@octonodes/cli 0.2.4 → 0.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@octonodes/cli",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Octonode API and plugin development CLI.",
   "license": "MIT",
   "repository": {
@@ -21,7 +21,7 @@
     "prepack": "tsc -b"
   },
   "dependencies": {
-    "@octonodes/sdk": "0.2.4",
+    "@octonodes/sdk": "0.2.6",
     "@supabase/supabase-js": "2.107.0",
     "esbuild": "0.28.1",
     "tar": "7.5.22",

package/runtime/plugin-lifecycle.cjs

@@ -11541,7 +11541,7 @@ var require_plugin_publishing = __commonJS({
   "packages/schema/dist/plugin-publishing.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PluginCloudBuild = exports2.PluginPublisherBuildDetail = exports2.PluginPublisherBuilds = exports2.PluginPublisherBuildQuery = exports2.PluginPublisherApplied = exports2.PluginPublisherApply = exports2.PluginPublisherReview = exports2.PluginPublisherReviewItem = exports2.PluginPublisherOperation = exports2.PluginPublisherConnections = exports2.PluginPublisherConnection = exports2.PluginPublisherPreview = exports2.PluginPublisherConsent = exports2.PluginPublisherAutomatic = exports2.PluginPublisherRepository = exports2.PluginPublisherInput = exports2.pluginReleaseScope = exports2.PluginReleaseConfig = exports2.PluginConfigPath = void 0;
+    exports2.PluginCloudBuild = exports2.PluginPublisherBuildDetail = exports2.PluginPublisherBuilds = exports2.PluginPublisherBuildQuery = exports2.PluginPublisherListQuery = exports2.PluginPublisherApplied = exports2.PluginPublisherApply = exports2.PluginPublisherReview = exports2.PluginPublisherReviewItem = exports2.PluginPublisherOperation = exports2.PluginPublisherConnections = exports2.PluginPublisherConnection = exports2.PluginPublisherPreview = exports2.PluginPublisherConsent = exports2.PluginPublisherAutomatic = exports2.PluginPublisherRepository = exports2.PluginPublisherInput = exports2.pluginReleaseScope = exports2.PluginReleaseConfig = exports2.PluginConfigPath = void 0;
     var zod_1 = require("zod");
     var plugin_version_1 = require_plugin_version();
     exports2.PluginConfigPath = zod_1.z.string().max(512).refine((path) => /^(?:[a-zA-Z0-9_.-]+\/)*(?:plugin\.octonode\.(?:json|ya?ml)|octonode\.plugin\.json)$/.test(path) && !path.split("/").some((part) => [".", "..", ".git", "node_modules"].includes(part)), "Select a repository-relative octonode.plugin.json file (older plugin.octonode release files also work)");
@@ -11612,17 +11612,32 @@ var require_plugin_publishing = __commonJS({
       repositoryId: zod_1.z.number(),
       buildId: zod_1.z.number()
     });
+    exports2.PluginPublisherListQuery = zod_1.z.object({
+      q: zod_1.z.string().trim().max(200).default(""),
+      offset: zod_1.z.coerce.number().int().min(0).max(1e6).default(0),
+      limit: zod_1.z.coerce.number().int().min(1).max(100).default(25),
+      days: zod_1.z.enum(["7", "30", "90"]).default("30"),
+      scope: zod_1.z.enum(["", "user", "group", "org", "public"]).default(""),
+      source: zod_1.z.enum(["", "sdk", "npm"]).default(""),
+      sort: zod_1.z.enum(["updated", "name", "version", "scope", "source", "installs", "score", "versions"]).default("updated"),
+      direction: zod_1.z.enum(["asc", "desc"]).default("desc")
+    });
     exports2.PluginPublisherBuildQuery = zod_1.z.object({
       repositoryId: zod_1.z.coerce.number().int().positive().optional(),
-      page: zod_1.z.coerce.number().int().min(1).max(1e3).default(1),
+      page: zod_1.z.coerce.number().int().min(1).max(1e6).default(1),
       search: zod_1.z.string().max(200).default(""),
       status: zod_1.z.enum(["", "queued", "in_progress", "success", "failure"]).default(""),
-      sort: zod_1.z.enum(["newest", "oldest", "name"]).default("newest")
+      sort: zod_1.z.enum(["newest", "oldest", "name", "status", "branch", "sha"]).default("newest"),
+      direction: zod_1.z.enum(["asc", "desc"]).default("asc"),
+      limit: zod_1.z.coerce.number().int().min(1).max(100).default(30),
+      branch: zod_1.z.string().trim().max(200).default(""),
+      sha: zod_1.z.string().trim().max(200).default("")
     });
     exports2.PluginPublisherBuilds = zod_1.z.object({
       total: zod_1.z.number(),
       page: zod_1.z.number(),
       hasMore: zod_1.z.boolean(),
+      limit: zod_1.z.number(),
       items: zod_1.z.array(zod_1.z.object({
         id: zod_1.z.number(),
         repositoryId: zod_1.z.number(),
@@ -11670,6 +11685,43 @@ var require_plugin_publishing = __commonJS({
   }
 });
 
+// packages/schema/dist/plugin-allowlist.js
+var require_plugin_allowlist = __commonJS({
+  "packages/schema/dist/plugin-allowlist.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.PluginAllowlistPage = exports2.PluginAllowlistInput = exports2.PluginAllowlistQuery = exports2.PluginAllowlistKind = void 0;
+    var zod_1 = require("zod");
+    exports2.PluginAllowlistKind = zod_1.z.enum(["org", "team", "user"]);
+    exports2.PluginAllowlistQuery = zod_1.z.object({
+      kind: exports2.PluginAllowlistKind,
+      q: zod_1.z.string().trim().max(200).default(""),
+      status: zod_1.z.enum(["allowed", "available", "all"]).default("allowed"),
+      sort: zod_1.z.enum(["name", "id"]).default("name"),
+      direction: zod_1.z.enum(["asc", "desc"]).default("asc"),
+      offset: zod_1.z.coerce.number().int().min(0).max(1e6).default(0),
+      limit: zod_1.z.coerce.number().int().min(1).max(100).default(25)
+    });
+    exports2.PluginAllowlistInput = zod_1.z.object({
+      kind: exports2.PluginAllowlistKind,
+      id: zod_1.z.string().min(1).max(200)
+    }).strict();
+    exports2.PluginAllowlistPage = zod_1.z.object({
+      items: zod_1.z.array(zod_1.z.object({
+        id: zod_1.z.string(),
+        name: zod_1.z.string(),
+        allowed: zod_1.z.boolean(),
+        inherited: zod_1.z.boolean(),
+        eligible: zod_1.z.boolean()
+      })),
+      total: zod_1.z.number(),
+      offset: zod_1.z.number(),
+      limit: zod_1.z.number(),
+      canAdd: zod_1.z.boolean()
+    });
+  }
+});
+
 // packages/schema/dist/index.js
 var require_dist = __commonJS({
   "packages/schema/dist/index.js"(exports2) {
@@ -11735,6 +11787,7 @@ var require_dist = __commonJS({
     __exportStar(require_execution(), exports2);
     __exportStar(require_execution_constants(), exports2);
     __exportStar(require_plugin_publishing(), exports2);
+    __exportStar(require_plugin_allowlist(), exports2);
   }
 });
 
@@ -12201,8 +12254,8 @@ var require_constants2 = __commonJS({
     exports2.OCTONODE_STORE_DIR = OCTONODE_STORE_DIR;
     var OCTONODE_STUDIO_URL = () => exports2.PROCESS_ENV.OCTONODE_STUDIO_URL ?? exports2.PROCESS_ENV.VITE_OCTONODE_STUDIO_URL ?? exports2.PROCESS_ENV.VITE_PUBLIC_OCTONODE_STUDIO_URL;
     exports2.OCTONODE_STUDIO_URL = OCTONODE_STUDIO_URL;
-    var OCTONODE_USER = () => exports2.PROCESS_ENV.OCTONODE_USER;
-    exports2.OCTONODE_USER = OCTONODE_USER;
+    var OCTONODE_USER2 = () => exports2.PROCESS_ENV.OCTONODE_USER;
+    exports2.OCTONODE_USER = OCTONODE_USER2;
     var OCTONODE_USER_EMAIL = () => exports2.PROCESS_ENV.OCTONODE_USER_EMAIL;
     exports2.OCTONODE_USER_EMAIL = OCTONODE_USER_EMAIL;
     var OCTONODE_VISUAL_PORT = () => exports2.PROCESS_ENV.OCTONODE_VISUAL_PORT;
@@ -12716,6 +12769,7 @@ var PLUGIN_BUNDLE_EXCLUDES = [
   "*.pem",
   "*.key"
 ];
+var MAX_CATALOG_MANIFESTS = 512;
 
 // packages/plugin/src/integrity.ts
 function collectFiles(dir, base, files) {
@@ -12875,6 +12929,79 @@ function loadPlugin(dir, source = "user") {
 function isPluginDir(dir) {
   return import_schema2.PLUGIN_DEFINITION_FILENAMES.some((name) => (0, import_node_fs4.existsSync)((0, import_node_path4.join)(dir, name)));
 }
+function pluginDirsIn(root) {
+  if (!(0, import_node_fs4.existsSync)(root)) return [];
+  const out = [];
+  for (const name of (0, import_node_fs4.readdirSync)(root)) {
+    if (name.startsWith(".")) continue;
+    const dir = (0, import_node_path4.join)(root, name);
+    try {
+      if ((0, import_node_fs4.statSync)(dir).isDirectory() && isPluginDir(dir)) out.push(dir);
+    } catch {
+    }
+  }
+  return out;
+}
+function discoverPluginCatalog(opts = {}) {
+  return discover(opts, true);
+}
+var catalogManifests = /* @__PURE__ */ new Map();
+function catalogManifest(dir) {
+  const path = (0, import_plugin_runtime2.pluginDefinitionPath)(dir);
+  const stat = (0, import_node_fs4.statSync)(path);
+  const revision = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+  const cached = catalogManifests.get(path);
+  if (cached?.revision === revision) return cached.manifest;
+  const manifest2 = loadPluginManifest(dir);
+  if (catalogManifests.size >= MAX_CATALOG_MANIFESTS) catalogManifests.delete(catalogManifests.keys().next().value);
+  catalogManifests.set(path, { revision, manifest: manifest2 });
+  return manifest2;
+}
+function discover(opts, metadataOnly) {
+  const plugins = [];
+  const errors = [];
+  const seen = /* @__PURE__ */ new Set();
+  const scanRoot = (root, source) => {
+    for (const dir of pluginDirsIn(root)) {
+      try {
+        const manifest2 = metadataOnly ? catalogManifest(dir) : loadPluginManifest(dir);
+        if (seen.has(manifest2.id)) continue;
+        seen.add(manifest2.id);
+        plugins.push({ manifest: manifest2, dir, source });
+      } catch (err) {
+        errors.push({ dir, message: err.message });
+      }
+    }
+  };
+  scanRoot(projectPluginRoot(opts.cwd), "project");
+  try {
+    const lock = readLockfile(opts.cwd);
+    for (const [id, entry] of Object.entries(lock.plugins)) {
+      if (seen.has(id)) continue;
+      const dir = storeEntryDir(entry.pluginId ?? id, entry.version, entry.sha256, opts.storeRoot);
+      if (!isPluginDir(dir)) {
+        errors.push({
+          dir,
+          message: `plugin "${id}"@${entry.version} is locked but missing from the store \u2014 run \`octonode install\``
+        });
+        continue;
+      }
+      try {
+        const manifest2 = metadataOnly ? catalogManifest(dir) : loadPluginManifest(dir);
+        if (manifest2.id !== (entry.pluginId ?? id) || manifest2.version !== entry.version || !metadataOnly && hashPluginDir(dir) !== entry.sha256)
+          throw new Error(`Locked plugin ${id} failed identity or integrity validation; run octonode install`);
+        seen.add(id);
+        plugins.push({ manifest: { ...manifest2, id }, dir, source: "store" });
+      } catch (err) {
+        errors.push({ dir, message: err.message });
+      }
+    }
+  } catch (err) {
+    errors.push({ dir: opts.cwd ?? process.cwd(), message: err.message });
+  }
+  scanRoot(opts.userRoot ?? userPluginRoot(), "user");
+  return { plugins, errors };
+}
 
 // packages/plugin/src/dependencies.ts
 var import_node_child_process = require("node:child_process");
@@ -13254,7 +13381,7 @@ async function run(project, command, cwd, cacheRoot) {
     maxBuffer: 4 * 1024 * 1024
   });
 }
-async function verifyProjectDependencies(project, names) {
+async function verifyProjectDependencies(project, names, versions = {}) {
   if (!names.length) return;
   const pnp = (0, import_node_path6.join)(project.root, ".pnp.cjs");
   const loader = (0, import_node_path6.join)(project.root, ".pnp.loader.mjs");
@@ -13266,14 +13393,37 @@ async function verifyProjectDependencies(project, names) {
       "--input-type=module",
       "-e",
       `import { createRequire } from 'node:module';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 const require = createRequire(${JSON.stringify((0, import_node_path6.join)(project.target, "package.json"))});
+const versions = ${JSON.stringify(versions)};
 for (const name of ${JSON.stringify(names)}) {
-  try { require.resolve(name); } catch {
+  let resolved;
+  try { resolved = require.resolve(name); } catch {
     const entry = import.meta.resolve(name);
+    resolved = entry.startsWith('file:') ? fileURLToPath(entry) : undefined;
     if (entry.startsWith('file:') && !existsSync(fileURLToPath(entry))) throw new Error('missing package entry: ' + name);
   }
+  const identity = name.startsWith('@') ? name.split('/').slice(0, 2).join('/') : name.split('/')[0];
+  if (Object.hasOwn(versions, identity)) {
+    let directory = resolved ? dirname(resolved) : '';
+    let matched = false;
+    while (directory) {
+      const file = join(directory, 'package.json');
+      if (existsSync(file)) {
+        const pkg = JSON.parse(readFileSync(file, 'utf8'));
+        if (pkg.name === identity) {
+          if (pkg.version !== versions[identity]) throw new Error('installed dependency version mismatch: ' + name);
+          matched = true; break;
+        }
+      }
+      const parent = dirname(directory);
+      if (parent === directory) break;
+      directory = parent;
+    }
+    if (!matched) throw new Error('cannot verify installed package: ' + name);
+  }
 }`
     ],
     { cwd: project.target, env: (0, import_common.childProcessEnvironment)(), timeout: 3e4, maxBuffer: 1024 * 1024 }
@@ -13323,7 +13473,40 @@ async function reconcileDependencies(cwd, dependencies, options = {}) {
       throw new Error("invalid npm dependency subpath");
     }
   }
+  const unique = /* @__PURE__ */ new Map();
+  for (const dependency of dependencies) {
+    const spec = dependency.spec.startsWith(`${dependency.name}@`) ? dependency.spec.slice(dependency.name.length + 1) : dependency.spec;
+    const previous = unique.get(dependency.name);
+    if (previous && previous.spec !== spec) throw new Error(`Conflicting dependency requests for ${dependency.name}`);
+    unique.set(dependency.name, {
+      ...dependency,
+      spec,
+      ...previous?.subpaths || dependency.subpaths ? { subpaths: [.../* @__PURE__ */ new Set([...previous?.subpaths ?? [], ...dependency.subpaths ?? []])] } : {}
+    });
+  }
+  dependencies = [...unique.values()];
   const project = resolveDependencyProject(cwd);
+  const declared = manifest(project.target);
+  const existing = { ...declared.devDependencies, ...declared.optionalDependencies, ...declared.dependencies };
+  if (options.preserveExisting) {
+    for (const { name, spec } of dependencies)
+      if (Object.hasOwn(existing, name) && existing[name] !== spec && !(existing[name].startsWith("file:") && spec.startsWith("file:") && (0, import_node_path6.resolve)(project.target, existing[name].slice(5)) === (0, import_node_path6.resolve)(project.target, spec.slice(5))))
+        throw new Error(
+          `Dependency conflict: ${name} is ${existing[name]}, plugin requires ${spec}; reconcile it explicitly first`
+        );
+  }
+  const reusable = dependencies.length > 0 && !options.remove?.length && dependencies.every(
+    ({ name, spec }) => existing[name] === spec && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(spec)
+  );
+  const reuse = reusable && await verifyProjectDependencies(
+    project,
+    dependencies.flatMap(({ name, subpaths }) => subpaths ? subpaths.map((path) => name + path.slice(1)) : [name]),
+    Object.fromEntries(dependencies.map(({ name, spec }) => [name, spec]))
+  ).then(
+    () => true,
+    () => false
+  );
+  const metadataOnly = options.metadataOnly || reuse;
   const packageJson = (0, import_node_path6.join)(project.target, "package.json");
   if (!dependencies.length && !(0, import_node_fs6.existsSync)(packageJson) && !options.commit) return;
   const hasLock = PACKAGE_MANAGER_LOCKS[project.manager].some((file) => (0, import_node_fs6.existsSync)((0, import_node_path6.join)(project.root, file)));
@@ -13359,13 +13542,12 @@ async function reconcileDependencies(cwd, dependencies, options = {}) {
       else (0, import_node_fs6.writeFileSync)(path, content);
     }
   };
-  if (hadInstall && !hasLock && !options.metadataOnly)
+  if (hadInstall && !hasLock && !metadataOnly)
     throw new Error(
       "create a native lockfile before updating existing dependencies so failed installations can be recovered"
     );
   try {
-    if (options.metadataOnly && (0, import_node_fs6.existsSync)((0, import_node_path6.dirname)(journal)))
-      (0, import_node_fs6.writeFileSync)((0, import_node_path6.join)((0, import_node_path6.dirname)(journal), "metadata-only"), "1");
+    if (metadataOnly && (0, import_node_fs6.existsSync)((0, import_node_path6.dirname)(journal))) (0, import_node_fs6.writeFileSync)((0, import_node_path6.join)((0, import_node_path6.dirname)(journal), "metadata-only"), "1");
     if ((0, import_node_fs6.existsSync)((0, import_node_path6.dirname)(journal)))
       (0, import_node_fs6.writeFileSync)(
         journal,
@@ -13376,7 +13558,7 @@ async function reconcileDependencies(cwd, dependencies, options = {}) {
           }))
         )
       );
-    if (options.metadataOnly) {
+    if (metadataOnly) {
       metadataTouched = true;
       options.commit?.();
       (0, import_node_fs6.rmSync)(journal, { force: true });
@@ -13468,14 +13650,14 @@ async function reconcileDependencies(cwd, dependencies, options = {}) {
     }
     restoreBefore();
     let recovery = "";
-    if (!options.metadataOnly && hadInstall && hasLock) {
+    if (!metadataOnly && hadInstall && hasLock) {
       try {
         await run(project, installCommand(project, true), project.root, options.cacheRoot);
       } catch {
         recovery = "; manifests restored, but dependency recovery failed \u2014 run a frozen install before executing workflows";
       }
       restoreBefore();
-    } else if (!options.metadataOnly && !hadInstall) {
+    } else if (!metadataOnly && !hadInstall) {
       (0, import_node_fs6.rmSync)((0, import_node_path6.join)(project.root, "node_modules"), { recursive: true, force: true });
     }
     for (const [path, content] of pnpBefore) {
@@ -13780,6 +13962,19 @@ async function generatePluginPackage(cwd, selections, expectedPacker) {
 function pluginNpmDependencies(manifest2) {
   return manifest2.integration?.npmDependencies ?? (manifest2.integration?.npm ? [manifest2.integration.npm] : []);
 }
+function assertUniqueNpmPlugins(plugins) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const { alias, manifest: manifest2 } of plugins) {
+    const pkg = manifest2.integration?.npm?.package.trim().toLowerCase();
+    if (!pkg) continue;
+    const previous = owners.get(pkg);
+    if (previous && previous !== alias)
+      throw new Error(
+        `Use existing npm integration "${previous}" for ${pkg}; duplicate plugin alias "${alias}" is not allowed`
+      );
+    owners.set(pkg, alias);
+  }
+}
 
 // packages/plugin/src/prepared/invocation.ts
 var import_common3 = __toESM(require_dist2());
@@ -13828,6 +14023,10 @@ async function reconcilePluginLock(cwd, next, options = {}) {
       throw new Error(`Plugin identity or integrity mismatch: ${alias}`);
     return { alias, directory, sha256: pin.sha256, manifest: manifest2, remote: preparedPluginPin(directory, pin) };
   });
+  assertUniqueNpmPlugins([
+    ...discoverPluginCatalog({ cwd, storeRoot: options.storeRoot }).plugins.filter((item) => item.source === "project" && !loaded.some((pin) => pin.alias === item.manifest.id)).map((item) => ({ alias: item.manifest.id, manifest: item.manifest })),
+    ...loaded
+  ]);
   const libraries = loaded.filter((item) => item.manifest.library);
   const generated = libraries.length ? await generatePluginPackage(project.target, libraries) : void 0;
   const packageFile = (0, import_node_path10.join)(project.target, "package.json");
@@ -13924,6 +14123,9 @@ function installRoot(opts) {
   return opts.project ? { root: projectPluginRoot(opts.cwd), source: "project" } : { root: userPluginRoot(), source: "user" };
 }
 async function installNodeDeps(dir, opts = {}) {
+  return installNodeDepsUnlocked(dir, opts, false);
+}
+async function installNodeDepsUnlocked(dir, opts, locked) {
   if (opts.noDeps) return {};
   const dependencies = pluginNpmDependencies(loadPluginManifest(dir));
   if (dependencies.length) {
@@ -13936,11 +14138,12 @@ async function installNodeDeps(dir, opts = {}) {
           });
         return {};
       }
-      await installProjectDependencies(
+      await (locked ? reconcileDependencies : installProjectDependencies)(
         opts.cwd ?? process.cwd(),
         dependencies.map((npm) => ({ name: npm.package, spec: npm.spec })),
         {
-          cacheRoot: opts.cacheRoot
+          cacheRoot: opts.cacheRoot,
+          preserveExisting: true
         }
       );
       return { depsInstalled: true };
@@ -13976,6 +14179,10 @@ async function installNodeDeps(dir, opts = {}) {
   }
 }
 async function installPlugin(src, opts = {}) {
+  if (opts.project) return withDependencyInstall(opts.cwd ?? process.cwd(), () => installPluginUnlocked(src, opts));
+  return installPluginUnlocked(src, opts);
+}
+async function installPluginUnlocked(src, opts) {
   if (!(0, import_node_fs11.existsSync)(src) || !(0, import_node_fs11.statSync)(src).isDirectory()) {
     throw new Error(`source "${src}" is not a directory`);
   }
@@ -13984,13 +14191,20 @@ async function installPlugin(src, opts = {}) {
   }
   const { manifest: manifest2 } = loadPlugin(src);
   const { root, source } = installRoot(opts);
+  const installed = discoverPluginCatalog({ cwd: opts.cwd }).plugins.filter(
+    (item) => (opts.project ? item.source !== "user" : item.source === "user") && item.manifest.id !== manifest2.id
+  );
+  assertUniqueNpmPlugins([
+    ...installed.map((item) => ({ alias: item.manifest.id, manifest: item.manifest })),
+    { alias: manifest2.id, manifest: manifest2 }
+  ]);
   const dest = (0, import_node_path11.join)(root, manifest2.id);
   if ((0, import_node_fs11.existsSync)(dest)) {
     if (!opts.force) {
       throw new Error(`plugin "${manifest2.id}" is already installed at ${dest} (use --force to overwrite)`);
     }
   }
-  const deps = pluginNpmDependencies(manifest2).length ? await installNodeDeps(src, { ...opts, cacheOnly: opts.cacheOnly ?? !opts.project }) : {};
+  const deps = pluginNpmDependencies(manifest2).length ? await installNodeDepsUnlocked(src, { ...opts, cacheOnly: opts.cacheOnly ?? !opts.project }, !!opts.project) : {};
   if (deps.depsError) return { manifest: manifest2, dir: dest, source, ...deps };
   if ((0, import_node_fs11.existsSync)(dest)) (0, import_node_fs11.rmSync)(dest, { recursive: true, force: true });
   (0, import_node_fs11.mkdirSync)(root, { recursive: true });
@@ -14000,7 +14214,7 @@ async function installPlugin(src, opts = {}) {
     dir: dest,
     source,
     ...deps,
-    ...pluginNpmDependencies(manifest2).length ? {} : await installNodeDeps(dest, opts)
+    ...pluginNpmDependencies(manifest2).length ? {} : await installNodeDepsUnlocked(dest, opts, !!opts.project)
   };
 }
 
@@ -14073,11 +14287,15 @@ var RemoteRegistry = class {
     }
     this.baseUrl = baseUrl.replace(/\/$/, "");
     this.token = opts.token ?? (0, import_common5.OCTONODE_MARKETPLACE_TOKEN)();
+    this.workspace = opts.workspace ?? (0, import_common5.OCTONODE_USER)()?.match(/^workspace:((?:user|org|team):.+)$/)?.[1];
   }
   async request(path, init = {}) {
     const headers = new Headers(init.headers);
     if (this.token) headers.set("authorization", `Bearer ${this.token}`);
-    const res = await fetch(`${this.baseUrl}${path}`, {
+    const url = new URL(`${this.baseUrl}${path}`);
+    if (this.workspace && (init.method === void 0 || init.method === "GET" || url.pathname.endsWith("/install")))
+      url.searchParams.set("workspace", this.workspace);
+    const res = await fetch(url.toString(), {
       ...init,
       headers,
       redirect: "error",
@@ -14217,13 +14435,15 @@ var RemoteRegistry = class {
    */
   async install(id, opts = {}) {
     const detail = await this.detail(id, opts.scope);
+    if (detail.manifestId && detail.manifestId !== id)
+      throw new Error("Publisher-qualified plugins require installToStore so their registry identity is preserved");
     const version = opts.version ?? detail.version;
     const release2 = detail.versions?.find((entry) => entry.version === version);
     const dir = await this.downloadBundle(
       id,
       version,
       opts.scope,
-      id,
+      detail.manifestId ?? id,
       release2?.archiveSha256 ?? release2?.sha256
     );
     const plugin = await installPlugin(dir, opts);
@@ -14256,7 +14476,7 @@ var RemoteRegistry = class {
       throw new Error("Marketplace release is missing its immutable checksum");
     const availableScopes = versionMeta?.scope ?? detail.scope;
     const scope = opts.scope && availableScopes.includes(opts.scope) ? opts.scope : availableScopes[0];
-    const dir = await this.downloadBundle(id, version, scope, id, releaseChecksum);
+    const dir = await this.downloadBundle(id, version, scope, detail.manifestId ?? id, releaseChecksum);
     const entry = (() => {
       try {
         return addToStore(dir, { storeRoot: opts.storeRoot });
@@ -14271,7 +14491,7 @@ var RemoteRegistry = class {
         "Library installation requires native dependency activation; use frozen --artifacts-only for CI restore"
       );
     if (!opts.cacheOnly && !opts.noDeps) {
-      const alias2 = opts.alias ?? entry.id;
+      const alias2 = opts.alias ?? (detail.manifestId && id !== detail.manifestId ? id : entry.id);
       const pin2 = {
         pluginId: entry.id,
         remoteId: id,
@@ -14323,7 +14543,7 @@ var RemoteRegistry = class {
       cacheOnly: opts.cacheOnly
     }) : {};
     if (deps.depsError) throw new Error(deps.depsError);
-    const alias = opts.alias ?? entry.id;
+    const alias = opts.alias ?? (detail.manifestId && id !== detail.manifestId ? id : entry.id);
     const pin = {
       pluginId: entry.id,
       remoteId: id,
@@ -14346,7 +14566,20 @@ var RemoteRegistry = class {
     }
     try {
       await withDependencyInstall(opts.cwd ?? process.cwd(), async () => {
-        const previous = readLockfile(opts.cwd).plugins[alias];
+        const pins = readLockfile(opts.cwd).plugins;
+        assertUniqueNpmPlugins([
+          ...discoverPluginCatalog({ cwd: opts.cwd, storeRoot: opts.storeRoot }).plugins.filter(
+            (item) => item.source === "project" && item.manifest.id !== alias && !pins[item.manifest.id]
+          ).map((item) => ({ alias: item.manifest.id, manifest: item.manifest })),
+          ...Object.entries(pins).filter(([key]) => key !== alias).map(([key, locked]) => ({
+            alias: key,
+            manifest: loadPluginManifest(
+              storeEntryDir(locked.pluginId ?? key, locked.version, locked.sha256, opts.storeRoot)
+            )
+          })),
+          { alias, manifest: entry.manifest }
+        ]);
+        const previous = pins[alias];
         if (previous && ((previous.pluginId ?? alias) !== entry.id || previous.registry !== this.baseUrl || previous.publisher !== pin.publisher))
           throw new Error("Plugin alias belongs to another publisher or registry");
         upsertLockEntry(opts.cwd ?? process.cwd(), alias, pin);