Fixed registry distribution

uibot.distribution.snapshot.v1 binds the public bundle hash, explicit resource/package versions and hashes to final registry item bytes, file targets/lengths/hashes, exact direct npm versions, and MIT/ISC license files. snapshotId is SHA-256 over canonical JSON with sorted object keys, excluding only snapshotId; transport origin and timestamps are absent. resourceHash describes the author resource, not its installable bytes. Public discovery exposes references; the full manifest is a separate immutable artifact. release.sourceHash continues to hash only index/showcases/documents; the snapshot binds that hash separately.

The build reads local author sources and the Bun lockfile, pins npm requirements before serializing registry items, and copies those exact bytes to snapshots/<id>/r/. A local registry closure with missing dependencies, target conflicts or inconsistent npm versions fails the build. Resources requiring external shadcn registry items have an explicit snapshotUnavailable reason, with no mutable fallback. No network fetch during generation.

Save, verify, install

Use the candidate CLI (or a packed CLI from the same candidate), with an explicit bundle:

uibot resource install-plan template:console-billing --source https://your-portal/resources/bundle.json --export ./uibot-snapshot
uibot resource install-plan template:console-billing --verify ./uibot-snapshot
uibot snapshot-serve ./uibot-snapshot --port 4444

A local bundle path is also accepted. Export fetches and verifies the entire selected closure and licenses in memory before writing any destination. All destinations pass lexical and canonical containment checks and an existing-file comparison before the first write. Identical repeated exports succeed; conflicting files or symlinks fail without overwriting local edits. Use a dedicated, single-writer destination. An I/O failure during writing can leave an incomplete export: verification must succeed before consumption.

The saved directory includes snapshot.json, selection.json, r/*.json and licenses/*. Verification and serving use only these files, without contacting the original portal. The server binds to loopback, validates before listening, serves verified bytes held in memory, and returns 404 for every missing dependency. It never proxies to the mutable registry.

Merge the server's printed mapping into the host components.json, keeping existing settings:

{ "registries": { "@uibot": "http://127.0.0.1:4444/r/{name}.json" } }

Then run the server's printed pinned bunx [email protected] add <local-item-url> command. The installer may format/transform source and normalize dependency ranges; the verified hashes describe its registry inputs, not host output bytes. Retain the snapshot license files with redistributed source, including the Lucide/Feather notice that a TSX transformer may remove. Do not use --overwrite: resolve existing-file conflicts explicitly and retain host edits. The official shadcn installer owns host file placement, aliases, CSS and dependency installation; the snapshot exporter never writes application source. npm packages and their transitive graph still require a host frozen lockfile and registry/cache access. Registry offline availability is not offline npm availability. Integrity hashes are not signatures or publication receipts: select a trusted bundle and pin its expected identity with --snapshot <sha256> on export and verify.

@uibot/registry exports Node integrity helpers. @uibot/registry/resources remains browser-safe and read-only. HTTP/MCP install-plan returns the same identity and closure; CLI-only export/verify and loopback serving are not MCP tools. This does not discover plugins, change capabilities, establish host acceptance, publish packages or deploy a service.