torch-glare 2.5.6 → 2.6.0

package/dist/src/shared/installFromPlan.js

@@ -1,66 +1,133 @@
 import fs from "fs";
 import path from "path";
-import { fileURLToPath } from "url";
-import { copyComponentsRecursively } from "./copyComponentsRecursively.js";
 import { ensureDirectoryExists } from "./ensureDirectoryExists.js";
 import { installNpmPackages } from "./installDependencies.js";
 import { isInstalled } from "./resolveEntry.js";
 import { loadRegistry } from "./loadRegistry.js";
+import { fetchRegistryItems, RegistryError } from "./registryClient.js";
 import { resolveInstallPlan } from "./resolveInstallPlan.js";
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-/** `apps/lib` in the published package — the root every registry `path` is relative to. */
-const LIB_DIR = path.resolve(__dirname, "../../../apps/lib");
+/** Where this project's files live — `<cwd>/<glare.json path>`, with a leading "@/" stripped. */
+export function installRoot(config) {
+    return path.join(process.cwd(), config.path.replace("@/", ""));
+}
 /**
  * Install one registry item and everything it needs.
  *
- * Dependencies come from `apps/lib/registry.json` — the same generated graph the docs and the MCP
- * server read — rather than from scanning import statements as files are copied. The old walker had
- * no visited set and no cycle guard, and ran once per copied file, so a 35-file component triggered
- * 35 recursive walks; worse, a dependency skipped because its folder already existed was never
+ * Dependencies come from the registry index — the same generated graph the docs and the MCP server
+ * read — rather than from scanning import statements as files are written. The old walker had no
+ * visited set and no cycle guard, and ran once per copied file, so a 35-file component triggered 35
+ * recursive walks; worse, a dependency skipped because its folder already existed was never
  * descended into, which silently truncated the tree (`add DataViews` installed 16 of 55 items and
  * exited 0).
  *
  * Resolving up front also gives `force` a coherent meaning: it applies to **every** item in the
  * plan, not only the one you named.
  */
-export function installFromPlan(type, name, config, force) {
-    const registry = loadRegistry();
+export async function installFromPlan(type, name, config, force) {
+    const registry = await loadRegistry();
     const plan = resolveInstallPlan(registry, type, name);
     if (!plan)
         return null;
-    const installed = [];
+    const root = installRoot(config);
+    // Work out what needs writing before fetching anything — there is no reason to pull 200KB over
+    // the network for 55 items only to skip 54 of them as already present.
+    const pending = [];
     const skipped = [];
     for (const item of plan.items) {
-        const source = path.join(LIB_DIR, item.path);
-        if (!fs.existsSync(source))
-            continue;
-        const entry = path.basename(item.path);
-        const targetDir = path.join(process.cwd(), config.path.replace("@/", ""), item.type);
-        if (isInstalled(targetDir, entry) && !force) {
+        if (isInstalled(path.join(root, item.type), entryOf(item.path)) && !force) {
             skipped.push(`${item.type}/${item.name}`);
-            continue;
         }
-        // Replacing: clear the old copy first, so a folder that lost files upstream does not keep
-        // them locally.
-        const target = path.join(targetDir, entry);
-        if (force && fs.existsSync(target))
-            fs.rmSync(target, { recursive: true, force: true });
-        ensureDirectoryExists(targetDir);
-        copyComponentsRecursively(source, targetDir);
-        installed.push(`${item.type}/${item.name}`);
+        else {
+            pending.push(item);
+        }
+    }
+    const payloads = pending.length
+        ? await fetchRegistryItems(pending)
+        : new Map();
+    const installed = [];
+    for (const item of pending) {
+        const ref = `${item.type}/${item.name}`;
+        const payload = payloads.get(ref);
+        if (!payload) {
+            // The index listed it, so a gap here means the registry is internally inconsistent.
+            // The old code `continue`d past a missing source without a word, which is how a
+            // partial install passed for a complete one.
+            throw new RegistryError(`${ref} is in the registry index but could not be fetched.`);
+        }
+        writeItem(payload, item.path, root, force);
+        installed.push(ref);
     }
     // Once, for the union — not once per file, which is what produced five "cn.ts has been added"
     // lines and five separate npm invocations for a single `add`.
-    //
-    // Pinned to the range the library builds against. Unpinned, `add DataTable` pulled
-    // @tanstack/react-table v9 against a component written for v8 — copied code that could not
-    // compile on arrival.
-    const pinned = [...plan.npmDependencies].map((name) => {
-        const range = registry.npmVersions?.[name];
-        return range ? `${name}@${range}` : name;
+    return {
+        installed,
+        skipped,
+        npm: installNpmPackages(pinRanges(plan.npmDependencies, payloads, registry)),
+    };
+}
+/**
+ * Resolve each npm dependency to a spec with its version range attached.
+ *
+ * Unpinned, `add DataTable` pulled @tanstack/react-table v9 against a component written for v8 —
+ * code that could not compile on arrival. Two sources carry the range, and both are consulted:
+ * a fetched item payload already has it inlined (`clsx@^2.1.1`), and the index hoists ranges into
+ * a shared `npmVersions` map. The payload is preferred because it is the more specific of the two;
+ * the index covers items that were skipped and so never fetched.
+ *
+ * Reading only the index — which is what this did — meant a registry with a sparse `npmVersions`
+ * installed everything unpinned in silence, which is the exact failure pinning exists to prevent.
+ */
+function pinRanges(deps, payloads, registry) {
+    const fromPayloads = new Map();
+    for (const payload of payloads.values()) {
+        for (const spec of payload.dependencies ?? []) {
+            // The leading `@` of a scoped package is not a separator.
+            const at = spec.lastIndexOf("@");
+            if (at > 0)
+                fromPayloads.set(spec.slice(0, at), spec);
+        }
+    }
+    const unpinned = [];
+    const specs = [...deps].map((dep) => {
+        const fromPayload = fromPayloads.get(dep);
+        if (fromPayload)
+            return fromPayload;
+        const range = registry.npmVersions?.[dep];
+        if (range)
+            return `${dep}@${range}`;
+        unpinned.push(dep);
+        return dep;
     });
-    const npm = installNpmPackages(pinned);
-    return { installed, skipped, npm };
+    if (unpinned.length) {
+        console.warn(`⚠️  No version range for ${unpinned.join(", ")} — installing the latest. ` +
+            `The registry should pin these.`);
+    }
+    return specs;
+}
+/** The file or folder an item occupies, e.g. `Button.tsx` or `DataViews`, from its registry path. */
+function entryOf(itemPath) {
+    return path.basename(itemPath);
+}
+/** Write one payload's files under `root`, replacing what is there when forced. */
+function writeItem(payload, itemPath, root, force) {
+    const ref = `${payload.type}/${payload.name}`;
+    // Replacing: clear the old copy first, so a folder that lost files upstream does not keep
+    // them locally.
+    const target = path.join(root, payload.type, entryOf(itemPath));
+    if (force && fs.existsSync(target))
+        fs.rmSync(target, { recursive: true, force: true });
+    for (const file of payload.files) {
+        const dest = path.join(root, file.target);
+        // The target comes off the network, so it is not trusted to stay inside the project.
+        // Note there is no `dest !== root` escape hatch: a target of "" or "." normalises to the
+        // root itself, which is not a file we should ever write, and letting it through only
+        // turned a clear rejection into an EISDIR crash.
+        if (!dest.startsWith(root + path.sep)) {
+            throw new RegistryError(`${ref} wants to write outside the install directory: ${file.target}`);
+        }
+        ensureDirectoryExists(path.dirname(dest));
+        fs.writeFileSync(dest, file.content);
+    }
 }
 /** `✅ 55 installed, 0 skipped` — truncation has to be visible, not inferred from silence. */
 export function reportInstall(name, result, where) {

package/dist/src/shared/installFromPlan.js.map

@@ -1 +1 @@
-{"version":3,"file":"installFromPlan.js","sourceRoot":"","sources":["../../../cli/src/shared/installFromPlan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,2FAA2F;AAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAQ7D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC3B,IAA0B,EAC1B,IAAY,EACZ,MAAc,EACd,KAAc;IAEd,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAErC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAErF,IAAI,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,SAAS;QACb,CAAC;QAED,0FAA0F;QAC1F,gBAAgB;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAExF,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACjC,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7C,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,8FAA8F;IAC9F,8DAA8D;IAC9D,EAAE;IACF,mFAAmF;IACnF,2FAA2F;IAC3F,sBAAsB;IACtB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACvC,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAqB,EAAE,KAAa;IAC5E,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAEhD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,0BAA0B,KAAK,oCAAoC,CAAC,CAAC;QAC3F,OAAO;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CACP,KAAK,IAAI,MAAM,KAAK,KAAK,SAAS,CAAC,MAAM,YAAY;QACjD,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,KAAK,KAAK,UAAU,CAC3B,CAAC;AACN,CAAC"}
+{"version":3,"file":"installFromPlan.js","sourceRoot":"","sources":["../../../cli/src/shared/installFromPlan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAS7D,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,MAAc;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,IAA0B,EAC1B,IAAY,EACZ,MAAc,EACd,KAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEjC,+FAA+F;IAC/F,uEAAuE;IACvE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;QAC3B,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC;QACnC,CAAC,CAAC,IAAI,GAAG,EAA+B,CAAC;IAE7C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,oFAAoF;YACpF,gFAAgF;YAChF,6CAA6C;YAC7C,MAAM,IAAI,aAAa,CAAC,GAAG,GAAG,qDAAqD,CAAC,CAAC;QACzF,CAAC;QACD,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,8FAA8F;IAC9F,8DAA8D;IAC9D,OAAO;QACH,SAAS;QACT,OAAO;QACP,GAAG,EAAE,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC/E,CAAC;AACN,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CACd,IAAiB,EACjB,QAA0C,EAC1C,QAAkD;IAElD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAC5C,0DAA0D;YAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,EAAE,GAAG,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAChC,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QAEpC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACR,4BAA4B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B;YACvE,gCAAgC,CACvC,CAAC;IACN,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,qGAAqG;AACrG,SAAS,OAAO,CAAC,QAAgB;IAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CACd,OAA4B,EAC5B,QAAgB,EAChB,IAAY,EACZ,KAAc;IAEd,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAE9C,0FAA0F;IAC1F,gBAAgB;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,IAAI,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAExF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,qFAAqF;QACrF,yFAAyF;QACzF,qFAAqF;QACrF,iDAAiD;QACjD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CACnB,GAAG,GAAG,kDAAkD,IAAI,CAAC,MAAM,EAAE,CACxE,CAAC;QACN,CAAC;QACD,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAqB,EAAE,KAAa;IAC5E,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAEhD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,0BAA0B,KAAK,oCAAoC,CAAC,CAAC;QAC3F,OAAO;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CACP,KAAK,IAAI,MAAM,KAAK,KAAK,SAAS,CAAC,MAAM,YAAY;QACjD,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,KAAK,KAAK,UAAU,CAC3B,CAAC;AACN,CAAC"}

package/dist/src/shared/loadRegistry.d.ts

@@ -1,7 +1,16 @@
 import { Registry } from "../types/main.js";
 /**
- * Load and cache the generated component registry.
- * @returns {Registry} The parsed registry manifest.
+ * Load and cache the component registry index.
+ *
+ * Fetched once per process and handed to `resolveInstallPlan`, which walks dependencies locally
+ * rather than recursing over the network per item.
+ *
+ * There is no local fallback. The CLI used to ship the whole library inside its own tarball and
+ * could quietly install from that when the network failed; it no longer carries it, so "the
+ * registry is unreachable" is a real failure and is reported as one. Silently succeeding from a
+ * stale bundle was how a project ended up with component source nobody could account for.
  */
-export declare function loadRegistry(): Registry;
+export declare function loadRegistry(): Promise<Registry>;
+/** Test seam — the module-level cache would otherwise leak between cases. */
+export declare function resetRegistryCache(): void;
 //# sourceMappingURL=loadRegistry.d.ts.map

package/dist/src/shared/loadRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loadRegistry.d.ts","sourceRoot":"","sources":["../../../cli/src/shared/loadRegistry.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAW5C;;;GAGG;AACH,wBAAgB,YAAY,IAAI,QAAQ,CAkBvC"}
+{"version":3,"file":"loadRegistry.d.ts","sourceRoot":"","sources":["../../../cli/src/shared/loadRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,CAWtD;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/src/shared/loadRegistry.js

@@ -1,31 +1,30 @@
-import fs from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-// registry.json ships alongside the library source (apps/lib), the same location the
-// command modules resolve their template dirs from.
-const REGISTRY_PATH = path.resolve(__dirname, "../../../apps/lib/registry.json");
+import { fetchRegistryIndex, indexUrl, RegistryError } from "./registryClient.js";
 let cached = null;
 /**
- * Load and cache the generated component registry.
- * @returns {Registry} The parsed registry manifest.
+ * Load and cache the component registry index.
+ *
+ * Fetched once per process and handed to `resolveInstallPlan`, which walks dependencies locally
+ * rather than recursing over the network per item.
+ *
+ * There is no local fallback. The CLI used to ship the whole library inside its own tarball and
+ * could quietly install from that when the network failed; it no longer carries it, so "the
+ * registry is unreachable" is a real failure and is reported as one. Silently succeeding from a
+ * stale bundle was how a project ended up with component source nobody could account for.
  */
-export function loadRegistry() {
+export async function loadRegistry() {
     if (cached)
         return cached;
-    if (!fs.existsSync(REGISTRY_PATH)) {
-        console.error("❌ registry.json not found. It is generated from library source via " +
-            "`node scripts/bin/generateRegistry/index.js`.");
-        process.exit(1);
-    }
     try {
-        cached = JSON.parse(fs.readFileSync(REGISTRY_PATH, "utf-8"));
-        return cached;
+        cached = await fetchRegistryIndex();
     }
     catch (error) {
-        console.error("❌ Error reading registry.json:", error.message);
-        process.exit(1);
+        const reason = error instanceof RegistryError ? error.message : String(error);
+        throw new RegistryError(`${reason}\n   Registry: ${indexUrl()}`);
     }
+    return cached;
+}
+/** Test seam — the module-level cache would otherwise leak between cases. */
+export function resetRegistryCache() {
+    cached = null;
 }
 //# sourceMappingURL=loadRegistry.js.map

package/dist/src/shared/loadRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadRegistry.js","sourceRoot":"","sources":["../../../cli/src/shared/loadRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAGpC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C,qFAAqF;AACrF,oDAAoD;AACpD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;AAEjF,IAAI,MAAM,GAAoB,IAAI,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,YAAY;IACxB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CACT,qEAAqE;YACjE,+CAA+C,CACtD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAa,CAAC;QACzE,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC"}
+{"version":3,"file":"loadRegistry.js","sourceRoot":"","sources":["../../../cli/src/shared/loadRegistry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAElF,IAAI,MAAM,GAAoB,IAAI,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,IAAI,aAAa,CAAC,GAAG,MAAM,kBAAkB,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAC9B,MAAM,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/src/shared/registryClient.d.ts

@@ -0,0 +1,19 @@
+import type { Registry, RegistryItem, RegistryItemPayload } from "../types/main.js";
+export declare class RegistryError extends Error {
+}
+/** Fetch the registry index: every item, its dependencies and its file list, without content. */
+export declare function fetchRegistryIndex(): Promise<Registry>;
+/** The index URL, exported so an error can name it without re-deriving it. */
+export declare function indexUrl(): string;
+/** Test seam, and a guard against one command's fetches leaking into another's. */
+export declare function resetItemMemo(): void;
+/** Fetch one item payload by its absolute URL, memoised and validated. */
+export declare function fetchItemByUrl(url: string): Promise<RegistryItemPayload>;
+/**
+ * Fetch every item in an install plan, `CONCURRENCY` at a time.
+ *
+ * Serially this is the difference between roughly 15s and 2s for `add DataViews`; unbounded it is
+ * 55 simultaneous connections, which is how you get rate-limited by a registry host.
+ */
+export declare function fetchRegistryItems(items: RegistryItem[]): Promise<Map<string, RegistryItemPayload>>;
+//# sourceMappingURL=registryClient.d.ts.map

package/dist/src/shared/registryClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryClient.d.ts","sourceRoot":"","sources":["../../../cli/src/shared/registryClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAgCpF,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAmC3C,iGAAiG;AACjG,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,QAAQ,CAAC,CAM5D;AAED,8EAA8E;AAC9E,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAYD,mFAAmF;AACnF,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAED,0EAA0E;AAC1E,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4B9E;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,YAAY,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAa3C"}

package/dist/src/shared/registryClient.js

@@ -0,0 +1,128 @@
+/**
+ * HTTP client for the hosted component registry.
+ *
+ * Until 2.5.7 the CLI shipped the whole library inside its own npm tarball and copied from there,
+ * which meant a one-line component fix required publishing a new version of the CLI. Components now
+ * come from a registry over HTTP, so source and tooling version independently.
+ *
+ * Everything here is fetch + JSON. `resolveInstallPlan` still does the dependency walk locally
+ * against a single fetched index, rather than recursing over the network per item — that keeps the
+ * resolver a pure, synchronous, testable function, and turns an N-deep request waterfall into one
+ * request plus one parallel batch.
+ */
+/**
+ * Where components come from: the `registry/` directory on the Glare repo's default branch,
+ * served by raw.githubusercontent.com.
+ *
+ * Fetched straight from the repo rather than through a branded URL on the docs site. The site was
+ * proxying this exact origin, and measuring it made the case plain: the proxy was *slower* than
+ * what it proxied (0.31-0.67s vs 0.27s), traded a CDN for a single VPS, and coupled every install
+ * to a website deploy. raw already sends `access-control-allow-origin: *`, which was the one thing
+ * the route added that could not be got for free.
+ */
+const REGISTRY_URL = "https://raw.githubusercontent.com/TORCH-Corp/TORCH-Glare/main/registry";
+/** Parallel item fetches. Measured ~275ms per request; `add DataViews` is 55 items. */
+const CONCURRENCY = 8;
+const REQUEST_TIMEOUT_MS = 20000;
+export class RegistryError extends Error {
+}
+async function getJson(url) {
+    let response;
+    try {
+        response = await fetch(url, {
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            headers: { Accept: "application/json" },
+        });
+    }
+    catch (error) {
+        // Offline, DNS failure, timeout. Deliberately distinguished from a 404 below: conflating
+        // them sends people hunting for a typo in a component name when the network is at fault.
+        throw new RegistryError(`Could not reach the registry at ${url}\n   ${error.message}`);
+    }
+    if (response.status === 404) {
+        throw new RegistryError(`Not found in the registry: ${url}`);
+    }
+    if (!response.ok) {
+        throw new RegistryError(`Registry returned ${response.status} for ${url}`);
+    }
+    const body = await response.text();
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new RegistryError(`Registry returned invalid JSON from ${url} ` +
+            `(${body.slice(0, 80).replace(/\s+/g, " ")}…)`);
+    }
+}
+/** Fetch the registry index: every item, its dependencies and its file list, without content. */
+export async function fetchRegistryIndex() {
+    const registry = await getJson(indexUrl());
+    if (!registry || !Array.isArray(registry.items)) {
+        throw new RegistryError(`Registry index at ${indexUrl()} has no items array.`);
+    }
+    return registry;
+}
+/** The index URL, exported so an error can name it without re-deriving it. */
+export function indexUrl() {
+    return `${REGISTRY_URL}/index.json`;
+}
+/**
+ * Payloads already fetched in this process, keyed by absolute URL.
+ *
+ * `update` is what makes this matter. It calls `add` once per installed item, and each call
+ * resolves its own dependency closure — which overlap heavily. Measured with 55 items installed:
+ * 287 item fetches for 55 distinct items, every one a request the registry host has to serve.
+ * With this, 55.
+ */
+const memo = new Map();
+/** Test seam, and a guard against one command's fetches leaking into another's. */
+export function resetItemMemo() {
+    memo.clear();
+}
+/** Fetch one item payload by its absolute URL, memoised and validated. */
+export async function fetchItemByUrl(url) {
+    const hit = memo.get(url);
+    if (hit)
+        return hit;
+    const pending = (async () => {
+        const payload = await getJson(url);
+        if (!Array.isArray(payload.files) || payload.files.length === 0) {
+            throw new RegistryError(`Registry item at ${url} has no files.`);
+        }
+        for (const file of payload.files) {
+            if (typeof file?.target !== "string" || typeof file?.content !== "string") {
+                throw new RegistryError(`Registry item at ${url} has a malformed file entry.`);
+            }
+        }
+        return payload;
+    })();
+    memo.set(url, pending);
+    try {
+        return await pending;
+    }
+    catch (error) {
+        // Do not memoise a failure — a transient network error should not poison the rest of
+        // the run, and `update` would otherwise repeat one blip across every remaining item.
+        memo.delete(url);
+        throw error;
+    }
+}
+/**
+ * Fetch every item in an install plan, `CONCURRENCY` at a time.
+ *
+ * Serially this is the difference between roughly 15s and 2s for `add DataViews`; unbounded it is
+ * 55 simultaneous connections, which is how you get rate-limited by a registry host.
+ */
+export async function fetchRegistryItems(items) {
+    const out = new Map();
+    const queue = [...items];
+    const workers = Array.from({ length: Math.min(CONCURRENCY, queue.length) }, async () => {
+        for (let next = queue.shift(); next; next = queue.shift()) {
+            const url = `${REGISTRY_URL}/${next.type}/${next.name}.json`;
+            out.set(`${next.type}/${next.name}`, await fetchItemByUrl(url));
+        }
+    });
+    await Promise.all(workers);
+    return out;
+}
+//# sourceMappingURL=registryClient.js.map

package/dist/src/shared/registryClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryClient.js","sourceRoot":"","sources":["../../../cli/src/shared/registryClient.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,wEAAwE,CAAC;AAE9F,uFAAuF;AACvF,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAElC,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG;AAE3C,KAAK,UAAU,OAAO,CAAI,GAAW;IACjC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC/C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC1C,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,yFAAyF;QACzF,yFAAyF;QACzF,MAAM,IAAI,aAAa,CACnB,mCAAmC,GAAG,QAAS,KAAe,CAAC,OAAO,EAAE,CAC3E,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,qBAAqB,QAAQ,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,aAAa,CACnB,uCAAuC,GAAG,GAAG;YACzC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CACrD,CAAC;IACN,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAW,QAAQ,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,qBAAqB,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ;IACpB,OAAO,GAAG,YAAY,aAAa,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;AAE7D,mFAAmF;AACnF,MAAM,UAAU,aAAa;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QACxB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAsB,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,aAAa,CAAC,oBAAoB,GAAG,gBAAgB,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACxE,MAAM,IAAI,aAAa,CAAC,oBAAoB,GAAG,8BAA8B,CAAC,CAAC;YACnF,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvB,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,qFAAqF;QACrF,qFAAqF;QACrF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,GAAG,EAA+B,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACnF,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC;YAC7D,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/src/shared/resolveEntry.d.ts

@@ -1,14 +1,17 @@
 /**
- * Resolve a user-provided name to an actual entry in a templates directory.
+ * Resolve a user-provided name to a registry item name.
  *
- * `readdirSync` returns names **with** their extensions, so comparing a bare `useDragDrop` against
- * that list never matches — which is why `torch-glare hook useDragDrop` used to do nothing at all.
- * Every command resolves through here now, so a bare name, a name with an extension, and a folder
- * component all work the same way whichever command you reach for.
+ * `available` is now the registry's own list of item names, not a `readdirSync` of a templates
+ * directory. That inversion matters: resolution used to be filesystem-first, so a name the local
+ * listing did not contain was rejected before the registry was ever consulted — which made every
+ * component that exists only in the hosted registry unreachable.
  *
- * Tries, in order: exact match · `.tsx` · `.ts` · anything on disk the listing missed.
+ * Registry names carry no extension, so a user typing `Button.tsx` (or copying it out of a file
+ * tree) has it stripped rather than failing to match.
+ *
+ * Tries, in order: exact · extension stripped · case-insensitive.
  */
-export declare function resolveEntry(input: string, available: string[], dir: string): string | null;
+export declare function resolveEntry(input: string, available: string[]): string | null;
 /**
  * Is this item actually installed?
  *

package/dist/src/shared/resolveEntry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveEntry.d.ts","sourceRoot":"","sources":["../../../cli/src/shared/resolveEntry.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU3F;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQrE"}
+{"version":3,"file":"resolveEntry.d.ts","sourceRoot":"","sources":["../../../cli/src/shared/resolveEntry.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAc9E;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQrE"}

package/dist/src/shared/resolveEntry.js

@@ -1,25 +1,30 @@
 import fs from "fs";
 import path from "path";
 /**
- * Resolve a user-provided name to an actual entry in a templates directory.
+ * Resolve a user-provided name to a registry item name.
  *
- * `readdirSync` returns names **with** their extensions, so comparing a bare `useDragDrop` against
- * that list never matches — which is why `torch-glare hook useDragDrop` used to do nothing at all.
- * Every command resolves through here now, so a bare name, a name with an extension, and a folder
- * component all work the same way whichever command you reach for.
+ * `available` is now the registry's own list of item names, not a `readdirSync` of a templates
+ * directory. That inversion matters: resolution used to be filesystem-first, so a name the local
+ * listing did not contain was rejected before the registry was ever consulted — which made every
+ * component that exists only in the hosted registry unreachable.
  *
- * Tries, in order: exact match · `.tsx` · `.ts` · anything on disk the listing missed.
+ * Registry names carry no extension, so a user typing `Button.tsx` (or copying it out of a file
+ * tree) has it stripped rather than failing to match.
+ *
+ * Tries, in order: exact · extension stripped · case-insensitive.
  */
-export function resolveEntry(input, available, dir) {
-    if (available.includes(input))
-        return input;
-    for (const candidate of [`${input}.tsx`, `${input}.ts`]) {
+export function resolveEntry(input, available) {
+    const candidates = [input, input.replace(/\.(tsx|ts)$/, "")];
+    for (const candidate of candidates) {
         if (available.includes(candidate))
             return candidate;
     }
-    // Last-ditch: a folder component, or something the listing filtered out.
-    if (fs.existsSync(path.join(dir, input)))
-        return input;
+    // `torch-glare add button` should not be a dead end when `Button` is right there.
+    for (const candidate of candidates) {
+        const match = available.find((name) => name.toLowerCase() === candidate.toLowerCase());
+        if (match)
+            return match;
+    }
     return null;
 }
 /**

package/dist/src/shared/resolveEntry.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveEntry.js","sourceRoot":"","sources":["../../../cli/src/shared/resolveEntry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAmB,EAAE,GAAW;IACxE,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,KAAK,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACxD,CAAC;IAED,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzC,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC3B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}
+{"version":3,"file":"resolveEntry.js","sourceRoot":"","sources":["../../../cli/src/shared/resolveEntry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAmB;IAC3D,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;IAE7D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACxD,CAAC;IAED,kFAAkF;IAClF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACvF,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzC,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC3B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/src/shared/suggestOtherCommand.d.ts

@@ -1,8 +1,14 @@
+import type { Registry, RegistryItem } from "../types/main.js";
+type ItemType = RegistryItem["type"];
 /**
  * A name that is not a component may still be something we ship.
  *
  * `torch-glare add useDragDrop` answering only "Component not found" is technically correct and
  * practically useless — it *is* installable, just by a different command. Look before saying no.
+ *
+ * Reads the registry index rather than scanning sibling directories in the installed package, so
+ * it keeps working once the library stops shipping in the tarball.
  */
-export declare function suggestOtherCommand(input: string): string | null;
+export declare function suggestOtherCommand(registry: Registry, input: string, exclude: ItemType): string | null;
+export {};
 //# sourceMappingURL=suggestOtherCommand.d.ts.map

package/dist/src/shared/suggestOtherCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suggestOtherCommand.d.ts","sourceRoot":"","sources":["../../../cli/src/shared/suggestOtherCommand.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAehE"}
+{"version":3,"file":"suggestOtherCommand.d.ts","sourceRoot":"","sources":["../../../cli/src/shared/suggestOtherCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE/D,KAAK,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAWrC;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,GAClB,MAAM,GAAG,IAAI,CA2Bf"}

package/dist/src/shared/suggestOtherCommand.js

@@ -1,33 +1,39 @@
-import fs from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const LIB_DIR = path.resolve(__dirname, "../../../apps/lib");
-/** Which command installs which folder. */
-const KINDS = [
-    { dir: "hooks", command: "hook", label: "hook" },
-    { dir: "utils", command: "util", label: "utility" },
-    { dir: "layouts", command: "layout", label: "layout" },
-    { dir: "providers", command: "provider", label: "provider" },
-];
+/** Which command installs which type, and what to call it in a sentence. */
+const KINDS = {
+    components: { command: "add", label: "component" },
+    hooks: { command: "hook", label: "hook" },
+    utils: { command: "util", label: "utility" },
+    layouts: { command: "layout", label: "layout" },
+    providers: { command: "provider", label: "provider" },
+};
 /**
  * A name that is not a component may still be something we ship.
  *
  * `torch-glare add useDragDrop` answering only "Component not found" is technically correct and
  * practically useless — it *is* installable, just by a different command. Look before saying no.
+ *
+ * Reads the registry index rather than scanning sibling directories in the installed package, so
+ * it keeps working once the library stops shipping in the tarball.
  */
-export function suggestOtherCommand(input) {
+export function suggestOtherCommand(registry, input, exclude) {
     const bare = input.replace(/\.(tsx|ts)$/, "").toLowerCase();
-    for (const kind of KINDS) {
-        const dir = path.join(LIB_DIR, kind.dir);
-        if (!fs.existsSync(dir))
-            continue;
-        for (const entry of fs.readdirSync(dir)) {
-            if (entry.replace(/\.(tsx|ts)$/, "").toLowerCase() === bare) {
-                const name = entry.replace(/\.(tsx|ts)$/, "");
-                return `"${name}" is a ${kind.label} — try \`torch-glare ${kind.command} ${name}\`.`;
-            }
-        }
+    const match = registry.items.find((item) => item.type !== exclude && item.name.toLowerCase() === bare);
+    if (match) {
+        const kind = KINDS[match.type];
+        return `"${match.name}" is a ${kind.label} — try \`torch-glare ${kind.command} ${match.name}\`.`;
+    }
+    // No exact match anywhere: offer the closest names of the type they asked for, which catches
+    // the ordinary case of a typo or half-remembered name.
+    const near = registry.items
+        .filter((item) => item.type === exclude)
+        .map((item) => item.name)
+        .filter((name) => {
+        const lower = name.toLowerCase();
+        return lower.includes(bare) || bare.includes(lower);
+    })
+        .slice(0, 3);
+    if (near.length) {
+        return `Did you mean: ${near.join(", ")}?`;
     }
     return null;
 }