@microwiseai/snapshot 0.8.0 → 0.9.0

package/dist/build-info.json

@@ -0,0 +1 @@
+{"gitSha":"f9d767748eb5"}

package/dist/commands/access.d.ts

@@ -1,17 +1,33 @@
 /**
- * Access command - Manage package access levels
+ * Access commands
  *
- * Commands:
- *   snapshot access sync [path]  - Sync access with license-api
+ *   snapshot access sync [path]                  - RETIRED (license-api write path)
+ *   snapshot access-index <snapshot> --version … - backfill access-index.json
  */
-interface AccessSyncOptions {
-    verbose?: boolean;
+export declare const ACCESS_SYNC_RETIRED_MESSAGE: string;
+/** Disabled: fails loudly with the contract reference. No network calls. */
+export declare function accessSyncCommand(): Promise<void>;
+export interface AccessIndexOptions {
+    version?: string[];
+    all?: boolean;
+    force?: boolean;
     dryRun?: boolean;
-    skipTransitive?: boolean;
+    allowPartial?: boolean;
+    /** --dry-run output directory (one file per version). */
+    out?: string;
+    verbose?: boolean;
+}
+export interface AccessIndexOutcome {
+    version: string;
+    status: 'uploaded' | 'dry-run' | 'skipped-exists' | 'failed' | 'not-found';
+    packages?: number;
+    detail?: string;
+    file?: string;
 }
 /**
- * Sync access levels for a snapshot
+ * Backfill access-index.json for already-published snapshot versions.
+ * snapshot.json is read from the registry (never a local file); only
+ * access-index.json is uploaded — the tarball is never re-published.
  */
-export declare function accessSyncCommand(snapshotPath?: string, options?: AccessSyncOptions): Promise<void>;
-export {};
+export declare function accessIndexCommand(snapshotArg: string, options?: AccessIndexOptions): Promise<AccessIndexOutcome[]>;
 //# sourceMappingURL=access.d.ts.map

package/dist/commands/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/commands/access.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,UAAU,iBAAiB;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AA0BD;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAmCf"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/commands/access.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,eAAO,MAAM,2BAA2B,QAM8C,CAAC;AAEvF,4EAA4E;AAC5E,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAKvD;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,gBAAgB,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAwF/B"}

package/dist/commands/access.js

@@ -1,68 +1,122 @@
 /**
- * Access command - Manage package access levels
+ * Access commands
  *
- * Commands:
- *   snapshot access sync [path]  - Sync access with license-api
+ *   snapshot access sync [path]                  - RETIRED (license-api write path)
+ *   snapshot access-index <snapshot> --version … - backfill access-index.json
  */
-import { readFile } from 'node:fs/promises';
-import { join, resolve } from 'node:path';
 import chalk from 'chalk';
-import { syncPackageAccess } from '../lib/access-sync.js';
-/**
- * Read snapshot.json from given path or current directory
- */
-async function readSnapshot(snapshotPath) {
-    const targetPath = snapshotPath
-        ? resolve(snapshotPath)
-        : join(process.cwd(), 'snapshot.json');
-    // If path is a directory, append snapshot.json
-    const finalPath = targetPath.endsWith('.json')
-        ? targetPath
-        : join(targetPath, 'snapshot.json');
-    try {
-        const content = await readFile(finalPath, 'utf-8');
-        return JSON.parse(content);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT') {
-            throw new Error(`snapshot.json not found at: ${finalPath}`);
-        }
-        throw new Error(`Failed to read snapshot.json: ${error instanceof Error ? error.message : String(error)}`);
-    }
+import { fetchSnapshotFromRepo, parseSnapshotSpec, snapshotNameToPackageName } from '../lib/gitlab.js';
+import { ACCESS_INDEX_FILE, PartialClosureError, generateAccessIndex, listGenericPackageVersions, listPackageFiles, serializeAccessIndex, uploadAccessIndex, } from '../lib/access-index.js';
+import { compareVersions, parseVersion } from '../lib/semver-range.js';
+import { describeIndex, writeIndexFile } from './publish.js';
+import { join, resolve } from 'node:path';
+import { mkdir } from 'node:fs/promises';
+export const ACCESS_SYNC_RETIRED_MESSAGE = '`snapshot access sync` is retired: license-api package_access is no longer written.\n' +
+    '  Contract (global snapshot-tier-access, 2026-09-28 owner decision): "license-api package_access 에\n' +
+    '  snapshot 의존 패키지를 등록하지 않음(access-sync 의 license-api 쓰기 경로 폐기)".\n' +
+    '  Serving SSOT is access-index.json in each published snapshot version:\n' +
+    '    - new versions:      snapshot publish (uploads it automatically)\n' +
+    '    - existing versions: snapshot access-index <snapshot> --version <v> (or --all)';
+/** Disabled: fails loudly with the contract reference. No network calls. */
+export async function accessSyncCommand() {
+    console.error();
+    console.error(chalk.red('Error:'), ACCESS_SYNC_RETIRED_MESSAGE);
+    console.error();
+    process.exitCode = 1;
 }
 /**
- * Sync access levels for a snapshot
+ * Backfill access-index.json for already-published snapshot versions.
+ * snapshot.json is read from the registry (never a local file); only
+ * access-index.json is uploaded — the tarball is never re-published.
  */
-export async function accessSyncCommand(snapshotPath, options = {}) {
-    const { verbose = false, dryRun = false, skipTransitive = false } = options;
-    console.log();
-    console.log(chalk.cyan('Syncing package access...'));
+export async function accessIndexCommand(snapshotArg, options = {}) {
+    const { force = false, dryRun = false, allowPartial = false, verbose = false } = options;
+    const outcomes = [];
     try {
-        const snapshot = await readSnapshot(snapshotPath);
-        if (!snapshot.access) {
-            console.log(chalk.yellow('\n  Warning: No "access" field in snapshot.json'));
-            console.log(chalk.dim('  Add "access": "public", "access": "authenticated", or "access": { "type": "licensed", "productId": "..." }'));
-            console.log();
-            return;
+        if (allowPartial && !dryRun) {
+            throw new Error('--allow-partial is only allowed with --dry-run (a partial access-index must not be uploaded)');
         }
-        console.log(chalk.dim(`  Snapshot: ${snapshot.name} v${snapshot.version}`));
-        const result = await syncPackageAccess(snapshot, {
-            verbose,
-            dryRun,
-            includeTransitive: !skipTransitive,
-        });
-        if (result.success) {
-            console.log(chalk.green('\n✓ Access sync completed!'));
+        const { name, version: specVersion } = parseSnapshotSpec(snapshotArg);
+        const packageName = snapshotNameToPackageName(name);
+        const published = await listGenericPackageVersions(packageName);
+        const byVersion = new Map(published.map((p) => [p.version, p]));
+        let targets;
+        if (options.all) {
+            targets = [...byVersion.keys()];
         }
         else {
-            console.log(chalk.yellow('\n⚠ Access sync completed with some failures'));
+            targets = [...(options.version ?? []), ...(specVersion ? [specVersion] : [])];
+        }
+        targets = [...new Set(targets)].sort((a, b) => {
+            const pa = parseVersion(a);
+            const pb = parseVersion(b);
+            return pa && pb ? compareVersions(pa, pb) : a.localeCompare(b);
+        });
+        if (targets.length === 0) {
+            throw new Error('No version given: use --version <v> (repeatable) or --all');
+        }
+        console.log();
+        console.log(chalk.cyan(`access-index backfill: ${name} (${targets.length} version(s))${dryRun ? ' [dry-run]' : ''}`));
+        for (const version of targets) {
+            const pkg = byVersion.get(version);
+            if (!pkg) {
+                console.log(chalk.red(`  ✗ ${version}: not published (${packageName})`));
+                outcomes.push({ version, status: 'not-found' });
+                continue;
+            }
+            try {
+                const files = await listPackageFiles(pkg);
+                if (files.includes(ACCESS_INDEX_FILE) && !force) {
+                    console.log(chalk.dim(`  ⊘ ${version}: ${ACCESS_INDEX_FILE} already present (use --force to re-upload)`));
+                    outcomes.push({ version, status: 'skipped-exists' });
+                    continue;
+                }
+                const snapshot = await fetchSnapshotFromRepo(`${name}@${version}`);
+                if (snapshot.name !== name || snapshot.version !== version) {
+                    throw new Error(`registry snapshot.json says ${snapshot.name}@${snapshot.version}, expected ${name}@${version}`);
+                }
+                const { index, gaps } = await generateAccessIndex(snapshot, { allowPartial, verbose });
+                for (const g of gaps)
+                    console.log(chalk.yellow(`    gap (--allow-partial): ${g}`));
+                const body = serializeAccessIndex(index);
+                if (dryRun) {
+                    let file;
+                    if (options.out) {
+                        await mkdir(resolve(options.out), { recursive: true });
+                        file = await writeIndexFile(body, join(options.out, `${packageName}-${version}.${ACCESS_INDEX_FILE}`));
+                    }
+                    else {
+                        file = await writeIndexFile(body);
+                    }
+                    console.log(chalk.yellow(`  [dry-run] ${version}: ${describeIndex(index)} → ${file}`));
+                    outcomes.push({ version, status: 'dry-run', packages: index.packages.length, file });
+                }
+                else {
+                    await uploadAccessIndex(pkg, body);
+                    console.log(chalk.green(`  ✓ ${version}: uploaded — ${describeIndex(index)}`));
+                    outcomes.push({ version, status: 'uploaded', packages: index.packages.length });
+                }
+            }
+            catch (error) {
+                const detail = error instanceof PartialClosureError
+                    ? `partial closure: ${error.gaps.join('; ')}`
+                    : error instanceof Error ? error.message : String(error);
+                console.log(chalk.red(`  ✗ ${version}: ${detail}`));
+                outcomes.push({ version, status: 'failed', detail });
+            }
         }
+        const count = (s) => outcomes.filter((o) => o.status === s).length;
         console.log();
+        console.log(`  uploaded ${count('uploaded')}, dry-run ${count('dry-run')}, skipped ${count('skipped-exists')}, ` +
+            `failed ${count('failed')}, not-found ${count('not-found')}`);
+        if (count('failed') + count('not-found') > 0)
+            process.exitCode = 1;
     }
     catch (error) {
         console.error();
         console.error(chalk.red('Error:'), error instanceof Error ? error.message : String(error));
         process.exitCode = 1;
     }
+    return outcomes;
 }
 //# sourceMappingURL=access.js.map

package/dist/commands/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/commands/access.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ1D;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,YAAqB;IAC/C,MAAM,UAAU,GAAG,YAAY;QAC7B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;IAEzC,+CAA+C;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5C,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,YAAqB,EACrB,UAA6B,EAAE;IAE/B,MAAM,EAAE,OAAO,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,cAAc,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE5E,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QAElD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8GAA8G,CAAC,CAAC,CAAC;YACvI,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE;YAC/C,OAAO;YACP,MAAM;YACN,iBAAiB,EAAE,CAAC,cAAc;SACnC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/commands/access.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,MAAM,CAAC,MAAM,2BAA2B,GACtC,uFAAuF;IACvF,sGAAsG;IACtG,oEAAoE;IACpE,2EAA2E;IAC3E,wEAAwE;IACxE,oFAAoF,CAAC;AAEvF,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAChE,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAqBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,UAA8B,EAAE;IAEhC,MAAM,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,YAAY,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACzF,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAgC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/F,IAAI,OAAiB,CAAC;QACtB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,KAAK,OAAO,CAAC,MAAM,eAAe,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAEtH,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,oBAAoB,WAAW,GAAG,CAAC,CAAC,CAAC;gBACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,KAAK,iBAAiB,6CAA6C,CAAC,CAAC,CAAC;oBAC1G,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;oBACrD,SAAS;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;gBACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,cAAc,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;gBACnH,CAAC;gBACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;gBACvF,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnF,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,IAAY,CAAC;oBACjB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAChB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;wBACvD,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,IAAI,OAAO,IAAI,iBAAiB,EAAE,CAAC,CAAC,CAAC;oBACzG,CAAC;yBAAM,CAAC;wBACN,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;oBACpC,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,OAAO,KAAK,aAAa,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;oBACvF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvF,CAAC;qBAAM,CAAC;oBACN,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,OAAO,gBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,KAAK,YAAY,mBAAmB;oBACjD,CAAC,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC7C,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAA+B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACjG,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACT,cAAc,KAAK,CAAC,UAAU,CAAC,aAAa,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,CAAC,gBAAgB,CAAC,IAAI;YAClG,UAAU,KAAK,CAAC,QAAQ,CAAC,eAAe,KAAK,CAAC,WAAW,CAAC,EAAE,CAC/D,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/commands/config.d.ts

@@ -0,0 +1,3 @@
+export declare function configGetCommand(key?: string): Promise<void>;
+export declare function configSetCommand(key: string, value: string): Promise<void>;
+//# sourceMappingURL=config.d.ts.map

package/dist/commands/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAuBA,wBAAsB,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlE;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahF"}

package/dist/commands/config.js

@@ -0,0 +1,37 @@
+import chalk from 'chalk';
+import { getConfigPath, getMachineDowngradeMode, setMachineDowngradeMode, asDowngradeMode, DOWNGRADE_MODES, } from '@microwiseai/snapshot-downgrade-guard';
+/**
+ * Thin `snapshot config` command. All read/write logic lives in
+ * @microwiseai/snapshot-downgrade-guard so core stays a thin wire. Currently
+ * only `install.onDowngrade` is supported.
+ */
+const SUPPORTED_KEYS = ['install.onDowngrade'];
+function unknownKey(key) {
+    console.log(chalk.red(`Unknown config key: ${key}`));
+    console.log(chalk.gray(`Supported keys: ${SUPPORTED_KEYS.join(', ')}`));
+    process.exit(1);
+}
+export async function configGetCommand(key) {
+    const current = getMachineDowngradeMode() ?? '(unset — default: refuse)';
+    if (!key || key === 'install.onDowngrade') {
+        if (!key)
+            console.log(chalk.gray(`Config file: ${getConfigPath()}`));
+        console.log(`install.onDowngrade = ${current}`);
+        return;
+    }
+    unknownKey(key);
+}
+export async function configSetCommand(key, value) {
+    if (key !== 'install.onDowngrade')
+        unknownKey(key);
+    const mode = asDowngradeMode(value);
+    if (!mode) {
+        console.log(chalk.red(`Invalid value for install.onDowngrade: "${value}"`));
+        console.log(chalk.gray(`Allowed values: ${DOWNGRADE_MODES.join(', ')}`));
+        process.exit(1);
+    }
+    setMachineDowngradeMode(mode);
+    console.log(chalk.green('✓') + ` install.onDowngrade = ${mode}`);
+    console.log(chalk.gray(`Saved to ${getConfigPath()}`));
+}
+//# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EACf,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAE/C;;;;GAIG;AAEH,MAAM,cAAc,GAAG,CAAC,qBAAqB,CAAU,CAAC;AAExD,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAY;IACjD,MAAM,OAAO,GAAG,uBAAuB,EAAE,IAAI,2BAA2B,CAAC;IACzE,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAa;IAC/D,IAAI,GAAG,KAAK,qBAAqB;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/commands/install.d.ts

@@ -1,9 +1,44 @@
 import type { Snapshot, InstallerConfig } from '../lib/types.js';
+import { type DowngradeMode } from '@microwiseai/snapshot-downgrade-guard';
 import { StepRecorder } from '../lib/ledger.js';
 export interface InstallResult {
     installed: string[];
     failed: string[];
 }
+export declare class DowngradeRefusedError extends Error {
+    constructor(message: string);
+}
+/**
+ * Publish (or clear) the downgrade policy resolved upstream by installCommand so
+ * the exec boundary reuses it. Exported as a test seam.
+ */
+export declare function setActiveDowngradeMode(mode: DowngradeMode | undefined): void;
+/**
+ * Run a command with FULLY LIVE output (spawn, async).
+ *
+ * Why spawn+async (not execSync): npm writes its progress bar to STDERR, and the
+ * previous `execSync(stdio:['inherit','inherit','pipe'])` piped stderr — which
+ * (a) hid npm's live progress (looked "frozen" for tens of seconds) and
+ * (b) blocked the event loop so no JS spinner could ever turn. Inheriting all
+ * three streams lets npm's own progress render live to the terminal while the
+ * event loop stays free. See install-speed-visibility work (B).
+ *
+ * On failure we can no longer capture the stderr text (it went straight to the
+ * terminal, so the user already SAW it) — `lastCommandError` carries the exit
+ * code instead.
+ */
+export declare function runCommand(command: string): Promise<boolean>;
+/**
+ * Synchronous streaming variant — used ONLY by the converge re-pin callback,
+ * which is invoked from the pure/sync `runConverge` (lib/install-verify.ts).
+ * Keeping this sync avoids making `runConverge` async (which would ripple into
+ * its unit-test suite and break its pure-function contract). `spawnSync` with
+ * inherited stdio still streams npm's live progress to the terminal (the child
+ * writes directly to the inherited fd), so the converge phase no longer looks
+ * frozen either — it only blocks the JS event loop for its (batched, rare)
+ * duration.
+ */
+export declare function runCommandSync(command: string): boolean;
 export interface InstallSnapshotOptions {
     useProxy?: boolean;
     autoDetect?: boolean;
@@ -20,6 +55,18 @@ export interface InstallSnapshotOptions {
      * base layer cannot clobber an override with its original pin.
      */
     overrides?: Record<string, string>;
+    /**
+     * grant-unify P1 — awaited before each long phase (every kit/skit install
+     * group) so an active snapshot grant can be re-issued before its TTL runs
+     * out. Unset (SNAPSHOT_GRANT_MODE=off) → no-op.
+     */
+    beforePhase?: (phase: string) => Promise<void>;
+    /**
+     * grant-unify P1 — skit session source read right before each kit install
+     * (grant mode: the CURRENT istsg_ token, so re-issues are honored). Takes
+     * precedence over `sessionId` for skit installs only. Unset → `sessionId`.
+     */
+    skitSessionId?: () => string | undefined;
 }
 /**
  * FB — the subset of pin overrides that actually apply to this install (i.e. the
@@ -60,6 +107,13 @@ export interface InstallCommandOptions {
      * (repeatable). Applied to the whole install + recorded in the ledger.
      */
     pin?: string[];
+    /**
+     * One-shot downgrade escape hatch (CLI `--allow-downgrade`). When true, an
+     * install that would downgrade already-installed global tooling proceeds
+     * anyway (equivalent to env SNAPSHOT_ALLOW_LOCAL=1). Highest-priority policy
+     * layer. See @microwiseai/snapshot-downgrade-guard.
+     */
+    allowDowngrade?: boolean;
 }
 export declare function installCommand(name: string, options?: InstallCommandOptions): Promise<void>;
 //# sourceMappingURL=install.d.ts.map

package/dist/commands/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAgBjE,OAAO,EACL,YAAY,EAIb,MAAM,kBAAkB,CAAC;AAsB1B,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAqgBD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAuBD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,KAAK,GAAE,MAAU,EACjB,gBAAgB,GAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAM,EACtD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAAE,CAAC,CA0YjF;AAwDD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA6B5F;AAED,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAoLD,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAwoBrG"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBjE,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,uCAAuC,CAAC;AAc/C,OAAO,EACL,YAAY,EAIb,MAAM,kBAAkB,CAAC;AAsB1B,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAwPD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAGD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI,CAE5E;AAgDD;;;;;;;;;;;;;GAaG;AAEH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyB5D;AAED;;;;;;;;;GASG;AAEH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgBvD;AAgSD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC1C;AAuDD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,KAAK,GAAE,MAAU,EACjB,gBAAgB,GAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAM,EACtD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAAE,CAAC,CAmZjF;AAwDD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA6B5F;AAED,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAoLD,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA23BrG"}