Morphir.Ion
0.5.0-alpha.3
Prefix Reserved
dotnet add package Morphir.Ion --version 0.5.0-alpha.3
NuGet\Install-Package Morphir.Ion -Version 0.5.0-alpha.3
<PackageReference Include="Morphir.Ion" Version="0.5.0-alpha.3" />
<PackageVersion Include="Morphir.Ion" Version="0.5.0-alpha.3" />
<PackageReference Include="Morphir.Ion" />
paket add Morphir.Ion --version 0.5.0-alpha.3
#r "nuget: Morphir.Ion, 0.5.0-alpha.3"
#:package Morphir.Ion@0.5.0-alpha.3
#addin nuget:?package=Morphir.Ion&version=0.5.0-alpha.3&prerelease
#tool nuget:?package=Morphir.Ion&version=0.5.0-alpha.3&prerelease
<img src="https://github.com/finos/branding/blob/master/project-logos/active-project-logos/Morphir%20Logo/Horizontal/2020_Morphir_Logo_Horizontal.png?raw=true" width="450">
Morphir
Morphir is a library of tools that works to capture business logic as data.
For the first time, business logic can be shared, stored, translated and visualised, all with the reliability of standardisation ensured in the Morphir framework.
What is it?
A set of tools for integrating technologies. Morphir is composed of a library of tools that facilitate the digitisation of business logic into multiple different languages & platforms. The Morphir framework is unique too in that facilities elements of automation and conversion that were previously unavailable in the field of finance-tech.
Why is it important?
Makes business logic portable. Business logic digitised provides distinct advantages: capacity for movement across departments and fields & the ability to be converted to new languages and applications.
How does it work?
Defines a standard format for storing and sharing business logic. A clear set of standards and format is in-place from the input/output, allowing for coherent structure.
What are the benefits?
✔️ Eliminates technical debt risk
Refactoring code libraries is often a harmful and time-sensitive issue for businesses, Morphir ensure the standards introduced from input eliminate delays at deployment.
✔️ Increases agility
Adaptability and usability are key concepts of the Morphir framework, business logic can now move with the code, be easily understood and adopted, in an ever-developing eco-system.
✔️ Ensures correctness
Certifying that specified functions behave as intended from input to output is assured through the Morphir library / tool chain.
✔️ Disseminates information through automation
Morphir’s automated processing helps disseminate information which otherwise may not be understood or shared at all, a useful tool when brining elements of business logic to conversation outside of its immediate audience (i.e developers).
Morphir .NET
Provides tooling for the Morphir ecosystem and .NET libraries that can be used to help you work with Morphir.
The additive shared configuration libraries
provide typed TOML, YAML, JSON/JSON5 documents, pure source resolution, named
profiles, validation and winning origins without constructing the CLI.
Morphir.Configuration.IO reads explicit files or supplied text and exposes
bounded project/workspace discovery through native and in-memory trees. See the
discovery guide for
ProjectSystem.Discover, per-root/member ProjectSystem.Load, membership/selection,
host boundaries and explicitly authorized machine sources.
Existing Git-first artifact discovery, cache-only tooling and CI overlays keep
their compatibility behavior. Shared inspection APIs
and morphir config get/list/show/path/explain expose typed values, source reports,
scoped queries and redacted explanations. The optional
Microsoft adapter projects one
resolved document with explicit/source-generated Options binding. See the
CLI reference for read controls, JSON schema
and exit codes. Shared editing services
and morphir config set/unset provide typed, scoped TOML previews and writes,
source-preserving changes, optimistic conflicts and explicit recovery ownership.
Shared classic project migration
and morphir project migrate provide loss-checked previews and guarded TOML
adoption while retaining classic bytes. Shared workspace migration
adds bounded inventory, verified membership and recoverable batch application through
morphir workspace migrate [directory]. See the
reader profile for syntax and provenance.
Get started
Install morphirup, the Morphir toolchain manager. It is one file and needs nothing else installed.
# macOS (Apple silicon) and Linux (x64, ARM64)
curl -fsSL https://raw.githubusercontent.com/finos/morphir-dotnet/main/scripts/install-morphirup.sh | sh
# Windows (x64, ARM64), in PowerShell
irm https://raw.githubusercontent.com/finos/morphir-dotnet/main/scripts/install-morphirup.ps1 | iex
# Or with mise
mise use -g 'github:finos/morphir[matching=morphirup,version_prefix=v,prerelease=true]'
The script installs morphirup from the newest Morphir release that has
it, and verifies the download first. morphirup then sets up the toolchain from the same releases. Open a new
terminal and run morphirup --version; it prints the version you installed.
| Platform | Install morphirup | Set up, compile and generate |
|---|---|---|
| macOS on Apple silicon | Yes | Yes |
| Windows x64 and ARM64 | Yes | Yes |
| Linux x64 and ARM64 | Yes | Not yet: morphirup setup does not support Linux yet |
| macOS on Intel | No | No |
Next, build your first model. The
installation guide covers script options, a given release,
manual download and the standalone morphir CLI. If something goes wrong, see
Troubleshooting.
SDK libraries
Morphir.SDK.CSharp is an independent net11.0 and net10.0 runtime package with immutable
C#/.NET public types. See the C# SDK guide
for its bounded operation contract and package usage.
The in-memory C# generator lowers typed classic/v4 libraries with explicit numeric C# 14/15 profiles, immutable values, executable functions/patterns/record operations and public SDK bindings. Original business fixtures and the bounded modern package-host/trimming checks are verified under #474. Implementation #478 landed. The main specification and archived acceptance evidence landed in archive follow-up #480. Coordinator cleanup remains pending.
Generate C# through the existing CLI, with numeric profiles and a validated optional namespace:
morphir generate --input model.json --target csharp --output generated --option language-version=14 --option namespace=Example.Generated --json
The C# walkthrough builds and runs a fresh consumer against the immutable runtime. CLI implementation #482 landed; its main specification and archived evidence are synchronized in this follow-up. Archive PR landing and root-verified cleanup remain pending.
Build from source and other installs
Building from source
The repository builds with the .NET 11 SDK and C# 15. Applications, .NET tools and tests target net11.0.
Packable libraries target net11.0 and net10.0 (.NET 10 LTS), so .NET 10 applications can use them.
.NET 8 and .NET 9 reached the end of support on 2026-11-10, so .NET 10 is the lowest target.
MSBuild tasks and Myriad plugins target net10.0, so the .NET 10 SDK can load them.
The netstandard2.0 attribute packages keep that target. The properties
MorphirCurrentTargetFramework, MorphirLibraryTargetFrameworks and MorphirHostedTargetFramework in
Directory.Build.props set these targets.
Install the SDK pinned in global.json, or use mise install to install the tools in
mise.toml. CI uses the same SDK pin.
VS Code users can run Dev Containers: Reopen in Container to use the
Microsoft .NET SDK image in .devcontainer/Dockerfile.
The SDK includes the C# and F# compilers. Renovate groups the container, global.json,
and mise SDK updates together and keeps them on the .NET 11 SDK. Moving to the next SDK
major version requires an explicit baseline update.
./build.sh --target Test
./build.sh --target PackAll
./build.sh --target TestBuild
To compile classic Morphir model JSON into F#, see the Myriad getting-started article, plugin reference, and car rental tutorial. The runnable example covers inventory, reservation, pickup, return and billing with one generated F# file per module.
Other ways to install the standalone morphir CLI
To install with morphirup, see Get started. These routes install the morphir command line
itself:
Using proto (Recommended for multi-language toolchains):
# Install proto (if not already installed)
curl -fsSL https://moonrepo.dev/install/proto.sh | bash # Linux/macOS
# or: irm https://moonrepo.dev/install/proto.ps1 | iex # Windows
# Add Morphir plugin and install
proto plugin add morphir "source:https://github.com/finos/morphir-dotnet/releases/latest/download/morphir_plugin.wasm"
proto install morphir
Using Platform-Specific Install Scripts:
# Linux
curl -fsSL https://raw.githubusercontent.com/finos/morphir-dotnet/main/scripts/install-linux.sh | bash
# macOS
curl -fsSL https://raw.githubusercontent.com/finos/morphir-dotnet/main/scripts/install-macos.sh | bash
# Windows (PowerShell)
irm https://raw.githubusercontent.com/finos/morphir-dotnet/main/scripts/install-windows.ps1 | iex
Using .NET Tool (requires .NET SDK):
dotnet tool install --global Morphir.Tool --prerelease
Verify Installation:
morphir --version # native executable
dotnet-morphir --version # .NET tool
Compile F# to Morphir IR: follow the five-minute Compile F# guide.
For detailed installation instructions and troubleshooting, see the Installation Guide.
Documentation
Building
This project uses Nuke for build orchestration, providing a strongly-typed, cross-platform build system written in C#.
Requirements
- .NET SDK 11.0.100 or a later patch in the same feature band, as specified in
global.json
Basic Commands
# First-time setup: Restore tools and dependencies
dotnet tool restore
./build.sh --target Restore
# Build the solution (default target)
./build.sh
# Run tests
./build.sh --target Test
# Run linting/formatting checks
./build.sh --target Lint
# Format code
./build.sh --target Format
# Run full CI pipeline (restore, build, test, lint)
./build.sh --target CI
# Show all available targets
./build.sh --help
Windows users: Use build.cmd or build.ps1 instead of ./build.sh
Configuration
You can set the build configuration using the --configuration parameter:
# Build in Debug mode
./build.sh --configuration Debug
# Run tests in Debug mode
./build.sh --target Test --configuration Debug
By default, commands use Release configuration.
Build system
The build runs on Fallout 10.5.0, the successor to Nuke. ./build.sh, build.ps1, and build.cmd are the entry points. Target names are unchanged from the earlier Just-to-Nuke move, which is recorded in NUKE_MIGRATION.md.
Developing
The shared .NET SDK contract freezes the bounded operation signatures, scalar limits and independent expectations used by both SDK deliveries. See the fixture guide for the build command, schema and provenance. After building its test project, run the offline validator with:
dotnet exec tests/Morphir.SDK.Conformance.Tests/bin/Debug/net11.0/Morphir.SDK.Conformance.Tests.dll --maximum-parallel-tests 2
F# runtime consumers use Morphir.SDK.FSharp. Its namespace and runtime assembly
remain Morphir.SDK, so existing generated source and runtime type identities
remain valid. The legacy Morphir.SDK package depends on the canonical package
and ships no runtime assembly. See the F# runtime migration guide
for dependency selection and covered behavior corrections.
Project Structure
morphir-dotnet/
├── src/
│ ├── Morphir.Core/ # Core IR types and utilities
│ ├── Morphir.Tooling/ # Tooling infrastructure
│ └── Morphir/ # CLI application
├── tests/
│ ├── Morphir.Core.Tests/ # Unit tests for Core
│ ├── Morphir.Tooling.Tests/ # Unit tests for Tooling
│ └── Morphir.BlackBox.Tests/ # Black-box tests of the built artifacts (BDD/Gherkin)
├── build/
│ ├── _build.csproj # Nuke build project
│ └── Build.cs # Build orchestration (strongly-typed)
├── scripts/ # Build and utility scripts (C# scripts)
├── build.sh/cmd/ps1 # Nuke bootstrap scripts
└── justfile # Legacy build commands (preserved for reference)
Development Workflow
Restore dependencies:
./build.sh --target RestoreBuild the solution:
./build.sh --target CompileRun tests:
./build.sh --target TestCheck code formatting:
./build.sh --target LintFormat code (if needed):
# Unix/macOS ./build.sh --target Format # Windows build.cmd --target Format # or ./build.ps1 --target Format
Scripts
The project uses C# scripts (.cs files) for build automation, leveraging the direct C# file execution of the .NET SDK. These scripts are located in the scripts/ directory:
run-tests.cs- Runs unit testsrun-e2e-tests.cs- Runs end-to-end testsgenerate-wolverine-code.cs- Generates Wolverine code
Note: The deprecated build-tool-dll.cs, pack-tool-platform.cs, publish-single-file.cs and publish-single-file-untrimmed.cs scripts have been removed. Use the Nuke build targets (PackTool, PublishTool, PackRelease, PublishSingleFile, PublishSingleFileUntrimmed) instead.
Build Commands
All Nuke build commands support both Unix/macOS (./build.sh) and Windows (build.cmd or ./build.ps1) bootstrap scripts. Examples below show both formats.
Building Libraries
# Unix/macOS: Pack library projects as NuGet packages
./build.sh --target PackLibs
# Windows
build.cmd --target PackLibs
# or
./build.ps1 --target PackLibs
# Pack all projects (libraries and tool)
./build.sh --target PackAll # Unix/macOS
build.cmd --target PackAll # Windows
# Specify configuration and version
./build.sh --target PackLibs --configuration Debug --version 1.2.3
build.cmd --target PackLibs --configuration Debug --version 1.2.3
# Custom output directory
./build.sh --target PackLibs --output-dir ./my-packages
build.cmd --target PackLibs --output-dir ./my-packages
Building Release Profiles
The four .NET deployment offerings each have a named release profile. PackRelease publishes one profile for one platform and packs it into an archive named morphir-dotnet-<release>-<deployment>-<rid>.<zip|tar.gz> (zip on Windows, tar.gz elsewhere, files at the archive root), or for dotnet-tool the Morphir.Tool.<release>.nupkg package. The release comes from CHANGELOG.md. Output goes to artifacts/release/; the publish folders are in artifacts/release/publish/<deployment>/<rid>/.
# Native AOT morphir (src/Morphir). Build on the operating system of the RID.
./build.sh --target PackRelease --deployment native-aot --rid linux-x64
build.cmd --target PackRelease --deployment native-aot --rid win-arm64
# Managed morphir with the in-process F# frontend (src/Morphir.Managed), untrimmed folder archives
./build.sh --target PackRelease --deployment self-contained --rid osx-arm64
./build.sh --target PackRelease --deployment framework-dependent --rid linux-arm64
# The Morphir.Tool package (dotnet-morphir). Portable, so no --rid.
./build.sh --target PackRelease --deployment dotnet-tool
# Publish only, without the archive
./build.sh --target PublishRelease --deployment self-contained --rid win-x64
Platforms: win-x64, win-arm64, osx-x64, osx-arm64, linux-x64, linux-arm64. Any other RID is refused. Beside each archive, <archive>.build-launch.json records its launch path, execution mode, layout (single-file, folder or tool-package), bundled runtime, required runtime or SDK, F# frontend, prerequisites and SHA-256. The operating-system prerequisites are not declared yet; qualifying the artifact on each platform establishes them. It is a build output, not a public contract. PackRelease fails when the publish folder contradicts it, for example a framework-dependent folder that carries coreclr. Building a profile does not qualify a platform: no platform is release-qualified yet. Checking the release profiles from packaged artifacts runs the E2E suite against the packaged archives and lists what has been run on each platform; nothing is qualified by it. PackRelease also writes <archive>.build-contents.json and artifacts/release/size-report.md, which list every file each artifact contains with its size.
The same publish folder always gives the same archive bytes. A publish for one RID writes its NuGet lock files under obj/publish-lock/<rid>/, so it leaves the committed packages.lock.json files alone. To check, run git status --short before and after PackRelease: it should list nothing new outside artifacts/, which is ignored.
On Windows, the Native AOT link needs the Visual Studio C++ build tools for the target architecture, and the ILCompiler targets call vswhere.exe. If the link fails with "'vswhere.exe' is not recognized", put %ProgramFiles(x86)%\Microsoft Visual Studio\Installer on PATH in that shell.
Building Executables
These targets keep the layouts that the workflows and E2E tests use. PublishSingleFile builds the legacy release asset that releases ship as morphir-<rid>[.exe] and morphir-<rid>-v<version>.tar.gz.
# Build a trimmed single-file executable for a specific platform
./build.sh --target PublishSingleFile --rid linux-x64 # Unix/macOS
build.cmd --target PublishSingleFile --rid linux-x64 # Windows
# Build an AOT (ahead-of-time compiled) executable
./build.sh --target PublishExecutable --rid linux-x64
build.cmd --target PublishExecutable --rid linux-x64
# Build an untrimmed executable (larger, better for debugging)
./build.sh --target PublishSingleFileUntrimmed --rid win-x64
build.cmd --target PublishSingleFileUntrimmed --rid win-x64
# Common RIDs: linux-x64, linux-arm64, win-x64, osx-x64, osx-arm64
# With custom configuration and output directory
./build.sh --target PublishSingleFile --rid linux-x64 --configuration Debug --single-file-dir ./bin
build.cmd --target PublishSingleFile --rid linux-x64 --configuration Debug --single-file-dir ./bin
Building the Dotnet Tool
# Pack the Morphir CLI as a dotnet tool
./build.sh --target PackTool # Unix/macOS
build.cmd --target PackTool # Windows
# With version and output directory
./build.sh --target PackTool --version 2.0.0 --output-dir ./packages
build.cmd --target PackTool --version 2.0.0 --output-dir ./packages
Testing
# Run unit tests
./build.sh --target Test # Unix/macOS
build.cmd --target Test # Windows
# Run tests in Debug configuration
./build.sh --target Test --configuration Debug
build.cmd --target Test --configuration Debug
# Build the black-box test project for the published targets
./build.sh --target BuildE2ETests
build.cmd --target BuildE2ETests
# Run end-to-end tests
./build.sh --target TestE2E # Unix/macOS
build.cmd --target TestE2E # Windows
# Run the black-box tests on one target (a value of MORPHIR_TEST_TARGET, or tool, all or offerings)
./build.sh --target TestE2E --executable-type trimmed
build.cmd --target TestE2E --executable-type trimmed
Publishing to NuGet
# Publish library packages to NuGet.org
./build.sh --target PublishLibs --api-key YOUR_API_KEY # Unix/macOS
build.cmd --target PublishLibs --api-key YOUR_API_KEY # Windows
# Publish the Morphir CLI tool package to NuGet.org
./build.sh --target PublishTool --api-key YOUR_API_KEY
build.cmd --target PublishTool --api-key YOUR_API_KEY
# Publish all packages
./build.sh --target PublishAll --api-key YOUR_API_KEY
build.cmd --target PublishAll --api-key YOUR_API_KEY
# Publish to custom NuGet source
./build.sh --target PublishLibs --nuget-source https://custom-feed.com --api-key YOUR_KEY
build.cmd --target PublishLibs --nuget-source https://custom-feed.com --api-key YOUR_KEY
# Publish to local NuGet feed (for testing)
./build.sh --target PublishLocalLibs # Unix/macOS
build.cmd --target PublishLocalLibs # Windows
# With custom local source
./build.sh --target PublishLocalLibs --local-source ./my-local-feed
build.cmd --target PublishLocalLibs --local-source ./my-local-feed
# Install tool locally from package
./build.sh --target PublishLocalTool
build.cmd --target PublishLocalTool
# Install globally
./build.sh --target PublishLocalTool --global true
build.cmd --target PublishLocalTool --global true
Available Nuke Targets
Run ./build.sh --help (Unix/macOS) or build.cmd --help (Windows) to see all available targets with descriptions and parameters.
Key targets:
Restore- Restore .NET dependenciesCompile- Build the solution (default target)Test- Run unit testsLint- Check code formattingFormat- Format codeCI- Run full CI pipeline (restore, build, test, lint)PackLibs- Pack library projects as NuGet packagesPackTool- Pack the Morphir CLI as a dotnet toolPackAll- Pack all projects (libraries and tool)PublishRelease- Publish one release profile (requires--deployment, and--ridexcept fordotnet-tool)PackRelease- Pack one release profile into its named archive and launch metadataPublishSingleFile- Publish the legacy trimmed single-file release asset (requires--rid)PublishExecutable- Publish AOT executable (requires--rid)PublishSingleFileUntrimmed- Publish untrimmed single-file executable (requires--rid)TestE2E- Run each group of the black-box tests against a published or packaged targetPublishLibs- Publish library packages to NuGetPublishTool- Publish tool package to NuGetPublishAll- Publish all packages to NuGetPublishLocalLibs- Publish libraries to local feedPublishLocalTool- Install tool locally from packagePublishLocalAll- Publish all to local feed
Contributing
We welcome contributions! Please see our Contributing Guide for details.
License
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
Links
SDK runtime delivery and archival evidence is recorded in the runtime delivery record. The canonical C# runtime spec, F# package spec, and stable C# API handoff describe the landed runtimes. SDK archive #472 landed; source SDK worktrees and their owned artifacts were removed. Empty shared archive directory cleanup remains pending with the recorded permission/policy limitations.
OpenSpec change proposals
The extension installation library documents the implemented distribution parsers, platform mappings and MEP eligibility checks, along with the remaining installer work tracked by #558. Extension installation commands are not implemented yet.
The Morphir Compatibility Kit seed contains portable F# frontend cases, a closed step vocabulary and the deterministic library runner. Its reader/runner tests and Native AOT smoke check are independent of the production F# frontend, which is still being implemented.
This repository uses the shared html-design OpenSpec workflow. New proposals
produce capability specs, a standalone design.html, and implementation tasks.
See the OpenSpec guide for setup, verification and updates.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. net11.0 is compatible. |
-
net10.0
- Eleven19.IonDotnet (>= 0.1.4)
- FSharp.Core (>= 10.1.403)
- Morphir.IR.Pipeline (>= 0.5.0-alpha.3)
- Morphir.Models (>= 0.5.0-alpha.3)
-
net11.0
- Eleven19.IonDotnet (>= 0.1.4)
- FSharp.Core (>= 10.1.403)
- Morphir.IR.Pipeline (>= 0.5.0-alpha.3)
- Morphir.Models (>= 0.5.0-alpha.3)
NuGet packages (1)
Showing the top 1 NuGet packages that depend on Morphir.Ion:
| Package | Downloads |
|---|---|
|
Morphir.Tooling
Package Description |
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 0.5.0-alpha.3 | 49 | 11/14/2026 |
| 0.5.0-alpha.2 | 49 | 11/13/2026 |
| 0.5.0-alpha.1 | 49 | 11/13/2026 |
| 0.4.0-alpha.5 | 53 | 11/13/2026 |
| 0.4.0-alpha.4 | 54 | 11/10/2026 |
| 0.4.0-alpha.3 | 64 | 11/9/2026 |
| 0.4.0-alpha.2 | 66 | 11/8/2026 |
| 0.4.0-alpha.1 | 66 | 11/7/2026 |
### Added
- `morphir extension install nuget:<package-id>[@<version>] --home <abs-home> --no-probe` installs an extension from a NuGet feed: nuget.org, a private V3 feed such as Azure Artifacts, or a folder feed. It reads the sources, package source mapping, credentials (`packageSourceCredentials` and credential provider plugins) and signature policy of `nuget.config`, as `dotnet tool install` does, through the Microsoft NuGet client packages. `--source` names one source (a configured name, a V3 `index.json` URL or a folder), `--configfile` names the `nuget.config`, and `--interactive` lets a credential provider prompt; the three options apply only to a `nuget:` source. No version selects the highest stable listed version. The main package carries `morphir/release.json`; a process artifact is the subtree under its `root` of the main package (one package) or of a package whose id extends the main id (one package per platform, such as the RID packages of a self-contained .NET tool), pinned by its tree digest. A framework-dependent .NET tool is refused. Signatures are checked as the dotnet CLI checks them on each operating system. The command writes only to the Home: no NuGet HTTP cache, global packages folder or NuGet temporary folder. New codes: `extension.nuget_not_found`, `extension.nuget_unreachable`, `extension.nuget_unauthorized`, `extension.nuget_signature_invalid`. See [Publish an extension as a NuGet package](docs/content/docs/guides/publish-extension-nuget.md).
- `morphir extension install` installs WASM extensions from every provider: a local declaration, a GitHub release asset, or the entry `morphir/<filename>` of a NuGet main package. The module is checked against its descriptor `sha256` (`extension.digest_mismatch`) and stored in the single-file store; the lock records `runtime` `wasm` and the claims stay unchecked. The guest does not run during installation. `morphir compile` and `morphir generate` with `--extension-id` run an installed WASM extension through the host's WASM runtime, with the loader that configured modules use: they rehash the stored module against the lock first, and check the session against the installed claims. A host without a WASM runtime fails with `extension.runtime_unavailable`.
- On Linux and macOS, NuGet signature checks use the code signing and timestamping trust lists of the .NET SDK, which `Morphir.Extensions.Installation` carries, as the dotnet CLI does. Without them, NuGet on Linux has no trusted root, and a `require` policy refused every nuget.org package.
- `NuGetPackageProvider` in `Morphir.Extensions.Installation`, and `ExtensionSourceRequest.WithNuGetOptions`. `ExtensionSources.ProviderFor(request, http, home)` takes the Home for a NuGet source. The package ships `buildTransitive/Morphir.Extensions.Installation.props`, which sets the `NuGet.UseSystemTextJsonDeserialization` feature switch in each application that references it.
- `morphir extension install github:<owner>/<repo>[@<version-or-tag>] --home <abs-home> --no-probe` installs an extension package from a GitHub release ([#493](https://github.com/finos/morphir-dotnet/issues/493)). The release carries the extensions-family `release.json` as an asset; the command picks the artifact for this platform, streams the asset into a private stage and checks its SHA-256 against the descriptor before the installer reads it. `@<version>` selects the tag `v<version>`, else `<version>`; no `@` selects the latest release. It uses the anonymous GitHub API, or `GITHUB_TOKEN` or `GH_TOKEN` when set, and reports a rate limit as `extension.github_rate_limited`. `--local-developer` does not apply to a named release; `--no-probe` is still required. The installed extension then runs with `--extension-id`, with no network.
- Source providers in `Morphir.Extensions.Installation`: `IExtensionSourceProvider` (`Scheme`, `ResolveAsync`, `FetchAsync`), with `GitHubReleaseProvider` and `LocalRepositoryProvider`. A provider only resolves and fetches; validation, the package tree, and the catalog, lock and journal writes stay in one installer. A new source (a plain HTTPS URL, OCI, a registry index) is one more provider.
### Changed
- The extension installer writes and reads the extension family `0.1.0-preview.3` ([finos/morphir#1176](https://github.com/finos/morphir/pull/1176), merged as `65bbbc96`): the package format `nupkg` (a NuGet package, pinned by its tree digest only), the provenance `nuget-package` and the source `nuget-package-entry`. Catalogs, locks, journals, repositories and release descriptors of `0.1.0-preview.2` are refused and not converted: install again into a new Home, and publish `release.json` with the preview.3 `$schema`. A release descriptor may now offer `process` and `wasm` artifacts; the installer selects the `process` artifact for the platform, else a `wasm` artifact, and the lock records the selection.
- Build: the Native AOT publish of `morphir` fails on any trim or AOT warning from `NuGet.*` or `Newtonsoft.Json`. `morphir` and `dotnet-morphir` set `NuGet.UseSystemTextJsonDeserialization`, with which NuGet.Protocol has no such warning.
- The extension installer writes and reads the extension family `0.1.0-preview.2` ([finos/morphir#1173](https://github.com/finos/morphir/pull/1173)), where an artifact `source` and an `index` provenance are provider-tagged unions (`local-file` or `github-release-asset`, `local-directory` or `github-release`). Catalogs, locks, journals, repositories and release descriptors of `0.1.0-preview.1` are refused and not converted: install again into a new Home, and publish `release.json` with the preview.2 `$schema`. The package tree manifest format is unchanged.
- The install scripts `scripts/install-morphirup.sh` and `scripts/install-morphirup.ps1` install `morphirup` from the [finos/morphir releases](https://github.com/finos/morphir/releases): they download `morphirup` and `morphirup-v<version>.sha256` from `https://github.com/finos/morphir/releases/download/v<version>/`; the scripts stay hosted here. `morphirup` is on finos/morphir from `0.5.0-alpha.2` on; earlier `morphirup` releases stay on the [finos/morphir-dotnet releases](https://github.com/finos/morphir-dotnet/releases). With no version, the scripts take the newest finos/morphir release that has `morphirup` for the machine and skip the others, such as `v0.5.0-alpha.1` (the CLI only) and the releases of the earlier Rust CLI (`v0.4.0-beta.*` and older), in the release list (up to 100 releases from the GitHub API) and in the release feed `https://github.com/finos/morphir/releases.atom`. A given version whose release has no `morphirup` for the machine is refused with "finos/morphir release v<version> has no morphirup-<rid>; morphirup releases before 0.5.0-alpha.2 are on finos/morphir-dotnet": the `sh` script reads the HTTP status of the download instead of letting `curl -f` report a 404 as a network error, and the PowerShell script reads the status of the failed request. The line `downloading <file> <version> from <url>` names the download, and `MORPHIRUP_DOWNLOAD_URL` mirrors `https://github.com/finos/morphir/releases/download`. Two testing hooks, `MORPHIRUP_RELEASES_FILE` and `MORPHIRUP_FEED_FILE`, read the release list and the release feed from local files; the end-to-end scenarios of `InstallScripts.feature` use them with a local release mirror to check, with no network, that the script of the machine skips the releases without `morphirup` in both and refuses a Rust release given by version.
- mise installs `morphirup` with `mise use -g 'github:finos/morphir[matching=morphirup,version_prefix=v,prerelease=true]'`. mise also lists the releases without `morphirup`; with one of those it stops with "No matching asset found" and installs nothing, so name a release that has `morphirup`, such as `@0.5.0-alpha.2`.
- The proto plugin downloads the `morphir` CLI from `https://github.com/finos/morphir/releases/download/v<version>/`. The plugin itself is still released here.
- The manual workflows `install-scripts.yml` and `morphirup-release-journey.yml` use the finos/morphir releases. The pinned version of `install-scripts.yml` is `0.5.0-alpha.2`, each of its runs checks that the download comes from finos/morphir, and a run of the Rust release `0.4.0-beta.12` must be refused by name.