@pikku/addon-console 0.12.41 → 0.12.43

package/dist/src/lib/audit-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-exec.js","sourceRoot":"","sources":["../../../src/lib/audit-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAI1C,yEAAyE;AACzE,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,UAAkB;IACtD,IAAI,GAAG,GAAG,UAAU,CAAA;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QACzD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAwB;IAExB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,IAAc,EACd,GAAW,EACX,EACE,aAAa,GAAG,KAAK,EACrB,SAAS,GAAG,CAAC,GAAG,MAAM,MAC6B,EAAE;IAEvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YAChC,GAAG;YACH,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;YACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5B,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAA;QAClD,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACpB,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,SAAS,IAAI,CAC9D,CACF,CAAA;QACH,CAAC,EAAE,SAAS,CAAC,CAAA;QACb,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,aAAa,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG;oBAClD,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9C,CACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC1C,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,CAAA;AAClF,CAAC"}
+{"version":3,"file":"audit-exec.js","sourceRoot":"","sources":["../../../src/lib/audit-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAI1C,yEAAyE;AACzE,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,UAAkB;IACtD,IAAI,GAAG,GAAG,UAAU,CAAA;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QACzD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAwB;IAExB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,IAAc,EACd,GAAW,EACX,EACE,aAAa,GAAG,KAAK,EACrB,SAAS,GAAG,CAAC,GAAG,MAAM,MAC6B,EAAE;IAEvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YAChC,GAAG;YACH,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;YACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5B,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAA;QAClD,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACpB,MAAM,CACJ,IAAI,KAAK,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,SAAS,IAAI,CAAC,CACzE,CAAA;QACH,CAAC,EAAE,SAAS,CAAC,CAAA;QACb,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,aAAa,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG;oBAClD,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9C,CACF,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC1C,MAAM,YAAY,CAChB,OAAO,CAAC,QAAQ,EAChB,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,EAC9B,UAAU,CACX,CAAA;AACH,CAAC"}

package/dist/src/lib/audit-exec.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-exec.test.d.ts.map

package/dist/src/lib/audit-exec.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-exec.test.d.ts","sourceRoot":"","sources":["../../../src/lib/audit-exec.test.ts"],"names":[],"mappings":""}

package/dist/src/lib/audit-exec.test.js

@@ -0,0 +1,97 @@
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { chmodSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { findBin, readAuditReport, spawnProcess } from './audit-exec.js';
+const scratch = () => mkdtempSync(join(tmpdir(), 'pikku-audit-exec-'));
+const executable = (dir, name, body) => {
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, name);
+    writeFileSync(path, body);
+    chmodSync(path, 0o755);
+    return path;
+};
+describe('findBin', () => {
+    test('finds the binary in the nearest node_modules/.bin', () => {
+        const root = scratch();
+        const nested = join(root, 'packages', 'api');
+        mkdirSync(nested, { recursive: true });
+        const bin = executable(join(nested, 'node_modules', '.bin'), 'pikku', '');
+        assert.equal(findBin('pikku', nested), bin);
+    });
+    test('walks up to a hoisted binary in the workspace root', () => {
+        const root = scratch();
+        const nested = join(root, 'packages', 'api', 'src');
+        mkdirSync(nested, { recursive: true });
+        const bin = executable(join(root, 'node_modules', '.bin'), 'pikku', '');
+        assert.equal(findBin('pikku', nested), bin);
+    });
+    test('prefers the closest binary over the hoisted one', () => {
+        const root = scratch();
+        const nested = join(root, 'packages', 'api');
+        mkdirSync(nested, { recursive: true });
+        executable(join(root, 'node_modules', '.bin'), 'pikku', '');
+        const local = executable(join(nested, 'node_modules', '.bin'), 'pikku', '');
+        assert.equal(findBin('pikku', nested), local);
+    });
+    // Falling back to the bare name lets PATH resolve it — a globally installed
+    // CLI still works rather than the call failing outright.
+    test('falls back to the bare name when nothing is installed', () => {
+        assert.equal(findBin('pikku', scratch()), 'pikku');
+    });
+});
+describe('spawnProcess', () => {
+    const sh = (body) => {
+        const dir = scratch();
+        return executable(dir, 'script.sh', `#!/bin/sh\n${body}`);
+    };
+    test('resolves when the process succeeds', async () => {
+        await spawnProcess(sh('exit 0'), [], scratch());
+    });
+    // `pikku audit` exits non-zero precisely when it finds advisories, having
+    // written a perfectly valid report — rejecting there would hide findings.
+    test('is lenient about a non-zero exit by default', async () => {
+        await spawnProcess(sh('exit 3'), [], scratch());
+    });
+    test('rejects on a non-zero exit when asked to', async () => {
+        await assert.rejects(spawnProcess(sh('exit 3'), [], scratch(), { failOnNonZero: true }), /exit 3/);
+    });
+    test('includes stderr so the failure is diagnosable', async () => {
+        await assert.rejects(spawnProcess(sh('echo "no matching version" >&2; exit 1'), [], scratch(), {
+            failOnNonZero: true,
+        }), /no matching version/);
+    });
+    test('rejects when the command does not exist', async () => {
+        await assert.rejects(spawnProcess(join(scratch(), 'nope'), [], scratch()), /ENOENT/);
+    });
+    // A hung `bun install` must not hold the console request open forever.
+    test('kills and rejects a process that outruns its timeout', async () => {
+        const started = Date.now();
+        await assert.rejects(spawnProcess(sh('sleep 30'), [], scratch(), { timeoutMs: 250 }), /timed out after 250ms/);
+        assert.ok(Date.now() - started < 5_000);
+    });
+    test('does not fire the timeout for a process that finished in time', async () => {
+        await spawnProcess(sh('exit 0'), [], scratch(), { timeoutMs: 10_000 });
+    });
+});
+describe('readAuditReport', () => {
+    const metaService = (readFile) => ({ readFile });
+    test('parses the report', async () => {
+        const report = await readAuditReport(metaService(async () => JSON.stringify({ schemaVersion: 1, tool: 'bun' })));
+        assert.equal(report?.tool, 'bun');
+    });
+    test('is null when there is no report yet', async () => {
+        assert.equal(await readAuditReport(metaService(async () => null)), null);
+        assert.equal(await readAuditReport(metaService(async () => '')), null);
+    });
+    test('is null rather than throwing on a malformed report', async () => {
+        assert.equal(await readAuditReport(metaService(async () => '{ truncated')), null);
+    });
+    test('is null rather than throwing when the read itself fails', async () => {
+        assert.equal(await readAuditReport(metaService(async () => {
+            throw new Error('EACCES');
+        })), null);
+    });
+});
+//# sourceMappingURL=audit-exec.test.js.map

package/dist/src/lib/audit-exec.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-exec.test.js","sourceRoot":"","sources":["../../../src/lib/audit-exec.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAExE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAA;AAEtE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE;IAC7D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC5B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACzB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACtB,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACvB,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;QAC5C,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACzE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;QACnD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACvE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;QAC5C,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QAC3E,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;QACrB,OAAO,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC,CAAA;IAED,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,MAAM,CAAC,OAAO,CAClB,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAClE,QAAQ,CACT,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,MAAM,CAAC,OAAO,CAClB,YAAY,CACV,EAAE,CAAC,wCAAwC,CAAC,EAC5C,EAAE,EACF,OAAO,EAAE,EACT;YACE,aAAa,EAAE,IAAI;SACpB,CACF,EACD,qBAAqB,CACtB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,CAAC,OAAO,CAClB,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EACpD,QAAQ,CACT,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1B,MAAM,MAAM,CAAC,OAAO,CAClB,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAC/D,uBAAuB,CACxB,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,WAAW,GAAG,CAAC,QAAsC,EAAE,EAAE,CAC7D,CAAC,EAAE,QAAQ,EAAE,CAAU,CAAA;IAEzB,IAAI,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAC3E,CAAA;QACD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QACxE,MAAM,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,CAAC,KAAK,CACV,MAAM,eAAe,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,EAC7D,IAAI,CACL,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,CAAC,KAAK,CACV,MAAM,eAAe,CACnB,WAAW,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC,CAAC,CACH,EACD,IAAI,CACL,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/lib/derive-instance-overrides.d.ts

@@ -1,3 +1,4 @@
+export declare function assertAddonPackageName(packageName: string): void;
 /**
  * Per-instance override derivation for a second-or-later `wireAddon` of the
  * same package. The first instance of a package uses the package's documented
@@ -22,6 +23,11 @@ export interface InstanceOverrides {
 /** `@pikku/addon-mandrill` -> `mandrill`. */
 export declare const packageBase: (packageName: string) => string;
 export declare function deriveInstanceOverrides(namespace: string, packageName: string, declared: AddonDeclaredNames): InstanceOverrides;
+/**
+ * An addon publishes its `.pikku` meta at the package root, under `dist`, or
+ * both — resolve whichever is on disk. `null` when the package ships neither.
+ */
+export declare function addonPikkuDir(rootDir: string, packageName: string): string | null;
 /**
  * Read a freshly-installed addon package's declared logical names from the
  * `.pikku` meta it ships in node_modules. Missing meta files are treated as

package/dist/src/lib/derive-instance-overrides.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"derive-instance-overrides.d.ts","sourceRoot":"","sources":["../../../src/lib/derive-instance-overrides.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7C;AASD,6CAA6C;AAC7C,eAAO,MAAM,WAAW,GAAI,aAAa,MAAM,KAAG,MACW,CAAA;AA2B7D,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,kBAAkB,GAC3B,iBAAiB,CAoBnB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAyB7B"}
+{"version":3,"file":"derive-instance-overrides.d.ts","sourceRoot":"","sources":["../../../src/lib/derive-instance-overrides.ts"],"names":[],"mappings":"AASA,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAIhE;AAED;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7C;AASD,6CAA6C;AAC7C,eAAO,MAAM,WAAW,GAAI,aAAa,MAAM,KAAG,MACW,CAAA;AA2B7D,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,kBAAkB,GAC3B,iBAAiB,CAoBnB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAcf;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B"}

package/dist/src/lib/derive-instance-overrides.js

@@ -1,5 +1,15 @@
 import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { join, resolve, sep } from 'node:path';
+import { BadRequestError } from '#pikku/addon/error';
+/** Anchoring the first character on npm's no-leading-dot rule is what excludes
+ *  `.` and `..`; a trailing `[a-z0-9._-]+` alone matches both. */
+const VALID_PACKAGE_NAME = /^(@[a-z0-9-]+\/)?[a-z0-9-][a-z0-9._-]*$/;
+export function assertAddonPackageName(packageName) {
+    if (!VALID_PACKAGE_NAME.test(packageName)) {
+        throw new BadRequestError(`Invalid package name: ${packageName}`);
+    }
+}
 /** `mandrill-promo` -> `MANDRILL_PROMO`. */
 const screamingSnake = (s) => s
     .replace(/[^a-zA-Z0-9]+/g, '_')
@@ -39,13 +49,36 @@ export function deriveInstanceOverrides(namespace, packageName, declared) {
     }
     return overrides;
 }
+/**
+ * An addon publishes its `.pikku` meta at the package root, under `dist`, or
+ * both — resolve whichever is on disk. `null` when the package ships neither.
+ */
+export function addonPikkuDir(rootDir, packageName) {
+    assertAddonPackageName(packageName);
+    const modulesDir = resolve(rootDir, 'node_modules');
+    const pkgDir = resolve(modulesDir, packageName);
+    if (!pkgDir.startsWith(modulesDir + sep)) {
+        throw new BadRequestError(`Invalid package name: ${packageName}`);
+    }
+    for (const candidate of [
+        join(pkgDir, '.pikku'),
+        join(pkgDir, 'dist', '.pikku'),
+    ]) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
 /**
  * Read a freshly-installed addon package's declared logical names from the
  * `.pikku` meta it ships in node_modules. Missing meta files are treated as
  * "declares none" — an addon may have no secrets/variables/credentials.
  */
 export async function readAddonDeclaredNames(rootDir, packageName) {
-    const pkgPikku = join(rootDir, 'node_modules', packageName, '.pikku');
+    const pkgPikku = addonPikkuDir(rootDir, packageName);
+    if (!pkgPikku) {
+        return { secrets: [], variables: [], credentials: [] };
+    }
     // Read the id the addon actually reads by (secretId/variableId for secrets and
     // variables — the string it passes to getSecret / variables.get; the meta's
     // own name for credentials), falling back to the meta key for older meta. That

package/dist/src/lib/derive-instance-overrides.js.map

@@ -1 +1 @@
-{"version":3,"file":"derive-instance-overrides.js","sourceRoot":"","sources":["../../../src/lib/derive-instance-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AA0BhC,4CAA4C;AAC5C,MAAM,cAAc,GAAG,CAAC,CAAS,EAAU,EAAE,CAC3C,CAAC;KACE,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;KAC9B,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;KACnC,WAAW,EAAE,CAAA;AAElB,6CAA6C;AAC7C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAU,EAAE,CACzD,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AAE7D;;;;;GAKG;AACH,MAAM,aAAa,GAAG,CACpB,SAAiB,EACjB,IAAY,EACZ,GAAW,EACH,EAAE;IACV,MAAM,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAA;IACP,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,CAAA;AACxB,CAAC,CAAA;AAED;;8FAE8F;AAC9F,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAU,EAAE,CACtE,GAAG,SAAS,IAAI,GAAG,EAAE,CAAA;AAEvB,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,WAAmB,EACnB,QAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IACrC,MAAM,SAAS,GAAsB,EAAE,CAAA;IAEvC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,SAAS,CAAC,eAAe,GAAG,MAAM,CAAC,WAAW,CAC5C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CACpE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,SAAS,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC9C,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CACtE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,SAAS,CAAC,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAChD,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CACzE,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IACrE,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,SAAS;IACT,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAE,OAAgB,EAAqB,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2C,CAAA;YACtE,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAC7C,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CACtC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC,CAAA;IACD,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,OAAO,CAAC,qCAAqC,EAAE,UAAU,CAAC;QAC1D,OAAO,CAAC,yCAAyC,EAAE,YAAY,CAAC;QAChE,OAAO,CAAC,6CAA6C,CAAC;KACvD,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"derive-instance-overrides.js","sourceRoot":"","sources":["../../../src/lib/derive-instance-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD;kEACkE;AAClE,MAAM,kBAAkB,GAAG,yCAAyC,CAAA;AAEpE,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC;AA0BD,4CAA4C;AAC5C,MAAM,cAAc,GAAG,CAAC,CAAS,EAAU,EAAE,CAC3C,CAAC;KACE,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;KAC9B,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;KACnC,WAAW,EAAE,CAAA;AAElB,6CAA6C;AAC7C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAU,EAAE,CACzD,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AAE7D;;;;;GAKG;AACH,MAAM,aAAa,GAAG,CACpB,SAAiB,EACjB,IAAY,EACZ,GAAW,EACH,EAAE;IACV,MAAM,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAA;IACP,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,CAAA;AACxB,CAAC,CAAA;AAED;;8FAE8F;AAC9F,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAU,EAAE,CACtE,GAAG,SAAS,IAAI,GAAG,EAAE,CAAA;AAEvB,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,WAAmB,EACnB,QAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IACrC,MAAM,SAAS,GAAsB,EAAE,CAAA;IAEvC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,SAAS,CAAC,eAAe,GAAG,MAAM,CAAC,WAAW,CAC5C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CACpE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,SAAS,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC9C,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CACtE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,SAAS,CAAC,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAChD,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CACzE,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,WAAmB;IAEnB,sBAAsB,CAAC,WAAW,CAAC,CAAA;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAA;IACnE,CAAC;IACD,KAAK,MAAM,SAAS,IAAI;QACtB,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;QACtB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KAC/B,EAAE,CAAC;QACF,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,WAAmB;IAEnB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;IACxD,CAAC;IACD,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,SAAS;IACT,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAE,OAAgB,EAAqB,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2C,CAAA;YACtE,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAC7C,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CACtC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC,CAAA;IACD,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,OAAO,CAAC,qCAAqC,EAAE,UAAU,CAAC;QAC1D,OAAO,CAAC,yCAAyC,EAAE,YAAY,CAAC;QAChE,OAAO,CAAC,6CAA6C,CAAC;KACvD,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AAC5C,CAAC"}

package/dist/src/lib/derive-instance-overrides.test.js

@@ -1,6 +1,6 @@
 import { strict as assert } from 'assert';
 import { describe, test } from 'node:test';
-import { deriveInstanceOverrides, packageBase, } from './derive-instance-overrides.js';
+import { assertAddonPackageName, deriveInstanceOverrides, packageBase, } from './derive-instance-overrides.js';
 describe('deriveInstanceOverrides', () => {
     test('scopes an env secret by namespace, stripping a redundant package prefix', () => {
         const o = deriveInstanceOverrides('mandrill-promo', '@pikku/addon-mandrill', {
@@ -56,4 +56,30 @@ describe('deriveInstanceOverrides', () => {
         assert.equal(packageBase('mypkg'), 'mypkg');
     });
 });
+describe('assertAddonPackageName', () => {
+    for (const name of [
+        '@pikku/addon-mandrill',
+        'addon-slack',
+        'my.pkg',
+        'a-b_c',
+    ]) {
+        test(`accepts ${name}`, () => {
+            assert.doesNotThrow(() => assertAddonPackageName(name));
+        });
+    }
+    for (const name of [
+        '.',
+        '..',
+        '../../etc',
+        '@pikku/../evil',
+        '_private',
+        'UPPER',
+        'has space',
+        '',
+    ]) {
+        test(`rejects ${JSON.stringify(name)}`, () => {
+            assert.throws(() => assertAddonPackageName(name), /Invalid package name/);
+        });
+    }
+});
 //# sourceMappingURL=derive-instance-overrides.test.js.map

package/dist/src/lib/derive-instance-overrides.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"derive-instance-overrides.test.js","sourceRoot":"","sources":["../../../src/lib/derive-instance-overrides.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EACL,uBAAuB,EACvB,WAAW,GACZ,MAAM,gCAAgC,CAAA;AAEvC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,GAAG,uBAAuB,CAC/B,gBAAgB,EAChB,uBAAuB,EACvB;YACE,OAAO,EAAE,CAAC,kBAAkB,CAAC;YAC7B,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;SAChB,CACF,CAAA;QACD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;YAClC,gBAAgB,EAAE,wBAAwB;SAC3C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,GAAG,uBAAuB,CAAC,WAAW,EAAE,uBAAuB,EAAE;YACtE,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;YAClC,aAAa,EAAE,yBAAyB;SACzC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,uBAAuB,CAAC,eAAe,EAAE,oBAAoB,EAAE;YACvE,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,CAAC,cAAc,CAAC;YAC3B,WAAW,EAAE,EAAE;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE;YACpC,YAAY,EAAE,sBAAsB;SACrC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,GAAG,uBAAuB,CAAC,eAAe,EAAE,oBAAoB,EAAE;YACvE,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE;YACtC,UAAU,EAAE,0BAA0B;SACvC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,gBAAgB,EAAE;YAC3D,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC,EAAE,UAAU,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"derive-instance-overrides.test.js","sourceRoot":"","sources":["../../../src/lib/derive-instance-overrides.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,WAAW,GACZ,MAAM,gCAAgC,CAAA;AAEvC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,GAAG,uBAAuB,CAC/B,gBAAgB,EAChB,uBAAuB,EACvB;YACE,OAAO,EAAE,CAAC,kBAAkB,CAAC;YAC7B,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;SAChB,CACF,CAAA;QACD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;YAClC,gBAAgB,EAAE,wBAAwB;SAC3C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,GAAG,uBAAuB,CAAC,WAAW,EAAE,uBAAuB,EAAE;YACtE,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;YAClC,aAAa,EAAE,yBAAyB;SACzC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,uBAAuB,CAAC,eAAe,EAAE,oBAAoB,EAAE;YACvE,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,CAAC,cAAc,CAAC;YAC3B,WAAW,EAAE,EAAE;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE;YACpC,YAAY,EAAE,sBAAsB;SACrC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,GAAG,uBAAuB,CAAC,eAAe,EAAE,oBAAoB,EAAE;YACvE,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE;YACtC,UAAU,EAAE,0BAA0B;SACvC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,gBAAgB,EAAE;YAC3D,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAAC,EAAE,UAAU,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,KAAK,MAAM,IAAI,IAAI;QACjB,uBAAuB;QACvB,aAAa;QACb,QAAQ;QACR,OAAO;KACR,EAAE,CAAC;QACF,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI;QACjB,GAAG;QACH,IAAI;QACJ,WAAW;QACX,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,WAAW;QACX,EAAE;KACH,EAAE,CAAC;QACF,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAA;QAC3E,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA"}

package/dist/src/lib/resolve-audit-users.d.ts

@@ -1,5 +1,5 @@
 import type { BetterAuthInstance } from '@pikku/better-auth';
-import type { CoreSingletonServices } from '@pikku/core';
+import type { CoreSingletonServices } from '@pikku/core/types';
 /** Who a user id belongs to. */
 export type AuditUserProfile = {
     name?: string;

package/dist/src/lib/resolve-audit-users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-audit-users.d.ts","sourceRoot":"","sources":["../../../src/lib/resolve-audit-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAExD,gCAAgC;AAChC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED,+DAA+D;AAC/D,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,CAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,SAAS,EACrD,SAAS,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,EAClC,SAAS,qBAAqB,CAAC,QAAQ,CAAC,KACvC,OAAO,CAAC,kBAAkB,CAsC5B,CAAA"}
+{"version":3,"file":"resolve-audit-users.d.ts","sourceRoot":"","sources":["../../../src/lib/resolve-audit-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAE9D,gCAAgC;AAChC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,CAAA;AAED,+DAA+D;AAC/D,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,CAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,SAAS,EACrD,SAAS,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,EAClC,SAAS,qBAAqB,CAAC,QAAQ,CAAC,KACvC,OAAO,CAAC,kBAAkB,CAsC5B,CAAA"}

package/dist/src/lib/resolve-package-manager.d.ts

@@ -13,6 +13,17 @@ export declare const execPrefix: Record<PackageManager, [string, ...string[]]>;
  * lockfile exists, and a project can carry a stale lockfile from another tool.
  * Lockfiles are the fallback, then npm, which every Node install ships with.
  *
+ * The search walks up from `rootDir`, because `rootDir` is the pikku root (the
+ * directory holding pikku.config.json) and in a monorepo that is a package dir
+ * carrying neither signal — both live at the workspace root above it. Stopping
+ * at the pikku root would fall through to the npm default and run `npm install`
+ * inside a yarn workspace, which dies on `Unsupported URL Type "workspace:"`.
+ *
+ * A declared manager anywhere up the tree outranks any lockfile, for the same
+ * reason it does within one directory: lockfiles get copied around and go
+ * stale, so a stray package-lock.json in a sub-package must not override the
+ * workspace root's declared yarn.
+ *
  * Guessing wrong is not a soft failure: the install spawns a binary that isn't
  * on PATH and the caller sees `Executable not found in $PATH: "yarn"`.
  */

package/dist/src/lib/resolve-package-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-package-manager.d.ts","sourceRoot":"","sources":["../../../src/lib/resolve-package-manager.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;AAE5D,sDAAsD;AACtD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAKzE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAKpE,CAAA;AAWD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAqBrE"}
+{"version":3,"file":"resolve-package-manager.d.ts","sourceRoot":"","sources":["../../../src/lib/resolve-package-manager.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;AAE5D,sDAAsD;AACtD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAKzE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAKpE,CAAA;AA8BD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAuBrE"}

package/dist/src/lib/resolve-package-manager.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 /** `<pm> <args...> <pkg>` for adding a dependency. */
 export const installArgs = {
     bun: (pkg) => ['add', pkg],
@@ -26,36 +26,65 @@ const LOCKFILES = [
     ['pnpm-lock.yaml', 'pnpm'],
     ['package-lock.json', 'npm'],
 ];
+/** The corepack field of `dir/package.json`, when it names a manager we run. */
+function declaredPackageManager(dir) {
+    const pkgJsonPath = join(dir, 'package.json');
+    if (!existsSync(pkgJsonPath))
+        return null;
+    try {
+        const declared = JSON.parse(readFileSync(pkgJsonPath, 'utf-8')).packageManager;
+        // e.g. "bun@1.3.14", "yarn@4.5.0+sha224.abc"
+        const name = typeof declared === 'string' ? declared.split('@')[0] : null;
+        if (name && name in installArgs)
+            return name;
+    }
+    catch (e) {
+        // A malformed package.json is the project's problem, not ours — fall
+        // through to lockfile detection rather than failing the install.
+        console.warn(`Could not read packageManager from ${pkgJsonPath}:`, e);
+    }
+    return null;
+}
 /**
  * Which package manager runs in this project. `packageManager` in package.json
  * (the corepack field) is authoritative — it states intent even before a
  * lockfile exists, and a project can carry a stale lockfile from another tool.
  * Lockfiles are the fallback, then npm, which every Node install ships with.
  *
+ * The search walks up from `rootDir`, because `rootDir` is the pikku root (the
+ * directory holding pikku.config.json) and in a monorepo that is a package dir
+ * carrying neither signal — both live at the workspace root above it. Stopping
+ * at the pikku root would fall through to the npm default and run `npm install`
+ * inside a yarn workspace, which dies on `Unsupported URL Type "workspace:"`.
+ *
+ * A declared manager anywhere up the tree outranks any lockfile, for the same
+ * reason it does within one directory: lockfiles get copied around and go
+ * stale, so a stray package-lock.json in a sub-package must not override the
+ * workspace root's declared yarn.
+ *
  * Guessing wrong is not a soft failure: the install spawns a binary that isn't
  * on PATH and the caller sees `Executable not found in $PATH: "yarn"`.
  */
 export function resolvePackageManager(rootDir) {
-    const pkgJsonPath = join(rootDir, 'package.json');
-    if (existsSync(pkgJsonPath)) {
-        try {
-            const declared = JSON.parse(readFileSync(pkgJsonPath, 'utf-8'))
-                .packageManager;
-            // e.g. "bun@1.3.14", "yarn@4.5.0+sha224.abc"
-            const name = typeof declared === 'string' ? declared.split('@')[0] : null;
-            if (name && name in installArgs)
-                return name;
-        }
-        catch (e) {
-            // A malformed root package.json is the project's problem, not ours —
-            // fall through to lockfile detection rather than failing the install.
-            console.warn(`Could not read packageManager from ${pkgJsonPath}:`, e);
+    let nearestLockfile = null;
+    let dir = rootDir;
+    while (true) {
+        const declared = declaredPackageManager(dir);
+        if (declared)
+            return declared;
+        if (!nearestLockfile) {
+            for (const [lock, pm] of LOCKFILES) {
+                if (existsSync(join(dir, lock))) {
+                    nearestLockfile = pm;
+                    break;
+                }
+            }
         }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
     }
-    for (const [lock, pm] of LOCKFILES) {
-        if (existsSync(join(rootDir, lock)))
-            return pm;
-    }
-    return 'npm';
+    return nearestLockfile ?? 'npm';
 }
 //# sourceMappingURL=resolve-package-manager.js.map

package/dist/src/lib/resolve-package-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-package-manager.js","sourceRoot":"","sources":["../../../src/lib/resolve-package-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAsD;IAC5E,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;IAC3B,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;IAC3B,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAkD;IACvE,GAAG,EAAE,CAAC,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,CAAC,KAAK,CAAC;CACb,CAAA;AAED,qEAAqE;AACrE,MAAM,SAAS,GAAoC;IACjD,CAAC,UAAU,EAAE,KAAK,CAAC;IACnB,CAAC,WAAW,EAAE,KAAK,CAAC;IACpB,CAAC,WAAW,EAAE,MAAM,CAAC;IACrB,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,mBAAmB,EAAE,KAAK,CAAC;CAC7B,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IACjD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;iBAC5D,cAAc,CAAA;YACjB,6CAA6C;YAC7C,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACzE,IAAI,IAAI,IAAI,IAAI,IAAI,WAAW;gBAAE,OAAO,IAAsB,CAAA;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qEAAqE;YACrE,sEAAsE;YACtE,OAAO,CAAC,IAAI,CAAC,sCAAsC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAA;IAChD,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"resolve-package-manager.js","sourceRoot":"","sources":["../../../src/lib/resolve-package-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIzC,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAsD;IAC5E,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;IAC3B,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;IAC3B,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAkD;IACvE,GAAG,EAAE,CAAC,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,CAAC,KAAK,CAAC;CACb,CAAA;AAED,qEAAqE;AACrE,MAAM,SAAS,GAAoC;IACjD,CAAC,UAAU,EAAE,KAAK,CAAC;IACnB,CAAC,WAAW,EAAE,KAAK,CAAC;IACpB,CAAC,WAAW,EAAE,MAAM,CAAC;IACrB,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,mBAAmB,EAAE,KAAK,CAAC;CAC7B,CAAA;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CACnC,CAAC,cAAc,CAAA;QAChB,6CAA6C;QAC7C,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACzE,IAAI,IAAI,IAAI,IAAI,IAAI,WAAW;YAAE,OAAO,IAAsB,CAAA;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,CAAC,IAAI,CAAC,sCAAsC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,eAAe,GAA0B,IAAI,CAAA;IAEjD,IAAI,GAAG,GAAG,OAAO,CAAA;IACjB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;gBACnC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;oBAChC,eAAe,GAAG,EAAE,CAAA;oBACpB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IAED,OAAO,eAAe,IAAI,KAAK,CAAA;AACjC,CAAC"}

package/dist/src/lib/resolve-package-manager.test.js

@@ -1,6 +1,6 @@
 import { strict as assert } from 'assert';
 import { describe, test, beforeEach, afterEach } from 'node:test';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { resolvePackageManager } from './resolve-package-manager.js';
@@ -51,5 +51,43 @@ describe('resolvePackageManager', () => {
     test('defaults to npm with no signals', () => {
         assert.equal(resolvePackageManager(dir), 'npm');
     });
+    describe('in a monorepo, where the workspace root is above the pikku root', () => {
+        // The pikku root is wherever pikku.config.json sits, which in a monorepo is
+        // a package dir carrying neither packageManager nor a lockfile. Both live
+        // at the workspace root above it, so detection has to keep walking.
+        const nestPikkuRoot = () => {
+            const pikkuRoot = join(dir, 'packages', 'functions');
+            mkdirSync(pikkuRoot, { recursive: true });
+            writeFileSync(join(pikkuRoot, 'package.json'), JSON.stringify({ name: '@app/functions' }), 'utf-8');
+            return pikkuRoot;
+        };
+        test('reads packageManager from the workspace root', () => {
+            writePkg({ packageManager: 'yarn@4.10.3' });
+            assert.equal(resolvePackageManager(nestPikkuRoot()), 'yarn');
+        });
+        test('detects the workspace root lockfile', () => {
+            writePkg({});
+            writeFileSync(join(dir, 'yarn.lock'), '', 'utf-8');
+            assert.equal(resolvePackageManager(nestPikkuRoot()), 'yarn');
+        });
+        test('the nearest declaration wins over the workspace root', () => {
+            writePkg({ packageManager: 'yarn@4.10.3' });
+            const pikkuRoot = nestPikkuRoot();
+            writeFileSync(join(pikkuRoot, 'package.json'), JSON.stringify({ packageManager: 'pnpm@9.0.0' }), 'utf-8');
+            assert.equal(resolvePackageManager(pikkuRoot), 'pnpm');
+        });
+        test('a nearer lockfile still loses to a declared packageManager above it', () => {
+            // Lockfiles get copied around and go stale; the corepack field states
+            // intent, so it outranks a lockfile found lower down.
+            writePkg({ packageManager: 'yarn@4.10.3' });
+            const pikkuRoot = nestPikkuRoot();
+            writeFileSync(join(pikkuRoot, 'package-lock.json'), '', 'utf-8');
+            assert.equal(resolvePackageManager(pikkuRoot), 'yarn');
+        });
+        test('still defaults to npm when the whole tree is silent', () => {
+            writePkg({});
+            assert.equal(resolvePackageManager(nestPikkuRoot()), 'npm');
+        });
+    });
 });
 //# sourceMappingURL=resolve-package-manager.test.js.map

package/dist/src/lib/resolve-package-manager.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-package-manager.test.js","sourceRoot":"","sources":["../../../src/lib/resolve-package-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,IAAI,GAAW,CAAA;IACf,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IACF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAC/B,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;IAExE,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC1C,QAAQ,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,QAAQ,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QAC1C,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QAClD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QAClD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;YACvB,CAAC,WAAW,EAAE,MAAM,CAAC;YACrB,CAAC,gBAAgB,EAAE,MAAM,CAAC;YAC1B,CAAC,mBAAmB,EAAE,KAAK,CAAC;SACpB,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAA;YACnD,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,QAAQ,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3C,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"resolve-package-manager.test.js","sourceRoot":"","sources":["../../../src/lib/resolve-package-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,IAAI,GAAW,CAAA;IACf,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IACF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAC/B,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;IAExE,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC1C,QAAQ,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,QAAQ,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QAC1C,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QAClD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QAClD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;YACvB,CAAC,WAAW,EAAE,MAAM,CAAC;YACrB,CAAC,gBAAgB,EAAE,MAAM,CAAC;YAC1B,CAAC,mBAAmB,EAAE,KAAK,CAAC;SACpB,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAA;YACnD,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,QAAQ,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3C,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QACvD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC/E,4EAA4E;QAC5E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,aAAa,GAAG,GAAG,EAAE;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;YACpD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACzC,aAAa,CACX,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAC1C,OAAO,CACR,CAAA;YACD,OAAO,SAAS,CAAA;QAClB,CAAC,CAAA;QAED,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACxD,QAAQ,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAA;YAC3C,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;QAC9D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC/C,QAAQ,CAAC,EAAE,CAAC,CAAA;YACZ,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;YAClD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;QAC9D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAChE,QAAQ,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAA;YAC3C,MAAM,SAAS,GAAG,aAAa,EAAE,CAAA;YACjC,aAAa,CACX,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,EAChD,OAAO,CACR,CAAA;YACD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;YAC/E,sEAAsE;YACtE,sDAAsD;YACtD,QAAQ,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAA;YAC3C,MAAM,SAAS,GAAG,aAAa,EAAE,CAAA;YACjC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;YAChE,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC/D,QAAQ,CAAC,EAAE,CAAC,CAAA;YACZ,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC7D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/lib/surface.d.ts

@@ -0,0 +1,30 @@
+import type { SurfaceDoc, SurfaceResult, SurfaceUsage } from './surface.types.js';
+export type { SurfaceDoc, SurfaceResult, SurfaceUsage };
+/** The package that computes the doc when it is built, and ships it. */
+export declare const SURFACE_DOC_PACKAGE = "@pikku/cli";
+/**
+ * `@pikku/cli/surface.json`, expressed relative to the package's `.pikku` root
+ * because that is where `readPackageFile` starts from.
+ */
+export declare const SURFACE_DOC_PATH = "../surface.json";
+/** Relative to the project's outDir, where prebuild writes it. */
+export declare const SURFACE_USAGE_PATH = "surface-usage.gen.json";
+export declare const EMPTY_SURFACE_USAGE: SurfaceUsage;
+/**
+ * The two reads the surface is made of. Narrower than `MetaService` on purpose,
+ * so the reader is exercised without a project on disk.
+ */
+export type SurfaceReader = {
+    readFile(relativePath: string): Promise<string | null>;
+    readPackageFile?(packageName: string, relativePath: string): Promise<string | null>;
+};
+/**
+ * Reads the framework's surface doc and this project's measured usage.
+ *
+ * Both halves are optional and independently so: a project on an older CLI has
+ * no doc, one that has never run prebuild has no usage, and a website-like host
+ * has the doc alone. Every absence is an empty result rather than a throw,
+ * because the page teaches from the doc and only confirms from the usage.
+ */
+export declare const readSurface: (reader: SurfaceReader) => Promise<SurfaceResult>;
+//# sourceMappingURL=surface.d.ts.map

package/dist/src/lib/surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../../src/lib/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAA;AAE3B,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AAEvD,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,oBAAoB,CAAA;AAEjD,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,2BAA2B,CAAA;AAE1D,eAAO,MAAM,mBAAmB,EAAE,YAAkC,CAAA;AAEpE;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACtD,eAAe,CAAC,CACd,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC1B,CAAA;AAqBD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GACtB,QAAQ,aAAa,KACpB,OAAO,CAAC,aAAa,CAUvB,CAAA"}

package/dist/src/lib/surface.js

@@ -0,0 +1,47 @@
+/** The package that computes the doc when it is built, and ships it. */
+export const SURFACE_DOC_PACKAGE = '@pikku/cli';
+/**
+ * `@pikku/cli/surface.json`, expressed relative to the package's `.pikku` root
+ * because that is where `readPackageFile` starts from.
+ */
+export const SURFACE_DOC_PATH = '../surface.json';
+/** Relative to the project's outDir, where prebuild writes it. */
+export const SURFACE_USAGE_PATH = 'surface-usage.gen.json';
+export const EMPTY_SURFACE_USAGE = { bySpecifier: {} };
+const read = async (attempt) => {
+    try {
+        return (await attempt()) ?? null;
+    }
+    catch {
+        return null;
+    }
+};
+const parseJson = (content) => {
+    if (!content)
+        return null;
+    try {
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Reads the framework's surface doc and this project's measured usage.
+ *
+ * Both halves are optional and independently so: a project on an older CLI has
+ * no doc, one that has never run prebuild has no usage, and a website-like host
+ * has the doc alone. Every absence is an empty result rather than a throw,
+ * because the page teaches from the doc and only confirms from the usage.
+ */
+export const readSurface = async (reader) => {
+    const [docContent, usageContent] = await Promise.all([
+        read(() => reader.readPackageFile?.(SURFACE_DOC_PACKAGE, SURFACE_DOC_PATH)),
+        read(() => reader.readFile(SURFACE_USAGE_PATH)),
+    ]);
+    return {
+        doc: parseJson(docContent),
+        usage: parseJson(usageContent) ?? EMPTY_SURFACE_USAGE,
+    };
+};
+//# sourceMappingURL=surface.js.map

package/dist/src/lib/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../../../src/lib/surface.ts"],"names":[],"mappings":"AAQA,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAEjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAA;AAE1D,MAAM,CAAC,MAAM,mBAAmB,GAAiB,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;AAcpE,MAAM,IAAI,GAAG,KAAK,EAChB,OAAiD,EACzB,EAAE;IAC1B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,IAAI,IAAI,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAI,OAAsB,EAAY,EAAE;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,MAAqB,EACG,EAAE;IAC1B,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;KAChD,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,EAAE,SAAS,CAAa,UAAU,CAAC;QACtC,KAAK,EAAE,SAAS,CAAe,YAAY,CAAC,IAAI,mBAAmB;KACpE,CAAA;AACH,CAAC,CAAA"}

package/dist/src/lib/surface.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=surface.test.d.ts.map

package/dist/src/lib/surface.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.test.d.ts","sourceRoot":"","sources":["../../../src/lib/surface.test.ts"],"names":[],"mappings":""}