@withbuddi/buddi 0.1.0-pre.21 → 0.1.0-pre.23

package/packages/gateway/dist/plugins/scaffold.js

@@ -4,7 +4,9 @@
  * The ten-minute path in `docs/plugins.md` starts here. Everything this writes
  * is something a plugin author would otherwise have to copy out of the guide by
  * hand and get subtly wrong: the `buddi` field that ties a package name to a
- * manifest name, the peer on `@buddi/core` (never a normal dependency), the
+ * manifest name, the peer on `@buddi/core` (never a normal dependency, and
+ * never a `link:` in anything `npm pack` ships — the development link is a
+ * pnpm override in `pnpm-workspace.yaml`, which is not packed), the
  * absolute `migrationsDir` resolved from the *built* file, one tool at each of
  * the two tiers a plugin should ship, and a `buddi.md` whose `Schema:` and
  * `Hosts:` lines already agree with the manifest so the first install shows no
@@ -17,6 +19,7 @@
  */
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
+import { AUTHOR_NAME_MAX } from '@buddi/core';
 import { InstallRefusal } from './refusals.js';
 /** A plugin name: lowercase, digits, `-` and `_`, starting with a letter. */
 export const SCAFFOLD_NAME = /^[a-z][a-z0-9_-]*$/;
@@ -42,21 +45,43 @@ export function assertScaffoldName(name) {
 export function schemaFor(name) {
     return name.replace(/-/g, '_');
 }
+/** The license a scaffold gets when the author names none. */
+export const DEFAULT_LICENSE = 'Apache-2.0';
+/** An SPDX expression, loosely: identifiers, `+`, `.`, `-`, parentheses, AND/OR/WITH. */
+export function assertLicense(license) {
+    const trimmed = license.trim();
+    if (!/^[A-Za-z0-9.+\-() ]+$/.test(trimmed) || trimmed.length > 100) {
+        throw new InstallRefusal('bad-license', `"${license}" is not an SPDX license identifier such as Apache-2.0, MIT or UNLICENSED.`);
+    }
+    return trimmed;
+}
+/** An author's name as the manifest takes it: 1–80 characters. */
+export function assertAuthor(author) {
+    const trimmed = author.trim();
+    if (trimmed === '' || trimmed.length > AUTHOR_NAME_MAX) {
+        throw new InstallRefusal('bad-author', `"${author}" is not an author's name: 1 to ${AUTHOR_NAME_MAX} characters.`);
+    }
+    return trimmed;
+}
 /** Every file the scaffold writes, keyed by its path relative to the root. */
 export function scaffoldFiles(opts) {
     const name = assertScaffoldName(opts.name);
     const schema = schemaFor(name);
-    const peer = `^${opts.coreVersion}`;
-    const link = opts.coreDir === undefined ? peer : `link:${opts.coreDir}`;
+    const peer = `>=${opts.coreVersion}`;
+    const license = assertLicense(opts.license ?? DEFAULT_LICENSE);
+    const author = opts.author === undefined ? undefined : assertAuthor(opts.author);
     return {
-        'package.json': packageJson(name, peer, link),
+        'package.json': packageJson(name, peer, license, author),
+        'pnpm-workspace.yaml': pnpmWorkspace(opts.coreDir),
+        LICENSE: licenseText(license, opts.license === undefined),
         'tsconfig.json': tsconfig(),
-        'src/index.ts': indexTs(name, schema),
+        'src/index.ts': indexTs(name, schema, author),
+        'src/version.ts': versionTs(),
         'src/index.test.ts': testTs(name),
         [`migrations/001_${schema}.sql`]: migrationSql(name, schema),
         'buddi.md': buddiMd(name, schema),
         'README.md': readmeMd(name, schema, opts.coreDir),
-        '.gitignore': 'node_modules/\ndist/\n',
+        '.gitignore': 'node_modules/\ndist/\n*.tsbuildinfo\n*.tgz\n',
     };
 }
 /** Write the scaffold. Refuses a directory that already exists. */
@@ -78,34 +103,78 @@ export function writeScaffold(dir, opts) {
 /* ------------------------------------------------------------------ *
  * The files
  * ------------------------------------------------------------------ */
-function packageJson(name, peer, link) {
+function packageJson(name, peer, license, author) {
     return `${JSON.stringify({
         name: `buddi-plugin-${name}`,
         version: '0.1.0',
         description: `A buddi plugin: ${name}.`,
         keywords: ['buddi-plugin'],
+        ...(author === undefined ? {} : { author: { name: author } }),
+        license,
         type: 'module',
         main: './dist/index.js',
         types: './dist/index.d.ts',
         exports: { '.': { types: './dist/index.d.ts', default: './dist/index.js' } },
-        buddi: { manifest: 'manifest', core: peer, uses: [], hostApi: '^1.0' },
+        buddi: { name, manifest: 'manifest', core: peer, uses: [], hostApi: '^1.0' },
         scripts: {
             build: 'tsc -p tsconfig.json',
             typecheck: 'tsc -p tsconfig.json --emitDeclarationOnly',
             test: 'vitest run',
+            // `npm pack`, `pnpm pack` and `npm publish` all build first.
+            prepack: 'tsc -p tsconfig.json',
         },
         dependencies: { pg: '^8.13.1', zod: '^3.24.1' },
+        // Buddi provides core to an installed plugin; nobody installs it from a
+        // registry. Optional, so no package manager goes looking for it.
         peerDependencies: { '@buddi/core': peer },
+        peerDependenciesMeta: { '@buddi/core': { optional: true } },
         devDependencies: {
-            '@buddi/core': link,
             '@types/node': '^22.10.2',
             '@types/pg': '^8.11.10',
             typescript: '^5.6.3',
             vitest: '^2.1.8',
         },
-        files: ['dist', 'migrations', 'buddi.md'],
+        // Source maps point at src/, which is not shipped.
+        files: ['dist', '!dist/**/*.map', '!dist/**/*.tsbuildinfo', 'migrations', 'buddi.md'],
     }, null, 2)}\n`;
 }
+/**
+ * The development link to core, where `npm pack` cannot see it.
+ *
+ * pnpm reads `overrides` from here and links the optional peer for `pnpm
+ * install`, `pnpm build` and `pnpm test`; the packed tarball has only the peer
+ * range. `allowBuilds` lets vitest's esbuild unpack its binary.
+ */
+function pnpmWorkspace(coreDir) {
+    const override = coreDir === undefined
+        ? `# Point core at a built buddi checkout for development (never shipped):
+# overrides:
+#   '@buddi/core': 'link:/path/to/buddi/packages/core'
+`
+        : `# The core this plugin is developed against. Never shipped: npm pack does not
+# include this file, and an installed plugin gets the core of the buddi that
+# installs it.
+overrides:
+  '@buddi/core': ${JSON.stringify(`link:${coreDir}`)}
+`;
+    return `${override}allowBuilds:
+  esbuild: true
+`;
+}
+function licenseText(license, defaulted) {
+    const chosen = defaulted
+        ? `buddi plugins init chose ${license}, buddi's own license, because no --license was given.
+Change "license" in package.json and this file together if you want another.`
+        : `Licensed under ${license}, as chosen with buddi plugins init --license.`;
+    return `${chosen}
+
+Replace this placeholder with the full text of the license before you publish
+(for Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt), and put your
+name and the year here:
+
+Copyright [yyyy] [name of copyright owner]
+`;
+}
 function tsconfig() {
     return `${JSON.stringify({
         compilerOptions: {
@@ -126,7 +195,7 @@ function tsconfig() {
         exclude: ['src/**/*.test.ts'],
     }, null, 2)}\n`;
 }
-function indexTs(name, schema) {
+function indexTs(name, schema, author) {
     return `/**
  * ${name} — a buddi plugin.
  *
@@ -141,6 +210,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import type { EffectDescription, PluginManifest, ToolDefinition } from '@buddi/core/plugin';
 import { z } from 'zod';
+import { VERSION } from './version.js';
 
 /**
  * Absolute, and resolved from the *built* file so it is right from \`dist\`.
@@ -272,14 +342,20 @@ export const forgetNote: ToolDefinition<z.infer<typeof forgetInput>, { deleted:
 
 export const manifest: PluginManifest = {
   name: '${name}',
-  // Bumping this voids every standing approval for this plugin's tools.
-  version: '0.1.0',
+  // package.json's version (src/version.ts). Bumping it voids every standing
+  // approval for this plugin's tools.
+  version: VERSION,
   schema: '${schema}',
   migrationsDir: MIGRATIONS_DIR,
   tools: [listNotes, forgetNote],
   // One line, shown before anybody installs you.
   description: 'Keeps short notes, and deletes one when the owner says so.',
-  // Every host you intend to reach, and why. Documentation, not a sandbox —
+${author === undefined
+        ? ''
+        : `  // Who made it: "by <name>" on the install card. The name must match
+  // package.json's author, which is what the card reads before this is imported.
+  author: { name: ${JSON.stringify(author)} },
+`}  // Every host you intend to reach, and why. Documentation, not a sandbox —
   // and it is compared with your buddi.md at install.
   network: [],
   // The areas of \`ctx.buddi\` you reach beyond your own schema, directory and
@@ -292,6 +368,19 @@ export const manifest: PluginManifest = {
 export default manifest;
 `;
 }
+function versionTs() {
+    return `/**
+ * The manifest's version, read from this plugin's own package.json when the
+ * module loads, so the two can never drift. \`../package.json\` resolves from
+ * both \`src/\` (tests) and \`dist/\` (the built plugin); npm always packs it.
+ */
+import { readFileSync } from 'node:fs';
+
+export const VERSION: string = (
+  JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version: string }
+).version;
+`;
+}
 function testTs(name) {
     return `/**
  * The manifest, through core's own validation.
@@ -302,11 +391,17 @@ function testTs(name) {
  * the manifest here is therefore the cheapest possible proof that this plugin
  * will load — and it needs no database.
  */
+import { readFileSync } from 'node:fs';
 import { describe, expect, it } from 'vitest';
 import { ToolRegistry } from '@buddi/core/testing';
 import { manifest } from './index.js';
 
 describe('${name} manifest', () => {
+  it("carries package.json's version", () => {
+    const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version: string };
+    expect(manifest.version).toBe(pkg.version);
+  });
+
   it('registers in a tool registry', () => {
     const registry = new ToolRegistry();
     expect(() => registry.register(manifest)).not.toThrow();
@@ -371,13 +466,12 @@ Hosts: none
 }
 function readmeMd(name, schema, coreDir) {
     const core = coreDir === undefined
-        ? 'Point the `@buddi/core` devDependency at a published version, or at a buddi\ncheckout: `"@buddi/core": "link:/path/to/buddi/packages/core"`.'
-        : `The \`@buddi/core\` devDependency is a \`link:\` at the installation this was
-scaffolded from (\`${coreDir}\`). That checkout must be built (\`pnpm -r build\`)
-before this compiles: the link points at the package, and its types and entry
-point are in its \`dist\`. When core is published the devDependency becomes the
-published range and nothing else changes — the peer range is already the
-contract.`;
+        ? 'Core is an optional peer, and nothing installs it for you. For development, uncomment\nthe override in `pnpm-workspace.yaml` and point it at a built buddi checkout\n(`link:/path/to/buddi/packages/core`).'
+        : `Core is an optional peer. For development, \`pnpm-workspace.yaml\` points it at
+the installation this was scaffolded from (\`${coreDir}\`) with a pnpm override;
+that file is never packed, so what you publish carries the peer range and no
+link. The linked core must be built (\`pnpm -r build\` in a checkout) before
+this compiles: its types and entry point are in its \`dist\`.`;
     return `# buddi-plugin-${name}
 
 A [buddi](https://github.com/withbuddi/buddi) plugin. It exports a
@@ -410,13 +504,28 @@ Plugins page (or in the agent's own \`tools:\` line).
 While you are working on it, \`buddi plugins dev .\` watches \`dist\` and tells you
 — or the service — to restart when the build changes.
 
+## Publish it
+
+\`\`\`sh
+npm pack      # builds first (prepack) and writes buddi-plugin-${name}-0.1.0.tgz
+buddi plugins install ./buddi-plugin-${name}-0.1.0.tgz   # exactly what you would publish
+npm publish --provenance --access public
+\`\`\`
+
+Publish under a name or scope you own (\`@you/buddi-plugin-${name}\`), never
+under \`@buddi\`: buddi does not own that scope on npm. \`buddi.name\` in
+package.json is the plugin's name whatever the package is called.
+
 ## What is here
 
 | | |
 | --- | --- |
 | \`src/index.ts\` | the manifest: one \`auto\` tool, one \`gated\` tool with \`describe\`, a source stub |
+| \`src/version.ts\` | the manifest's version, read from package.json so the two cannot drift |
 | \`migrations/001_${schema}.sql\` | the Postgres schema this plugin owns |
 | \`buddi.md\` | what the owner reads before anything is imported |
+| \`pnpm-workspace.yaml\` | the development link to core; not packed |
+| \`LICENSE\` | a placeholder: put the full license text here |
 
 The guide is \`docs/plugins.md\` in the buddi repository. Read it before you ship:
 the tiers, the effect envelope and what a gated \`execute\` owes the owner are all

package/packages/gateway/dist/plugins/scaffold.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/plugins/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,cAAc,CACtB,UAAU,EACV,IAAI,IAAI,+EAA+E;YACrF,0FAA0F;YAC1F,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAiBD,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAqB;IACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;IACxE,OAAO;QACL,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAC7C,eAAe,EAAE,QAAQ,EAAE;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACrC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC;QACjC,CAAC,kBAAkB,MAAM,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QAC5D,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC;QACjD,YAAY,EAAE,wBAAwB;KACvC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAqB;IAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,GAAG,GAAG,mFAAmF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;wEAEwE;AAExE,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IAC3D,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,IAAI,EAAE,gBAAgB,IAAI,EAAE;QAC5B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,mBAAmB,IAAI,GAAG;QACvC,QAAQ,EAAE,CAAC,cAAc,CAAC;QAC1B,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE;QAC5E,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;QACtE,OAAO,EAAE;YACP,KAAK,EAAE,sBAAsB;YAC7B,SAAS,EAAE,4CAA4C;YACvD,IAAI,EAAE,YAAY;SACnB;QACD,YAAY,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;QAC/C,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;QACzC,eAAe,EAAE;YACf,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,UAAU;YACzB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,QAAQ;SACjB;QACD,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;KAC1C,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,UAAU;YAClB,gBAAgB,EAAE,UAAU;YAC5B,GAAG,EAAE,CAAC,QAAQ,CAAC;YACf,MAAM,EAAE,IAAI;YACZ,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;YAC9B,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI;SACnB;QACD,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,OAAO,EAAE,CAAC,kBAAkB,CAAC;KAC9B,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO;KACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8CE,IAAI;;;;;;;;;;;uDAWwC,MAAM;;;;;;;;;;;;;;;;;;6DAkBA,IAAI;;;;WAItD,IAAI;;;;;;;;;;;;;oEAaqD,MAAM;;;2BAG/C,IAAI;;;;;;;;;;;;;yBAaN,IAAI;;;mEAGsC,MAAM;;;;;;;;;;;;;;;;;;YAkB7D,IAAI;;;;;;;;;;;;;;WAcL,IAAI;;;aAGF,MAAM;;;;;;;;;;;;;;;;CAgBlB,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO;;;;;;;;;;;;;YAaG,IAAI;;;;2BAIW,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,MAAM,IAAI;;6CAE0B,MAAM;;;;;;;;;;;CAWlD,CAAC;AACF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,KAAK,IAAI;;;;;;;;;UASR,MAAM;;CAEf,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,OAA2B;IACzE,MAAM,IAAI,GACR,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,8IAA8I;QAChJ,CAAC,CAAC;qBACa,OAAO;;;;UAIlB,CAAC;IACT,OAAO,kBAAkB,IAAI;;;;;;;;;;;;;;;EAe7B,IAAI;;;;;;;;;;;2CAWqC,IAAI;;;;;;;;;;;qBAW1B,MAAM;;;;;;CAM1B,CAAC;AACF,CAAC"}
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/plugins/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,cAAc,CACtB,UAAU,EACV,IAAI,IAAI,+EAA+E;YACrF,0FAA0F;YAC1F,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AA8BD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACnE,MAAM,IAAI,cAAc,CACtB,aAAa,EACb,IAAI,OAAO,4EAA4E,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACvD,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,IAAI,MAAM,mCAAmC,eAAe,cAAc,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAqB;IACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjF,OAAO;QACL,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;QACxD,qBAAqB,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAClD,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;QACzD,eAAe,EAAE,QAAQ,EAAE;QAC3B,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;QAC7C,gBAAgB,EAAE,SAAS,EAAE;QAC7B,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC;QACjC,CAAC,kBAAkB,MAAM,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QAC5D,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC;QACjD,YAAY,EAAE,8CAA8C;KAC7D,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAqB;IAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,GAAG,GAAG,mFAAmF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;wEAEwE;AAExE,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe,EAAE,MAA0B;IAC1F,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,IAAI,EAAE,gBAAgB,IAAI,EAAE;QAC5B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,mBAAmB,IAAI,GAAG;QACvC,QAAQ,EAAE,CAAC,cAAc,CAAC;QAC1B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;QAC7D,OAAO;QACP,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE;QAC5E,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;QAC5E,OAAO,EAAE;YACP,KAAK,EAAE,sBAAsB;YAC7B,SAAS,EAAE,4CAA4C;YACvD,IAAI,EAAE,YAAY;YAClB,6DAA6D;YAC7D,OAAO,EAAE,sBAAsB;SAChC;QACD,YAAY,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;QAC/C,wEAAwE;QACxE,iEAAiE;QACjE,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;QACzC,oBAAoB,EAAE,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC3D,eAAe,EAAE;YACf,aAAa,EAAE,UAAU;YACzB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,QAAQ;SACjB;QACD,mDAAmD;QACnD,KAAK,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,YAAY,EAAE,UAAU,CAAC;KACtF,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAA2B;IAChD,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC;;;CAGP;QACK,CAAC,CAAC;;;;mBAIW,IAAI,CAAC,SAAS,CAAC,QAAQ,OAAO,EAAE,CAAC;CACnD,CAAC;IACA,OAAO,GAAG,QAAQ;;CAEnB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,SAAkB;IACtD,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,4BAA4B,OAAO;6EACoC;QACzE,CAAC,CAAC,kBAAkB,OAAO,gDAAgD,CAAC;IAC9E,OAAO,GAAG,MAAM;;;;;;;CAOjB,CAAC;AACF,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,UAAU;YAClB,gBAAgB,EAAE,UAAU;YAC5B,GAAG,EAAE,CAAC,QAAQ,CAAC;YACf,MAAM,EAAE,IAAI;YACZ,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;YAC9B,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI;SACnB;QACD,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,OAAO,EAAE,CAAC,kBAAkB,CAAC;KAC9B,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,MAA0B;IACvE,OAAO;KACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA+CE,IAAI;;;;;;;;;;;uDAWwC,MAAM;;;;;;;;;;;;;;;;;;6DAkBA,IAAI;;;;WAItD,IAAI;;;;;;;;;;;;;oEAaqD,MAAM;;;2BAG/C,IAAI;;;;;;;;;;;;;yBAaN,IAAI;;;mEAGsC,MAAM;;;;;;;;;;;;;;;;;;YAkB7D,IAAI;;;;;;;;;;;;;;WAcL,IAAI;;;;aAIF,MAAM;;;;;EAMf,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;oBAEY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;CAExC;;;;;;;;;;;CAWD,CAAC;AACF,CAAC;AAED,SAAS,SAAS;IAChB,OAAO;;;;;;;;;;CAUR,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO;;;;;;;;;;;;;;YAcG,IAAI;;;;;;;;;2BASW,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,MAAM,IAAI;;6CAE0B,MAAM;;;;;;;;;;;CAWlD,CAAC;AACF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,OAAO,KAAK,IAAI;;;;;;;;;UASR,MAAM;;CAEf,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,OAA2B;IACzE,MAAM,IAAI,GACR,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,6MAA6M;QAC/M,CAAC,CAAC;+CACuC,OAAO;;;8DAGQ,CAAC;IAC7D,OAAO,kBAAkB,IAAI;;;;;;;;;;;;;;;EAe7B,IAAI;;;;;;;;;;;2CAWqC,IAAI;;;;;;;;;iEASkB,IAAI;uCAC9B,IAAI;;;;6DAIkB,IAAI;;;;;;;;;;qBAU5C,MAAM;;;;;;;;CAQ1B,CAAC;AACF,CAAC"}

package/packages/gateway/dist/plugins/stage.d.ts

@@ -1,4 +1,4 @@
-import { type PluginSource, type PluginUse } from '@buddi/core';
+import { type PluginAuthor, type PluginSource, type PluginUse } from '@buddi/core';
 import { type PluginClaims } from './claims.js';
 import { type NpmPackument, type NpmRunner } from './npm.js';
 import { type PluginSpec } from './spec.js';
@@ -52,8 +52,23 @@ export interface StagedPlugin {
      * the developer's own and change every time they build.
      */
     stagedHash: string;
-    /** The name its manifest must answer to: `buddi.name`, or the package name. */
+    /**
+     * The name its manifest must answer to: `buddi.name`, or the package name
+     * when it declares none (and then `nameFromManifest` is set).
+     */
     declaredName: string;
+    /**
+     * It declares no `buddi.name`, so it installs under whatever name its
+     * manifest gives, read at approval — unless a different package is already
+     * installed under that name. Absent on a stage written before this existed,
+     * which keeps the old rule: the package name must be the manifest's.
+     */
+    nameFromManifest?: boolean;
+    /**
+     * It lists `@buddi/core` as an ordinary dependency. npm was not asked for it
+     * — buddi provides its own — and the card says so.
+     */
+    coreAsDependency?: boolean;
     /** The `buddi` field of package.json, if any. */
     buddi?: {
         manifest?: string;
@@ -70,6 +85,11 @@ export interface StagedPlugin {
     uses?: PluginUse[];
     /** On an upgrade, what the installed version declared: the card marks what is new. */
     previousUses?: PluginUse[];
+    /**
+     * Who made it, from package.json's `author` — the card is drawn before the
+     * manifest can be read. At approval a manifest `author` must name the same.
+     */
+    author?: PluginAuthor;
     /** The peer range it wants on `@buddi/core`. */
     coreRange?: string;
     /** Lifecycle scripts the package itself declares. */
@@ -200,6 +220,25 @@ export declare function readClaims(packageDir: string): PluginClaims;
  * about itself. Imports nothing.
  */
 export declare function stagePlugin(spec: string | PluginSpec, opts?: StageOptions): Promise<StagedPlugin>;
+export declare const CORE_PACKAGE = "@buddi/core";
+/**
+ * The package.json `npm install` reads in a stage. Pure: the author's file is
+ * restored byte for byte once npm is done.
+ *
+ * npm reads more of a package.json than `--omit` suggests. `--omit=dev` still
+ * parses devDependencies, so a `link:` to the author's checkout fails the
+ * whole install; `--omit=peer` still *resolves* peers, so an unpublished core
+ * is a 404 — and a published one would be fetched, from whoever owns the name
+ * on that registry. So npm is given a file with no devDependencies, no
+ * `@buddi/core` anywhere a dependency can be named, and an override that
+ * points core at `corePlaceholder`, a local directory: a dependency of the
+ * plugin that asks for core itself is answered from disk too. Buddi links its
+ * own core in afterwards (`linkCore`).
+ */
+export declare function packageJsonForInstall(pkg: Record<string, any>, corePlaceholder: string): {
+    pkg: Record<string, any>;
+    coreRemovedFrom: string[];
+};
 /** Does this package directory still look like the one that was staged? */
 export declare function stagedPackageExists(staged: StagedPlugin): boolean;
 //# sourceMappingURL=stage.d.ts.map

package/packages/gateway/dist/plugins/stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stage.d.ts","sourceRoot":"","sources":["../../src/plugins/stage.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAmC,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAmB,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAM1E,sEAAsE;AACtE,eAAO,MAAM,cAAc,QAMD,CAAC;AAE3B,uEAAuE;AACvE,eAAO,MAAM,YAAY,QAAsB,CAAC;AAEhD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IACnB,sFAAsF;IACtF,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,kBAAkB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAFvB,SAAkB,IAAI,kBAAkB;gBAE7B,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,yBAAyB,GACzB,SAAS,GACT,MAAM,GACN,QAAQ,CAAC;AAEb,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,iEAAiE;IACjE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,uEAAuE;IACvE,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAWD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAMzF;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAGtD;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,EAAE,CAa/E;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAKtF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC9C,MAAM,EAAE,CAYV;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC9C,MAAM,EAAE,CAoBV;AAMD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C7E;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,SAAS,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAOvE;AAID,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,MAAM,EAAE,CAEpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CA2CvE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASjF;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA6BtE;AAWD,kFAAkF;AAClF,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAkBnD;AAcD,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAM3D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,YAAY,CAAC,CAsMvB;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAMjE"}
+{"version":3,"file":"stage.d.ts","sourceRoot":"","sources":["../../src/plugins/stage.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAwD,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzI,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAmB,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAM1E,sEAAsE;AACtE,eAAO,MAAM,cAAc,QAMD,CAAC;AAE3B,uEAAuE;AACvE,eAAO,MAAM,YAAY,QAAsB,CAAC;AAEhD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IACnB,sFAAsF;IACtF,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,kBAAkB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAFvB,SAAkB,IAAI,kBAAkB;gBAE7B,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,yBAAyB,GACzB,SAAS,GACT,MAAM,GACN,QAAQ,CAAC;AAEb,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,iEAAiE;IACjE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,uEAAuE;IACvE,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAWD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAMzF;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAGtD;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,EAAE,CAa/E;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAKtF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC9C,MAAM,EAAE,CAYV;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC9C,MAAM,EAAE,CAoBV;AAMD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C7E;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,SAAS,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAOvE;AAID,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,MAAM,EAAE,CAEpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CA2CvE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASjF;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA6BtE;AAWD,kFAAkF;AAClF,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAkBnD;AAcD,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAM3D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,YAAY,CAAC,CAiNvB;AAMD,eAAO,MAAM,YAAY,gBAAgB,CAAC;AAa1C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxB,eAAe,EAAE,MAAM,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAmBzD;AAyED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAMjE"}

package/packages/gateway/dist/plugins/stage.js

@@ -13,7 +13,9 @@
  *    integrity hash, publisher, its `buddi` field, its scripts;
  *  - fetches it (`npm pack`) and extracts it into a staging directory;
  *  - installs its dependencies with `--ignore-scripts`, because a dependency's
- *    `postinstall` is arbitrary code and no approval exists yet;
+ *    `postinstall` is arbitrary code and no approval exists yet — from a
+ *    package.json with its development half and every mention of
+ *    `@buddi/core` taken out, so npm never asks any registry for core;
  *  - points the staged tree's `@buddi/core` at the core this gateway is
  *    running, because a plugin holding a second copy of core would register
  *    tools into a registry nobody reads and talk to a pool nobody owns;
@@ -30,7 +32,7 @@ import { createRequire } from 'node:module';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
-import { hostApiProblem, parsePluginUses } from '@buddi/core';
+import { authorOfPackageJson, hostApiProblem, parsePluginUses } from '@buddi/core';
 import { InstallRefusal } from './refusals.js';
 import { parseBuddiMd } from './claims.js';
 import { createNpmRunner } from './npm.js';
@@ -482,10 +484,14 @@ export async function stagePlugin(spec, opts = {}) {
         }
         // The name its manifest has to answer to. A published package is usually
         // `buddi-plugin-weather` while its manifest is `weather`, so the package
-        // may say which name is its own; if it does not, the two must match.
-        const declaredName = typeof pkg.buddi?.name === 'string' && pkg.buddi.name.trim() !== ''
-            ? pkg.buddi.name.trim()
-            : pkg.name;
+        // may say which name is its own, and then the two must match. If it does
+        // not, the manifest's name is the plugin's, read at approval
+        // (`assertNameMatches` in approve.ts keeps it off another plugin's name).
+        const nameFromManifest = !(typeof pkg.buddi?.name === 'string' && pkg.buddi.name.trim() !== '');
+        const declaredName = nameFromManifest ? pkg.name : pkg.buddi.name.trim();
+        const coreAsDependency = typeof pkg.dependencies === 'object' &&
+            pkg.dependencies !== null &&
+            Object.hasOwn(pkg.dependencies, CORE_PACKAGE);
         /*
          * What it reaches in buddi, and which buddi it was built for — both read
          * from package.json, because nothing of the package may be imported yet,
@@ -502,16 +508,17 @@ export async function stagePlugin(spec, opts = {}) {
                 throw new StageRefusal('host-api', `${String(pkg.name)} ${String(pkg.version)} cannot run on this buddi: ${problem} Nothing of it is kept.`);
             }
         }
+        const author = authorOfPackageJson(pkg.author);
         if (parsed.kind !== 'directory' && opts.skipDependencies !== true) {
             phase('installing-dependencies');
             const registry = parsed.kind === 'registry' ? parsed.registry : undefined;
-            const declared = Object.keys(pkg.dependencies ?? {}).filter((d) => d !== '@buddi/core');
+            const declared = Object.keys(pkg.dependencies ?? {}).filter((d) => d !== CORE_PACKAGE);
             if (declared.length > 0) {
-                await npm.install(packageDir, { ...(registry === undefined ? {} : { registry }) });
+                await installWithoutCore(packageDir, dir, pkg, () => npm.install(packageDir, { ...(registry === undefined ? {} : { registry }) }));
             }
         }
         if (parsed.kind !== 'directory')
-            linkCore(packageDir);
+            linkNestedCores(packageDir, linkCore(packageDir));
         phase('reading');
         /*
          * The hash of what will run, taken once the tree is final: the package, the
@@ -542,6 +549,8 @@ export async function stagePlugin(spec, opts = {}) {
             integrity,
             stagedHash,
             declaredName,
+            ...(nameFromManifest ? { nameFromManifest: true } : {}),
+            ...(coreAsDependency ? { coreAsDependency: true } : {}),
             ...(pkg.buddi === undefined
                 ? {}
                 : {
@@ -553,6 +562,7 @@ export async function stagePlugin(spec, opts = {}) {
                     },
                 }),
             uses: uses.uses,
+            ...(author === undefined ? {} : { author }),
             ...(opts.previousUses === undefined ? {} : { previousUses: opts.previousUses }),
             ...(typeof pkg.peerDependencies?.['@buddi/core'] === 'string'
                 ? { coreRange: pkg.peerDependencies['@buddi/core'] }
@@ -579,6 +589,124 @@ export async function stagePlugin(spec, opts = {}) {
         throw err;
     }
 }
+/* ------------------------------------------------------------------ *
+ * What npm is allowed to read
+ * ------------------------------------------------------------------ */
+export const CORE_PACKAGE = '@buddi/core';
+/** An `overrides` object with every key naming core taken out, at any depth. */
+function withoutCoreOverrides(overrides) {
+    if (typeof overrides !== 'object' || overrides === null || Array.isArray(overrides))
+        return {};
+    const out = {};
+    for (const [key, value] of Object.entries(overrides)) {
+        if (key === CORE_PACKAGE || key.startsWith(`${CORE_PACKAGE}@`))
+            continue;
+        out[key] = typeof value === 'object' && value !== null ? withoutCoreOverrides(value) : value;
+    }
+    return out;
+}
+/**
+ * The package.json `npm install` reads in a stage. Pure: the author's file is
+ * restored byte for byte once npm is done.
+ *
+ * npm reads more of a package.json than `--omit` suggests. `--omit=dev` still
+ * parses devDependencies, so a `link:` to the author's checkout fails the
+ * whole install; `--omit=peer` still *resolves* peers, so an unpublished core
+ * is a 404 — and a published one would be fetched, from whoever owns the name
+ * on that registry. So npm is given a file with no devDependencies, no
+ * `@buddi/core` anywhere a dependency can be named, and an override that
+ * points core at `corePlaceholder`, a local directory: a dependency of the
+ * plugin that asks for core itself is answered from disk too. Buddi links its
+ * own core in afterwards (`linkCore`).
+ */
+export function packageJsonForInstall(pkg, corePlaceholder) {
+    const out = JSON.parse(JSON.stringify(pkg));
+    delete out.devDependencies;
+    const coreRemovedFrom = [];
+    for (const field of ['dependencies', 'peerDependencies', 'optionalDependencies']) {
+        const deps = out[field];
+        if (typeof deps === 'object' && deps !== null && Object.hasOwn(deps, CORE_PACKAGE)) {
+            delete deps[CORE_PACKAGE];
+            coreRemovedFrom.push(field);
+        }
+    }
+    if (typeof out.peerDependenciesMeta === 'object' && out.peerDependenciesMeta !== null) {
+        delete out.peerDependenciesMeta[CORE_PACKAGE];
+    }
+    for (const field of ['bundleDependencies', 'bundledDependencies']) {
+        if (Array.isArray(out[field]))
+            out[field] = out[field].filter((d) => d !== CORE_PACKAGE);
+    }
+    out.overrides = { ...withoutCoreOverrides(out.overrides), [CORE_PACKAGE]: `file:${corePlaceholder}` };
+    return { pkg: out, coreRemovedFrom };
+}
+/**
+ * Run `install` with the package.json npm is allowed to read, then put the
+ * author's back. The placeholder core npm may have been pointed at lives in
+ * the stage directory, outside the package, and is gone when this returns.
+ */
+async function installWithoutCore(packageDir, stage, pkg, install) {
+    const file = path.join(packageDir, 'package.json');
+    const original = readFileSync(file);
+    const placeholder = path.join(stage, 'core-placeholder');
+    mkdirSync(placeholder, { recursive: true });
+    writeFileSync(path.join(placeholder, 'package.json'), `${JSON.stringify({ name: CORE_PACKAGE, version: runningCoreVersion(), private: true })}\n`);
+    try {
+        writeFileSync(file, `${JSON.stringify(packageJsonForInstall(pkg, placeholder).pkg, null, 2)}\n`);
+        await install();
+    }
+    finally {
+        writeFileSync(file, original);
+        rmSync(placeholder, { recursive: true, force: true });
+    }
+}
+/** The version of the core this gateway runs, or `0.0.0` when it cannot tell. */
+function runningCoreVersion() {
+    const dir = resolveCoreDir();
+    if (dir === undefined)
+        return '0.0.0';
+    try {
+        const pkg = JSON.parse(readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/**
+ * Every `node_modules/@buddi/core` below the package's own, which only a
+ * dependency asking for core can have put there: each becomes the same
+ * plugin-only core `linkCore` writes at the top.
+ */
+function linkNestedCores(packageDir, coreDir) {
+    const visit = (modules, depth) => {
+        if (depth > 32 || !lstatOrUndefined(modules)?.isDirectory())
+            return;
+        for (const entry of readdirSync(modules, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const full = path.join(modules, entry.name);
+            const packages = entry.name.startsWith('@')
+                ? readdirSync(full, { withFileTypes: true })
+                    .filter((e) => e.isDirectory() || e.isSymbolicLink())
+                    .map((e) => ({ name: `${entry.name}/${e.name}`, dir: path.join(full, e.name) }))
+                : [{ name: entry.name, dir: full }];
+            for (const pkg of packages) {
+                if (!lstatOrUndefined(pkg.dir)?.isDirectory())
+                    continue;
+                const nested = path.join(pkg.dir, 'node_modules');
+                const core = path.join(nested, '@buddi', 'core');
+                if (lstatOrUndefined(core) !== undefined) {
+                    rmSync(core, { recursive: true, force: true });
+                    if (coreDir !== undefined)
+                        writePluginOnlyCore(core, coreDir);
+                }
+                visit(nested, depth + 1);
+            }
+        }
+    };
+    visit(path.join(packageDir, 'node_modules'), 0);
+}
 /** Does this package directory still look like the one that was staged? */
 export function stagedPackageExists(staged) {
     try {