@studio-foundation/cli 0.11.1 → 0.12.0

package/dist/registry/resolver.js

@@ -1,86 +1,96 @@
-/** Extract all dependency names (regardless of whether they're in the index) for cycle detection. */
-function depNames(deps, kind) {
-    const names = [];
-    for (const [, spec] of Object.entries(deps)) {
-        const arr = spec[kind] ?? [];
-        names.push(...arr);
+import { parseDependencySpec } from './dependency-spec.js';
+import { selectVersion } from './constraints.js';
+import { candidatesFor } from './registry-index.js';
+/** Parsed dependency entries of one kind, tagged with the category they came from. */
+function specsOf(deps, kind) {
+    const out = [];
+    for (const [category, entry] of Object.entries(deps)) {
+        const names = entry[kind] ?? [];
+        for (const raw of names) {
+            out.push({ spec: parseDependencySpec(raw), category });
+        }
     }
-    return names;
+    return out;
 }
-function flattenDeps(deps, kind, index, requiredBy) {
-    const nodes = [];
-    for (const [category, spec] of Object.entries(deps)) {
-        const names = spec[kind] ?? [];
-        for (const name of names) {
-            const entry = index.packages.find(p => p.name === name);
-            if (entry) {
-                nodes.push({ name, type: entry.type });
-            }
-            else if (kind === 'required') {
-                // Fail loud, before install: a required dep absent from the index would
-                // otherwise install "successfully" and then crash at run time.
-                throw new Error(`Missing required dependency '${name}' (${category}) of package '${requiredBy}': ` +
-                    `not found in the registry index. Run 'studio registry sync' or check the package name.`);
-            }
-            // A missing recommended dependency is optional — skipped, not fatal.
-        }
+/**
+ * Which marketplace a dependency resolves against: the one it names, or the
+ * dependent's own. A marketplace the user has not registered is refused rather
+ * than added silently — `studio marketplace add` is a deliberate act (ADR 0001).
+ */
+function marketplaceOf(spec, requiredBy, options) {
+    if (!spec.marketplace)
+        return options.marketplace;
+    if (!options.registered.includes(spec.marketplace)) {
+        throw new Error(`Dependency '${spec.raw}' of package '${requiredBy}' names marketplace ` +
+            `'${spec.marketplace}', which is not registered. Run: studio marketplace add <url> ` +
+            `--name ${spec.marketplace}`);
     }
-    return nodes;
+    return spec.marketplace;
 }
-export async function resolveDependencies(rootPackageName, meta, index, _lockfile, fetchMeta) {
-    const resolved = new Map();
+export async function resolveDependencies(rootPackageName, meta, packages, _lockfile, fetchMeta, options) {
+    const constraints = new Map();
+    const targets = new Map();
+    const order = [];
     const visiting = new Set();
-    // Track the root package so cycles back to it are detected
-    visiting.add(rootPackageName);
-    async function visit(name, pkgMeta) {
-        if (visiting.has(name)) {
-            throw new Error(`Circular dependency detected: ${name} is part of a cycle`);
-        }
-        if (resolved.has(name))
+    async function visit(name, marketplace, pkgMeta) {
+        if (!pkgMeta.dependencies)
             return;
-        visiting.add(name);
-        if (pkgMeta.dependencies) {
-            // Check for cycles on all required names (even those not in index)
-            for (const depName of depNames(pkgMeta.dependencies, 'required')) {
-                if (visiting.has(depName)) {
-                    throw new Error(`Circular dependency detected: ${depName} is part of a cycle`);
-                }
+        const selfKey = `${marketplace}:${name}`;
+        visiting.add(selfKey);
+        for (const { spec, category } of specsOf(pkgMeta.dependencies, 'required')) {
+            const depMarketplace = marketplaceOf(spec, name, { ...options, marketplace });
+            const key = `${depMarketplace}:${spec.name}`;
+            if (visiting.has(key)) {
+                throw new Error(`Circular dependency detected: ${spec.name} is part of a cycle`);
             }
-            const requiredNodes = flattenDeps(pkgMeta.dependencies, 'required', index, name);
-            for (const node of requiredNodes) {
-                if (!resolved.has(node.name)) {
-                    const subMeta = await fetchMeta(node.name);
-                    await visit(node.name, subMeta);
-                    if (!resolved.has(node.name)) {
-                        resolved.set(node.name, node);
-                    }
-                }
+            if (candidatesFor(packages, spec.name, depMarketplace).length === 0) {
+                // Fail loud, before install: a required dep absent from the index would
+                // otherwise install "successfully" and then crash at run time.
+                throw new Error(`Missing required dependency '${spec.name}' (${category}) of package '${name}': ` +
+                    `not found in marketplace '${depMarketplace}'. Run 'studio registry sync' or check the package name.`);
             }
-        }
-        visiting.delete(name);
-    }
-    if (meta.dependencies) {
-        // Check for cycles at the first level too (root → dep that cycles back to root)
-        for (const depName of depNames(meta.dependencies, 'required')) {
-            if (visiting.has(depName)) {
-                throw new Error(`Circular dependency detected: ${depName} is part of a cycle`);
+            const known = constraints.get(key);
+            if (known) {
+                known.push({ range: spec.range, requiredBy: name });
             }
-        }
-        const firstLevelRequired = flattenDeps(meta.dependencies, 'required', index, rootPackageName);
-        for (const node of firstLevelRequired) {
-            const subMeta = await fetchMeta(node.name);
-            await visit(node.name, subMeta);
-            if (!resolved.has(node.name)) {
-                resolved.set(node.name, node);
+            else {
+                constraints.set(key, [{ range: spec.range, requiredBy: name }]);
+                targets.set(key, { name: spec.name, marketplace: depMarketplace });
+                order.push(key);
+                await visit(spec.name, depMarketplace, await fetchMeta(spec.name, depMarketplace));
             }
         }
+        visiting.delete(selfKey);
+    }
+    await visit(rootPackageName, options.marketplace, meta);
+    const required = order.map((key) => {
+        const { name, marketplace } = targets.get(key);
+        const candidates = candidatesFor(packages, name, marketplace);
+        const nodeConstraints = constraints.get(key);
+        return {
+            name,
+            marketplace,
+            type: candidates[0].type,
+            version: selectVersion(name, nodeConstraints, candidates),
+            constraints: nodeConstraints,
+        };
+    });
+    const recommended = [];
+    for (const { spec } of meta.dependencies ? specsOf(meta.dependencies, 'recommended') : []) {
+        const depMarketplace = marketplaceOf(spec, rootPackageName, options);
+        const candidates = candidatesFor(packages, spec.name, depMarketplace);
+        // A missing recommended dependency is optional — skipped, not fatal.
+        if (candidates.length === 0)
+            continue;
+        const nodeConstraints = [{ range: spec.range, requiredBy: rootPackageName }];
+        recommended.push({
+            name: spec.name,
+            marketplace: depMarketplace,
+            type: candidates[0].type,
+            version: selectVersion(spec.name, nodeConstraints, candidates),
+            constraints: nodeConstraints,
+        });
     }
-    const recommended = meta.dependencies
-        ? flattenDeps(meta.dependencies, 'recommended', index, rootPackageName)
-        : [];
-    return {
-        required: Array.from(resolved.values()),
-        recommended,
-    };
+    return { required, recommended };
 }
 //# sourceMappingURL=resolver.js.map

package/dist/registry/resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/registry/resolver.ts"],"names":[],"mappings":"AAcA,qGAAqG;AACrG,SAAS,QAAQ,CAAC,IAAyB,EAAE,IAAgC;IAC3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAc,IAAiC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,IAAyB,EACzB,IAAgC,EAChC,KAAoB,EACpB,UAAkB;IAElB,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAc,IAAiC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACxD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAmB,EAAE,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,wEAAwE;gBACxE,+DAA+D;gBAC/D,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,MAAM,QAAQ,iBAAiB,UAAU,KAAK;oBAClF,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,qEAAqE;QACvE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,eAAuB,EACvB,IAAqB,EACrB,KAAoB,EACpB,SAAmB,EACnB,SAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE9B,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,OAAwB;QACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,qBAAqB,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAE/B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,mEAAmE;YACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBACjE,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,qBAAqB,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,gFAAgF;QAChF,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9D,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,qBAAqB,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,MAAM,kBAAkB,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QAC9F,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAqB,IAAI,CAAC,YAAY;QACrD,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,CAAC;QACvE,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/registry/resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAuB,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAmB,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAuB,MAAM,qBAAqB,CAAC;AAyBzE,sFAAsF;AACtF,SAAS,OAAO,CACd,IAAyB,EACzB,IAAgC;IAEhC,MAAM,GAAG,GAAsD,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAc,KAAkC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAoB,EAAE,UAAkB,EAAE,OAAuB;IACtF,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,GAAG,iBAAiB,UAAU,sBAAsB;YACxE,IAAI,IAAI,CAAC,WAAW,gEAAgE;YACpF,UAAU,IAAI,CAAC,WAAW,EAAE,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,eAAuB,EACvB,IAAqB,EACrB,QAA0B,EAC1B,SAAmB,EACnB,SAA0B,EAC1B,OAAuB;IAEvB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiD,CAAC;IACzE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,WAAmB,EAAE,OAAwB;QAC9E,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO;QAClC,MAAM,OAAO,GAAG,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEtB,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,GAAG,cAAc,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpE,wEAAwE;gBACxE,+DAA+D;gBAC/D,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,IAAI,MAAM,QAAQ,iBAAiB,IAAI,KAAK;oBACjF,6BAA6B,cAAc,0DAA0D,CACtG,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAqB,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACnD,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAChD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAC9C,OAAO;YACL,IAAI;YACJ,WAAW;YACX,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAmB;YACvC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC;YACzD,WAAW,EAAE,eAAe;SAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1F,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACtE,qEAAqE;QACrE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,MAAM,eAAe,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7E,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,cAAc;YAC3B,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAmB;YACvC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC;YAC9D,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC"}

package/dist/registry/seed.d.ts

@@ -0,0 +1,10 @@
+import type { RegistryIndex } from './types.js';
+export declare function seedIndex(): RegistryIndex | null;
+/** The seeded copy of one marketplace file, addressed as the registry addresses it. */
+export declare function seedFile(path: string): string | null;
+/** Every seeded file under `dir`, with paths relative to `dir`, sorted. */
+export declare function seedFiles(dir: string): Array<{
+    path: string;
+    content: string;
+}>;
+//# sourceMappingURL=seed.d.ts.map

package/dist/registry/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/registry/seed.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAUhD,wBAAgB,SAAS,IAAI,aAAa,GAAG,IAAI,CAGhD;AAED,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpD;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAM/E"}

package/dist/registry/seed.js

@@ -0,0 +1,25 @@
+import { BUNDLED_ASSETS } from '../generated/bundled-assets.js';
+/**
+ * The pre-fetched marketplace snapshot bundled with the CLI, used when the live
+ * registry is unreachable. It mirrors the marketplace layout verbatim, so every
+ * lookup is a path lookup — the kernel never names a package. Refresh it with
+ * `node scripts/refresh-seed.mjs`.
+ */
+const SEED_PREFIX = 'seed/';
+export function seedIndex() {
+    const raw = BUNDLED_ASSETS[`${SEED_PREFIX}index.json`];
+    return raw ? JSON.parse(raw) : null;
+}
+/** The seeded copy of one marketplace file, addressed as the registry addresses it. */
+export function seedFile(path) {
+    return BUNDLED_ASSETS[`${SEED_PREFIX}${path}`] ?? null;
+}
+/** Every seeded file under `dir`, with paths relative to `dir`, sorted. */
+export function seedFiles(dir) {
+    const prefix = `${SEED_PREFIX}${dir}/`;
+    return Object.keys(BUNDLED_ASSETS)
+        .filter((key) => key.startsWith(prefix))
+        .sort()
+        .map((key) => ({ path: key.slice(prefix.length), content: BUNDLED_ASSETS[key] }));
+}
+//# sourceMappingURL=seed.js.map

package/dist/registry/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/registry/seed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGhE;;;;;GAKG;AACH,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,WAAW,YAAY,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,cAAc,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC;AACzD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,GAAG,WAAW,GAAG,GAAG,GAAG,CAAC;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;SAC/B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACvC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC"}

package/dist/registry/types.d.ts

@@ -1,4 +1,35 @@
-export type PackageType = 'tool' | 'template' | 'pipeline' | 'integration' | 'agent' | 'plugin' | 'skill';
+/**
+ * Two packaging types, each defined by its install verb (ADR 0002). What used to
+ * be a type — tool, agent, skill… — is a content kind carried inside a plugin.
+ */
+export type PackageType = 'template' | 'plugin';
+/** What a plugin delivers into `.studio/`. */
+export type ContentKind = 'tool' | 'agent' | 'skill' | 'integration' | 'pipeline' | 'contract' | 'input';
+/** A plugin's declared contents, by kind. Search reads it; install verifies nothing against it. */
+export type PackageProvides = Partial<Record<`${ContentKind}s`, string[]>>;
+/**
+ * Where a package's payload lives: `path` is the package directory in the
+ * marketplace repo, never derived from `name` — the two may diverge. Payload
+ * filenames are discovered by listing that directory.
+ */
+export interface LocalSource {
+    type: 'local';
+    path: string;
+}
+/**
+ * A payload hosted outside the marketplace repo (ADR 0001). `sha` is the commit
+ * actually installed; `ref` is what it is checked against, so an upstream push
+ * that moves the tag fails the install instead of silently changing the payload.
+ */
+export interface GitSource {
+    type: 'git';
+    url: string;
+    /** Package directory inside the repo. Absent means the repository root. */
+    path?: string;
+    ref: string;
+    sha: string;
+}
+export type PackageSource = LocalSource | GitSource;
 export interface PackageEntry {
     name: string;
     type: PackageType;
@@ -9,13 +40,24 @@ export interface PackageEntry {
     tags: string[];
     studio_version: string | null;
     downloads: number;
+    provides?: PackageProvides;
+    source: PackageSource;
 }
 export interface RegistryIndex {
     generated_at: string;
     version: string;
     packages: PackageEntry[];
 }
+/**
+ * Every category resolves identically — by name, through the same index. `plugins`
+ * is the form ADR 0002 settles on; the others are the pre-migration spelling and
+ * keep working. Entries are `[marketplace:]name[@range]`.
+ */
 export interface PackageDependencies {
+    plugins?: {
+        required?: string[];
+        recommended?: string[];
+    };
     tools?: {
         required?: string[];
         recommended?: string[];
@@ -37,23 +79,40 @@ export interface PackageDependencies {
         recommended?: string[];
     };
 }
-export interface PackageMetadata extends PackageEntry {
+export interface PackageMetadata extends Omit<PackageEntry, 'source'> {
     requires_binaries?: string[];
     dependencies?: PackageDependencies;
 }
 export interface LockfileEntry {
+    /** `template` or `plugin`, or one of the pre-migration types on an older lockfile. */
+    type: string;
+    /** Marketplace it came from. Absent on entries written before marketplaces existed. */
+    marketplace?: string;
     version: string;
-    type: PackageType;
     installed_at: string;
     sha256: string;
+    /** What the package wrote, relative to `.studio/`. Absent on pre-migration entries. */
+    files?: string[];
     required_by?: string[];
+    /**
+     * Range declared by each dependent, e.g. `{ "software": ">=1.2.0" }`. Without it
+     * an update has no way to tell "newest" from "newest my dependents accept".
+     * Only dependents that declared a range appear.
+     */
+    constraints?: Record<string, string>;
 }
 export interface Lockfile {
     installed: Record<string, LockfileEntry>;
 }
-/** Where packages get installed relative to the project's .studio/ dir */
-export declare const INSTALL_DIRS: Record<PackageType, string>;
+/** Where each content kind lands, relative to the project's `.studio/` dir. */
+export declare const CONTENT_DIRS: Record<ContentKind, string>;
+/**
+ * Payload filename suffix → content kind. The suffix is the only thing that
+ * decides where a plugin's file lands; `provides` is a declaration, not authority.
+ */
+export declare const CONTENT_EXTENSIONS: Record<string, ContentKind>;
+export declare function contentKindOf(filename: string): ContentKind | null;
+/** Where an installed template's payload lands, relative to `.studio/`. */
+export declare const TEMPLATE_DIR = "projects";
 export declare const REGISTRY_REPO = "studio-foundation/studio-community";
-export declare const REGISTRY_RAW_BASE = "https://raw.githubusercontent.com/studio-foundation/studio-community/main";
-export declare const REGISTRY_API_BASE = "https://api.github.com/repos/studio-foundation/studio-community";
 //# sourceMappingURL=types.d.ts.map

package/dist/registry/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/registry/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,UAAU,GACV,UAAU,GACV,aAAa,GACb,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAM;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,MAAM,CAAC,EAAK;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,MAAM,CAAC,EAAK;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAED,0EAA0E;AAC1E,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAQpD,CAAC;AAEF,eAAO,MAAM,aAAa,uCAAuC,CAAC;AAClE,eAAO,MAAM,iBAAiB,8EAA4D,CAAC;AAC3F,eAAO,MAAM,iBAAiB,oEAAkD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/registry/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEhD,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzG,mGAAmG;AACnG,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,WAAW,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAI;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,KAAK,CAAC,EAAM;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,MAAM,CAAC,EAAK;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,MAAM,CAAC,EAAK;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC;IACnE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAED,+EAA+E;AAC/E,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAQpD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAQ1D,CAAC;AAEF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAKlE;AAED,2EAA2E;AAC3E,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,eAAO,MAAM,aAAa,uCAAuC,CAAC"}

package/dist/registry/types.js

@@ -1,14 +1,34 @@
-/** Where packages get installed relative to the project's .studio/ dir */
-export const INSTALL_DIRS = {
+/** Where each content kind lands, relative to the project's `.studio/` dir. */
+export const CONTENT_DIRS = {
     tool: 'tools',
-    template: 'projects',
-    pipeline: 'pipelines',
-    integration: 'integrations',
     agent: 'agents',
-    plugin: 'plugins',
     skill: 'skills',
+    integration: 'integrations',
+    pipeline: 'pipelines',
+    contract: 'contracts',
+    input: 'inputs',
+};
+/**
+ * Payload filename suffix → content kind. The suffix is the only thing that
+ * decides where a plugin's file lands; `provides` is a declaration, not authority.
+ */
+export const CONTENT_EXTENSIONS = {
+    '.tool.yaml': 'tool',
+    '.agent.yaml': 'agent',
+    '.skill.md': 'skill',
+    '.integration.yaml': 'integration',
+    '.pipeline.yaml': 'pipeline',
+    '.contract.yaml': 'contract',
+    '.input.yaml': 'input',
 };
+export function contentKindOf(filename) {
+    for (const [ext, kind] of Object.entries(CONTENT_EXTENSIONS)) {
+        if (filename.endsWith(ext))
+            return kind;
+    }
+    return null;
+}
+/** Where an installed template's payload lands, relative to `.studio/`. */
+export const TEMPLATE_DIR = 'projects';
 export const REGISTRY_REPO = 'studio-foundation/studio-community';
-export const REGISTRY_RAW_BASE = `https://raw.githubusercontent.com/${REGISTRY_REPO}/main`;
-export const REGISTRY_API_BASE = `https://api.github.com/repos/${REGISTRY_REPO}`;
 //# sourceMappingURL=types.js.map

package/dist/registry/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/registry/types.ts"],"names":[],"mappings":"AAoDA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAgC;IACvD,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,oCAAoC,CAAC;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qCAAqC,aAAa,OAAO,CAAC;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,gCAAgC,aAAa,EAAE,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/registry/types.ts"],"names":[],"mappings":"AAoGA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAgC;IACvD,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,cAAc;IAC3B,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgC;IAC7D,YAAY,EAAE,MAAM;IACpB,aAAa,EAAE,OAAO;IACtB,WAAW,EAAE,OAAO;IACpB,mBAAmB,EAAE,aAAa;IAClC,gBAAgB,EAAE,UAAU;IAC5B,gBAAgB,EAAE,UAAU;IAC5B,aAAa,EAAE,OAAO;CACvB,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7D,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC,MAAM,CAAC,MAAM,aAAa,GAAG,oCAAoC,CAAC"}

package/dist/registry/verify.d.ts

@@ -0,0 +1,15 @@
+import { type PackageProvides } from './types.js';
+import type { PayloadFile } from './client.js';
+export interface VerifiableEntry {
+    name: string;
+    license: string;
+    provides?: PackageProvides;
+}
+/**
+ * Assert a fetched payload against what its index entry claims. Only meaningful
+ * for sources hosted outside the marketplace repo, where review sees a URL and
+ * never the files (ADR 0001).
+ */
+export declare function verifyPayload(files: PayloadFile[], entry: VerifiableEntry): string[];
+export declare function assertPayload(files: PayloadFile[], entry: VerifiableEntry): void;
+//# sourceMappingURL=verify.d.ts.map

package/dist/registry/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/registry/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsE/C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE,CAKpF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAQhF"}

package/dist/registry/verify.js

@@ -0,0 +1,86 @@
+import { CONTENT_EXTENSIONS, contentKindOf } from './types.js';
+/**
+ * Enough of each license's text to tell it apart from the others. A payload may
+ * ship any wording it likes as long as it is the license the entry declares —
+ * the index says what users are agreeing to, and review only ever sees the index.
+ */
+const LICENSE_SIGNATURES = {
+    'MIT': /MIT License|Permission is hereby granted, free of charge/i,
+    'ISC': /ISC License|Permission to use, copy, modify, and\/or distribute/i,
+    'Apache-2.0': /Apache License[\s\S]{0,80}Version 2\.0/i,
+    'AGPL-3.0': /GNU AFFERO GENERAL PUBLIC LICENSE[\s\S]{0,80}Version 3/i,
+    'GPL-3.0': /GNU GENERAL PUBLIC LICENSE[\s\S]{0,80}Version 3/i,
+    'LGPL-3.0': /GNU LESSER GENERAL PUBLIC LICENSE[\s\S]{0,80}Version 3/i,
+    'MPL-2.0': /Mozilla Public License Version 2\.0/i,
+    'BSD-3-Clause': /Redistribution and use in source and binary forms[\s\S]*?Neither the name/i,
+    'BSD-2-Clause': /Redistribution and use in source and binary forms/i,
+};
+const LICENSE_FILE = /^LICEN[SC]E(\.[\w-]+)?$/i;
+function baseName(path) {
+    return path.slice(path.lastIndexOf('/') + 1);
+}
+/** `coder.agent.yaml` → `coder`, the name `provides` lists it under. */
+function payloadName(filename) {
+    for (const ext of Object.keys(CONTENT_EXTENSIONS)) {
+        if (filename.endsWith(ext))
+            return filename.slice(0, -ext.length);
+    }
+    return null;
+}
+function checkLicense(files, license) {
+    const file = files.find((f) => LICENSE_FILE.test(baseName(f.path)));
+    if (!file)
+        return [`declares license '${license}' but ships no LICENSE file`];
+    const spdx = license.replace(/-(only|or-later)$/, '');
+    const signature = LICENSE_SIGNATURES[spdx];
+    if (!signature)
+        return [];
+    return signature.test(file.content)
+        ? []
+        : [`ships a LICENSE file that is not '${license}'`];
+}
+function checkProvides(files, provides) {
+    const actual = {};
+    for (const file of files) {
+        const filename = baseName(file.path);
+        const kind = contentKindOf(filename);
+        const name = payloadName(filename);
+        if (!kind || !name)
+            continue;
+        (actual[`${kind}s`] ??= new Set()).add(name);
+    }
+    const problems = [];
+    for (const [kind, names] of Object.entries(provides)) {
+        for (const name of names ?? []) {
+            if (!actual[kind]?.has(name))
+                problems.push(`declares ${kind} '${name}', absent from the payload`);
+        }
+    }
+    for (const [kind, names] of Object.entries(actual)) {
+        const declared = new Set(provides[kind] ?? []);
+        for (const name of names) {
+            if (!declared.has(name))
+                problems.push(`ships undeclared ${kind.replace(/s$/, '')} '${name}'`);
+        }
+    }
+    return problems;
+}
+/**
+ * Assert a fetched payload against what its index entry claims. Only meaningful
+ * for sources hosted outside the marketplace repo, where review sees a URL and
+ * never the files (ADR 0001).
+ */
+export function verifyPayload(files, entry) {
+    return [
+        ...checkLicense(files, entry.license),
+        ...(entry.provides ? checkProvides(files, entry.provides) : []),
+    ];
+}
+export function assertPayload(files, entry) {
+    const problems = verifyPayload(files, entry);
+    if (problems.length > 0) {
+        throw new Error(`Package '${entry.name}' does not match its registry entry:\n` +
+            problems.map((p) => `  - ${p}`).join('\n'));
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/registry/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/registry/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAwB,MAAM,YAAY,CAAC;AAGrF;;;;GAIG;AACH,MAAM,kBAAkB,GAA2B;IACjD,KAAK,EAAE,2DAA2D;IAClE,KAAK,EAAE,kEAAkE;IACzE,YAAY,EAAE,yCAAyC;IACvD,UAAU,EAAE,yDAAyD;IACrE,SAAS,EAAE,kDAAkD;IAC7D,UAAU,EAAE,yDAAyD;IACrE,SAAS,EAAE,sCAAsC;IACjD,cAAc,EAAE,4EAA4E;IAC5F,cAAc,EAAE,oDAAoD;CACrE,CAAC;AAEF,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEhD,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,QAAgB;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB,EAAE,OAAe;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,qBAAqB,OAAO,6BAA6B,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QACjC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,qCAAqC,OAAO,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAoB,EAAE,QAAyB;IACpE,MAAM,MAAM,GAAgC,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,SAAS;QAC7B,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,IAAI,4BAA4B,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB,EAAE,KAAsB;IACxE,OAAO;QACL,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAoB,EAAE,KAAsB;IACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,IAAI,wCAAwC;YAC9D,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/upgrade.d.ts

@@ -0,0 +1,28 @@
+export declare const REPO = "studio-foundation/studio";
+/**
+ * How the running Studio got onto this machine. Only a standalone binary can be
+ * replaced in place — an npm install is owned by npm, and overwriting a file it
+ * tracks breaks the next `npm i -g`.
+ */
+export type Install = {
+    kind: 'binary';
+    path: string;
+} | {
+    kind: 'npm';
+};
+/**
+ * The npm install resolves through `cli/bin/studio.mjs`, which either runs under Node
+ * (JS build) or spawns the binary from a `@studio-foundation/cli-<platform>` package
+ * inside `node_modules`. Neither is ours to overwrite.
+ */
+export declare function detectInstall(execPath?: string): Install;
+/**
+ * The release asset suffix for this machine, or null when no binary ships for it.
+ * Mirrors the platform table in scripts/platforms.mjs.
+ */
+export declare function platformKey(platform?: string, arch?: string, isMusl?: () => boolean): string | null;
+export declare function assetName(platform: string): string;
+/** The sha256 listed for `asset` in a `sha256sum`-format manifest, or null. */
+export declare function checksumFor(manifest: string, asset: string): string | null;
+export declare function resolveLatestTag(fetchImpl?: typeof fetch): Promise<string>;
+//# sourceMappingURL=upgrade.d.ts.map

package/dist/upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../src/upgrade.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,IAAI,6BAA6B,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,GAAE,MAAyB,GAAG,OAAO,CAM1E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,GAAE,MAAyB,EACnC,IAAI,GAAE,MAAqB,EAC3B,MAAM,GAAE,MAAM,OAAsB,GACnC,MAAM,GAAG,IAAI,CAMf;AAYD,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM1E;AAED,wBAAsB,gBAAgB,CAAC,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvF"}

package/dist/upgrade.js

@@ -0,0 +1,64 @@
+import { existsSync } from 'node:fs';
+export const REPO = 'studio-foundation/studio';
+/**
+ * The npm install resolves through `cli/bin/studio.mjs`, which either runs under Node
+ * (JS build) or spawns the binary from a `@studio-foundation/cli-<platform>` package
+ * inside `node_modules`. Neither is ours to overwrite.
+ */
+export function detectInstall(execPath = process.execPath) {
+    const segments = execPath.split(/[/\\]/);
+    const name = segments[segments.length - 1];
+    if (name !== 'studio' && name !== 'studio.exe')
+        return { kind: 'npm' };
+    if (segments.includes('node_modules'))
+        return { kind: 'npm' };
+    return { kind: 'binary', path: execPath };
+}
+/**
+ * The release asset suffix for this machine, or null when no binary ships for it.
+ * Mirrors the platform table in scripts/platforms.mjs.
+ */
+export function platformKey(platform = process.platform, arch = process.arch, isMusl = muslDetected) {
+    if (arch !== 'x64' && arch !== 'arm64')
+        return null;
+    if (platform === 'darwin')
+        return `darwin-${arch}`;
+    if (platform === 'win32')
+        return arch === 'x64' ? 'win-x64' : null;
+    if (platform === 'linux')
+        return `linux-${arch}${isMusl() ? '-musl' : ''}`;
+    return null;
+}
+/**
+ * Positive musl detection — the loader file only exists on a musl system. Probing for
+ * glibc instead is what shipped the wrong binary to Fedora once, and `process.report`
+ * is not available inside the Bun-compiled binary this runs in.
+ */
+function muslDetected() {
+    const suffix = process.arch === 'arm64' ? 'aarch64' : 'x86_64';
+    return existsSync(`/lib/ld-musl-${suffix}.so.1`);
+}
+export function assetName(platform) {
+    return platform.startsWith('win-') ? `studio-${platform}.exe` : `studio-${platform}`;
+}
+/** The sha256 listed for `asset` in a `sha256sum`-format manifest, or null. */
+export function checksumFor(manifest, asset) {
+    for (const line of manifest.split('\n')) {
+        const [hash, name] = line.trim().split(/\s+/);
+        if (name === asset && hash)
+            return hash;
+    }
+    return null;
+}
+export async function resolveLatestTag(fetchImpl = fetch) {
+    const res = await fetchImpl(`https://api.github.com/repos/${REPO}/releases/latest`, {
+        headers: { accept: 'application/vnd.github+json' },
+    });
+    if (!res.ok)
+        throw new Error(`could not resolve the latest release (HTTP ${res.status})`);
+    const { tag_name: tag } = (await res.json());
+    if (!tag)
+        throw new Error('the latest release has no tag');
+    return tag;
+}
+//# sourceMappingURL=upgrade.js.map