@withbuddi/buddi 0.1.0-pre.21 → 0.1.0-pre.22

package/packages/gateway/dist/plugins/npm.js

@@ -114,9 +114,15 @@ export function createNpmRunner(opts = {}) {
                     // Not negotiable: this runs before the owner has approved anything.
                     '--ignore-scripts',
                     '--omit=dev',
+                    // Buddi provides the one peer a plugin has, @buddi/core; staging
+                    // links it after this. npm still *resolves* peers under
+                    // --omit=peer, which is why the package.json it reads carries an
+                    // override for core as well (stage.ts, `prepareForInstall`).
+                    '--omit=peer',
                     '--no-audit',
                     '--no-fund',
                     '--no-package-lock',
+                    '--no-update-notifier',
                     ...registryArgs(installOpts?.registry),
                 ], { cwd: dir, timeout: timeout * 5, maxBuffer });
             }

package/packages/gateway/dist/plugins/npm.js.map

@@ -1 +1 @@
-{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/plugins/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AA8BhC,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,gBAAgB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnG,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,QAAiB;IACrC,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,GAAY;IAC3C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,cAAc,CACvB,kFAAkF,IAAI,eAAe;YACnG,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;IAC3D,OAAO,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,eAAe,CAAC,OAAgD,EAAE;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAC1C,2EAA2E;IAC3E,4EAA4E;IAC5E,gBAAgB;IAChB,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ;YACvB,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE;oBAC7F,OAAO;oBACP,SAAS;iBACV,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC;YAC1D,CAAC;YACD,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;YACzG,OAAO,GAAmB,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ;YACpC,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CACrB,MAAM,EACN,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAChG,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,QAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAiC,CAAC;gBAClE,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;YACrD,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;YACpG,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW;YAC5B,IAAI,CAAC;gBACH,MAAM,GAAG,CACP,MAAM,EACN;oBACE,SAAS;oBACT,oEAAoE;oBACpE,kBAAkB;oBAClB,YAAY;oBACZ,YAAY;oBACZ,WAAW;oBACX,mBAAmB;oBACnB,GAAG,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC;iBACvC,EACD,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,SAAS,EAAE,CAC9C,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,SAAS,CAAC,kBAAkB,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/plugins/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAkChC,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,gBAAgB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnG,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,QAAiB;IACrC,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,GAAY;IAC3C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,cAAc,CACvB,kFAAkF,IAAI,eAAe;YACnG,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;IAC3D,OAAO,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,eAAe,CAAC,OAAgD,EAAE;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAC1C,2EAA2E;IAC3E,4EAA4E;IAC5E,gBAAgB;IAChB,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ;YACvB,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE;oBAC7F,OAAO;oBACP,SAAS;iBACV,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC;YAC1D,CAAC;YACD,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;YACzG,OAAO,GAAmB,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ;YACpC,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CACrB,MAAM,EACN,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAChG,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,QAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAiC,CAAC;gBAClE,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;YACrD,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;YACpG,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW;YAC5B,IAAI,CAAC;gBACH,MAAM,GAAG,CACP,MAAM,EACN;oBACE,SAAS;oBACT,oEAAoE;oBACpE,kBAAkB;oBAClB,YAAY;oBACZ,iEAAiE;oBACjE,wDAAwD;oBACxD,iEAAiE;oBACjE,6DAA6D;oBAC7D,aAAa;oBACb,YAAY;oBACZ,WAAW;oBACX,mBAAmB;oBACnB,sBAAsB;oBACtB,GAAG,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC;iBACvC,EACD,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,SAAS,EAAE,CAC9C,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,SAAS,CAAC,kBAAkB,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/packages/gateway/dist/plugins/scaffold.d.ts

@@ -19,13 +19,24 @@ export interface ScaffoldOptions {
     coreVersion: string;
     /**
      * An absolute path to the `@buddi/core` package of this installation, when
-     * there is one on disk. Core is not published yet, so the scaffold satisfies
-     * the peer with a `link:` devDependency pointing at it — exactly what the
-     * finance plugin does. Omitted, the devDependency is the published range and
-     * the README says to fix it up.
+     * there is one on disk. Core is not published, so for development the
+     * scaffold points the (optional) peer at it with a pnpm override in
+     * `pnpm-workspace.yaml` — a file `npm pack` never ships, so the tarball
+     * carries no `link:`. Omitted, the override is left commented out and the
+     * README says to fill it in.
      */
     coreDir?: string;
+    /**
+     * The SPDX identifier for `license` and the LICENSE placeholder. The author
+     * picks it (`--license`); when they do not, it is Apache-2.0, buddi's own,
+     * and the LICENSE file says that was a default.
+     */
+    license?: string;
 }
+/** The license a scaffold gets when the author names none. */
+export declare const DEFAULT_LICENSE = "Apache-2.0";
+/** An SPDX expression, loosely: identifiers, `+`, `.`, `-`, parentheses, AND/OR/WITH. */
+export declare function assertLicense(license: string): string;
 /** Every file the scaffold writes, keyed by its path relative to the root. */
 export declare function scaffoldFiles(opts: ScaffoldOptions): Record<string, string>;
 /** Write the scaffold. Refuses a directory that already exists. */

package/packages/gateway/dist/plugins/scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/plugins/scaffold.ts"],"names":[],"mappings":"AAqBA,6EAA6E;AAC7E,eAAO,MAAM,aAAa,QAAuB,CAAC;AAElD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWvD;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAe3E;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,MAAM,EAAE,CAiB1E"}
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/plugins/scaffold.ts"],"names":[],"mappings":"AAuBA,6EAA6E;AAC7E,eAAO,MAAM,aAAa,QAAuB,CAAC;AAElD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWvD;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8DAA8D;AAC9D,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASrD;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiB3E;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,MAAM,EAAE,CAiB1E"}

package/packages/gateway/dist/plugins/scaffold.js

@@ -4,7 +4,9 @@
  * The ten-minute path in `docs/plugins.md` starts here. Everything this writes
  * is something a plugin author would otherwise have to copy out of the guide by
  * hand and get subtly wrong: the `buddi` field that ties a package name to a
- * manifest name, the peer on `@buddi/core` (never a normal dependency), the
+ * manifest name, the peer on `@buddi/core` (never a normal dependency, and
+ * never a `link:` in anything `npm pack` ships — the development link is a
+ * pnpm override in `pnpm-workspace.yaml`, which is not packed), the
  * absolute `migrationsDir` resolved from the *built* file, one tool at each of
  * the two tiers a plugin should ship, and a `buddi.md` whose `Schema:` and
  * `Hosts:` lines already agree with the manifest so the first install shows no
@@ -42,21 +44,33 @@ export function assertScaffoldName(name) {
 export function schemaFor(name) {
     return name.replace(/-/g, '_');
 }
+/** The license a scaffold gets when the author names none. */
+export const DEFAULT_LICENSE = 'Apache-2.0';
+/** An SPDX expression, loosely: identifiers, `+`, `.`, `-`, parentheses, AND/OR/WITH. */
+export function assertLicense(license) {
+    const trimmed = license.trim();
+    if (!/^[A-Za-z0-9.+\-() ]+$/.test(trimmed) || trimmed.length > 100) {
+        throw new InstallRefusal('bad-license', `"${license}" is not an SPDX license identifier such as Apache-2.0, MIT or UNLICENSED.`);
+    }
+    return trimmed;
+}
 /** Every file the scaffold writes, keyed by its path relative to the root. */
 export function scaffoldFiles(opts) {
     const name = assertScaffoldName(opts.name);
     const schema = schemaFor(name);
-    const peer = `^${opts.coreVersion}`;
-    const link = opts.coreDir === undefined ? peer : `link:${opts.coreDir}`;
+    const peer = `>=${opts.coreVersion}`;
+    const license = assertLicense(opts.license ?? DEFAULT_LICENSE);
     return {
-        'package.json': packageJson(name, peer, link),
+        'package.json': packageJson(name, peer, license),
+        'pnpm-workspace.yaml': pnpmWorkspace(opts.coreDir),
+        LICENSE: licenseText(license, opts.license === undefined),
         'tsconfig.json': tsconfig(),
         'src/index.ts': indexTs(name, schema),
         'src/index.test.ts': testTs(name),
         [`migrations/001_${schema}.sql`]: migrationSql(name, schema),
         'buddi.md': buddiMd(name, schema),
         'README.md': readmeMd(name, schema, opts.coreDir),
-        '.gitignore': 'node_modules/\ndist/\n',
+        '.gitignore': 'node_modules/\ndist/\n*.tsbuildinfo\n*.tgz\n',
     };
 }
 /** Write the scaffold. Refuses a directory that already exists. */
@@ -78,34 +92,77 @@ export function writeScaffold(dir, opts) {
 /* ------------------------------------------------------------------ *
  * The files
  * ------------------------------------------------------------------ */
-function packageJson(name, peer, link) {
+function packageJson(name, peer, license) {
     return `${JSON.stringify({
         name: `buddi-plugin-${name}`,
         version: '0.1.0',
         description: `A buddi plugin: ${name}.`,
         keywords: ['buddi-plugin'],
+        license,
         type: 'module',
         main: './dist/index.js',
         types: './dist/index.d.ts',
         exports: { '.': { types: './dist/index.d.ts', default: './dist/index.js' } },
-        buddi: { manifest: 'manifest', core: peer, uses: [], hostApi: '^1.0' },
+        buddi: { name, manifest: 'manifest', core: peer, uses: [], hostApi: '^1.0' },
         scripts: {
             build: 'tsc -p tsconfig.json',
             typecheck: 'tsc -p tsconfig.json --emitDeclarationOnly',
             test: 'vitest run',
+            // `npm pack`, `pnpm pack` and `npm publish` all build first.
+            prepack: 'tsc -p tsconfig.json',
         },
         dependencies: { pg: '^8.13.1', zod: '^3.24.1' },
+        // Buddi provides core to an installed plugin; nobody installs it from a
+        // registry. Optional, so no package manager goes looking for it.
         peerDependencies: { '@buddi/core': peer },
+        peerDependenciesMeta: { '@buddi/core': { optional: true } },
         devDependencies: {
-            '@buddi/core': link,
             '@types/node': '^22.10.2',
             '@types/pg': '^8.11.10',
             typescript: '^5.6.3',
             vitest: '^2.1.8',
         },
-        files: ['dist', 'migrations', 'buddi.md'],
+        // Source maps point at src/, which is not shipped.
+        files: ['dist', '!dist/**/*.map', '!dist/**/*.tsbuildinfo', 'migrations', 'buddi.md'],
     }, null, 2)}\n`;
 }
+/**
+ * The development link to core, where `npm pack` cannot see it.
+ *
+ * pnpm reads `overrides` from here and links the optional peer for `pnpm
+ * install`, `pnpm build` and `pnpm test`; the packed tarball has only the peer
+ * range. `allowBuilds` lets vitest's esbuild unpack its binary.
+ */
+function pnpmWorkspace(coreDir) {
+    const override = coreDir === undefined
+        ? `# Point core at a built buddi checkout for development (never shipped):
+# overrides:
+#   '@buddi/core': 'link:/path/to/buddi/packages/core'
+`
+        : `# The core this plugin is developed against. Never shipped: npm pack does not
+# include this file, and an installed plugin gets the core of the buddi that
+# installs it.
+overrides:
+  '@buddi/core': ${JSON.stringify(`link:${coreDir}`)}
+`;
+    return `${override}allowBuilds:
+  esbuild: true
+`;
+}
+function licenseText(license, defaulted) {
+    const chosen = defaulted
+        ? `buddi plugins init chose ${license}, buddi's own license, because no --license was given.
+Change "license" in package.json and this file together if you want another.`
+        : `Licensed under ${license}, as chosen with buddi plugins init --license.`;
+    return `${chosen}
+
+Replace this placeholder with the full text of the license before you publish
+(for Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt), and put your
+name and the year here:
+
+Copyright [yyyy] [name of copyright owner]
+`;
+}
 function tsconfig() {
     return `${JSON.stringify({
         compilerOptions: {
@@ -371,13 +428,12 @@ Hosts: none
 }
 function readmeMd(name, schema, coreDir) {
     const core = coreDir === undefined
-        ? 'Point the `@buddi/core` devDependency at a published version, or at a buddi\ncheckout: `"@buddi/core": "link:/path/to/buddi/packages/core"`.'
-        : `The \`@buddi/core\` devDependency is a \`link:\` at the installation this was
-scaffolded from (\`${coreDir}\`). That checkout must be built (\`pnpm -r build\`)
-before this compiles: the link points at the package, and its types and entry
-point are in its \`dist\`. When core is published the devDependency becomes the
-published range and nothing else changes — the peer range is already the
-contract.`;
+        ? 'Core is an optional peer, and nothing installs it for you. For development, uncomment\nthe override in `pnpm-workspace.yaml` and point it at a built buddi checkout\n(`link:/path/to/buddi/packages/core`).'
+        : `Core is an optional peer. For development, \`pnpm-workspace.yaml\` points it at
+the installation this was scaffolded from (\`${coreDir}\`) with a pnpm override;
+that file is never packed, so what you publish carries the peer range and no
+link. The linked core must be built (\`pnpm -r build\` in a checkout) before
+this compiles: its types and entry point are in its \`dist\`.`;
     return `# buddi-plugin-${name}
 
 A [buddi](https://github.com/withbuddi/buddi) plugin. It exports a
@@ -410,6 +466,18 @@ Plugins page (or in the agent's own \`tools:\` line).
 While you are working on it, \`buddi plugins dev .\` watches \`dist\` and tells you
 — or the service — to restart when the build changes.
 
+## Publish it
+
+\`\`\`sh
+npm pack      # builds first (prepack) and writes buddi-plugin-${name}-0.1.0.tgz
+buddi plugins install ./buddi-plugin-${name}-0.1.0.tgz   # exactly what you would publish
+npm publish --provenance --access public
+\`\`\`
+
+Publish under a name or scope you own (\`@you/buddi-plugin-${name}\`), never
+under \`@buddi\`: buddi does not own that scope on npm. \`buddi.name\` in
+package.json is the plugin's name whatever the package is called.
+
 ## What is here
 
 | | |
@@ -417,6 +485,8 @@ While you are working on it, \`buddi plugins dev .\` watches \`dist\` and tells
 | \`src/index.ts\` | the manifest: one \`auto\` tool, one \`gated\` tool with \`describe\`, a source stub |
 | \`migrations/001_${schema}.sql\` | the Postgres schema this plugin owns |
 | \`buddi.md\` | what the owner reads before anything is imported |
+| \`pnpm-workspace.yaml\` | the development link to core; not packed |
+| \`LICENSE\` | a placeholder: put the full license text here |
 
 The guide is \`docs/plugins.md\` in the buddi repository. Read it before you ship:
 the tiers, the effect envelope and what a gated \`execute\` owes the owner are all

package/packages/gateway/dist/plugins/scaffold.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/plugins/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,cAAc,CACtB,UAAU,EACV,IAAI,IAAI,+EAA+E;YACrF,0FAA0F;YAC1F,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAiBD,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAqB;IACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;IACxE,OAAO;QACL,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAC7C,eAAe,EAAE,QAAQ,EAAE;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACrC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC;QACjC,CAAC,kBAAkB,MAAM,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QAC5D,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC;QACjD,YAAY,EAAE,wBAAwB;KACvC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAqB;IAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,GAAG,GAAG,mFAAmF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;wEAEwE;AAExE,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IAC3D,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,IAAI,EAAE,gBAAgB,IAAI,EAAE;QAC5B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,mBAAmB,IAAI,GAAG;QACvC,QAAQ,EAAE,CAAC,cAAc,CAAC;QAC1B,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE;QAC5E,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;QACtE,OAAO,EAAE;YACP,KAAK,EAAE,sBAAsB;YAC7B,SAAS,EAAE,4CAA4C;YACvD,IAAI,EAAE,YAAY;SACnB;QACD,YAAY,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;QAC/C,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;QACzC,eAAe,EAAE;YACf,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,UAAU;YACzB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,QAAQ;SACjB;QACD,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;KAC1C,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,UAAU;YAClB,gBAAgB,EAAE,UAAU;YAC5B,GAAG,EAAE,CAAC,QAAQ,CAAC;YACf,MAAM,EAAE,IAAI;YACZ,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;YAC9B,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI;SACnB;QACD,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,OAAO,EAAE,CAAC,kBAAkB,CAAC;KAC9B,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO;KACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8CE,IAAI;;;;;;;;;;;uDAWwC,MAAM;;;;;;;;;;;;;;;;;;6DAkBA,IAAI;;;;WAItD,IAAI;;;;;;;;;;;;;oEAaqD,MAAM;;;2BAG/C,IAAI;;;;;;;;;;;;;yBAaN,IAAI;;;mEAGsC,MAAM;;;;;;;;;;;;;;;;;;YAkB7D,IAAI;;;;;;;;;;;;;;WAcL,IAAI;;;aAGF,MAAM;;;;;;;;;;;;;;;;CAgBlB,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO;;;;;;;;;;;;;YAaG,IAAI;;;;2BAIW,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,MAAM,IAAI;;6CAE0B,MAAM;;;;;;;;;;;CAWlD,CAAC;AACF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,KAAK,IAAI;;;;;;;;;UASR,MAAM;;CAEf,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,OAA2B;IACzE,MAAM,IAAI,GACR,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,8IAA8I;QAChJ,CAAC,CAAC;qBACa,OAAO;;;;UAIlB,CAAC;IACT,OAAO,kBAAkB,IAAI;;;;;;;;;;;;;;;EAe7B,IAAI;;;;;;;;;;;2CAWqC,IAAI;;;;;;;;;;;qBAW1B,MAAM;;;;;;CAM1B,CAAC;AACF,CAAC"}
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/plugins/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,cAAc,CACtB,UAAU,EACV,IAAI,IAAI,+EAA+E;YACrF,0FAA0F;YAC1F,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAwBD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACnE,MAAM,IAAI,cAAc,CACtB,aAAa,EACb,IAAI,OAAO,4EAA4E,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAqB;IACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC;IAC/D,OAAO;QACL,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAChD,qBAAqB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAClD,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;QACzD,eAAe,EAAE,QAAQ,EAAE;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACrC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC;QACjC,CAAC,kBAAkB,MAAM,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QAC5D,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC;QACjD,YAAY,EAAE,8CAA8C;KAC7D,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAqB;IAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,GAAG,GAAG,mFAAmF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;wEAEwE;AAExE,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;IAC9D,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,IAAI,EAAE,gBAAgB,IAAI,EAAE;QAC5B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,mBAAmB,IAAI,GAAG;QACvC,QAAQ,EAAE,CAAC,cAAc,CAAC;QAC1B,OAAO;QACP,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE;QAC5E,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;QAC5E,OAAO,EAAE;YACP,KAAK,EAAE,sBAAsB;YAC7B,SAAS,EAAE,4CAA4C;YACvD,IAAI,EAAE,YAAY;YAClB,6DAA6D;YAC7D,OAAO,EAAE,sBAAsB;SAChC;QACD,YAAY,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;QAC/C,wEAAwE;QACxE,iEAAiE;QACjE,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;QACzC,oBAAoB,EAAE,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC3D,eAAe,EAAE;YACf,aAAa,EAAE,UAAU;YACzB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,QAAQ;SACjB;QACD,mDAAmD;QACnD,KAAK,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,YAAY,EAAE,UAAU,CAAC;KACtF,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAA2B;IAChD,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC;;;CAGP;QACK,CAAC,CAAC;;;;mBAIW,IAAI,CAAC,SAAS,CAAC,QAAQ,OAAO,EAAE,CAAC;CACnD,CAAC;IACA,OAAO,GAAG,QAAQ;;CAEnB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,SAAkB;IACtD,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,4BAA4B,OAAO;6EACoC;QACzE,CAAC,CAAC,kBAAkB,OAAO,gDAAgD,CAAC;IAC9E,OAAO,GAAG,MAAM;;;;;;;CAOjB,CAAC;AACF,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,UAAU;YAClB,gBAAgB,EAAE,UAAU;YAC5B,GAAG,EAAE,CAAC,QAAQ,CAAC;YACf,MAAM,EAAE,IAAI;YACZ,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;YAC9B,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI;SACnB;QACD,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,OAAO,EAAE,CAAC,kBAAkB,CAAC;KAC9B,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO;KACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8CE,IAAI;;;;;;;;;;;uDAWwC,MAAM;;;;;;;;;;;;;;;;;;6DAkBA,IAAI;;;;WAItD,IAAI;;;;;;;;;;;;;oEAaqD,MAAM;;;2BAG/C,IAAI;;;;;;;;;;;;;yBAaN,IAAI;;;mEAGsC,MAAM;;;;;;;;;;;;;;;;;;YAkB7D,IAAI;;;;;;;;;;;;;;WAcL,IAAI;;;aAGF,MAAM;;;;;;;;;;;;;;;;CAgBlB,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO;;;;;;;;;;;;;YAaG,IAAI;;;;2BAIW,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,MAAM,IAAI;;6CAE0B,MAAM;;;;;;;;;;;CAWlD,CAAC;AACF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,KAAK,IAAI;;;;;;;;;UASR,MAAM;;CAEf,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,OAA2B;IACzE,MAAM,IAAI,GACR,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,6MAA6M;QAC/M,CAAC,CAAC;+CACuC,OAAO;;;8DAGQ,CAAC;IAC7D,OAAO,kBAAkB,IAAI;;;;;;;;;;;;;;;EAe7B,IAAI;;;;;;;;;;;2CAWqC,IAAI;;;;;;;;;iEASkB,IAAI;uCAC9B,IAAI;;;;6DAIkB,IAAI;;;;;;;;;qBAS5C,MAAM;;;;;;;;CAQ1B,CAAC;AACF,CAAC"}

package/packages/gateway/dist/plugins/stage.d.ts

@@ -52,8 +52,23 @@ export interface StagedPlugin {
      * the developer's own and change every time they build.
      */
     stagedHash: string;
-    /** The name its manifest must answer to: `buddi.name`, or the package name. */
+    /**
+     * The name its manifest must answer to: `buddi.name`, or the package name
+     * when it declares none (and then `nameFromManifest` is set).
+     */
     declaredName: string;
+    /**
+     * It declares no `buddi.name`, so it installs under whatever name its
+     * manifest gives, read at approval — unless a different package is already
+     * installed under that name. Absent on a stage written before this existed,
+     * which keeps the old rule: the package name must be the manifest's.
+     */
+    nameFromManifest?: boolean;
+    /**
+     * It lists `@buddi/core` as an ordinary dependency. npm was not asked for it
+     * — buddi provides its own — and the card says so.
+     */
+    coreAsDependency?: boolean;
     /** The `buddi` field of package.json, if any. */
     buddi?: {
         manifest?: string;
@@ -200,6 +215,25 @@ export declare function readClaims(packageDir: string): PluginClaims;
  * about itself. Imports nothing.
  */
 export declare function stagePlugin(spec: string | PluginSpec, opts?: StageOptions): Promise<StagedPlugin>;
+export declare const CORE_PACKAGE = "@buddi/core";
+/**
+ * The package.json `npm install` reads in a stage. Pure: the author's file is
+ * restored byte for byte once npm is done.
+ *
+ * npm reads more of a package.json than `--omit` suggests. `--omit=dev` still
+ * parses devDependencies, so a `link:` to the author's checkout fails the
+ * whole install; `--omit=peer` still *resolves* peers, so an unpublished core
+ * is a 404 — and a published one would be fetched, from whoever owns the name
+ * on that registry. So npm is given a file with no devDependencies, no
+ * `@buddi/core` anywhere a dependency can be named, and an override that
+ * points core at `corePlaceholder`, a local directory: a dependency of the
+ * plugin that asks for core itself is answered from disk too. Buddi links its
+ * own core in afterwards (`linkCore`).
+ */
+export declare function packageJsonForInstall(pkg: Record<string, any>, corePlaceholder: string): {
+    pkg: Record<string, any>;
+    coreRemovedFrom: string[];
+};
 /** Does this package directory still look like the one that was staged? */
 export declare function stagedPackageExists(staged: StagedPlugin): boolean;
 //# sourceMappingURL=stage.d.ts.map

package/packages/gateway/dist/plugins/stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stage.d.ts","sourceRoot":"","sources":["../../src/plugins/stage.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAmC,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAmB,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAM1E,sEAAsE;AACtE,eAAO,MAAM,cAAc,QAMD,CAAC;AAE3B,uEAAuE;AACvE,eAAO,MAAM,YAAY,QAAsB,CAAC;AAEhD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IACnB,sFAAsF;IACtF,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,kBAAkB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAFvB,SAAkB,IAAI,kBAAkB;gBAE7B,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,yBAAyB,GACzB,SAAS,GACT,MAAM,GACN,QAAQ,CAAC;AAEb,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,iEAAiE;IACjE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,uEAAuE;IACvE,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAWD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAMzF;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAGtD;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,EAAE,CAa/E;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAKtF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC9C,MAAM,EAAE,CAYV;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC9C,MAAM,EAAE,CAoBV;AAMD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C7E;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,SAAS,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAOvE;AAID,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,MAAM,EAAE,CAEpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CA2CvE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASjF;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA6BtE;AAWD,kFAAkF;AAClF,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAkBnD;AAcD,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAM3D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,YAAY,CAAC,CAsMvB;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAMjE"}
+{"version":3,"file":"stage.d.ts","sourceRoot":"","sources":["../../src/plugins/stage.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAmC,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAmB,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAM1E,sEAAsE;AACtE,eAAO,MAAM,cAAc,QAMD,CAAC;AAE3B,uEAAuE;AACvE,eAAO,MAAM,YAAY,QAAsB,CAAC;AAEhD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IACnB,sFAAsF;IACtF,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,kBAAkB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAFvB,SAAkB,IAAI,kBAAkB;gBAE7B,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,yBAAyB,GACzB,SAAS,GACT,MAAM,GACN,QAAQ,CAAC;AAEb,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,iEAAiE;IACjE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,uEAAuE;IACvE,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAWD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAMzF;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAGtD;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,EAAE,CAa/E;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAKtF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC9C,MAAM,EAAE,CAYV;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC9C,MAAM,EAAE,CAoBV;AAMD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C7E;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,SAAS,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAOvE;AAID,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,MAAM,EAAE,CAEpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CA2CvE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASjF;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA6BtE;AAWD,kFAAkF;AAClF,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAkBnD;AAcD,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAM3D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,YAAY,CAAC,CA8MvB;AAMD,eAAO,MAAM,YAAY,gBAAgB,CAAC;AAa1C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxB,eAAe,EAAE,MAAM,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAmBzD;AAyED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAMjE"}

package/packages/gateway/dist/plugins/stage.js

@@ -13,7 +13,9 @@
  *    integrity hash, publisher, its `buddi` field, its scripts;
  *  - fetches it (`npm pack`) and extracts it into a staging directory;
  *  - installs its dependencies with `--ignore-scripts`, because a dependency's
- *    `postinstall` is arbitrary code and no approval exists yet;
+ *    `postinstall` is arbitrary code and no approval exists yet — from a
+ *    package.json with its development half and every mention of
+ *    `@buddi/core` taken out, so npm never asks any registry for core;
  *  - points the staged tree's `@buddi/core` at the core this gateway is
  *    running, because a plugin holding a second copy of core would register
  *    tools into a registry nobody reads and talk to a pool nobody owns;
@@ -482,10 +484,14 @@ export async function stagePlugin(spec, opts = {}) {
         }
         // The name its manifest has to answer to. A published package is usually
         // `buddi-plugin-weather` while its manifest is `weather`, so the package
-        // may say which name is its own; if it does not, the two must match.
-        const declaredName = typeof pkg.buddi?.name === 'string' && pkg.buddi.name.trim() !== ''
-            ? pkg.buddi.name.trim()
-            : pkg.name;
+        // may say which name is its own, and then the two must match. If it does
+        // not, the manifest's name is the plugin's, read at approval
+        // (`assertNameMatches` in approve.ts keeps it off another plugin's name).
+        const nameFromManifest = !(typeof pkg.buddi?.name === 'string' && pkg.buddi.name.trim() !== '');
+        const declaredName = nameFromManifest ? pkg.name : pkg.buddi.name.trim();
+        const coreAsDependency = typeof pkg.dependencies === 'object' &&
+            pkg.dependencies !== null &&
+            Object.hasOwn(pkg.dependencies, CORE_PACKAGE);
         /*
          * What it reaches in buddi, and which buddi it was built for — both read
          * from package.json, because nothing of the package may be imported yet,
@@ -505,13 +511,13 @@ export async function stagePlugin(spec, opts = {}) {
         if (parsed.kind !== 'directory' && opts.skipDependencies !== true) {
             phase('installing-dependencies');
             const registry = parsed.kind === 'registry' ? parsed.registry : undefined;
-            const declared = Object.keys(pkg.dependencies ?? {}).filter((d) => d !== '@buddi/core');
+            const declared = Object.keys(pkg.dependencies ?? {}).filter((d) => d !== CORE_PACKAGE);
             if (declared.length > 0) {
-                await npm.install(packageDir, { ...(registry === undefined ? {} : { registry }) });
+                await installWithoutCore(packageDir, dir, pkg, () => npm.install(packageDir, { ...(registry === undefined ? {} : { registry }) }));
             }
         }
         if (parsed.kind !== 'directory')
-            linkCore(packageDir);
+            linkNestedCores(packageDir, linkCore(packageDir));
         phase('reading');
         /*
          * The hash of what will run, taken once the tree is final: the package, the
@@ -542,6 +548,8 @@ export async function stagePlugin(spec, opts = {}) {
             integrity,
             stagedHash,
             declaredName,
+            ...(nameFromManifest ? { nameFromManifest: true } : {}),
+            ...(coreAsDependency ? { coreAsDependency: true } : {}),
             ...(pkg.buddi === undefined
                 ? {}
                 : {
@@ -579,6 +587,124 @@ export async function stagePlugin(spec, opts = {}) {
         throw err;
     }
 }
+/* ------------------------------------------------------------------ *
+ * What npm is allowed to read
+ * ------------------------------------------------------------------ */
+export const CORE_PACKAGE = '@buddi/core';
+/** An `overrides` object with every key naming core taken out, at any depth. */
+function withoutCoreOverrides(overrides) {
+    if (typeof overrides !== 'object' || overrides === null || Array.isArray(overrides))
+        return {};
+    const out = {};
+    for (const [key, value] of Object.entries(overrides)) {
+        if (key === CORE_PACKAGE || key.startsWith(`${CORE_PACKAGE}@`))
+            continue;
+        out[key] = typeof value === 'object' && value !== null ? withoutCoreOverrides(value) : value;
+    }
+    return out;
+}
+/**
+ * The package.json `npm install` reads in a stage. Pure: the author's file is
+ * restored byte for byte once npm is done.
+ *
+ * npm reads more of a package.json than `--omit` suggests. `--omit=dev` still
+ * parses devDependencies, so a `link:` to the author's checkout fails the
+ * whole install; `--omit=peer` still *resolves* peers, so an unpublished core
+ * is a 404 — and a published one would be fetched, from whoever owns the name
+ * on that registry. So npm is given a file with no devDependencies, no
+ * `@buddi/core` anywhere a dependency can be named, and an override that
+ * points core at `corePlaceholder`, a local directory: a dependency of the
+ * plugin that asks for core itself is answered from disk too. Buddi links its
+ * own core in afterwards (`linkCore`).
+ */
+export function packageJsonForInstall(pkg, corePlaceholder) {
+    const out = JSON.parse(JSON.stringify(pkg));
+    delete out.devDependencies;
+    const coreRemovedFrom = [];
+    for (const field of ['dependencies', 'peerDependencies', 'optionalDependencies']) {
+        const deps = out[field];
+        if (typeof deps === 'object' && deps !== null && Object.hasOwn(deps, CORE_PACKAGE)) {
+            delete deps[CORE_PACKAGE];
+            coreRemovedFrom.push(field);
+        }
+    }
+    if (typeof out.peerDependenciesMeta === 'object' && out.peerDependenciesMeta !== null) {
+        delete out.peerDependenciesMeta[CORE_PACKAGE];
+    }
+    for (const field of ['bundleDependencies', 'bundledDependencies']) {
+        if (Array.isArray(out[field]))
+            out[field] = out[field].filter((d) => d !== CORE_PACKAGE);
+    }
+    out.overrides = { ...withoutCoreOverrides(out.overrides), [CORE_PACKAGE]: `file:${corePlaceholder}` };
+    return { pkg: out, coreRemovedFrom };
+}
+/**
+ * Run `install` with the package.json npm is allowed to read, then put the
+ * author's back. The placeholder core npm may have been pointed at lives in
+ * the stage directory, outside the package, and is gone when this returns.
+ */
+async function installWithoutCore(packageDir, stage, pkg, install) {
+    const file = path.join(packageDir, 'package.json');
+    const original = readFileSync(file);
+    const placeholder = path.join(stage, 'core-placeholder');
+    mkdirSync(placeholder, { recursive: true });
+    writeFileSync(path.join(placeholder, 'package.json'), `${JSON.stringify({ name: CORE_PACKAGE, version: runningCoreVersion(), private: true })}\n`);
+    try {
+        writeFileSync(file, `${JSON.stringify(packageJsonForInstall(pkg, placeholder).pkg, null, 2)}\n`);
+        await install();
+    }
+    finally {
+        writeFileSync(file, original);
+        rmSync(placeholder, { recursive: true, force: true });
+    }
+}
+/** The version of the core this gateway runs, or `0.0.0` when it cannot tell. */
+function runningCoreVersion() {
+    const dir = resolveCoreDir();
+    if (dir === undefined)
+        return '0.0.0';
+    try {
+        const pkg = JSON.parse(readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/**
+ * Every `node_modules/@buddi/core` below the package's own, which only a
+ * dependency asking for core can have put there: each becomes the same
+ * plugin-only core `linkCore` writes at the top.
+ */
+function linkNestedCores(packageDir, coreDir) {
+    const visit = (modules, depth) => {
+        if (depth > 32 || !lstatOrUndefined(modules)?.isDirectory())
+            return;
+        for (const entry of readdirSync(modules, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const full = path.join(modules, entry.name);
+            const packages = entry.name.startsWith('@')
+                ? readdirSync(full, { withFileTypes: true })
+                    .filter((e) => e.isDirectory() || e.isSymbolicLink())
+                    .map((e) => ({ name: `${entry.name}/${e.name}`, dir: path.join(full, e.name) }))
+                : [{ name: entry.name, dir: full }];
+            for (const pkg of packages) {
+                if (!lstatOrUndefined(pkg.dir)?.isDirectory())
+                    continue;
+                const nested = path.join(pkg.dir, 'node_modules');
+                const core = path.join(nested, '@buddi', 'core');
+                if (lstatOrUndefined(core) !== undefined) {
+                    rmSync(core, { recursive: true, force: true });
+                    if (coreDir !== undefined)
+                        writePluginOnlyCore(core, coreDir);
+                }
+                visit(nested, depth + 1);
+            }
+        }
+    };
+    visit(path.join(packageDir, 'node_modules'), 0);
+}
 /** Does this package directory still look like the one that was staged? */
 export function stagedPackageExists(staged) {
     try {