fundus 0.17.2 → 0.19.0

package/build/server/chunks/chunks/{context.js-Dh0ibRIF.js → context.js-BIgcUcEl.js}

@@ -1,13 +1,13 @@
-import { c as compareCodeUnits, h as folderOfRawPath, j as rawFileNameOfPath, g as canonicalizeParameters, n as normalizeFolderPath, H as typesForFileName, k as parentFolderPath, u as portableFolderPathKey, B as isAssetReference } from './core.js-CTyKR4bu.js';
-import { s as serverPluginsByType, i as isRecord, L as LibraryStore, d as descriptorsByType, m as manifestModuleFileName, l as locateGeneratedAssetDeclaration, a as serializeLibrary, b as serverPluginForType, S as SourceImportError, p as processAssets, g as generateManifestModules, r as readCurrentProxy, e as encodeRelativePathForUrl, f as flatLibraryIssues, c as manifestModuleCollisionIssues, h as invalidInput, j as parseLibrary, k as isRecord$1, n as assertSafeKey, o as parseManifestRecord, q as parseImportSource } from './contract.js-_LTMZBo2.js';
-import { c as collectAllReferences, a as assetIdError, b as computeLibraryMembership, d as allDeliveredAssetIds, i as isValidAssetId } from './manifest-membership.js-at1ixQdW.js';
-import { v as verifyStableRawFile, c as classifyRawDirectory } from './raw-reconciliation2.js-z4xl5zw2.js';
+import { c as compareCodeUnits, h as folderOfRawPath, j as rawFileNameOfPath, g as canonicalizeParameters, n as normalizeFolderPath, H as typesForFileName, k as parentFolderPath, u as portableFolderPathKey } from './core.js-Bp-ReC60.js';
+import { i as isRecord, s as serverPluginsByType, L as LibraryStore, d as descriptorsByType, m as manifestModuleFileName, l as locateGeneratedAssetDeclaration, a as serializeLibrary, b as serverPluginForType, S as SourceImportError, p as processAssets, g as generateManifestModules, r as readCurrentProxy, e as encodeRelativePathForUrl, c as invalidInput, f as parseLibrary } from './contract.js-B6KBK8D9.js';
+import { c as collectAllReferences, a as assetIdError, b as computeLibraryMembership, d as allDeliveredAssetIds, i as isValidAssetId } from './manifest-membership.js-Dj3WwZgz.js';
+import { v as validateDependencyList, f as formatRequiredBy } from './dependencies.js-pUkjICr5.js';
+import { v as verifyStableRawFile, c as classifyRawDirectory } from './raw-reconciliation2.js-Bo1jJgvd.js';
 import { createRequire } from 'node:module';
 import { isAbsolute, resolve, join, dirname, extname, relative, sep } from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
-import { readFile, realpath } from 'node:fs/promises';
-import { pathToFileURL } from 'node:url';
 import { createJiti } from 'jiti';
+import { readFile, realpath } from 'node:fs/promises';
 import { execFile } from 'node:child_process';
 import { isDeepStrictEqual, promisify } from 'node:util';
 import sharp from 'sharp';
@@ -16,224 +16,6 @@ import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
 import { request } from 'node:https';
 
-//#region src/lib/core/package-declaration.ts
-function parsePackageAsset(origin, id, value) {
-	if (!isRecord$1(value)) throw new Error(`Package "${origin}" asset "${id}" must be an object.`);
-	if (typeof value.type !== "string" || value.type.length === 0) throw new Error(`Package "${origin}" asset "${id}" is missing a string "type".`);
-	if ("raw" in value || "rawHash" in value) throw new Error(`Package "${origin}" asset "${id}" declares "raw"/"rawHash"; Packages ship byte-less slots only.`);
-	if (!Array.isArray(value.manifests) || value.manifests.some((entry) => typeof entry !== "string")) throw new Error(`Package "${origin}" asset "${id}" must have a "manifests" array of strings.`);
-	const record = {
-		type: value.type,
-		parameters: "parameters" in value ? value.parameters : {},
-		manifests: value.manifests
-	};
-	if (value.importSource !== void 0) record.importSource = parseImportSource(id, value.importSource);
-	return record;
-}
-/**
-* Parse and structurally validate a `fundus.package.json` (JSON text). Delegates
-* to {@link validatePackageDeclaration} after `JSON.parse`.
-*/
-function parsePackageDeclaration(json, origin) {
-	let value;
-	try {
-		value = JSON.parse(json);
-	} catch (cause) {
-		throw new Error(`Package "${origin}" declaration is not valid JSON: ${cause instanceof Error ? cause.message : String(cause)}`);
-	}
-	return validatePackageDeclaration(value, origin);
-}
-/**
-* Structurally validate an already-parsed package declaration — the shared core of
-* both the JSON path ({@link parsePackageDeclaration}) and the TypeScript-module path
-* (a `fundus.package.ts` default export loaded via jiti). Throws with a clear,
-* origin-tagged message on any malformed part. Plugin parameter validation and
-* id/manifest-name validity are separate steps that run over the merged
-* (effective) library, not here — mirroring `parseLibrary`. `version` defaults to 1.
-*/
-function validatePackageDeclaration(value, origin) {
-	if (!isRecord$1(value)) throw new Error(`Package "${origin}" declaration must be an object.`);
-	if (value.version !== void 0 && value.version !== 1) throw new Error(`Package "${origin}" declaration has unsupported version ${JSON.stringify(value.version)} (expected 1).`);
-	if (!isRecord$1(value.assets)) throw new Error(`Package "${origin}" declaration "assets" must be an object.`);
-	if (value.manifests !== void 0 && !isRecord$1(value.manifests)) throw new Error(`Package "${origin}" declaration "manifests" must be an object.`);
-	const assets = {};
-	for (const [id, record] of Object.entries(value.assets)) {
-		assertSafeKey("asset", id);
-		assets[id] = parsePackageAsset(origin, id, record);
-	}
-	const manifests = {};
-	if (isRecord$1(value.manifests)) for (const [name, record] of Object.entries(value.manifests)) {
-		assertSafeKey("manifest", name);
-		if (!isRecord$1(record)) throw new Error(`Package "${origin}" manifest "${name}" must be an object.`);
-		manifests[name] = parseManifestRecord(name, record);
-	}
-	return {
-		version: 1,
-		assets,
-		manifests
-	};
-}
-//#endregion
-//#region src/lib/core/package-merge.ts
-/**
-* The pure Package merge: fold package-shipped partial libraries **under** the
-* host library into one in-memory *effective* library. Host wins per-field
-* (deep). No disk, no config — testable like `resolveConfig`. The effective
-* library is never serialized (a host `Library` always carries `raw`/`rawHash`);
-* `materializeLibrary` drops raw-less inert slots to hand a plain `Library` to
-* processing/codegen once the slot/validation gates have passed.
-*/
-function sortDedupManifests(names) {
-	return [...new Set(names)].sort(compareCodeUnits);
-}
-/**
-* Deep-merge plugin `parameters` — overlay (host) wins. Recurses into plain
-* objects only; arrays are replaced wholesale (host-replace) and `{ $asset }`
-* reference markers are treated as atomic (never merged field-by-field). Applied
-* to `parameters` only — the record-level `manifests` array is unioned by the
-* caller, never routed through here.
-*/
-function deepMergeParameters(base, overlay) {
-	if (isRecord$1(base) && isRecord$1(overlay) && !isAssetReference(base) && !isAssetReference(overlay)) {
-		const result = { ...base };
-		for (const [key, value] of Object.entries(overlay)) result[key] = key in base ? deepMergeParameters(base[key], value) : value;
-		return result;
-	}
-	return overlay;
-}
-/**
-* Merge `packages` under `host` (host wins, per-field deep). Returns the merged
-* effective library, per-asset provenance, and merge findings. `host` is an
-* `EffectiveLibrary` so a raw-less host override branch stays reachable/testable
-* and v2-ready; a plain `Library` is assignable.
-*/
-function mergePackages(host, packages) {
-	const findings = [];
-	const pkgAssets = /* @__PURE__ */ new Map();
-	const pkgManifests = /* @__PURE__ */ new Map();
-	for (const { origin, declaration } of packages) {
-		for (const [id, decl] of Object.entries(declaration.assets)) {
-			const existing = pkgAssets.get(id);
-			if (existing) {
-				findings.push({
-					kind: "package-conflict",
-					assetId: id,
-					origins: [existing.origin, origin],
-					message: `Asset "${id}" is declared by two Packages ("${existing.origin}" and "${origin}"); Package ids must be unique.`
-				});
-				continue;
-			}
-			pkgAssets.set(id, {
-				origin,
-				decl
-			});
-		}
-		for (const [name, record] of Object.entries(declaration.manifests)) if (!pkgManifests.has(name)) pkgManifests.set(name, record);
-	}
-	const assets = {};
-	const provenance = {};
-	for (const [id, hostRecord] of Object.entries(host.assets)) {
-		const pkg = pkgAssets.get(id);
-		if (!pkg) {
-			assets[id] = { ...hostRecord };
-			provenance[id] = { source: "host" };
-			continue;
-		}
-		if (pkg.decl.type !== hostRecord.type) {
-			findings.push({
-				kind: "package-type-mismatch",
-				assetId: id,
-				origin: pkg.origin,
-				message: `Asset "${id}" overrides Package "${pkg.origin}" but changes its type from "${pkg.decl.type}" to "${hostRecord.type}"; changing the type is a different asset, not an override.`
-			});
-			assets[id] = { ...hostRecord };
-			provenance[id] = {
-				source: "override",
-				origin: pkg.origin
-			};
-			continue;
-		}
-		const merged = {
-			type: hostRecord.type,
-			parameters: deepMergeParameters(pkg.decl.parameters, hostRecord.parameters),
-			manifests: sortDedupManifests([...pkg.decl.manifests, ...hostRecord.manifests])
-		};
-		if (hostRecord.raw !== void 0 || hostRecord.importSource !== void 0) {
-			if (hostRecord.raw !== void 0) merged.raw = hostRecord.raw;
-			if (hostRecord.rawHash !== void 0) merged.rawHash = hostRecord.rawHash;
-			if (hostRecord.importSource !== void 0) merged.importSource = hostRecord.importSource;
-		} else if (pkg.decl.importSource !== void 0) merged.importSource = pkg.decl.importSource;
-		assets[id] = merged;
-		provenance[id] = {
-			source: "override",
-			origin: pkg.origin
-		};
-		findings.push({
-			kind: "package-overridden",
-			assetId: id,
-			origin: pkg.origin,
-			message: `Asset "${id}" from Package "${pkg.origin}" is overridden by the host library.`
-		});
-	}
-	for (const [id, { origin, decl }] of pkgAssets) {
-		if (Object.hasOwn(host.assets, id)) continue;
-		const record = {
-			type: decl.type,
-			parameters: decl.parameters,
-			manifests: sortDedupManifests(decl.manifests)
-		};
-		if (decl.importSource !== void 0) record.importSource = decl.importSource;
-		assets[id] = record;
-		provenance[id] = {
-			source: "package",
-			origin
-		};
-	}
-	const manifests = {};
-	for (const [name, record] of pkgManifests) manifests[name] = { ...record };
-	for (const [name, record] of Object.entries(host.manifests)) manifests[name] = {
-		...manifests[name],
-		...record
-	};
-	return {
-		library: {
-			version: Object.values(assets).some((record) => record.importSource !== void 0) ? 2 : host.version,
-			folders: host.folders,
-			assets,
-			manifests
-		},
-		provenance,
-		findings
-	};
-}
-/**
-* Drop raw-less (unfilled) slots from an effective library, yielding a plain
-* `Library` for processing/codegen. Safe only after the slot/validation gates
-* pass — every remaining delivered asset then has `raw`; dropped slots are
-* provably inert (not delivered).
-*/
-function materializeLibrary(effective) {
-	const assets = {};
-	for (const [id, record] of Object.entries(effective.assets)) {
-		if (record.raw === void 0 || record.rawHash === void 0) continue;
-		const materialized = {
-			type: record.type,
-			raw: record.raw,
-			rawHash: record.rawHash,
-			parameters: record.parameters,
-			manifests: record.manifests
-		};
-		if (record.importSource !== void 0) materialized.importSource = record.importSource;
-		assets[id] = materialized;
-	}
-	return {
-		version: effective.version,
-		folders: effective.folders,
-		assets,
-		manifests: effective.manifests
-	};
-}
-//#endregion
 //#region src/lib/core/propose-asset-id.ts
 /**
 * Propose a camelCase asset id from a file (or node) name: split on
@@ -252,6 +34,20 @@ function proposeAssetId(fileName) {
 	return withoutLeadingDigits.charAt(0).toLowerCase() + withoutLeadingDigits.slice(1);
 }
 //#endregion
+//#region src/lib/core/dependency-validation.ts
+function validateDependencies(dependencies, library) {
+	const findings = [];
+	for (const dependency of dependencies) {
+		if (!Object.hasOwn(library.assets, dependency.id)) {
+			findings.push({ message: `Missing ${dependency.type} "${dependency.id}" required by ${formatRequiredBy(dependency.sources)}.` });
+			continue;
+		}
+		const record = library.assets[dependency.id];
+		if (record.type !== dependency.type) findings.push({ message: `Type mismatch for "${dependency.id}" required by ${formatRequiredBy(dependency.sources)}: expected ${dependency.type}, library has ${record.type}.` });
+	}
+	return findings;
+}
+//#endregion
 //#region src/lib/server/config-loader.ts
 /**
 * Loads and resolves the host's `fundus.config.ts` through jiti, validates
@@ -275,70 +71,6 @@ function configDefinitionsFor(registry) {
 	}
 	return [...byNamespace.values()];
 }
-/**
-* A string `packages` entry is a *path* when it looks like one (starts with
-* `.`/`/`, is absolute, or ends `.json`), or a bare relative path with a
-* separator; otherwise it is a package *name*. A scoped name (`@scope/pkg`)
-* contains a `/` but is a name.
-*/
-function classifyPackageSpec(spec) {
-	if (spec.startsWith(".") || spec.startsWith("/") || isAbsolute(spec)) return "path";
-	if (DECLARATION_FILE_RE.test(spec)) return "path";
-	if (spec.startsWith("@")) return "name";
-	if (spec.includes("/") || spec.includes("\\")) return "path";
-	return "name";
-}
-/** A declaration file is JSON or a JS/TS module (the latter loaded via jiti). */
-var DECLARATION_FILE_RE = /\.(json|[mc]?[jt]s)$/;
-/**
-* Read a package declaration from its resolved file: a JSON `fundus.package.json`
-* (parsed as text) or a JS/TS module (`fundus.package.ts`) whose default export is
-* the declaration — loaded through the same jiti path as `fundus.config.ts`, which
-* keeps the resource `type`s literal for the package's `PackageAssets<…>` derivation.
-*/
-async function loadPackageDeclaration(file, origin) {
-	if (/\.[mc]?[jt]s$/.test(file)) {
-		let module;
-		try {
-			module = await createJiti(import.meta.url, { interopDefault: false }).import(file);
-		} catch (cause) {
-			throw new Error(`Cannot load fundus package "${origin}" (${file}): ${cause instanceof Error ? cause.message : String(cause)}`);
-		}
-		return validatePackageDeclaration(isRecord(module) && "default" in module ? module.default : module, origin);
-	}
-	let text;
-	try {
-		text = await readFile(file, "utf8");
-	} catch (cause) {
-		throw new Error(`Cannot read fundus package "${origin}" (${file}): ${cause instanceof Error ? cause.message : String(cause)}`);
-	}
-	return parsePackageDeclaration(text, origin);
-}
-function normalizePackageSource(projectRoot, entry) {
-	let spec;
-	let rawDirOverride;
-	if (typeof entry === "string") spec = entry;
-	else if (isRecord(entry) && typeof entry.package === "string" && entry.package.length > 0) {
-		spec = entry.package;
-		if (entry.rawDir !== void 0) {
-			if (typeof entry.rawDir !== "string" || entry.rawDir.length === 0) throw new Error("fundus.config: a \"packages\" entry \"rawDir\" must be a non-empty string.");
-			rawDirOverride = entry.rawDir;
-		}
-	} else throw new Error("fundus.config: each \"packages\" entry must be a package name, a path string, or { package: string; rawDir?: string }.");
-	const kind = classifyPackageSpec(spec);
-	const reference = kind === "path" ? resolve(projectRoot, spec) : spec;
-	return {
-		origin: spec,
-		kind,
-		reference,
-		...rawDirOverride !== void 0 ? { rawDirOverride } : {}
-	};
-}
-function resolvePackageSources(projectRoot, value) {
-	if (value === void 0) return [];
-	if (!Array.isArray(value)) throw new Error("fundus.config: \"packages\" must be an array.");
-	return value.map((entry) => normalizePackageSource(projectRoot, entry));
-}
 /** Pure resolution step (testable without a config file on disk). */
 function resolveConfig(projectRoot, value, registry = serverPluginsByType) {
 	if (!isRecord(value)) throw new Error("fundus.config must default-export a configuration object.");
@@ -361,6 +93,7 @@ function resolveConfig(projectRoot, value, registry = serverPluginsByType) {
 	if (!isRecord(defaults)) throw new Error("fundus.config: \"import.figma.defaults\" must be an object.");
 	const scale = defaults.scale === void 0 ? 2 : defaults.scale;
 	if (scale !== 1 && scale !== 2 && scale !== 3 && scale !== 4) throw new Error("fundus.config: \"import.figma.defaults.scale\" must be 1, 2, 3, or 4.");
+	dependencySpecs(value);
 	const usage = value.usage;
 	if (usage !== void 0 && !isRecord(usage)) throw new Error("fundus.config: \"usage\" must be an object.");
 	if (usage !== void 0 && typeof usage.referenceProvider !== "function") throw new Error("fundus.config: \"usage.referenceProvider\" must be a function.");
@@ -372,93 +105,92 @@ function resolveConfig(projectRoot, value, registry = serverPluginsByType) {
 		library: resolvePath(projectRoot, requiredString(value, "library")),
 		manifestsDir: resolvePath(projectRoot, requiredString(value, "manifestsDir")),
 		proxyBasePath,
+		dependencies: [],
 		plugins: resolvedPlugins,
 		import: { figma: {
 			...figma.token !== void 0 ? { token: figma.token } : {},
 			...figma.defaultFileKey !== void 0 ? { defaultFileKey: figma.defaultFileKey } : {},
 			defaults: { scale }
 		} },
-		usage: usage === void 0 ? null : usage,
-		packageSources: resolvePackageSources(projectRoot, value.packages),
-		packages: []
+		usage: usage === void 0 ? null : usage
 	};
 }
-function nearestNamedPackageJson(entryPath, name) {
-	let dir = dirname(entryPath);
+/** Validated dependency source specs (shape only; absent means none). */
+function dependencySpecs(value) {
+	const specs = value.dependencies;
+	if (specs === void 0) return [];
+	if (!Array.isArray(specs) || specs.some((spec) => typeof spec !== "string" || spec.length === 0)) throw new Error("fundus.config: \"dependencies\" must be an array of non-empty strings.");
+	return specs;
+}
+/** Reject a `.json` dependency source: JSON carries no literal types (D4). */
+function assertNotJson(spec, context) {
+	if (spec.endsWith(".json")) throw new Error(`Dependency ${context} "${spec}" must be a .ts or .js module; JSON is not supported.`);
+}
+/** A dependency spec is a path when it is relative/absolute or names a module file. */
+function isPathSpec(spec) {
+	return spec.startsWith(".") || spec.startsWith("/") || spec.endsWith(".ts") || spec.endsWith(".js");
+}
+/** Walk up from `fromPath` to the nearest package.json whose `name` matches. */
+function nearestPackageJson(fromPath, name) {
+	let dir = dirname(fromPath);
 	for (;;) {
 		const candidate = join(dir, "package.json");
 		if (existsSync(candidate)) try {
-			const pkg = JSON.parse(readFileSync(candidate, "utf8"));
-			if (isRecord(pkg) && pkg.name === name) return {
-				dir,
-				pkg
-			};
+			if (JSON.parse(readFileSync(candidate, "utf8")).name === name) return candidate;
 		} catch {}
 		const parent = dirname(dir);
 		if (parent === dir) break;
 		dir = parent;
 	}
-	throw new Error(`Cannot find the package.json for fundus package "${name}" (resolved to ${entryPath}).`);
+	throw new Error(`Cannot resolve the package.json of dependency "${name}".`);
 }
-/**
-* Resolve a name-form Package to its root directory + parsed `package.json`. A
-* declaration-only Package ships no JS entry module, so resolving the bare name
-* would throw `MODULE_NOT_FOUND`; resolve its `package.json` subpath first and
-* only fall back to entry resolution when an `exports` map hides it.
-*/
-function resolvePackageRoot(require, reference, origin) {
-	try {
-		const manifestPath = require.resolve(`${reference}/package.json`);
-		const pkg = JSON.parse(readFileSync(manifestPath, "utf8"));
-		if (isRecord(pkg)) return {
-			dir: dirname(manifestPath),
-			pkg
-		};
-	} catch {}
-	let entry;
+/** Resolve an npm-name dependency spec to its declared source module path. */
+function resolveNpmDependencyModule(spec, require) {
+	let packageJsonPath;
 	try {
-		entry = require.resolve(reference);
-	} catch {
-		throw new Error(`Cannot resolve fundus package "${origin}": no installed package declares it — is it a dependency?`);
+		packageJsonPath = require.resolve(`${spec}/package.json`);
+	} catch (cause) {
+		if (cause !== null && typeof cause === "object" && cause.code === "ERR_PACKAGE_PATH_NOT_EXPORTED") packageJsonPath = nearestPackageJson(require.resolve(spec), spec);
+		else throw cause;
 	}
-	return nearestNamedPackageJson(entry, reference);
+	const field = JSON.parse(readFileSync(packageJsonPath, "utf8")).fundus?.dependencies;
+	if (typeof field !== "string" || field.length === 0) throw new Error(`Dependency "${spec}" is missing a non-empty "fundus".dependencies module path in its package.json.`);
+	assertNotJson(field, `package.json "fundus".dependencies field of "${spec}"`);
+	return resolve(dirname(packageJsonPath), field);
 }
 /**
-* Read and parse every declared Package from disk. Name entries resolve through
-* the host's module resolver (respecting `exports`), then walk up to the nearest
-* `package.json` that declares the name and read its `"fundus"` field. Path
-* entries point directly at a `fundus.package.json`. Throws a clear,
-* origin-tagged error on any resolution/read/parse failure — Package assembly
-* failures are symmetric with a missing `fundus.config.ts`.
+* Load and aggregate every configured dependency source (D3, D6). `requireAnchor`
+* anchors npm-name resolution at the host project (injectable for tests). Flat:
+* the dependencies of a referenced npm package are not resolved recursively.
 */
-async function loadPackages(projectRoot, sources) {
-	const require = createRequire(pathToFileURL(join(projectRoot, "fundus.config.ts")).href);
-	const packages = [];
-	for (const source of sources) {
-		let file;
-		let defaultRawDir;
-		if (source.kind === "path") {
-			file = source.reference;
-			if (!existsSync(file)) throw new Error(`Fundus package file not found: ${file} (from "${source.origin}").`);
-			defaultRawDir = dirname(file);
-		} else {
-			const { dir, pkg } = resolvePackageRoot(require, source.reference, source.origin);
-			const fundusField = pkg.fundus;
-			if (!isRecord(fundusField) || typeof fundusField.package !== "string" || fundusField.package.length === 0) throw new Error(`Fundus package "${source.origin}" is missing a "fundus.package" field in its package.json.`);
-			file = resolve(dir, fundusField.package);
-			if (!existsSync(file)) throw new Error(`Fundus package "${source.origin}" declaration not found: ${file}.`);
-			defaultRawDir = typeof fundusField.rawDir === "string" && fundusField.rawDir.length > 0 ? resolve(dir, fundusField.rawDir) : dir;
+async function resolveDependencies(projectRoot, specs, requireAnchor = join(resolve(projectRoot), "package.json")) {
+	if (specs.length === 0) return [];
+	const jiti = createJiti(import.meta.url, { interopDefault: false });
+	const require = createRequire(requireAnchor);
+	const aggregated = /* @__PURE__ */ new Map();
+	for (const spec of specs) {
+		assertNotJson(spec, "source");
+		const modulePath = isPathSpec(spec) ? resolve(resolve(projectRoot), spec) : resolveNpmDependencyModule(spec, require);
+		const loaded = await jiti.import(modulePath);
+		const value = loaded.default ?? loaded;
+		for (const dependency of validateDependencyList(spec, value)) {
+			const existing = aggregated.get(dependency.id);
+			if (existing === void 0) {
+				aggregated.set(dependency.id, {
+					type: dependency.type,
+					sources: [spec]
+				});
+				continue;
+			}
+			if (existing.type !== dependency.type) throw new Error(`Dependency "${dependency.id}" is declared as "${existing.type}" by "${existing.sources.join("\", \"")}" and as "${dependency.type}" by "${spec}".`);
+			if (!existing.sources.includes(spec)) existing.sources.push(spec);
 		}
-		const declaration = await loadPackageDeclaration(file, source.origin);
-		const rawDir = source.rawDirOverride !== void 0 ? resolve(projectRoot, source.rawDirOverride) : defaultRawDir;
-		packages.push({
-			origin: source.origin,
-			file,
-			rawDir,
-			declaration
-		});
 	}
-	return packages;
+	return [...aggregated].map(([id, { type, sources }]) => ({
+		id,
+		type,
+		sources
+	}));
 }
 /** Load `fundus.config.ts` from the host project root. */
 async function loadConfig(projectRoot) {
@@ -471,153 +203,14 @@ async function loadConfig(projectRoot) {
 	} catch (cause) {
 		throw new Error(`Cannot load fundus.config.ts: ${cause instanceof Error ? cause.message : String(cause)}`);
 	}
-	const config = resolveConfig(root, isRecord(module) && "default" in module ? module.default : module);
-	return {
-		...config,
-		packages: await loadPackages(root, config.packageSources)
-	};
-}
-async function imageFingerprint(filePath, hashSize) {
-	const width = hashSize + 1;
-	const pixels = await sharp(filePath).rotate().trim({
-		background: {
-			r: 0,
-			g: 0,
-			b: 0,
-			alpha: 0
-		},
-		threshold: 0
-	}).resize({
-		width,
-		height: hashSize,
-		fit: "fill"
-	}).ensureAlpha().toColourspace("srgb").raw().toBuffer();
-	const hash = new Uint8Array(Math.ceil(hashSize * hashSize / 8));
-	const alphaHash = new Uint8Array(hash.length);
-	const colorTotals = [
-		0,
-		0,
-		0
-	];
-	let alphaTotal = 0;
-	let bit = 0;
-	for (let row = 0; row < hashSize; row++) for (let column = 0; column < hashSize; column++) {
-		const leftOffset = (row * width + column) * 4;
-		const rightOffset = leftOffset + 4;
-		const leftAlpha = pixels[leftOffset + 3] / 255;
-		const rightAlpha = pixels[rightOffset + 3] / 255;
-		if (visibleLuminance(pixels, leftOffset, leftAlpha) < visibleLuminance(pixels, rightOffset, rightAlpha)) hash[bit >> 3] |= 1 << 7 - (bit & 7);
-		if (leftAlpha < rightAlpha) alphaHash[bit >> 3] |= 1 << 7 - (bit & 7);
-		for (let channel = 0; channel < 3; channel++) colorTotals[channel] += pixels[leftOffset + channel] * leftAlpha;
-		alphaTotal += leftAlpha;
-		bit += 1;
-	}
-	const pixelCount = hashSize * hashSize;
+	const value = isRecord(module) && "default" in module ? module.default : module;
+	const resolved = resolveConfig(root, value);
+	const dependencies = await resolveDependencies(root, isRecord(value) ? dependencySpecs(value) : []);
 	return {
-		hash,
-		alphaHash,
-		meanColor: colorTotals.map((total) => alphaTotal === 0 ? 0 : total / alphaTotal),
-		meanAlpha: alphaTotal / pixelCount
+		...resolved,
+		dependencies
 	};
 }
-function visibleLuminance(pixels, offset, alpha) {
-	return (pixels[offset] * .2126 + pixels[offset + 1] * .7152 + pixels[offset + 2] * .0722) * alpha + 127 * (1 - alpha);
-}
-function colorDistance(left, right) {
-	return Math.hypot(left[0] - right[0], left[1] - right[1], left[2] - right[2]);
-}
-/** Count differing bits between two equally sized perceptual hashes. */
-function hammingDistance(left, right) {
-	if (left.length !== right.length) throw new Error("Image hashes must have the same length.");
-	let distance = 0;
-	for (let index = 0; index < left.length; index++) {
-		let value = left[index] ^ right[index];
-		while (value !== 0) {
-			value &= value - 1;
-			distance += 1;
-		}
-	}
-	return distance;
-}
-/**
-* Stateful so the editor can reuse fingerprints by content hash between state
-* snapshots. Unreadable raws are omitted: duplicate detection is advisory and
-* must not hide the editor or replace the pipeline's canonical diagnostics.
-*/
-var ImageDuplicateDetector = class {
-	#fingerprints = /* @__PURE__ */ new Map();
-	async find(library, rawDir) {
-		const images = Object.entries(library.assets).filter(([, record]) => record.type === "image").sort(([left], [right]) => compareCodeUnits(left, right));
-		const activeHashes = new Set(images.map(([, record]) => record.rawHash));
-		for (const hash of this.#fingerprints.keys()) if (!activeHashes.has(hash)) this.#fingerprints.delete(hash);
-		const readable = [];
-		for (const [id, record] of images) {
-			let fingerprint = this.#fingerprints.get(record.rawHash);
-			if (!fingerprint) {
-				fingerprint = imageFingerprint(join(rawDir, record.raw), 8);
-				this.#fingerprints.set(record.rawHash, fingerprint);
-			}
-			try {
-				readable.push({
-					id,
-					fingerprint: await fingerprint
-				});
-			} catch {
-				this.#fingerprints.delete(record.rawHash);
-			}
-		}
-		const duplicates = /* @__PURE__ */ new Map();
-		for (let leftIndex = 0; leftIndex < readable.length; leftIndex++) for (let rightIndex = leftIndex + 1; rightIndex < readable.length; rightIndex++) {
-			const left = readable[leftIndex];
-			const right = readable[rightIndex];
-			if (hammingDistance(left.fingerprint.hash, right.fingerprint.hash) > 5 || hammingDistance(left.fingerprint.alphaHash, right.fingerprint.alphaHash) > 5 || Math.abs(left.fingerprint.meanAlpha - right.fingerprint.meanAlpha) > .125 || colorDistance(left.fingerprint.meanColor, right.fingerprint.meanColor) > 32) continue;
-			const leftDuplicates = duplicates.get(left.id) ?? [];
-			leftDuplicates.push(right.id);
-			duplicates.set(left.id, leftDuplicates);
-			const rightDuplicates = duplicates.get(right.id) ?? [];
-			rightDuplicates.push(left.id);
-			duplicates.set(right.id, rightDuplicates);
-		}
-		return duplicates;
-	}
-};
-//#endregion
-//#region src/lib/server/check.ts
-/**
-* The delivered-slot contract: a Package slot that is delivered (explicit member
-* or in a delivered manifest's reference closure) but has no host-supplied bytes
-* must be filled. A slot with an `importSource` is `slot-unmaterialized` (run
-* import); a slot with nothing is `slot-unfilled`. Inert (undelivered) slots
-* produce no finding.
-*/
-function packageSlotFindings(library, provenance, membership) {
-	const deliveringManifests = /* @__PURE__ */ new Map();
-	for (const [name, manifestMembership] of Object.entries(membership)) for (const assetId of manifestMembership.deliveredAssetIds) {
-		const names = deliveringManifests.get(assetId) ?? [];
-		names.push(name);
-		deliveringManifests.set(assetId, names);
-	}
-	const findings = [];
-	for (const [assetId, record] of Object.entries(library.assets)) {
-		if (record.raw !== void 0) continue;
-		const names = deliveringManifests.get(assetId);
-		if (!names || names.length === 0) continue;
-		const originRecord = provenance[assetId];
-		const origin = originRecord && originRecord.source !== "host" ? originRecord.origin : "a package";
-		const deliveredBy = [...names].sort(compareCodeUnits).map((name) => `"${name}"`).join(", ");
-		if (record.importSource !== void 0) findings.push({
-			kind: "slot-unmaterialized",
-			assetId,
-			message: `Slot "${assetId}" (from ${origin}) has an import source but no bytes yet — run import to fill it. Delivered by: ${deliveredBy}.`
-		});
-		else findings.push({
-			kind: "slot-unfilled",
-			assetId,
-			message: `Slot "${assetId}" (from ${origin}) has no bytes, import source, or host override. Delivered by: ${deliveredBy}.`
-		});
-	}
-	return findings;
-}
 //#endregion
 //#region src/lib/server/raw-safety.ts
 function rawSafetyIssueKey(issue) {
@@ -1678,6 +1271,110 @@ function pathsFromRoot(root, target, referencesByAsset, countMemo = /* @__PURE__
 function usageSnapshotRevision(parts) {
 	return createHash("sha256").update(parts.join("\0")).digest("hex");
 }
+async function imageFingerprint(filePath, hashSize) {
+	const width = hashSize + 1;
+	const pixels = await sharp(filePath).rotate().trim({
+		background: {
+			r: 0,
+			g: 0,
+			b: 0,
+			alpha: 0
+		},
+		threshold: 0
+	}).resize({
+		width,
+		height: hashSize,
+		fit: "fill"
+	}).ensureAlpha().toColourspace("srgb").raw().toBuffer();
+	const hash = new Uint8Array(Math.ceil(hashSize * hashSize / 8));
+	const alphaHash = new Uint8Array(hash.length);
+	const colorTotals = [
+		0,
+		0,
+		0
+	];
+	let alphaTotal = 0;
+	let bit = 0;
+	for (let row = 0; row < hashSize; row++) for (let column = 0; column < hashSize; column++) {
+		const leftOffset = (row * width + column) * 4;
+		const rightOffset = leftOffset + 4;
+		const leftAlpha = pixels[leftOffset + 3] / 255;
+		const rightAlpha = pixels[rightOffset + 3] / 255;
+		if (visibleLuminance(pixels, leftOffset, leftAlpha) < visibleLuminance(pixels, rightOffset, rightAlpha)) hash[bit >> 3] |= 1 << 7 - (bit & 7);
+		if (leftAlpha < rightAlpha) alphaHash[bit >> 3] |= 1 << 7 - (bit & 7);
+		for (let channel = 0; channel < 3; channel++) colorTotals[channel] += pixels[leftOffset + channel] * leftAlpha;
+		alphaTotal += leftAlpha;
+		bit += 1;
+	}
+	const pixelCount = hashSize * hashSize;
+	return {
+		hash,
+		alphaHash,
+		meanColor: colorTotals.map((total) => alphaTotal === 0 ? 0 : total / alphaTotal),
+		meanAlpha: alphaTotal / pixelCount
+	};
+}
+function visibleLuminance(pixels, offset, alpha) {
+	return (pixels[offset] * .2126 + pixels[offset + 1] * .7152 + pixels[offset + 2] * .0722) * alpha + 127 * (1 - alpha);
+}
+function colorDistance(left, right) {
+	return Math.hypot(left[0] - right[0], left[1] - right[1], left[2] - right[2]);
+}
+/** Count differing bits between two equally sized perceptual hashes. */
+function hammingDistance(left, right) {
+	if (left.length !== right.length) throw new Error("Image hashes must have the same length.");
+	let distance = 0;
+	for (let index = 0; index < left.length; index++) {
+		let value = left[index] ^ right[index];
+		while (value !== 0) {
+			value &= value - 1;
+			distance += 1;
+		}
+	}
+	return distance;
+}
+/**
+* Stateful so the editor can reuse fingerprints by content hash between state
+* snapshots. Unreadable raws are omitted: duplicate detection is advisory and
+* must not hide the editor or replace the pipeline's canonical diagnostics.
+*/
+var ImageDuplicateDetector = class {
+	#fingerprints = /* @__PURE__ */ new Map();
+	async find(library, rawDir) {
+		const images = Object.entries(library.assets).filter(([, record]) => record.type === "image").sort(([left], [right]) => compareCodeUnits(left, right));
+		const activeHashes = new Set(images.map(([, record]) => record.rawHash));
+		for (const hash of this.#fingerprints.keys()) if (!activeHashes.has(hash)) this.#fingerprints.delete(hash);
+		const readable = [];
+		for (const [id, record] of images) {
+			let fingerprint = this.#fingerprints.get(record.rawHash);
+			if (!fingerprint) {
+				fingerprint = imageFingerprint(join(rawDir, record.raw), 8);
+				this.#fingerprints.set(record.rawHash, fingerprint);
+			}
+			try {
+				readable.push({
+					id,
+					fingerprint: await fingerprint
+				});
+			} catch {
+				this.#fingerprints.delete(record.rawHash);
+			}
+		}
+		const duplicates = /* @__PURE__ */ new Map();
+		for (let leftIndex = 0; leftIndex < readable.length; leftIndex++) for (let rightIndex = leftIndex + 1; rightIndex < readable.length; rightIndex++) {
+			const left = readable[leftIndex];
+			const right = readable[rightIndex];
+			if (hammingDistance(left.fingerprint.hash, right.fingerprint.hash) > 5 || hammingDistance(left.fingerprint.alphaHash, right.fingerprint.alphaHash) > 5 || Math.abs(left.fingerprint.meanAlpha - right.fingerprint.meanAlpha) > .125 || colorDistance(left.fingerprint.meanColor, right.fingerprint.meanColor) > 32) continue;
+			const leftDuplicates = duplicates.get(left.id) ?? [];
+			leftDuplicates.push(right.id);
+			duplicates.set(left.id, leftDuplicates);
+			const rightDuplicates = duplicates.get(right.id) ?? [];
+			rightDuplicates.push(left.id);
+			duplicates.set(right.id, rightDuplicates);
+		}
+		return duplicates;
+	}
+};
 //#endregion
 //#region src/lib/server/operations.ts
 /**
@@ -2173,24 +1870,7 @@ var FundusOperations = class {
 		this.#validateImportedRaw(raw);
 		const fileName = raw.suggestedFileName ?? `${options.id}.${raw.extension}`;
 		const plugin = serverPluginForType(options.type, this.#registry);
-		const packageBase = this.#packageBase(await this.#store.read(), options.id);
-		if (packageBase && packageBase.type !== options.type) throw new SourceImportError("invalid-input", `Filling slot "${options.id}" requires the package type "${packageBase.type}", not "${options.type}".`);
-		let slotOverride = {};
-		if (packageBase) {
-			const pixelRatio = figmaSlicePixelRatio(raw, options.type);
-			if (pixelRatio !== void 0) slotOverride = mergeParameterPatch(slotOverride, { pixelRatio });
-			if (options.parametersPatch !== void 0) slotOverride = mergeParameterPatch(slotOverride, options.parametersPatch);
-		}
-		const library = packageBase ? await this.#store.createAsset({
-			fileName,
-			bytes: raw.bytes,
-			type: options.type,
-			id: options.id,
-			folder: options.folder,
-			manifests: options.manifests,
-			importSource: raw.importSource,
-			parametersOverride: slotOverride
-		}) : await this.#store.createAsset({
+		const library = await this.#store.createAsset({
 			fileName,
 			bytes: raw.bytes,
 			type: options.type,
@@ -2225,8 +1905,7 @@ var FundusOperations = class {
 		const folder = normalizeFolderPath(options.folder ?? "");
 		if (folder !== "" && !library.folders.includes(folder)) throw new SourceImportError("invalid-input", `Unknown folder "${folder}".`);
 		if (options.manifests !== void 0 && (!Array.isArray(options.manifests) || options.manifests.some((value) => typeof value !== "string"))) throw new SourceImportError("invalid-input", "Import manifests must be an array of strings.");
-		const validManifests = this.#effectiveOf(library).effective.manifests;
-		for (const manifest of new Set(options.manifests ?? [])) if (!Object.hasOwn(validManifests, manifest)) throw new SourceImportError("invalid-input", `Unknown manifest "${manifest}".`);
+		for (const manifest of new Set(options.manifests ?? [])) if (!Object.hasOwn(library.manifests, manifest)) throw new SourceImportError("invalid-input", `Unknown manifest "${manifest}".`);
 	}
 	#validateImportedRaw(raw, importerKind) {
 		if (!(raw.bytes instanceof Uint8Array) || !/^[a-z0-9]+$/.test(raw.extension)) throw new SourceImportError("invalid-response", "The source importer returned invalid raw data.");
@@ -2241,7 +1920,7 @@ var FundusOperations = class {
 	}
 	async #patchAsset(id, body) {
 		let library = await this.#store.read();
-		this.#assertHostAsset(library, id, "editing it");
+		this.#requireAsset(library, id);
 		if (body.parameters !== void 0) library = await this.#store.updateParameters(id, body.parameters);
 		if (body.manifests !== void 0) {
 			if (!Array.isArray(body.manifests) || body.manifests.some((name) => typeof name !== "string")) throw new Error("\"manifests\" must be an array of manifest names.");
@@ -2443,13 +2122,11 @@ var FundusOperations = class {
 	async #runAfterMutation(library) {
 		const pipelineIssues = [];
 		const classification = await this.#classifyRawDirectory(library);
-		const { effective, provenance, mergeFindings } = this.#effectiveOf(library);
-		const materialized = materializeLibrary(effective);
-		const ordinaryIssues = [...await this.#store.validate(library, { flatSpace: false }), ...this.#flatIssues(effective, provenance, mergeFindings)];
+		const ordinaryIssues = await this.#store.validate(library);
 		const safetyIssues = this.#rawSafetyIssues(library, classification);
 		if (ordinaryIssues.length === 0 && safetyIssues.length === 0) try {
-			const report = await processAssets(this.#config, materialized, this.#registry);
-			await generateManifestModules(this.#config, materialized, report.proxies, this.#registry);
+			const report = await processAssets(this.#config, library, this.#registry);
+			await generateManifestModules(this.#config, library, report.proxies, this.#registry);
 		} catch (cause) {
 			pipelineIssues.push({ message: `Processing failed: ${cause instanceof Error ? cause.message : String(cause)}` });
 		}
@@ -2461,10 +2138,10 @@ var FundusOperations = class {
 			state: await this.#snapshotState(latestLibrary, latestClassification, pipelineIssues)
 		};
 	}
-	async #buildState(host, library, provenance, issues, classification) {
-		const [gitBranch, changedGitAssets] = await Promise.all([currentGitBranch(this.#config.projectRoot), gitAssetChanges(this.#config.projectRoot, this.#config.library, host)]);
+	async #buildState(library, issues, classification) {
+		const [gitBranch, changedGitAssets] = await Promise.all([currentGitBranch(this.#config.projectRoot), gitAssetChanges(this.#config.projectRoot, this.#config.library, library)]);
 		const referencesByAsset = collectAllReferences(library, descriptorsByType(this.#registry));
-		const duplicatesByAsset = await this.#duplicateDetector.find(host, this.#config.rawDir);
+		const duplicatesByAsset = await this.#duplicateDetector.find(library, this.#config.rawDir);
 		const membershipByManifest = computeLibraryMembership(library, referencesByAsset);
 		const delivered = allDeliveredAssetIds(membershipByManifest);
 		const passiveManifestsByAsset = /* @__PURE__ */ new Map();
@@ -2485,24 +2162,17 @@ var FundusOperations = class {
 			});
 			incomingByAsset.set(reference.assetId, incoming);
 		}
+		const requiredByAsset = /* @__PURE__ */ new Map();
+		for (const dependency of this.#config.dependencies) requiredByAsset.set(dependency.id, [...dependency.sources]);
 		const assets = [];
 		for (const assetId of Object.keys(library.assets).sort(compareCodeUnits)) {
 			const record = library.assets[assetId];
-			const prov = provenance[assetId] ?? { source: "host" };
-			const origin = prov.source === "host" ? { kind: "host" } : prov.source === "package" ? {
-				kind: "package",
-				origin: prov.origin
-			} : {
-				kind: "override",
-				origin: prov.origin
-			};
-			const isSlot = record.raw === void 0;
 			const warnings = [];
 			for (const issue of issues) if (issue.assetId === assetId) warnings.push(issue.message);
-			if (record.manifests.length === 0 && !delivered.has(assetId) && !isSlot) warnings.push("In no manifest and not referenced by any delivered asset — nothing is processed or generated for it.");
+			if (record.manifests.length === 0 && !delivered.has(assetId)) warnings.push("In no manifest and not referenced by any delivered asset — nothing is processed or generated for it.");
 			if (record.importSource && !this.#importers.has(record.importSource.importer)) warnings.push(`Importer "${record.importSource.importer}" is unavailable; the local raw file remains usable.`);
 			let proxy = null;
-			if (delivered.has(assetId) && !isSlot) try {
+			if (delivered.has(assetId)) try {
 				const currentProxy = await readCurrentProxy(assetId, record, this.#config, this.#registry);
 				if (currentProxy) proxy = {
 					url: `/files/proxy/${encodeRelativePathForUrl(currentProxy.relativePath)}`,
@@ -2513,15 +2183,13 @@ var FundusOperations = class {
 			} catch (cause) {
 				warnings.push(cause instanceof Error ? cause.message : String(cause));
 			}
-			const raw = record.raw ?? "";
-			const rawHash = record.rawHash ?? "";
 			assets.push({
 				id: assetId,
 				type: record.type,
-				raw,
-				folder: folderOfRawPath(raw),
-				rawUrl: isSlot ? "" : `/files/raw/${encodeRelativePathForUrl(raw)}?v=${rawHash.slice(0, 12)}`,
-				rawHash,
+				raw: record.raw,
+				folder: folderOfRawPath(record.raw),
+				rawUrl: `/files/raw/${encodeRelativePathForUrl(record.raw)}?v=${record.rawHash.slice(0, 12)}`,
+				rawHash: record.rawHash,
 				gitStatus: changedGitAssets.get(assetId) ?? null,
 				importSource: record.importSource,
 				parameters: record.parameters,
@@ -2537,8 +2205,7 @@ var FundusOperations = class {
 					})),
 					incoming: incomingByAsset.get(assetId) ?? []
 				},
-				origin,
-				overridden: origin.kind === "override"
+				requiredBy: requiredByAsset.get(assetId) ?? []
 			});
 		}
 		const proxySizeByAssetId = new Map(assets.filter((asset) => asset.proxy).map((asset) => [asset.id, asset.proxy?.fileSize ?? 0]));
@@ -2562,7 +2229,7 @@ var FundusOperations = class {
 			presetNames[type] = names;
 			presetCapabilities[type] = Object.fromEntries(names.map((name) => [name, plugin.presetCapabilities?.(presets[name]) ?? {}]));
 		}
-		const rawIngestionQueue = this.#buildRawIngestionQueue(host, classification);
+		const rawIngestionQueue = this.#buildRawIngestionQueue(library, classification);
 		return {
 			gitBranch,
 			library,
@@ -2576,8 +2243,7 @@ var FundusOperations = class {
 			presetCapabilities,
 			manifestMemberships,
 			manifestDeliveredBytes,
-			rawIngestionQueue,
-			packageOrigins: this.#config.packages.map((pkg) => pkg.origin).sort(compareCodeUnits)
+			rawIngestionQueue
 		};
 	}
 	#compatibleTypes(path) {
@@ -2590,11 +2256,10 @@ var FundusOperations = class {
 		return rawSafetyIssues(library, classification, (path) => this.#compatibleTypes(path));
 	}
 	async #snapshotState(library, classification, extraIssues = []) {
-		const { effective, provenance, mergeFindings } = this.#effectiveOf(library);
 		const issues = [
-			...await this.#store.validate(library, { flatSpace: false }),
-			...this.#flatIssues(effective, provenance, mergeFindings),
+			...await this.#store.validate(library),
 			...this.#rawSafetyIssues(library, classification),
+			...validateDependencies(this.#config.dependencies, library),
 			...extraIssues
 		];
 		const seen = /* @__PURE__ */ new Set();
@@ -2604,7 +2269,7 @@ var FundusOperations = class {
 			seen.add(key);
 			return true;
 		});
-		return this.#buildState(library, effective, provenance, uniqueIssues, classification);
+		return this.#buildState(library, uniqueIssues, classification);
 	}
 	#canAutoReconcile(classification, retry = false) {
 		return classification.complete && classification.blockers.length === 0 && classification.moves.length + classification.deletions.length > 0 && (!retry || classification.edited.length === 0 && classification.unmanaged.length === 0);
@@ -2693,59 +2358,6 @@ var FundusOperations = class {
 	#requireAsset(library, id) {
 		if (!Object.hasOwn(library.assets, id)) throw new Error(`Unknown asset "${id}".`);
 	}
-	/** Merge the configured Packages under the host library (host wins). */
-	#effectiveOf(host) {
-		const { library, provenance, findings } = mergePackages(host, this.#config.packages ?? []);
-		return {
-			effective: library,
-			provenance,
-			mergeFindings: findings
-		};
-	}
-	/**
-	* The Package base record for `id` when `id` is a read-only Package asset the
-	* host has not yet filled — i.e. this create is a *slot fill*. Returns null
-	* for a plain new host asset.
-	*/
-	#packageBase(host, id) {
-		if (Object.hasOwn(host.assets, id)) return null;
-		const { effective, provenance } = this.#effectiveOf(host);
-		if (provenance[id]?.source === "package") return { type: effective.assets[id].type };
-		return null;
-	}
-	/**
-	* Flat-space validation over the effective library: merge errors, id/type/
-	* parameter/membership/appearance/reference checks, module collisions, and
-	* delivered-slot findings. Disk/host checks stay in `store.validate(host,
-	* { flatSpace: false })`.
-	*/
-	#flatIssues(effective, provenance, mergeFindings) {
-		const membership = computeLibraryMembership(effective, collectAllReferences(effective, descriptorsByType(this.#registry)));
-		return [
-			...mergeFindings.filter((finding) => finding.kind !== "package-overridden").map((finding) => ({
-				assetId: finding.assetId,
-				message: finding.message
-			})),
-			...flatLibraryIssues(effective, descriptorsByType(this.#registry)),
-			...manifestModuleCollisionIssues(effective.manifests),
-			...packageSlotFindings(effective, provenance, membership).map((finding) => ({
-				assetId: finding.assetId,
-				message: finding.message
-			}))
-		];
-	}
-	/**
-	* Whether an id is a read-only Package asset the host has not overridden.
-	* Such ids can be filled/overridden (write a host record) but not mutated,
-	* renamed, moved, or deleted in place.
-	*/
-	#assertHostAsset(host, id, action) {
-		if (Object.hasOwn(host.assets, id)) return;
-		const { provenance } = this.#effectiveOf(host);
-		const prov = provenance[id];
-		if (prov && prov.source !== "host") throw new Error(`Asset "${id}" is provided by package "${prov.origin}"; ${action} is not available. Override it by importing or uploading bytes with this id.`);
-		throw new Error(`Unknown asset "${id}".`);
-	}
 	/**
 	* Apply a CLI asset change to the store, validating the resulting library
 	* on an in-memory candidate first — nothing is persisted when the change
@@ -2794,4 +2406,4 @@ async function createFundusContext() {
 }
 
 export { getFundusContext as g, initializeFundusContext as i };
-//# sourceMappingURL=context.js-Dh0ibRIF.js.map
+//# sourceMappingURL=context.js-BIgcUcEl.js.map