expose/isolate allowed package manager descriptors

It'd be super useful to be able to query whether or not a package manager string (e.g., yarn@3.2.3+sha224.953c8233f7a92884eee2de69a1b92d1f2ec1655e66d08071ba9a02fa or npm@latest) is valid without needing to invoke corepack. Or even the ability to grab a big list.

I haven't looked too closely at the source here, but it appears config.json determines how the package managers are found and downloaded, and Engine does that work. There's a CI job which updates config.json, too.

My use case is that I'm wrapping corepack and want to provide some input validation before I invoke it. Ideally, corepack could export some function I could call (resolveDescriptior()?)--instead of dropping into a child process. But that seems to be counter to the project goals, as it exports nothing.

What if some portion of the fetching/lookup were extracted into its own library, instead? Happy to look into this if you feel it's something you'd consider.

Start by reading config.json and the Engine entry point to understand how package manager descriptors are found and downloaded, then inspect the CI job that updates config.json. The issue is done when callers can validate or query descriptors without invoking corepack, through an exposed function or extracted library.