@uapkg/cli 1.1.7 → 1.1.9

package/dist/postinstall/loader/ModuleImporter.js

@@ -0,0 +1,60 @@
+import fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { createPostinstallLoadFailedDiagnostic, fail, ok } from '@uapkg/diagnostics';
+/**
+ * Imports a postinstall module.
+ *
+ * For `.js`/`.mjs` files we use the file URL directly so relative imports and
+ * `node_modules` resolution work.
+ *
+ * For transpiled `.ts` code we write to a sibling temp file next to the
+ * original entry — data: URLs cannot resolve relative specifiers — and delete
+ * it on best-effort basis after import. The file lives in the OS tmp dir
+ * keyed by a timestamp+pid, avoiding collisions across concurrent installs.
+ */
+export class ModuleImporter {
+    async import(packageName, source) {
+        if (source.kind === 'file') {
+            return this.importFileUrl(packageName, source.path, source.path);
+        }
+        const tmpFile = this.createTempFile(source.originalPath, source.code);
+        try {
+            return await this.importFileUrl(packageName, tmpFile, source.originalPath);
+        }
+        finally {
+            this.safeUnlink(tmpFile);
+        }
+    }
+    async importFileUrl(packageName, filePath, reportedPath) {
+        try {
+            // Cache-bust with a query parameter so repeated postinstall runs in the
+            // same process (e.g. tests) always reload the latest bytes on disk.
+            const url = `${pathToFileURL(filePath).href}?t=${Date.now()}`;
+            const moduleValue = await import(url);
+            return ok(moduleValue);
+        }
+        catch (error) {
+            return fail([
+                createPostinstallLoadFailedDiagnostic(packageName, reportedPath, error instanceof Error ? error.message : String(error)),
+            ]);
+        }
+    }
+    createTempFile(originalPath, code) {
+        const base = path.basename(originalPath, path.extname(originalPath));
+        const fileName = `uapkg-postinstall-${base}-${process.pid}-${Date.now()}.mjs`;
+        const tmpFile = path.join(os.tmpdir(), fileName);
+        fs.writeFileSync(tmpFile, code, 'utf-8');
+        return tmpFile;
+    }
+    safeUnlink(filePath) {
+        try {
+            fs.unlinkSync(filePath);
+        }
+        catch {
+            // Best-effort cleanup; OS tmp dir is rotated anyway.
+        }
+    }
+}
+//# sourceMappingURL=ModuleImporter.js.map

package/dist/postinstall/loader/ModuleImporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ModuleImporter.js","sourceRoot":"","sources":["../../../src/postinstall/loader/ModuleImporter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,EAAE,EAAe,MAAM,oBAAoB,CAAC;AAOlG;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IAClB,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,MAAoB;QAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,QAAgB,EAAE,YAAoB;QACrF,IAAI,CAAC;YACH,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;gBACV,qCAAqC,CACnC,WAAW,EACX,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,YAAoB,EAAE,IAAY;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,qBAAqB,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;CACF"}

package/dist/postinstall/loader/PostinstallLoader.d.ts

@@ -0,0 +1,32 @@
+import { type Result } from '@uapkg/diagnostics';
+import type { PostinstallDefinition } from '../api/PostinstallDsl.js';
+import { EntryResolver } from './EntryResolver.js';
+import { EsbuildTranspiler } from './EsbuildTranspiler.js';
+import { ExportValidator } from './ExportValidator.js';
+import { ModuleImporter } from './ModuleImporter.js';
+export interface LoadedPostinstall {
+    readonly packageName: string;
+    readonly pluginRoot: string;
+    readonly entryFile: string;
+    readonly definition: PostinstallDefinition;
+}
+/**
+ * Facade that composes the four loader stages:
+ *   1. {@link EntryResolver}        locate `.uapkg/postinstall.<ext>`
+ *   2. {@link EsbuildTranspiler}    if `.ts`, transpile to ESM
+ *   3. {@link ModuleImporter}       dynamic import → raw module value
+ *   4. {@link ExportValidator}      Zod-validate default export
+ *
+ * Returns `ok(null)` when a plugin has no postinstall — a valid, silent state.
+ * Never throws: every stage returns `Result`.
+ */
+export declare class PostinstallLoader {
+    private readonly entryResolver;
+    private readonly transpiler;
+    private readonly importer;
+    private readonly validator;
+    constructor(entryResolver?: EntryResolver, transpiler?: EsbuildTranspiler, importer?: ModuleImporter, validator?: ExportValidator);
+    load(packageName: string, pluginRoot: string): Promise<Result<LoadedPostinstall | null>>;
+    private buildModuleSource;
+}
+//# sourceMappingURL=PostinstallLoader.d.ts.map

package/dist/postinstall/loader/PostinstallLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostinstallLoader.d.ts","sourceRoot":"","sources":["../../../src/postinstall/loader/PostinstallLoader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAsB,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAqB,MAAM,qBAAqB,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAHT,aAAa,GAAE,aAAmC,EAClD,UAAU,GAAE,iBAA2C,EACvD,QAAQ,GAAE,cAAqC,EAC/C,SAAS,GAAE,eAAuC;IAGxD,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;YAuBvF,iBAAiB;CAQhC"}

package/dist/postinstall/loader/PostinstallLoader.js

@@ -0,0 +1,60 @@
+import { fail, ok } from '@uapkg/diagnostics';
+import { EntryResolver } from './EntryResolver.js';
+import { EsbuildTranspiler } from './EsbuildTranspiler.js';
+import { ExportValidator } from './ExportValidator.js';
+import { ModuleImporter } from './ModuleImporter.js';
+/**
+ * Facade that composes the four loader stages:
+ *   1. {@link EntryResolver}        locate `.uapkg/postinstall.<ext>`
+ *   2. {@link EsbuildTranspiler}    if `.ts`, transpile to ESM
+ *   3. {@link ModuleImporter}       dynamic import → raw module value
+ *   4. {@link ExportValidator}      Zod-validate default export
+ *
+ * Returns `ok(null)` when a plugin has no postinstall — a valid, silent state.
+ * Never throws: every stage returns `Result`.
+ */
+export class PostinstallLoader {
+    entryResolver;
+    transpiler;
+    importer;
+    validator;
+    constructor(entryResolver = new EntryResolver(), transpiler = new EsbuildTranspiler(), importer = new ModuleImporter(), validator = new ExportValidator()) {
+        this.entryResolver = entryResolver;
+        this.transpiler = transpiler;
+        this.importer = importer;
+        this.validator = validator;
+    }
+    async load(packageName, pluginRoot) {
+        const entryResult = this.entryResolver.resolve(packageName, pluginRoot);
+        if (!entryResult.ok)
+            return entryResult;
+        const entry = entryResult.value;
+        if (entry === null)
+            return ok(null);
+        const sourceResult = await this.buildModuleSource(packageName, entry);
+        if (!sourceResult.ok)
+            return sourceResult;
+        const importResult = await this.importer.import(packageName, sourceResult.value);
+        if (!importResult.ok)
+            return importResult;
+        const validated = this.validator.validate(packageName, entry.path, importResult.value);
+        if (!validated.ok)
+            return validated;
+        return ok({
+            packageName,
+            pluginRoot,
+            entryFile: entry.path,
+            definition: validated.value,
+        });
+    }
+    async buildModuleSource(packageName, entry) {
+        if (entry.kind !== 'ts') {
+            return ok({ kind: 'file', path: entry.path });
+        }
+        const transpiled = await this.transpiler.transpile(packageName, entry.path);
+        if (!transpiled.ok)
+            return fail(transpiled.diagnostics);
+        return ok({ kind: 'transpiled', code: transpiled.value, originalPath: entry.path });
+    }
+}
+//# sourceMappingURL=PostinstallLoader.js.map

package/dist/postinstall/loader/PostinstallLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostinstallLoader.js","sourceRoot":"","sources":["../../../src/postinstall/loader/PostinstallLoader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,EAAE,EAAe,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAsB,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAqB,MAAM,qBAAqB,CAAC;AASxE;;;;;;;;;GASG;AACH,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IAJnB,YACmB,gBAA+B,IAAI,aAAa,EAAE,EAClD,aAAgC,IAAI,iBAAiB,EAAE,EACvD,WAA2B,IAAI,cAAc,EAAE,EAC/C,YAA6B,IAAI,eAAe,EAAE;QAHlD,kBAAa,GAAb,aAAa,CAAqC;QAClD,eAAU,GAAV,UAAU,CAA6C;QACvD,aAAQ,GAAR,QAAQ,CAAuC;QAC/C,cAAS,GAAT,SAAS,CAAyC;IAClE,CAAC;IAEG,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAEpC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,YAAY,CAAC;QAE1C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,YAAY,CAAC;QAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAEpC,OAAO,EAAE,CAAC;YACR,WAAW;YACX,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,UAAU,EAAE,SAAS,CAAC,KAAK;SAC5B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,KAAoB;QACvE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;CACF"}

package/dist/postinstall/markers/MarkerBlockEditor.d.ts

@@ -0,0 +1,30 @@
+import { type Result } from '@uapkg/diagnostics';
+import { MarkerBlockService } from './MarkerBlockService.js';
+import { MarkerIntegrityValidator } from './MarkerIntegrityValidator.js';
+/**
+ * Higher-level idempotent wrapper around {@link MarkerBlockService}.
+ *
+ * - `upsert`: remove any existing owned block and re-insert fresh content.
+ *   Idempotent: calling twice with the same input yields the same result.
+ * - `remove`: strip the owned block if present; no-op otherwise.
+ * - `validate`: detect corruption (orphaned/nested markers) in the source for
+ *   the owning `(pluginName, zone)` pair. Returns a `POSTINSTALL_MARKER_CORRUPT`
+ *   diagnostic on failure; never throws.
+ *
+ * Injectors compose this helper to achieve "edit once, safe to re-run" semantics.
+ */
+export declare class MarkerBlockEditor {
+    private readonly service;
+    private readonly integrity;
+    constructor(service?: MarkerBlockService, integrity?: MarkerIntegrityValidator);
+    upsert(source: string, pluginName: string, zone: string, content: string, indent?: string): string;
+    remove(source: string, pluginName: string, zone: string): string;
+    contains(source: string, pluginName: string, zone: string): boolean;
+    /**
+     * Validates that the source contains a well-formed marker block for the
+     * owning `(pluginName, zone)` pair. Returns `Result.ok` when clean; returns
+     * `Result.fail` with a `POSTINSTALL_MARKER_CORRUPT` diagnostic otherwise.
+     */
+    validate(source: string, pluginName: string, zone: string, filePath: string): Result<void>;
+}
+//# sourceMappingURL=MarkerBlockEditor.d.ts.map

package/dist/postinstall/markers/MarkerBlockEditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MarkerBlockEditor.d.ts","sourceRoot":"","sources":["../../../src/postinstall/markers/MarkerBlockEditor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsD,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,GAAE,kBAA6C,EACtD,SAAS,GAAE,wBAAyD;IAGhF,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,MAAM;IAM9F,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAIhE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1E;;;;OAIG;IACI,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;CAKlG"}

package/dist/postinstall/markers/MarkerBlockEditor.js

@@ -0,0 +1,46 @@
+import { createPostinstallMarkerCorruptDiagnostic, fail, ok } from '@uapkg/diagnostics';
+import { MarkerBlockService } from './MarkerBlockService.js';
+import { MarkerIntegrityValidator } from './MarkerIntegrityValidator.js';
+/**
+ * Higher-level idempotent wrapper around {@link MarkerBlockService}.
+ *
+ * - `upsert`: remove any existing owned block and re-insert fresh content.
+ *   Idempotent: calling twice with the same input yields the same result.
+ * - `remove`: strip the owned block if present; no-op otherwise.
+ * - `validate`: detect corruption (orphaned/nested markers) in the source for
+ *   the owning `(pluginName, zone)` pair. Returns a `POSTINSTALL_MARKER_CORRUPT`
+ *   diagnostic on failure; never throws.
+ *
+ * Injectors compose this helper to achieve "edit once, safe to re-run" semantics.
+ */
+export class MarkerBlockEditor {
+    service;
+    integrity;
+    constructor(service = new MarkerBlockService(), integrity = new MarkerIntegrityValidator()) {
+        this.service = service;
+        this.integrity = integrity;
+    }
+    upsert(source, pluginName, zone, content, indent = '') {
+        const stripped = this.service.stripOwnedBlock(source, pluginName, zone);
+        const block = this.service.createBlock(pluginName, zone, content, indent);
+        return `${stripped.trimEnd()}\n${block}\n`;
+    }
+    remove(source, pluginName, zone) {
+        return this.service.stripOwnedBlock(source, pluginName, zone);
+    }
+    contains(source, pluginName, zone) {
+        return this.service.containsOwnedBlock(source, pluginName, zone);
+    }
+    /**
+     * Validates that the source contains a well-formed marker block for the
+     * owning `(pluginName, zone)` pair. Returns `Result.ok` when clean; returns
+     * `Result.fail` with a `POSTINSTALL_MARKER_CORRUPT` diagnostic otherwise.
+     */
+    validate(source, pluginName, zone, filePath) {
+        const result = this.integrity.validate(source, pluginName, zone);
+        if (result.ok)
+            return ok(undefined);
+        return fail([createPostinstallMarkerCorruptDiagnostic(pluginName, filePath, result.reason)]);
+    }
+}
+//# sourceMappingURL=MarkerBlockEditor.js.map

package/dist/postinstall/markers/MarkerBlockEditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MarkerBlockEditor.js","sourceRoot":"","sources":["../../../src/postinstall/markers/MarkerBlockEditor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wCAAwC,EAAE,IAAI,EAAE,EAAE,EAAe,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,UAA8B,IAAI,kBAAkB,EAAE,EACtD,YAAsC,IAAI,wBAAwB,EAAE;QADpE,YAAO,GAAP,OAAO,CAA+C;QACtD,cAAS,GAAT,SAAS,CAA2D;IACpF,CAAC;IAEG,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAY,EAAE,OAAe,EAAE,MAAM,GAAG,EAAE;QAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,KAAK,IAAI,CAAC;IAC7C,CAAC;IAEM,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAY;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAEM,QAAQ,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAY;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACI,QAAQ,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAY,EAAE,QAAgB;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,CAAC,wCAAwC,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;CACF"}

package/dist/postinstall/markers/MarkerBlockService.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Low-level marker-block primitives.
+ *
+ * A marker block has the form:
+ *
+ * ```
+ * <indent>// UAPKG-BEGIN <pluginName>:<zone>
+ * <indent><content...>
+ * <indent>// UAPKG-END <pluginName>:<zone>
+ * ```
+ *
+ * Blocks are *owned* by a `(pluginName, zone)` pair — only the owning pair's
+ * blocks are ever rewritten. Behavior mirrors the legacy `MarkerBlockService`
+ * so existing host-project files stay stable across the rewrite.
+ */
+export declare class MarkerBlockService {
+    makeBegin(pluginName: string, zone: string): string;
+    makeEnd(pluginName: string, zone: string): string;
+    createBlock(pluginName: string, zone: string, content: string, indent?: string): string;
+    stripOwnedBlock(source: string, pluginName: string, zone: string): string;
+    containsOwnedBlock(source: string, pluginName: string, zone: string): boolean;
+    private escapeForRegex;
+}
+//# sourceMappingURL=MarkerBlockService.d.ts.map

package/dist/postinstall/markers/MarkerBlockService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MarkerBlockService.d.ts","sourceRoot":"","sources":["../../../src/postinstall/markers/MarkerBlockService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,qBAAa,kBAAkB;IACtB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAInD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAIjD,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,MAAM;IAUnF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAOzE,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAKpF,OAAO,CAAC,cAAc;CAGvB"}

package/dist/postinstall/markers/MarkerBlockService.js

@@ -0,0 +1,46 @@
+/**
+ * Low-level marker-block primitives.
+ *
+ * A marker block has the form:
+ *
+ * ```
+ * <indent>// UAPKG-BEGIN <pluginName>:<zone>
+ * <indent><content...>
+ * <indent>// UAPKG-END <pluginName>:<zone>
+ * ```
+ *
+ * Blocks are *owned* by a `(pluginName, zone)` pair — only the owning pair's
+ * blocks are ever rewritten. Behavior mirrors the legacy `MarkerBlockService`
+ * so existing host-project files stay stable across the rewrite.
+ */
+export class MarkerBlockService {
+    makeBegin(pluginName, zone) {
+        return `// UAPKG-BEGIN ${pluginName}:${zone}`;
+    }
+    makeEnd(pluginName, zone) {
+        return `// UAPKG-END ${pluginName}:${zone}`;
+    }
+    createBlock(pluginName, zone, content, indent = '') {
+        const begin = `${indent}${this.makeBegin(pluginName, zone)}`;
+        const end = `${indent}${this.makeEnd(pluginName, zone)}`;
+        const lines = content
+            .trim()
+            .split(/\r?\n/)
+            .map((line) => `${indent}${line}`.replace(/[ \t]+$/g, ''));
+        return `${begin}\n${lines.join('\n')}\n${end}`;
+    }
+    stripOwnedBlock(source, pluginName, zone) {
+        const begin = this.escapeForRegex(this.makeBegin(pluginName, zone));
+        const end = this.escapeForRegex(this.makeEnd(pluginName, zone));
+        const pattern = new RegExp(`^[ \\t]*${begin}[\\s\\S]*?^[ \\t]*${end}\\s*\\r?\\n?`, 'gm');
+        return source.replace(pattern, '');
+    }
+    containsOwnedBlock(source, pluginName, zone) {
+        const begin = this.escapeForRegex(this.makeBegin(pluginName, zone));
+        return new RegExp(`^[ \\t]*${begin}$`, 'm').test(source);
+    }
+    escapeForRegex(value) {
+        return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }
+}
+//# sourceMappingURL=MarkerBlockService.js.map

package/dist/postinstall/markers/MarkerBlockService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MarkerBlockService.js","sourceRoot":"","sources":["../../../src/postinstall/markers/MarkerBlockService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,kBAAkB;IACtB,SAAS,CAAC,UAAkB,EAAE,IAAY;QAC/C,OAAO,kBAAkB,UAAU,IAAI,IAAI,EAAE,CAAC;IAChD,CAAC;IAEM,OAAO,CAAC,UAAkB,EAAE,IAAY;QAC7C,OAAO,gBAAgB,UAAU,IAAI,IAAI,EAAE,CAAC;IAC9C,CAAC;IAEM,WAAW,CAAC,UAAkB,EAAE,IAAY,EAAE,OAAe,EAAE,MAAM,GAAG,EAAE;QAC/E,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO;aAClB,IAAI,EAAE;aACN,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;IACjD,CAAC;IAEM,eAAe,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAY;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,WAAW,KAAK,qBAAqB,GAAG,cAAc,EAAE,IAAI,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IAEM,kBAAkB,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAY;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/postinstall/markers/MarkerIntegrityValidator.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Detects corruption in UAPKG marker blocks for a single `(pluginName, zone)`
+ * owning pair. Corruption rules (scoped to the owning pair — foreign plugins'
+ * blocks are ignored on purpose):
+ *
+ *   1. `UAPKG-BEGIN X:Z` with no matching `UAPKG-END X:Z` after it
+ *      → `orphaned-begin`.
+ *   2. `UAPKG-END X:Z` with no preceding `UAPKG-BEGIN X:Z`
+ *      → `orphaned-end`.
+ *   3. Two `UAPKG-BEGIN X:Z` before any `UAPKG-END X:Z`
+ *      → `nested-begin`.
+ *
+ * The validator is a pure function — no I/O, no mutation, no exceptions. It
+ * returns the first violation encountered so callers can surface exactly one
+ * diagnostic per file.
+ */
+export interface MarkerIntegrityOk {
+    readonly ok: true;
+}
+export interface MarkerIntegrityFail {
+    readonly ok: false;
+    readonly reason: string;
+    readonly line: number;
+}
+export type MarkerIntegrityResult = MarkerIntegrityOk | MarkerIntegrityFail;
+export declare class MarkerIntegrityValidator {
+    validate(source: string, pluginName: string, zone: string): MarkerIntegrityResult;
+}
+//# sourceMappingURL=MarkerIntegrityValidator.d.ts.map

package/dist/postinstall/markers/MarkerIntegrityValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MarkerIntegrityValidator.d.ts","sourceRoot":"","sources":["../../../src/postinstall/markers/MarkerIntegrityValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAE5E,qBAAa,wBAAwB;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,qBAAqB;CAyDzF"}

package/dist/postinstall/markers/MarkerIntegrityValidator.js

@@ -0,0 +1,53 @@
+export class MarkerIntegrityValidator {
+    validate(source, pluginName, zone) {
+        const beginToken = `UAPKG-BEGIN ${pluginName}:${zone}`;
+        const endToken = `UAPKG-END ${pluginName}:${zone}`;
+        const lines = source.split(/\r?\n/);
+        let depth = 0;
+        let lastBeginLine = -1;
+        for (let i = 0; i < lines.length; i += 1) {
+            const line = lines[i];
+            const hasBegin = line.includes(beginToken);
+            const hasEnd = line.includes(endToken);
+            if (hasBegin && hasEnd) {
+                // Same-line BEGIN+END is not a shape we emit; treat as malformed.
+                return {
+                    ok: false,
+                    reason: `BEGIN and END on same line at line ${i + 1}`,
+                    line: i + 1,
+                };
+            }
+            if (hasBegin) {
+                if (depth >= 1) {
+                    return {
+                        ok: false,
+                        reason: `nested BEGIN at line ${i + 1} (previous BEGIN at line ${lastBeginLine + 1} was not closed)`,
+                        line: i + 1,
+                    };
+                }
+                depth += 1;
+                lastBeginLine = i;
+                continue;
+            }
+            if (hasEnd) {
+                if (depth === 0) {
+                    return {
+                        ok: false,
+                        reason: `orphaned END at line ${i + 1} (no preceding BEGIN)`,
+                        line: i + 1,
+                    };
+                }
+                depth -= 1;
+            }
+        }
+        if (depth > 0) {
+            return {
+                ok: false,
+                reason: `orphaned BEGIN at line ${lastBeginLine + 1} (missing END)`,
+                line: lastBeginLine + 1,
+            };
+        }
+        return { ok: true };
+    }
+}
+//# sourceMappingURL=MarkerIntegrityValidator.js.map

package/dist/postinstall/markers/MarkerIntegrityValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MarkerIntegrityValidator.js","sourceRoot":"","sources":["../../../src/postinstall/markers/MarkerIntegrityValidator.ts"],"names":[],"mappings":"AA4BA,MAAM,OAAO,wBAAwB;IAC5B,QAAQ,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAY;QAC9D,MAAM,UAAU,GAAG,eAAe,UAAU,IAAI,IAAI,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,aAAa,UAAU,IAAI,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;QAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEvC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;gBACvB,kEAAkE;gBAClE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,sCAAsC,CAAC,GAAG,CAAC,EAAE;oBACrD,IAAI,EAAE,CAAC,GAAG,CAAC;iBACZ,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACf,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,wBAAwB,CAAC,GAAG,CAAC,4BAA4B,aAAa,GAAG,CAAC,kBAAkB;wBACpG,IAAI,EAAE,CAAC,GAAG,CAAC;qBACZ,CAAC;gBACJ,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;gBACX,aAAa,GAAG,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,wBAAwB,CAAC,GAAG,CAAC,uBAAuB;wBAC5D,IAAI,EAAE,CAAC,GAAG,CAAC;qBACZ,CAAC;gBACJ,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QAED,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0BAA0B,aAAa,GAAG,CAAC,gBAAgB;gBACnE,IAAI,EAAE,aAAa,GAAG,CAAC;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/postinstall/policy/PostinstallPolicyGate.d.ts

@@ -0,0 +1,36 @@
+import { type ConfigInstance, PostInstallPolicyResolver, type PostInstallPolicyValue, type ResolvedConfig } from '@uapkg/config';
+import { type PostinstallPolicyDeniedDiagnostic } from '@uapkg/diagnostics';
+/** Minimal config reader surface; defaults to the singleton `@uapkg/config`. */
+export interface PolicyConfigReader {
+    getAll(): ResolvedConfig | Record<string, unknown> | null;
+}
+export interface PolicyDecision {
+    /** Whether the policy allows running a plugin's postinstall. */
+    readonly allowed: boolean;
+    /** The effective policy value ("allow"/"deny"). */
+    readonly policy: PostInstallPolicyValue;
+    /** Where the value was read from. */
+    readonly resolvedFrom: 'registry' | 'install';
+    /**
+     * Populated only when `allowed === false`. Callers attach this to their
+     * diagnostic bag and continue with other plugins (skipping is non-fatal).
+     */
+    readonly denialDiagnostic?: PostinstallPolicyDeniedDiagnostic;
+}
+/**
+ * Consults {@link PostInstallPolicyResolver} to decide whether a given plugin's
+ * postinstall script should run. The resolver honors per-registry overrides
+ * and falls back to the global `install.postInstallPolicy` default (`deny`).
+ *
+ * This class is a thin glue layer so the orchestrator stays free of config
+ * vocabulary.
+ */
+export declare class PostinstallPolicyGate {
+    private readonly reader;
+    private readonly resolver;
+    constructor(reader?: PolicyConfigReader, resolver?: PostInstallPolicyResolver);
+    evaluate(packageName: string, registryName: string): PolicyDecision;
+    private readResolved;
+}
+export type { ConfigInstance };
+//# sourceMappingURL=PostinstallPolicyGate.d.ts.map

package/dist/postinstall/policy/PostinstallPolicyGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostinstallPolicyGate.d.ts","sourceRoot":"","sources":["../../../src/postinstall/policy/PostinstallPolicyGate.ts"],"names":[],"mappings":"AAAA,OAAe,EACb,KAAK,cAAc,EACnB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAA2C,KAAK,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AAErH,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,MAAM,IAAI,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,qCAAqC;IACrC,QAAQ,CAAC,YAAY,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,iCAAiC,CAAC;CAC/D;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,MAAM,GAAE,kBAA4D,EACpE,QAAQ,GAAE,yBAA2D;IAGjF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,cAAc;IAc1E,OAAO,CAAC,YAAY;CAQrB;AAoBD,YAAY,EAAE,cAAc,EAAE,CAAC"}

package/dist/postinstall/policy/PostinstallPolicyGate.js

@@ -0,0 +1,57 @@
+import Config, { PostInstallPolicyResolver, } from '@uapkg/config';
+import { createPostinstallPolicyDeniedDiagnostic } from '@uapkg/diagnostics';
+/**
+ * Consults {@link PostInstallPolicyResolver} to decide whether a given plugin's
+ * postinstall script should run. The resolver honors per-registry overrides
+ * and falls back to the global `install.postInstallPolicy` default (`deny`).
+ *
+ * This class is a thin glue layer so the orchestrator stays free of config
+ * vocabulary.
+ */
+export class PostinstallPolicyGate {
+    reader;
+    resolver;
+    constructor(reader = Config, resolver = new PostInstallPolicyResolver()) {
+        this.reader = reader;
+        this.resolver = resolver;
+    }
+    evaluate(packageName, registryName) {
+        const resolved = this.readResolved();
+        const { policy, resolvedFrom } = this.resolver.resolve(resolved, registryName);
+        if (policy === 'allow') {
+            return { allowed: true, policy, resolvedFrom };
+        }
+        return {
+            allowed: false,
+            policy,
+            resolvedFrom,
+            denialDiagnostic: createPostinstallPolicyDeniedDiagnostic(packageName, registryName, policy, resolvedFrom),
+        };
+    }
+    readResolved() {
+        const value = this.reader.getAll();
+        if (!value || typeof value !== 'object' || !('install' in value)) {
+            // Defensive: if the caller passed an unresolved config, fall back to deny.
+            return FALLBACK_RESOLVED_CONFIG;
+        }
+        return value;
+    }
+}
+/**
+ * Construct-or-else fallback: never used with the real `@uapkg/config`
+ * singleton (which always produces a `ResolvedConfig`), but shields the gate
+ * from arbitrary callers that might pass a partial config.
+ */
+const FALLBACK_RESOLVED_CONFIG = {
+    registry: '',
+    registries: {},
+    git: 'git',
+    editor: '',
+    exec: { shell: '' },
+    cache: { enabled: true },
+    registryCache: { ttlSeconds: 0 },
+    network: { retries: 0, timeout: 0, maxConcurrentDownloads: 1 },
+    install: { postInstallPolicy: 'deny' },
+    term: { quiet: false, verbose: false },
+};
+//# sourceMappingURL=PostinstallPolicyGate.js.map

package/dist/postinstall/policy/PostinstallPolicyGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostinstallPolicyGate.js","sourceRoot":"","sources":["../../../src/postinstall/policy/PostinstallPolicyGate.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAEb,yBAAyB,GAG1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uCAAuC,EAA0C,MAAM,oBAAoB,CAAC;AAqBrH;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,SAA6B,MAAuC,EACpE,WAAsC,IAAI,yBAAyB,EAAE;QADrE,WAAM,GAAN,MAAM,CAA8D;QACpE,aAAQ,GAAR,QAAQ,CAA6D;IACrF,CAAC;IAEG,QAAQ,CAAC,WAAmB,EAAE,YAAoB;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/E,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM;YACN,YAAY;YACZ,gBAAgB,EAAE,uCAAuC,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC;SAC3G,CAAC;IACJ,CAAC;IAEO,YAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC;YACjE,2EAA2E;YAC3E,OAAO,wBAAwB,CAAC;QAClC,CAAC;QACD,OAAO,KAAuB,CAAC;IACjC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAAmB;IAC/C,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,EAAE;IACd,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IACnB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;IACxB,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;IAChC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,sBAAsB,EAAE,CAAC,EAAE;IAC9D,OAAO,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE;IACtC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE;CACvC,CAAC"}

package/dist/postinstall/runner/PostinstallOrchestrator.d.ts

@@ -0,0 +1,71 @@
+import type { Result } from '@uapkg/diagnostics';
+import { PostinstallLoader } from '../loader/PostinstallLoader.js';
+import { PostinstallPolicyGate } from '../policy/PostinstallPolicyGate.js';
+import { BuildCsInjector } from '../unreal/BuildCsInjector.js';
+import { ProjectFileLocator } from '../unreal/ProjectFileLocator.js';
+import { TargetCsInjector } from '../unreal/TargetCsInjector.js';
+import { UnrealSourceCatalogBuilder } from '../unreal/UnrealSourceCatalog.js';
+import { UProjectInjector } from '../unreal/UProjectInjector.js';
+import { UProjectMetadataReader } from '../unreal/UProjectMetadataReader.js';
+/**
+ * Projection of an installer action that the orchestrator needs. The CLI
+ * (Phase 8) will map `InstallAction` → `PostinstallCandidate` by filtering
+ * `type === 'add' | 'update'` and joining with the lockfile for registry
+ * metadata.
+ */
+export interface PostinstallCandidate {
+    readonly packageName: string;
+    readonly registry: string;
+    /** Absolute path to the installed plugin root. */
+    readonly pluginRoot: string;
+}
+export interface PostinstallReport {
+    readonly executed: readonly string[];
+    readonly skipped: readonly {
+        packageName: string;
+        reason: 'no-script' | 'policy-denied';
+    }[];
+}
+export interface PostinstallOrchestratorInput {
+    readonly projectRoot: string;
+    readonly manifestType: 'project' | 'plugin';
+    readonly candidates: readonly PostinstallCandidate[];
+    /**
+     * Optional explicit module-name list (from `postinstall.modules` in the
+     * project manifest). When provided, overrides the names discovered from
+     * `.uproject`'s `Modules[]`. An empty array = override to "no modules".
+     */
+    readonly moduleNameOverride?: readonly string[];
+}
+/**
+ * Top-level postinstall flow:
+ *
+ *   1. Fast path: if the host is a plugin manifest, nothing runs.
+ *   2. For each candidate plugin:
+ *        a. PolicyGate decides allow/deny. Deny → info diagnostic, skip.
+ *        b. Loader locates + transpiles + imports + validates the script.
+ *        c. Accumulate `(plugin, definition)` pairs into a plan.
+ *   3. Build a single {@link UnrealSourceCatalog} covering every module
+ *      any script wants to touch.
+ *   4. Apply injectors idempotently per zone.
+ *
+ * Always returns a {@link Result}; never throws. The caller inspects
+ * `diagnostics` to render errors/warnings/info lines.
+ */
+export declare class PostinstallOrchestrator {
+    private readonly loader;
+    private readonly policy;
+    private readonly catalogBuilder;
+    private readonly buildInjector;
+    private readonly targetInjector;
+    private readonly projectInjector;
+    private readonly projectFileLocator;
+    private readonly uprojectReader;
+    constructor(loader?: PostinstallLoader, policy?: PostinstallPolicyGate, catalogBuilder?: UnrealSourceCatalogBuilder, buildInjector?: BuildCsInjector, targetInjector?: TargetCsInjector, projectInjector?: UProjectInjector, projectFileLocator?: ProjectFileLocator, uprojectReader?: UProjectMetadataReader);
+    run(input: PostinstallOrchestratorInput): Promise<Result<PostinstallReport>>;
+    private buildPlan;
+    private buildCatalog;
+    private applyScript;
+    private absorb;
+}
+//# sourceMappingURL=PostinstallOrchestrator.d.ts.map

package/dist/postinstall/runner/PostinstallOrchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostinstallOrchestrator.d.ts","sourceRoot":"","sources":["../../../src/postinstall/runner/PostinstallOrchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAA0B,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,GAAG,eAAe,CAAA;KAAE,EAAE,CAAC;CAC7F;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAPd,MAAM,GAAE,iBAA2C,EACnD,MAAM,GAAE,qBAAmD,EAC3D,cAAc,GAAE,0BAA6D,EAC7E,aAAa,GAAE,eAAuC,EACtD,cAAc,GAAE,gBAAyC,EACzD,eAAe,GAAE,gBAAyC,EAC1D,kBAAkB,GAAE,kBAA6C,EACjE,cAAc,GAAE,sBAAqD;IAG3E,GAAG,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YA+B3E,SAAS;IAyBvB,OAAO,CAAC,YAAY;IAmCpB,OAAO,CAAC,WAAW;IAsDnB,OAAO,CAAC,MAAM;CAIf"}