its manifest
+ * `registry[scope]` entry. Precedence (Fix A):
+ *   1. explicit `entry.url` (author-declared) — used verbatim (unchanged);
+ *   2. derive from `entry.group` NAME → numeric id → group npm registry URL;
+ *   3. `null` when the scope has neither a `url` nor a `group`.
+ *
+ * THROWS only when a declared `group` cannot be resolved (network / 404 / 403);
+ * the caller decides whether that is fatal (explicit `--source gitlab`) or a
+ * soft fall-through to the proxy (default flow — no regression).
+ *
+ * `resolveId` is injectable for tests (defaults to {@link resolveGroupId}).
+ */
+export declare function resolveScopeGitlabRegistryUrl(scope: string, registry: ScopeRegistryMapping, host: string, token: string | null, resolveId?: (host: string, group: string, token: string | null) => Promise<number>): Promise<string | null>;
+/** Outcome of routing a gitlab-batch npm dep (see {@link decideGitlabRouting}). */
+export type GitlabRouting = {
+    batch: 'gitlab';
+    registryUrl: string;
+} | {
+    batch: 'proxy';
+    warning: string | null;
+};
+/**
+ * PURE decision (no network) for a dep that the distkit matrix put in the
+ * 'gitlab' batch, given the ALREADY-resolved group-registry URL (or the error
+ * from trying to resolve it). Fix A + Fix B live here:
+ *
+ *  - URL resolved            -> `{ batch: 'gitlab', registryUrl }`.
+ *  - URL null / resolve error:
+ *      · `explicitSource === 'gitlab'` -> THROW (fail loud, name dep/scope + fix).
+ *      · otherwise                     -> `{ batch: 'proxy', warning }` — preserve
+ *        the anonymous-proxy fall-through so an un-migrated kit does not regress.
+ *
+ * Kept separate from the network resolution so it is trivially unit-testable.
+ */
+export declare function decideGitlabRouting(opts: {
+    spec: string;
+    scope: string | undefined;
+    registryUrl: string | null;
+    resolveError?: unknown;
+    explicitSource?: 'gitlab' | 'proxy';
+}): GitlabRouting;
+//# sourceMappingURL=gitlab-registry.d.ts.map

package/node_modules/@microwiseai/skit/dist/utils/gitlab-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-registry.d.ts","sourceRoot":"","sources":["../../src/utils/gitlab-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD,mFAAmF;AACnF,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAKR;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpF;AAOD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,GAAE,MAAkC,GAC5C,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAkB,GACjG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE/C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACrC,GAAG,aAAa,CAoChB"}

package/node_modules/@microwiseai/skit/dist/utils/installed-registry.d.ts

@@ -8,6 +8,12 @@ export interface InstalledKit {
     version: string;
     installedAt: string;
     files: string[];
+    /**
+     * Profile permission overlays applied by this kit on install
+     * (profileName -> allowedTools entries added). Recorded so uninstall can
+     * revert exactly what was granted. Absent for kits with no overlays.
+     */
+    profileGrants?: Record<string, string[]>;
 }
 /**
  * Registry structure
@@ -15,6 +21,10 @@ export interface InstalledKit {
 export interface InstalledRegistry {
     [packageName: string]: InstalledKit;
 }
+/**
+ * Expand ~ to home directory
+ */
+export declare function expandPath(path: string): string;
 /**
  * Contract path to use ~ for home directory
  */
@@ -34,15 +44,61 @@ export declare function getInstalledKit(packageName: string): Promise<InstalledK
 /**
  * Register an installed kit
  */
-export declare function registerInstalledKit(packageName: string, version: string, files: string[]): Promise<void>;
+export declare function registerInstalledKit(packageName: string, version: string, files: string[], profileGrants?: Record<string, string[]>): Promise<void>;
 /**
  * Unregister a kit
  */
 export declare function unregisterKit(packageName: string): Promise<void>;
 /**
- * Remove files from previous installation
+ * Shared merged files (several kits merge entries into ONE file, e.g.
+ * permission-packs.json). Never deleted by file cleanup — deleting it would
+ * drop every other kit's entries.
+ */
+export declare function isMergedFile(file: string): boolean;
+/**
+ * Paths recorded by installed kits OTHER than `packageName`
+ * (key → owning kit names). Used for the ownership check and the install-time
+ * shared-path warning.
+ */
+export declare function pathsOwnedByOthers(registry: InstalledRegistry, packageName: string): Map<string, string[]>;
+/** Result of {@link removeKitFiles}. */
+export interface RemoveKitFilesResult {
+    /** Files deleted (or, under dryRun, that would be deleted). */
+    removed: string[];
+    /** Files kept because another installed kit also records them. */
+    keptShared: Array<{
+        file: string;
+        owners: string[];
+    }>;
+    /** Files kept because the new version installs them again (upgrade). */
+    keptInNewVersion: string[];
+    /** Shared merged files (permission-packs.json) — never deleted here. */
+    keptMerged: string[];
+    failed: Array<{
+        file: string;
+        error: string;
+    }>;
+}
+/**
+ * Remove the files recorded for `packageName`, with an OWNERSHIP check:
+ *  - a path another installed kit also records is KEPT (cross-kit delete bug:
+ *    archkit 0.3.0→0.4.0 deleted debug-kit's prompts/global/arch-lint.md);
+ *  - `keep` (the new version's target paths, on upgrade) is KEPT — only files
+ *    dropped by the new version are deleted;
+ *  - merged shared files (permission-packs.json) are never deleted.
+ * Does not touch the registry entry itself.
+ */
+export declare function removeKitFiles(packageName: string, options?: {
+    keep?: Iterable<string>;
+    dryRun?: boolean;
+}): Promise<RemoveKitFilesResult>;
+/**
+ * Remove files from a previous installation (ownership-checked; see
+ * {@link removeKitFiles}). Returns the removed files.
  */
-export declare function cleanPreviousInstall(packageName: string): Promise<string[]>;
+export declare function cleanPreviousInstall(packageName: string, options?: {
+    keep?: Iterable<string>;
+}): Promise<string[]>;
 /**
  * List all installed kits
  */