@penvhq/launcher 0.9.4 → 0.10.0

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { PenvError, ManifestEngine } from '@penvhq/core';
+import { Environment, PenvError, ManifestEngine, PackageKind } from '@penvhq/core';
 
 /**
  * Every byte penv downloads comes through here.
@@ -54,6 +54,10 @@ interface LauncherIo {
  * `--no-download` and a run with nobody at it are both refused before the first
  * request, and CI gets `penv install`, which installs what the manifest already
  * pins rather than choosing what it should.
+ *
+ * `--local` is the one path with no release behind it: a repository that writes
+ * a provider adds the package it already builds. Nothing is fetched and nothing
+ * is pinned, so the manifest is not touched — see {@link addLocal}.
  */
 
 interface AddOptions {
@@ -113,6 +117,10 @@ declare function setProviderType(source: string, environment: string, type: stri
  */
 /** What an extension's `package.json` tells `add`, and nothing more. */
 interface ExtensionPackage {
+    /** The package's own name, which is what identifies the directory as its own. */
+    readonly name: string | undefined;
+    /** The package's own version. Only a local add reads it; a release pins the registry's. */
+    readonly version: string | undefined;
     /** A path inside the package to a self-contained declaration file. */
     readonly types: string | undefined;
     /** The engine command that finishes setting this provider up, e.g. `cloud login`. */
@@ -129,6 +137,8 @@ interface DeclarationSubject {
     readonly version: string;
     /** Recorded in the header: what npm knew about where these bytes came from. */
     readonly attested: boolean;
+    /** The package is this project's own, resolved from it rather than pinned. */
+    readonly local?: boolean;
 }
 /** The declaration's text: the package's own, or the open shape under its name. */
 declare function renderDeclaration(subject: DeclarationSubject, shipped?: {
@@ -146,50 +156,6 @@ interface WriteDeclarationOptions extends DeclarationSubject {
 /** Writes the declaration and answers with the path a message prints. */
 declare function writeDeclaration(options: WriteDeclarationOptions): string;
 
-/**
- * `$PENV_HOME` — the one directory the launcher owns.
- *
- * Engines and extensions are addressed by exact name and exact version, so a
- * machine holds every version any of its projects pins at once and no project's
- * command is ever answered by another project's bytes.
- */
-/** A read-only view of the process environment. */
-type Environment = Readonly<Record<string, string | undefined>>;
-/** The variable that moves the store off `~/.penv`. */
-declare const PENV_HOME_VAR = "PENV_HOME";
-/** The two things the store holds, and the directory each lives under. */
-type PackageKind = "engines" | "extensions";
-/** How the launcher was installed, recorded by the installer that did it. */
-declare const HOME_META_FILE = "meta.json";
-/** Written beside an installed package: the SSRI of the tarball it came from. */
-declare const INTEGRITY_FILE = ".penv-integrity";
-/** The update command for a launcher whose installer recorded nothing. */
-declare const NPM_UPDATE_COMMAND = "npm install -g @penvhq/launcher";
-/** The store, from the environment. `~/.penv` unless `$PENV_HOME` says otherwise. */
-declare function penvHome(env: Environment): string;
-/**
- * Where one exact version lives.
- *
- * The manifest's grammar already refuses a name or a version that could climb
- * out of the store, so the containment check is the second lock rather than the
- * first: this function is also reached from `penv add`, where the name is
- * whatever the user typed.
- *
- * Containment is measured against the bucket, not against `$PENV_HOME`. A name
- * of `../extensions/x` stays inside the store while landing an engine among the
- * extensions, and a store where the two are not separated is a store where the
- * kind a caller asked for is not the kind it gets.
- */
-declare function packageDir(home: string, kind: PackageKind, name: string, version: string): string;
-/**
- * The command that updates this launcher.
- *
- * Advisory, so it never throws: a store with no `meta.json`, or one holding
- * something unreadable, falls back to the npm form rather than turning a
- * manifest-format refusal into a second failure about a metadata file.
- */
-declare function launcherUpdateCommand(home: string): string;
-
 /**
  * Handing the command over.
  *
@@ -313,6 +279,40 @@ declare class AddFlagError extends PenvError {
     readonly name = "AddFlagError";
     constructor(flag: string);
 }
+/** The flag that adds an extension this project builds instead of one a registry publishes. */
+declare const LOCAL_FLAG = "--local";
+/** `--local` asked for something only a published release has. */
+declare class AddLocalFlagError extends PenvError {
+    readonly name = "AddLocalFlagError";
+    constructor(subject: string);
+}
+/**
+ * The extension resolved and is not something penv can import.
+ *
+ * `add` used to certify resolution and stop there, so a package whose `exports`
+ * pointed at TypeScript source got three green checks and failed much later,
+ * from an unrelated command. The load check runs here, at the one moment the
+ * operator is looking at the provider.
+ */
+declare class ExtensionNotImportableError extends PenvError {
+    readonly name = "ExtensionNotImportableError";
+    constructor(name: string, entry: string | undefined, local: boolean);
+}
+/** The extension imported and threw. Its own failure is the diagnosis. */
+declare class ExtensionUnloadableError extends PenvError {
+    readonly name = "ExtensionUnloadableError";
+    constructor(name: string, entry: string, detail: string, local: boolean);
+}
+/** `--local` on a package the project does not have. */
+declare class LocalExtensionUnresolvedError extends PenvError {
+    readonly name = "LocalExtensionUnresolvedError";
+    constructor(name: string, root: string);
+}
+/** `penv add --local` on a machine with nobody at it. */
+declare class AddLocalInCiError extends PenvError {
+    readonly name = "AddLocalInCiError";
+    constructor(name: string);
+}
 /** `--registry` with something that is not an https origin. */
 declare class AddRegistryError extends PenvError {
     readonly name = "AddRegistryError";
@@ -407,6 +407,29 @@ declare class EngineEntryError extends PenvError {
     constructor(name: string, version: string, dir: string);
 }
 
+/**
+ * What the launcher alone knows about `$PENV_HOME`: how the installation that
+ * created it updates itself, and what it writes beside an installed package.
+ *
+ * The store's layout — where `$PENV_HOME` is and where one exact version lives —
+ * is `@penvhq/core`'s, because the engine reads the same directories the
+ * launcher fills.
+ */
+/** How the launcher was installed, recorded by the installer that did it. */
+declare const HOME_META_FILE = "meta.json";
+/** Written beside an installed package: the SSRI of the tarball it came from. */
+declare const INTEGRITY_FILE = ".penv-integrity";
+/** The update command for a launcher whose installer recorded nothing. */
+declare const NPM_UPDATE_COMMAND = "npm install -g @penvhq/launcher";
+/**
+ * The command that updates this launcher.
+ *
+ * Advisory, so it never throws: a store with no `meta.json`, or one holding
+ * something unreadable, falls back to the npm form rather than turning a
+ * manifest-format refusal into a second failure about a metadata file.
+ */
+declare function launcherUpdateCommand(home: string): string;
+
 /**
  * The one hash penv checks: npm's SSRI, over the tarball bytes.
  *
@@ -598,4 +621,4 @@ interface ArchiveSubject {
 /** Every regular file in an npm tarball, `package/` stripped. */
 declare function readTarball(gzipped: Uint8Array, subject: ArchiveSubject): TarEntry[];
 
-export { AddFlagError, AddNoDownloadError, AddNotInteractiveError, type AddOptions, AddPackageNameError, AddRegistryError, type AddResult, AddSubjectError, ArchiveError, type ArchiveSubject, BUNDLED_ENGINE_PIN, DEFAULT_REGISTRY, DEV_PIN_INTEGRITY, DEV_PIN_VERSION, DeclarationMissingError, DeclarationNotSelfContainedError, type DeclarationSubject, type Delegation, DownloadFailedError, DownloadIntegrityError, ENGINE_BIN, type Engine, EngineEntryError, EnginePinMismatchError, EnginePinUnreleasedError, type Environment, type ExtensionPackage, type Fetcher, HOME_META_FILE, INSTALL_COMMAND, INTEGRITY_FILE, InstallDeclinedError, type InstallOptions, type InstallState, type Installation, type LauncherIo, type LauncherOptions, MIN_PACKAGE_AGE_DAYS, NPM_UPDATE_COMMAND, NoProjectError, OfficialRegistryError, PENV_HOME_VAR, PackageCorruptError, type PackageKind, PackageMissingError, PackageTooYoungError, PackageUnknownError, type Pin, type Project, type ProviderEntry, RegistryUnreadableError, type Release, ReleaseIncompleteError, type ReleaseQuery, type Spawner, TRUST_YOUNG_FLAG, type TarEntry, TrustDeclinedError, TrustPublisherMissingError, TrustReasonMissingError, VersionUnknownError, add, assertReleasePin, bundledEngine, declarationPath, engineAt, fetchRelease, findAdoptedRoot, findProject, httpFetcher, inspectInstall, installPin, integrityOf, launcherUpdateCommand, nodeSpawner, packageDir, packumentUrl, penvHome, readExtensionPackage, readProviderEntries, readTarball, releaseEnginePin, renderDeclaration, runLauncher, setProviderType, tarballUrl, writeDeclaration };
+export { AddFlagError, AddLocalFlagError, AddLocalInCiError, AddNoDownloadError, AddNotInteractiveError, type AddOptions, AddPackageNameError, AddRegistryError, type AddResult, AddSubjectError, ArchiveError, type ArchiveSubject, BUNDLED_ENGINE_PIN, DEFAULT_REGISTRY, DEV_PIN_INTEGRITY, DEV_PIN_VERSION, DeclarationMissingError, DeclarationNotSelfContainedError, type DeclarationSubject, type Delegation, DownloadFailedError, DownloadIntegrityError, ENGINE_BIN, type Engine, EngineEntryError, EnginePinMismatchError, EnginePinUnreleasedError, ExtensionNotImportableError, type ExtensionPackage, ExtensionUnloadableError, type Fetcher, HOME_META_FILE, INSTALL_COMMAND, INTEGRITY_FILE, InstallDeclinedError, type InstallOptions, type InstallState, type Installation, LOCAL_FLAG, type LauncherIo, type LauncherOptions, LocalExtensionUnresolvedError, MIN_PACKAGE_AGE_DAYS, NPM_UPDATE_COMMAND, NoProjectError, OfficialRegistryError, PackageCorruptError, PackageMissingError, PackageTooYoungError, PackageUnknownError, type Pin, type Project, type ProviderEntry, RegistryUnreadableError, type Release, ReleaseIncompleteError, type ReleaseQuery, type Spawner, TRUST_YOUNG_FLAG, type TarEntry, TrustDeclinedError, TrustPublisherMissingError, TrustReasonMissingError, VersionUnknownError, add, assertReleasePin, bundledEngine, declarationPath, engineAt, fetchRelease, findAdoptedRoot, findProject, httpFetcher, inspectInstall, installPin, integrityOf, launcherUpdateCommand, nodeSpawner, packumentUrl, readExtensionPackage, readProviderEntries, readTarball, releaseEnginePin, renderDeclaration, runLauncher, setProviderType, tarballUrl, writeDeclaration };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { PenvError, ManifestEngine } from '@penvhq/core';
+import { Environment, PenvError, ManifestEngine, PackageKind } from '@penvhq/core';
 
 /**
  * Every byte penv downloads comes through here.
@@ -54,6 +54,10 @@ interface LauncherIo {
  * `--no-download` and a run with nobody at it are both refused before the first
  * request, and CI gets `penv install`, which installs what the manifest already
  * pins rather than choosing what it should.
+ *
+ * `--local` is the one path with no release behind it: a repository that writes
+ * a provider adds the package it already builds. Nothing is fetched and nothing
+ * is pinned, so the manifest is not touched — see {@link addLocal}.
  */
 
 interface AddOptions {
@@ -113,6 +117,10 @@ declare function setProviderType(source: string, environment: string, type: stri
  */
 /** What an extension's `package.json` tells `add`, and nothing more. */
 interface ExtensionPackage {
+    /** The package's own name, which is what identifies the directory as its own. */
+    readonly name: string | undefined;
+    /** The package's own version. Only a local add reads it; a release pins the registry's. */
+    readonly version: string | undefined;
     /** A path inside the package to a self-contained declaration file. */
     readonly types: string | undefined;
     /** The engine command that finishes setting this provider up, e.g. `cloud login`. */
@@ -129,6 +137,8 @@ interface DeclarationSubject {
     readonly version: string;
     /** Recorded in the header: what npm knew about where these bytes came from. */
     readonly attested: boolean;
+    /** The package is this project's own, resolved from it rather than pinned. */
+    readonly local?: boolean;
 }
 /** The declaration's text: the package's own, or the open shape under its name. */
 declare function renderDeclaration(subject: DeclarationSubject, shipped?: {
@@ -146,50 +156,6 @@ interface WriteDeclarationOptions extends DeclarationSubject {
 /** Writes the declaration and answers with the path a message prints. */
 declare function writeDeclaration(options: WriteDeclarationOptions): string;
 
-/**
- * `$PENV_HOME` — the one directory the launcher owns.
- *
- * Engines and extensions are addressed by exact name and exact version, so a
- * machine holds every version any of its projects pins at once and no project's
- * command is ever answered by another project's bytes.
- */
-/** A read-only view of the process environment. */
-type Environment = Readonly<Record<string, string | undefined>>;
-/** The variable that moves the store off `~/.penv`. */
-declare const PENV_HOME_VAR = "PENV_HOME";
-/** The two things the store holds, and the directory each lives under. */
-type PackageKind = "engines" | "extensions";
-/** How the launcher was installed, recorded by the installer that did it. */
-declare const HOME_META_FILE = "meta.json";
-/** Written beside an installed package: the SSRI of the tarball it came from. */
-declare const INTEGRITY_FILE = ".penv-integrity";
-/** The update command for a launcher whose installer recorded nothing. */
-declare const NPM_UPDATE_COMMAND = "npm install -g @penvhq/launcher";
-/** The store, from the environment. `~/.penv` unless `$PENV_HOME` says otherwise. */
-declare function penvHome(env: Environment): string;
-/**
- * Where one exact version lives.
- *
- * The manifest's grammar already refuses a name or a version that could climb
- * out of the store, so the containment check is the second lock rather than the
- * first: this function is also reached from `penv add`, where the name is
- * whatever the user typed.
- *
- * Containment is measured against the bucket, not against `$PENV_HOME`. A name
- * of `../extensions/x` stays inside the store while landing an engine among the
- * extensions, and a store where the two are not separated is a store where the
- * kind a caller asked for is not the kind it gets.
- */
-declare function packageDir(home: string, kind: PackageKind, name: string, version: string): string;
-/**
- * The command that updates this launcher.
- *
- * Advisory, so it never throws: a store with no `meta.json`, or one holding
- * something unreadable, falls back to the npm form rather than turning a
- * manifest-format refusal into a second failure about a metadata file.
- */
-declare function launcherUpdateCommand(home: string): string;
-
 /**
  * Handing the command over.
  *
@@ -313,6 +279,40 @@ declare class AddFlagError extends PenvError {
     readonly name = "AddFlagError";
     constructor(flag: string);
 }
+/** The flag that adds an extension this project builds instead of one a registry publishes. */
+declare const LOCAL_FLAG = "--local";
+/** `--local` asked for something only a published release has. */
+declare class AddLocalFlagError extends PenvError {
+    readonly name = "AddLocalFlagError";
+    constructor(subject: string);
+}
+/**
+ * The extension resolved and is not something penv can import.
+ *
+ * `add` used to certify resolution and stop there, so a package whose `exports`
+ * pointed at TypeScript source got three green checks and failed much later,
+ * from an unrelated command. The load check runs here, at the one moment the
+ * operator is looking at the provider.
+ */
+declare class ExtensionNotImportableError extends PenvError {
+    readonly name = "ExtensionNotImportableError";
+    constructor(name: string, entry: string | undefined, local: boolean);
+}
+/** The extension imported and threw. Its own failure is the diagnosis. */
+declare class ExtensionUnloadableError extends PenvError {
+    readonly name = "ExtensionUnloadableError";
+    constructor(name: string, entry: string, detail: string, local: boolean);
+}
+/** `--local` on a package the project does not have. */
+declare class LocalExtensionUnresolvedError extends PenvError {
+    readonly name = "LocalExtensionUnresolvedError";
+    constructor(name: string, root: string);
+}
+/** `penv add --local` on a machine with nobody at it. */
+declare class AddLocalInCiError extends PenvError {
+    readonly name = "AddLocalInCiError";
+    constructor(name: string);
+}
 /** `--registry` with something that is not an https origin. */
 declare class AddRegistryError extends PenvError {
     readonly name = "AddRegistryError";
@@ -407,6 +407,29 @@ declare class EngineEntryError extends PenvError {
     constructor(name: string, version: string, dir: string);
 }
 
+/**
+ * What the launcher alone knows about `$PENV_HOME`: how the installation that
+ * created it updates itself, and what it writes beside an installed package.
+ *
+ * The store's layout — where `$PENV_HOME` is and where one exact version lives —
+ * is `@penvhq/core`'s, because the engine reads the same directories the
+ * launcher fills.
+ */
+/** How the launcher was installed, recorded by the installer that did it. */
+declare const HOME_META_FILE = "meta.json";
+/** Written beside an installed package: the SSRI of the tarball it came from. */
+declare const INTEGRITY_FILE = ".penv-integrity";
+/** The update command for a launcher whose installer recorded nothing. */
+declare const NPM_UPDATE_COMMAND = "npm install -g @penvhq/launcher";
+/**
+ * The command that updates this launcher.
+ *
+ * Advisory, so it never throws: a store with no `meta.json`, or one holding
+ * something unreadable, falls back to the npm form rather than turning a
+ * manifest-format refusal into a second failure about a metadata file.
+ */
+declare function launcherUpdateCommand(home: string): string;
+
 /**
  * The one hash penv checks: npm's SSRI, over the tarball bytes.
  *
@@ -598,4 +621,4 @@ interface ArchiveSubject {
 /** Every regular file in an npm tarball, `package/` stripped. */
 declare function readTarball(gzipped: Uint8Array, subject: ArchiveSubject): TarEntry[];
 
-export { AddFlagError, AddNoDownloadError, AddNotInteractiveError, type AddOptions, AddPackageNameError, AddRegistryError, type AddResult, AddSubjectError, ArchiveError, type ArchiveSubject, BUNDLED_ENGINE_PIN, DEFAULT_REGISTRY, DEV_PIN_INTEGRITY, DEV_PIN_VERSION, DeclarationMissingError, DeclarationNotSelfContainedError, type DeclarationSubject, type Delegation, DownloadFailedError, DownloadIntegrityError, ENGINE_BIN, type Engine, EngineEntryError, EnginePinMismatchError, EnginePinUnreleasedError, type Environment, type ExtensionPackage, type Fetcher, HOME_META_FILE, INSTALL_COMMAND, INTEGRITY_FILE, InstallDeclinedError, type InstallOptions, type InstallState, type Installation, type LauncherIo, type LauncherOptions, MIN_PACKAGE_AGE_DAYS, NPM_UPDATE_COMMAND, NoProjectError, OfficialRegistryError, PENV_HOME_VAR, PackageCorruptError, type PackageKind, PackageMissingError, PackageTooYoungError, PackageUnknownError, type Pin, type Project, type ProviderEntry, RegistryUnreadableError, type Release, ReleaseIncompleteError, type ReleaseQuery, type Spawner, TRUST_YOUNG_FLAG, type TarEntry, TrustDeclinedError, TrustPublisherMissingError, TrustReasonMissingError, VersionUnknownError, add, assertReleasePin, bundledEngine, declarationPath, engineAt, fetchRelease, findAdoptedRoot, findProject, httpFetcher, inspectInstall, installPin, integrityOf, launcherUpdateCommand, nodeSpawner, packageDir, packumentUrl, penvHome, readExtensionPackage, readProviderEntries, readTarball, releaseEnginePin, renderDeclaration, runLauncher, setProviderType, tarballUrl, writeDeclaration };
+export { AddFlagError, AddLocalFlagError, AddLocalInCiError, AddNoDownloadError, AddNotInteractiveError, type AddOptions, AddPackageNameError, AddRegistryError, type AddResult, AddSubjectError, ArchiveError, type ArchiveSubject, BUNDLED_ENGINE_PIN, DEFAULT_REGISTRY, DEV_PIN_INTEGRITY, DEV_PIN_VERSION, DeclarationMissingError, DeclarationNotSelfContainedError, type DeclarationSubject, type Delegation, DownloadFailedError, DownloadIntegrityError, ENGINE_BIN, type Engine, EngineEntryError, EnginePinMismatchError, EnginePinUnreleasedError, ExtensionNotImportableError, type ExtensionPackage, ExtensionUnloadableError, type Fetcher, HOME_META_FILE, INSTALL_COMMAND, INTEGRITY_FILE, InstallDeclinedError, type InstallOptions, type InstallState, type Installation, LOCAL_FLAG, type LauncherIo, type LauncherOptions, LocalExtensionUnresolvedError, MIN_PACKAGE_AGE_DAYS, NPM_UPDATE_COMMAND, NoProjectError, OfficialRegistryError, PackageCorruptError, PackageMissingError, PackageTooYoungError, PackageUnknownError, type Pin, type Project, type ProviderEntry, RegistryUnreadableError, type Release, ReleaseIncompleteError, type ReleaseQuery, type Spawner, TRUST_YOUNG_FLAG, type TarEntry, TrustDeclinedError, TrustPublisherMissingError, TrustReasonMissingError, VersionUnknownError, add, assertReleasePin, bundledEngine, declarationPath, engineAt, fetchRelease, findAdoptedRoot, findProject, httpFetcher, inspectInstall, installPin, integrityOf, launcherUpdateCommand, nodeSpawner, packumentUrl, readExtensionPackage, readProviderEntries, readTarball, releaseEnginePin, renderDeclaration, runLauncher, setProviderType, tarballUrl, writeDeclaration };

package/dist/index.js

@@ -1,5 +1,7 @@
 import {
   AddFlagError,
+  AddLocalFlagError,
+  AddLocalInCiError,
   AddNoDownloadError,
   AddNotInteractiveError,
   AddPackageNameError,
@@ -18,15 +20,18 @@ import {
   EngineEntryError,
   EnginePinMismatchError,
   EnginePinUnreleasedError,
+  ExtensionNotImportableError,
+  ExtensionUnloadableError,
   HOME_META_FILE,
   INSTALL_COMMAND,
   INTEGRITY_FILE,
   InstallDeclinedError,
+  LOCAL_FLAG,
+  LocalExtensionUnresolvedError,
   MIN_PACKAGE_AGE_DAYS,
   NPM_UPDATE_COMMAND,
   NoProjectError,
   OfficialRegistryError,
-  PENV_HOME_VAR,
   PackageCorruptError,
   PackageMissingError,
   PackageTooYoungError,
@@ -52,9 +57,7 @@ import {
   integrityOf,
   launcherUpdateCommand,
   nodeSpawner,
-  packageDir,
   packumentUrl,
-  penvHome,
   readExtensionPackage,
   readProviderEntries,
   readTarball,
@@ -64,9 +67,11 @@ import {
   setProviderType,
   tarballUrl,
   writeDeclaration
-} from "./chunk-Q27F7QYT.js";
+} from "./chunk-BNUZ52VN.js";
 export {
   AddFlagError,
+  AddLocalFlagError,
+  AddLocalInCiError,
   AddNoDownloadError,
   AddNotInteractiveError,
   AddPackageNameError,
@@ -85,15 +90,18 @@ export {
   EngineEntryError,
   EnginePinMismatchError,
   EnginePinUnreleasedError,
+  ExtensionNotImportableError,
+  ExtensionUnloadableError,
   HOME_META_FILE,
   INSTALL_COMMAND,
   INTEGRITY_FILE,
   InstallDeclinedError,
+  LOCAL_FLAG,
+  LocalExtensionUnresolvedError,
   MIN_PACKAGE_AGE_DAYS,
   NPM_UPDATE_COMMAND,
   NoProjectError,
   OfficialRegistryError,
-  PENV_HOME_VAR,
   PackageCorruptError,
   PackageMissingError,
   PackageTooYoungError,
@@ -119,9 +127,7 @@ export {
   integrityOf,
   launcherUpdateCommand,
   nodeSpawner,
-  packageDir,
   packumentUrl,
-  penvHome,
   readExtensionPackage,
   readProviderEntries,
   readTarball,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@penvhq/launcher",
-  "version": "0.9.4",
+  "version": "0.10.0",
   "description": "The stable penv launcher: it verifies the engine your project pins and hands over the command.",
   "license": "MIT",
   "type": "module",
@@ -22,8 +22,8 @@
   ],
   "dependencies": {
     "zod": "4.4.3",
-    "@penvhq/cli": "0.9.4",
-    "@penvhq/core": "0.9.4"
+    "@penvhq/cli": "0.10.0",
+    "@penvhq/core": "0.10.0"
   },
   "scripts": {
     "build": "tsup"