carrick 0.3.109 → 0.3.110

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "carrick",
-  "version": "0.3.109",
+  "version": "0.3.110",
   "description": "Maps your entire TypeScript codebase across services and repositories, giving AI agents full context on existing types, routes, and function behaviours over MCP before they write duplicate or breaking code.",
   "keywords": [
     "typescript",
@@ -58,11 +58,11 @@
     "zod": "^3.23.0"
   },
   "optionalDependencies": {
-    "@carrick-tools/cli-darwin-arm64": "0.3.109",
-    "@carrick-tools/cli-darwin-x64": "0.3.109",
-    "@carrick-tools/cli-linux-arm64": "0.3.109",
-    "@carrick-tools/cli-linux-x64": "0.3.109",
-    "@carrick-tools/cli-win32-x64": "0.3.109"
+    "@carrick-tools/cli-darwin-arm64": "0.3.110",
+    "@carrick-tools/cli-darwin-x64": "0.3.110",
+    "@carrick-tools/cli-linux-arm64": "0.3.110",
+    "@carrick-tools/cli-linux-x64": "0.3.110",
+    "@carrick-tools/cli-win32-x64": "0.3.110"
   },
   "devDependencies": {
     "@types/node": "^24.13.3"

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "carrick",
   "description": "Claude Code plugin for Carrick, which indexes TypeScript codebases across service and repository boundaries. After each edit it adds the file's routes, calls, and cross-service type mismatches to the session, and it registers Carrick's language server. It pairs with the Carrick MCP server, which lets agents search functions by intent rather than name.",
-  "version": "0.3.109",
+  "version": "0.3.110",
   "author": {
     "name": "Carrick",
     "email": "hello@carrick.tools"

package/sidecar/dist/src/bundler.d.ts

@@ -50,6 +50,16 @@ export declare class TypeBundler {
      */
     private expandOrigin;
     private extractTypeDefinition;
+    /**
+     * carrick#1841: what a consumer receives when the symbol the model named for
+     * its response is a response table keyed by status code (`{ 200: Item;
+     * 404: Problem }`): the table's 2xx values, expanded like any other body.
+     * `unknown` where the table states no success body (no 2xx row, or only
+     * rows such as `204: void`). `undefined` when the symbol is not a table, so
+     * the caller bundles it as written. The capture's symbol anchor reads the
+     * same rule (`capture/anchors.ts`), so both answers agree.
+     */
+    private statusTableBodyText;
     private elementNeedsArrayParens;
     private extractTypeDefinitionBase;
     private isPathSource;

package/sidecar/dist/src/bundler.js

@@ -7,6 +7,7 @@ import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { expandTypeStructural, } from './type-structural-expander.js';
 import { externalImportsOf } from './origin.js';
+import { statusTableBody } from './capture/index.js';
 /**
  * #248: upper bound on `SymbolRequest.array_depth`. SDL list nesting is
  * realistically 1-3 levels (`[Order!]!`, at most `[[Order!]!]!`); this is a
@@ -301,6 +302,17 @@ export class TypeBundler {
         };
     }
     extractTypeDefinition(symbol) {
+        const tableBody = symbol.consumer_response ? this.statusTableBodyText(symbol) : undefined;
+        if (tableBody !== undefined) {
+            const alias = symbol.alias || symbol.symbol_name;
+            const depth = symbol.array_depth ?? 0;
+            if (depth > MAX_ARRAY_DEPTH)
+                return null;
+            const typeString = depth > 0 && tableBody !== 'unknown'
+                ? `(${tableBody})${'[]'.repeat(depth)}`
+                : tableBody;
+            return { definition: `export type ${alias} = ${typeString};`, typeString };
+        }
         const base = this.extractTypeDefinitionBase(symbol);
         if (!base)
             return null;
@@ -338,6 +350,36 @@ export class TypeBundler {
         const typeString = `${element}${'[]'.repeat(depth)}`;
         return { definition: `export type ${alias} = ${typeString};`, typeString };
     }
+    /**
+     * carrick#1841: what a consumer receives when the symbol the model named for
+     * its response is a response table keyed by status code (`{ 200: Item;
+     * 404: Problem }`): the table's 2xx values, expanded like any other body.
+     * `unknown` where the table states no success body (no 2xx row, or only
+     * rows such as `204: void`). `undefined` when the symbol is not a table, so
+     * the caller bundles it as written. The capture's symbol anchor reads the
+     * same rule (`capture/anchors.ts`), so both answers agree.
+     */
+    statusTableBodyText(symbol) {
+        const site = this.siteOf(symbol);
+        if (!site)
+            return undefined;
+        const declaration = site.sourceFile.getTypeAlias(site.name) ?? site.sourceFile.getInterface(site.name);
+        if (!declaration)
+            return undefined;
+        const table = declaration.getType();
+        const checker = this.project.getTypeChecker().compilerObject;
+        const read = statusTableBody(checker, table.compilerType, declaration.compilerNode);
+        if (!read)
+            return undefined;
+        if (read.kind === 'no_body')
+            return 'unknown';
+        const bodies = read.entries.map((entry) => {
+            const value = table.getProperty(entry.key)?.getTypeAtLocation(declaration);
+            return value ? expandTypeStructural(value, this.expandOrigin()) : 'unknown';
+        });
+        const distinct = [...new Set(bodies)];
+        return distinct.length === 1 ? distinct[0] : distinct.map((body) => `(${body})`).join(' | ');
+    }
     /// Whether the element type must be parenthesised before an `[]` suffix.
     /// Interfaces/classes/enums are always object/nominal (never a top-level
     /// union), so only type aliases and typed variables can carry a bare

package/sidecar/dist/src/capture/anchors.js

@@ -10,6 +10,7 @@ import { printTypeForDestination, substituteUndeclaredNames, undeclaredNamesIn,
 import { typeIsOrContainsMachinery } from './machinery.js';
 import { installedPackageSpecifier } from './installed-package.js';
 import { realPath } from './service-config.js';
+import { statusTableBody } from './status-table.js';
 import { unresolvedAtAnchor, unresolvedSpecifiersReachableFrom, } from './unresolved.js';
 /**
  * Repo-root-relative source file -> the specifier the surface entry imports
@@ -155,6 +156,37 @@ export function resolveAnchor(program, request, args) {
         }
         const arrayDepth = Math.max(0, request.array_depth ?? 0);
         const declared = checker.getDeclaredTypeOfSymbol(resolvedExport);
+        // carrick#1841: a symbol named for what a consumer receives that is a
+        // response table keyed by status code (`{ 200: Item; 404: Problem }`) is
+        // not the body. The body is its 2xx rows, indexed out of the table so the
+        // compiler still emits it (`import('./m').Table[200]`). A table with no
+        // success body abstains, decided. The v1 bundle reads the same rule
+        // (`TypeBundler.statusTableBodyText`).
+        if (request.consumer_response) {
+            const table = statusTableBody(checker, declared, resolvedExport.declarations?.[0] ?? sourceFile);
+            if (table?.kind === 'no_body') {
+                return {
+                    request,
+                    aliasText: 'unknown',
+                    serialization: 'structural_fallback',
+                    abstainReason: `'${request.symbol_name}' is a response table keyed by status code with no ` +
+                        'success row that states a body, so this consumer states no response contract',
+                };
+            }
+            if (table?.kind === 'body') {
+                const rows = [...new Set(table.entries.map((entry) => entry.key))].map((key) => /^\d+$/.test(key)
+                    ? `import('${spec}').${request.symbol_name}[${key}]`
+                    : `import('${spec}').${request.symbol_name}[${JSON.stringify(key)}]`);
+                const body = rows.join(' | ');
+                const unresolvedBody = unresolvedAtAnchor(program, sourceFile, declared, resolvedExport.declarations?.[0] ?? sourceFile, '<0>'.repeat(arrayDepth));
+                return {
+                    request,
+                    aliasText: arraySuffix && rows.length > 1 ? `(${body})${arraySuffix}` : `${body}${arraySuffix}`,
+                    serialization: 'emitted',
+                    ...(unresolvedBody ? { unresolved: unresolvedBody } : {}),
+                };
+            }
+        }
         const unresolved = unresolvedAtAnchor(program, sourceFile, declared, resolvedExport.declarations?.[0] ?? sourceFile, '<0>'.repeat(arrayDepth));
         return {
             request,

package/sidecar/dist/src/capture/api.d.ts

@@ -50,6 +50,11 @@ export interface SymbolAnchorRequest {
      * `import('./m').Sym[]`. Omitted/0 captures the symbol as-is.
      */
     array_depth?: number;
+    /**
+     * carrick#1841: the symbol names what a consumer receives, so a response
+     * table keyed by status code captures as its 2xx body, not as the table.
+     */
+    consumer_response?: boolean;
 }
 /**
  * Inline literal type text with no addressable symbol (the v1 inline-alias

package/sidecar/dist/src/capture/check-workspace.d.ts

@@ -15,6 +15,7 @@
 import type { CheckStubInput } from './api.js';
 import type { ProbePlan } from './check-probe.js';
 import { WriteGuard } from './guarded-fs.js';
+import { type ResolutionEdges } from './resolution-edges.js';
 export interface AssembledStub {
     serviceName: string;
     /** Workspace package dir under packages/ (== the @carrick/<dir> suffix). */
@@ -45,6 +46,15 @@ export interface AssembledWorkspace {
 export declare function computeDedupeOverrides(stubs: {
     dependencies: Record<string, string>;
 }[]): Record<string, string>;
+/**
+ * pnpm parent-scoped overrides (`<parent>@<version>><child>`) that install
+ * each edge the stubs recorded at the version the scanned repo installed
+ * (carrick#2091). A parent-scoped override wins over a generic one, so an
+ * edge's version first passes through the dedupe table: one physical copy per
+ * compat group still holds. An edge two stubs record at versions the dedupe
+ * does not reconcile is left to the resolver.
+ */
+export declare function computeResolutionOverrides(edgeSets: ResolutionEdges[], dedupe: Record<string, string>): Record<string, string>;
 export interface AssembleOptions {
     stubs: CheckStubInput[];
     workspaceRoot?: string;

package/sidecar/dist/src/capture/check-workspace.js

@@ -15,6 +15,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { WriteGuard } from './guarded-fs.js';
+import { RESOLUTION_FILE } from './resolution-edges.js';
 const PROBES_PACKAGE = 'carrick-probes';
 function parseVersion(v) {
     const core = v.replace(/^[^\d]*/, '').split('-')[0].split('+')[0];
@@ -90,6 +91,57 @@ export function computeDedupeOverrides(stubs) {
         .sort()
         .map((k) => [k, overrides[k]]));
 }
+/** A stub's recorded edges; a stub stored without the file records none. */
+function readStubResolution(stubDir) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(path.join(stubDir, RESOLUTION_FILE), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+    const edges = parsed?.edges;
+    if (!edges || typeof edges !== 'object')
+        return {};
+    const out = {};
+    for (const [parent, children] of Object.entries(edges)) {
+        if (!children || typeof children !== 'object')
+            continue;
+        for (const [child, version] of Object.entries(children)) {
+            if (typeof version === 'string')
+                (out[parent] ??= {})[child] = version;
+        }
+    }
+    return out;
+}
+/**
+ * pnpm parent-scoped overrides (`<parent>@<version>><child>`) that install
+ * each edge the stubs recorded at the version the scanned repo installed
+ * (carrick#2091). A parent-scoped override wins over a generic one, so an
+ * edge's version first passes through the dedupe table: one physical copy per
+ * compat group still holds. An edge two stubs record at versions the dedupe
+ * does not reconcile is left to the resolver.
+ */
+export function computeResolutionOverrides(edgeSets, dedupe) {
+    const versionsOf = new Map();
+    for (const edges of edgeSets) {
+        for (const [parent, children] of Object.entries(edges)) {
+            for (const [child, version] of Object.entries(children)) {
+                const key = `${parent}>${child}`;
+                if (!versionsOf.has(key))
+                    versionsOf.set(key, new Set());
+                versionsOf.get(key).add(dedupe[`${child}@${version}`] ?? version);
+            }
+        }
+    }
+    const overrides = {};
+    for (const key of [...versionsOf.keys()].sort()) {
+        const versions = versionsOf.get(key);
+        if (versions.size === 1)
+            overrides[key] = [...versions][0];
+    }
+    return overrides;
+}
 function readStubPackageName(stubDir) {
     const pkgPath = path.join(stubDir, 'package.json');
     const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
@@ -116,6 +168,7 @@ export function assembleWorkspace(opts) {
     guard.writeFile(path.join(workspaceDir, 'pnpm-workspace.yaml'), 'packages:\n  - "packages/*"\n');
     const assembled = [];
     const dependencySets = [];
+    const edgeSets = [];
     const svcToPkg = new Map();
     const dirToPkg = new Map();
     const dirToSvc = new Map();
@@ -126,12 +179,20 @@ export function assembleWorkspace(opts) {
         guard.copyTree(stub.stub_dir, dest, (src) => !src.split(path.sep).includes('node_modules'));
         assembled.push({ serviceName: stub.service_name, packageDir, packageName });
         dependencySets.push({ dependencies: readStubDependencies(stub.stub_dir) });
+        edgeSets.push(readStubResolution(stub.stub_dir));
         svcToPkg.set(stub.service_name, packageName);
         dirToPkg.set(packageDir, packageName);
         dirToSvc.set(packageDir, stub.service_name);
     }
-    // Root manifest carries the semver-dedupe overrides.
-    const overrides = computeDedupeOverrides(dependencySets);
+    // Root manifest carries the semver-dedupe overrides and the recorded edges.
+    const dedupe = computeDedupeOverrides(dependencySets);
+    const merged = {
+        ...dedupe,
+        ...computeResolutionOverrides(edgeSets, dedupe),
+    };
+    const overrides = Object.fromEntries(Object.keys(merged)
+        .sort()
+        .map((k) => [k, merged[k]]));
     guard.writeFile(path.join(workspaceDir, 'package.json'), JSON.stringify({
         name: 'carrick-check-workspace',
         version: '0.0.0',
@@ -181,12 +242,13 @@ const NPMRC = [
     'strict-peer-dependencies=false',
     // Determinism: install exactly the pinned closure, no implicit peer pull-in.
     'auto-install-peers=false',
-    // Determinism: the scratch workspace has no committed lockfile, so the
-    // transitive closure would otherwise be a pure function of live registry
-    // state. prefer-offline resolves from the local store/metadata cache
+    // Determinism: the scratch workspace has no committed lockfile. Direct deps
+    // are exact-pinned by the stubs, and every transitive edge a stub recorded
+    // from the scanned repo's installed tree is pinned by a parent-scoped
+    // override in the root manifest. Only unrecorded edges resolve, and for
+    // those prefer-offline resolves from the local store/metadata cache
     // whenever possible (byte-stable across runs on a host), and the explicit
     // resolution-mode pins pnpm's resolver behavior across pnpm versions.
-    // Direct deps are exact-pinned by the stubs; only transitives resolve.
     'prefer-offline=true',
     'resolution-mode=highest',
     '',

package/sidecar/dist/src/capture/index.d.ts

@@ -59,3 +59,4 @@ export declare function surfaceEntryFileName(): string;
 /** Same normalization intent as bundle_file_stems on the Rust side. */
 export declare function sanitizeServiceName(name: string): string;
 export declare function captureStub(opts: CaptureStubOptions): CaptureStubResult;
+export { classifyStatusCodes, constituents, httpStatus, statesNoBody, statusKeyCode, statusTableBody, statusTableOf, successEntries, } from './status-table.js';

package/sidecar/dist/src/capture/index.js

@@ -33,6 +33,7 @@ import * as path from 'node:path';
 import { entryRelativeSpecifier, resolveAnchor } from './anchors.js';
 import { findAugmentationFiles } from './augmentations.js';
 import { installedVersions, lockfileVersions } from './lockfile.js';
+import { installedResolutionEdges, RESOLUTION_FILE } from './resolution-edges.js';
 import { rewriteEmittedSpecifiers } from './paths-rewrite.js';
 import { installedPackageSpecifier, typesPackageOf, withInstalledPackages } from './installed-package.js';
 import { selfCheckStub } from './self-check.js';
@@ -428,9 +429,8 @@ export function captureStub(opts) {
     // repos whose lockfiles we do not parse (yarn classic v1, binary
     // bun.lockb). The parsed lockfile (npm, pnpm, yarn-berry, text bun.lock)
     // remains the bare-checkout fallback. Both paths pin only
-    // the directly-referenced externals; transitives resolve at check-install
-    // (check-workspace NPMRC: "Direct deps are exact-pinned by the stubs;
-    // only transitives resolve").
+    // the directly-referenced externals; what those depend on is recorded
+    // from the installed tree below (RESOLUTION_FILE).
     const installed = installedVersions(repoRoot, externalSpecs);
     const lockVersions = lockfileVersions(repoRoot);
     for (const name of Object.keys(deno?.pinned ?? {}))
@@ -451,6 +451,18 @@ export function captureStub(opts) {
         else if (!rewritten.pins[typesPackageOf(name)])
             unpinned.push(name);
     }
+    // ---- Record how the installed tree resolved what the pins depend on ----
+    // The check pins each recorded edge, so it installs what the repo
+    // installed rather than the newest version in range (carrick#2091).
+    const resolution = deno
+        ? { edges: {}, unrecorded: 0 }
+        : installedResolutionEdges(repoRoot, pinned);
+    const edgeCount = Object.values(resolution.edges).reduce((n, children) => n + Object.keys(children).length, 0);
+    if (edgeCount > 0) {
+        stubGuard.writeFile(path.join(stubDir, RESOLUTION_FILE), JSON.stringify({ edges: resolution.edges }, null, 2) + '\n');
+    }
+    console.error(`[sidecar] capture ${packageName}: ${edgeCount} dependency edge(s) recorded from the installed tree, ` +
+        `${resolution.unrecorded} left to the registry`);
     const dependencyRoot = deno?.config.workspaceRoot ?? repoRoot;
     const bareCheckout = !deno && !fs.existsSync(path.join(dependencyRoot, 'node_modules'));
     stubGuard.writeFile(path.join(stubDir, 'package.json'), JSON.stringify({
@@ -751,3 +763,6 @@ function resolveAnchors(opts, parsed, ctx, deno) {
             ctx.guard.unlink(ctx.entryPath);
     }
 }
+// carrick#1841: the response-table reading the inferrer and the v1 bundle
+// share with the capture's symbol anchor.
+export { classifyStatusCodes, constituents, httpStatus, statesNoBody, statusKeyCode, statusTableBody, statusTableOf, successEntries, } from './status-table.js';

package/sidecar/dist/src/capture/installed-package-directory.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Where an installed package sits on disk, by path alone, for capture's
+ * resolution walk. It mirrors `DeclarationReader.installedPackage` in
+ * library-claims.ts: the capture seam (pinned decision 11a) lets neither side
+ * import the other, so a change to what counts as installed changes both.
+ *
+ * Seam: node builtins only.
+ */
+/**
+ * The installed package directory a real path lies in, by path alone: the
+ * directory after the path's last `node_modules` segment (two segments for a
+ * scope), taken relative to `root`, and the name it is installed as. A source
+ * file in a directory named `node_modules` above `root`, or a checkout under a
+ * `node_modules` ancestor, is not installed; an install hoisted above `root`
+ * (`../../node_modules/pkg`) and a pnpm store
+ * (`node_modules/.pnpm/pkg@1/node_modules/pkg`) are. The caller reads the
+ * package.json there: without one, nothing is installed.
+ */
+export declare function installedPackageDirectory(root: string, realPath: string): {
+    directory: string;
+    name: string;
+} | undefined;

package/sidecar/dist/src/capture/installed-package-directory.js

@@ -0,0 +1,30 @@
+/**
+ * Where an installed package sits on disk, by path alone, for capture's
+ * resolution walk. It mirrors `DeclarationReader.installedPackage` in
+ * library-claims.ts: the capture seam (pinned decision 11a) lets neither side
+ * import the other, so a change to what counts as installed changes both.
+ *
+ * Seam: node builtins only.
+ */
+import * as path from 'node:path';
+/**
+ * The installed package directory a real path lies in, by path alone: the
+ * directory after the path's last `node_modules` segment (two segments for a
+ * scope), taken relative to `root`, and the name it is installed as. A source
+ * file in a directory named `node_modules` above `root`, or a checkout under a
+ * `node_modules` ancestor, is not installed; an install hoisted above `root`
+ * (`../../node_modules/pkg`) and a pnpm store
+ * (`node_modules/.pnpm/pkg@1/node_modules/pkg`) are. The caller reads the
+ * package.json there: without one, nothing is installed.
+ */
+export function installedPackageDirectory(root, realPath) {
+    const segments = path.relative(root, realPath).split(path.sep);
+    const last = segments.lastIndexOf('node_modules');
+    if (last < 0)
+        return undefined;
+    const width = segments[last + 1]?.startsWith('@') ? 2 : 1;
+    return {
+        directory: path.resolve(root, ...segments.slice(0, last + 1 + width)),
+        name: segments.slice(last + 1, last + 1 + width).join('/'),
+    };
+}

package/sidecar/dist/src/capture/resolution-edges.d.ts

@@ -0,0 +1,36 @@
+/**
+ * How the scanned repo's installed tree resolved the packages a stub pins
+ * (carrick#2091).
+ *
+ * A stub pins only the externals its declarations import. The check
+ * workspace has no lockfile, so without this record every package those pins
+ * depend on resolves fresh from the registry: the check can install a version
+ * the repo never ran, or fail on one the registry lists but cannot serve.
+ *
+ * The walk reads the installed tree the way Node's lookup does, so one reader
+ * covers npm, pnpm (isolated store and hoisted), yarn's node-modules linker
+ * and bun. Starting at each pin installed at the pinned version, it follows
+ * `dependencies` and `optionalDependencies` breadth first and records
+ * `<parent>@<version> -> <child>: <version>` for every child installed as a
+ * published package of that name. Workspace members, `link:` targets and npm
+ * aliases are left out: the registry cannot serve them by that name. An edge
+ * whose parent version is installed twice with different children is left
+ * out, since no one answer is the repo's.
+ *
+ * The walk only reads. Seam: node builtins and this bundle only.
+ */
+/** The stub file the check reads to pin transitive edges. */
+export declare const RESOLUTION_FILE = "carrick-resolution.json";
+/** `<parent>@<version>` -> child name -> child version. */
+export type ResolutionEdges = Record<string, Record<string, string>>;
+export interface InstalledResolution {
+    /** Key-sorted at both levels; byte-stable for one tree. */
+    edges: ResolutionEdges;
+    /** Dependencies of walked packages that no edge records: the check resolves these from the registry. */
+    unrecorded: number;
+}
+/**
+ * The edges the installed tree under `serviceRoot` resolved, from the stub's
+ * pins outward. A pin not installed at its pinned version starts no walk.
+ */
+export declare function installedResolutionEdges(serviceRoot: string, pins: Record<string, string>): InstalledResolution;

package/sidecar/dist/src/capture/resolution-edges.js

@@ -0,0 +1,150 @@
+/**
+ * How the scanned repo's installed tree resolved the packages a stub pins
+ * (carrick#2091).
+ *
+ * A stub pins only the externals its declarations import. The check
+ * workspace has no lockfile, so without this record every package those pins
+ * depend on resolves fresh from the registry: the check can install a version
+ * the repo never ran, or fail on one the registry lists but cannot serve.
+ *
+ * The walk reads the installed tree the way Node's lookup does, so one reader
+ * covers npm, pnpm (isolated store and hoisted), yarn's node-modules linker
+ * and bun. Starting at each pin installed at the pinned version, it follows
+ * `dependencies` and `optionalDependencies` breadth first and records
+ * `<parent>@<version> -> <child>: <version>` for every child installed as a
+ * published package of that name. Workspace members, `link:` targets and npm
+ * aliases are left out: the registry cannot serve them by that name. An edge
+ * whose parent version is installed twice with different children is left
+ * out, since no one answer is the repo's.
+ *
+ * The walk only reads. Seam: node builtins and this bundle only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { installedPackageDirectory } from './installed-package-directory.js';
+import { isPublishedSemver } from './lockfile.js';
+/** The stub file the check reads to pin transitive edges. */
+export const RESOLUTION_FILE = 'carrick-resolution.json';
+function validName(name) {
+    return !name.split('/').some((s) => s === '' || s === '.' || s === '..');
+}
+/**
+ * Node's lookup of `name` from `fromDir`: `<dir>/node_modules/<name>` at each
+ * ancestor, skipping an ancestor that is itself a `node_modules` directory.
+ * That skip is how a pnpm store package finds its sibling links.
+ */
+function lookup(fromDir, name) {
+    let dir = fromDir;
+    for (;;) {
+        if (path.basename(dir) !== 'node_modules') {
+            const candidate = path.join(dir, 'node_modules', ...name.split('/'));
+            if (fs.existsSync(path.join(candidate, 'package.json')))
+                return candidate;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+/**
+ * The package `name` installed as Node would find it from `fromDir`: a
+ * directory `installedPackageDirectory` accepts, holding a package.json of
+ * that name with a published version.
+ */
+function installedFrom(root, fromDir, name) {
+    if (!validName(name))
+        return undefined;
+    const found = lookup(fromDir, name);
+    if (found === undefined)
+        return undefined;
+    try {
+        const dir = fs.realpathSync(found);
+        const installed = installedPackageDirectory(root, dir);
+        if (installed === undefined || installed.directory !== dir || installed.name !== name) {
+            return undefined;
+        }
+        const manifest = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        if (manifest?.name !== name || typeof manifest.version !== 'string')
+            return undefined;
+        if (!isPublishedSemver(manifest.version))
+            return undefined;
+        const names = new Set();
+        for (const field of [manifest.dependencies, manifest.optionalDependencies]) {
+            if (field && typeof field === 'object')
+                for (const dep of Object.keys(field))
+                    names.add(dep);
+        }
+        return { dir, name, version: manifest.version, dependencies: [...names].sort() };
+    }
+    catch {
+        // Dangling link, unreadable or corrupt manifest: nothing installed here.
+        return undefined;
+    }
+}
+function sorted(record) {
+    return Object.fromEntries(Object.keys(record)
+        .sort()
+        .map((k) => [k, record[k]]));
+}
+/**
+ * The edges the installed tree under `serviceRoot` resolved, from the stub's
+ * pins outward. A pin not installed at its pinned version starts no walk.
+ */
+export function installedResolutionEdges(serviceRoot, pins) {
+    let root;
+    try {
+        root = fs.realpathSync(path.resolve(serviceRoot));
+    }
+    catch {
+        return { edges: {}, unrecorded: 0 };
+    }
+    const queue = [];
+    const visited = new Set();
+    for (const name of Object.keys(pins).sort()) {
+        const pkg = installedFrom(root, root, name);
+        if (pkg === undefined || pkg.version !== pins[name] || visited.has(pkg.dir))
+            continue;
+        visited.add(pkg.dir);
+        queue.push(pkg);
+    }
+    // parent key -> child -> every version a copy of that parent resolved.
+    const seen = new Map();
+    // Each (parent key, child) a walked package declares, recorded or not.
+    const declared = new Set();
+    for (let i = 0; i < queue.length; i++) {
+        const parent = queue[i];
+        const key = `${parent.name}@${parent.version}`;
+        let children = seen.get(key);
+        if (children === undefined)
+            seen.set(key, (children = new Map()));
+        for (const name of parent.dependencies) {
+            declared.add(`${key}>${name}`);
+            const child = installedFrom(root, parent.dir, name);
+            if (child === undefined)
+                continue;
+            let versions = children.get(name);
+            if (versions === undefined)
+                children.set(name, (versions = new Set()));
+            versions.add(child.version);
+            if (!visited.has(child.dir)) {
+                visited.add(child.dir);
+                queue.push(child);
+            }
+        }
+    }
+    const edges = {};
+    let recorded = 0;
+    for (const [key, children] of seen) {
+        const kept = {};
+        for (const [name, versions] of children) {
+            if (versions.size === 1)
+                kept[name] = [...versions][0];
+        }
+        if (Object.keys(kept).length === 0)
+            continue;
+        edges[key] = sorted(kept);
+        recorded += Object.keys(kept).length;
+    }
+    return { edges: sorted(edges), unrecorded: declared.size - recorded };
+}