@loomcli/loom 0.0.0 → 0.6.0

package/dist/helpers/http.d.ts

@@ -0,0 +1,17 @@
+export interface HttpPolicy {
+    requestTimeoutMs: number;
+}
+export interface RetryPolicy extends HttpPolicy {
+    attempts: number;
+    delayMs: number;
+}
+export interface JsonAnswer {
+    data: unknown;
+    status: number;
+}
+export declare function readJson(policy: HttpPolicy, url: string, token?: string): Promise<JsonAnswer>;
+export declare function readBytes(policy: HttpPolicy, url: string): Promise<Buffer<ArrayBuffer>>;
+export declare function writeJson(policy: HttpPolicy, url: string, token: string, body: unknown): Promise<unknown>;
+export declare function writeBytes(policy: HttpPolicy, url: string, token: string, bytes: Buffer, contentType: string): Promise<void>;
+export declare function removeResource(policy: HttpPolicy, url: string, token: string): Promise<void>;
+export declare function until<Value>(policy: RetryPolicy, subject: string, read: () => Promise<Value | undefined>): Promise<Awaited<Value> & ({} | null)>;

package/dist/helpers/http.js

@@ -0,0 +1,134 @@
+const maximumDelayMs = 60_000;
+// A tarball is larger than a JSON answer, so its deadline is four times the configured one.
+const bytesDeadlineFactor = 4;
+function headers(token) {
+    return {
+        accept: 'application/json',
+        ...(token === undefined ? {} : { authorization: `Bearer ${token}` }),
+    };
+}
+function parseJson(url, text) {
+    try {
+        const data = JSON.parse(text);
+        return data;
+    }
+    catch {
+        throw new Error(`${url} answered with invalid JSON.`);
+    }
+}
+async function refuse(method, url, response) {
+    const text = await response.text();
+    return new Error(`${method} ${url} answered ${String(response.status)}: ${text.trim()}`);
+}
+function sleep(delayMs) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, delayMs);
+    });
+}
+// A deadline reached during the request or during the body read arrives as the timeout error itself or as its cause.
+function timedOut(error) {
+    return error instanceof Error && (error.name === 'TimeoutError' || timedOut(error.cause));
+}
+// Every request carries a deadline, because a stalled connection would otherwise hold the run forever.
+// The abort error names neither the endpoint nor the deadline, so a stall is reported with both.
+async function within(method, url, deadlineMs, exchange) {
+    try {
+        return await exchange(AbortSignal.timeout(deadlineMs));
+    }
+    catch (error) {
+        if (timedOut(error)) {
+            throw new Error(`${method} ${url} did not answer within ${String(deadlineMs)} ms.`, {
+                cause: error,
+            });
+        }
+        throw error;
+    }
+}
+// An absent resource is a fact the caller reads, so a 404 answers with an undefined body.
+export async function readJson(policy, url, token) {
+    return within('GET', url, policy.requestTimeoutMs, async (signal) => {
+        const response = await fetch(url, { headers: headers(token), signal });
+        if (response.status === 404) {
+            return { data: undefined, status: response.status };
+        }
+        if (!response.ok) {
+            throw await refuse('GET', url, response);
+        }
+        const text = await response.text();
+        return { data: parseJson(url, text), status: response.status };
+    });
+}
+export async function readBytes(policy, url) {
+    const deadlineMs = policy.requestTimeoutMs * bytesDeadlineFactor;
+    return within('GET', url, deadlineMs, async (signal) => {
+        const response = await fetch(url, { signal });
+        if (!response.ok) {
+            throw await refuse('GET', url, response);
+        }
+        const body = await response.arrayBuffer();
+        return Buffer.from(body);
+    });
+}
+export async function writeJson(policy, url, token, body) {
+    return within('POST', url, policy.requestTimeoutMs, async (signal) => {
+        const response = await fetch(url, {
+            body: JSON.stringify(body),
+            headers: { ...headers(token), 'content-type': 'application/json' },
+            method: 'POST',
+            signal,
+        });
+        if (!response.ok) {
+            throw await refuse('POST', url, response);
+        }
+        const text = await response.text();
+        return parseJson(url, text);
+    });
+}
+export async function writeBytes(policy, url, token, bytes, contentType) {
+    const deadlineMs = policy.requestTimeoutMs * bytesDeadlineFactor;
+    await within('POST', url, deadlineMs, async (signal) => {
+        const response = await fetch(url, {
+            body: new Uint8Array(bytes),
+            headers: { ...headers(token), 'content-type': contentType },
+            method: 'POST',
+            signal,
+        });
+        if (!response.ok) {
+            throw await refuse('POST', url, response);
+        }
+    });
+}
+export async function removeResource(policy, url, token) {
+    await within('DELETE', url, policy.requestTimeoutMs, async (signal) => {
+        const response = await fetch(url, { headers: headers(token), method: 'DELETE', signal });
+        if (!response.ok) {
+            throw await refuse('DELETE', url, response);
+        }
+    });
+}
+// The registry and the GitHub API both propagate a write with a delay, so a read after a write waits for it.
+// A failed read is one more way a write has not propagated, so it counts as an attempt and its error survives to the end.
+export async function until(policy, subject, read) {
+    let delayMs = policy.delayMs;
+    let failure = undefined;
+    for (let attempt = 1; attempt <= policy.attempts; attempt += 1) {
+        try {
+            const value = await read();
+            if (value !== undefined) {
+                return value;
+            }
+            failure = undefined;
+        }
+        catch (error) {
+            failure = { error };
+        }
+        if (attempt < policy.attempts) {
+            await sleep(delayMs);
+            delayMs = Math.min(delayMs * 2, maximumDelayMs);
+        }
+    }
+    if (failure !== undefined) {
+        throw failure.error;
+    }
+    throw new Error(`${subject} did not appear after ${String(policy.attempts)} attempts.`);
+}

package/dist/helpers/markdown.d.ts

@@ -0,0 +1,16 @@
+import { fromMarkdown } from 'mdast-util-from-markdown';
+type Node = ReturnType<typeof fromMarkdown>['children'][number];
+type Heading = Extract<Node, {
+    type: 'heading';
+}>;
+export interface ReleaseLocation {
+    body: string;
+    frontmatter: string;
+    index: number;
+    nodes: Node[];
+    releases: Heading[];
+}
+export declare function headingText(heading: Heading): string;
+export declare function locateRelease(changelog: string, version: string): ReleaseLocation;
+export declare function requireClosedBlocks(source: string, label: string): void;
+export {};

package/dist/helpers/markdown.js

@@ -0,0 +1,40 @@
+import { fromMarkdown } from 'mdast-util-from-markdown';
+function text(nodes) {
+    return nodes
+        .map((node) => {
+        if (node.type === 'html') {
+            return '';
+        }
+        if ('value' in node) {
+            return node.value;
+        }
+        if ('children' in node) {
+            return text(node.children);
+        }
+        return '';
+    })
+        .join('');
+}
+export function headingText(heading) {
+    return text(heading.children);
+}
+// A changelog opens every release with a depth-2 heading whose first word is the version.
+// The frontmatter is not Markdown, so it is split off before the body is parsed, and every offset counts from the body.
+// The index is -1 while the changelog carries no section for the version.
+export function locateRelease(changelog, version) {
+    const frontmatter = /^---\r?\n[\s\S]*?\r?\n---\r?\n/u.exec(changelog)?.[0] ?? '';
+    const body = changelog.slice(frontmatter.length);
+    const nodes = fromMarkdown(body).children;
+    const releases = nodes.flatMap((node) => node.type === 'heading' && node.depth === 2 ? [node] : []);
+    const index = releases.findIndex((heading) => headingText(heading).trim().split(/\s/u)[0] === `v${version}`);
+    return { body, frontmatter, index, nodes, releases };
+}
+// A fragment must finish its blocks so later release headings remain structural headings.
+export function requireClosedBlocks(source, label) {
+    const boundary = fromMarkdown(`${source}\n\n## Release boundary\n`).children.at(-1);
+    if (boundary?.type !== 'heading' ||
+        boundary.depth !== 2 ||
+        headingText(boundary) !== 'Release boundary') {
+        throw new Error(`${label}: unclosed Markdown block would swallow later release entries.`);
+    }
+}

package/dist/helpers/material.d.ts

@@ -0,0 +1,4 @@
+import type { readLibraries } from './repository.js';
+export declare function materialBaseline(root: string, libraries: ReturnType<typeof readLibraries>, version: string, head: string): string;
+export declare function isBuildAffectingPath(path: string): boolean;
+export declare function unchangedLibraries(root: string, libraries: ReturnType<typeof readLibraries>, since: string, head?: string): string[];

package/dist/helpers/material.js

@@ -0,0 +1,103 @@
+import { posix } from 'node:path';
+import { currentVersion, git, readParticipants, requireCoherentLibraries, requireFullHistory, } from './repository.js';
+function dependencyName(directory, name, range, libraries) {
+    if (!range.startsWith('workspace:')) {
+        return name;
+    }
+    const target = range.slice('workspace:'.length);
+    if (target.startsWith('.')) {
+        const path = posix.normalize(posix.join(directory, target));
+        return libraries.find((library) => library.directory === path)?.manifest.name;
+    }
+    const separator = target.lastIndexOf('@');
+    return separator > 0 ? target.slice(0, separator) : name;
+}
+// Only a commit that carries no participating manifest has no synchronized version.
+// Every other failure of the walk is a defect or a damaged repository, and it propagates.
+function synchronizedVersion(root, ref) {
+    if (ref === undefined) {
+        return undefined;
+    }
+    const [first, ...rest] = readParticipants(root, ref);
+    if (first === undefined) {
+        return undefined;
+    }
+    return currentVersion(requireCoherentLibraries([first, ...rest])).text;
+}
+// An abandoned version never receives a tag, so the baseline is the commit that set the current version.
+// The walk visits the first-parent commits that touched a participating manifest, newest first.
+export function materialBaseline(root, libraries, version, head) {
+    requireFullHistory(root);
+    const candidates = git(root, [
+        'log',
+        '--first-parent',
+        '--format=%H %P',
+        head,
+        '--',
+        ...libraries.map((library) => library.path),
+    ])
+        .split('\n')
+        .flatMap((line) => {
+        const [commit, parent] = line.split(' ').filter(Boolean);
+        return commit === undefined ? [] : [{ commit, parent }];
+    });
+    for (const { commit, parent } of candidates) {
+        if (synchronizedVersion(root, commit) === version &&
+            synchronizedVersion(root, parent) !== version) {
+            return commit;
+        }
+    }
+    throw new Error(`No first-parent commit sets version ${version}.`);
+}
+// Root Markdown and docs do not enter the current library build.
+export function isBuildAffectingPath(path) {
+    return !path.startsWith('docs/') && !(!path.includes('/') && /\.md$/iu.test(path));
+}
+export function unchangedLibraries(root, libraries, since, head) {
+    const base = git(root, ['rev-parse', '--verify', '--end-of-options', `${since}^{commit}`]).trim();
+    git(root, ['merge-base', '--is-ancestor', base, head ?? 'HEAD']);
+    const paths = git(root, [
+        'diff',
+        '--no-renames',
+        '--name-only',
+        '-z',
+        base,
+        ...(head === undefined ? [] : [head]),
+        '--',
+    ])
+        .split('\0')
+        .filter(Boolean);
+    const untracked = (head === undefined ? git(root, ['ls-files', '--others', '--exclude-standard', '-z']) : '')
+        .split('\0')
+        .filter(Boolean);
+    const changed = new Set();
+    for (const path of [...paths, ...untracked].filter((candidate) => !candidate.startsWith('.changes/') && isBuildAffectingPath(candidate))) {
+        const owner = libraries.find((library) => path.startsWith(`${library.directory}/`));
+        if (!owner) {
+            return [];
+        }
+        changed.add(owner.manifest.name);
+    }
+    let count = 0;
+    do {
+        count = changed.size;
+        for (const library of libraries) {
+            const dependencies = [
+                library.manifest.dependencies,
+                library.manifest.devDependencies,
+                library.manifest.optionalDependencies,
+                library.manifest.peerDependencies,
+            ].flatMap((group) => Object.entries(group ?? {}));
+            for (const [name, range] of dependencies) {
+                const target = dependencyName(library.directory, name, range, libraries);
+                if (target && changed.has(target)) {
+                    changed.add(library.manifest.name);
+                }
+            }
+        }
+    } while (count !== changed.size);
+    return libraries
+        .map((library) => library.manifest.name)
+        .filter((name) => !changed.has(name))
+        .toSorted();
+}

package/dist/helpers/pr-check.d.ts

@@ -0,0 +1,6 @@
+export declare function checkPullRequest(root: string, options: {
+    base: string;
+    head: string;
+    title: string;
+    labels: string[];
+}): void;

package/dist/helpers/pr-check.js

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+import { readFragments } from './fragments.js';
+import { isBuildAffectingPath } from './material.js';
+import { checkRelease } from './release-check.js';
+import { currentVersion, git, readLibraries, readRegularFile } from './repository.js';
+export function checkPullRequest(root, options) {
+    if (git(root, ['rev-parse', '--is-shallow-repository']).trim() === 'true') {
+        throw new Error('PR checks require full Git history.');
+    }
+    const base = git(root, [
+        'rev-parse',
+        '--verify',
+        '--end-of-options',
+        `${options.base}^{commit}`,
+    ]).trim();
+    const head = git(root, [
+        'rev-parse',
+        '--verify',
+        '--end-of-options',
+        `${options.head}^{commit}`,
+    ]).trim();
+    const ancestor = git(root, ['merge-base', base, head]).trim();
+    const fragments = readFragments(root, head);
+    const changed = git(root, ['diff', '--no-renames', '--name-only', '-z', ancestor, head, '--'])
+        .split('\0')
+        .filter(Boolean);
+    if (options.title.startsWith('chore(release)')) {
+        const version = /^chore\(release\): Release v(?<version>0\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)) - (?:\S[^\r\n]*)$/u.exec(options.title)?.groups?.version;
+        if (version === undefined) {
+            throw new Error('Expected release title: chore(release): Release v<version> - <description>');
+        }
+        if (ancestor !== base) {
+            throw new Error('Release branch must include the current base commit. Update the release cut.');
+        }
+        if (fragments.length > 0) {
+            throw new Error('No fragments may remain after a release cut.');
+        }
+        checkRelease(root, base, head, version, changed);
+        return;
+    }
+    const libraries = readLibraries(root, head);
+    const previous = readLibraries(root, ancestor);
+    const current = currentVersion(previous);
+    currentVersion(libraries);
+    for (const library of libraries) {
+        if (library.manifest.version !== current.text) {
+            throw new Error(`${library.path}: ordinary PR version must stay ${current.text}.`);
+        }
+    }
+    for (const library of previous) {
+        if (git(root, ['ls-tree', head, '--', library.path])) {
+            const manifest = z
+                .object({ version: z.string() })
+                .parse(JSON.parse(readRegularFile(root, library.path, head)));
+            if (manifest.version !== library.manifest.version) {
+                throw new Error(`${library.path}: ordinary PR version must stay ${current.text}.`);
+            }
+        }
+    }
+    if (changed.some(isBuildAffectingPath) &&
+        !fragments.some((fragment) => changed.includes(`.changes/${fragment.name}`)) &&
+        !options.labels.includes('skip-changelog')) {
+        throw new Error('Build-affecting PRs require an added or modified fragment or skip-changelog.');
+    }
+}

package/dist/helpers/registry.d.ts

@@ -0,0 +1,16 @@
+import type { HttpPolicy } from './http.js';
+export interface RegistryTarget {
+    policy: HttpPolicy;
+    registry: string;
+}
+export declare function readPublished(target: RegistryTarget, name: string, version: string): Promise<{
+    [x: string]: unknown;
+    integrity: string;
+    tarball: string;
+} | undefined>;
+export declare function readProvenance(target: RegistryTarget, name: string, version: string): Promise<{
+    commit: string;
+    uri: string;
+} | undefined>;
+export declare function tarballName(name: string, version: string): string;
+export declare function verifyIntegrity(subject: string, bytes: Buffer, integrity: string): void;

package/dist/helpers/registry.js

@@ -0,0 +1,78 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { readJson } from './http.js';
+const packumentSchema = z.looseObject({ versions: z.record(z.string(), z.unknown()) });
+const distSchema = z.looseObject({ integrity: z.string().min(1), tarball: z.string().min(1) });
+const releasedSchema = z.looseObject({ dist: distSchema });
+const envelopeSchema = z.looseObject({ payload: z.string() });
+const bundleSchema = z.looseObject({ dsseEnvelope: envelopeSchema });
+const attestationSchema = z.looseObject({ bundle: bundleSchema, predicateType: z.string() });
+const attestationsSchema = z.looseObject({ attestations: z.array(attestationSchema) });
+const digestSchema = z.looseObject({ gitCommit: z.string().min(1) });
+const dependencySchema = z.looseObject({ digest: digestSchema, uri: z.string() });
+// The provenance statement names the source of the build in its first resolved dependency.
+const buildDefinitionSchema = z.looseObject({ resolvedDependencies: z.array(dependencySchema) });
+const predicateSchema = z.looseObject({ buildDefinition: buildDefinitionSchema });
+const subjectSchema = z.looseObject({ name: z.string() });
+const provenanceSchema = z.looseObject({
+    predicate: predicateSchema,
+    subject: z.array(subjectSchema),
+});
+const provenancePredicateType = 'https://slsa.dev/provenance/v1';
+// Npm attests a version under its package URL, whose scope separator is percent-encoded.
+function packageUrl(name, version) {
+    return `pkg:npm/${name.replace('@', '%40')}@${version}`;
+}
+function endpoint(target, path) {
+    return `${target.registry.replace(/\/+$/u, '')}/${path}`;
+}
+// The distribution facts of one published version, or undefined while the registry lacks it.
+export async function readPublished(target, name, version) {
+    const { data } = await readJson(target.policy, endpoint(target, name));
+    if (data === undefined) {
+        return undefined;
+    }
+    const released = packumentSchema.parse(data).versions[version];
+    return released === undefined ? undefined : releasedSchema.parse(released).dist;
+}
+// The commit and the source repository npm attests for one published version.
+export async function readProvenance(target, name, version) {
+    const path = `-/npm/v1/attestations/${name}@${version}`;
+    const { data } = await readJson(target.policy, endpoint(target, path));
+    if (data === undefined) {
+        return undefined;
+    }
+    const attestation = attestationsSchema
+        .parse(data)
+        .attestations.find((candidate) => candidate.predicateType === provenancePredicateType);
+    if (attestation === undefined) {
+        return undefined;
+    }
+    const statement = Buffer.from(attestation.bundle.dsseEnvelope.payload, 'base64').toString('utf8');
+    const payload = JSON.parse(statement);
+    const provenance = provenanceSchema.parse(payload);
+    const purl = packageUrl(name, version);
+    if (!provenance.subject.some((subject) => subject.name === purl)) {
+        const attested = provenance.subject.map((subject) => subject.name).join(', ');
+        throw new Error(`${name}@${version}: its provenance attests ${attested || 'nothing'}, not ${purl}.`);
+    }
+    const [source] = provenance.predicate.buildDefinition.resolvedDependencies;
+    if (source === undefined) {
+        throw new Error(`${name}@${version}: its provenance resolves no source repository.`);
+    }
+    return { commit: source.digest.gitCommit, uri: source.uri };
+}
+// A published tarball keeps the name npm pack gives it, and its Release asset uses that same name.
+export function tarballName(name, version) {
+    return `${name.replace(/^@/u, '').replace('/', '-')}-${version}.tgz`;
+}
+export function verifyIntegrity(subject, bytes, integrity) {
+    const expected = /^sha512-(?<digest>[\w+/=]+)$/u.exec(integrity)?.groups?.digest;
+    if (expected === undefined) {
+        throw new Error(`${subject}: the registry reports unsupported integrity ${integrity}.`);
+    }
+    const actual = createHash('sha512').update(bytes).digest('base64');
+    if (actual !== expected) {
+        throw new Error(`${subject}: the downloaded tarball hashes to sha512-${actual}, not ${integrity}.`);
+    }
+}

package/dist/helpers/release-check.d.ts

@@ -0,0 +1 @@
+export declare function checkRelease(root: string, base: string, head: string, version: string, changed: string[]): void;

package/dist/helpers/release-check.js

@@ -0,0 +1,76 @@
+import { isDeepStrictEqual } from 'node:util';
+import { prepareLockfile, releaseInsertion } from './release-files.js';
+import { prepareRelease, releaseDate, requireReleaseNotes } from './release.js';
+import { currentVersion, git, readLibraries, readRegularFile } from './repository.js';
+export function checkRelease(root, base, head, version, changed) {
+    const previous = readLibraries(root, base);
+    const libraries = readLibraries(root, head);
+    const changelog = readRegularFile(root, 'CHANGELOG.md', head);
+    const { after, before } = releaseInsertion(readRegularFile(root, 'CHANGELOG.md', base), version);
+    if (!changelog.startsWith(before) ||
+        !changelog.endsWith(after) ||
+        changelog.length <= before.length + after.length) {
+        throw new Error('CHANGELOG.md must preserve its introduction and earlier releases.');
+    }
+    const section = changelog.slice(before.length, changelog.length - after.length);
+    const dateInput = /^## v0\.\d+\.\d+ - (?<date>\d{4}-\d{2}-\d{2})\n\n/u.exec(section)?.groups
+        ?.date;
+    if (dateInput === undefined) {
+        throw new Error('CHANGELOG.md requires a compiled release heading and date.');
+    }
+    const options = {
+        date: releaseDate(dateInput),
+        initial: currentVersion(previous).text === '0.0.0',
+        narrative: undefined,
+        since: undefined,
+    };
+    const release = prepareRelease(root, options, base);
+    if (version !== release.version) {
+        throw new Error(`Release version must be ${release.version}; replacement overrides are not supported.`);
+    }
+    if (currentVersion(libraries).text !== version) {
+        throw new Error(`Every participating library must carry title version ${version}.`);
+    }
+    if (git(root, ['tag', '--list', `v${version}`]).trim()) {
+        throw new Error(`Tag v${version} already exists.`);
+    }
+    if (!isDeepStrictEqual(libraries.map((library) => library.path).toSorted(), previous.map((library) => library.path).toSorted())) {
+        throw new Error('Release cuts cannot change participating libraries.');
+    }
+    for (const library of libraries) {
+        const original = previous.find((candidate) => candidate.path === library.path);
+        if (!isDeepStrictEqual(library.manifest, { ...original?.manifest, version })) {
+            throw new Error(`${library.path}: release cuts change only the version field.`);
+        }
+    }
+    const allowed = new Set([
+        'CHANGELOG.md',
+        'pnpm-lock.yaml',
+        ...libraries.map((library) => library.path),
+        ...release.fragments.map((fragment) => `.changes/${fragment.name}`),
+    ]);
+    for (const path of changed) {
+        if (!allowed.has(path)) {
+            throw new Error(`${path}: outside the release cut.`);
+        }
+        const oldMode = git(root, ['ls-tree', base, '--', path]).slice(0, 6);
+        const newMode = git(root, ['ls-tree', head, '--', path]).slice(0, 6);
+        if (oldMode && newMode && oldMode !== newMode) {
+            throw new Error(`${path}: release cuts cannot change a file mode.`);
+        }
+    }
+    if (readRegularFile(root, 'pnpm-lock.yaml', head) !== prepareLockfile(root, release, base)) {
+        throw new Error('pnpm-lock.yaml must match the version writer; unrelated lockfile changes need an ordinary PR.');
+    }
+    const heading = `## v${release.version} - ${options.date}\n\n`;
+    const entries = release.section.slice(heading.length);
+    if (!section.startsWith(heading) || !section.endsWith(entries)) {
+        throw new Error('CHANGELOG.md must contain the compiler output for the consumed fragments.');
+    }
+    const narrative = section.slice(heading.length, section.length - entries.length);
+    const compiled = prepareRelease(root, { ...options, narrative: narrative || undefined }, base);
+    if (section !== compiled.section) {
+        throw new Error('CHANGELOG.md must contain exactly one compiled release section.');
+    }
+    requireReleaseNotes(compiled);
+}

package/dist/helpers/release-files.d.ts

@@ -0,0 +1,13 @@
+import type { prepareRelease } from './release.js';
+declare function releaseInsertion(changelog: string, version: string): {
+    after: string;
+    before: string;
+};
+/**
+ * The installed pnpm manifest's path. pnpm is an optional peer dependency, because only lockfile
+ * preparation runs it, so a missing one fails with a sentence instead of a resolve error.
+ */
+declare function pnpmManifestPath(resolve?: (specifier: string) => string): string;
+declare function versionedManifest(source: string, version: string): string;
+export declare function prepareLockfile(root: string, release: Pick<ReturnType<typeof prepareRelease>, 'libraries' | 'version'>, ref?: string): string;
+export { pnpmManifestPath, releaseInsertion, versionedManifest };