@seanhogg/builderforce-webcontainers-core 2026.10.1 → 2026.10.3

package/dist/installer/lockfile.js

@@ -0,0 +1,110 @@
+import { sortObject } from './spec.js';
+import { satisfies, validRange } from './semver.js';
+export function parseLockfile(text) {
+    if (!text)
+        return undefined;
+    try {
+        const lock = JSON.parse(text);
+        // v1 lockfiles only have the nested `dependencies` tree; re-resolving is simpler than translating.
+        return lock.lockfileVersion >= 2 && lock.packages ? lock : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const nameFromLocation = (location) => location.slice(location.lastIndexOf('node_modules/') + 'node_modules/'.length);
+/** A locked entry as the manifest the resolver works with. */
+export function lockEntryManifest(location, entry) {
+    if (!entry.version || !entry.resolved)
+        return undefined;
+    return {
+        name: entry.name ?? nameFromLocation(location),
+        version: entry.version,
+        dependencies: entry.dependencies,
+        optionalDependencies: entry.optionalDependencies,
+        peerDependencies: entry.peerDependencies,
+        peerDependenciesMeta: entry.peerDependenciesMeta,
+        bin: entry.bin,
+        engines: entry.engines,
+        os: entry.os,
+        cpu: entry.cpu,
+        hasInstallScript: entry.hasInstallScript,
+        deprecated: entry.deprecated,
+        license: entry.license,
+        dist: { tarball: entry.resolved, integrity: entry.integrity },
+    };
+}
+/** Locked manifests by registry package name, for "prefer what is locked". */
+export function lockedManifests(lock) {
+    const out = new Map();
+    for (const [location, entry] of Object.entries(lock?.packages ?? {})) {
+        if (!location.includes('node_modules/'))
+            continue;
+        const manifest = lockEntryManifest(location, entry);
+        if (!manifest)
+            continue;
+        const list = out.get(manifest.name) ?? [];
+        list.push(manifest);
+        out.set(manifest.name, list);
+    }
+    return out;
+}
+/** The highest locked version of `name` satisfying `range`, if any. */
+export function pickLocked(locked, name, range) {
+    const r = range || '*';
+    if (!validRange(r))
+        return undefined;
+    let best;
+    for (const m of locked.get(name) ?? []) {
+        if (satisfies(m.version, r) && (!best || satisfies(m.version, `>${best.version}`)))
+            best = m;
+    }
+    return best;
+}
+const ROOT_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
+/** Do the lockfile's root ranges match package.json exactly? (`npm ci`'s precondition.) */
+export function lockMatchesPackage(lock, pkg) {
+    const root = lock.packages[''] ?? {};
+    return ROOT_FIELDS.every((field) => {
+        const a = pkg[field] ?? {};
+        const b = root[field] ?? {};
+        const keys = new Set([...Object.keys(a), ...Object.keys(b)]);
+        return [...keys].every((k) => a[k] === b[k]);
+    });
+}
+const nonEmpty = (record) => (record && Object.keys(record).length ? record : undefined);
+export function buildLockfile(pkg, tree) {
+    const root = { name: pkg.name, version: pkg.version };
+    for (const field of ROOT_FIELDS)
+        if (nonEmpty(pkg[field]))
+            root[field] = pkg[field];
+    if (pkg.bin)
+        root.bin = pkg.bin;
+    const packages = { '': JSON.parse(JSON.stringify(root)) };
+    for (const location of [...tree.keys()].sort()) {
+        const node = tree.get(location);
+        const m = node.manifest;
+        const entry = {
+            name: m.name !== node.name ? m.name : undefined,
+            version: m.version,
+            resolved: m.dist.tarball,
+            integrity: m.dist.integrity,
+            dev: node.dev || undefined,
+            optional: node.optional || undefined,
+            license: m.license,
+            dependencies: nonEmpty(m.dependencies && sortObject(m.dependencies)),
+            optionalDependencies: nonEmpty(m.optionalDependencies),
+            peerDependencies: nonEmpty(m.peerDependencies),
+            peerDependenciesMeta: nonEmpty(m.peerDependenciesMeta),
+            bin: m.bin,
+            engines: nonEmpty(m.engines),
+            os: m.os,
+            cpu: m.cpu,
+            hasInstallScript: m.hasInstallScript || undefined,
+            deprecated: m.deprecated,
+        };
+        packages[location] = JSON.parse(JSON.stringify(entry)); // drops the undefineds
+    }
+    return { name: pkg.name, version: pkg.version, lockfileVersion: 3, requires: true, packages };
+}
+//# sourceMappingURL=lockfile.js.map

package/dist/installer/lockfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../src/installer/lockfile.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAoB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA+BpD,MAAM,UAAU,aAAa,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;QAC1C,mGAAmG;QACnG,OAAO,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;AAE9H,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAgB;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAA0B;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,SAAS;QAClD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,UAAU,CAAC,MAAsC,EAAE,IAAY,EAAE,KAAa;IAC5F,MAAM,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC;IACvB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,IAAiC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,CAAU,CAAC;AAE7G,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,IAAc,EAAE,GAAgB;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAI,IAA2D,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,QAAQ,GAAG,CAAmB,MAAqB,EAAiB,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEzI,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,IAAkC;IAChF,MAAM,IAAI,GAAkC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACrF,KAAK,MAAM,KAAK,IAAI,WAAW;QAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAG,IAAgC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACjH,IAAI,GAAG,CAAC,GAAG;QAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,QAAQ,GAA8B,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAc,EAAE,CAAC;IAElG,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;YACxB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;YACpC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACpE,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACtD,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC9C,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACtD,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;YACjD,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAc,CAAC,CAAC,uBAAuB;IAC9F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChG,CAAC"}

package/dist/installer/registry.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Talking to an npm registry: packuments (version metadata) and tarballs, both
+ * through an optional cache PORT so the browser can back it with Cache Storage
+ * and tests with a Map. The installer never touches `globalThis.fetch` — the
+ * caller injects one, which is what keeps this testable against a fake registry.
+ */
+export type FetchLike = (url: string, init?: {
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    arrayBuffer(): Promise<ArrayBuffer>;
+}>;
+/** A byte cache keyed by string. Tarballs are immutable, so they are cached forever. */
+export interface PackageCache {
+    get(key: string): Promise<Uint8Array | undefined>;
+    put(key: string, data: Uint8Array): Promise<void>;
+}
+export declare function createMemoryCache(): PackageCache & {
+    readonly size: number;
+};
+export type BinField = string | Record<string, string>;
+/** One version from a packument — the fields the abbreviated format carries. */
+export interface PackageManifest {
+    name: string;
+    version: string;
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    peerDependenciesMeta?: Record<string, {
+        optional?: boolean;
+    }>;
+    bundleDependencies?: string[] | boolean;
+    bundledDependencies?: string[] | boolean;
+    bin?: BinField;
+    os?: string[];
+    cpu?: string[];
+    engines?: Record<string, string>;
+    hasInstallScript?: boolean;
+    deprecated?: string;
+    license?: string;
+    dist: {
+        tarball: string;
+        integrity?: string;
+        shasum?: string;
+    };
+}
+export interface Packument {
+    name: string;
+    'dist-tags': Record<string, string>;
+    versions: Record<string, PackageManifest>;
+}
+export interface RegistryOptions {
+    fetch: FetchLike;
+    registry?: string;
+    cache?: PackageCache;
+    /** How long a cached packument is trusted. Default 10 minutes. */
+    packumentMaxAgeMs?: number;
+    signal?: AbortSignal;
+}
+export declare const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+/**
+ * Check `integrity` (SRI, `sha512-…`) or the legacy sha1 `shasum`. Skipped where
+ * WebCrypto is missing — a tarball from the configured registry over https is
+ * still trustworthy, the check only guards against a corrupt cache entry.
+ */
+export declare function verifyIntegrity(data: Uint8Array, dist: {
+    integrity?: string;
+    shasum?: string;
+}): Promise<boolean>;
+export declare class RegistryClient {
+    private readonly options;
+    readonly registry: string;
+    private readonly packuments;
+    constructor(options: RegistryOptions);
+    /** Version metadata for a package, fetched once per client. */
+    packument(name: string): Promise<Packument>;
+    /** The tarball's bytes (still gzipped), integrity-checked. */
+    tarball(manifest: Pick<PackageManifest, 'name' | 'version' | 'dist'>): Promise<Uint8Array>;
+    private loadPackument;
+    private get;
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/installer/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/installer/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC;IAClH,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACrC,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED,wBAAgB,iBAAiB,IAAI,YAAY,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAS5E;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEvD,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACxC,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAiB7D;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAevH;AAED,qBAAa,cAAc;IAIb,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyC;gBAEvC,OAAO,EAAE,eAAe;IAIrD,+DAA+D;IAC/D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAU3C,8DAA8D;IACxD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;YAWlF,aAAa;YAoBb,GAAG;CAiBlB"}

package/dist/installer/registry.js

@@ -0,0 +1,130 @@
+/**
+ * Talking to an npm registry: packuments (version metadata) and tarballs, both
+ * through an optional cache PORT so the browser can back it with Cache Storage
+ * and tests with a Map. The installer never touches `globalThis.fetch` — the
+ * caller injects one, which is what keeps this testable against a fake registry.
+ */
+export function createMemoryCache() {
+    const store = new Map();
+    return {
+        get: async (key) => store.get(key),
+        put: async (key, data) => void store.set(key, data),
+        get size() {
+            return store.size;
+        },
+    };
+}
+export const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+/** The abbreviated ("corgi") document: a fraction of the full packument's size. */
+const ABBREVIATED = 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*';
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function toBase64(bytes) {
+    let binary = '';
+    for (let i = 0; i < bytes.length; i += 0x8000)
+        binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
+    return btoa(binary);
+}
+function toHex(bytes) {
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Check `integrity` (SRI, `sha512-…`) or the legacy sha1 `shasum`. Skipped where
+ * WebCrypto is missing — a tarball from the configured registry over https is
+ * still trustworthy, the check only guards against a corrupt cache entry.
+ */
+export async function verifyIntegrity(data, dist) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle)
+        return true;
+    const digest = async (algo) => new Uint8Array(await subtle.digest(algo, data));
+    if (dist.integrity) {
+        const algos = { sha512: 'SHA-512', sha384: 'SHA-384', sha256: 'SHA-256', sha1: 'SHA-1' };
+        for (const token of dist.integrity.split(/\s+/)) {
+            const dash = token.indexOf('-');
+            const algo = algos[token.slice(0, dash)];
+            if (algo && toBase64(await digest(algo)) === token.slice(dash + 1))
+                return true;
+        }
+        return false;
+    }
+    if (dist.shasum)
+        return toHex(await digest('SHA-1')) === dist.shasum;
+    return true;
+}
+export class RegistryClient {
+    options;
+    registry;
+    packuments = new Map();
+    constructor(options) {
+        this.options = options;
+        this.registry = (options.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, '');
+    }
+    /** Version metadata for a package, fetched once per client. */
+    packument(name) {
+        let pending = this.packuments.get(name);
+        if (!pending) {
+            pending = this.loadPackument(name);
+            pending.catch(() => this.packuments.delete(name));
+            this.packuments.set(name, pending);
+        }
+        return pending;
+    }
+    /** The tarball's bytes (still gzipped), integrity-checked. */
+    async tarball(manifest) {
+        const { dist } = manifest;
+        const key = `tarball:${dist.integrity ?? dist.shasum ?? dist.tarball}`;
+        const cached = await this.options.cache?.get(key);
+        if (cached && (await verifyIntegrity(cached, dist)))
+            return cached;
+        const data = await this.get(dist.tarball, {});
+        if (!(await verifyIntegrity(data, dist)))
+            throw new Error(`Integrity check failed for ${manifest.name}@${manifest.version}`);
+        await this.options.cache?.put(key, data);
+        return data;
+    }
+    async loadPackument(name) {
+        const key = `packument:${this.registry}/${name}`;
+        const maxAge = this.options.packumentMaxAgeMs ?? 10 * 60_000;
+        const cached = await this.options.cache?.get(key);
+        if (cached) {
+            try {
+                const entry = JSON.parse(decoder.decode(cached));
+                if (Date.now() - entry.t < maxAge)
+                    return entry.p;
+            }
+            catch {
+                // a corrupt entry is just a miss
+            }
+        }
+        const url = `${this.registry}/${name.startsWith('@') ? '@' + encodeURIComponent(name.slice(1)) : encodeURIComponent(name)}`;
+        const bytes = await this.get(url, { accept: ABBREVIATED }, name);
+        const packument = JSON.parse(decoder.decode(bytes));
+        if (!packument.versions)
+            throw new Error(`The registry returned no versions for "${name}".`);
+        await this.options.cache?.put(key, encoder.encode(JSON.stringify({ t: Date.now(), p: packument })));
+        return packument;
+    }
+    async get(url, headers, packageName) {
+        let lastError;
+        for (let attempt = 0; attempt < 2; attempt++) {
+            let response;
+            try {
+                response = await this.options.fetch(url, { headers, signal: this.options.signal });
+            }
+            catch (error) {
+                if (this.options.signal?.aborted)
+                    throw error;
+                lastError = error; // network blip: retry once
+                continue;
+            }
+            if (response.status === 404 && packageName)
+                throw new Error(`Package "${packageName}" was not found in ${this.registry}.`);
+            if (!response.ok)
+                throw new Error(`GET ${url} failed with HTTP ${response.status}.`);
+            return new Uint8Array(await response.arrayBuffer());
+        }
+        throw new Error(`GET ${url} failed: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/installer/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/installer/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;QACnD,IAAI,IAAI;YACN,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAuCD,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,mFAAmF;AACnF,MAAM,WAAW,GAAG,0EAA0E,CAAC;AAE/F,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAC/G,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAgB,EAAE,IAA6C;IACnG,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAA8B,CAAC,CAAC,CAAC;IACjH,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,KAAK,GAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,IAAI,QAAQ,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,cAAc;IAII;IAHpB,QAAQ,CAAS;IACT,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEpE,YAA6B,OAAwB;QAAxB,YAAO,GAAP,OAAO,CAAiB;QACnD,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,+DAA+D;IAC/D,SAAS,CAAC,IAAY;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,OAAO,CAAC,QAA4D;QACxE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;QAC1B,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,MAAM,IAAI,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7H,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY;QACtC,MAAM,GAAG,GAAG,aAAa,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,GAAG,MAAM,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAgC,CAAC;gBAChF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,MAAM;oBAAE,OAAO,KAAK,CAAC,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;YACnC,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5H,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAc,CAAC;QACjE,IAAI,CAAC,SAAS,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,IAAI,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,OAA+B,EAAE,WAAoB;QAClF,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,QAAwC,CAAC;YAC7C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACrF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO;oBAAE,MAAM,KAAK,CAAC;gBAC9C,SAAS,GAAG,KAAK,CAAC,CAAC,2BAA2B;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,sBAAsB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAC3H,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,qBAAqB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACrF,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;CACF"}

package/dist/installer/semver.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The slice of node-semver an installer needs: parse, compare, range matching
+ * and "highest version satisfying". Written here rather than depending on the
+ * `semver` package because that one is CommonJS, and the core must load as
+ * native ESM in a browser without a bundler step.
+ *
+ * Semantics follow node-semver (and so npm): `^`/`~`/x-ranges/hyphen ranges,
+ * `||` unions, and the prerelease rule — a prerelease only satisfies a range
+ * that names a prerelease on the same major.minor.patch.
+ */
+export interface SemVer {
+    major: number;
+    minor: number;
+    patch: number;
+    prerelease: Array<string | number>;
+    /** Normalised `1.2.3-beta.1` (build metadata dropped). */
+    version: string;
+}
+type Op = '<' | '<=' | '>' | '>=' | '=';
+interface Comparator {
+    op: Op;
+    version: SemVer;
+}
+/** OR of AND sets; an empty AND set matches every (non-prerelease) version. */
+type Range = Comparator[][];
+export declare function parseVersion(input: string): SemVer | null;
+export declare function valid(input: string): string | null;
+/** -1, 0 or 1. Accepts strings or parsed versions. */
+export declare function compare(a: string | SemVer, b: string | SemVer): number;
+export declare function parseRange(input: string): Range | null;
+export declare function validRange(input: string): boolean;
+export declare function satisfies(version: string | SemVer, range: string, options?: {
+    includePrerelease?: boolean;
+}): boolean;
+/** The highest of `versions` satisfying `range`, or null. */
+export declare function maxSatisfying(versions: Iterable<string>, range: string): string | null;
+export {};
+//# sourceMappingURL=semver.d.ts.map

package/dist/installer/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../../src/installer/semver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACnC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,EAAE,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;AACxC,UAAU,UAAU;IAClB,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,MAAM,CAAC;CACjB;AACD,+EAA+E;AAC/E,KAAK,KAAK,GAAG,UAAU,EAAE,EAAE,CAAC;AAK5B,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKzD;AAOD,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAElD;AAkBD,sDAAsD;AACtD,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAKtE;AA6DD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAmBtD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAqBD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAKzH;AAED,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOtF"}

package/dist/installer/semver.js

@@ -0,0 +1,187 @@
+/**
+ * The slice of node-semver an installer needs: parse, compare, range matching
+ * and "highest version satisfying". Written here rather than depending on the
+ * `semver` package because that one is CommonJS, and the core must load as
+ * native ESM in a browser without a bundler step.
+ *
+ * Semantics follow node-semver (and so npm): `^`/`~`/x-ranges/hyphen ranges,
+ * `||` unions, and the prerelease rule — a prerelease only satisfies a range
+ * that names a prerelease on the same major.minor.patch.
+ */
+const VERSION = /^\s*[v=]*\s*(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-.]+)?\s*$/;
+const PARTIAL = /^[v=]*(\d+|[xX*])?(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-.]+)?$/;
+export function parseVersion(input) {
+    const m = VERSION.exec(input);
+    if (!m)
+        return null;
+    const prerelease = m[4] ? m[4].split('.').map((id) => (/^\d+$/.test(id) ? Number(id) : id)) : [];
+    return make(Number(m[1]), Number(m[2]), Number(m[3]), prerelease);
+}
+function make(major, minor, patch, prerelease = []) {
+    const pre = prerelease.length ? `-${prerelease.join('.')}` : '';
+    return { major, minor, patch, prerelease, version: `${major}.${minor}.${patch}${pre}` };
+}
+export function valid(input) {
+    return parseVersion(input)?.version ?? null;
+}
+function comparePre(a, b) {
+    if (!a.prerelease.length || !b.prerelease.length)
+        return (b.prerelease.length ? 1 : 0) - (a.prerelease.length ? 1 : 0) || 0;
+    for (let i = 0;; i++) {
+        const x = a.prerelease[i];
+        const y = b.prerelease[i];
+        if (x === undefined && y === undefined)
+            return 0;
+        if (x === undefined)
+            return -1;
+        if (y === undefined)
+            return 1;
+        if (x === y)
+            continue;
+        if (typeof x === 'number' && typeof y === 'number')
+            return x < y ? -1 : 1;
+        if (typeof x === 'number')
+            return -1; // numeric identifiers sort below alphanumeric ones
+        if (typeof y === 'number')
+            return 1;
+        return x < y ? -1 : 1;
+    }
+}
+/** -1, 0 or 1. Accepts strings or parsed versions. */
+export function compare(a, b) {
+    const x = typeof a === 'string' ? parseVersion(a) : a;
+    const y = typeof b === 'string' ? parseVersion(b) : b;
+    if (!x || !y)
+        throw new TypeError(`Invalid version: ${!x ? String(a) : String(b)}`);
+    return Math.sign(x.major - y.major || x.minor - y.minor || x.patch - y.patch) || comparePre(x, y);
+}
+const isX = (part) => part === undefined || part === 'x' || part === 'X' || part === '*';
+/** One `op + partial` token → comparators (an x-range expands to a pair). */
+function expand(token) {
+    const opMatch = /^(~>?|\^|<=|>=|<|>|=)?(.*)$/.exec(token);
+    const op = opMatch[1] ?? '';
+    const m = PARTIAL.exec(opMatch[2]);
+    if (!m)
+        return null;
+    const [, M, m2, p, pre] = m;
+    const pr = pre ? pre.split('.').map((id) => (/^\d+$/.test(id) ? Number(id) : id)) : [];
+    const xM = isX(M), xm = xM || isX(m2), xp = xm || isX(p);
+    const maj = xM ? 0 : Number(M), min = xm ? 0 : Number(m2), pat = xp ? 0 : Number(p);
+    const ge = (v) => ({ op: '>=', version: v });
+    const lt = (v) => ({ op: '<', version: v });
+    const upper = (a, b, c) => lt(make(a, b, c, [0]));
+    if (op === '^') {
+        if (xM)
+            return [];
+        const lower = ge(make(maj, min, pat, pr));
+        if (maj > 0 || xm)
+            return [lower, upper(maj + 1, 0, 0)];
+        if (min > 0 || xp)
+            return [lower, upper(0, min + 1, 0)];
+        return [lower, upper(0, 0, pat + 1)];
+    }
+    if (op === '~' || op === '~>') {
+        if (xM)
+            return [];
+        const lower = ge(make(maj, min, pat, pr));
+        return xm ? [lower, upper(maj + 1, 0, 0)] : [lower, upper(maj, min + 1, 0)];
+    }
+    if (op === '' || op === '=') {
+        if (xM)
+            return [];
+        if (xm)
+            return [ge(make(maj, 0, 0)), upper(maj + 1, 0, 0)];
+        if (xp)
+            return [ge(make(maj, min, 0)), upper(maj, min + 1, 0)];
+        return [{ op: '=', version: make(maj, min, pat, pr) }];
+    }
+    // <, <=, >, >= with a partial version.
+    if (xM)
+        return op === '<' || op === '>' ? [lt(make(0, 0, 0, [0]))] : [];
+    if (!xp)
+        return [{ op: op, version: make(maj, min, pat, pr) }];
+    if (op === '>')
+        return [ge(xm ? make(maj + 1, 0, 0) : make(maj, min + 1, 0))];
+    if (op === '<=')
+        return [xm ? upper(maj + 1, 0, 0) : upper(maj, min + 1, 0)];
+    if (op === '<')
+        return [lt(make(maj, min, 0, [0]))];
+    return [ge(make(maj, min, 0))]; // >=
+}
+function parsePartialBound(text) {
+    return { parts: text.replace(/^[v=]+/, '').split('-')[0].split('.'), full: parseVersion(text) };
+}
+function hyphen(from, to) {
+    const lower = expand(`>=${from}`);
+    if (!lower)
+        return null;
+    const { parts, full } = parsePartialBound(to);
+    if (full)
+        return [...lower, { op: '<=', version: full }];
+    if (isX(parts[0]))
+        return lower;
+    const upperC = expand(`<=${to}`);
+    return upperC ? [...lower, ...upperC] : null;
+}
+const cache = new Map();
+export function parseRange(input) {
+    const hit = cache.get(input);
+    if (hit !== undefined)
+        return hit;
+    let range = [];
+    for (const raw of input.split('||')) {
+        const part = raw.trim().replace(/(<=|>=|<|>|=|~>?|\^)\s+/g, '$1');
+        const h = /^(\S+)\s+-\s+(\S+)$/.exec(part);
+        const set = h ? hyphen(h[1], h[2]) : part.split(/\s+/).filter(Boolean).reduce((acc, token) => {
+            const c = acc && expand(token);
+            return c ? [...acc, ...c] : null;
+        }, []);
+        if (!set) {
+            range = null;
+            break;
+        }
+        range.push(set);
+    }
+    cache.set(input, range);
+    return range;
+}
+export function validRange(input) {
+    return parseRange(input) !== null;
+}
+function test(c, v) {
+    const d = compare(v, c.version);
+    switch (c.op) {
+        case '<': return d < 0;
+        case '<=': return d <= 0;
+        case '>': return d > 0;
+        case '>=': return d >= 0;
+        default: return d === 0;
+    }
+}
+function testSet(set, v, includePrerelease) {
+    if (!set.every((c) => test(c, v)))
+        return false;
+    if (!v.prerelease.length || includePrerelease)
+        return true;
+    // A prerelease only matches when the range itself names one on the same tuple.
+    return set.some((c) => c.version.prerelease.length > 0
+        && c.version.major === v.major && c.version.minor === v.minor && c.version.patch === v.patch);
+}
+export function satisfies(version, range, options = {}) {
+    const v = typeof version === 'string' ? parseVersion(version) : version;
+    const r = parseRange(range);
+    if (!v || !r)
+        return false;
+    return r.some((set) => testSet(set, v, options.includePrerelease ?? false));
+}
+/** The highest of `versions` satisfying `range`, or null. */
+export function maxSatisfying(versions, range) {
+    let best = null;
+    for (const raw of versions) {
+        const v = parseVersion(raw);
+        if (v && satisfies(v, range) && (!best || compare(v, best) > 0))
+            best = v;
+    }
+    return best?.version ?? null;
+}
+//# sourceMappingURL=semver.js.map

package/dist/installer/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../src/installer/semver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmBH,MAAM,OAAO,GAAG,mGAAmG,CAAC;AACpH,MAAM,OAAO,GAAG,uHAAuH,CAAC;AAExI,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,KAAa,EAAE,KAAa,EAAE,aAAqC,EAAE;IAChG,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,GAAG,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,OAAO,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5H,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,mDAAmD;QACzF,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,OAAO,CAAC,CAAkB,EAAE,CAAkB;IAC5D,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,IAAwB,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAE7G,6EAA6E;AAC7E,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,EAAE,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1E,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAC5B,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,IAAI,EAAE;YAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE;YAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,uCAAuC;IACvC,IAAI,EAAE;QAAE,OAAO,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,EAAU;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;AAE9C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,KAAK,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAClH,MAAM,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,GAAG,IAAI,CAAC;YACb,MAAM;QACR,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,CAAa,EAAE,CAAS;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QACb,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAiB,EAAE,CAAS,EAAE,iBAA0B;IACvE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC3D,+EAA+E;IAC/E,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;WACjD,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAwB,EAAE,KAAa,EAAE,UAA2C,EAAE;IAC9G,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,QAA0B,EAAE,KAAa;IACrE,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;AAC/B,CAAC"}

package/dist/installer/spec.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Package specifiers as `npm install` and package.json write them:
+ * `react`, `react@^18`, `@scope/pkg@latest`, and aliases (`foo@npm:bar@^1`).
+ * Git, file and URL specs are recognised so they can be declined with a reason.
+ */
+export interface ParsedSpec {
+    /** The name it is installed under (the alias, for `npm:` specs). */
+    name: string;
+    /** The registry package actually fetched. */
+    registryName: string;
+    /** A semver range or a dist-tag. `''` when none was given. */
+    range: string;
+}
+/** Split `name@range` (the CLI form). */
+export declare function parseInstallSpec(spec: string): ParsedSpec;
+/** A package.json `dependencies` entry: `"foo": "npm:bar@^1"` or `"foo": "^1"`. */
+export declare function parseDependency(name: string, range: string): ParsedSpec;
+export interface PackageJson {
+    name?: string;
+    version?: string;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    scripts?: Record<string, string>;
+    bin?: string | Record<string, string>;
+    [key: string]: unknown;
+}
+export declare function sortObject(record: Record<string, string>): Record<string, string>;
+//# sourceMappingURL=spec.d.ts.map

package/dist/installer/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/installer/spec.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;CACf;AAID,yCAAyC;AACzC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKzD;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAUvE;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjF"}