@frontfriend/sdk 1.2.2 → 1.2.4

package/README.md

@@ -240,7 +240,7 @@ npx frontfriend add custom/acme/data-grid --release <release-id> --dry-run
 
 Without a component or a selection flag, `frontfriend update` adopts what the App's `adopt` levels cover, in one lock: the approved contracts (`--working-design`), plus the Release tokens and the installed components (`--installed --tokens`) when the App adopts tokens or components. A contracts-only App gets `--contracts-only --working-design`. An applied adoption also writes `.frontfriend/rules/`, so `frontfriend check` reads the adopted rules.
 
-An applied adoption installs the npm dependencies of the components it wrote that `package.json` lacks, with the package manager your lockfile names (`--no-install` prints the command instead). It then refreshes the token cache in `node_modules/.cache/frontfriend` when the token pin moved: a running Vite dev server reloads by itself, without a restart. With `--installed --replace`, a stock shadcn file that the Design System ships under another name (`sonner.tsx` → `toast`) is replaced by the Design System component and removed, and its imports point at the new module.
+An applied adoption installs the npm dependencies of the components it adds or moves to another version, with the package manager your lockfile names (`--no-install` prints the command instead). It installs a dependency that `package.json` lacks, or raises a requirement below the minimum of the declared range. It never lowers or replaces a newer requirement: ``⚠️ `lucide-react` stays at 1.17.0; `icon@1.1.0` declares ^0.468.0.`` A component whose pin does not change, or whose local edit is kept, does not impose its dependencies. If an unchanged component that you have not edited declares a package that `package.json` lacks, `update` prints the install command and does not install it. A file that already matches the incoming source is reported as unchanged and is not rewritten. `update --json` reports the install requests in `npm_dependencies.missing`, the newer requirements kept in `npm_dependencies.kept`, the packages unchanged components lack in `npm_dependencies.repair`, and `files_unchanged` and `files_kept` (local edits). It then refreshes the token cache in `node_modules/.cache/frontfriend` when the token pin moved: a running Vite dev server reloads by itself, without a restart. With `--installed --replace`, a stock shadcn file that the Design System ships under another name (`sonner.tsx` → `toast`) is replaced by the Design System component and removed, and its imports point at the new module.
 
 A private component deleted from the Design System leaves every Release. `update` removes its pin from `frontfriend.lock.json` and prints `custom/... was deleted from the design system. Its files in <path> were kept; remove them and their imports if you no longer use them.` It never deletes those files. `add` and `download` refuse a deleted component that the lock pins; `diff` and `doctor` report the pin until `update` removes it. `update --json` (with `--yes` or `--dry-run`) prints one JSON result on stdout, with the removed pins in `components_removed`.
 
@@ -326,6 +326,10 @@ npx frontfriend init --tag <tag-name-or-id>
 
 `--version` takes a Release ID, not an SDK version. A Studio refusal, such as a missing login or no access to the Design System, stops initialization.
 
+After the tokens, an online `init` registers the App named in `frontfriend.config.js` on its tag (`--tag`, then `tag`) with its `framework` and `primitive`, so `update` and the design reads find it. When Studio refuses the registration, `init` stops with the reason; the installed tokens stay. During an outage it keeps the tokens and asks you to run `init` again. When the App adopts contracts and `frontfriend.lock.json` pins a design snapshot, `init` also writes that snapshot's contracts to `.frontfriend/design/` and, when they are missing or belong to another snapshot, its rules to `.frontfriend/rules/`: the same files `update` writes.
+
+`frontfriend.lock.json` lists its contract pins by slug, then kind, and its `adoptionDigest` does not depend on the order of the pins. A lock written by an earlier SDK in another order is still valid; `update` keeps its bytes until the adoption itself changes.
+
 Every online `init` keeps a verified copy of the selected tokens in `.frontfriend/artifacts`. When Studio is unreachable (network failure, timeout or server error), a signed-in `init` restores that copy. A first install during an outage has no copy to restore.
 
 ### Offline tokens
@@ -340,7 +344,7 @@ npx frontfriend init --offline
 
 The default API uses the production token CDN automatically. For a custom API, set `token-cdn-url`, `FF_TOKEN_CDN_URL`, or `--token-cdn-url`. Set `token-cdn-url: false` to disable CDN delivery.
 
-Downloads validate artifact identity and integrity. Access refusals and invalid data stop initialization. Token delivery does not update component files, register the application, or publish changes. Run `connect` or `design sync` online for those operations. External fonts and images have their own availability.
+Downloads validate artifact identity and integrity. Access refusals and invalid data stop initialization. Token delivery does not update component files or publish changes; `init --offline` also does not register the application or write contracts. Run `init`, `connect` or `design sync` online for those operations. External fonts and images have their own availability.
 
 ## CI authentication
 

package/dist/application-adoption-lock.d.ts

@@ -3,6 +3,7 @@ import type {
   AdoptionComponent,
   AdoptionDigestLock,
   ApplicationLock,
+  DesignAdoption,
 } from "./application-adoption";
 
 export type {
@@ -26,6 +27,18 @@ export type ParsedApplicationLock =
 
 export function sortedObject<T>(value: Record<string, T>): Record<string, T>;
 export function adoptionDigest(lock: AdoptionDigestLock): string;
+export function hasValidAdoptionDigest(lock: AdoptionDigestLock): boolean;
+export function sameAdoption(
+  left: AdoptionDigestLock,
+  right: AdoptionDigestLock,
+): boolean;
+export function sortContractPins<T extends { slug: string; kind: string }>(
+  pins: T[],
+): T[];
+export function canonicalDesignAdoption<T extends DesignAdoption>(design: T): T;
+export function canonicalApplicationLock<T extends AdoptionDigestLock>(
+  lock: T,
+): T;
 export function normalizeLock(value: unknown): ParsedApplicationLock;
 export function parseApplicationLock(content: unknown): ParsedApplicationLock;
 export function serializeApplicationLock(lock: unknown): string;

package/dist/application-adoption.d.ts

@@ -98,6 +98,13 @@ export class ApplicationAdoption {
     nextLock: ApplicationLock;
     changelogs: string[];
     npmDependencies: string[];
+    npmDeclarations: Array<{
+      component: string;
+      dependencies: string[];
+      required: boolean;
+    }>;
+    unchanged: string[];
+    kept: string[];
   };
   apply(plan: unknown, hooks?: Record<string, unknown>): ApplicationLock;
 }