Deps redesign: package universe repositories, Resolver-owned selection

.cursor/rules/separation-of-concerns.mdc

@@ -59,7 +59,7 @@ end
 
 # GOOD: separate classes for separate layers
 class DependencyResolver   # resolve + lock layer
-class DependencyInstaller  # install layer
+class Installer  # install layer
 ```
 
 ## Integration-specific logic stays in its integration

.cursor/rules/strong-types.mdc

@@ -78,7 +78,7 @@ end
 
 # GOOD: parser returns domain object immediately
 def parse(path)
-  DependencyDeclaration.new(name: yaml["name"], version: yaml["version"])
+  Declaration.new(name: yaml["name"], integration: :cmake, constraint: yaml["constraint"])
 end
 ```
 

.rubocop.yml

@@ -30,25 +30,9 @@ Sorbet/StrictSigil:
     - src/**/*
     - lib/**/*
   Exclude:
-    # The pre-bundle bootstrap chain (dependencies.rb -> dev/deps -> ...,
-    # plus ensure_bundler) is loaded by bin/setup.rb and bin/test.rb BEFORE
-    # the bundle exists, so it must stay stdlib-only: `sig` blocks would
-    # require sorbet-runtime at load time. These files cap at `typed: true`
-    # (or `typed: false` where noted).
-    - lib/ensure_bundler.rb
-    - lib/dev/deps.rb
-    - lib/dev/deps/cli_ui.rb
-    - lib/dev/deps/config.rb
-    - lib/dev/deps/lockfile.rb
-    - lib/dev/deps/tap.rb
-    - lib/dev/deps/dependency_installer.rb
-    # `typed: false` holdouts: Data.define with a keyword-args initialize
+    # `typed: false` holdouts. Data.define with a keyword-args initialize
     # override is rejected by Sorbet (error 4010)...
     - lib/dev/deps/dependency.rb
-    - lib/dev/deps/dependency_declaration.rb
-    # ...method_missing dispatch into a required-keyword method needs
-    # T.unsafe, which the pre-bundle constraint forbids...
-    - lib/dev/deps/dsl.rb
     # ...and Fetcher consumes a consumer-repo Lockfile API (parse,
     # runtime_ref_map) that doesn't resolve against this repo's Lockfile.
     - lib/dev/deps/fetcher.rb

bin/install-build-deps.rb

@@ -48,7 +48,7 @@ def install_brew_entry(entry)
   when Hash
     entry.each do |name, opts|
       # Host-gated entries (e.g. brew "xcodes", host: :darwin) skip
-      # non-matching hosts — mirrors DependencyInstaller#filter_by_host.
+      # non-matching hosts — mirrors Installer#filter_by_host.
       host = opts["host"]
       if host && host.to_s != HOST
         puts ">>> Skipping #{name} (host: #{host})"

bin/rbi.rb

@@ -29,14 +29,13 @@
 
 CLI::UI::StdoutRouter.enable
 
-load File.join(DEV_ROOT, "dependencies.rb")
 require "ensure_bundler"
 
 class TapiocaGemError < StandardError; end
 
 CLI::UI.frame("Regenerating gem RBI files...") do
   CLI::UI.spinner("Ensuring bundler is installed...") do
-    ensure_bundler!(DEV_ROOT)
+    EnsureBundler.ensure!(DEV_ROOT)
   end
 
   CLI::UI.spinner("Generating gem RBI files...") do

bin/setup.rb

@@ -51,7 +51,7 @@
 class BundleInstallError < StandardError; end
 
 CLI::UI.frame("Setting up dev environment...") do
-  unless CLI::UI.spinner("Installing bundler...") { ensure_bundler!(DEV_ROOT) }
+  unless CLI::UI.spinner("Installing bundler...") { EnsureBundler.ensure!(DEV_ROOT) }
     exit 1
   end
 

bin/tc.rb

@@ -24,8 +24,6 @@
 DEV_ROOT = File.expand_path("..", __dir__)
 $LOAD_PATH.unshift(File.join(DEV_ROOT, "lib")) unless $LOAD_PATH.include?(File.join(DEV_ROOT, "lib"))
 
-load File.join(DEV_ROOT, "dependencies.rb")
-
 ENV["BUNDLE_GEMFILE"] ||= File.join(DEV_ROOT, "Gemfile")
 require "bundler/setup"
 
@@ -41,7 +39,7 @@ class RbiOutOfDateError < StandardError; end
 # CLI::UI.spinner returns false when the task fails (debrief prints exceptions
 # but never re-raises), so we check each return value explicitly.
 CLI::UI.frame("Type checking...") do
-  unless CLI::UI.spinner("Install Bundler") { ensure_bundler!(DEV_ROOT) }
+  unless CLI::UI.spinner("Install Bundler") { EnsureBundler.ensure!(DEV_ROOT) }
     exit 1
   end
 

bin/test.rb

@@ -24,8 +24,6 @@
 DEV_ROOT = File.expand_path("..", __dir__)
 $LOAD_PATH.unshift(File.join(DEV_ROOT, "lib")) unless $LOAD_PATH.include?(File.join(DEV_ROOT, "lib"))
 
-load File.join(DEV_ROOT, "dependencies.rb")
-
 ENV["BUNDLE_GEMFILE"] ||= File.join(DEV_ROOT, "Gemfile")
 require "bundler/setup"
 
@@ -47,7 +45,7 @@ class TestError < StandardError; end
 def main
   requested_files = ARGV
   CLI::UI.frame("Running tests...") do
-    unless CLI::UI.spinner("Install Bundler") { ensure_bundler!(DEV_ROOT) }
+    unless CLI::UI.spinner("Install Bundler") { EnsureBundler.ensure!(DEV_ROOT) }
       exit 1
     end
 

dependencies.rb

@@ -3,10 +3,10 @@
 
 # dev's own dependency manifest. Loaded in two ways:
 # - by dev itself (before every command) to read the project toolchain;
-# - by bin/setup.rb and bin/test.rb BEFORE the bundle exists, for the
-#   bootstrap constants below. The dev/deps require chain is stdlib-only,
-#   so this file must stay loadable pre-bundle (both callers put lib/ on
-#   the load path first). The guard keeps re-loads idempotent.
+# - by EnsureBundler (for the bin/ scripts), for the bootstrap constants
+#   below. Every caller activates gems first (bundler/setup or plain
+#   RubyGems), so the dev/deps require chain is free to use sorbet-runtime.
+#   The guard keeps re-loads idempotent.
 require "dev/deps"
 
 Dev::Deps.define do