@microwiseai/snapshot 0.5.1 → 0.5.2

package/dist/lib/distkit-closure-bridge.d.ts

@@ -0,0 +1,102 @@
+/**
+ * ============================================================================
+ *  Phase-2b §1.2/§1.3/§1.4 — flag-on walkClosure → manifest → lock (ACTIVE)
+ * ============================================================================
+ *
+ * distkit is linked into snapshot via local symlinks (workspace file:link):
+ *   node_modules/@microwiseai/distkit        → distkit/packages/core   (fresh dist)
+ *   node_modules/@microwiseai/distkit-schema → distkit/packages/schema (0.3.0)
+ * so the §1.2 spec imports resolve to the REAL, distkit-owned algorithm.
+ *
+ * PIPELINE (SSOT §1.2b + §1.3 recommended path):
+ *
+ *   collectNpmClosureRoots(snapshot)                  // §1.1 (shipped, unchanged)
+ *     → ClosureRoot[]
+ *     → resolveManifestToLock(DistkitManifest, roots, { npm })   // §1.3 (one call)
+ *         │ walkClosure (BFS, cycle-safe, multi-parent dedup, deterministic)
+ *         │ npm adapter over the SCOPE-ROUTING PackumentPort (decision A)
+ *         │ intent join: source/group/url/installTarget/accessTier
+ *     → LockfileV2 (digest-bound, full B2 closure incl. public deps — decision B)
+ *
+ * GATED behind SNAPSHOT_DISTKIT_CLOSURE (off by default). On NO live install path
+ * yet — install-resolution CUTOVER (§5 step 6) is a separate, post-QA round.
+ *
+ * ★ DECISION A (routing): the npm adapter runs over
+ *   {@link createScopeRoutingPackumentPort} — PRIVATE scopes → proxy + token,
+ *   PUBLIC → npmjs token-less. Token can NOT leak to npmjs (see the port).
+ * ★ DECISION B (scope): the lock is the FULL closure including public transitive
+ *   deps (materially larger than legacy /resolve-deps — owner-signed-off).
+ * ★ GUARDRAILS: (1) private=token-in-port, fail-loud on unentitled read;
+ *   (2) public=token-less; (3) accessTier OBSERVATION-ONLY (no enforcement here);
+ *   (4) legacy /resolve-deps NOT called on this path.
+ * ★ §1.4 FAIL-LOUD: a partial closure ⇒ a wrong lock. This path never degrades —
+ *   unresolved roots/domain errors from the collector are surfaced as a hard
+ *   error (see {@link buildNpmAdapterForSnapshot}); adapter/walker throws propagate.
+ */
+import { type ResolvedPackageInput, type LockfileV2 } from '@microwiseai/distkit';
+/** Re-export distkit's real types for downstream (§1.3+) callers. */
+export type { ResolvedPackageInput, LockfileV2 };
+/** Options shared by the flag-on resolution entrypoints. */
+export interface ResolveViaDistkitOptions {
+    /** restrict roots to these scopes (passthrough to the §1.1 collector). */
+    scopes?: string[];
+    /** proxy base url for the PRIVATE lane. Default {@link REGISTRY_PROXY_URL}. */
+    proxyUrl?: string;
+    /** npmjs base url for the PUBLIC lane. Default distkit's NPMJS_PUBLIC_REGISTRY_URL. */
+    npmjsUrl?: string;
+    /** session/PAT token for the PRIVATE lane. Default {@link getLicenseKey}. */
+    token?: string;
+    /** injectable fetch (tests). */
+    fetchImpl?: typeof fetch;
+    /**
+     * `lock.generatedFor` label (e.g. "@ist/minimal@0.6.25"). When omitted for the
+     * lock path, it is derived by fetching the snapshot's version.
+     */
+    generatedFor?: string;
+}
+/**
+ * FLAG-ON closure candidate (§1.2b). Returns the walked `ResolvedPackageInput[]`
+ * (full B2 closure incl. public deps) — used by the parity harness. For the
+ * digest-bound lock, use {@link resolveSnapshotToLock}.
+ *
+ * @throws on flag-off, §1.4 partial closure, or any adapter/walker error (fail-loud).
+ */
+export declare function resolveClosureViaDistkit(snapshotName: string, options?: ResolveViaDistkitOptions): Promise<ResolvedPackageInput[]>;
+/**
+ * §5-step6 install-resolution path — resolve the transitive npm closure from an
+ * EXPLICIT set of already-resolved pins (the roots the preflight adapter computed
+ * from the snapshot's install/packages/skits maps), WITHOUT re-walking the
+ * snapshot graph. This is the walkClosure replacement for the legacy
+ * `/resolve-deps` call on the install-resolution path (behind the flag).
+ *
+ * Returns the FULL B2 closure (private + public transitive deps, roots excluded).
+ * The install consumer (preflight) filters to the lane(s) it probes.
+ *
+ * @param pins   already-resolved direct npm pins (name + exact version).
+ * @param privateScopes the snapshot's registry scopes (drive the routing port +
+ *   source intent — PRIVATE→proxy+token, PUBLIC→npmjs token-less).
+ * @throws on flag-off, §1.4 partial closure (an unfetchable root manifest), or any
+ *   adapter/walker error (fail-loud — a partial closure ⇒ a wrong result).
+ */
+export declare function resolveTransitiveClosureFromPins(pins: ReadonlyArray<{
+    name: string;
+    version: string;
+}>, privateScopes: readonly string[], options?: ResolveViaDistkitOptions): Promise<ResolvedPackageInput[]>;
+/**
+ * §1.3 + lock emit — resolve a snapshot to a deterministic, digest-bound
+ * {@link LockfileV2} via distkit's `resolveManifestToLock`.
+ *
+ * Intent join (per closure node), decision A/B:
+ *   - source   ← scope-based `ResolveFromFn` (PRIVATE→`proxy`⇒our-proxy;
+ *                PUBLIC→`native`⇒npmjs-public), via distkit `defaultResolvedFrom`.
+ *   - group/url← `resolveManifestToLock`'s router over the built `registry`
+ *                (private scope → group + proxy url; public → forced npmjs url).
+ *   - installer← ecosystem default (walker) — npm⇒npm.
+ *   - installTarget ← default `cli-global`.
+ *   - accessTier ← OBSERVATION-ONLY default `public` (guardrail 3; authority is
+ *                fetch/install, never this lock).
+ *
+ * @throws on flag-off, §1.4 partial closure, unresolved routing, or fail-loud walk.
+ */
+export declare function resolveSnapshotToLock(snapshotName: string, options?: ResolveViaDistkitOptions): Promise<LockfileV2>;
+//# sourceMappingURL=distkit-closure-bridge.d.ts.map

package/dist/lib/distkit-closure-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distkit-closure-bridge.d.ts","sourceRoot":"","sources":["../../src/lib/distkit-closure-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAIL,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EAKhB,MAAM,sBAAsB,CAAC;AAa9B,qEAAqE;AACrE,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,CAAC;AAEjD,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAyDD;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAGjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EACtD,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CA2BjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,UAAU,CAAC,CAuCrB"}

package/dist/lib/distkit-closure-bridge.js

@@ -0,0 +1,177 @@
+/**
+ * ============================================================================
+ *  Phase-2b §1.2/§1.3/§1.4 — flag-on walkClosure → manifest → lock (ACTIVE)
+ * ============================================================================
+ *
+ * distkit is linked into snapshot via local symlinks (workspace file:link):
+ *   node_modules/@microwiseai/distkit        → distkit/packages/core   (fresh dist)
+ *   node_modules/@microwiseai/distkit-schema → distkit/packages/schema (0.3.0)
+ * so the §1.2 spec imports resolve to the REAL, distkit-owned algorithm.
+ *
+ * PIPELINE (SSOT §1.2b + §1.3 recommended path):
+ *
+ *   collectNpmClosureRoots(snapshot)                  // §1.1 (shipped, unchanged)
+ *     → ClosureRoot[]
+ *     → resolveManifestToLock(DistkitManifest, roots, { npm })   // §1.3 (one call)
+ *         │ walkClosure (BFS, cycle-safe, multi-parent dedup, deterministic)
+ *         │ npm adapter over the SCOPE-ROUTING PackumentPort (decision A)
+ *         │ intent join: source/group/url/installTarget/accessTier
+ *     → LockfileV2 (digest-bound, full B2 closure incl. public deps — decision B)
+ *
+ * GATED behind SNAPSHOT_DISTKIT_CLOSURE (off by default). On NO live install path
+ * yet — install-resolution CUTOVER (§5 step 6) is a separate, post-QA round.
+ *
+ * ★ DECISION A (routing): the npm adapter runs over
+ *   {@link createScopeRoutingPackumentPort} — PRIVATE scopes → proxy + token,
+ *   PUBLIC → npmjs token-less. Token can NOT leak to npmjs (see the port).
+ * ★ DECISION B (scope): the lock is the FULL closure including public transitive
+ *   deps (materially larger than legacy /resolve-deps — owner-signed-off).
+ * ★ GUARDRAILS: (1) private=token-in-port, fail-loud on unentitled read;
+ *   (2) public=token-less; (3) accessTier OBSERVATION-ONLY (no enforcement here);
+ *   (4) legacy /resolve-deps NOT called on this path.
+ * ★ §1.4 FAIL-LOUD: a partial closure ⇒ a wrong lock. This path never degrades —
+ *   unresolved roots/domain errors from the collector are surfaced as a hard
+ *   error (see {@link buildNpmAdapterForSnapshot}); adapter/walker throws propagate.
+ */
+import { createClosureResolver, resolveManifestToLock, defaultResolvedFrom, } from '@microwiseai/distkit';
+import { createNpmAdapter } from '@microwiseai/distkit/adapters';
+import { getLicenseKey, REGISTRY_PROXY_URL } from './config.js';
+import { fetchSnapshotFromRepo } from './gitlab.js';
+import { collectNpmClosureRoots, buildNpmClosureRoots, isDistkitClosureEnabled, } from './transitive-resolver.js';
+import { createScopeRoutingPackumentPort, isPrivateScope } from './distkit-routing-port.js';
+/**
+ * Collect roots (§1.1) and build the npm adapter over the scope-routing port
+ * (decision A). §1.4: fail LOUD if the collector reported ANY domain/root-manifest
+ * error — a partial root set would yield a wrong lock.
+ */
+async function buildNpmAdapterForSnapshot(snapshotName, options) {
+    if (!isDistkitClosureEnabled()) {
+        throw new Error('distkit closure path called while SNAPSHOT_DISTKIT_CLOSURE is OFF. It is ' +
+            'gated behind the flag; the legacy /resolve-deps path remains the default.');
+    }
+    const proxyUrl = options.proxyUrl ?? REGISTRY_PROXY_URL;
+    const { roots, errors, scopeGroups } = await collectNpmClosureRoots(snapshotName, {
+        scopes: options.scopes,
+    });
+    // §1.4 fail-loud: no silent degrade — a missing root manifest / domain fetch
+    // failure means an incomplete closure ⇒ a wrong lock. Surface as a hard error.
+    if (errors.length > 0) {
+        throw new Error(`[distkit closure §1.4] refusing to resolve a PARTIAL closure for "${snapshotName}": ` +
+            `${errors.length} unresolved root/domain error(s): ` +
+            errors.map((e) => `${e.name}: ${e.error}`).join('; '));
+    }
+    const privateScopes = Object.keys(scopeGroups);
+    const token = options.token ?? getLicenseKey() ?? undefined;
+    const port = createScopeRoutingPackumentPort({
+        privateScopes,
+        proxyUrl,
+        npmjsUrl: options.npmjsUrl,
+        token, // PRIVATE lane only; the port never sends it to npmjs.
+        fetchImpl: options.fetchImpl,
+    });
+    const npm = createNpmAdapter(port); // includePeer left at distkit default (true).
+    return { roots, scopeGroups, privateScopes, npm, proxyUrl };
+}
+/**
+ * FLAG-ON closure candidate (§1.2b). Returns the walked `ResolvedPackageInput[]`
+ * (full B2 closure incl. public deps) — used by the parity harness. For the
+ * digest-bound lock, use {@link resolveSnapshotToLock}.
+ *
+ * @throws on flag-off, §1.4 partial closure, or any adapter/walker error (fail-loud).
+ */
+export async function resolveClosureViaDistkit(snapshotName, options = {}) {
+    const { roots, npm } = await buildNpmAdapterForSnapshot(snapshotName, options);
+    return createClosureResolver({ npm })(roots, { includeDev: false });
+}
+/**
+ * §5-step6 install-resolution path — resolve the transitive npm closure from an
+ * EXPLICIT set of already-resolved pins (the roots the preflight adapter computed
+ * from the snapshot's install/packages/skits maps), WITHOUT re-walking the
+ * snapshot graph. This is the walkClosure replacement for the legacy
+ * `/resolve-deps` call on the install-resolution path (behind the flag).
+ *
+ * Returns the FULL B2 closure (private + public transitive deps, roots excluded).
+ * The install consumer (preflight) filters to the lane(s) it probes.
+ *
+ * @param pins   already-resolved direct npm pins (name + exact version).
+ * @param privateScopes the snapshot's registry scopes (drive the routing port +
+ *   source intent — PRIVATE→proxy+token, PUBLIC→npmjs token-less).
+ * @throws on flag-off, §1.4 partial closure (an unfetchable root manifest), or any
+ *   adapter/walker error (fail-loud — a partial closure ⇒ a wrong result).
+ */
+export async function resolveTransitiveClosureFromPins(pins, privateScopes, options = {}) {
+    if (!isDistkitClosureEnabled()) {
+        throw new Error('resolveTransitiveClosureFromPins called while SNAPSHOT_DISTKIT_CLOSURE is OFF. ' +
+            'It is gated behind the flag; the legacy /resolve-deps path remains the default.');
+    }
+    const { roots, errors } = await buildNpmClosureRoots([...pins], {});
+    if (errors.length > 0) {
+        // §1.4 fail-loud: no silent degrade — a missing root manifest ⇒ partial closure.
+        throw new Error(`[distkit closure §1.4] refusing to resolve a PARTIAL closure from ${pins.length} pin(s): ` +
+            errors.map((e) => `${e.name}: ${e.error}`).join('; '));
+    }
+    const token = options.token ?? getLicenseKey() ?? undefined;
+    const port = createScopeRoutingPackumentPort({
+        privateScopes,
+        proxyUrl: options.proxyUrl ?? REGISTRY_PROXY_URL,
+        npmjsUrl: options.npmjsUrl,
+        token, // PRIVATE lane only; never sent to npmjs.
+        fetchImpl: options.fetchImpl,
+    });
+    const npm = createNpmAdapter(port);
+    return createClosureResolver({ npm })(roots, { includeDev: false });
+}
+/**
+ * §1.3 + lock emit — resolve a snapshot to a deterministic, digest-bound
+ * {@link LockfileV2} via distkit's `resolveManifestToLock`.
+ *
+ * Intent join (per closure node), decision A/B:
+ *   - source   ← scope-based `ResolveFromFn` (PRIVATE→`proxy`⇒our-proxy;
+ *                PUBLIC→`native`⇒npmjs-public), via distkit `defaultResolvedFrom`.
+ *   - group/url← `resolveManifestToLock`'s router over the built `registry`
+ *                (private scope → group + proxy url; public → forced npmjs url).
+ *   - installer← ecosystem default (walker) — npm⇒npm.
+ *   - installTarget ← default `cli-global`.
+ *   - accessTier ← OBSERVATION-ONLY default `public` (guardrail 3; authority is
+ *                fetch/install, never this lock).
+ *
+ * @throws on flag-off, §1.4 partial closure, unresolved routing, or fail-loud walk.
+ */
+export async function resolveSnapshotToLock(snapshotName, options = {}) {
+    const { roots, scopeGroups, privateScopes, npm, proxyUrl } = await buildNpmAdapterForSnapshot(snapshotName, options);
+    // Build the DistkitManifest (ADR 0002) from the snapshot's registry scope-map.
+    // Routing only (decision A): every private scope routes to the proxy.
+    // ★ Task-5 / ADR 0003: the RegistryModel key (npm scope) is an npm-adapter-LOCAL
+    // projection, not a core identity axis — the SAME status skit's
+    // `deriveProxyRoutingScopes` (.npmrc projection) keeps. The neutral (group, name)
+    // identity is delegated to `resolveManifestToLock` (routes via
+    // `resolvePackageOriginByIdentity`); the emitted LockEntry keys on (name, group)
+    // and stores NO scope, so this map's scope keys never reach the lock bytes (C2).
+    const registry = {};
+    for (const scope of privateScopes) {
+        registry[scope] = { group: scopeGroups[scope], url: proxyUrl };
+    }
+    const manifest = {
+        manifestVersion: 1,
+        target: snapshotName,
+        registry,
+        // accessTier intentionally omitted — snapshot is not the publishing authority;
+        // emitted rows fall back to the observation-only default 'public' (guardrail 3).
+    };
+    // Scope-based source intent (decision A): PRIVATE ⇒ our-proxy, PUBLIC ⇒ npmjs.
+    const resolveFrom = (name, _source, ecosystem) => defaultResolvedFrom(isPrivateScope(name, privateScopes) ? 'proxy' : 'native', ecosystem ?? 'npm');
+    const generatedFor = options.generatedFor ?? `${snapshotName}@${await fetchSnapshotVersion(snapshotName)}`;
+    return resolveManifestToLock(manifest, roots, { npm }, {
+        generatedFor,
+        includeDev: false,
+        resolveFrom,
+        // defaultInstallTarget 'cli-global' and defaultAccessTier 'public' are the
+        // distkit defaults (observation-only) — not overridden.
+    });
+}
+/** Fetch the snapshot's exact version for the `generatedFor` label. */
+async function fetchSnapshotVersion(snapshotName) {
+    const snap = await fetchSnapshotFromRepo(snapshotName);
+    return snap.version;
+}
+//# sourceMappingURL=distkit-closure-bridge.js.map

package/dist/lib/distkit-closure-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"distkit-closure-bridge.js","sourceRoot":"","sources":["../../src/lib/distkit-closure-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GAQpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAiC5F;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,YAAoB,EACpB,OAAiC;IAEjC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE;QAChF,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qEAAqE,YAAY,KAAK;YACpF,GAAG,MAAM,CAAC,MAAM,oCAAoC;YACpD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,IAAI,SAAS,CAAC;IAE5D,MAAM,IAAI,GAAG,+BAA+B,CAAC;QAC3C,aAAa;QACb,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,uDAAuD;QAC9D,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,8CAA8C;IAElF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,YAAoB,EACpB,UAAoC,EAAE;IAEtC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAsD,EACtD,aAAgC,EAChC,UAAoC,EAAE;IAEtC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iFAAiF;YAC/E,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,iFAAiF;QACjF,MAAM,IAAI,KAAK,CACb,qEAAqE,IAAI,CAAC,MAAM,WAAW;YACzF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,IAAI,SAAS,CAAC;IAC5D,MAAM,IAAI,GAAG,+BAA+B,CAAC;QAC3C,aAAa;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,kBAAkB;QAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,0CAA0C;QACjD,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,UAAoC,EAAE;IAEtC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,0BAA0B,CAC3F,YAAY,EACZ,OAAO,CACR,CAAC;IAEF,+EAA+E;IAC/E,sEAAsE;IACtE,iFAAiF;IACjF,gEAAgE;IAChE,kFAAkF;IAClF,+DAA+D;IAC/D,iFAAiF;IACjF,iFAAiF;IACjF,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,eAAe,EAAE,CAAC;QAClB,MAAM,EAAE,YAAY;QACpB,QAAQ;QACR,+EAA+E;QAC/E,iFAAiF;KAClF,CAAC;IAEF,+EAA+E;IAC/E,MAAM,WAAW,GAAkB,CAAC,IAAY,EAAE,OAAO,EAAE,SAAqB,EAAE,EAAE,CAClF,mBAAmB,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC;IAEpG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,YAAY,IAAI,MAAM,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;IAE3G,OAAO,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE;QACrD,YAAY;QACZ,UAAU,EAAE,KAAK;QACjB,WAAW;QACX,2EAA2E;QAC3E,wDAAwD;KACzD,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,oBAAoB,CAAC,YAAoB;IACtD,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC"}

package/dist/lib/distkit-closure-parity.d.ts

@@ -0,0 +1,110 @@
+/**
+ * ============================================================================
+ *  Phase-2b §1.2c — parity-diff harness (walkClosure vs legacy /resolve-deps)
+ * ============================================================================
+ *
+ * STATUS: harness SKELETON (pure, testable NOW). The distkit side is fed by
+ * {@link resolveClosureViaDistkit} (HELD until distkit is linked); this module's
+ * diff functions are pure and unit-tested today against synthetic inputs so the
+ * classification is ready the moment real outputs exist.
+ *
+ * PURPOSE (cutover GATE): before any cutover, diff the flag-on distkit closure
+ * against the current `/resolve-deps` output on a real snapshot and CLASSIFY the
+ * differences so each is either accepted (a known B2 improvement) or flagged (a
+ * regression). Four classification axes (SSOT §1.2c):
+ *
+ *   1. ORDERING       — distkit emits deterministic sorted order; legacy order may
+ *                       differ. Same SET, different sequence ⇒ benign.
+ *   2. DEDUP          — a `name@version` present in one side only. distkit dedups
+ *                       by `name@version` (multi-parent diamond collapses to one).
+ *   3. requestedBy    — legacy carries a SINGLE parent (`requestedBy?: string`);
+ *      MERGE            distkit carries the MERGED multi-parent set (`string[]`).
+ *                       A superset on the distkit side is the expected B2 gap-close.
+ *   4. PEER           — distkit includes peerDependencies as OPTIONAL by default;
+ *      INCLUSION        legacy returned peers separately (`includePeer`). Packages
+ *                       present only because of a peer edge are surfaced here.
+ *
+ * This module is provenance-neutral: it compares by `name@version` identity and
+ * `requestedBy` sets, NOT by installer/source (that is §1.3 mapping, out of scope).
+ */
+/** A legacy `/resolve-deps` row (snapshot `ResolvedPackage`, single-parent). */
+export interface LegacyClosureRow {
+    name: string;
+    version: string;
+    isDirect?: boolean;
+    /** legacy single-parent provenance (undefined for direct roots). */
+    requestedBy?: string;
+}
+/** A distkit `ResolvedPackageInput` row (multi-parent). Structural subset. */
+export interface DistkitClosureRow {
+    name: string;
+    version: string;
+    isDirect: boolean;
+    /** merged, deduped, sorted parents. */
+    requestedBy: string[];
+}
+/** Optional hints that let the harness classify PEER-only inclusions precisely. */
+export interface PeerClassificationHints {
+    /** `name@version` keys known to enter the closure ONLY via a peer edge. */
+    peerOnlyKeys?: readonly string[];
+}
+export interface RequestedByDiff {
+    key: string;
+    legacy: string[];
+    distkit: string[];
+    /** true iff distkit's parent set ⊇ legacy's (expected multi-parent gap-close). */
+    distkitSuperset: boolean;
+}
+export interface ParityReport {
+    /** `name@version` present in legacy but missing from distkit (investigate). */
+    onlyInLegacy: string[];
+    /** `name@version` present in distkit but missing from legacy (dedup/peer/new). */
+    onlyInDistkit: string[];
+    /** ordering comparison over the shared key set. */
+    ordering: {
+        sameSet: boolean;
+        legacyOrder: string[];
+        distkitOrder: string[];
+        sameOrder: boolean;
+    };
+    /** per-key requestedBy differences (only keys present on BOTH sides). */
+    requestedBy: RequestedByDiff[];
+    /** `onlyInDistkit` keys attributable to peer inclusion (via hints). */
+    peerInclusions: string[];
+    /** rollup counts for a quick gate read. */
+    summary: {
+        legacyCount: number;
+        distkitCount: number;
+        sharedCount: number;
+        onlyInLegacyCount: number;
+        onlyInDistkitCount: number;
+        requestedByDiffCount: number;
+        /** requestedBy diffs where distkit is NOT a superset of legacy (⇒ inspect). */
+        requestedByNonSupersetCount: number;
+        peerInclusionCount: number;
+    };
+}
+/** Stable identity key for a closure row. */
+export declare function closureKey(row: {
+    name: string;
+    version: string;
+}): string;
+/**
+ * Classify the differences between the legacy `/resolve-deps` closure and the
+ * distkit `walkClosure` closure. PURE — deterministic, no I/O. Ready to run on
+ * real outputs the moment {@link resolveClosureViaDistkit} is unblocked.
+ */
+export declare function diffClosures(legacy: readonly LegacyClosureRow[], distkit: readonly DistkitClosureRow[], hints?: PeerClassificationHints): ParityReport;
+/**
+ * Gate verdict over a {@link ParityReport}. The cutover GATE passes only when
+ * every difference is a KNOWN-BENIGN B2 improvement:
+ *   - `onlyInLegacy` MUST be empty (distkit dropped nothing).
+ *   - every `onlyInDistkit` key is attributable to peer inclusion (hints).
+ *   - every requestedBy diff is a distkit SUPERSET (multi-parent gap-close).
+ * Ordering differences are always benign (distkit is canonically sorted).
+ */
+export declare function isParityAcceptable(report: ParityReport): {
+    ok: boolean;
+    reasons: string[];
+};
+//# sourceMappingURL=distkit-closure-parity.d.ts.map

package/dist/lib/distkit-closure-parity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distkit-closure-parity.d.ts","sourceRoot":"","sources":["../../src/lib/distkit-closure-parity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,uCAAuC;IACvC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kFAAkF;IAClF,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,mDAAmD;IACnD,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAClG,yEAAyE;IACzE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2CAA2C;IAC3C,OAAO,EAAE;QACP,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,+EAA+E;QAC/E,2BAA2B,EAAE,MAAM,CAAC;QACpC,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAID,6CAA6C;AAC7C,wBAAgB,UAAU,CAAC,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEzE;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,KAAK,GAAE,uBAA4B,GAClC,YAAY,CA8Dd;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAaA"}

package/dist/lib/distkit-closure-parity.js

@@ -0,0 +1,134 @@
+/**
+ * ============================================================================
+ *  Phase-2b §1.2c — parity-diff harness (walkClosure vs legacy /resolve-deps)
+ * ============================================================================
+ *
+ * STATUS: harness SKELETON (pure, testable NOW). The distkit side is fed by
+ * {@link resolveClosureViaDistkit} (HELD until distkit is linked); this module's
+ * diff functions are pure and unit-tested today against synthetic inputs so the
+ * classification is ready the moment real outputs exist.
+ *
+ * PURPOSE (cutover GATE): before any cutover, diff the flag-on distkit closure
+ * against the current `/resolve-deps` output on a real snapshot and CLASSIFY the
+ * differences so each is either accepted (a known B2 improvement) or flagged (a
+ * regression). Four classification axes (SSOT §1.2c):
+ *
+ *   1. ORDERING       — distkit emits deterministic sorted order; legacy order may
+ *                       differ. Same SET, different sequence ⇒ benign.
+ *   2. DEDUP          — a `name@version` present in one side only. distkit dedups
+ *                       by `name@version` (multi-parent diamond collapses to one).
+ *   3. requestedBy    — legacy carries a SINGLE parent (`requestedBy?: string`);
+ *      MERGE            distkit carries the MERGED multi-parent set (`string[]`).
+ *                       A superset on the distkit side is the expected B2 gap-close.
+ *   4. PEER           — distkit includes peerDependencies as OPTIONAL by default;
+ *      INCLUSION        legacy returned peers separately (`includePeer`). Packages
+ *                       present only because of a peer edge are surfaced here.
+ *
+ * This module is provenance-neutral: it compares by `name@version` identity and
+ * `requestedBy` sets, NOT by installer/source (that is §1.3 mapping, out of scope).
+ */
+// ── Pure helpers ─────────────────────────────────────────────────────────────
+/** Stable identity key for a closure row. */
+export function closureKey(row) {
+    return `${row.name}@${row.version}`;
+}
+function sortedUnique(xs) {
+    return [...new Set(xs)].sort();
+}
+function setsEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const bs = new Set(b);
+    return a.every((x) => bs.has(x));
+}
+/** True iff every element of `sub` is in `sup`. */
+function isSuperset(sup, sub) {
+    const s = new Set(sup);
+    return sub.every((x) => s.has(x));
+}
+/**
+ * Classify the differences between the legacy `/resolve-deps` closure and the
+ * distkit `walkClosure` closure. PURE — deterministic, no I/O. Ready to run on
+ * real outputs the moment {@link resolveClosureViaDistkit} is unblocked.
+ */
+export function diffClosures(legacy, distkit, hints = {}) {
+    const legacyByKey = new Map();
+    for (const r of legacy)
+        legacyByKey.set(closureKey(r), r);
+    const distkitByKey = new Map();
+    for (const r of distkit)
+        distkitByKey.set(closureKey(r), r);
+    const legacyKeys = [...legacyByKey.keys()];
+    const distkitKeys = [...distkitByKey.keys()];
+    const onlyInLegacy = legacyKeys.filter((k) => !distkitByKey.has(k)).sort();
+    const onlyInDistkit = distkitKeys.filter((k) => !legacyByKey.has(k)).sort();
+    // Ordering: compare the sequence of the SHARED keys as each side lists them.
+    const sharedLegacyOrder = legacyKeys.filter((k) => distkitByKey.has(k));
+    const sharedDistkitOrder = distkitKeys.filter((k) => legacyByKey.has(k));
+    const sameSet = setsEqual(legacyKeys, distkitKeys);
+    const sameOrder = sharedLegacyOrder.length === sharedDistkitOrder.length &&
+        sharedLegacyOrder.every((k, i) => k === sharedDistkitOrder[i]);
+    // requestedBy diffs over shared keys (legacy single-parent → set of size ≤1).
+    const requestedBy = [];
+    for (const key of sharedLegacyOrder) {
+        const l = legacyByKey.get(key);
+        const d = distkitByKey.get(key);
+        const legacyParents = sortedUnique(l.requestedBy ? [l.requestedBy] : []);
+        const distkitParents = sortedUnique(d.requestedBy);
+        if (!setsEqual(legacyParents, distkitParents)) {
+            requestedBy.push({
+                key,
+                legacy: legacyParents,
+                distkit: distkitParents,
+                distkitSuperset: isSuperset(distkitParents, legacyParents),
+            });
+        }
+    }
+    const peerSet = new Set(hints.peerOnlyKeys ?? []);
+    const peerInclusions = onlyInDistkit.filter((k) => peerSet.has(k));
+    return {
+        onlyInLegacy,
+        onlyInDistkit,
+        ordering: {
+            sameSet,
+            legacyOrder: sharedLegacyOrder,
+            distkitOrder: sharedDistkitOrder,
+            sameOrder,
+        },
+        requestedBy,
+        peerInclusions,
+        summary: {
+            legacyCount: legacyKeys.length,
+            distkitCount: distkitKeys.length,
+            sharedCount: sharedLegacyOrder.length,
+            onlyInLegacyCount: onlyInLegacy.length,
+            onlyInDistkitCount: onlyInDistkit.length,
+            requestedByDiffCount: requestedBy.length,
+            requestedByNonSupersetCount: requestedBy.filter((r) => !r.distkitSuperset).length,
+            peerInclusionCount: peerInclusions.length,
+        },
+    };
+}
+/**
+ * Gate verdict over a {@link ParityReport}. The cutover GATE passes only when
+ * every difference is a KNOWN-BENIGN B2 improvement:
+ *   - `onlyInLegacy` MUST be empty (distkit dropped nothing).
+ *   - every `onlyInDistkit` key is attributable to peer inclusion (hints).
+ *   - every requestedBy diff is a distkit SUPERSET (multi-parent gap-close).
+ * Ordering differences are always benign (distkit is canonically sorted).
+ */
+export function isParityAcceptable(report) {
+    const reasons = [];
+    if (report.summary.onlyInLegacyCount > 0) {
+        reasons.push(`${report.summary.onlyInLegacyCount} package(s) present in legacy but MISSING from distkit`);
+    }
+    const unexplainedNew = report.onlyInDistkit.filter((k) => !report.peerInclusions.includes(k));
+    if (unexplainedNew.length > 0) {
+        reasons.push(`${unexplainedNew.length} distkit-only package(s) not explained by peer inclusion`);
+    }
+    if (report.summary.requestedByNonSupersetCount > 0) {
+        reasons.push(`${report.summary.requestedByNonSupersetCount} requestedBy diff(s) where distkit is not a superset of legacy`);
+    }
+    return { ok: reasons.length === 0, reasons };
+}
+//# sourceMappingURL=distkit-closure-parity.js.map

package/dist/lib/distkit-closure-parity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"distkit-closure-parity.js","sourceRoot":"","sources":["../../src/lib/distkit-closure-parity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+DH,gFAAgF;AAEhF,6CAA6C;AAC7C,MAAM,UAAU,UAAU,CAAC,GAAsC;IAC/D,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,EAAqB;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,CAAoB,EAAE,CAAoB;IAC3D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,mDAAmD;AACnD,SAAS,UAAU,CAAC,GAAsB,EAAE,GAAsB;IAChE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAmC,EACnC,OAAqC,EACrC,QAAiC,EAAE;IAEnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5E,6EAA6E;IAC7E,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GACb,iBAAiB,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QACtD,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjE,8EAA8E;IAC9E,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAChC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QACjC,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YAC9C,WAAW,CAAC,IAAI,CAAC;gBACf,GAAG;gBACH,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,cAAc;gBACvB,eAAe,EAAE,UAAU,CAAC,cAAc,EAAE,aAAa,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,OAAO;QACL,YAAY;QACZ,aAAa;QACb,QAAQ,EAAE;YACR,OAAO;YACP,WAAW,EAAE,iBAAiB;YAC9B,YAAY,EAAE,kBAAkB;YAChC,SAAS;SACV;QACD,WAAW;QACX,cAAc;QACd,OAAO,EAAE;YACP,WAAW,EAAE,UAAU,CAAC,MAAM;YAC9B,YAAY,EAAE,WAAW,CAAC,MAAM;YAChC,WAAW,EAAE,iBAAiB,CAAC,MAAM;YACrC,iBAAiB,EAAE,YAAY,CAAC,MAAM;YACtC,kBAAkB,EAAE,aAAa,CAAC,MAAM;YACxC,oBAAoB,EAAE,WAAW,CAAC,MAAM;YACxC,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM;YACjF,kBAAkB,EAAE,cAAc,CAAC,MAAM;SAC1C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IAIrD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,wDAAwD,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,0DAA0D,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,2BAA2B,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,2BAA2B,gEAAgE,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/dist/lib/distkit-routing-port.d.ts

@@ -0,0 +1,37 @@
+import { type PackumentPort } from '@microwiseai/distkit/adapters';
+/**
+ * True iff `name` belongs to one of the PRIVATE scopes (the snapshot's registry
+ * scope-map keys, e.g. `@ist`, `@microwiseai`). A private name routes to the
+ * proxy (+ token); everything else is PUBLIC (npmjs, token-less).
+ *
+ * ★ Task-5 / ADR 0003 (ecosystem-neutral identity): `scope` here is an
+ * npm-adapter-LOCAL projection — the private/public LANE selector for the npm
+ * closure — NOT a core identity axis. It carries no npm privilege: any name not
+ * in `privateScopes` (an unscoped-npm public dep AND a pypi-style name alike) is
+ * uniformly PUBLIC. The core (group, name) identity is delegated downstream to
+ * distkit's `resolveManifestToLock` / `resolvePackageOriginByIdentity`, and the
+ * emitted lock keys on (name, group) — never on scope.
+ */
+export declare function isPrivateScope(name: string, privateScopes: readonly string[]): boolean;
+/** Options for {@link createScopeRoutingPackumentPort}. */
+export interface ScopeRoutingPortOptions {
+    /** the PRIVATE scopes (snapshot registry scope-map keys). Everything else = public. */
+    privateScopes: readonly string[];
+    /** our access-controlling proxy base url (private lane). */
+    proxyUrl: string;
+    /** public npm registry base. Default {@link NPMJS_PUBLIC_REGISTRY_URL}. */
+    npmjsUrl?: string;
+    /** session/PAT token — injected into the PRIVATE lane ONLY (never public). */
+    token?: string;
+    /** injectable fetch (tests). Defaults to global `fetch` inside each sub-port. */
+    fetchImpl?: typeof fetch;
+    /** per-request timeout (ms) forwarded to both sub-ports. */
+    timeoutMs?: number;
+}
+/**
+ * Build a {@link PackumentPort} that routes each `fetchPackument(name)` to the
+ * proxy (private, tokened) or npmjs (public, token-less) by scope. Plug into
+ * `createNpmAdapter(port)`.
+ */
+export declare function createScopeRoutingPackumentPort(opts: ScopeRoutingPortOptions): PackumentPort;
+//# sourceMappingURL=distkit-routing-port.d.ts.map

package/dist/lib/distkit-routing-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distkit-routing-port.d.ts","sourceRoot":"","sources":["../../src/lib/distkit-routing-port.ts"],"names":[],"mappings":"AAuBA,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE7F;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAKtF;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,uFAAuF;IACvF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,uBAAuB,GAAG,aAAa,CAuB5F"}