@superblocksteam/sdk 2.0.123 → 2.0.124-next.1

package/dist/cli-replacement/install-packages.classify.test.mjs

@@ -0,0 +1,125 @@
+/**
+ * Failure-classification coverage for the dev-server startup `installPackages`
+ * (APPS-4450). When the verification install fails, `installPackages` no longer
+ * rethrows the raw `exec` rejection — it classifies the npm `--json` envelope
+ * into a structured `DependencyInstallError` and throws the
+ * `InitialInstallFailed` marker so the `dev()` catch can degrade by origin.
+ *
+ * Mirrors the mock style of the sibling `install-packages.npm-registry.test.mts`
+ * (stub `node:child_process`, `package-manager-detector`, `node:fs/promises`,
+ * and the logging module; hand a fake `NpmRegistryClient`). The one new wrinkle
+ * is the failure path: the promisified `exec` rejects with an error object that
+ * carries the ERESOLVE `--json` payload on `.stdout` and the npm error-code
+ * banner on `.stderr`, exactly as `util.promisify(child_process.exec)` does in
+ * production (it preserves stdout/stderr on the rejected error).
+ */
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+const execMock = vi.fn();
+const execFileMock = vi.fn();
+vi.mock("node:child_process", () => ({
+    default: { exec: execMock, execFile: execFileMock },
+    exec: execMock,
+    execFile: execFileMock,
+}));
+const detectMock = vi.fn();
+vi.mock("package-manager-detector/detect", () => ({
+    detect: (...args) => detectMock(...args),
+}));
+const resolveCommandMock = vi.fn();
+vi.mock("package-manager-detector", () => ({
+    resolveCommand: (...args) => resolveCommandMock(...args),
+}));
+vi.mock("node:fs/promises", () => ({
+    readFile: vi.fn(async () => "{}"),
+    writeFile: vi.fn(async () => undefined),
+    // `installPackages` ensures `<app>/.superblocks/logs` exists (npm's
+    // `logs-dir` target) before spawning the install; without this stub the
+    // real `mkdir` is undefined and throws before the exec mock, misclassifying
+    // the failure as `unknown`. Mirrors the sibling npm-registry test.
+    mkdir: vi.fn(async () => undefined),
+}));
+const mockLogger = {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+};
+vi.mock("../telemetry/logging.js", () => ({
+    getLogger: () => mockLogger,
+    getErrorMeta: (err) => ({
+        error: { kind: "Error", message: err instanceof Error ? err.message : "" },
+    }),
+}));
+function fakeRegistryClient(result) {
+    return {
+        getConfig: vi.fn(async () => typeof result === "function" ? result() : result),
+    };
+}
+function notConfigured() {
+    return { source: "not-configured", config: { configured: false } };
+}
+/**
+ * The ERESOLVE `--json` envelope npm writes to stdout when a peer-dependency
+ * conflict aborts the install. `util.promisify(exec)` rejects with an Error
+ * whose `.stdout` carries this body and whose `.stderr` carries the
+ * `npm error code ERESOLVE` banner — both preserved separately on the
+ * rejected error (the contract the classifier relies on).
+ */
+const ERESOLVE_JSON_STDOUT = JSON.stringify({
+    error: {
+        code: "ERESOLVE",
+        summary: "unable to resolve dependency tree",
+        detail: "Found: react@17.0.2\nCould not resolve dependency:\npeer react@^18.0.0 from @some/pkg@1.0.0",
+    },
+});
+const ERESOLVE_STDERR = [
+    "npm error code ERESOLVE",
+    "npm error ERESOLVE unable to resolve dependency tree",
+].join("\n");
+beforeAll(async () => {
+    await import("./dev.mjs");
+});
+beforeEach(() => {
+    vi.clearAllMocks();
+    detectMock.mockResolvedValue({
+        name: "npm",
+        agent: "npm",
+        version: "10.0.0",
+    });
+    resolveCommandMock.mockImplementation((_agent, _action, args) => ({
+        command: "npm",
+        args: ["install", ...args],
+    }));
+});
+describe("installPackages classifies install failures (APPS-4450)", () => {
+    it("throws InitialInstallFailed(dependency_conflict) on an ERESOLVE install", async () => {
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(notConfigured());
+        // Reject exactly the way `util.promisify(child_process.exec)` does: the
+        // rejected value is an Error with `.stdout` and `.stderr` preserved
+        // separately. The ERESOLVE `--json` body lives on `.stdout`.
+        execMock.mockImplementation((_cmd, _opts, cb) => {
+            const callback = (typeof _opts === "function" ? _opts : cb);
+            const err = Object.assign(new Error("Command failed: npm install --fund=false --audit=false"), {
+                stdout: ERESOLVE_JSON_STDOUT,
+                stderr: ERESOLVE_STDERR,
+                code: 1,
+            });
+            callback(err);
+        });
+        await expect(installPackages("/tmp/app", mockLogger, client)).rejects.toMatchObject({
+            name: "InitialInstallFailed",
+            serverError: {
+                category: "dependency_conflict",
+                npmErrorCode: "ERESOLVE",
+            },
+        });
+        // Guard against the mock being silently bypassed: if `dev.mjs` ever binds
+        // `exec` to the REAL `child_process.exec` (a module-scope capture before
+        // this file's mock is live), real npm runs against the missing `/tmp/app`
+        // and the classification quietly degrades to unknown/undefined. Asserting
+        // the stub fired turns that into an explicit failure instead. (APPS-4450)
+        expect(execMock).toHaveBeenCalledTimes(1);
+    });
+});
+//# sourceMappingURL=install-packages.classify.test.mjs.map

package/dist/cli-replacement/install-packages.classify.test.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-packages.classify.test.mjs","sourceRoot":"","sources":["../../src/cli-replacement/install-packages.classify.test.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAIzE,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACzB,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7B,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE;IACnD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAC,CAAC;AAEJ,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC3B,EAAE,CAAC,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;CACpD,CAAC,CAAC,CAAC;AAEJ,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACnC,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,cAAc,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;CACpE,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;IACjC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IACvC,oEAAoE;IACpE,wEAAwE;IACxE,4EAA4E;IAC5E,mEAAmE;IACnE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;CACpC,CAAC,CAAC,CAAC;AAEJ,MAAM,UAAU,GAAG;IACjB,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;IACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;IACb,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;IACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC;AAEF,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU;IAC3B,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;KAC3E,CAAC;CACH,CAAC,CAAC,CAAC;AAOJ,SAAS,kBAAkB,CACzB,MAAwE;IAExE,OAAO;QACL,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAC1B,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CACjD;KACsD,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC;IAC1C,KAAK,EAAE;QACL,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,mCAAmC;QAC5C,MAAM,EACJ,6FAA6F;KAChG;CACF,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACtB,yBAAyB;IACzB,sDAAsD;CACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,UAAU,CAAC,iBAAiB,CAAC;QAC3B,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,kBAAkB,CAAC,kBAAkB,CACnC,CAAC,MAAc,EAAE,OAAe,EAAE,IAAc,EAAE,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC;KAC3B,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,EAAE,CAAC,CAAC;QAEnD,wEAAwE;QACxE,oEAAoE;QACpE,6DAA6D;QAC7D,QAAQ,CAAC,kBAAkB,CACzB,CACE,IAAY,EACZ,KAAc,EACd,EAAwD,EACxD,EAAE;YACF,MAAM,QAAQ,GAAG,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAGjD,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CACvB,IAAI,KAAK,CAAC,wDAAwD,CAAC,EACnE;gBACE,MAAM,EAAE,oBAAoB;gBAC5B,MAAM,EAAE,eAAe;gBACvB,IAAI,EAAE,CAAC;aACR,CACF,CAAC;YACF,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;QAEF,MAAM,MAAM,CACV,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CACzD,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE;gBACX,QAAQ,EAAE,qBAAqB;gBAC/B,YAAY,EAAE,UAAU;aACzB;SACF,CAAC,CAAC;QAEH,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli-replacement/install-packages.npm-registry.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=install-packages.npm-registry.test.d.mts.map

package/dist/cli-replacement/install-packages.npm-registry.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-packages.npm-registry.test.d.mts","sourceRoot":"","sources":["../../src/cli-replacement/install-packages.npm-registry.test.mts"],"names":[],"mappings":""}

package/dist/cli-replacement/install-packages.npm-registry.test.mjs

@@ -0,0 +1,260 @@
+/**
+ * Argv-matrix coverage for the dev-server startup `installPackages` honoring
+ * the per-org `allow_install_scripts` policy (APPS-4251).
+ *
+ * Mirrors the structure of
+ * `packages/vite-plugin-file-sync/src/ai-service/app-interface/shell.npm-registry.test.ts`
+ * (the AppShell-side coverage): we stub `package-manager-detector`, capture
+ * the args handed to `resolveCommand`, drive a fake `NpmRegistryClient`, and
+ * assert whether `--ignore-scripts` made it onto the install argv.
+ *
+ * Why exercise this here rather than via the full `dev()` test surface:
+ * `installPackages` is the unit that picked up the new policy plumbing.
+ * Testing through `dev()` would need ~250 lines of mock setup unrelated to
+ * the policy decision, and the test would still be asserting the same
+ * `resolveCommand`-args invariant. The function is intentionally exported
+ * from `dev.mts` for this purpose.
+ */
+import { beforeAll, beforeEach, describe, expect, it, vi, } from "vitest";
+const execMock = vi.fn();
+const execFileMock = vi.fn();
+vi.mock("node:child_process", () => ({
+    default: { exec: execMock, execFile: execFileMock },
+    exec: execMock,
+    execFile: execFileMock,
+}));
+const detectMock = vi.fn();
+vi.mock("package-manager-detector/detect", () => ({
+    detect: (...args) => detectMock(...args),
+}));
+const resolveCommandMock = vi.fn();
+vi.mock("package-manager-detector", () => ({
+    resolveCommand: (...args) => resolveCommandMock(...args),
+}));
+vi.mock("node:fs/promises", () => ({
+    readFile: vi.fn(async () => "{}"),
+    writeFile: vi.fn(async () => undefined),
+    // `installPackages` ensures the `<app>/.superblocks/logs` dir exists
+    // before spawning the install (npm's `logs-dir` target).
+    mkdir: vi.fn(async () => undefined),
+}));
+const mockLogger = {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+};
+vi.mock("../telemetry/logging.js", () => ({
+    getLogger: () => mockLogger,
+    getErrorMeta: (err) => ({
+        error: { kind: "Error", message: err instanceof Error ? err.message : "" },
+    }),
+}));
+function fakeRegistryClient(result) {
+    return {
+        getConfig: vi.fn(async () => typeof result === "function" ? result() : result),
+        // The dev-server install path only calls `getConfig()`; the rest of the
+        // `NpmRegistryClient` surface (JWT refresh, cache TTL) is exercised by
+        // the vite-plugin-file-sync side. Casting through `unknown` lets us
+        // hand this minimal stub to a parameter typed `NpmRegistryClient`
+        // without dragging the full class into the test.
+    };
+}
+function notConfigured(allowInstallScripts) {
+    return {
+        source: "not-configured",
+        config: {
+            configured: false,
+            ...(allowInstallScripts !== undefined ? { allowInstallScripts } : {}),
+        },
+    };
+}
+// Pre-import `./dev.mjs` once so the heavy module-load cost (it transitively
+// pulls in `vite-plugin-file-sync/git-service`, `AiService`, etc.) is paid
+// outside any test's per-test timeout. Under turbo parallelism (CI runs the
+// `cli` unit-test job alongside ai-service-templates, cli, mcp-server, and
+// sdk in the same worker pool), the first dynamic `await import("./dev.mjs")`
+// inside a test was being CPU-starved past the default 5s testTimeout — the
+// test that owned the cold import then timed out, leaked its in-flight
+// `resolveCommand` call past the `beforeEach` `clearAllMocks`, and the *next*
+// test observed two recorded calls instead of one. Hoisting to `beforeAll`
+// keeps the per-test surface fast and order-independent. The repeated
+// `await import("./dev.mjs")` lines below remain as cheap cached lookups —
+// no behavioural change.
+beforeAll(async () => {
+    await import("./dev.mjs");
+});
+beforeEach(() => {
+    vi.clearAllMocks();
+    // Default: npm package manager, install resolves to a real command so we
+    // can read back the args the call site passed in.
+    detectMock.mockResolvedValue({
+        name: "npm",
+        agent: "npm",
+        version: "10.0.0",
+    });
+    resolveCommandMock.mockImplementation((_agent, _action, args) => ({
+        command: "npm",
+        args: ["install", ...args],
+    }));
+    execMock.mockImplementation((_cmd, _opts, cb) => {
+        if (typeof _opts === "function") {
+            _opts(null, {
+                stdout: "ok",
+            });
+        }
+        else if (cb) {
+            cb(null, { stdout: "ok" });
+        }
+    });
+});
+function getResolveCommandArgs() {
+    expect(resolveCommandMock).toHaveBeenCalledTimes(1);
+    const [, , args] = resolveCommandMock.mock.calls[0];
+    return args;
+}
+/** Pull the exec options (incl. `env`) out of the spawned subprocess
+ * call. We assert against the env-overlay because that is the mechanism
+ * userconfig pinning uses for npm AND pnpm (pnpm rejects `--userconfig=`
+ * as a CLI flag — pnpm/pnpm#6036). */
+function getExecOptions() {
+    const lastCall = execMock.mock.calls.at(-1);
+    return lastCall[1];
+}
+describe("installPackages honors allow_install_scripts policy", () => {
+    it("appends --ignore-scripts when allow_install_scripts === false", async () => {
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(notConfigured(false));
+        await installPackages("/tmp/app", mockLogger, client);
+        const args = getResolveCommandArgs();
+        expect(args).toContain("--ignore-scripts");
+        // Existing baseline npm flags must survive.
+        expect(args).toContain("--fund=false");
+        expect(args).toContain("--audit=false");
+    });
+    it("does NOT append --ignore-scripts when allow_install_scripts === true", async () => {
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(notConfigured(true));
+        await installPackages("/tmp/app", mockLogger, client);
+        expect(getResolveCommandArgs()).not.toContain("--ignore-scripts");
+    });
+    it("does NOT append --ignore-scripts when allow_install_scripts is unset", async () => {
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(notConfigured(undefined));
+        await installPackages("/tmp/app", mockLogger, client);
+        expect(getResolveCommandArgs()).not.toContain("--ignore-scripts");
+    });
+    it("does NOT append --ignore-scripts when no client is wired in (test/opt-out path)", async () => {
+        const { installPackages } = await import("./dev.mjs");
+        await installPackages("/tmp/app", mockLogger);
+        expect(getResolveCommandArgs()).not.toContain("--ignore-scripts");
+    });
+    it("swallows policy-resolution errors and proceeds without --ignore-scripts", async () => {
+        // A transient registry-endpoint outage with no cache must not abort the
+        // user's startup install. The client surfaces the throw; we log and
+        // fall back to "scripts allowed" (today's behaviour). The 404 /
+        // last-known-good preservation that prevents this in practice is
+        // covered by `npm-registry.test.ts` on the vite-plugin-file-sync side.
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(async () => {
+            throw new Error("registry endpoint unreachable");
+        });
+        await installPackages("/tmp/app", mockLogger, client);
+        expect(getResolveCommandArgs()).not.toContain("--ignore-scripts");
+        expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining("Could not resolve npm install-scripts policy"), expect.objectContaining({ error: expect.any(Object) }));
+    });
+    it("appends --ignore-scripts under pnpm too (no npm-only baseline flags)", async () => {
+        detectMock.mockResolvedValue({
+            name: "pnpm",
+            agent: "pnpm",
+            version: "9.0.0",
+        });
+        resolveCommandMock.mockImplementation((_agent, _action, args) => ({
+            command: "pnpm",
+            args: ["install", ...args],
+        }));
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(notConfigured(false));
+        await installPackages("/tmp/app", mockLogger, client);
+        const args = getResolveCommandArgs();
+        expect(args).toContain("--ignore-scripts");
+        expect(args).not.toContain("--fund=false");
+        expect(args).not.toContain("--audit=false");
+    });
+});
+// ---------------------------------------------------------------------------
+// Userconfig plumbing for the dev-server startup install.
+//
+// `installPackages` points npm/pnpm at the Superblocks-owned userconfig
+// (`~/.superblocks/npmrc`) so the user-app install resolves
+// `@superblocksteam/library`, `@superblocksteam/sdk-api`, and any private
+// scope through the same registry config the CLI auto-upgrade uses.
+//
+// The mechanism is the spawned subprocess env overlay (both
+// `NPM_CONFIG_USERCONFIG` and `PNPM_CONFIG_USERCONFIG`), not a CLI flag.
+// pnpm rejects `--userconfig=` (pnpm/pnpm#6036), and pnpm 11+ stopped
+// honouring the `npm_config_*` env vars — setting both forms covers
+// npm, pnpm <= 10, and pnpm 11+ uniformly.
+// `userconfig-env.integration.test.mts` in this directory exercises the
+// real npm + pnpm binaries to pin that contract.
+// ---------------------------------------------------------------------------
+const USERCONFIG_PATTERN = /[/\\]\.superblocks[/\\]npmrc$/;
+describe("installPackages userconfig env plumbing", () => {
+    it("sets both NPM_CONFIG_USERCONFIG and PNPM_CONFIG_USERCONFIG under npm", async () => {
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(notConfigured(undefined));
+        await installPackages("/tmp/app", mockLogger, client);
+        const opts = getExecOptions();
+        expect(opts.env?.NPM_CONFIG_USERCONFIG).toMatch(USERCONFIG_PATTERN);
+        expect(opts.env?.PNPM_CONFIG_USERCONFIG).toMatch(USERCONFIG_PATTERN);
+        // npm's debug log is routed into `<app>/.superblocks/logs` so a failed
+        // install in the live-edit pod leaves a collectable log.
+        expect(opts.env?.NPM_CONFIG_LOGS_DIR).toBe("/tmp/app/.superblocks/logs");
+        // Argv carries the baseline npm flags only — no --userconfig (pnpm
+        // would reject it; env is the mechanism instead).
+        const args = getResolveCommandArgs();
+        expect(args.some((a) => a.startsWith("--userconfig="))).toBe(false);
+        expect(args).toContain("--fund=false");
+        expect(args).toContain("--audit=false");
+    });
+    it("sets both NPM_CONFIG_USERCONFIG and PNPM_CONFIG_USERCONFIG under pnpm", async () => {
+        detectMock.mockResolvedValue({
+            name: "pnpm",
+            agent: "pnpm",
+            version: "11.0.0",
+        });
+        resolveCommandMock.mockImplementation((_agent, _action, args) => ({
+            command: "pnpm",
+            args: ["install", ...args],
+        }));
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(notConfigured(undefined));
+        await installPackages("/tmp/app", mockLogger, client);
+        const opts = getExecOptions();
+        expect(opts.env?.NPM_CONFIG_USERCONFIG).toMatch(USERCONFIG_PATTERN);
+        expect(opts.env?.PNPM_CONFIG_USERCONFIG).toMatch(USERCONFIG_PATTERN);
+        const args = getResolveCommandArgs();
+        expect(args.some((a) => a.startsWith("--userconfig="))).toBe(false);
+        expect(args).not.toContain("--audit=false");
+    });
+    it("sets the userconfig env alongside --ignore-scripts when policy is restrictive", async () => {
+        // The install-scripts policy gate (argv) and the userconfig pin
+        // (env) are independent knobs that must co-exist.
+        const { installPackages } = await import("./dev.mjs");
+        const client = fakeRegistryClient(notConfigured(false));
+        await installPackages("/tmp/app", mockLogger, client);
+        const args = getResolveCommandArgs();
+        expect(args).toContain("--ignore-scripts");
+        const opts = getExecOptions();
+        expect(opts.env?.NPM_CONFIG_USERCONFIG).toMatch(USERCONFIG_PATTERN);
+        expect(opts.env?.PNPM_CONFIG_USERCONFIG).toMatch(USERCONFIG_PATTERN);
+    });
+    // PATH-preservation coverage lives in two places that don't trip the
+    // turbo `no-undeclared-env-vars` lint:
+    //   - `buildInstallEnv`'s "accepts a custom base env" test verifies
+    //     the merge semantics directly without referencing `process.env`.
+    //   - The real-subprocess integration test
+    //     (`userconfig-env.integration.test.mts`) would fail to resolve
+    //     `npm`/`pnpm` on PATH if the overlay clobbered it.
+});
+//# sourceMappingURL=install-packages.npm-registry.test.mjs.map

package/dist/cli-replacement/install-packages.npm-registry.test.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-packages.npm-registry.test.mjs","sourceRoot":"","sources":["../../src/cli-replacement/install-packages.npm-registry.test.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,SAAS,EACT,UAAU,EACV,QAAQ,EACR,MAAM,EACN,EAAE,EACF,EAAE,GAEH,MAAM,QAAQ,CAAC;AAIhB,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACzB,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7B,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE;IACnD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,YAAY;CACvB,CAAC,CAAC,CAAC;AAEJ,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC3B,EAAE,CAAC,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;CACpD,CAAC,CAAC,CAAC;AAEJ,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACnC,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,cAAc,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;CACpE,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;IACjC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IACvC,qEAAqE;IACrE,yDAAyD;IACzD,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;CACpC,CAAC,CAAC,CAAC;AAEJ,MAAM,UAAU,GAAG;IACjB,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;IACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;IACb,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;IACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC;AAEF,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU;IAC3B,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;KAC3E,CAAC;CACH,CAAC,CAAC,CAAC;AAUJ,SAAS,kBAAkB,CACzB,MAAwE;IAExE,OAAO;QACL,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAC1B,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CACjD;QACD,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,kEAAkE;QAClE,iDAAiD;KACM,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,mBAA6B;IAClD,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE;YACN,UAAU,EAAE,KAAK;YACjB,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,yBAAyB;AACzB,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,yEAAyE;IACzE,kDAAkD;IAClD,UAAU,CAAC,iBAAiB,CAAC;QAC3B,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,kBAAkB,CAAC,kBAAkB,CACnC,CAAC,MAAc,EAAE,OAAe,EAAE,IAAc,EAAE,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC;KAC3B,CAAC,CACH,CAAC;IACF,QAAQ,CAAC,kBAAkB,CACzB,CACE,IAAY,EACZ,KAAc,EACd,EAAoD,EACpD,EAAE;QACF,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAC/B,KAAyD,CAAC,IAAI,EAAE;gBAC/D,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,EAAE,CAAC;YACd,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,SAAS,qBAAqB;IAC5B,MAAM,CAAC,kBAAkB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,AAAD,EAAG,IAAI,CAAC,GAAI,kBAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAI3D,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;sCAGsC;AACtC,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAI,QAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAInD,CAAC;IACF,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QAExD,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,4CAA4C;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvD,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5D,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAEtD,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,CAAC,CAAC;QAEvD,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,wEAAwE;QACxE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,uEAAuE;QACvE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,IAAI,EAAE;YAC3C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAClE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAC1C,MAAM,CAAC,gBAAgB,CAAC,8CAA8C,CAAC,EACvE,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,UAAU,CAAC,iBAAiB,CAAC;YAC3B,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,kBAAkB,CAAC,kBAAkB,CACnC,CAAC,MAAc,EAAE,OAAe,EAAE,IAAc,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC;SAC3B,CAAC,CACH,CAAC;QACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QAExD,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,wEAAwE;AACxE,4DAA4D;AAC5D,0EAA0E;AAC1E,oEAAoE;AACpE,EAAE;AACF,4DAA4D;AAC5D,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,2CAA2C;AAC3C,wEAAwE;AACxE,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5D,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrE,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzE,mEAAmE;QACnE,kDAAkD;QAClD,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,UAAU,CAAC,iBAAiB,CAAC;YAC3B,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,kBAAkB,CAAC,kBAAkB,CACnC,CAAC,MAAc,EAAE,OAAe,EAAE,IAAc,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC;SAC3B,CAAC,CACH,CAAC;QACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5D,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,gEAAgE;QAChE,kDAAkD;QAClD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QAExD,MAAM,eAAe,CAAC,UAAU,EAAE,UAAmB,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,uCAAuC;IACvC,oEAAoE;IACpE,sEAAsE;IACtE,2CAA2C;IAC3C,oEAAoE;IACpE,wDAAwD;AAC1D,CAAC,CAAC,CAAC"}

package/dist/cli-replacement/post-upgrade-lockfile-strip.d.mts

@@ -0,0 +1,58 @@
+/**
+ * Post-CLI-upgrade lockfile normalization for the dev-server pod's globally
+ * installed Superblocks CLI.
+ *
+ * npm honors `resolved` URLs verbatim, so a tarball whose bundled lockfile
+ * entries point at `registry.npmjs.org` keeps fetching from public npm even
+ * after we've written a private `.npmrc`. This module strips those URLs
+ * post-upgrade so subsequent installs re-resolve through the active registry.
+ *
+ * The walk from the resolved `superblocks` binary up to the CLI package root
+ * is bounded so a misconfigured layout can never mutate arbitrary lockfiles
+ * on the filesystem.
+ *
+ * All failures are logged and swallowed — a failed post-strip must not crash
+ * the pod after a working upgrade. The next dev startup repeats the strip
+ * idempotently.
+ */
+import { type Logger } from "../telemetry/logging.js";
+/**
+ * Injectable subset of `child_process.exec` so tests can stub the
+ * `which`/`where` lookup without spawning a real subprocess.
+ */
+export type WhichRunner = (binary: string) => Promise<string>;
+/**
+ * Discovers the absolute path of the `@superblocksteam/cli` install root
+ * (the directory containing the CLI's `package.json`), or returns `undefined`
+ * if discovery fails. Discovery failures are non-fatal — the caller logs and
+ * skips the strip rather than aborting.
+ */
+export declare function findGlobalCliInstallDir(logger: Logger, whichRunner?: WhichRunner): Promise<string | undefined>;
+export interface StripUpgradedCliLockfilesOptions {
+    /**
+     * Pre-resolved install root. If omitted, `findGlobalCliInstallDir` is used.
+     * Tests pass this directly to avoid stubbing `which`.
+     */
+    installDir?: string;
+    whichRunner?: WhichRunner;
+    /**
+     * Override the strip timeout (ms). Tests use a tight value to exercise the
+     * timeout branch without sleeping for the real bound.
+     */
+    timeoutMs?: number;
+}
+/**
+ * Strips public-host `resolved` URLs from every lockfile under the global
+ * CLI install that the auto-upgrade could have refreshed. Returns the
+ * resolved install root on success, or `undefined` when discovery failed.
+ *
+ * Non-fatal: every individual strip already swallows lockfile-level errors
+ * (logged in `stripResolvedFromLockfilePath`); this wrapper additionally
+ * swallows discovery failures and any unexpected throw from the inner
+ * helpers so a successful upgrade is never demoted to a crash by a post-step
+ * problem.
+ */
+export declare function stripUpgradedCliLockfiles(logger: Logger, options?: StripUpgradedCliLockfilesOptions): Promise<{
+    installDir?: string;
+}>;
+//# sourceMappingURL=post-upgrade-lockfile-strip.d.mts.map

package/dist/cli-replacement/post-upgrade-lockfile-strip.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-upgrade-lockfile-strip.d.mts","sourceRoot":"","sources":["../../src/cli-replacement/post-upgrade-lockfile-strip.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAoCpE;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAQ9D;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,WAAW,GAAE,WAAgC,GAC5C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqG7B;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+ElC"}