feat(cli): add ecosystem resolvers for npm, pypi, pub

[amondnet]

Summary

• Add resolver layer that maps ecosystem package names (npm, pypi, pub) to GitHub repositories by fetching package metadata APIs
• When a registry lookup misses for an ecosystem-prefixed spec (e.g. npm:lodash), the CLI falls back to the appropriate resolver
• Support semver range resolution for npm (e.g. ^15 → latest 15.x.x)
• Provide git ref fallback (try v{version} then {version})

Changes

• packages/cli/src/resolvers/ — new resolver module with interface, factory, and 3 implementations
• packages/cli/src/index.ts — wire resolver fallback into add command
• packages/cli/src/sources/npm.ts — mark as @deprecated
• README.md — document ecosystem resolvers
• 146 tests (all passing), lint clean, tsc clean

Test plan

• bun run --cwd packages/cli test — all 146 tests pass
• bun run --cwd packages/cli lint — no errors
• bun run --cwd packages/cli build — tsc compiles cleanly
• Verify npm:lodash resolves to lodash/lodash (mocked)
• Verify pub:riverpod resolves to rrousselGit/riverpod (mocked)
• Verify npm:next@^15 resolves to latest 15.x.x (mocked)
• Registry-hit specs bypass resolver path (regression test)

Closes #6

---

Summary by cubic

Adds ecosystem resolvers for npm, pypi, and pub so specs like npm:lodash auto-map to GitHub when the registry misses in ask docs add. Adds npm semver range support, git ref fallbacks, and docs on resolver architecture; deprecates the old npm tarball source. Implements #6.

• New Features

  • Resolver layer with npm, pypi, pub; add falls back on registry miss for ecosystem-prefixed specs and delegates to the GitHub source.
  • npm ranges (e.g. ^15, ~3.22) resolve via semver and dist-tags to the best match.
  • Git ref fallback: resolvers return a primary ref and fallbackRefs (try v{version} then {version}).
  • Docs: README and CLAUDE.md document resolver architecture and gotchas.

• Migration

  • source: 'npm' is deprecated; use npm:<name> or owner/repo.
  • No breaking change this release; existing configs continue to work.

^{Written for commit cc6bd0d. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 80.69307% with 39 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/cli/src/index.ts	2.50%	39 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cloudflare-workers-and-pages]

Deploying ask-registry with    Cloudflare Pages

Latest commit:	cc6bd0d
Status:	⚡️  Build in progress...

View logs

[cubic-dev-ai]

0 issues found across 3 files (changes from recent commits).

_{Requires human review: Significant feature addition adding a new resolver layer, external API integrations, and a new production dependency (semver), requiring human review of the logic and architecture.}

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

_{Requires human review: Significant new feature adding ecosystem resolution logic and external API integrations; requires human review for core CLI path changes.}