@microwiseai/snapshot 0.5.2 → 0.7.0

package/dist/lib/distkit-closure-bridge.js

@@ -1,177 +0,0 @@
-/**
- * ============================================================================
- *  Phase-2b §1.2/§1.3/§1.4 — flag-on walkClosure → manifest → lock (ACTIVE)
- * ============================================================================
- *
- * distkit is linked into snapshot via local symlinks (workspace file:link):
- *   node_modules/@microwiseai/distkit        → distkit/packages/core   (fresh dist)
- *   node_modules/@microwiseai/distkit-schema → distkit/packages/schema (0.3.0)
- * so the §1.2 spec imports resolve to the REAL, distkit-owned algorithm.
- *
- * PIPELINE (SSOT §1.2b + §1.3 recommended path):
- *
- *   collectNpmClosureRoots(snapshot)                  // §1.1 (shipped, unchanged)
- *     → ClosureRoot[]
- *     → resolveManifestToLock(DistkitManifest, roots, { npm })   // §1.3 (one call)
- *         │ walkClosure (BFS, cycle-safe, multi-parent dedup, deterministic)
- *         │ npm adapter over the SCOPE-ROUTING PackumentPort (decision A)
- *         │ intent join: source/group/url/installTarget/accessTier
- *     → LockfileV2 (digest-bound, full B2 closure incl. public deps — decision B)
- *
- * GATED behind SNAPSHOT_DISTKIT_CLOSURE (off by default). On NO live install path
- * yet — install-resolution CUTOVER (§5 step 6) is a separate, post-QA round.
- *
- * ★ DECISION A (routing): the npm adapter runs over
- *   {@link createScopeRoutingPackumentPort} — PRIVATE scopes → proxy + token,
- *   PUBLIC → npmjs token-less. Token can NOT leak to npmjs (see the port).
- * ★ DECISION B (scope): the lock is the FULL closure including public transitive
- *   deps (materially larger than legacy /resolve-deps — owner-signed-off).
- * ★ GUARDRAILS: (1) private=token-in-port, fail-loud on unentitled read;
- *   (2) public=token-less; (3) accessTier OBSERVATION-ONLY (no enforcement here);
- *   (4) legacy /resolve-deps NOT called on this path.
- * ★ §1.4 FAIL-LOUD: a partial closure ⇒ a wrong lock. This path never degrades —
- *   unresolved roots/domain errors from the collector are surfaced as a hard
- *   error (see {@link buildNpmAdapterForSnapshot}); adapter/walker throws propagate.
- */
-import { createClosureResolver, resolveManifestToLock, defaultResolvedFrom, } from '@microwiseai/distkit';
-import { createNpmAdapter } from '@microwiseai/distkit/adapters';
-import { getLicenseKey, REGISTRY_PROXY_URL } from './config.js';
-import { fetchSnapshotFromRepo } from './gitlab.js';
-import { collectNpmClosureRoots, buildNpmClosureRoots, isDistkitClosureEnabled, } from './transitive-resolver.js';
-import { createScopeRoutingPackumentPort, isPrivateScope } from './distkit-routing-port.js';
-/**
- * Collect roots (§1.1) and build the npm adapter over the scope-routing port
- * (decision A). §1.4: fail LOUD if the collector reported ANY domain/root-manifest
- * error — a partial root set would yield a wrong lock.
- */
-async function buildNpmAdapterForSnapshot(snapshotName, options) {
-    if (!isDistkitClosureEnabled()) {
-        throw new Error('distkit closure path called while SNAPSHOT_DISTKIT_CLOSURE is OFF. It is ' +
-            'gated behind the flag; the legacy /resolve-deps path remains the default.');
-    }
-    const proxyUrl = options.proxyUrl ?? REGISTRY_PROXY_URL;
-    const { roots, errors, scopeGroups } = await collectNpmClosureRoots(snapshotName, {
-        scopes: options.scopes,
-    });
-    // §1.4 fail-loud: no silent degrade — a missing root manifest / domain fetch
-    // failure means an incomplete closure ⇒ a wrong lock. Surface as a hard error.
-    if (errors.length > 0) {
-        throw new Error(`[distkit closure §1.4] refusing to resolve a PARTIAL closure for "${snapshotName}": ` +
-            `${errors.length} unresolved root/domain error(s): ` +
-            errors.map((e) => `${e.name}: ${e.error}`).join('; '));
-    }
-    const privateScopes = Object.keys(scopeGroups);
-    const token = options.token ?? getLicenseKey() ?? undefined;
-    const port = createScopeRoutingPackumentPort({
-        privateScopes,
-        proxyUrl,
-        npmjsUrl: options.npmjsUrl,
-        token, // PRIVATE lane only; the port never sends it to npmjs.
-        fetchImpl: options.fetchImpl,
-    });
-    const npm = createNpmAdapter(port); // includePeer left at distkit default (true).
-    return { roots, scopeGroups, privateScopes, npm, proxyUrl };
-}
-/**
- * FLAG-ON closure candidate (§1.2b). Returns the walked `ResolvedPackageInput[]`
- * (full B2 closure incl. public deps) — used by the parity harness. For the
- * digest-bound lock, use {@link resolveSnapshotToLock}.
- *
- * @throws on flag-off, §1.4 partial closure, or any adapter/walker error (fail-loud).
- */
-export async function resolveClosureViaDistkit(snapshotName, options = {}) {
-    const { roots, npm } = await buildNpmAdapterForSnapshot(snapshotName, options);
-    return createClosureResolver({ npm })(roots, { includeDev: false });
-}
-/**
- * §5-step6 install-resolution path — resolve the transitive npm closure from an
- * EXPLICIT set of already-resolved pins (the roots the preflight adapter computed
- * from the snapshot's install/packages/skits maps), WITHOUT re-walking the
- * snapshot graph. This is the walkClosure replacement for the legacy
- * `/resolve-deps` call on the install-resolution path (behind the flag).
- *
- * Returns the FULL B2 closure (private + public transitive deps, roots excluded).
- * The install consumer (preflight) filters to the lane(s) it probes.
- *
- * @param pins   already-resolved direct npm pins (name + exact version).
- * @param privateScopes the snapshot's registry scopes (drive the routing port +
- *   source intent — PRIVATE→proxy+token, PUBLIC→npmjs token-less).
- * @throws on flag-off, §1.4 partial closure (an unfetchable root manifest), or any
- *   adapter/walker error (fail-loud — a partial closure ⇒ a wrong result).
- */
-export async function resolveTransitiveClosureFromPins(pins, privateScopes, options = {}) {
-    if (!isDistkitClosureEnabled()) {
-        throw new Error('resolveTransitiveClosureFromPins called while SNAPSHOT_DISTKIT_CLOSURE is OFF. ' +
-            'It is gated behind the flag; the legacy /resolve-deps path remains the default.');
-    }
-    const { roots, errors } = await buildNpmClosureRoots([...pins], {});
-    if (errors.length > 0) {
-        // §1.4 fail-loud: no silent degrade — a missing root manifest ⇒ partial closure.
-        throw new Error(`[distkit closure §1.4] refusing to resolve a PARTIAL closure from ${pins.length} pin(s): ` +
-            errors.map((e) => `${e.name}: ${e.error}`).join('; '));
-    }
-    const token = options.token ?? getLicenseKey() ?? undefined;
-    const port = createScopeRoutingPackumentPort({
-        privateScopes,
-        proxyUrl: options.proxyUrl ?? REGISTRY_PROXY_URL,
-        npmjsUrl: options.npmjsUrl,
-        token, // PRIVATE lane only; never sent to npmjs.
-        fetchImpl: options.fetchImpl,
-    });
-    const npm = createNpmAdapter(port);
-    return createClosureResolver({ npm })(roots, { includeDev: false });
-}
-/**
- * §1.3 + lock emit — resolve a snapshot to a deterministic, digest-bound
- * {@link LockfileV2} via distkit's `resolveManifestToLock`.
- *
- * Intent join (per closure node), decision A/B:
- *   - source   ← scope-based `ResolveFromFn` (PRIVATE→`proxy`⇒our-proxy;
- *                PUBLIC→`native`⇒npmjs-public), via distkit `defaultResolvedFrom`.
- *   - group/url← `resolveManifestToLock`'s router over the built `registry`
- *                (private scope → group + proxy url; public → forced npmjs url).
- *   - installer← ecosystem default (walker) — npm⇒npm.
- *   - installTarget ← default `cli-global`.
- *   - accessTier ← OBSERVATION-ONLY default `public` (guardrail 3; authority is
- *                fetch/install, never this lock).
- *
- * @throws on flag-off, §1.4 partial closure, unresolved routing, or fail-loud walk.
- */
-export async function resolveSnapshotToLock(snapshotName, options = {}) {
-    const { roots, scopeGroups, privateScopes, npm, proxyUrl } = await buildNpmAdapterForSnapshot(snapshotName, options);
-    // Build the DistkitManifest (ADR 0002) from the snapshot's registry scope-map.
-    // Routing only (decision A): every private scope routes to the proxy.
-    // ★ Task-5 / ADR 0003: the RegistryModel key (npm scope) is an npm-adapter-LOCAL
-    // projection, not a core identity axis — the SAME status skit's
-    // `deriveProxyRoutingScopes` (.npmrc projection) keeps. The neutral (group, name)
-    // identity is delegated to `resolveManifestToLock` (routes via
-    // `resolvePackageOriginByIdentity`); the emitted LockEntry keys on (name, group)
-    // and stores NO scope, so this map's scope keys never reach the lock bytes (C2).
-    const registry = {};
-    for (const scope of privateScopes) {
-        registry[scope] = { group: scopeGroups[scope], url: proxyUrl };
-    }
-    const manifest = {
-        manifestVersion: 1,
-        target: snapshotName,
-        registry,
-        // accessTier intentionally omitted — snapshot is not the publishing authority;
-        // emitted rows fall back to the observation-only default 'public' (guardrail 3).
-    };
-    // Scope-based source intent (decision A): PRIVATE ⇒ our-proxy, PUBLIC ⇒ npmjs.
-    const resolveFrom = (name, _source, ecosystem) => defaultResolvedFrom(isPrivateScope(name, privateScopes) ? 'proxy' : 'native', ecosystem ?? 'npm');
-    const generatedFor = options.generatedFor ?? `${snapshotName}@${await fetchSnapshotVersion(snapshotName)}`;
-    return resolveManifestToLock(manifest, roots, { npm }, {
-        generatedFor,
-        includeDev: false,
-        resolveFrom,
-        // defaultInstallTarget 'cli-global' and defaultAccessTier 'public' are the
-        // distkit defaults (observation-only) — not overridden.
-    });
-}
-/** Fetch the snapshot's exact version for the `generatedFor` label. */
-async function fetchSnapshotVersion(snapshotName) {
-    const snap = await fetchSnapshotFromRepo(snapshotName);
-    return snap.version;
-}
-//# sourceMappingURL=distkit-closure-bridge.js.map

package/dist/lib/distkit-closure-bridge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"distkit-closure-bridge.js","sourceRoot":"","sources":["../../src/lib/distkit-closure-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GAQpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAiC5F;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,YAAoB,EACpB,OAAiC;IAEjC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE;QAChF,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qEAAqE,YAAY,KAAK;YACpF,GAAG,MAAM,CAAC,MAAM,oCAAoC;YACpD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,IAAI,SAAS,CAAC;IAE5D,MAAM,IAAI,GAAG,+BAA+B,CAAC;QAC3C,aAAa;QACb,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,uDAAuD;QAC9D,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,8CAA8C;IAElF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,YAAoB,EACpB,UAAoC,EAAE;IAEtC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAsD,EACtD,aAAgC,EAChC,UAAoC,EAAE;IAEtC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iFAAiF;YAC/E,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,iFAAiF;QACjF,MAAM,IAAI,KAAK,CACb,qEAAqE,IAAI,CAAC,MAAM,WAAW;YACzF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,IAAI,SAAS,CAAC;IAC5D,MAAM,IAAI,GAAG,+BAA+B,CAAC;QAC3C,aAAa;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,kBAAkB;QAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,0CAA0C;QACjD,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,UAAoC,EAAE;IAEtC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,0BAA0B,CAC3F,YAAY,EACZ,OAAO,CACR,CAAC;IAEF,+EAA+E;IAC/E,sEAAsE;IACtE,iFAAiF;IACjF,gEAAgE;IAChE,kFAAkF;IAClF,+DAA+D;IAC/D,iFAAiF;IACjF,iFAAiF;IACjF,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,eAAe,EAAE,CAAC;QAClB,MAAM,EAAE,YAAY;QACpB,QAAQ;QACR,+EAA+E;QAC/E,iFAAiF;KAClF,CAAC;IAEF,+EAA+E;IAC/E,MAAM,WAAW,GAAkB,CAAC,IAAY,EAAE,OAAO,EAAE,SAAqB,EAAE,EAAE,CAClF,mBAAmB,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC;IAEpG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,YAAY,IAAI,MAAM,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;IAE3G,OAAO,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE;QACrD,YAAY;QACZ,UAAU,EAAE,KAAK;QACjB,WAAW;QACX,2EAA2E;QAC3E,wDAAwD;KACzD,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,oBAAoB,CAAC,YAAoB;IACtD,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC"}

package/dist/lib/distkit-closure-parity.d.ts

@@ -1,110 +0,0 @@
-/**
- * ============================================================================
- *  Phase-2b §1.2c — parity-diff harness (walkClosure vs legacy /resolve-deps)
- * ============================================================================
- *
- * STATUS: harness SKELETON (pure, testable NOW). The distkit side is fed by
- * {@link resolveClosureViaDistkit} (HELD until distkit is linked); this module's
- * diff functions are pure and unit-tested today against synthetic inputs so the
- * classification is ready the moment real outputs exist.
- *
- * PURPOSE (cutover GATE): before any cutover, diff the flag-on distkit closure
- * against the current `/resolve-deps` output on a real snapshot and CLASSIFY the
- * differences so each is either accepted (a known B2 improvement) or flagged (a
- * regression). Four classification axes (SSOT §1.2c):
- *
- *   1. ORDERING       — distkit emits deterministic sorted order; legacy order may
- *                       differ. Same SET, different sequence ⇒ benign.
- *   2. DEDUP          — a `name@version` present in one side only. distkit dedups
- *                       by `name@version` (multi-parent diamond collapses to one).
- *   3. requestedBy    — legacy carries a SINGLE parent (`requestedBy?: string`);
- *      MERGE            distkit carries the MERGED multi-parent set (`string[]`).
- *                       A superset on the distkit side is the expected B2 gap-close.
- *   4. PEER           — distkit includes peerDependencies as OPTIONAL by default;
- *      INCLUSION        legacy returned peers separately (`includePeer`). Packages
- *                       present only because of a peer edge are surfaced here.
- *
- * This module is provenance-neutral: it compares by `name@version` identity and
- * `requestedBy` sets, NOT by installer/source (that is §1.3 mapping, out of scope).
- */
-/** A legacy `/resolve-deps` row (snapshot `ResolvedPackage`, single-parent). */
-export interface LegacyClosureRow {
-    name: string;
-    version: string;
-    isDirect?: boolean;
-    /** legacy single-parent provenance (undefined for direct roots). */
-    requestedBy?: string;
-}
-/** A distkit `ResolvedPackageInput` row (multi-parent). Structural subset. */
-export interface DistkitClosureRow {
-    name: string;
-    version: string;
-    isDirect: boolean;
-    /** merged, deduped, sorted parents. */
-    requestedBy: string[];
-}
-/** Optional hints that let the harness classify PEER-only inclusions precisely. */
-export interface PeerClassificationHints {
-    /** `name@version` keys known to enter the closure ONLY via a peer edge. */
-    peerOnlyKeys?: readonly string[];
-}
-export interface RequestedByDiff {
-    key: string;
-    legacy: string[];
-    distkit: string[];
-    /** true iff distkit's parent set ⊇ legacy's (expected multi-parent gap-close). */
-    distkitSuperset: boolean;
-}
-export interface ParityReport {
-    /** `name@version` present in legacy but missing from distkit (investigate). */
-    onlyInLegacy: string[];
-    /** `name@version` present in distkit but missing from legacy (dedup/peer/new). */
-    onlyInDistkit: string[];
-    /** ordering comparison over the shared key set. */
-    ordering: {
-        sameSet: boolean;
-        legacyOrder: string[];
-        distkitOrder: string[];
-        sameOrder: boolean;
-    };
-    /** per-key requestedBy differences (only keys present on BOTH sides). */
-    requestedBy: RequestedByDiff[];
-    /** `onlyInDistkit` keys attributable to peer inclusion (via hints). */
-    peerInclusions: string[];
-    /** rollup counts for a quick gate read. */
-    summary: {
-        legacyCount: number;
-        distkitCount: number;
-        sharedCount: number;
-        onlyInLegacyCount: number;
-        onlyInDistkitCount: number;
-        requestedByDiffCount: number;
-        /** requestedBy diffs where distkit is NOT a superset of legacy (⇒ inspect). */
-        requestedByNonSupersetCount: number;
-        peerInclusionCount: number;
-    };
-}
-/** Stable identity key for a closure row. */
-export declare function closureKey(row: {
-    name: string;
-    version: string;
-}): string;
-/**
- * Classify the differences between the legacy `/resolve-deps` closure and the
- * distkit `walkClosure` closure. PURE — deterministic, no I/O. Ready to run on
- * real outputs the moment {@link resolveClosureViaDistkit} is unblocked.
- */
-export declare function diffClosures(legacy: readonly LegacyClosureRow[], distkit: readonly DistkitClosureRow[], hints?: PeerClassificationHints): ParityReport;
-/**
- * Gate verdict over a {@link ParityReport}. The cutover GATE passes only when
- * every difference is a KNOWN-BENIGN B2 improvement:
- *   - `onlyInLegacy` MUST be empty (distkit dropped nothing).
- *   - every `onlyInDistkit` key is attributable to peer inclusion (hints).
- *   - every requestedBy diff is a distkit SUPERSET (multi-parent gap-close).
- * Ordering differences are always benign (distkit is canonically sorted).
- */
-export declare function isParityAcceptable(report: ParityReport): {
-    ok: boolean;
-    reasons: string[];
-};
-//# sourceMappingURL=distkit-closure-parity.d.ts.map

package/dist/lib/distkit-closure-parity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"distkit-closure-parity.d.ts","sourceRoot":"","sources":["../../src/lib/distkit-closure-parity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,uCAAuC;IACvC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kFAAkF;IAClF,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,mDAAmD;IACnD,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAClG,yEAAyE;IACzE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2CAA2C;IAC3C,OAAO,EAAE;QACP,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,+EAA+E;QAC/E,2BAA2B,EAAE,MAAM,CAAC;QACpC,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAID,6CAA6C;AAC7C,wBAAgB,UAAU,CAAC,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEzE;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,KAAK,GAAE,uBAA4B,GAClC,YAAY,CA8Dd;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAaA"}

package/dist/lib/distkit-closure-parity.js

@@ -1,134 +0,0 @@
-/**
- * ============================================================================
- *  Phase-2b §1.2c — parity-diff harness (walkClosure vs legacy /resolve-deps)
- * ============================================================================
- *
- * STATUS: harness SKELETON (pure, testable NOW). The distkit side is fed by
- * {@link resolveClosureViaDistkit} (HELD until distkit is linked); this module's
- * diff functions are pure and unit-tested today against synthetic inputs so the
- * classification is ready the moment real outputs exist.
- *
- * PURPOSE (cutover GATE): before any cutover, diff the flag-on distkit closure
- * against the current `/resolve-deps` output on a real snapshot and CLASSIFY the
- * differences so each is either accepted (a known B2 improvement) or flagged (a
- * regression). Four classification axes (SSOT §1.2c):
- *
- *   1. ORDERING       — distkit emits deterministic sorted order; legacy order may
- *                       differ. Same SET, different sequence ⇒ benign.
- *   2. DEDUP          — a `name@version` present in one side only. distkit dedups
- *                       by `name@version` (multi-parent diamond collapses to one).
- *   3. requestedBy    — legacy carries a SINGLE parent (`requestedBy?: string`);
- *      MERGE            distkit carries the MERGED multi-parent set (`string[]`).
- *                       A superset on the distkit side is the expected B2 gap-close.
- *   4. PEER           — distkit includes peerDependencies as OPTIONAL by default;
- *      INCLUSION        legacy returned peers separately (`includePeer`). Packages
- *                       present only because of a peer edge are surfaced here.
- *
- * This module is provenance-neutral: it compares by `name@version` identity and
- * `requestedBy` sets, NOT by installer/source (that is §1.3 mapping, out of scope).
- */
-// ── Pure helpers ─────────────────────────────────────────────────────────────
-/** Stable identity key for a closure row. */
-export function closureKey(row) {
-    return `${row.name}@${row.version}`;
-}
-function sortedUnique(xs) {
-    return [...new Set(xs)].sort();
-}
-function setsEqual(a, b) {
-    if (a.length !== b.length)
-        return false;
-    const bs = new Set(b);
-    return a.every((x) => bs.has(x));
-}
-/** True iff every element of `sub` is in `sup`. */
-function isSuperset(sup, sub) {
-    const s = new Set(sup);
-    return sub.every((x) => s.has(x));
-}
-/**
- * Classify the differences between the legacy `/resolve-deps` closure and the
- * distkit `walkClosure` closure. PURE — deterministic, no I/O. Ready to run on
- * real outputs the moment {@link resolveClosureViaDistkit} is unblocked.
- */
-export function diffClosures(legacy, distkit, hints = {}) {
-    const legacyByKey = new Map();
-    for (const r of legacy)
-        legacyByKey.set(closureKey(r), r);
-    const distkitByKey = new Map();
-    for (const r of distkit)
-        distkitByKey.set(closureKey(r), r);
-    const legacyKeys = [...legacyByKey.keys()];
-    const distkitKeys = [...distkitByKey.keys()];
-    const onlyInLegacy = legacyKeys.filter((k) => !distkitByKey.has(k)).sort();
-    const onlyInDistkit = distkitKeys.filter((k) => !legacyByKey.has(k)).sort();
-    // Ordering: compare the sequence of the SHARED keys as each side lists them.
-    const sharedLegacyOrder = legacyKeys.filter((k) => distkitByKey.has(k));
-    const sharedDistkitOrder = distkitKeys.filter((k) => legacyByKey.has(k));
-    const sameSet = setsEqual(legacyKeys, distkitKeys);
-    const sameOrder = sharedLegacyOrder.length === sharedDistkitOrder.length &&
-        sharedLegacyOrder.every((k, i) => k === sharedDistkitOrder[i]);
-    // requestedBy diffs over shared keys (legacy single-parent → set of size ≤1).
-    const requestedBy = [];
-    for (const key of sharedLegacyOrder) {
-        const l = legacyByKey.get(key);
-        const d = distkitByKey.get(key);
-        const legacyParents = sortedUnique(l.requestedBy ? [l.requestedBy] : []);
-        const distkitParents = sortedUnique(d.requestedBy);
-        if (!setsEqual(legacyParents, distkitParents)) {
-            requestedBy.push({
-                key,
-                legacy: legacyParents,
-                distkit: distkitParents,
-                distkitSuperset: isSuperset(distkitParents, legacyParents),
-            });
-        }
-    }
-    const peerSet = new Set(hints.peerOnlyKeys ?? []);
-    const peerInclusions = onlyInDistkit.filter((k) => peerSet.has(k));
-    return {
-        onlyInLegacy,
-        onlyInDistkit,
-        ordering: {
-            sameSet,
-            legacyOrder: sharedLegacyOrder,
-            distkitOrder: sharedDistkitOrder,
-            sameOrder,
-        },
-        requestedBy,
-        peerInclusions,
-        summary: {
-            legacyCount: legacyKeys.length,
-            distkitCount: distkitKeys.length,
-            sharedCount: sharedLegacyOrder.length,
-            onlyInLegacyCount: onlyInLegacy.length,
-            onlyInDistkitCount: onlyInDistkit.length,
-            requestedByDiffCount: requestedBy.length,
-            requestedByNonSupersetCount: requestedBy.filter((r) => !r.distkitSuperset).length,
-            peerInclusionCount: peerInclusions.length,
-        },
-    };
-}
-/**
- * Gate verdict over a {@link ParityReport}. The cutover GATE passes only when
- * every difference is a KNOWN-BENIGN B2 improvement:
- *   - `onlyInLegacy` MUST be empty (distkit dropped nothing).
- *   - every `onlyInDistkit` key is attributable to peer inclusion (hints).
- *   - every requestedBy diff is a distkit SUPERSET (multi-parent gap-close).
- * Ordering differences are always benign (distkit is canonically sorted).
- */
-export function isParityAcceptable(report) {
-    const reasons = [];
-    if (report.summary.onlyInLegacyCount > 0) {
-        reasons.push(`${report.summary.onlyInLegacyCount} package(s) present in legacy but MISSING from distkit`);
-    }
-    const unexplainedNew = report.onlyInDistkit.filter((k) => !report.peerInclusions.includes(k));
-    if (unexplainedNew.length > 0) {
-        reasons.push(`${unexplainedNew.length} distkit-only package(s) not explained by peer inclusion`);
-    }
-    if (report.summary.requestedByNonSupersetCount > 0) {
-        reasons.push(`${report.summary.requestedByNonSupersetCount} requestedBy diff(s) where distkit is not a superset of legacy`);
-    }
-    return { ok: reasons.length === 0, reasons };
-}
-//# sourceMappingURL=distkit-closure-parity.js.map

package/dist/lib/distkit-closure-parity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"distkit-closure-parity.js","sourceRoot":"","sources":["../../src/lib/distkit-closure-parity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+DH,gFAAgF;AAEhF,6CAA6C;AAC7C,MAAM,UAAU,UAAU,CAAC,GAAsC;IAC/D,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,EAAqB;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,CAAoB,EAAE,CAAoB;IAC3D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,mDAAmD;AACnD,SAAS,UAAU,CAAC,GAAsB,EAAE,GAAsB;IAChE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAmC,EACnC,OAAqC,EACrC,QAAiC,EAAE;IAEnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5E,6EAA6E;IAC7E,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GACb,iBAAiB,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QACtD,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjE,8EAA8E;IAC9E,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAChC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QACjC,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YAC9C,WAAW,CAAC,IAAI,CAAC;gBACf,GAAG;gBACH,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,cAAc;gBACvB,eAAe,EAAE,UAAU,CAAC,cAAc,EAAE,aAAa,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,OAAO;QACL,YAAY;QACZ,aAAa;QACb,QAAQ,EAAE;YACR,OAAO;YACP,WAAW,EAAE,iBAAiB;YAC9B,YAAY,EAAE,kBAAkB;YAChC,SAAS;SACV;QACD,WAAW;QACX,cAAc;QACd,OAAO,EAAE;YACP,WAAW,EAAE,UAAU,CAAC,MAAM;YAC9B,YAAY,EAAE,WAAW,CAAC,MAAM;YAChC,WAAW,EAAE,iBAAiB,CAAC,MAAM;YACrC,iBAAiB,EAAE,YAAY,CAAC,MAAM;YACtC,kBAAkB,EAAE,aAAa,CAAC,MAAM;YACxC,oBAAoB,EAAE,WAAW,CAAC,MAAM;YACxC,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM;YACjF,kBAAkB,EAAE,cAAc,CAAC,MAAM;SAC1C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IAIrD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,wDAAwD,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,0DAA0D,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,2BAA2B,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,2BAA2B,gEAAgE,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/dist/lib/distkit-routing-port.d.ts

@@ -1,37 +0,0 @@
-import { type PackumentPort } from '@microwiseai/distkit/adapters';
-/**
- * True iff `name` belongs to one of the PRIVATE scopes (the snapshot's registry
- * scope-map keys, e.g. `@ist`, `@microwiseai`). A private name routes to the
- * proxy (+ token); everything else is PUBLIC (npmjs, token-less).
- *
- * ★ Task-5 / ADR 0003 (ecosystem-neutral identity): `scope` here is an
- * npm-adapter-LOCAL projection — the private/public LANE selector for the npm
- * closure — NOT a core identity axis. It carries no npm privilege: any name not
- * in `privateScopes` (an unscoped-npm public dep AND a pypi-style name alike) is
- * uniformly PUBLIC. The core (group, name) identity is delegated downstream to
- * distkit's `resolveManifestToLock` / `resolvePackageOriginByIdentity`, and the
- * emitted lock keys on (name, group) — never on scope.
- */
-export declare function isPrivateScope(name: string, privateScopes: readonly string[]): boolean;
-/** Options for {@link createScopeRoutingPackumentPort}. */
-export interface ScopeRoutingPortOptions {
-    /** the PRIVATE scopes (snapshot registry scope-map keys). Everything else = public. */
-    privateScopes: readonly string[];
-    /** our access-controlling proxy base url (private lane). */
-    proxyUrl: string;
-    /** public npm registry base. Default {@link NPMJS_PUBLIC_REGISTRY_URL}. */
-    npmjsUrl?: string;
-    /** session/PAT token — injected into the PRIVATE lane ONLY (never public). */
-    token?: string;
-    /** injectable fetch (tests). Defaults to global `fetch` inside each sub-port. */
-    fetchImpl?: typeof fetch;
-    /** per-request timeout (ms) forwarded to both sub-ports. */
-    timeoutMs?: number;
-}
-/**
- * Build a {@link PackumentPort} that routes each `fetchPackument(name)` to the
- * proxy (private, tokened) or npmjs (public, token-less) by scope. Plug into
- * `createNpmAdapter(port)`.
- */
-export declare function createScopeRoutingPackumentPort(opts: ScopeRoutingPortOptions): PackumentPort;
-//# sourceMappingURL=distkit-routing-port.d.ts.map

package/dist/lib/distkit-routing-port.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"distkit-routing-port.d.ts","sourceRoot":"","sources":["../../src/lib/distkit-routing-port.ts"],"names":[],"mappings":"AAuBA,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE7F;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAKtF;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,uFAAuF;IACvF,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,uBAAuB,GAAG,aAAa,CAuB5F"}

package/dist/lib/distkit-routing-port.js

@@ -1,72 +0,0 @@
-/**
- * ============================================================================
- *  Phase-2b §1.2/§1.3 (decision A) — production scope-routing PackumentPort
- * ============================================================================
- *
- * Decision A (owner-confirmed): distkit resolves the npm closure CLIENT-SIDE with
- * PER-SCOPE registry routing. A real closure mixes lanes — PRIVATE roots/deps
- * (`@ist/*`, `@microwiseai/*` … the snapshot's registry scopes) served by our
- * proxy (+ session token), and PUBLIC transitive deps (`semver`, `commander`, …)
- * served by npmjs (token-less). distkit's npm adapter takes ONE PackumentPort, so
- * this port DISPATCHES per package name to the right registry.
- *
- * ★ TOKEN ISOLATION (C1 — the whole point): the two lanes are SEPARATE
- *   {@link createFetchPackumentPort} instances. The public port is constructed
- *   WITHOUT a token, so `createFetchPackumentPort` never attaches an
- *   `Authorization` header to an npmjs read — it is structurally impossible for
- *   the license/session token to leak to npmjs. Only the private port carries the
- *   Bearer token.
- * ★ FAIL-LOUD (§1.4): each sub-port surfaces a non-2xx as `PackumentResolutionError`
- *   (an unentitled private read → 401 → throw). This port adds NO catch — a miss
- *   propagates; it NEVER silently degrades to a public read for a private name.
- */
-import { NPMJS_PUBLIC_REGISTRY_URL } from '@microwiseai/distkit';
-import { createFetchPackumentPort } from '@microwiseai/distkit/adapters';
-/**
- * True iff `name` belongs to one of the PRIVATE scopes (the snapshot's registry
- * scope-map keys, e.g. `@ist`, `@microwiseai`). A private name routes to the
- * proxy (+ token); everything else is PUBLIC (npmjs, token-less).
- *
- * ★ Task-5 / ADR 0003 (ecosystem-neutral identity): `scope` here is an
- * npm-adapter-LOCAL projection — the private/public LANE selector for the npm
- * closure — NOT a core identity axis. It carries no npm privilege: any name not
- * in `privateScopes` (an unscoped-npm public dep AND a pypi-style name alike) is
- * uniformly PUBLIC. The core (group, name) identity is delegated downstream to
- * distkit's `resolveManifestToLock` / `resolvePackageOriginByIdentity`, and the
- * emitted lock keys on (name, group) — never on scope.
- */
-export function isPrivateScope(name, privateScopes) {
-    return privateScopes.some((s) => {
-        const scope = s.endsWith('/') ? s.slice(0, -1) : s;
-        return name === scope || name.startsWith(`${scope}/`);
-    });
-}
-/**
- * Build a {@link PackumentPort} that routes each `fetchPackument(name)` to the
- * proxy (private, tokened) or npmjs (public, token-less) by scope. Plug into
- * `createNpmAdapter(port)`.
- */
-export function createScopeRoutingPackumentPort(opts) {
-    // PRIVATE lane — proxy + Bearer token (guardrail 1).
-    const privatePort = createFetchPackumentPort({
-        registryUrl: opts.proxyUrl,
-        token: opts.token,
-        fetchImpl: opts.fetchImpl,
-        timeoutMs: opts.timeoutMs,
-    });
-    // PUBLIC lane — npmjs, NO token passed (guardrail 2 / C1). Token isolation by
-    // construction: this port has no credential to send.
-    const publicPort = createFetchPackumentPort({
-        registryUrl: opts.npmjsUrl ?? NPMJS_PUBLIC_REGISTRY_URL,
-        fetchImpl: opts.fetchImpl,
-        timeoutMs: opts.timeoutMs,
-    });
-    return {
-        fetchPackument(name) {
-            return isPrivateScope(name, opts.privateScopes)
-                ? privatePort.fetchPackument(name)
-                : publicPort.fetchPackument(name);
-        },
-    };
-}
-//# sourceMappingURL=distkit-routing-port.js.map

package/dist/lib/distkit-routing-port.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"distkit-routing-port.js","sourceRoot":"","sources":["../../src/lib/distkit-routing-port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAsB,MAAM,+BAA+B,CAAC;AAE7F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,aAAgC;IAC3E,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAA6B;IAC3E,qDAAqD;IACrD,MAAM,WAAW,GAAG,wBAAwB,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,QAAQ;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,8EAA8E;IAC9E,qDAAqD;IACrD,MAAM,UAAU,GAAG,wBAAwB,CAAC;QAC1C,WAAW,EAAE,IAAI,CAAC,QAAQ,IAAI,yBAAyB;QACvD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,OAAO;QACL,cAAc,CAAC,IAAY;YACzB,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;gBAC7C,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC;gBAClC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/lib/install-timeline.d.ts

@@ -1,81 +0,0 @@
-/**
- * install-timeline.ts — Install timeline instrumentation (investigation only).
- *
- * Purpose: measure WHY a snapshot install is slow, from the inside, without
- * changing any install behavior. Purely additive: when the opt-in env flag is
- * unset the whole thing is a no-op with negligible overhead — every `start()`
- * returns one shared no-op handle and `finalize()` returns immediately.
- *
- * Opt-in: SNAPSHOT_INSTALL_TIMELINE ∈ {'1','true'} (case-insensitive).
- *
- * Output when enabled:
- *   (a) console phase-summary table with relative [+Xs] offsets, per-phase
- *       durations, a `◄ dominant` marker on the largest phase, and per-command /
- *       per-package rows indented under their phase, then a total line.
- *   (b) JSONL file at ~/.ist/logs/snapshot-install-timeline/<ISO>.jsonl —
- *       one line per event + a trailing summary line, for cross-run diffing.
- *
- * Security (security-ssot-principle): tokens must NEVER be written. Command
- * strings and meta are sanitized — IST_SESSION_TOKEN, authToken, _authToken=,
- * and Bearer values are replaced with `***` before any record/print/write.
- */
-export type TimelineCategory = 'phase' | 'command' | 'package';
-export interface TimelineEvent {
-    label: string;
-    category: TimelineCategory;
-    /** Offset from timeline t0, in ms (span start). */
-    startOffsetMs: number;
-    /** Measured span duration, in ms (performance.now based). */
-    durationMs: number;
-    /** Wall-clock ISO timestamp of the span start (Date.now based). */
-    wallStartIso: string;
-    /** Label of the enclosing phase span, if any (for indentation/grouping). */
-    parentLabel?: string;
-    meta?: Record<string, unknown>;
-}
-export interface SpanHandle {
-    /** Close the span, recording its duration. Extra meta is merged in. */
-    end(meta?: Record<string, unknown>): void;
-}
-export interface StartOptions {
-    category?: TimelineCategory;
-    meta?: Record<string, unknown>;
-}
-export interface InstallTimelineOptions {
-    /** Force enable/disable. When omitted, decided from env opt-in flag. */
-    enabled?: boolean;
-    /** Env source (default: process.env). */
-    env?: Record<string, string | undefined>;
-    /** Monotonic clock in ms (default: performance.now). Injectable for tests. */
-    now?: () => number;
-    /** Wall clock in ms (default: Date.now). Injectable for tests. */
-    wallNow?: () => number;
-    /** Directory for JSONL logs (default: ~/.ist/logs/snapshot-install-timeline). */
-    logDir?: string;
-    /** Console sink (default: console.log). Injectable for tests. */
-    logger?: (line: string) => void;
-    /** Directory creator (default: mkdirSync -p). Injectable for tests. */
-    mkdir?: (dir: string) => void;
-    /** File writer (default: writeFileSync). Injectable for tests. */
-    writeFile?: (path: string, content: string) => void;
-}
-/** Redact token material from an arbitrary string. */
-export declare function sanitizeString(input: string, env?: Record<string, string | undefined>): string;
-/** Deep-sanitize a meta object: scrub string values and redact suspicious keys. */
-export declare function sanitizeMeta(meta: Record<string, unknown> | undefined, env?: Record<string, string | undefined>): Record<string, unknown> | undefined;
-export interface InstallTimeline {
-    readonly enabled: boolean;
-    start(label: string, opts?: StartOptions): SpanHandle;
-    finalize(): void;
-    /** Read recorded events (for tests / introspection). */
-    getEvents(): TimelineEvent[];
-}
-/**
- * Decide enablement from the opt-in env flag (unless explicitly overridden).
- */
-export declare function isTimelineEnabled(env?: Record<string, string | undefined>): boolean;
-/**
- * Factory: returns an active timeline when opted-in, else a zero-overhead no-op.
- */
-export declare function createInstallTimeline(opts?: InstallTimelineOptions): InstallTimeline;
-//# sourceMappingURL=install-timeline.d.ts.map