@frontfriend/sdk 1.2.2 → 1.2.3

package/README.md

@@ -240,7 +240,7 @@ npx frontfriend add custom/acme/data-grid --release <release-id> --dry-run
 
 Without a component or a selection flag, `frontfriend update` adopts what the App's `adopt` levels cover, in one lock: the approved contracts (`--working-design`), plus the Release tokens and the installed components (`--installed --tokens`) when the App adopts tokens or components. A contracts-only App gets `--contracts-only --working-design`. An applied adoption also writes `.frontfriend/rules/`, so `frontfriend check` reads the adopted rules.
 
-An applied adoption installs the npm dependencies of the components it wrote that `package.json` lacks, with the package manager your lockfile names (`--no-install` prints the command instead). It then refreshes the token cache in `node_modules/.cache/frontfriend` when the token pin moved: a running Vite dev server reloads by itself, without a restart. With `--installed --replace`, a stock shadcn file that the Design System ships under another name (`sonner.tsx` → `toast`) is replaced by the Design System component and removed, and its imports point at the new module.
+An applied adoption installs the npm dependencies of the components it adds or moves to another version, with the package manager your lockfile names (`--no-install` prints the command instead). It installs a dependency that `package.json` lacks, or raises a requirement below the minimum of the declared range. It never lowers or replaces a newer requirement: ``⚠️ `lucide-react` stays at 1.17.0; `icon@1.1.0` declares ^0.468.0.`` A component whose pin does not change, or whose local edit is kept, does not impose its dependencies. If an unchanged component that you have not edited declares a package that `package.json` lacks, `update` prints the install command and does not install it. A file that already matches the incoming source is reported as unchanged and is not rewritten. `update --json` reports the install requests in `npm_dependencies.missing`, the newer requirements kept in `npm_dependencies.kept`, the packages unchanged components lack in `npm_dependencies.repair`, and `files_unchanged` and `files_kept` (local edits). It then refreshes the token cache in `node_modules/.cache/frontfriend` when the token pin moved: a running Vite dev server reloads by itself, without a restart. With `--installed --replace`, a stock shadcn file that the Design System ships under another name (`sonner.tsx` → `toast`) is replaced by the Design System component and removed, and its imports point at the new module.
 
 A private component deleted from the Design System leaves every Release. `update` removes its pin from `frontfriend.lock.json` and prints `custom/... was deleted from the design system. Its files in <path> were kept; remove them and their imports if you no longer use them.` It never deletes those files. `add` and `download` refuse a deleted component that the lock pins; `diff` and `doctor` report the pin until `update` removes it. `update --json` (with `--yes` or `--dry-run`) prints one JSON result on stdout, with the removed pins in `components_removed`.
 

package/dist/application-adoption.d.ts

@@ -98,6 +98,13 @@ export class ApplicationAdoption {
     nextLock: ApplicationLock;
     changelogs: string[];
     npmDependencies: string[];
+    npmDeclarations: Array<{
+      component: string;
+      dependencies: string[];
+      required: boolean;
+    }>;
+    unchanged: string[];
+    kept: string[];
   };
   apply(plan: unknown, hooks?: Record<string, unknown>): ApplicationLock;
 }