@superblocksteam/cli 2.0.124-next.0 → 2.0.124-next.1

package/dist/{chunk-3GQYYNTU.js → chunk-QG7DIXUV.js}

@@ -1,7 +1,7 @@
 if (typeof process === 'object' && process !== null &&
     process.env !== null && typeof process.env === 'object') {
   process.env.DD_GIT_REPOSITORY_URL = 'https://token@github.com/superblocksteam/superblocks.git';
-  process.env.DD_GIT_COMMIT_SHA = '82f752e9195056aa68c03b31b6678e601f98d863';
+  process.env.DD_GIT_COMMIT_SHA = 'a060d081eb056a54cd05156895abeff80af16285';
 }
 import { createRequire as $dd_createRequire } from 'module';
 import { fileURLToPath as $dd_fileURLToPath } from 'url';
@@ -22,7 +22,7 @@ import {
   require_re,
   require_semver,
   require_valid
-} from "./chunk-FI2KBYYW.js";
+} from "./chunk-5X2SP7MF.js";
 import {
   debounce_default,
   get_default,
@@ -39,23 +39,23 @@ import {
   require_lib,
   require_slugify,
   throttle_default
-} from "./chunk-CHCNUJBS.js";
+} from "./chunk-2OZBOBWN.js";
 import {
   require_dd_trace,
   require_js_yaml,
   require_module_details_from_path,
   require_p_limit,
   require_path_to_regexp
-} from "./chunk-VVIDGKBM.js";
+} from "./chunk-HLIMXBQU.js";
 import {
   require_commonjs
-} from "./chunk-QGKZQEHG.js";
+} from "./chunk-TEP5BJUV.js";
 import {
   require_dc_polyfill
-} from "./chunk-HBV3OFIW.js";
+} from "./chunk-MWZZHIX7.js";
 import {
   require_token_error
-} from "./chunk-UVFJBAOS.js";
+} from "./chunk-GOKHJJHO.js";
 import {
   SpanKind,
   SpanStatusCode,
@@ -65,7 +65,7 @@ import {
   init_esm,
   metrics,
   trace
-} from "./chunk-ZPKHY4TR.js";
+} from "./chunk-6CKMVZ5F.js";
 import {
   __commonJS,
   __esm,
@@ -74,7 +74,7 @@ import {
   __toCommonJS,
   __toESM,
   init_cjs_shims
-} from "./chunk-W6BSLSFB.js";
+} from "./chunk-VP5756W2.js";
 
 // ../../../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/internal/constants.js
 var require_constants3 = __commonJS({
@@ -42348,6 +42348,7 @@ var require_rbac = __commonJS({
       ResourceTypeEnum2["INTEGRATIONS_DEFAULT_AI"] = "integrations.default_ai";
       ResourceTypeEnum2["LOGS"] = "logs";
       ResourceTypeEnum2["LOGS_STREAMS"] = "logs.streams";
+      ResourceTypeEnum2["NPM_REGISTRY"] = "npm_registry";
       ResourceTypeEnum2["ORGANIZATION"] = "org";
       ResourceTypeEnum2["ORGANIZATION_USERS"] = "org.users";
       ResourceTypeEnum2["ORG_KNOWLEDGE"] = "org_knowledge";
@@ -42477,6 +42478,9 @@ var require_rbac = __commonJS({
         MANAGE: ActionTypeEnum.MANAGE,
         READ: ActionTypeEnum.READ
       },
+      NPM_REGISTRY: {
+        MANAGE: ActionTypeEnum.MANAGE
+      },
       SCHEDULED_JOBS: {
         CREATE: ActionTypeEnum.CREATE,
         DELETE: ActionTypeEnum.DELETE,
@@ -97014,15 +97018,15 @@ var require_api_files = __commonJS({
     exports.readAppApiYamlFile = readAppApiYamlFile4;
     exports.resolveLanguageSpecificStepContentFromBlocks = resolveLanguageSpecificStepContentFromBlocks2;
     async function writeApiFiles3(...args) {
-      const esmFunction = await import("./api-VHDFNHLS.js");
+      const esmFunction = await import("./api-TKEOZ34M.js");
       return esmFunction.writeApiFiles(...args);
     }
     async function readAppApiYamlFile4(...args) {
-      const esmFunction = await import("./api-VHDFNHLS.js");
+      const esmFunction = await import("./api-TKEOZ34M.js");
       return esmFunction.readAppApiYamlFile(...args);
     }
     async function resolveLanguageSpecificStepContentFromBlocks2(...args) {
-      const esmFunction = await import("./api-VHDFNHLS.js");
+      const esmFunction = await import("./api-TKEOZ34M.js");
       return esmFunction.resolveLanguageSpecificStepContentFromBlocks(...args);
     }
   }
@@ -103612,19 +103616,19 @@ var require_getMachineId = __commonJS({
       if (!getMachineIdImpl) {
         switch (process5.platform) {
           case "darwin":
-            getMachineIdImpl = (await import("./getMachineId-darwin-B5XTIQSJ.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-darwin-IXVLPABJ.js")).getMachineId;
             break;
           case "linux":
-            getMachineIdImpl = (await import("./getMachineId-linux-E5TSUEUB.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-linux-I3Z3YAG3.js")).getMachineId;
             break;
           case "freebsd":
-            getMachineIdImpl = (await import("./getMachineId-bsd-5OF7DQSS.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-bsd-5IGAYYFV.js")).getMachineId;
             break;
           case "win32":
-            getMachineIdImpl = (await import("./getMachineId-win-CVE4IXUV.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-win-VIYQDRGH.js")).getMachineId;
             break;
           default:
-            getMachineIdImpl = (await import("./getMachineId-unsupported-G5Q2YKAA.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-unsupported-Y3LDRJZ7.js")).getMachineId;
             break;
         }
       }
@@ -182582,8 +182586,8 @@ var require_get_vercel_oidc_token = __commonJS({
       }
       try {
         const [{ getTokenPayload, isExpired }, { refreshToken }] = await Promise.all([
-          await import("./token-util-DEC5MK7D.js"),
-          await import("./token-CHDYJV5Z.js")
+          await import("./token-util-PYLTI3A5.js"),
+          await import("./token-6NS57FJI.js")
         ]);
         if (!token2 || isExpired(getTokenPayload(token2))) {
           await refreshToken();
@@ -437970,7 +437974,7 @@ var require_config_loader = __commonJS({
        * @returns {Promise<{createJiti: Function|undefined, version: string;}>} A promise that fulfills with an object containing the jiti module's createJiti function and version.
        */
       static async loadJiti() {
-        const { createJiti } = await import("./jiti-FIVQTCZJ.js");
+        const { createJiti } = await import("./jiti-S6LC2ASV.js");
         const version4 = require_package5().version;
         return { createJiti, version: version4 };
       }
@@ -438299,7 +438303,7 @@ var require_eslint_helpers = __commonJS({
     }
     async function globMatch({ basePath, pattern }) {
       let found = false;
-      const { hfs } = await import("./src-6HTRCZ34.js");
+      const { hfs } = await import("./src-YLPWTEB6.js");
       const patternToUse = normalizeToPosix(path78.relative(basePath, pattern));
       const matcher = new Minimatch2(patternToUse, MINIMATCH_OPTIONS);
       const walkSettings = {
@@ -438339,7 +438343,7 @@ var require_eslint_helpers = __commonJS({
         return new Minimatch2(patternToUse, MINIMATCH_OPTIONS);
       });
       const unmatchedPatterns = /* @__PURE__ */ new Set([...relativeToPatterns.keys()]);
-      const { hfs } = await import("./src-6HTRCZ34.js");
+      const { hfs } = await import("./src-YLPWTEB6.js");
       const walk2 = hfs.walk(basePath, {
         async directoryFilter(entry) {
           if (!matchers.some((matcher) => matcher.match(entry.path, true))) {
@@ -494603,7 +494607,7 @@ init_cjs_shims();
 // ../sdk/package.json
 var package_default = {
   name: "@superblocksteam/sdk",
-  version: "2.0.124-next.0",
+  version: "2.0.124-next.1",
   description: "Superblocks JS SDK",
   homepage: "https://www.superblocks.com",
   license: "Superblocks Community Software License",
@@ -494965,7 +494969,7 @@ var config = void 0;
 var configured = false;
 var ddTracePromise = void 0;
 async function getDdTrace() {
-  ddTracePromise ??= import("./dd-trace-JWH4DKVT.js").then((module) => module.default);
+  ddTracePromise ??= import("./dd-trace-WJPWN54S.js").then((module) => module.default);
   return await ddTracePromise;
 }
 var deploymentType = (() => {
@@ -503430,6 +503434,28 @@ init_cjs_shims();
 // ../../../library-shared/dist/types/parent-messages.js
 init_cjs_shims();
 
+// ../../../library-shared/dist/types/protected-packages.js
+init_cjs_shims();
+var PROTECTED_PACKAGE_SCOPE = "@superblocksteam/";
+var PROTECTED_CORE_PACKAGES = [
+  "react",
+  "react-dom",
+  "react-router",
+  "react-router-dom",
+  "vite",
+  "typescript",
+  "@tailwindcss/vite",
+  "tailwindcss"
+];
+function packageNameFromSpec(spec) {
+  const at5 = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
+  return at5 === -1 ? spec : spec.slice(0, at5);
+}
+function isProtectedCorePackage(nameOrSpec) {
+  const name17 = packageNameFromSpec(nameOrSpec.trim());
+  return name17.startsWith(PROTECTED_PACKAGE_SCOPE) || PROTECTED_CORE_PACKAGES.includes(name17);
+}
+
 // ../../../library-shared/dist/types/routing.js
 init_cjs_shims();
 
@@ -520312,7 +520338,7 @@ var MAX_ATTRIBUTE_LENGTH = 64e3;
 var LLMObsSpanWriter = null;
 async function loadLLMObsSpanWriter() {
   if (!LLMObsSpanWriter) {
-    const module = await import("./spans-TQTQLIFS.js");
+    const module = await import("./spans-FS3FXI24.js");
     LLMObsSpanWriter = module.default;
   }
   return LLMObsSpanWriter;
@@ -545790,6 +545816,7 @@ function buildBlockedMessage(err) {
   const safeHost = err.registryHost ? sanitizeForAgentMessage(err.registryHost) : "";
   const host = safeHost ? ` (registry: ${safeHost})` : "";
   const packagesPhrase = err.packages.length > 0 ? err.packages.map((p3) => `\`${sanitizeForAgentMessage(p3)}\``).join(", ") : "the requested package";
+  const protectedCorePackageGuidance = err.packages.some((p3) => isProtectedCorePackage(p3)) ? ` One or more of these are core app dependencies (\`@superblocksteam/*\` packages, ${PROTECTED_CORE_PACKAGES.join(", ")}). Never suggest uninstalling, replacing, or refactoring the app away from a core dependency; an org admin must make it available in the registry.` : "";
   const hasRows = err.hasAnyRegistryConfigured !== false;
   const hostIsPublic = isPublicNpmHost(err.registryHost);
   const hostIsKnown = !!err.registryHost;
@@ -545800,12 +545827,12 @@ function buildBlockedMessage(err) {
       if (privateHostWithRows) {
         return {
           variant: "private_mirror_hint",
-          message: `The npm registry${host} returned 404 for ${packagesPhrase}. This may be a typo, an unpublished package, or a package that has not been mirrored into your private registry. Stop and confirm with the user before trying a different package \u2014 and if the package name is correct, an org admin may need to mirror it into your private registry.`
+          message: `The npm registry${host} returned 404 for ${packagesPhrase}. This may be a typo, an unpublished package, or a package that has not been mirrored into your private registry. Stop and confirm with the user before trying a different package \u2014 and if the package name is correct, an org admin may need to mirror it into your private registry.${protectedCorePackageGuidance}`
         };
       }
       return {
         variant: "default",
-        message: `The npm registry${host} returned 404 for ${packagesPhrase}. This may be a typo, an unpublished or renamed package, or \u2014 if a private registry is configured \u2014 a package that has not been mirrored. Stop and confirm with the user before trying a different package.`
+        message: `The npm registry${host} returned 404 for ${packagesPhrase}. This may be a typo, an unpublished or renamed package, or \u2014 if a private registry is configured \u2014 a package that has not been mirrored. Stop and confirm with the user before trying a different package.${protectedCorePackageGuidance}`
       };
     }
     case "registry_unreachable": {
@@ -594065,6 +594092,10 @@ var AppShell = (() => {
       }
     }
     async uninstallPackages(packages, options8) {
+      const protectedRequested = packages.filter((p3) => isProtectedCorePackage(p3));
+      if (protectedRequested.length > 0) {
+        throw new Error(`Refusing to uninstall protected core package(s): ${protectedRequested.join(", ")}. These are required by the Superblocks platform (dev server, build pipeline, or app runtime) and must remain in the app.`);
+      }
       return await this.withAuthFailedRetry(async (registryFetchResult) => {
         this.maybeShortCircuitForUnreachable(registryFetchResult, packages);
         const ignoreScripts = shouldIgnoreInstallScripts(registryFetchResult);
@@ -609553,7 +609584,7 @@ var PlaywrightMcpServerManager = class {
       this.logger.info(`Starting embedded Playwright MCP server: browser=${options8?.browser || "chromium"}, headless=${options8?.headless !== false}`);
     }
     try {
-      const { startEmbeddedPlaywrightMcpServer } = await import("./embedded-playwright-mcp-server-OD6TPDSE.js");
+      const { startEmbeddedPlaywrightMcpServer } = await import("./embedded-playwright-mcp-server-F7YUYHZB.js");
       this.server = await startEmbeddedPlaywrightMcpServer({
         storageStatePath: options8?.storageStatePath,
         jwt: options8?.jwt,
@@ -613335,7 +613366,8 @@ function buildRegistryPolicyParagraph(registryPolicy) {
 `;
   }
   if (registryPolicy.hasAnyRegistryConfigured) {
-    return `Your organization uses a private npm registry. Only packages available in that registry can be installed. If \`build_installPackages\` returns \`NpmInstallBlocked\` with reason \`not_in_registry\`, do not retry \u2014 explain to the user that the package isn't available and suggest they ask their org admin to add it.
+    const protectedPackagesPhrase = PROTECTED_CORE_PACKAGES.map((name17) => `\`${name17}\``).join(", ");
+    return `Your organization uses a private npm registry. Only packages available in that registry can be installed. If \`build_installPackages\` returns \`NpmInstallBlocked\` with reason \`not_in_registry\`, do not retry \u2014 explain to the user that the package isn't available and suggest they ask their org admin to add it. Never suggest uninstalling, replacing, or refactoring the app away from core dependencies \u2014 any \`@superblocksteam/*\` package, plus ${protectedPackagesPhrase}. If a core dependency is unavailable in the registry, the only fix is for an org admin to make it available there.
 
 `;
   }
@@ -615589,8 +615621,10 @@ async function installTemplateModulesImpl(dir, options8) {
   const detectionCwd = options8?.detectionCwd ?? process.cwd();
   const override = process.env[PM_OVERRIDE_ENV]?.trim();
   const fromOverride = override ? override : null;
-  const fromEnv = fromOverride ? null : getUserAgent();
-  const fromDetect = fromOverride || fromEnv ? null : (await detect({
+  const isCloudMode = !fromOverride && process.env.SUPERBLOCKS_SERVER_ENV !== "local";
+  const fromCloud = isCloudMode ? "npm" : null;
+  const fromEnv = fromOverride || fromCloud ? null : getUserAgent();
+  const fromDetect = fromOverride || fromCloud || fromEnv ? null : (await detect({
     strategies: [
       "packageManager-field",
       "lockfile",
@@ -615600,8 +615634,8 @@ async function installTemplateModulesImpl(dir, options8) {
     cwd: detectionCwd
   }))?.agent ?? null;
   const fallback = "npm";
-  const agent = fromOverride ?? fromEnv ?? fromDetect ?? fallback;
-  const source2 = fromOverride ? "override" : fromEnv ? "env" : fromDetect ? "detect" : "fallback";
+  const agent = fromOverride ?? fromCloud ?? fromEnv ?? fromDetect ?? fallback;
+  const source2 = fromOverride ? "override" : fromCloud ? "cloud" : fromEnv ? "env" : fromDetect ? "detect" : "fallback";
   getLogger3().info(`[ai-service] template-install: resolved package manager '${agent}' via ${source2}` + (source2 === "fallback" ? ` (no signal from $${PM_OVERRIDE_ENV}, $npm_config_user_agent, or detect(cwd=${detectionCwd}); set $${PM_OVERRIDE_ENV} to override)` : ""));
   const installCommand = resolveCommand(agent, "install", ["--ignore-scripts"]);
   if (!installCommand) {
@@ -616459,6 +616493,15 @@ var AiService = class extends import_shared48.TracedEventEmitter {
     if (!checklist) {
       return;
     }
+    const staleInProgressItems = checklist.items.filter((item) => API_MIGRATION_ORIGINS.has(item.origin) && item.status === "in_progress");
+    for (const item of staleInProgressItems) {
+      await updateChecklistItem({
+        appRootDirPath: this.appRootDirPath,
+        itemId: item.id,
+        status: "pending"
+      });
+      this.getLogger().info(`[ai-service] Reset stale in_progress item "${item.id}" to pending after restart`);
+    }
     const hasPendingSeedApi = checklist.items.some((item) => API_MIGRATION_ORIGINS.has(item.origin) && (item.status === "pending" || item.status === "in_progress"));
     if (hasPendingSeedApi) {
       this.appShell.setApiHandlerEnabled(false);
@@ -616698,11 +616741,19 @@ var AiService = class extends import_shared48.TracedEventEmitter {
     }
     return await response.json();
   }
-  async ensureAiQuotaAvailable(jwt2) {
+  /**
+   * Non-throwing AI quota check. Returns `{ allowed: true }` when the org is
+   * within its limit, and also when the check itself can't run (no JWT, or the
+   * quota endpoint errors) — callers fail open so a flaky quota service never
+   * blocks legitimate work. When the org is over limit, returns the reason and
+   * a user-facing message instead of throwing, so callers that don't surface
+   * exceptions (e.g. the background migration turn) can react.
+   */
+  async checkAiQuota(jwt2) {
     const token2 = jwt2 ?? this.getJwt();
     if (!token2) {
       this.getLogger().warn("[ai-service] No JWT available for quota check, skipping");
-      return;
+      return { allowed: true };
     }
     try {
       const quota = await this.callServer({
@@ -616712,13 +616763,18 @@ var AiService = class extends import_shared48.TracedEventEmitter {
       if (!quota.allowed) {
         const reason = quota.reason ?? "token_limit_exceeded";
         const message = reason === "trial_expired" ? "Your AI trial period has ended." : reason === "no_seat_assigned" ? "You don't have an AI Builder license assigned. Ask your admin to assign a license." : "Your organization has reached its AI usage limit.";
-        throw new Error(`${message} [reason:${reason}]`);
+        return { allowed: false, reason, message };
       }
+      return { allowed: true };
     } catch (error40) {
-      if (error40 instanceof Error && error40.message.includes("[reason:")) {
-        throw error40;
-      }
       this.getLogger().warn("[ai-service] Quota check failed, allowing request", getErrorMeta2(error40));
+      return { allowed: true };
+    }
+  }
+  async ensureAiQuotaAvailable(jwt2) {
+    const quota = await this.checkAiQuota(jwt2);
+    if (!quota.allowed) {
+      throw new Error(`${quota.message} [reason:${quota.reason}]`);
     }
   }
   /**
@@ -616759,11 +616815,16 @@ var AiService = class extends import_shared48.TracedEventEmitter {
       this.getLogger().warn("[ai-service] Migration checklist not found or unreadable; skipping translation turn");
       return { dispatched: false, reason: "checklist-unavailable" };
     }
-    const pendingSeedApiItems = checklist.items.filter((item) => API_MIGRATION_ORIGINS.has(item.origin) && item.status === "pending");
+    const pendingSeedApiItems = checklist.items.filter((item) => API_MIGRATION_ORIGINS.has(item.origin) && (item.status === "pending" || item.status === "in_progress"));
     const pendingSeedApiCount = pendingSeedApiItems.length;
     if (pendingSeedApiCount === 0) {
       return { dispatched: false, reason: "no-pending-items" };
     }
+    const quota = await this.checkAiQuota(request.jwt);
+    if (!quota.allowed) {
+      this.getLogger().warn("[ai-service] Skipping v2\u2192v3 migration turn \u2014 AI quota exceeded", { reason: quota.reason });
+      return { dispatched: false, reason: "quota-exceeded" };
+    }
     this.migrationTurnTriggered = true;
     this.appShell.setApiHandlerEnabled(false);
     this.getLogger().info(`[ai-service] Dispatching internal v2\u2192v3 migration turn for ${pendingSeedApiCount} API(s) (API VFS projection disabled, retryMode=${request.retryMode ?? "none"})`);
@@ -644575,7 +644636,7 @@ var parseYaml3;
 async function loadYaml(file2) {
   const content17 = await read_file_default(file2);
   if (!parseYaml3) {
-    ({ __parsePrettierYamlConfig: parseYaml3 } = await import("./yaml-PIU5OO2X.js"));
+    ({ __parsePrettierYamlConfig: parseYaml3 } = await import("./yaml-DVJHKKTB.js"));
   }
   try {
     return parseYaml3(content17);
@@ -649969,7 +650030,7 @@ function createParsersAndPrinters(modules) {
 }
 var estreePlugin = createParsersAndPrinters([
   {
-    importPlugin: () => import("./estree-F7YRBMH4.js"),
+    importPlugin: () => import("./estree-LMK7E6KO.js"),
     printers: ["estree", "estree-json"]
   }
 ]);
@@ -649993,11 +650054,11 @@ var languages = [
 ];
 var { parsers: parsers12, printers } = createParsersAndPrinters([
   {
-    importPlugin: () => import("./acorn-I7LW2FZG.js"),
+    importPlugin: () => import("./acorn-W53BUILS.js"),
     parsers: ["acorn", "espree"]
   },
   {
-    importPlugin: () => import("./angular-VTZIPRQU.js"),
+    importPlugin: () => import("./angular-W4XO7MNV.js"),
     parsers: [
       "__ng_action",
       "__ng_binding",
@@ -650006,7 +650067,7 @@ var { parsers: parsers12, printers } = createParsersAndPrinters([
     ]
   },
   {
-    importPlugin: () => import("./babel-2UVZQSYJ.js"),
+    importPlugin: () => import("./babel-PMKCT6KZ.js"),
     parsers: [
       "babel",
       "babel-flow",
@@ -650025,44 +650086,44 @@ var { parsers: parsers12, printers } = createParsersAndPrinters([
     ]
   },
   {
-    importPlugin: () => import("./flow-C6HMOQMX.js"),
+    importPlugin: () => import("./flow-TSB7BON7.js"),
     parsers: ["flow"]
   },
   {
-    importPlugin: () => import("./glimmer-PSKFK3H7.js"),
+    importPlugin: () => import("./glimmer-WBFZ3MWG.js"),
     parsers: ["glimmer"],
     printers: ["glimmer"]
   },
   {
-    importPlugin: () => import("./graphql-YJCYUY3C.js"),
+    importPlugin: () => import("./graphql-FHVMHT5G.js"),
     parsers: ["graphql"],
     printers: ["graphql"]
   },
   {
-    importPlugin: () => import("./html-NWFMJ2IC.js"),
+    importPlugin: () => import("./html-KGYCFQMD.js"),
     parsers: ["html", "angular", "vue", "lwc", "mjml"],
     printers: ["html"]
   },
   {
-    importPlugin: () => import("./markdown-GFSHWVVT.js"),
+    importPlugin: () => import("./markdown-5V3KY6HV.js"),
     parsers: ["markdown", "mdx", "remark"],
     printers: ["mdast"]
   },
   {
-    importPlugin: () => import("./meriyah-ULFR2VN4.js"),
+    importPlugin: () => import("./meriyah-STTGH33R.js"),
     parsers: ["meriyah"]
   },
   {
-    importPlugin: () => import("./postcss-PE32FW56.js"),
+    importPlugin: () => import("./postcss-WTZXTIRZ.js"),
     parsers: ["css", "less", "scss"],
     printers: ["postcss"]
   },
   {
-    importPlugin: () => import("./typescript-G2NIDHKU.js"),
+    importPlugin: () => import("./typescript-ISXUGB52.js"),
     parsers: ["typescript"]
   },
   {
-    importPlugin: () => import("./yaml-PIU5OO2X.js"),
+    importPlugin: () => import("./yaml-DVJHKKTB.js"),
     parsers: ["yaml"],
     printers: ["yaml"]
   }
@@ -652009,7 +652070,7 @@ function stripComments(source2) {
   stripped = stripped.replace(/(^|[^:])\/\/[^\n]*/g, "$1");
   return stripped;
 }
-function packageNameFromSpec(spec) {
+function packageNameFromSpec2(spec) {
   if (spec.length === 0)
     return null;
   if (spec === "." || spec === ".." || spec.startsWith("./") || spec.startsWith("../")) {
@@ -652048,7 +652109,7 @@ function extractImportedPackageNames(source2) {
       const spec = match2[1];
       if (spec === void 0)
         continue;
-      const pkg = packageNameFromSpec(spec);
+      const pkg = packageNameFromSpec2(spec);
       if (pkg !== null)
         specs.add(pkg);
     }
@@ -667206,12 +667267,48 @@ async function handleLockConflict(error40, lockSvc, span, logger21) {
 }
 async function readPkgJson(cwd) {
   try {
-    const { readPackage } = await import("./read-pkg-UY2WG3MO.js");
+    const { readPackage } = await import("./read-pkg-SRZXLX7H.js");
     return await readPackage({ cwd });
   } catch {
     return null;
   }
 }
+async function readPackageLock(cwd) {
+  try {
+    return await nodeFs.readFile(path77.join(cwd, "package-lock.json"), "utf8");
+  } catch {
+    return null;
+  }
+}
+function lockfileComparisonKey(raw) {
+  if (raw === null)
+    return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed?.packages && typeof parsed.packages === "object") {
+      for (const entry of Object.values(parsed.packages)) {
+        if (entry && typeof entry === "object") {
+          delete entry.resolved;
+        }
+      }
+    }
+    return JSON.stringify(parsed);
+  } catch {
+    return raw;
+  }
+}
+async function shouldValidatePrivateRegistryInstall(npmRegistryClient, logger21) {
+  if (!npmRegistryClient) {
+    return false;
+  }
+  try {
+    const result = await npmRegistryClient.getConfig();
+    return result.source === "configured" || result.source === "stale";
+  } catch (err) {
+    logger21.warn("Could not resolve npm registry config for startup install validation; preserving package snapshot decision", getErrorMeta(err));
+    return false;
+  }
+}
 async function normalizePackageJsonForNpm(cwd, logger21) {
   const packageJsonPath = path77.join(cwd, "package.json");
   let raw;
@@ -667715,10 +667812,12 @@ async function dev(options8) {
             if (!packageJsonBefore && packageJsonRequiresInstall) {
               logger21.info("package.json was created, installing packages\u2026");
             }
+            const npmRegistryClient = aiService?.getNpmRegistryClient();
             const forcePackageInstallRequested = !!options8.forcePackageInstall;
             let forcePackageInstall = forcePackageInstallRequested;
+            const privateRegistryRequiresInstallValidation = packageJsonAfter ? await shouldValidatePrivateRegistryInstall(npmRegistryClient, logger21) : false;
             if (forcePackageInstallRequested && hasPackageJsonSnapshotBeforeRestore) {
-              forcePackageInstall = packageJsonRequiresInstall;
+              forcePackageInstall = packageJsonRequiresInstall || privateRegistryRequiresInstallValidation;
             }
             logger21.info("Package install decision", {
               packageJsonBeforePresent: !!packageJsonBefore,
@@ -667727,6 +667826,7 @@ async function dev(options8) {
               packageJsonRequiresInstall,
               forcePackageInstall,
               forcePackageInstallRequested,
+              privateRegistryRequiresInstallValidation,
               upgradePromiseCount: upgradePromises.length,
               packageJsonSnapshotBefore: packageJsonSnapshotDiagnostic(packageJsonSnapshotBefore),
               packageJsonInstallBaselineSnapshot: packageJsonSnapshotDiagnostic(packageJsonInstallBaselineSnapshot),
@@ -667747,11 +667847,13 @@ async function dev(options8) {
                 logger21.error(`Background package upgrade failed [errorId=DEV_SERVER_BG_UPGRADE_FAILED applicationId=${installApplicationId} cwd=${cwd} upgradePromiseCount=${launchedUpgradeCount}]`, getErrorMeta(err));
               });
             }
-            if (packageJsonRequiresInstall || upgradePromises.length > 0 || forcePackageInstall) {
+            let packageLockBeforeInstall = null;
+            if (packageJsonRequiresInstall || upgradePromises.length > 0 || forcePackageInstall || privateRegistryRequiresInstallValidation) {
+              packageLockBeforeInstall = await readPackageLock(cwd);
               logger21.info("Starting package install in background\u2026");
               packageInstallPromise = tracer4.startActiveSpan("installPackages", async (span) => {
                 try {
-                  await installPackages(cwd, logger21, aiService?.getNpmRegistryClient());
+                  await installPackages(cwd, logger21, npmRegistryClient);
                 } finally {
                   span.end();
                 }
@@ -667770,7 +667872,8 @@ async function dev(options8) {
               logger21.info("package.json has not changed, skipping package installation");
             }
             const shouldUploadPackageState = hasPackageChanged || forcePackageInstall;
-            if (shouldUploadPackageState || uploadFirst) {
+            let shouldUploadAfterInstall = shouldUploadPackageState;
+            if (shouldUploadPackageState || uploadFirst || privateRegistryRequiresInstallValidation) {
               let skipStartupUploadForCliRestart = false;
               try {
                 await joinUpgradeThenInstall("before upload");
@@ -667782,7 +667885,10 @@ async function dev(options8) {
                   throw joinError;
                 }
               }
-              if (!skipStartupUploadForCliRestart) {
+              if (privateRegistryRequiresInstallValidation && !shouldUploadAfterInstall && lockfileComparisonKey(packageLockBeforeInstall) !== lockfileComparisonKey(await readPackageLock(cwd))) {
+                shouldUploadAfterInstall = true;
+              }
+              if (!skipStartupUploadForCliRestart && (shouldUploadAfterInstall || uploadFirst)) {
                 logger21.info(`Uploading local files to branch '${activeDbfsBranchName}' on server before starting`);
                 await tracer4.startActiveSpan("uploadFirstOrPackageChanged", async (span) => {
                   await syncService.uploadDirectory("cli:sdk");
@@ -668855,4 +668961,4 @@ serve-static/index.js:
 chokidar/esm/index.js:
   (*! chokidar - MIT License (c) 2012 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=chunk-3GQYYNTU.js.map
+//# sourceMappingURL=chunk-QG7DIXUV.js.map