@sous-io/sous 0.2.37 → 1.0.2

package/src/lib/repos/trust.ts

@@ -1,447 +0,0 @@
-/**
- * The trust layer.
- *
- * Added equals trusted. There is no separate trust command and no trusted-but-
- * not-added state: a repository sous will read from is one written into the
- * project's `repos:` map, and removing the entry withdraws the trust. Until a
- * repository is added, sous downloads nothing from it, not even its index;
- * there is no peeking before trusting, because the decision rests on the URL
- * and the publisher's reputation, which are inspected outside sous.
- *
- * Resolution can turn up repositories a dependency needs but the project has
- * not added. Those come back from the resolver as `MissingRepo` entries with
- * their provenance, and this is where the user is asked about them: one
- * consolidated question per round, listing every new repository with its URL
- * and the recipe that requires it. A refusal aborts. A non-interactive run
- * fails hard, naming the repositories and the command that grants trust, and
- * `--trust` acknowledges without asking.
- */
-
-import { color } from "@oclif/color";
-import { ConfigError } from "../errors.js";
-import type { Settings } from "../settings.js";
-import {
-  blankLine,
-  formatVariable,
-  log as writeLine,
-  palette,
-  wrapColumns,
-  wrapText,
-  type VariableEntry,
-} from "../../utils/formatting.js";
-import { askYesNo } from "../../utils/prompts.js";
-import {
-  isInteractive,
-  nonInteractiveReason,
-  NonInteractiveError,
-} from "../interactive.js";
-import {
-  REPOS_LAYER_FILENAME,
-  readManagedLayer,
-  updateManagedLayer,
-  type ManagedLayerOptions,
-} from "./managed-layer.js";
-import type { MissingRepo } from "./resolver.js";
-import type { ProviderId } from "./providers/provider.js";
-import { enabledRepos } from "./defaults.js";
-
-/** The `addedBy` value meaning a person deliberately added the repository. */
-export const USER_ADDED_BY = "user";
-
-/** One repository entry, as it is written into the managed layer. */
-export type TrustedRepo = {
-  /** Where the repository lives. */
-  url: string;
-  /** The provider that handles it, when the URL does not give it away. */
-  provider?: ProviderId;
-  /** Whether a newer in-range version is preferred over the locked one. */
-  alwaysPull?: boolean;
-  /** When it was added. */
-  addedAt?: string;
-  /** Who required it: "user", or the ref of the recipe whose dependency pulled it in. */
-  addedBy?: string;
-};
-
-/** What `addRepo` is told. */
-export type AddRepoRequest = {
-  /** The repository's short name, which refs use as the `repo:` qualifier. */
-  name: string;
-  /** Where the repository lives. */
-  url: string;
-  /** The provider that handles it, when the URL does not give it away. */
-  provider?: ProviderId;
-  /** Whether a newer in-range version is preferred over the locked one. */
-  alwaysPull?: boolean;
-  /** Who required it. Defaults to "user". */
-  addedBy?: string;
-};
-
-/** How trust is confirmed for a round of missing repositories. */
-export type ConfirmTrustOptions = {
-  /** Whether sous may ask. Defaults to whether both streams are a terminal. */
-  interactive?: boolean;
-  /**
-   * The confirmation flag, spelled `--trust` on the commands that perform this
-   * ceremony (and `--yes`, `-y`, `-f` or `--force`): acknowledge every
-   * repository this command adds, without asking.
-   */
-  trustFlag?: boolean;
-};
-
-/** What a confirmation round produced. */
-export type ConfirmTrustResult = {
-  /** The repositories the user accepted. */
-  accepted: MissingRepo[];
-  /** The ones whose URL sous knew, and has now written into the managed layer. */
-  added: string[];
-  /**
-   * The ones sous still cannot add on its own, because nothing told it their
-   * URL. A recipe names a repository by its short name, so the URL has to come
-   * from the person adding it.
-   */
-  needUrl: string[];
-};
-
-/** How the trust service is built. */
-export type TrustServiceOptions = ManagedLayerOptions & {
-  /** The project's `.sous/` directory; the managed layer lives under it. */
-  sousDir: string;
-  /** The merged settings, which is where hand-written `repos:` entries come from. */
-  settings?: Settings;
-  /** Whether sous may ask questions. Defaults to whether both streams are a terminal. */
-  interactive?: boolean;
-  /** How a yes or no question is asked. Injected in tests. */
-  ask?: (message: string) => Promise<boolean>;
-  /** Where the consolidated trust notice is written. Defaults to the console. */
-  write?: (message: string) => void;
-  /** The clock, so a recorded `addedAt` is predictable in tests. */
-  now?: () => Date;
-};
-
-/** Reads and changes the list of repositories a project trusts. */
-export class TrustService {
-  private readonly sousDir: string;
-
-  private readonly layerOptions: ManagedLayerOptions;
-
-  private readonly settings: Settings | undefined;
-
-  private readonly interactive: boolean;
-
-  private readonly ask: (message: string) => Promise<boolean>;
-
-  private readonly write: (message: string) => void;
-
-  private readonly now: () => Date;
-
-  constructor(options: TrustServiceOptions) {
-    this.sousDir = options.sousDir;
-    this.layerOptions = options.confDir === undefined ? {} : { confDir: options.confDir };
-    this.settings = options.settings;
-    this.interactive = options.interactive ?? isInteractive();
-    this.ask = options.ask ?? ((message: string) => askYesNo(message));
-    this.write = options.write ?? writeLine;
-    this.now = options.now ?? (() => new Date());
-  }
-
-  /**
-   * Every repository the project trusts, keyed by short name. This is the
-   * merged view: entries hand-written in the primary config and entries sous
-   * wrote into the managed layer both appear, because by the time settings are
-   * loaded they are one map.
-   *
-   * @param settings - The merged settings. Defaults to the ones given at construction.
-   */
-  listTrusted(settings: Settings | undefined = this.settings): Record<string, TrustedRepo> {
-    return { ...enabledRepos(settings) } as Record<string, TrustedRepo>;
-  }
-
-  /**
-   * True when the project trusts a repository by that name.
-   *
-   * @param repoName - The repository's short name.
-   * @param settings - The merged settings. Defaults to the ones given at construction.
-   */
-  isTrusted(repoName: string, settings: Settings | undefined = this.settings): boolean {
-    return Object.hasOwn(this.listTrusted(settings), repoName);
-  }
-
-  /** Every repository written in the managed layer, keyed by short name. */
-  listManaged(): Record<string, TrustedRepo> {
-    const layer = readManagedLayer(this.sousDir, REPOS_LAYER_FILENAME, this.layerOptions);
-    const repos = layer["repos"];
-    if (typeof repos !== "object" || repos === null || Array.isArray(repos)) return {};
-    return repos as Record<string, TrustedRepo>;
-  }
-
-  /**
-   * Adds a repository to the managed layer, which is what trusting one means.
-   * Adding a name that is already there replaces its entry, so this is also how
-   * a URL or a provider is corrected.
-   *
-   * @param request - The repository's name, URL and provenance.
-   */
-  addRepo(request: AddRepoRequest): TrustedRepo {
-    const entry: TrustedRepo = {
-      url: request.url,
-      ...(request.provider === undefined ? {} : { provider: request.provider }),
-      ...(request.alwaysPull === undefined ? {} : { alwaysPull: request.alwaysPull }),
-      addedAt: this.now().toISOString(),
-      addedBy: request.addedBy ?? USER_ADDED_BY,
-    };
-
-    updateManagedLayer(
-      this.sousDir,
-      REPOS_LAYER_FILENAME,
-      [{ path: ["repos", request.name], value: entry }],
-      this.layerOptions
-    );
-    return entry;
-  }
-
-  /**
-   * Removes a repository from the managed layer, withdrawing the trust. A
-   * repository written by hand in the primary config is not sous's to remove:
-   * that is an error saying so, since silently doing nothing would look like it
-   * worked.
-   *
-   * @param name - The repository's short name.
-   */
-  removeRepo(name: string): void {
-    const existing = this.listManaged();
-    if (!Object.hasOwn(existing, name)) {
-      if (this.isTrusted(name)) {
-        throw new ConfigError(
-          `The repository '${name}' is written in this project's own config, not in the ` +
-            `layer sous manages.\n` +
-            `  Remove its entry from the 'repos' block of your config file; sous never ` +
-            `edits a config file you wrote.`
-        );
-      }
-      throw new ConfigError(
-        `This project has no repository called '${name}'.\n` +
-          `  Run 'sous repo list' to see the repositories it trusts.`
-      );
-    }
-
-    updateManagedLayer(
-      this.sousDir,
-      REPOS_LAYER_FILENAME,
-      [{ path: ["repos", name], value: undefined }],
-      this.layerOptions
-    );
-  }
-
-  /**
-   * Switches a repository off without deleting an entry, which is how trust is
-   * withdrawn from the repository sous provides itself. That entry is recreated
-   * from the installed package on every run, so only a recorded `enabled: false`
-   * outlives it; the shape is the same one a person writes by hand to opt out.
-   *
-   * @param name - The repository's short name.
-   */
-  disableRepo(name: string): void {
-    updateManagedLayer(
-      this.sousDir,
-      REPOS_LAYER_FILENAME,
-      [{ path: ["repos", name], value: { enabled: false } }],
-      this.layerOptions
-    );
-  }
-
-  /**
-   * Asks about every repository a round of resolution turned up that the
-   * project has not added, in ONE consolidated question. Any refusal aborts,
-   * because a half-trusted install is not something sous will produce.
-   *
-   * @param missing - The repositories resolution says are needed.
-   * @param options - Whether sous may ask, and whether `--trust` was passed.
-   */
-  async confirmTrust(
-    missing: MissingRepo[],
-    options: ConfirmTrustOptions = {}
-  ): Promise<ConfirmTrustResult> {
-    if (missing.length === 0) return { accepted: [], added: [], needUrl: [] };
-
-    const interactive = options.interactive ?? this.interactive;
-    const trustFlag = options.trustFlag ?? false;
-
-    if (!trustFlag && !interactive) {
-      throw new NonInteractiveError(this.nonInteractiveMessage(missing));
-    }
-
-    if (!trustFlag) {
-      // The notice opens with a blank line of its own, so it never lands
-      // pressed up against whatever the command printed before it, wherever the
-      // ceremony runs from.
-      this.write(" ");
-      this.write(this.trustNotice(missing));
-      const plural = missing.length === 1 ? "this repository" : "these repositories";
-      const accepted = await this.ask(`Do you trust ${plural}?`);
-      if (!accepted) {
-        throw new ConfigError(
-          `Nothing was installed: trust was declined for ` +
-            `${missing.map((repo) => `'${repo.name}'`).join(", ")}.\n` +
-            `  Sous installs a dependency closure whole or not at all, so declining any ` +
-            `repository in it stops the whole install.`
-        );
-      }
-    }
-
-    const added: string[] = [];
-    const needUrl: string[] = [];
-    for (const repo of missing) {
-      if (repo.url === undefined) {
-        needUrl.push(repo.name);
-        continue;
-      }
-      // Every requester is recorded, not just the first. Removal hygiene reads
-      // this to say why a repository is there, and a repository three recipes
-      // need looks removable when the entry names only one of them.
-      const requesters = [
-        ...new Set(repo.requiredBy.map((entry) => entry.requestedBy)),
-      ].sort();
-      this.addRepo({
-        name: repo.name,
-        url: repo.url,
-        // A dependency's locator names the provider in its scheme, which is the
-        // one thing a URL alone cannot say for a self-hosted host.
-        ...(repo.provider === undefined ? {} : { provider: repo.provider as ProviderId }),
-        addedBy: requesters.length > 0 ? requesters.join(", ") : USER_ADDED_BY,
-      });
-      added.push(repo.name);
-    }
-
-    return { accepted: missing, added, needUrl };
-  }
-
-  /**
-   * The consolidated notice shown before the question: every new repository,
-   * its URL, the recipe that requires it, and what trusting it actually means.
-   *
-   * @param missing - The repositories being asked about.
-   */
-  trustNotice(missing: MissingRepo[]): string {
-    const width = wrapColumns() - 2;
-    const lines: string[] = [];
-    lines.push(
-      palette.warning(
-        missing.length === 1
-          ? "One repository has to be trusted before this can continue."
-          : `${missing.length} repositories have to be trusted before this can continue.`
-      )
-    );
-    lines.push(" ");
-
-    // Every repository is written as the same key and value block the rest of
-    // the CLI uses, so the facts under a repository name are read the same way
-    // as the facts anywhere else.
-    for (const repo of missing) {
-      lines.push(`  ${color.bold(repo.name)}`);
-
-      const entries: VariableEntry[] = [
-        {
-          label: "Location",
-          value:
-            repo.url === undefined
-              ? "not known to sous; a ref named it by its short name only"
-              : repo.url,
-        },
-        ...(repo.identity === undefined
-          ? []
-          : [{ label: "Identity", value: repo.identity }]),
-        ...repo.requiredBy.map((entry) => ({
-          label: "Required",
-          value: entry.ref,
-          detail: `required by ${
-            entry.requestedBy === "project" ? "this project" : `'${entry.requestedBy}'`
-          }`,
-        })),
-      ];
-      const labelWidth = Math.max(...entries.map((entry) => entry.label.length));
-      for (const entry of entries) {
-        lines.push(...formatVariable(entry, { labelWidth, width }));
-      }
-      lines.push(" ");
-    }
-
-    // The two phrases that carry the actual risk are highlighted in orange
-    // inside the yellow, so a reader skimming the block still takes in the part
-    // that matters.
-    const body = [
-      `Trusting a repository trusts ${palette.highlight(
-        "every namespace and every recipe"
-      )} in it, including ones published later. Trusting on its own executes ` +
-        `nothing; subscribing to something inside it ${palette.highlight(
-          "can, and probably will,"
-        )} run scripts on this machine. This question is the last gate before ` +
-        `that happens.`,
-      "",
-      "Sous cannot tell you whether a repository deserves trust. Look at the " +
-        "location above, and at who publishes it, before answering.",
-    ].join("\n");
-
-    for (const line of wrapText(body, width - 2)) {
-      lines.push(line === "" ? " " : `  ${palette.warning(line)}`);
-    }
-
-    // The block closes on a blank line, so the question that follows it stands
-    // on its own rather than reading as the last line of the notice.
-    lines.push(" ");
-    return lines.join("\n");
-  }
-
-  /**
-   * The error a non-interactive run gets: it names every repository needing
-   * trust and the exact command that grants it, because a script cannot answer
-   * a question.
-   *
-   * @param missing - The repositories being asked about.
-   */
-  private nonInteractiveMessage(missing: MissingRepo[]): string {
-    const lines: string[] = [
-      missing.length === 1
-        ? "One repository has to be trusted before this can continue, and sous is not " +
-          "running where it can ask."
-        : `${missing.length} repositories have to be trusted before this can continue, ` +
-          `and sous is not running where it can ask.`,
-      `  Why: ${nonInteractiveReason() ?? "there is no terminal to ask on"}.`,
-      "",
-    ];
-
-    for (const repo of missing) {
-      const provenance = repo.requiredBy
-        .map((entry) => `${entry.ref} (required by ${entry.requestedBy})`)
-        .join(", ");
-      lines.push(`  ${repo.name}: ${repo.url ?? "URL not known to sous"}`);
-      lines.push(`    ${provenance}`);
-    }
-
-    lines.push("");
-    lines.push("  Trusting a repository trusts every namespace and recipe in it, and");
-    lines.push("  subscribing to something inside it can run scripts on this machine.");
-    lines.push("  Add each repository deliberately, with its URL:");
-    lines.push("");
-    for (const repo of missing) {
-      lines.push(`    sous repo add ${repo.url ?? "<url>"} --name ${repo.name} --trust`);
-    }
-    lines.push("");
-    lines.push(
-      "  '--trust' is one spelling of the confirmation flag; '--yes', '-y' and"
-    );
-    lines.push("  '--force' mean exactly the same thing.");
-
-    return lines.join("\n");
-  }
-}
-
-/**
- * Writes a blank line and then a block of text, which is how the trust notice
- * reaches the console when nothing overrides it.
- *
- * @param message - The block to write.
- */
-export function writeTrustNotice(message: string): void {
-  blankLine();
-  writeLine(message);
-}

package/src/lib/repos/update-plan.ts

@@ -1,235 +0,0 @@
-/**
- * What an update is about to do, written out before it asks.
- *
- * `sous subscription update` (and `sous repo unlink --update`, which runs the
- * same code) works out the whole change first: which pins move, which
- * dependencies arrive or leave, which repositories a newer version needs that
- * the project does not trust yet, and which questions the new versions ask.
- * This module turns those facts into the lines printed above the one question.
- * It is pure: it formats what it is handed and decides nothing.
- */
-
-import type { LockDiff } from "./lock-service.js";
-import type { MissingRepo } from "./resolver.js";
-import { formatQuestionPlan, type PlannedVariable } from "../vars/index.js";
-import { BULLET, palette, wrapColumns, wrapText } from "../../utils/formatting.js";
-
-/** What an update narrowed itself to. */
-export type UpdateScope =
-  | { kind: "all" }
-  | { kind: "repository"; repo: string }
-  | { kind: "namespace"; repo: string; namespace: string }
-  | { kind: "recipe"; repo: string; key: string };
-
-/** Everything the plan says, gathered by the subscription service. */
-export type UpdatePlanFacts = {
-  /** What the update covers. */
-  scope: UpdateScope;
-  /** What would change in the lockfile. */
-  diff: LockDiff;
-  /** Repositories a newer version needs that the project does not trust yet. */
-  missingRepos: MissingRepo[];
-  /** The questions the new versions ask that nothing answers yet. */
-  questions: PlannedVariable[];
-  /** Recipes whose files are not on this machine and whose index does not record their questions. */
-  unreadable: string[];
-  /** Repositories whose index could not be fetched, so their pins stay where they are. */
-  unreachable: Array<{ repo: string; reason: string }>;
-  /** Linked repositories whose pins move, which builds keep bypassing. */
-  linked: string[];
-  /** Subscriptions sous provides itself, held at the version this sous ships. */
-  builtIn: Array<{ key: string; version?: string }>;
-  /** Switched-off subscriptions the update left alone. */
-  switchedOff: string[];
-  /** Subscriptions that could not be resolved, each with the reason. */
-  failed: Array<{ key: string; reason: string }>;
-};
-
-/**
- * The scope in words, for a sentence that has to say what was updated.
- *
- * describeUpdateScope({ kind: "repository", repo: "sous-recipes" })
- * // -> "the recipes this project takes from the repository 'sous-recipes'"
- *
- * @param scope - What the update covers.
- */
-export function describeUpdateScope(scope: UpdateScope): string {
-  switch (scope.kind) {
-    case "all":
-      return "every subscription in this project";
-    case "repository":
-      return `the recipes this project takes from the repository '${scope.repo}'`;
-    case "namespace":
-      return `the recipes in the namespace '${scope.repo}:${scope.namespace}'`;
-    case "recipe":
-      return `the recipe '${scope.repo}:${scope.key}'`;
-  }
-}
-
-/**
- * True when the plan has nothing to do: no pin moves, nothing arrives or
- * leaves, and no new repository is needed.
- *
- * @param facts - What the service worked out.
- */
-export function isEmptyUpdate(facts: Pick<UpdatePlanFacts, "diff" | "missingRepos">): boolean {
-  return facts.diff.unchanged && facts.missingRepos.length === 0;
-}
-
-/**
- * The plan, as lines ready to be indented and printed. Pin changes come first,
- * then the repositories that need trusting, then the questions, then the notes
- * about what the update deliberately left alone.
- *
- * @param facts - What the service worked out.
- * @param options - The width to wrap to, for tests.
- */
-export function formatUpdatePlan(
-  facts: UpdatePlanFacts,
-  options: { width?: number } = {}
-): string[] {
-  const width = (options.width ?? wrapColumns()) - 4;
-  const lines: string[] = [""];
-
-  /** One sentence, wrapped. */
-  const sentence = (text: string, paint = (line: string): string => line): string[] =>
-    wrapText(text, width).map(paint);
-
-  /** One bullet, wrapped so its continuation hangs under the text. */
-  const bullet = (text: string): string[] =>
-    wrapText(`  ${BULLET} ${text}`, width, { hangingIndent: 2 });
-
-  if (isEmptyUpdate(facts)) {
-    lines.push(
-      ...sentence(
-        `Nothing to update: every pin in ${describeUpdateScope(facts.scope)} is ` +
-          `already the newest published version its range allows.`
-      )
-    );
-  } else {
-    lines.push(...sentence(`Updating ${describeUpdateScope(facts.scope)} changes the lockfile:`));
-    lines.push("");
-    if (facts.diff.unchanged) {
-      lines.push(
-        ...bullet("No pin moves until the repositories below are trusted and read.")
-      );
-    } else {
-      for (const change of facts.diff.lines) lines.push(...bullet(change));
-    }
-  }
-
-  if (facts.missingRepos.length > 0) {
-    lines.push("");
-    lines.push(
-      ...sentence(
-        `A newer version needs ${
-          facts.missingRepos.length === 1 ? "a repository" : "repositories"
-        } this project ${palette.highlight("does not trust yet")}. You are asked about ` +
-          `each one by name before anything is fetched from it:`,
-        palette.warning
-      )
-    );
-    lines.push("");
-    for (const missing of facts.missingRepos) {
-      const where = missing.url === undefined ? "" : ` at ${missing.url}`;
-      const needers = missing.requiredBy.map((entry) => entry.requestedBy).join(", ");
-      lines.push(...bullet(`${missing.name}${where}, needed by ${needers}`));
-    }
-  }
-
-  if (facts.questions.length > 0 || facts.unreadable.length > 0) {
-    lines.push("");
-    lines.push(...sentence("Questions the new versions ask that nothing answers yet:"));
-    lines.push("");
-    for (const line of formatQuestionPlan(facts.questions, {
-      unreadable: facts.unreadable,
-      width,
-    })) {
-      lines.push(line === "" ? "" : `  ${line}`);
-    }
-  }
-
-  const notes: string[] = [];
-  if (facts.unreadable.length > 0) {
-    notes.push(
-      `A dry run downloads no recipe, so the dependencies of the versions not on this ` +
-        `machine yet, and not described by their index, are not shown: ` +
-        `${facts.unreadable.join(", ")}.`
-    );
-  }
-  for (const entry of facts.unreachable) {
-    notes.push(
-      `The index of '${entry.repo}' could not be fetched, so its pins stay where ` +
-        `they are. ${firstLine(entry.reason)}`
-    );
-  }
-  for (const entry of facts.failed) {
-    notes.push(
-      `The subscription to '${entry.key}' could not be resolved, so its pins stay ` +
-        `where they are. ${firstLine(entry.reason)}`
-    );
-  }
-  for (const repo of facts.linked) {
-    notes.push(
-      `The repository '${repo}' is linked to a working copy, so builds keep ` +
-        `reading that checkout until it is unlinked; the pins above take effect then.`
-    );
-  }
-  for (const entry of facts.builtIn) {
-    notes.push(
-      `The subscription to '${entry.key}' is one sous provides itself, and it stays ` +
-        `at ${
-          entry.version === undefined ? "the version" : `version ${entry.version}, the version`
-        } this installation of sous ships.`
-    );
-  }
-  if (facts.switchedOff.length > 0) {
-    notes.push(
-      `Switched off, so left alone: ${facts.switchedOff.join(", ")}.`
-    );
-  }
-
-  if (notes.length > 0) {
-    lines.push("");
-    for (const text of notes) {
-      lines.push(...wrapText(`${BULLET} ${text}`, width, { hangingIndent: 2 }).map(palette.note));
-    }
-  }
-
-  lines.push("");
-  return lines;
-}
-
-/**
- * The first line of a possibly multi-line reason, which is what fits in a note.
- *
- * @param text - The reason.
- */
-function firstLine(text: string): string {
-  return text.split("\n")[0]!.trim();
-}
-
-/**
- * True when an update of this scope may move a recipe, judged by the recipe's
- * key and the repository it comes from.
- *
- * recipeInScope({ kind: "namespace", repo: "r", namespace: "workflow" }, "workflow/x", "r")
- * // -> true
- *
- * @param scope - What the update covers.
- * @param key - The recipe key, `namespace/recipe`.
- * @param repo - The short name of the repository it comes from.
- */
-export function recipeInScope(scope: UpdateScope, key: string, repo: string): boolean {
-  switch (scope.kind) {
-    case "all":
-      return true;
-    case "repository":
-      return repo === scope.repo;
-    case "namespace":
-      return repo === scope.repo && key.startsWith(`${scope.namespace}/`);
-    case "recipe":
-      return repo === scope.repo && key === scope.key;
-  }
-}
-

package/src/lib/self-update/index.ts

@@ -1,14 +0,0 @@
-/**
- * The self-update layer: which copies of sous are installed, which version
- * each should move to, and the package manager command that moves it.
- *
- * Import from here rather than from the individual modules. Nothing exported
- * here installs anything; `run.ts`, imported on its own by `sous update`, is
- * the flow that runs the commands the plans name.
- */
-
-export * from "./versions.js";
-export * from "./registry.js";
-export * from "./managers.js";
-export * from "./installs.js";
-export * from "./plan.js";