@unbrained/pm-cli 2026.8.28 → 2026.8.30

package/dist/core/item/parse.js

@@ -4,7 +4,7 @@
  * Defines item parsing, formatting, and lifecycle helpers for Parse.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2252cfb9-37ea-57f1-b7ea-2b0c0f87ecb2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="80965b57-856c-5fef-a372-0c9f3766ada5")}catch(e){}}();
 import { PmCliError } from "../shared/errors.js";
 import { EXIT_CODE } from "../shared/constants.js";
 const STDIN_TOKEN = "-";
@@ -30,6 +30,16 @@ const CONTINUABLE_VALUE_KEYS = new Set([
     "value",
     "why_now",
 ]);
+/** Classify plaintext as structured key/value input using an explicit accepted-key vocabulary. */
+export function looksLikeStructuredKeyValueEntry(raw, keys) {
+    if (raw.startsWith("```") || raw.includes("\n")) {
+        return true;
+    }
+    const keyPattern = keys
+        .map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join("|");
+    return new RegExp(`^(?:[-*+]\\s+)?(?:${keyPattern})\\s*[:=]`, "i").test(raw);
+}
 /** Implements parse tags for the public runtime surface of this module. */
 export function parseTags(raw) {
     const trimmed = raw.trim();
@@ -188,16 +198,16 @@ function splitCsvSegments(raw) {
     const segments = [];
     let current = "";
     let inQuotes = false;
-    let escaped = false;
-    for (const char of raw) {
-        if (escaped) {
-            current += char;
-            escaped = false;
+    for (let index = 0; index < raw.length; index += 1) {
+        const char = raw[index];
+        if (char === "\\" && raw[index + 1] === ",") {
+            current += ",";
+            index += 1;
             continue;
         }
-        if (char === "\\") {
-            current += char;
-            escaped = true;
+        if (char === "\\" && raw[index + 1] !== undefined) {
+            current += `${char}${raw[index + 1]}`;
+            index += 1;
             continue;
         }
         if (char === '"') {
@@ -206,14 +216,14 @@ function splitCsvSegments(raw) {
             continue;
         }
         if (char === "," && !inQuotes) {
-            segments.push(current.trim());
+            segments.push(current);
             current = "";
             continue;
         }
         current += char;
     }
     if (current.trim()) {
-        segments.push(current.trim());
+        segments.push(current);
     }
     return segments;
 }
@@ -235,8 +245,8 @@ function unquoteValue(value) {
 function findKeyValueDelimiter(segment) {
     const equalsIndex = segment.indexOf("=");
     const colonIndex = segment.indexOf(":");
-    const hasEquals = equalsIndex > 0;
-    const hasColon = colonIndex > 0;
+    const hasEquals = equalsIndex >= 0;
+    const hasColon = colonIndex >= 0;
     if (hasEquals && hasColon) {
         return Math.min(equalsIndex, colonIndex);
     }
@@ -324,15 +334,18 @@ export function parseCsvKv(raw, optionName) {
     const segments = splitCsvSegments(trimmed);
     for (const segment of segments) {
         const delimiterIndex = findKeyValueDelimiter(segment);
-        if (delimiterIndex > 0) {
+        if (delimiterIndex >= 0) {
             const key = segment.slice(0, delimiterIndex).trim();
+            if (!key) {
+                throw new PmCliError(buildInvalidKvMessage(raw, optionName), EXIT_CODE.USAGE);
+            }
             const value = unquoteValue(segment.slice(delimiterIndex + 1).trim());
             result[key] = value;
             activeKey = key;
             continue;
         }
         if (activeKey && CONTINUABLE_VALUE_KEYS.has(activeKey.toLowerCase())) {
-            result[activeKey] = `${result[activeKey]},${segment.trim()}`;
+            result[activeKey] = `${result[activeKey]},${segment}`;
             continue;
         }
         throw new PmCliError(buildInvalidKvMessage(raw, optionName), EXIT_CODE.USAGE);
@@ -358,6 +371,15 @@ export function looksLikeGenericKeyValueEntry(raw) {
     }
     return GENERIC_LEADING_KV_KEY_PATTERN.test(trimmed);
 }
+/** Refuse a comma-bearing bare value whose meaning depends on guessing whether the comma separates values or belongs to one value. */
+export function assertNoAmbiguousBareCommaEntry(raw, optionName, noun, structured) {
+    if (structured || !raw.includes(","))
+        return;
+    throw new PmCliError(`${optionName} received an ambiguous comma-bearing bare ${noun}. Repeat ${optionName} for multiple values, or quote or escape literal commas in a structured key=<value> entry.`, EXIT_CODE.USAGE, {
+        code: "bare_comma_entry_ambiguous",
+        required: `Use one ${optionName} per bare ${noun}, or quote or escape literal commas in a structured key=<value> entry.`,
+    });
+}
 /**
  * Reject any key in a parsed CSV/markdown key/value map that is not part of the
  * caller's allowed-key contract, mirroring the strict `test --add` behavior
@@ -579,4 +601,4 @@ export const _testOnly = {
     parseMarkdownKeyValueLines,
 };
 //# sourceMappingURL=parse.js.map
-//# debugId=2252cfb9-37ea-57f1-b7ea-2b0c0f87ecb2
+//# debugId=80965b57-856c-5fef-a372-0c9f3766ada5

package/dist/core/shared/author.js

@@ -4,7 +4,7 @@
  * Provides shared primitives and utilities for Author.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8d89d381-5c6e-5f96-ba03-298fc6db9bba")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cf550961-0040-5e04-9d8d-16e316027e43")}catch(e){}}();
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
@@ -312,20 +312,50 @@ const MAX_PROVENANCE_PROBE_BYTES = 1_048_576;
 const MAX_CODEX_PROVENANCE_PROBE_BYTES = 4_194_304;
 const codexProvenanceSnapshotCache = new Map();
 const EMPTY_CODEX_PROVENANCE_SNAPSHOT = Object.freeze({});
-function parseClaudeProvenanceLine(line, dimension) {
+const claudeProvenanceSnapshotCache = new Map();
+const EMPTY_CLAUDE_PROVENANCE_SNAPSHOT = Object.freeze({});
+function asProvenanceRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function parseClaudeProvenanceLine(line) {
     let parsed;
     try {
         parsed = JSON.parse(line);
     }
     catch {
-        return undefined;
+        return EMPTY_CLAUDE_PROVENANCE_SNAPSHOT;
     }
-    const record = parsed;
-    const message = typeof record.message === "object" && record.message !== null
-        ? record.message
-        : undefined;
-    const value = dimension === "model" ? message?.model : record.version;
-    return nonBlank(value)?.slice(0, 256);
+    const record = asProvenanceRecord(parsed);
+    if (!record)
+        return EMPTY_CLAUDE_PROVENANCE_SNAPSHOT;
+    const queue = [
+        { value: record, depth: 0 },
+    ];
+    let visited = 0;
+    let model;
+    let version;
+    while (queue.length > 0 && visited < 64) {
+        const current = queue.shift();
+        visited += 1;
+        model ??= nonBlank(current.value.model)?.slice(0, 256);
+        version ??= nonBlank(current.value.version)?.slice(0, 256);
+        if (model && version)
+            break;
+        if (current.depth >= 4)
+            continue;
+        for (const value of Object.values(current.value)) {
+            const nested = asProvenanceRecord(value);
+            if (nested) {
+                queue.push({
+                    value: nested,
+                    depth: current.depth + 1,
+                });
+            }
+        }
+    }
+    return Object.freeze({ model, version });
 }
 function readClaudeSessionProvenance(dimension, signals, env) {
     const session = nonBlank(env.CLAUDE_CODE_SESSION_ID);
@@ -337,18 +367,40 @@ function readClaudeSessionProvenance(dimension, signals, env) {
     try {
         const file = fs.openSync(sessionPath, "r");
         try {
-            const size = fs.fstatSync(file).size;
-            const tailLength = Math.min(size, MAX_PROVENANCE_PROBE_BYTES);
+            const stats = fs.fstatSync(file);
+            const cacheKey = `${sessionPath}\u0000${stats.size}\u0000${stats.mtimeMs}`;
+            const cached = claudeProvenanceSnapshotCache.get(cacheKey);
+            if (cached)
+                return cached[dimension];
+            const probeLength = Math.min(stats.size, MAX_PROVENANCE_PROBE_BYTES);
+            const headLength = Math.min(probeLength, Math.ceil(probeLength / 2));
+            const tailLength = Math.min(probeLength - headLength, stats.size - headLength);
+            const head = Buffer.alloc(headLength);
+            fs.readSync(file, head, 0, headLength, 0);
             const tail = Buffer.alloc(tailLength);
-            fs.readSync(file, tail, 0, tailLength, Math.max(0, size - tailLength));
-            const lines = tail.toString("utf8").split("\n").reverse().slice(0, 4_096);
+            if (tailLength > 0) {
+                fs.readSync(file, tail, 0, tailLength, stats.size - tailLength);
+            }
+            const snapshot = {};
+            const lines = stats.size <= probeLength
+                ? Buffer.concat([head, tail]).toString("utf8").split("\n")
+                : [
+                    ...head.toString("utf8").split("\n").slice(0, 4_096),
+                    ...tail.toString("utf8").split("\n").slice(-4_096),
+                ];
             for (const line of lines) {
                 if (line.length === 0 || line.length > 262_144)
                     continue;
-                const value = parseClaudeProvenanceLine(line, dimension);
-                if (value)
-                    return value;
+                const parsed = parseClaudeProvenanceLine(line);
+                snapshot.model ??= parsed.model;
+                snapshot.version ??= parsed.version;
+                if (snapshot.model && snapshot.version)
+                    break;
             }
+            const frozen = Object.freeze(snapshot);
+            claudeProvenanceSnapshotCache.clear();
+            claudeProvenanceSnapshotCache.set(cacheKey, frozen);
+            return frozen[dimension];
         }
         finally {
             fs.closeSync(file);
@@ -1030,4 +1082,4 @@ export function resolveAuthor(candidate, fallback) {
     return identity.author;
 }
 //# sourceMappingURL=author.js.map
-//# debugId=8d89d381-5c6e-5f96-ba03-298fc6db9bba
+//# debugId=cf550961-0040-5e04-9d8d-16e316027e43

package/dist/sdk/dependency-provenance.d.ts

@@ -1,9 +1,58 @@
+export { isExternalDependencyReference, isExternalDependencySourceKind, } from "../core/item/dependency-reference.js";
 /** Provenance value declaring that a dependency id belongs to another workspace. */
 export declare const EXTERNAL_DEPENDENCY_SOURCE_KIND = "global";
 /** Human-facing alias accepted wherever external dependency provenance is parsed. */
 export declare const EXTERNAL_DEPENDENCY_SOURCE_KIND_ALIAS = "external";
-/** Return whether a dependency provenance value identifies an external workspace target. */
-export declare function isExternalDependencySourceKind(sourceKind: string | undefined): boolean;
+/** Stable external lifecycle values understood without coupling core to a provider. */
+export declare const EXTERNAL_DEPENDENCY_RESOLUTION_STATUSES: readonly ["open", "closed", "unknown"];
+/** External lifecycle value returned by a registered dependency resolver. */
+export type ExternalDependencyResolutionStatus = (typeof EXTERNAL_DEPENDENCY_RESOLUTION_STATUSES)[number];
+/** Provider-owned external dependency data before the SDK applies output bounds. */
+export interface ExternalDependencyResolverResult {
+    /** Provider lifecycle state normalized to the universal external status vocabulary. */
+    status: ExternalDependencyResolutionStatus;
+    /** Optional bounded human context for the remote dependency. */
+    title?: string;
+    /** Optional canonical provider URL or locator used as evidence. */
+    source?: string;
+    /** Optional provider observation timestamp; invalid timestamps are replaced by SDK time. */
+    checkedAt?: string;
+}
+/** Package-provided resolver contract for one or more external dependency locator families. */
+export interface ExternalDependencyResolver {
+    /** Stable resolver identity surfaced in agent-facing evidence. */
+    name: string;
+    /** Return whether this resolver owns the supplied external locator. */
+    supports(reference: string): boolean;
+    /** Resolve the locator without exposing provider credentials or unbounded response data. */
+    resolve(reference: string): Promise<ExternalDependencyResolverResult | null>;
+}
+/** Bounded provider-neutral evidence returned by the public resolver registry. */
+export interface ExternalDependencyResolution {
+    /** Original normalized dependency locator. */
+    id: string;
+    /** Provider lifecycle state. */
+    status: ExternalDependencyResolutionStatus;
+    /** Whether trusted provider evidence proves the blocker terminal. */
+    resolved: boolean;
+    /** Bounded remote title, or null when the provider did not supply one. */
+    title: string | null;
+    /** Bounded evidence locator. */
+    source: string;
+    /** Observation timestamp supplied by the provider or SDK clock. */
+    checked_at: string;
+    /** Registered resolver identity that produced this evidence. */
+    resolver: string;
+}
+/** Deterministic clock override for external resolver acceptance and tests. */
+export interface ExternalDependencyResolutionOptions {
+    /** Return the timestamp used when provider evidence omits or corrupts checkedAt. */
+    now?: () => string;
+}
+/** Register a package-owned external dependency resolver and return its idempotent disposer. */
+export declare function registerExternalDependencyResolver(resolver: ExternalDependencyResolver): () => void;
+/** Resolve one external locator through registered package providers with bounded provider-neutral evidence. */
+export declare function resolveExternalDependencyReference(reference: string, options?: ExternalDependencyResolutionOptions): Promise<ExternalDependencyResolution | null>;
 /** Canonicalize external provenance while preserving other named source kinds. */
 export declare function normalizeDependencySourceKind(sourceKind: string | undefined): string | undefined;
 /**

package/dist/sdk/dependency-provenance.js

@@ -5,17 +5,101 @@
  * items outside the current workspace.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1b2f1ac3-82b3-58a2-9f40-2dd95ab1b2bc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f3f3beb2-1d60-52fe-88ce-1ab3cb9dba0d")}catch(e){}}();
 import { normalizeItemId } from "../core/item/id.js";
+import { isExternalDependencyReference, isExternalDependencySourceKind, } from "../core/item/dependency-reference.js";
+export { isExternalDependencyReference, isExternalDependencySourceKind, } from "../core/item/dependency-reference.js";
 /** Provenance value declaring that a dependency id belongs to another workspace. */
 export const EXTERNAL_DEPENDENCY_SOURCE_KIND = "global";
 /** Human-facing alias accepted wherever external dependency provenance is parsed. */
 export const EXTERNAL_DEPENDENCY_SOURCE_KIND_ALIAS = "external";
-/** Return whether a dependency provenance value identifies an external workspace target. */
-export function isExternalDependencySourceKind(sourceKind) {
-    const normalized = sourceKind?.trim().toLowerCase();
-    return (normalized === EXTERNAL_DEPENDENCY_SOURCE_KIND ||
-        normalized === EXTERNAL_DEPENDENCY_SOURCE_KIND_ALIAS);
+/** Stable external lifecycle values understood without coupling core to a provider. */
+export const EXTERNAL_DEPENDENCY_RESOLUTION_STATUSES = [
+    "open",
+    "closed",
+    "unknown",
+];
+const externalDependencyResolvers = new Map();
+const MAX_EXTERNAL_TITLE_LENGTH = 240;
+const MAX_EXTERNAL_SOURCE_LENGTH = 2_048;
+/** Normalize and cap provider strings before they reach agent-facing output. */
+function boundedExternalText(value, fallback, maximumLength) {
+    return (value?.trim() || fallback).slice(0, maximumLength);
+}
+/** Reject provider payloads that violate the runtime resolver-result contract. */
+function isExternalDependencyResolverResult(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const candidate = value;
+    return (typeof candidate.status === "string" &&
+        (candidate.title == null || typeof candidate.title === "string") &&
+        (candidate.source == null || typeof candidate.source === "string") &&
+        (candidate.checkedAt == null || typeof candidate.checkedAt === "string"));
+}
+/** Register a package-owned external dependency resolver and return its idempotent disposer. */
+export function registerExternalDependencyResolver(resolver) {
+    const name = resolver.name.trim();
+    if (name.length === 0) {
+        throw new Error("External dependency resolver name must not be empty");
+    }
+    if (externalDependencyResolvers.has(name)) {
+        throw new Error(`External dependency resolver already registered: ${name}`);
+    }
+    const registeredResolver = {
+        name,
+        supports: (reference) => resolver.supports(reference),
+        resolve: (reference) => resolver.resolve(reference),
+    };
+    externalDependencyResolvers.set(name, registeredResolver);
+    return () => {
+        if (externalDependencyResolvers.get(name) === registeredResolver) {
+            externalDependencyResolvers.delete(name);
+        }
+    };
+}
+/** Resolve one external locator through registered package providers with bounded provider-neutral evidence. */
+export async function resolveExternalDependencyReference(reference, options = {}) {
+    const id = reference.trim();
+    if (!isExternalDependencyReference(id)) {
+        return null;
+    }
+    const resolvers = [...externalDependencyResolvers.values()].filter((resolver) => {
+        try {
+            return resolver.supports(id);
+        }
+        catch {
+            return false;
+        }
+    });
+    const outcomes = await Promise.allSettled(resolvers.map((resolver) => Promise.resolve().then(() => resolver.resolve(id))));
+    for (const [index, outcome] of outcomes.entries()) {
+        if (outcome.status !== "fulfilled" ||
+            !isExternalDependencyResolverResult(outcome.value)) {
+            continue;
+        }
+        const resolver = resolvers[index];
+        const candidate = outcome.value;
+        const status = EXTERNAL_DEPENDENCY_RESOLUTION_STATUSES.includes(candidate.status)
+            ? candidate.status
+            : "unknown";
+        const title = boundedExternalText(candidate.title, "", MAX_EXTERNAL_TITLE_LENGTH);
+        const source = boundedExternalText(candidate.source, id, MAX_EXTERNAL_SOURCE_LENGTH);
+        const observedAtMs = Date.parse(candidate.checkedAt?.trim() ?? "");
+        const checkedAt = Number.isFinite(observedAtMs)
+            ? new Date(observedAtMs).toISOString()
+            : (options.now?.() ?? new Date().toISOString());
+        return {
+            id,
+            status,
+            resolved: status === "closed",
+            title: title.length > 0 ? title : null,
+            source,
+            checked_at: checkedAt,
+            resolver: resolver.name,
+        };
+    }
+    return null;
 }
 /** Canonicalize external provenance while preserving other named source kinds. */
 export function normalizeDependencySourceKind(sourceKind) {
@@ -39,4 +123,4 @@ export function normalizeDependencySeedId(id, prefix, sourceKind) {
         : normalizeItemId(trimmed, prefix);
 }
 //# sourceMappingURL=dependency-provenance.js.map
-//# debugId=1b2f1ac3-82b3-58a2-9f40-2dd95ab1b2bc
+//# debugId=f3f3beb2-1d60-52fe-88ce-1ab3cb9dba0d

package/dist/sdk/extension/install-sources.d.ts

@@ -107,13 +107,7 @@ export declare function wrapNpmPackResolutionError(spec: string, error: unknown)
 declare function resolveNpmPackSpec(spec: string): Promise<string>;
 /** Implements normalize npm local file alias spec for the public runtime surface of this module. */
 export declare function normalizeNpmLocalFileAliasSpec(spec: string, cwd?: string): string;
-/**
- * Parse npm pack output and bind the reported artifact to its isolated target.
- *
- * Supports current JSON metadata and the legacy filename-only form while
- * refusing absolute or traversing results before the filesystem is consulted.
- */
-declare function parsePackedNpmPackage(stdout: string, packDirectory: string): {
+declare function parsePackedNpmPackage(stdout: string, packDirectory: string, expectedPackage?: string): {
     tarball: string;
     package?: string;
     version?: string;

package/dist/sdk/extension/install-sources.js

@@ -4,7 +4,7 @@
  * Implements extension package-management support for Install Sources.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="404342eb-68ab-5b7d-9a5a-ade1c8e98546")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="05f56edb-c08d-570c-b8b5-641fc694331e")}catch(e){}}();
 import { execFile } from "node:child_process";
 import fs from "node:fs/promises";
 import os from "node:os";
@@ -237,6 +237,14 @@ function npmPackageNameFromSpec(spec) {
     const unscoped = withoutAlias.match(/^([^/@\s]+)/);
     return unscoped?.[1] ?? withoutAlias;
 }
+/** Return whether an npm spec is a complete local-file alias, including unchanged UNC targets. */
+function isNpmLocalFileAliasSpec(spec) {
+    const marker = "@file:";
+    const markerIndex = spec.lastIndexOf(marker);
+    return (markerIndex > 0 &&
+        spec.slice(0, markerIndex).trim().length > 0 &&
+        spec.slice(markerIndex + marker.length).trim().length > 0);
+}
 /** Implements check whether npm not found error for the public runtime surface of this module. */
 export function isNpmNotFoundError(error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -358,14 +366,11 @@ async function resolveNpmPackSpec(spec) {
 export function normalizeNpmLocalFileAliasSpec(spec, cwd = process.cwd()) {
     const marker = "@file:";
     const markerIndex = spec.lastIndexOf(marker);
-    if (markerIndex <= 0) {
+    if (!isNpmLocalFileAliasSpec(spec)) {
         return spec;
     }
     const packageName = spec.slice(0, markerIndex);
     const target = spec.slice(markerIndex + marker.length);
-    if (packageName.trim().length === 0 || target.trim().length === 0) {
-        return spec;
-    }
     // `file://host/share` (exactly two leading slashes) is a UNC / network spec,
     // not a local path — leave it for npm to resolve.
     if (target.startsWith("//") && !target.startsWith("///")) {
@@ -403,29 +408,7 @@ export function normalizeNpmLocalFileAliasSpec(spec, cwd = process.cwd()) {
  * Supports current JSON metadata and the legacy filename-only form while
  * refusing absolute or traversing results before the filesystem is consulted.
  */
-function parsePackedNpmPackage(stdout, packDirectory) {
-    let parsed;
-    try {
-        parsed = JSON.parse(stdout);
-    }
-    catch {
-        // Fall back to the last stdout line for older npm output.
-    }
-    const first = Array.isArray(parsed)
-        ? parsed[0]
-        : undefined;
-    const filename = first &&
-        typeof first.filename === "string" &&
-        first.filename.trim().length > 0
-        ? first.filename
-        : stdout
-            .split(/\r?\n/)
-            .map((line) => line.trim())
-            .filter((line) => line.length > 0)
-            .at(-1);
-    if (!filename) {
-        throw new PmCliError("npm pack did not report a tarball filename.", EXIT_CODE.GENERIC_FAILURE);
-    }
+function resolvePackedTarball(packDirectory, filename) {
     const tarball = path.resolve(packDirectory, filename);
     const relativeTarball = path.relative(packDirectory, tarball);
     if (relativeTarball.length === 0 ||
@@ -438,10 +421,86 @@ function parsePackedNpmPackage(stdout, packDirectory) {
             why: "pm will not read a package-manager artifact outside the isolated directory created for this install.",
         });
     }
+    return tarball;
+}
+function decodePackedNpmCandidate(value, key) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const record = value;
+    if (typeof record.filename !== "string" ||
+        record.filename.trim().length === 0) {
+        return undefined;
+    }
+    return {
+        ...(key === undefined ? {} : { key }),
+        filename: record.filename,
+        ...(typeof record.name === "string" ? { name: record.name } : {}),
+        ...(typeof record.version === "string" ? { version: record.version } : {}),
+    };
+}
+function collectPackedNpmCandidates(parsed) {
+    const entries = Array.isArray(parsed)
+        ? parsed.map((value) => ({ value }))
+        : typeof parsed === "object" && parsed !== null
+            ? Object.entries(parsed).map(([key, value]) => ({ key, value }))
+            : [];
+    return entries.flatMap(({ key, value }) => {
+        const candidate = decodePackedNpmCandidate(value, key);
+        return candidate ? [candidate] : [];
+    });
+}
+function selectPackedNpmCandidate(candidates, expectedPackage) {
+    const normalizedExpected = expectedPackage?.trim().toLowerCase();
+    const matchingCandidates = normalizedExpected
+        ? candidates.filter((candidate) => {
+            const normalizedName = candidate.name?.trim().toLowerCase();
+            return normalizedName !== undefined
+                ? normalizedName === normalizedExpected
+                : candidate.key?.trim().toLowerCase() === normalizedExpected;
+        })
+        : [];
+    if (matchingCandidates.length === 1)
+        return matchingCandidates[0];
+    if (candidates.length !== 1)
+        return undefined;
+    const soleCandidate = candidates[0];
+    const soleIdentity = soleCandidate.name ?? soleCandidate.key;
+    return normalizedExpected &&
+        soleIdentity !== undefined &&
+        soleIdentity.trim().toLowerCase() !== normalizedExpected
+        ? undefined
+        : soleCandidate;
+}
+function parsePackedNpmPackage(stdout, packDirectory, expectedPackage) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        const filename = stdout
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0)
+            .at(-1);
+        if (!filename) {
+            throw new PmCliError("npm pack did not report a tarball filename.", EXIT_CODE.GENERIC_FAILURE);
+        }
+        return { tarball: resolvePackedTarball(packDirectory, filename) };
+    }
+    const candidates = collectPackedNpmCandidates(parsed);
+    const selected = selectPackedNpmCandidate(candidates, expectedPackage);
+    if (!selected) {
+        throw new PmCliError("npm pack --json returned an unsupported or ambiguous package receipt.", EXIT_CODE.GENERIC_FAILURE, {
+            code: "npm_pack_json_shape_unsupported",
+            required: "Use an npm client that returns an array of package receipts or an object keyed by package name, with exactly one requested package entry containing filename.",
+            why: `Well-formed JSON contained ${candidates.length} usable package receipt(s), but pm could not select ${expectedPackage ?? "one package"} deterministically.`,
+        });
+    }
     return {
-        tarball,
-        package: typeof first?.name === "string" ? first.name : undefined,
-        version: typeof first?.version === "string" ? first.version : undefined,
+        tarball: resolvePackedTarball(packDirectory, selected.filename),
+        package: selected.name ?? selected.key,
+        version: selected.version,
     };
 }
 async function resolveNpmSourceDirectory(source) {
@@ -486,7 +545,9 @@ async function resolveNpmSourceDirectoryWithRunner(source, npmRunner) {
             "--pack-destination",
             packDirectory,
         ]);
-        const packed = parsePackedNpmPackage(packStdout, packDirectory);
+        const packed = parsePackedNpmPackage(packStdout, packDirectory, isNpmLocalFileAliasSpec(source.spec)
+            ? undefined
+            : npmPackageNameFromSpec(source.spec));
         if (!(await pathExists(packed.tarball))) {
             throw new PmCliError("npm pack did not create its reported package archive.", EXIT_CODE.GENERIC_FAILURE, {
                 code: "npm_package_archive_missing",
@@ -994,4 +1055,4 @@ export const _testOnlyInstallSources = {
     runNpmCommand,
 };
 //# sourceMappingURL=install-sources.js.map
-//# debugId=404342eb-68ab-5b7d-9a5a-ade1c8e98546
+//# debugId=05f56edb-c08d-570c-b8b5-641fc694331e