@studio-foundation/cli 0.11.1 → 0.13.0

package/dist/registry/git-source.js

@@ -0,0 +1,92 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { mkdir, rm, rename, stat } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
+const run = promisify(execFile);
+/** How long an unpinned clone (a marketplace repo) is reused before refetching. */
+const HEAD_TTL_MS = 24 * 60 * 60 * 1000;
+function cacheRoot() {
+    return resolve(homedir(), '.cache', 'studio', 'git');
+}
+/** The commit `ref` points at upstream right now, peeling annotated tags. */
+async function remoteSha(url, ref) {
+    const { stdout } = await run('git', ['ls-remote', url, ref, `${ref}^{}`]);
+    const lines = stdout.trim().split('\n').filter(Boolean);
+    if (lines.length === 0)
+        return null;
+    const peeled = lines.find((l) => l.endsWith('^{}'));
+    return (peeled ?? lines[0]).split('\t')[0];
+}
+async function fetchPinned(url, ref, sha, dir) {
+    await mkdir(dir, { recursive: true });
+    await run('git', ['init', '-q', dir]);
+    await run('git', ['-C', dir, 'remote', 'add', 'origin', url]);
+    try {
+        await run('git', ['-C', dir, 'fetch', '-q', '--depth', '1', 'origin', sha]);
+    }
+    catch {
+        // Servers that refuse a by-sha fetch still serve the ref; the checkout below
+        // is what proves the sha is actually in what we got.
+        await run('git', ['-C', dir, 'fetch', '-q', '--depth', '1', 'origin', ref]);
+    }
+    await run('git', ['-C', dir, 'checkout', '-q', sha]);
+}
+/**
+ * Fetch a git-sourced package or marketplace and return the local directory.
+ *
+ * A pinned checkout is verified against its ref before anything is read: if the
+ * upstream tag or branch no longer points at the recorded commit, the entry has
+ * been changed under us and the install fails rather than resolving to either one.
+ */
+export async function materializeGit(target, root = cacheRoot()) {
+    if (target.sha) {
+        if (!target.ref)
+            throw new Error(`Git source for ${target.url} pins a sha but declares no ref.`);
+        const upstream = await remoteSha(target.url, target.ref);
+        if (!upstream) {
+            throw new Error(`Ref '${target.ref}' not found in ${target.url}.`);
+        }
+        if (upstream !== target.sha) {
+            throw new Error(`Pinned sha mismatch for ${target.url}: the entry pins ${target.sha}, ` +
+                `but '${target.ref}' now points at ${upstream}. Refusing to install.`);
+        }
+        const dir = resolve(root, target.sha);
+        if (existsSync(dir))
+            return dir;
+        const staging = `${dir}.partial`;
+        await rm(staging, { recursive: true, force: true });
+        try {
+            await fetchPinned(target.url, target.ref, target.sha, staging);
+            await rename(staging, dir);
+        }
+        catch (err) {
+            await rm(staging, { recursive: true, force: true });
+            throw err;
+        }
+        return dir;
+    }
+    const key = createHash('sha256').update(`${target.url}#${target.ref ?? ''}`).digest('hex').slice(0, 16);
+    const dir = resolve(root, `head-${key}`);
+    if (existsSync(dir)) {
+        const age = Date.now() - (await stat(dir)).mtimeMs;
+        if (age < HEAD_TTL_MS)
+            return dir;
+        await rm(dir, { recursive: true, force: true });
+    }
+    const staging = `${dir}.partial`;
+    await rm(staging, { recursive: true, force: true });
+    try {
+        const branch = target.ref ? ['--branch', target.ref] : [];
+        await run('git', ['clone', '-q', '--depth', '1', ...branch, target.url, staging]);
+        await rename(staging, dir);
+    }
+    catch (err) {
+        await rm(staging, { recursive: true, force: true });
+        throw err;
+    }
+    return dir;
+}
+//# sourceMappingURL=git-source.js.map

package/dist/registry/git-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-source.js","sourceRoot":"","sources":["../../src/registry/git-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,mFAAmF;AACnF,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAUxC,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,GAAW;IAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW,EAAE,GAAW;IAC3E,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,qDAAqD;QACrD,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAmB,EAAE,IAAI,GAAG,SAAS,EAAE;IAC1E,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,GAAG,kCAAkC,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,CAAC,GAAG,kBAAkB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,GAAG,oBAAoB,MAAM,CAAC,GAAG,IAAI;gBACvE,QAAQ,MAAM,CAAC,GAAG,mBAAmB,QAAQ,wBAAwB,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAEhC,MAAM,OAAO,GAAG,GAAG,GAAG,UAAU,CAAC;QACjC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACnD,IAAI,GAAG,GAAG,WAAW;YAAE,OAAO,GAAG,CAAC;QAClC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,GAAG,UAAU,CAAC;IACjC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/registry/legacy-paths.d.ts

@@ -0,0 +1,3 @@
+/** Paths relative to `.studio/`. Empty when the type is unknown. */
+export declare function legacyInstallPaths(name: string, type: string): string[];
+//# sourceMappingURL=legacy-paths.d.ts.map

package/dist/registry/legacy-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-paths.d.ts","sourceRoot":"","sources":["../../src/registry/legacy-paths.ts"],"names":[],"mappings":"AAuBA,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAKvE"}

package/dist/registry/legacy-paths.js

@@ -0,0 +1,31 @@
+/**
+ * Where a package installed by a pre-`files` CLI landed, so `remove` and `audit`
+ * still find it. Lockfiles written before ADR 0002 record one of the seven old
+ * package types and no file list; paths had to be derived from the type.
+ */
+const LEGACY_DIRS = {
+    tool: 'tools',
+    template: 'projects',
+    pipeline: 'pipelines',
+    integration: 'integrations',
+    agent: 'agents',
+    plugin: 'plugins',
+    skill: 'skills',
+};
+const LEGACY_EXTENSIONS = {
+    tool: '.tool.yaml',
+    pipeline: '.pipeline.yaml',
+    integration: '.integration.yaml',
+    agent: '.agent.yaml',
+    skill: '.skill.md',
+};
+/** Paths relative to `.studio/`. Empty when the type is unknown. */
+export function legacyInstallPaths(name, type) {
+    const dir = LEGACY_DIRS[type];
+    if (!dir)
+        return [];
+    if (type === 'template' || type === 'plugin')
+        return [`${dir}/${name}`];
+    return [`${dir}/${name}${LEGACY_EXTENSIONS[type] ?? '.yaml'}`];
+}
+//# sourceMappingURL=legacy-paths.js.map

package/dist/registry/legacy-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-paths.js","sourceRoot":"","sources":["../../src/registry/legacy-paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,GAA2B;IAC1C,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF,MAAM,iBAAiB,GAA2B;IAChD,IAAI,EAAE,YAAY;IAClB,QAAQ,EAAE,gBAAgB;IAC1B,WAAW,EAAE,mBAAmB;IAChC,KAAK,EAAE,aAAa;IACpB,KAAK,EAAE,WAAW;CACnB,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/registry/lockfile.d.ts

@@ -5,13 +5,17 @@ export declare class RegistryLockfile {
     constructor(studioDir: string);
     read(): Promise<Lockfile>;
     private write;
+    /**
+     * Dependents survive a reinstall: `--force` rewrites the payload fields, not the
+     * graph, so `studio registry update` can't orphan an entry it just refreshed.
+     */
     add(name: string, entry: LockfileEntry): Promise<void>;
     remove(name: string): Promise<void>;
     get(name: string): Promise<LockfileEntry | null>;
     list(): Promise<Array<{
         name: string;
     } & LockfileEntry>>;
-    addRequiredBy(name: string, requiredBy: string): Promise<void>;
+    addRequiredBy(name: string, requiredBy: string, range?: string): Promise<void>;
     removeRequiredBy(name: string, requiredBy: string): Promise<void>;
 }
 //# sourceMappingURL=lockfile.d.ts.map

package/dist/registry/lockfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/registry/lockfile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1D,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,EAAE,MAAM;IAKvB,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC;YASjB,KAAK;IAKb,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKhD,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,CAAC,CAAC;IAKxD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9D,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOxE"}
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/registry/lockfile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1D,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,EAAE,MAAM;IAKvB,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC;YASjB,KAAK;IAKnB;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAatD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKhD,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,CAAC,CAAC;IAKxD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAaxE"}

package/dist/registry/lockfile.js

@@ -20,9 +20,20 @@ export class RegistryLockfile {
         await mkdir(this.studioDir, { recursive: true });
         await writeFile(this.lockPath, JSON.stringify(data, null, 2) + '\n');
     }
+    /**
+     * Dependents survive a reinstall: `--force` rewrites the payload fields, not the
+     * graph, so `studio registry update` can't orphan an entry it just refreshed.
+     */
     async add(name, entry) {
         const data = await this.read();
-        data.installed[name] = entry;
+        const previous = data.installed[name];
+        const required_by = [...new Set([...(previous?.required_by ?? []), ...(entry.required_by ?? [])])];
+        const constraints = { ...previous?.constraints, ...entry.constraints };
+        data.installed[name] = {
+            ...entry,
+            required_by,
+            ...(Object.keys(constraints).length > 0 ? { constraints } : {}),
+        };
         await this.write(data);
     }
     async remove(name) {
@@ -38,23 +49,33 @@ export class RegistryLockfile {
         const data = await this.read();
         return Object.entries(data.installed).map(([name, entry]) => ({ name, ...entry }));
     }
-    async addRequiredBy(name, requiredBy) {
+    async addRequiredBy(name, requiredBy, range) {
         const data = await this.read();
         const entry = data.installed[name];
         if (!entry)
             return;
         const existing = entry.required_by ?? [];
-        if (!existing.includes(requiredBy)) {
-            data.installed[name] = { ...entry, required_by: [...existing, requiredBy] };
-            await this.write(data);
-        }
+        if (existing.includes(requiredBy) && entry.constraints?.[requiredBy] === range)
+            return;
+        data.installed[name] = {
+            ...entry,
+            required_by: existing.includes(requiredBy) ? existing : [...existing, requiredBy],
+            ...(range ? { constraints: { ...entry.constraints, [requiredBy]: range } } : {}),
+        };
+        await this.write(data);
     }
     async removeRequiredBy(name, requiredBy) {
         const data = await this.read();
         const entry = data.installed[name];
         if (!entry)
             return;
-        data.installed[name] = { ...entry, required_by: (entry.required_by ?? []).filter(r => r !== requiredBy) };
+        const constraints = { ...entry.constraints };
+        delete constraints[requiredBy];
+        data.installed[name] = {
+            ...entry,
+            required_by: (entry.required_by ?? []).filter(r => r !== requiredBy),
+            ...(Object.keys(constraints).length > 0 ? { constraints } : { constraints: undefined }),
+        };
         await this.write(data);
     }
 }

package/dist/registry/lockfile.js.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../src/registry/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,OAAO,gBAAgB;IACnB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE1B,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAc;QAChC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAoB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,UAAkB;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,UAAkB;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../src/registry/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,OAAO,gBAAgB;IACnB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE1B,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAc;QAChC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAoB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,MAAM,WAAW,GAAG,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YACrB,GAAG,KAAK;YACR,WAAW;YACX,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,UAAkB,EAAE,KAAc;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QACzC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK;YAAE,OAAO;QACvF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YACrB,GAAG,KAAK;YACR,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,UAAU,CAAC;YACjF,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,UAAkB;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,WAAW,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YACrB,GAAG,KAAK;YACR,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;SACxF,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;CACF"}

package/dist/registry/marketplaces.d.ts

@@ -0,0 +1,23 @@
+export interface Marketplace {
+    name: string;
+    url: string;
+}
+export declare const DEFAULT_MARKETPLACE_ENTRY: Marketplace;
+/**
+ * A marketplace is a property of the machine, not of a checkout: the same private
+ * marketplace serves every project on it, and a project must not be able to point
+ * its own installs at an unreviewed source.
+ */
+export declare function marketplacesPath(): string;
+/** The default marketplace first, then whatever the user registered. */
+export declare function loadMarketplaces(file?: string): Promise<Marketplace[]>;
+export declare function findMarketplace(name: string, file?: string): Promise<Marketplace>;
+export declare function addMarketplace(entry: Marketplace, file?: string): Promise<void>;
+export declare function removeMarketplace(name: string, file?: string): Promise<void>;
+/** `owner/repo` when the URL is a GitHub remote, else null — the raw/API fast path. */
+export declare function githubRepoOf(url: string): string | null;
+export declare function rawBaseOf(repo: string): string;
+export declare function apiBaseOf(repo: string): string;
+/** Default name for `studio marketplace add <url>`: the repository name. */
+export declare function marketplaceNameFromUrl(url: string): string;
+//# sourceMappingURL=marketplaces.d.ts.map

package/dist/registry/marketplaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplaces.d.ts","sourceRoot":"","sources":["../../src/registry/marketplaces.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,yBAAyB,EAAE,WAGvC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,wEAAwE;AACxE,wBAAsB,gBAAgB,CAAC,IAAI,SAAqB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAUxF;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAQvF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,SAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW9F;AAED,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGvD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK1D"}

package/dist/registry/marketplaces.js

@@ -0,0 +1,83 @@
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { DEFAULT_MARKETPLACE } from './dependency-spec.js';
+import { REGISTRY_REPO } from './types.js';
+export const DEFAULT_MARKETPLACE_ENTRY = {
+    name: DEFAULT_MARKETPLACE,
+    url: `https://github.com/${REGISTRY_REPO}.git`,
+};
+/**
+ * A marketplace is a property of the machine, not of a checkout: the same private
+ * marketplace serves every project on it, and a project must not be able to point
+ * its own installs at an unreviewed source.
+ */
+export function marketplacesPath() {
+    return resolve(homedir(), '.studio', 'marketplaces.json');
+}
+/** The default marketplace first, then whatever the user registered. */
+export async function loadMarketplaces(file = marketplacesPath()) {
+    let raw;
+    try {
+        raw = await readFile(file, 'utf8');
+    }
+    catch {
+        return [DEFAULT_MARKETPLACE_ENTRY];
+    }
+    const data = JSON.parse(raw);
+    const registered = (data.marketplaces ?? []).filter((m) => m.name !== DEFAULT_MARKETPLACE);
+    return [DEFAULT_MARKETPLACE_ENTRY, ...registered];
+}
+export async function findMarketplace(name, file) {
+    const found = (await loadMarketplaces(file)).find((m) => m.name === name);
+    if (!found) {
+        throw new Error(`Marketplace '${name}' is not registered. Run: studio marketplace add <url> --name ${name}`);
+    }
+    return found;
+}
+export async function addMarketplace(entry, file = marketplacesPath()) {
+    if (entry.name === DEFAULT_MARKETPLACE) {
+        throw new Error(`'${DEFAULT_MARKETPLACE}' is the default marketplace and is always available.`);
+    }
+    const existing = (await loadMarketplaces(file)).find((m) => m.name === entry.name);
+    if (existing && existing.url !== entry.url) {
+        throw new Error(`Marketplace '${entry.name}' is already registered as ${existing.url}. ` +
+            `Remove it first, or add this one under another name with --name.`);
+    }
+    const others = (await loadMarketplaces(file)).filter((m) => m.name !== DEFAULT_MARKETPLACE && m.name !== entry.name);
+    await mkdir(dirname(file), { recursive: true });
+    const data = { marketplaces: [...others, entry] };
+    await writeFile(file, JSON.stringify(data, null, 2) + '\n');
+}
+export async function removeMarketplace(name, file = marketplacesPath()) {
+    if (name === DEFAULT_MARKETPLACE) {
+        throw new Error(`'${DEFAULT_MARKETPLACE}' is the default marketplace and cannot be removed.`);
+    }
+    const registered = (await loadMarketplaces(file)).filter((m) => m.name !== DEFAULT_MARKETPLACE);
+    if (!registered.some((m) => m.name === name)) {
+        throw new Error(`Marketplace '${name}' is not registered.`);
+    }
+    await mkdir(dirname(file), { recursive: true });
+    const data = { marketplaces: registered.filter((m) => m.name !== name) };
+    await writeFile(file, JSON.stringify(data, null, 2) + '\n');
+}
+/** `owner/repo` when the URL is a GitHub remote, else null — the raw/API fast path. */
+export function githubRepoOf(url) {
+    const match = /^(?:https?:\/\/github\.com\/|git@github\.com:)([^/]+\/[^/]+?)(?:\.git)?\/?$/.exec(url.trim());
+    return match ? match[1] : null;
+}
+export function rawBaseOf(repo) {
+    return `https://raw.githubusercontent.com/${repo}/main`;
+}
+export function apiBaseOf(repo) {
+    return `https://api.github.com/repos/${repo}`;
+}
+/** Default name for `studio marketplace add <url>`: the repository name. */
+export function marketplaceNameFromUrl(url) {
+    const trimmed = url.trim().replace(/\/+$/, '').replace(/\.git$/, '');
+    const name = trimmed.slice(trimmed.lastIndexOf('/') + 1).trim();
+    if (!name)
+        throw new Error(`Cannot derive a marketplace name from '${url}' — pass --name.`);
+    return name;
+}
+//# sourceMappingURL=marketplaces.js.map

package/dist/registry/marketplaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplaces.js","sourceRoot":"","sources":["../../src/registry/marketplaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAO3C,MAAM,CAAC,MAAM,yBAAyB,GAAgB;IACpD,IAAI,EAAE,mBAAmB;IACzB,GAAG,EAAE,sBAAsB,aAAa,MAAM;CAC/C,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC5D,CAAC;AAMD,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAI,GAAG,gBAAgB,EAAE;IAC9D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;IAC3F,OAAO,CAAC,yBAAyB,EAAE,GAAG,UAAU,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAa;IAC/D,MAAM,KAAK,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,iEAAiE,IAAI,EAAE,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAkB,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAChF,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,IAAI,mBAAmB,uDAAuD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IACnF,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,CAAC,IAAI,8BAA8B,QAAQ,CAAC,GAAG,IAAI;YACxE,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAC/D,CAAC;IACF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAoB,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;IACnE,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAC7E,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,IAAI,mBAAmB,qDAAqD,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;IAChG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,sBAAsB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAoB,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;IAC1F,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,6EAA6E,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,qCAAqC,IAAI,OAAO,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,gCAAgC,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,kBAAkB,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/registry/registry-index.d.ts

@@ -0,0 +1,36 @@
+import { type Marketplace } from './marketplaces.js';
+import type { PackageEntry } from './types.js';
+/** An index entry knows which marketplace served it — names are unique per marketplace, not globally. */
+export interface IndexedPackage extends PackageEntry {
+    marketplace: string;
+}
+export interface MergedIndex {
+    packages: IndexedPackage[];
+    marketplaces: Marketplace[];
+}
+interface LoadOptions {
+    cacheDir?: string;
+    marketplacesFile?: string;
+    /** Stand in for an uncached default marketplace with the bundled snapshot. */
+    seed?: boolean;
+}
+/** Every registered marketplace's cached index, merged. Assumes `syncRegistry` ran. */
+export declare function loadMergedIndex(options?: LoadOptions): Promise<MergedIndex>;
+/**
+ * Every index entry for one package name, newest-first ordering left as published.
+ *
+ * An unqualified name that exists in more than one marketplace is an error, never
+ * a pick: which one wins would otherwise depend on registration order.
+ */
+export declare function candidatesFor(packages: IndexedPackage[], name: string, marketplace?: string): IndexedPackage[];
+export interface PackageRef {
+    marketplace?: string;
+    name: string;
+    version?: string;
+}
+/** A package as typed on the command line: `[marketplace:]name[@version]`. */
+export declare function parsePackageRef(raw: string): PackageRef;
+/** The index entry to install for `name[@version]`, or null when there is none. */
+export declare function entryFor(packages: IndexedPackage[], name: string, version?: string, marketplace?: string): IndexedPackage | null;
+export {};
+//# sourceMappingURL=registry-index.d.ts.map

package/dist/registry/registry-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-index.d.ts","sourceRoot":"","sources":["../../src/registry/registry-index.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,yGAAyG;AACzG,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,uFAAuF;AACvF,wBAAsB,eAAe,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAYrF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,cAAc,EAAE,EAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,GACnB,cAAc,EAAE,CAYlB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAUvD;AAED,mFAAmF;AACnF,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,cAAc,EAAE,EAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,cAAc,GAAG,IAAI,CAIvB"}

package/dist/registry/registry-index.js

@@ -0,0 +1,57 @@
+import { RegistryCache } from './cache.js';
+import { loadMarketplaces } from './marketplaces.js';
+import { DEFAULT_MARKETPLACE } from './dependency-spec.js';
+import { seedIndex } from './seed.js';
+/** Every registered marketplace's cached index, merged. Assumes `syncRegistry` ran. */
+export async function loadMergedIndex(options = {}) {
+    const marketplaces = await loadMarketplaces(options.marketplacesFile);
+    const packages = [];
+    for (const marketplace of marketplaces) {
+        // The snapshot only ever stands in for the marketplace it was bundled from,
+        // and only where an empty listing would be a failure rather than a fact.
+        const seeded = options.seed && marketplace.name === DEFAULT_MARKETPLACE ? seedIndex() : null;
+        const index = await new RegistryCache(options.cacheDir, marketplace.name).read() ?? seeded;
+        if (!index)
+            continue;
+        packages.push(...index.packages.map((p) => ({ ...p, marketplace: marketplace.name })));
+    }
+    return { packages, marketplaces };
+}
+/**
+ * Every index entry for one package name, newest-first ordering left as published.
+ *
+ * An unqualified name that exists in more than one marketplace is an error, never
+ * a pick: which one wins would otherwise depend on registration order.
+ */
+export function candidatesFor(packages, name, marketplace) {
+    const byName = packages.filter((p) => p.name === name);
+    if (marketplace)
+        return byName.filter((p) => p.marketplace === marketplace);
+    const owners = [...new Set(byName.map((p) => p.marketplace))];
+    if (owners.length > 1) {
+        throw new Error(`Package '${name}' exists in several marketplaces (${owners.join(', ')}). ` +
+            `Qualify it: ${owners.map((m) => `${m}:${name}`).join(' or ')}.`);
+    }
+    return byName;
+}
+/** A package as typed on the command line: `[marketplace:]name[@version]`. */
+export function parsePackageRef(raw) {
+    const trimmed = raw.trim();
+    const colon = trimmed.indexOf(':');
+    const marketplace = colon === -1 ? undefined : trimmed.slice(0, colon).trim();
+    const rest = colon === -1 ? trimmed : trimmed.slice(colon + 1).trim();
+    const [name, version] = rest.split('@');
+    if (!name)
+        throw new Error(`Invalid package name: '${raw}'`);
+    if (colon !== -1 && !marketplace)
+        throw new Error(`Invalid package name: '${raw}' — empty marketplace`);
+    return { marketplace, name, version: version || undefined };
+}
+/** The index entry to install for `name[@version]`, or null when there is none. */
+export function entryFor(packages, name, version, marketplace) {
+    const candidates = candidatesFor(packages, name, marketplace);
+    if (candidates.length === 0)
+        return null;
+    return (version && candidates.find((c) => c.version === version)) || candidates[0];
+}
+//# sourceMappingURL=registry-index.js.map

package/dist/registry/registry-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-index.js","sourceRoot":"","sources":["../../src/registry/registry-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAoBtC,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAuB,EAAE;IAC7D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,MAAM,KAAK,GAAG,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;QAC3F,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA0B,EAC1B,IAAY,EACZ,WAAoB;IAEpB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAC3E,eAAe,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,GAAG,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,uBAAuB,CAAC,CAAC;IACxG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,QAAQ,CACtB,QAA0B,EAC1B,IAAY,EACZ,OAAgB,EAChB,WAAoB;IAEpB,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/dist/registry/resolver.d.ts

@@ -1,13 +1,25 @@
-import type { PackageMetadata, PackageType, RegistryIndex, Lockfile } from './types.js';
+import type { PackageMetadata, PackageType, Lockfile } from './types.js';
+import { type Constraint } from './constraints.js';
+import { type IndexedPackage } from './registry-index.js';
 export interface DependencyNode {
     name: string;
+    marketplace: string;
     type: PackageType;
+    version: string;
+    /** Every range declared on this node, so the caller can record its own. */
+    constraints: Constraint[];
 }
 export interface ResolvedGraph {
     required: DependencyNode[];
     recommended: DependencyNode[];
 }
-type MetadataFetcher = (name: string) => Promise<PackageMetadata>;
-export declare function resolveDependencies(rootPackageName: string, meta: PackageMetadata, index: RegistryIndex, _lockfile: Lockfile, fetchMeta: MetadataFetcher): Promise<ResolvedGraph>;
+type MetadataFetcher = (name: string, marketplace: string) => Promise<PackageMetadata>;
+export interface ResolveOptions {
+    /** Marketplace of the package being resolved — where its unqualified deps resolve. */
+    marketplace: string;
+    /** Names of every registered marketplace. A dependency may name no other. */
+    registered: string[];
+}
+export declare function resolveDependencies(rootPackageName: string, meta: PackageMetadata, packages: IndexedPackage[], _lockfile: Lockfile, fetchMeta: MetadataFetcher, options: ResolveOptions): Promise<ResolvedGraph>;
 export {};
 //# sourceMappingURL=resolver.d.ts.map

package/dist/registry/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/registry/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAuB,MAAM,YAAY,CAAC;AAE7G,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAED,KAAK,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAuClE,wBAAsB,mBAAmB,CACvC,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,QAAQ,EACnB,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,aAAa,CAAC,CAgExB"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/registry/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAuB,MAAM,YAAY,CAAC;AAE9F,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAED,KAAK,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEvF,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAkCD,wBAAsB,mBAAmB,CACvC,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,cAAc,EAAE,EAC1B,SAAS,EAAE,QAAQ,EACnB,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAwExB"}