@microwiseai/snapshot 0.7.0 → 0.9.0

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.d.ts

@@ -0,0 +1,42 @@
+import { type DowngradeMode } from './types.js';
+/**
+ * Policy values read from each layer. Any field may be absent (undefined/null)
+ * or invalid; invalid values are ignored (treated as absent) so a typo never
+ * silently weakens the guard.
+ *
+ * Precedence (highest wins):
+ *   (a) override  — CLI flag / one-shot env (already mapped to a mode)
+ *   (b) machine   — machine config (~/.config/ist-snapshot/config.json)
+ *   (c) snapshot  — snapshot.json `policy.onDowngrade`
+ *   (d) default   — 'refuse'
+ */
+export interface PolicySources {
+    override?: DowngradeMode | string | null;
+    machine?: DowngradeMode | string | null;
+    snapshot?: DowngradeMode | string | null;
+}
+/** The default when no layer specifies a valid mode. */
+export declare const DEFAULT_DOWNGRADE_MODE: DowngradeMode;
+/** Narrow an arbitrary value to a valid DowngradeMode, or null if invalid. */
+export declare function asDowngradeMode(v: unknown): DowngradeMode | null;
+/**
+ * Resolve the effective downgrade policy from the layered sources.
+ * Pure: first valid value in precedence order (a > b > c), else the default.
+ */
+export declare function resolveDowngradePolicy(sources?: PolicySources): DowngradeMode;
+export interface OneShotOverrideInput {
+    /** Environment map (e.g. process.env). SNAPSHOT_ALLOW_LOCAL=1 → allow. */
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
+    /** CLI flag, e.g. --allow-downgrade → allow. */
+    allowDowngradeFlag?: boolean;
+}
+/**
+ * Map the one-shot escape hatches (CLI `--allow-downgrade` or env
+ * `SNAPSHOT_ALLOW_LOCAL=1`) to an override mode.
+ *
+ * Returns 'allow' when either hatch is engaged, otherwise null (no override).
+ * Pure — reads only the injected inputs. Core passes the result as
+ * `PolicySources.override`.
+ */
+export declare function readOneShotOverride(input?: OneShotOverrideInput): DowngradeMode | null;
+//# sourceMappingURL=policy.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,EAAE,aAAwB,CAAC;AAE9D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAIhE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,aAAkB,GAAG,aAAa,CAOjF;AAED,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,gDAAgD;IAChD,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,oBAAyB,GAAG,aAAa,GAAG,IAAI,CAK1F"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.js

@@ -0,0 +1,36 @@
+import { DOWNGRADE_MODES } from './types.js';
+/** The default when no layer specifies a valid mode. */
+export const DEFAULT_DOWNGRADE_MODE = 'refuse';
+/** Narrow an arbitrary value to a valid DowngradeMode, or null if invalid. */
+export function asDowngradeMode(v) {
+    return typeof v === 'string' && DOWNGRADE_MODES.includes(v)
+        ? v
+        : null;
+}
+/**
+ * Resolve the effective downgrade policy from the layered sources.
+ * Pure: first valid value in precedence order (a > b > c), else the default.
+ */
+export function resolveDowngradePolicy(sources = {}) {
+    return (asDowngradeMode(sources.override) ??
+        asDowngradeMode(sources.machine) ??
+        asDowngradeMode(sources.snapshot) ??
+        DEFAULT_DOWNGRADE_MODE);
+}
+/**
+ * Map the one-shot escape hatches (CLI `--allow-downgrade` or env
+ * `SNAPSHOT_ALLOW_LOCAL=1`) to an override mode.
+ *
+ * Returns 'allow' when either hatch is engaged, otherwise null (no override).
+ * Pure — reads only the injected inputs. Core passes the result as
+ * `PolicySources.override`.
+ */
+export function readOneShotOverride(input = {}) {
+    const env = input.env ?? {};
+    if (input.allowDowngradeFlag === true)
+        return 'allow';
+    if (env.SNAPSHOT_ALLOW_LOCAL === '1')
+        return 'allow';
+    return null;
+}
+//# sourceMappingURL=policy.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAsB,MAAM,YAAY,CAAC;AAmBjE,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAkB,QAAQ,CAAC;AAE9D,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,CAAC,CAAE,CAAmB;QACtB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAyB,EAAE;IAChE,OAAO,CACL,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,sBAAsB,CACvB,CAAC;AACJ,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA8B,EAAE;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACtD,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/report.d.ts

@@ -0,0 +1,11 @@
+import type { DowngradeMode, Offender } from './types.js';
+/**
+ * Build a user-facing message describing the detected downgrades for the given
+ * policy mode. Korean + short English.
+ *
+ *   - refuse: block message with the offender list and the three bypass routes.
+ *   - warn:   warning header + offender list, install continues.
+ *   - allow:  minimal note (usually not shown by callers).
+ */
+export declare function formatDowngradeReport(offenders: Offender[], mode: DowngradeMode): string;
+//# sourceMappingURL=report.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAM1D;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAqCxF"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/report.js

@@ -0,0 +1,46 @@
+function offenderLines(offenders) {
+    return offenders.map((o) => `  • ${o.pkg}: ${o.installed} → ${o.pinned}`).join('\n');
+}
+/**
+ * Build a user-facing message describing the detected downgrades for the given
+ * policy mode. Korean + short English.
+ *
+ *   - refuse: block message with the offender list and the three bypass routes.
+ *   - warn:   warning header + offender list, install continues.
+ *   - allow:  minimal note (usually not shown by callers).
+ */
+export function formatDowngradeReport(offenders, mode) {
+    if (offenders.length === 0) {
+        return '다운그레이드 없음 / No downgrades detected.';
+    }
+    const list = offenderLines(offenders);
+    if (mode === 'refuse') {
+        return [
+            '스냅샷 설치가 현재 전역 패키지를 다운그레이드하므로 거부되었습니다.',
+            'Refused: this snapshot would downgrade already-installed global packages.',
+            '',
+            '다운그레이드 대상 / Would downgrade:',
+            list,
+            '',
+            '해결 / How to proceed:',
+            '  1) 깨끗한 Docker 샌드박스에서 실행 (권장) / run in a clean Docker sandbox (recommended)',
+            '  2) 이번 한 번만 강제 / force just this once:  --allow-downgrade  또는/or  SNAPSHOT_ALLOW_LOCAL=1',
+            '  3) 이 머신에서 항상 허용 / always allow on this machine:  snapshot config set install.onDowngrade allow',
+        ].join('\n');
+    }
+    if (mode === 'warn') {
+        return [
+            '⚠ 경고: 스냅샷 설치가 아래 전역 패키지를 다운그레이드합니다 (계속 진행).',
+            '⚠ Warning: this snapshot will downgrade the following global packages (continuing).',
+            '',
+            list,
+        ].join('\n');
+    }
+    // allow
+    return [
+        '스냅샷 설치가 아래 패키지를 다운그레이드합니다 (allow 정책으로 진행).',
+        'Proceeding despite downgrades (policy=allow):',
+        list,
+    ].join('\n');
+}
+//# sourceMappingURL=report.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAEA,SAAS,aAAa,CAAC,SAAqB;IAC1C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAqB,EAAE,IAAmB;IAC9E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAEtC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,uCAAuC;YACvC,2EAA2E;YAC3E,EAAE;YACF,8BAA8B;YAC9B,IAAI;YACJ,EAAE;YACF,sBAAsB;YACtB,8EAA8E;YAC9E,2FAA2F;YAC3F,kGAAkG;SACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO;YACL,6CAA6C;YAC7C,qFAAqF;YACrF,EAAE;YACF,IAAI;SACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,QAAQ;IACR,OAAO;QACL,4CAA4C;QAC5C,+CAA+C;QAC/C,IAAI;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/semver.d.ts

@@ -0,0 +1,11 @@
+/** True iff `v` is a single, exact semver (prerelease/build metadata allowed). */
+export declare function isExactSemver(v: unknown): boolean;
+/**
+ * Compare two exact semvers by SemVer-spec precedence (build metadata ignored).
+ *
+ * Returns -1 if a < b, 0 if equal precedence, 1 if a > b, or `null` when EITHER
+ * side is not an exact semver (incomparable — caller should skip). Never throws:
+ * tolerance is a design requirement.
+ */
+export declare function compareExact(a: unknown, b: unknown): -1 | 0 | 1 | null;
+//# sourceMappingURL=semver.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../src/semver.ts"],"names":[],"mappings":"AAiBA,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAEjD;AAuBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAgCtE"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/semver.js

@@ -0,0 +1,81 @@
+/**
+ * Minimal, self-contained exact-semver comparison.
+ *
+ * This package stays zero-runtime-dependency (no `semver`) on purpose so it is
+ * self-sufficient and side-effect-free. We only compare EXACT semvers; anything
+ * that is not a single exact version is reported as "incomparable" and the
+ * caller skips it (tolerant, same philosophy as the core-floor check).
+ *
+ * The pattern is the canonical semver.org regex, anchored — it accepts:
+ *   0.3.59            (plain)
+ *   0.3.70-dev.0      (prerelease)
+ *   1.2.3-rc.1+build  (prerelease + build metadata)
+ * and rejects ranges, `^`/`~`, `v` prefixes, dist-tags, partial versions, etc.
+ */
+const EXACT_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
+/** True iff `v` is a single, exact semver (prerelease/build metadata allowed). */
+export function isExactSemver(v) {
+    return typeof v === 'string' && EXACT_SEMVER.test(v.trim());
+}
+function parseSemver(v) {
+    if (typeof v !== 'string')
+        return null;
+    const m = EXACT_SEMVER.exec(v.trim());
+    if (!m)
+        return null;
+    const prerelease = [];
+    if (m[4]) {
+        for (const id of m[4].split('.')) {
+            prerelease.push(/^\d+$/.test(id) ? Number(id) : id);
+        }
+    }
+    return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]), prerelease };
+}
+/**
+ * Compare two exact semvers by SemVer-spec precedence (build metadata ignored).
+ *
+ * Returns -1 if a < b, 0 if equal precedence, 1 if a > b, or `null` when EITHER
+ * side is not an exact semver (incomparable — caller should skip). Never throws:
+ * tolerance is a design requirement.
+ */
+export function compareExact(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (!pa || !pb)
+        return null;
+    for (const k of ['major', 'minor', 'patch']) {
+        if (pa[k] !== pb[k])
+            return pa[k] < pb[k] ? -1 : 1;
+    }
+    // A version WITHOUT prerelease outranks one WITH (1.0.0 > 1.0.0-rc.1).
+    const aPre = pa.prerelease;
+    const bPre = pb.prerelease;
+    if (aPre.length === 0 && bPre.length === 0)
+        return 0;
+    if (aPre.length === 0)
+        return 1;
+    if (bPre.length === 0)
+        return -1;
+    const len = Math.min(aPre.length, bPre.length);
+    for (let i = 0; i < len; i++) {
+        const x = aPre[i];
+        const y = bPre[i];
+        if (x === y)
+            continue;
+        const xNum = typeof x === 'number';
+        const yNum = typeof y === 'number';
+        // Numeric identifiers always have lower precedence than non-numeric.
+        if (xNum && !yNum)
+            return -1;
+        if (!xNum && yNum)
+            return 1;
+        if (xNum && yNum)
+            return x < y ? -1 : 1;
+        return x < y ? -1 : 1;
+    }
+    // All shared identifiers equal — the longer prerelease list has higher precedence.
+    if (aPre.length === bPre.length)
+        return 0;
+    return aPre.length < bPre.length ? -1 : 1;
+}
+//# sourceMappingURL=semver.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../src/semver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,YAAY,GAChB,qLAAqL,CAAC;AAExL,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAUD,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,CAAU;IACjD,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE5B,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACrD,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,uEAAuE;IACvE,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC;QACnC,qEAAqE;QACrE,IAAI,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI;YAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,IAAI;YAAE,OAAQ,CAAY,GAAI,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,OAAQ,CAAY,GAAI,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,mFAAmF;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/types.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared types for @microwiseai/snapshot-downgrade-guard.
+ */
+/**
+ * Downgrade policy mode.
+ *   - refuse (default): block the install when a downgrade is detected.
+ *   - warn:   print a warning, then proceed.
+ *   - allow:  proceed silently.
+ */
+export type DowngradeMode = 'refuse' | 'warn' | 'allow';
+/** The set of valid policy modes (runtime guard). */
+export declare const DOWNGRADE_MODES: readonly DowngradeMode[];
+/** A single package whose currently-installed version is newer than the pin. */
+export interface Offender {
+    /** Package name. */
+    pkg: string;
+    /** Currently-installed (global) version. */
+    installed: string;
+    /** Version the snapshot would pin/install (a downgrade relative to `installed`). */
+    pinned: string;
+}
+/** Result of {@link detectDowngrades}. */
+export interface DetectResult {
+    /** True iff at least one offender was found. */
+    wouldDowngrade: boolean;
+    /** Packages that would be downgraded (installed > pinned, strict). */
+    offenders: Offender[];
+}
+//# sourceMappingURL=types.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAExD,qDAAqD;AACrD,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAAgC,CAAC;AAErF,gFAAgF;AAChF,MAAM,WAAW,QAAQ;IACvB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,cAAc,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,SAAS,EAAE,QAAQ,EAAE,CAAC;CACvB"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * Shared types for @microwiseai/snapshot-downgrade-guard.
+ */
+/** The set of valid policy modes (runtime guard). */
+export const DOWNGRADE_MODES = ['refuse', 'warn', 'allow'];
+//# sourceMappingURL=types.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@microwiseai/snapshot-downgrade-guard",
+  "version": "0.1.0",
+  "description": "Auto-detects when a snapshot install would downgrade already-installed global tooling, and resolves the layered refuse/warn/allow policy. Pure, dependency-injected, no side effects.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "lint": "eslint src",
+    "prepublishOnly": "npm run build"
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "snapshot",
+    "downgrade",
+    "guard",
+    "semver",
+    "install"
+  ],
+  "author": "IST Team",
+  "license": "MIT",
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^20.11.0",
+    "@typescript-eslint/eslint-plugin": "^8.57.0",
+    "@typescript-eslint/parser": "^8.57.0",
+    "eslint": "^10.0.3",
+    "typescript": "^5.7.3",
+    "vitest": "^4.0.18"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "glpkg": {
+    "group": "microwiseai"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/microwiseai/snapshot.downgrade-guard.git"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microwiseai/snapshot",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "CLI for installing IST Snapshot packages",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -25,6 +25,7 @@
   "scripts": {
     "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsc -p tsconfig.build.json",
+    "postbuild": "node scripts/write-build-info.mjs",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "test": "vitest",
@@ -32,7 +33,7 @@
     "lint": "eslint src",
     "prepublishOnly": "npm run build",
     "publish:npm": "set -a; . ./.env; set +a; npm publish --access public",
-    "publish:glpkg": "glpkg publish --git-tag false --push false",
+    "publish:glpkg": "glpkg publish",
     "publish:all": "npm run publish:npm && npm run publish:glpkg"
   },
   "files": [
@@ -53,6 +54,7 @@
     "@microwiseai/license": "^0.1.4",
     "@microwiseai/skit": "^0.1.19",
     "@microwiseai/snapshot-dedup": "0.2.0",
+    "@microwiseai/snapshot-downgrade-guard": "0.1.0",
     "@microwiseai/snapshot-parallel": "^0.1.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
@@ -75,9 +77,14 @@
     "@microwiseai/license",
     "@microwiseai/skit",
     "@microwiseai/snapshot-dedup",
+    "@microwiseai/snapshot-downgrade-guard",
     "@microwiseai/snapshot-parallel"
   ],
   "glpkg": {
     "group": "microwiseai"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/microwiseai/snapshot.git"
   }
 }

package/dist/lib/transitive-resolver.d.ts

@@ -1,89 +0,0 @@
-/**
- * Transitive Dependency Resolver
- *
- * snapshot과 skit을 재귀적으로 탐색하여 모든 npm 패키지를 수집하고
- * registry-proxy의 /resolve-deps API를 통해 transitive deps를 해석
- */
-export interface SkitManifest {
-    name: string;
-    version: string;
-    dependencies?: {
-        npm?: Record<string, string>;
-        skit?: Record<string, string>;
-        cli?: Array<{
-            name: string;
-            install: string;
-        }>;
-    };
-}
-export interface ResolvedPackage {
-    name: string;
-    version: string;
-    isDirect: boolean;
-    source: 'snapshot' | 'skit' | 'transitive';
-    requestedBy?: string;
-}
-export interface TransitiveResolutionResult {
-    /** 수집된 모든 npm 패키지 (직접 + transitive) */
-    npm: ResolvedPackage[];
-    /** 수집된 모든 skit 패키지 */
-    skit: ResolvedPackage[];
-    /** 에러 발생한 패키지들 */
-    errors: Array<{
-        name: string;
-        error: string;
-    }>;
-    /** scope → groupId 매핑 (snapshot registry에서 수집) */
-    scopeGroups: Record<string, string>;
-}
-/**
- * license-api /resolve-deps 응답 타입 (normalized)
- */
-export interface LicenseApiResolveDepsResponse {
-    dependencies: Record<string, string>;
-    peerDependencies?: Record<string, string>;
-}
-export interface ResolveOptions {
-    /** proxy를 통해 transitive deps 해석 */
-    resolveTransitive?: boolean;
-    /** transitive 해석 대상 스코프 (defaults to scopes from snapshot.registry) */
-    scopes?: string[];
-    /** GitLab group ID */
-    groupId?: string;
-}
-/**
- * Snapshot의 모든 의존성을 재귀적으로 탐색하고
- * npm transitive deps까지 해석
- *
- * NOTE: scopes는 snapshot.json의 registry 필드에서 동적으로 추출됨
- * options.scopes가 지정되면 해당 값 사용, 아니면 수집된 scopeGroups 사용
- */
-export declare function resolveAllDependencies(snapshotName: string, options?: ResolveOptions): Promise<TransitiveResolutionResult>;
-export interface ResolveDepsFromLicenseOptions {
-    /** Package list to resolve (e.g., ['@microwiseai/foo@1.0.0']) */
-    packages: string[];
-    /** GitLab group ID (string) */
-    groupId: string;
-    /** Package scopes (e.g., ['@microwiseai']) */
-    scopes: string[];
-    /** Include peer dependencies in response (default: true) */
-    includePeer?: boolean;
-}
-/**
- * license-api의 /resolve-deps API를 호출하여 의존성 해석
- *
- * @example
- * const result = await resolveDepsFromLicenseAPI({
- *   groupId: 12345,
- *   scopes: ['@ist', '@microwiseai'],
- *   includePeer: true,
- * });
- * // result.dependencies: { "@ist/tda-kit": "^1.0.0" }
- * // result.peerDependencies: { "typescript": "^5.0.0" }
- */
-export declare function resolveDepsFromLicenseAPI(options: ResolveDepsFromLicenseOptions): Promise<LicenseApiResolveDepsResponse>;
-/**
- * 캐시 클리어
- */
-export declare function clearTransitiveCache(): void;
-//# sourceMappingURL=transitive-resolver.d.ts.map

package/dist/lib/transitive-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transitive-resolver.d.ts","sourceRoot":"","sources":["../../src/lib/transitive-resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,GAAG,CAAC,EAAE,KAAK,CAAC;YACV,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,uCAAuC;IACvC,GAAG,EAAE,eAAe,EAAE,CAAC;IACvB,sBAAsB;IACtB,IAAI,EAAE,eAAe,EAAE,CAAC;IACxB,kBAAkB;IAClB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAYD;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAmWD,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,0BAA0B,CAAC,CAqDrC;AAMD,MAAM,WAAW,6BAA6B;IAC5C,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,6BAA6B,CAAC,CAiGxC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}