@microwiseai/snapshot 0.8.0 → 0.9.0

package/dist/index.js

@@ -7,9 +7,10 @@ import { listCommand } from './commands/list.js';
 import { currentCommand } from './commands/current.js';
 import { publishCommand } from './commands/publish.js';
 import { licenseActivateCommand, licenseStatusCommand, licenseDeactivateCommand, licenseRefreshCommand, } from './commands/license.js';
-import { accessSyncCommand } from './commands/access.js';
+import { accessSyncCommand, accessIndexCommand } from './commands/access.js';
 import { doctorCommand } from './commands/doctor.js';
 import { setupCommand } from './commands/setup.js';
+import { configGetCommand, configSetCommand } from './commands/config.js';
 import { reportImport } from '@microwiseai/import-telemetry';
 import { VENDOR_NAME, PACKAGE_NAME } from './lib/config.js';
 const require = createRequire(import.meta.url);
@@ -46,7 +47,10 @@ const program = new Command();
 program
     .name('snapshot')
     .description('IST Snapshot Installer - Install packages from GitLab snapshot repos')
-    .version(pkg.version);
+    .version(pkg.version)
+    // Root options (only --version) are recognized before the subcommand only, so
+    // `access-index --version <v>` reaches the subcommand.
+    .enablePositionalOptions();
 program
     .command('install <name>')
     .description('Install packages from a snapshot (e.g., @scope/name)')
@@ -55,6 +59,7 @@ program
     .option('-y, --yes', 'With --replace, skip the removal confirmation prompt')
     .option('--no-converge', 'Raw/fast install: skip post-install convergence — only verify, and fail-loud on any divergence (convergence is ON by default)')
     .option('--pin <spec...>', 'Override a package version without re-publishing, e.g. --pin @ist/sesh@0.4.0 (repeatable)')
+    .option('--allow-downgrade', 'Proceed even if the snapshot would downgrade already-installed global packages (one-shot; same as SNAPSHOT_ALLOW_LOCAL=1)')
     .action(async (name, options) => {
     await installCommand(name, options);
 });
@@ -81,7 +86,9 @@ program
     .option('-b, --bump <type>', 'Bump version (patch, minor, major)')
     .option('-d, --dry-run', 'Show what would be published without publishing')
     .option('-v, --verbose', 'Show detailed output')
-    .option('--skip-access-sync', 'Skip syncing access levels to license-api')
+    .option('--skip-access-sync', '(deprecated, no-op) license-api access sync was retired')
+    .option('--allow-partial', 'With --dry-run only: generate the access-index even if the closure has gaps')
+    .option('--index-out <path>', 'With --dry-run, write access-index.json here (default: temp dir)')
     .action(async (options) => {
     await publishCommand(options);
 });
@@ -89,14 +96,28 @@ program
 const accessCmd = program
     .command('access')
     .description('Package access management');
+// Retired (2026-09-28, snapshot-tier-access): no license-api writes. Kept so
+// the command fails loudly with the contract reference instead of "unknown".
 accessCmd
     .command('sync [path]')
-    .description('Sync package access levels with license-api')
-    .option('-d, --dry-run', 'Show what would be synced without syncing')
+    .description('(retired) license-api access sync — use access-index instead')
+    .allowUnknownOption()
+    .action(async () => {
+    await accessSyncCommand();
+});
+const collect = (value, prev = []) => [...prev, value];
+program
+    .command('access-index <snapshot>')
+    .description('Backfill access-index.json for published snapshot versions (reads snapshot.json from the registry; never re-publishes the tarball)')
+    .option('--version <v>', 'Published version (repeatable)', collect)
+    .option('--all', 'All published versions of the snapshot')
+    .option('--force', 'Re-upload even if access-index.json already exists')
+    .option('-d, --dry-run', 'Generate files only (no upload)')
+    .option('--out <dir>', 'With --dry-run, write files into this directory')
+    .option('--allow-partial', 'With --dry-run only: generate even if the closure has gaps (never uploaded)')
     .option('-v, --verbose', 'Show detailed output')
-    .option('--skip-transitive', 'Skip transitive dependencies')
-    .action(async (path, options) => {
-    await accessSyncCommand(path, options);
+    .action(async (snapshot, options) => {
+    await accessIndexCommand(snapshot, options);
 });
 // License management commands
 const licenseCmd = program
@@ -126,6 +147,22 @@ licenseCmd
     .action(async () => {
     await licenseRefreshCommand();
 });
+// Machine-level config (thin wrapper over @microwiseai/snapshot-downgrade-guard)
+const configCmd = program
+    .command('config')
+    .description('Machine-level snapshot config (~/.config/ist-snapshot/config.json)');
+configCmd
+    .command('get [key]')
+    .description('Get a config value (default: show install.onDowngrade)')
+    .action(async (key) => {
+    await configGetCommand(key);
+});
+configCmd
+    .command('set <key> <value>')
+    .description('Set a config value, e.g. install.onDowngrade refuse|warn|allow')
+    .action(async (key, value) => {
+    await configSetCommand(key, value);
+});
 program
     .command('doctor')
     .description('Check if all prerequisites are satisfied')

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,2DAA2D;AAC3D,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,IAAc;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,gCAAgC;IACrE,MAAM,GAAG,GAAG,CAAC,GAAG,KAAe,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAO,sBAAsB;IACtE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,CAAC,qBAAqB;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,YAAY,CAAC;QACX,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,YAAY;QACzB,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,iDAAiD;KACzF,CAAC,CAAC;AACL,CAAC;AACD,2DAA2D;AAE3D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,sEAAsE,CAAC;KACnF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,WAAW,EAAE,kHAAkH,CAAC;KACvI,MAAM,CAAC,eAAe,EAAE,sEAAsE,CAAC;KAC/F,MAAM,CAAC,WAAW,EAAE,sDAAsD,CAAC;KAC3E,MAAM,CAAC,eAAe,EAAE,+HAA+H,CAAC;KACxJ,MAAM,CAAC,iBAAiB,EAAE,2FAA2F,CAAC;KACtH,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAAmG,EAAE,EAAE;IAClI,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,OAAO;KACJ,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACjC,WAAW,CAAC,0EAA0E,CAAC;KACvF,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,QAAQ,EAAE,0EAA0E,CAAC;KAC5F,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;IAC5C,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;KACjE,MAAM,CAAC,eAAe,EAAE,iDAAiD,CAAC;KAC1E,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;KAC/C,MAAM,CAAC,oBAAoB,EAAE,2CAA2C,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,6BAA6B;AAC7B,MAAM,SAAS,GAAG,OAAO;KACtB,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2BAA2B,CAAC,CAAC;AAE5C,SAAS;KACN,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC;KACpE,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;KAC/C,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;KAC3D,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,OAAO,EAAE,EAAE;IAClD,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEL,8BAA8B;AAC9B,MAAM,UAAU,GAAG,OAAO;KACvB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErC,UAAU;KACP,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,qCAAqC,CAAC;KAClD,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;IAC5B,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,oBAAoB,EAAE,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,4BAA4B,CAAC;KACzC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,wBAAwB,EAAE,CAAC;AACnC,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,qBAAqB,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,+BAA+B,CAAC;KAC5C,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;KACjD,MAAM,CAAC,eAAe,EAAE,iDAAiD,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,0BAA0B;AAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;;;;CAI7B,CAAC,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,IAAI,EAAE,CAAC;AACjB,CAAC;AAED,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IAC7B,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,2DAA2D;AAC3D,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,IAAc;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,gCAAgC;IACrE,MAAM,GAAG,GAAG,CAAC,GAAG,KAAe,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAO,sBAAsB;IACtE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,CAAC,qBAAqB;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,YAAY,CAAC;QACX,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,YAAY;QACzB,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,iDAAiD;KACzF,CAAC,CAAC;AACL,CAAC;AACD,2DAA2D;AAE3D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,sEAAsE,CAAC;KACnF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACrB,8EAA8E;IAC9E,uDAAuD;KACtD,uBAAuB,EAAE,CAAC;AAE7B,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,WAAW,EAAE,kHAAkH,CAAC;KACvI,MAAM,CAAC,eAAe,EAAE,sEAAsE,CAAC;KAC/F,MAAM,CAAC,WAAW,EAAE,sDAAsD,CAAC;KAC3E,MAAM,CAAC,eAAe,EAAE,+HAA+H,CAAC;KACxJ,MAAM,CAAC,iBAAiB,EAAE,2FAA2F,CAAC;KACtH,MAAM,CAAC,mBAAmB,EAAE,2HAA2H,CAAC;KACxJ,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAA6H,EAAE,EAAE;IAC5J,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,OAAO;KACJ,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACjC,WAAW,CAAC,0EAA0E,CAAC;KACvF,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,QAAQ,EAAE,0EAA0E,CAAC;KAC5F,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;IAC5C,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;KACjE,MAAM,CAAC,eAAe,EAAE,iDAAiD,CAAC;KAC1E,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;KAC/C,MAAM,CAAC,oBAAoB,EAAE,yDAAyD,CAAC;KACvF,MAAM,CAAC,iBAAiB,EAAE,6EAA6E,CAAC;KACxG,MAAM,CAAC,oBAAoB,EAAE,kEAAkE,CAAC;KAChG,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,6BAA6B;AAC7B,MAAM,SAAS,GAAG,OAAO;KACtB,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2BAA2B,CAAC,CAAC;AAE5C,6EAA6E;AAC7E,6EAA6E;AAC7E,SAAS;KACN,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,kBAAkB,EAAE;KACpB,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,iBAAiB,EAAE,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,OAAiB,EAAE,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;AAEnF,OAAO;KACJ,OAAO,CAAC,yBAAyB,CAAC;KAClC,WAAW,CAAC,oIAAoI,CAAC;KACjJ,MAAM,CAAC,eAAe,EAAE,gCAAgC,EAAE,OAAO,CAAC;KAClE,MAAM,CAAC,OAAO,EAAE,wCAAwC,CAAC;KACzD,MAAM,CAAC,SAAS,EAAE,oDAAoD,CAAC;KACvE,MAAM,CAAC,eAAe,EAAE,iCAAiC,CAAC;KAC1D,MAAM,CAAC,aAAa,EAAE,iDAAiD,CAAC;KACxE,MAAM,CAAC,iBAAiB,EAAE,6EAA6E,CAAC;KACxG,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;KAC/C,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,OAAO,EAAE,EAAE;IAC1C,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEL,8BAA8B;AAC9B,MAAM,UAAU,GAAG,OAAO;KACvB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErC,UAAU;KACP,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,qCAAqC,CAAC;KAClD,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;IAC5B,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,oBAAoB,EAAE,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,4BAA4B,CAAC;KACzC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,wBAAwB,EAAE,CAAC;AACnC,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,qBAAqB,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,iFAAiF;AACjF,MAAM,SAAS,GAAG,OAAO;KACtB,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oEAAoE,CAAC,CAAC;AAErF,SAAS;KACN,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,wDAAwD,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,GAAuB,EAAE,EAAE;IACxC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,mBAAmB,CAAC;KAC5B,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE;IAC3C,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,+BAA+B,CAAC;KAC5C,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;KACjD,MAAM,CAAC,eAAe,EAAE,iDAAiD,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,0BAA0B;AAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;;;;CAI7B,CAAC,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,IAAI,EAAE,CAAC;AACjB,CAAC;AAED,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IAC7B,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/access-index.d.ts

@@ -0,0 +1,81 @@
+/**
+ * access-index.json — per-version serving manifest for registry-proxy.
+ *
+ * Contract (global state `snapshot-tier-access`, 2026-09-28 revision):
+ *   snapshot.json `access` (authoring SSOT) → `snapshot publish` writes the
+ *   install-set transitive closure (npmjs origin excluded) as access-index.json
+ *   into the SAME generic package version (serving SSOT) → registry-proxy
+ *   rebuilds its index from every published version of supported snapshots.
+ *
+ * Schema 1:
+ *   { schema: 1, snapshot, version, access: "public" | "licensed",
+ *     productId (required when licensed, else null),
+ *     generatedBy: "@microwiseai/snapshot@<ver> <git sha>",
+ *     closureSource: "gitlab" | "proxy"   (additive, schema-1 compatible),
+ *     packages: [{ name, versions: [exact…], kind: "npm" | "generic" }] }
+ *   generic names use the proxy path form (`ist__qa-kit`). Output is sorted
+ *   (packages by kind+name, versions ascending) so it is deterministic.
+ *
+ * Partial closures (unresolved / untraversed / skipped kits / unmatched) are
+ * refused by default — a partial index must not be published. `allowPartial`
+ * is the only escape hatch.
+ */
+import type { Snapshot } from './types.js';
+import { type ClosureSource, type InstallClosure } from './access-sync.js';
+export { ACCESS_INDEX_FILE } from './gitlab-publisher.js';
+export { downloadAccessIndex, findGenericPackageVersion, listGenericPackageVersions, listPackageFiles, resolveGenericProjectId, uploadAccessIndex, type GenericPackageVersion, type GenericTarget, } from './gitlab-publisher.js';
+export declare const ACCESS_INDEX_SCHEMA = 1;
+export interface AccessIndexPackage {
+    name: string;
+    versions: string[];
+    kind: 'npm' | 'generic';
+}
+export interface AccessIndex {
+    schema: 1;
+    snapshot: string;
+    version: string;
+    access: 'public' | 'licensed';
+    productId: string | null;
+    generatedBy: string;
+    /** Where the closure walk read packuments/kits (additive field). */
+    closureSource: ClosureSource;
+    packages: AccessIndexPackage[];
+}
+/** Closure gaps that make an index partial. */
+export declare function closureGaps(closure: InstallClosure): string[];
+export declare class PartialClosureError extends Error {
+    readonly snapshotSpec: string;
+    readonly gaps: string[];
+    constructor(snapshotSpec: string, gaps: string[]);
+}
+/** Map snapshot.json `access` to the schema-1 access/productId pair (fail-loud). */
+export declare function indexAccess(snapshot: Snapshot): {
+    access: 'public' | 'licensed';
+    productId: string | null;
+};
+/**
+ * Pure builder: closure → schema-1 index. The snapshot's own generic package
+ * (e.g. `ist__beta@<version>`) is included so the proxy can serve the snapshot
+ * artifact itself under the same rule as its members.
+ */
+export declare function buildAccessIndex(snapshot: Snapshot, closure: InstallClosure, generatedBy: string, closureSource?: ClosureSource): AccessIndex;
+/** Stable serialization (2-space JSON + trailing newline). */
+export declare function serializeAccessIndex(index: AccessIndex): string;
+/** "@microwiseai/snapshot@<ver> <git sha>" of the running CLI. */
+export declare function generatedByString(): string;
+export interface GenerateResult {
+    index: AccessIndex;
+    closure: InstallClosure;
+    gaps: string[];
+}
+/**
+ * Walk the closure and build the index. Throws PartialClosureError on gaps
+ * unless `allowPartial` (gaps are then returned for the caller to warn about).
+ */
+export declare function generateAccessIndex(snapshot: Snapshot, options?: {
+    allowPartial?: boolean;
+    verbose?: boolean;
+    generatedBy?: string;
+    source?: ClosureSource;
+}): Promise<GenerateResult>;
+//# sourceMappingURL=access-index.d.ts.map

package/dist/lib/access-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-index.d.ts","sourceRoot":"","sources":["../../src/lib/access-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAA0C,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGnH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,GACnB,MAAM,uBAAuB,CAAC;AAC/B,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,+CAA+C;AAC/C,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CAM7D;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE;gBADd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EAAE;CAQ1B;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG;IAAE,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAa3G;AAWD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,MAAM,EACnB,aAAa,GAAE,aAAwB,GACtC,WAAW,CA6Bb;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAE/D;AAID,kEAAkE;AAClE,wBAAgB,iBAAiB,IAAI,MAAM,CAwC1C;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAO,GACxG,OAAO,CAAC,cAAc,CAAC,CAWzB"}

package/dist/lib/access-index.js

@@ -0,0 +1,175 @@
+/**
+ * access-index.json — per-version serving manifest for registry-proxy.
+ *
+ * Contract (global state `snapshot-tier-access`, 2026-09-28 revision):
+ *   snapshot.json `access` (authoring SSOT) → `snapshot publish` writes the
+ *   install-set transitive closure (npmjs origin excluded) as access-index.json
+ *   into the SAME generic package version (serving SSOT) → registry-proxy
+ *   rebuilds its index from every published version of supported snapshots.
+ *
+ * Schema 1:
+ *   { schema: 1, snapshot, version, access: "public" | "licensed",
+ *     productId (required when licensed, else null),
+ *     generatedBy: "@microwiseai/snapshot@<ver> <git sha>",
+ *     closureSource: "gitlab" | "proxy"   (additive, schema-1 compatible),
+ *     packages: [{ name, versions: [exact…], kind: "npm" | "generic" }] }
+ *   generic names use the proxy path form (`ist__qa-kit`). Output is sorted
+ *   (packages by kind+name, versions ascending) so it is deterministic.
+ *
+ * Partial closures (unresolved / untraversed / skipped kits / unmatched) are
+ * refused by default — a partial index must not be published. `allowPartial`
+ * is the only escape hatch.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { resolveInstallClosure, kitRegistryName } from './access-sync.js';
+import { compareVersions, parseVersion } from './semver-range.js';
+export { ACCESS_INDEX_FILE } from './gitlab-publisher.js';
+export { downloadAccessIndex, findGenericPackageVersion, listGenericPackageVersions, listPackageFiles, resolveGenericProjectId, uploadAccessIndex, } from './gitlab-publisher.js';
+export const ACCESS_INDEX_SCHEMA = 1;
+/** Closure gaps that make an index partial. */
+export function closureGaps(closure) {
+    return [
+        ...closure.unresolved.map((g) => `unresolved: ${g}`),
+        ...closure.untraversed.map((g) => `untraversed: ${g}`),
+        ...closure.skippedKits.map((g) => `kit not read: ${g}`),
+    ];
+}
+export class PartialClosureError extends Error {
+    snapshotSpec;
+    gaps;
+    constructor(snapshotSpec, gaps) {
+        super(`access-index for ${snapshotSpec} would be partial (${gaps.length} gap(s)); refusing to publish it. ` +
+            'Fix the gaps or pass --allow-partial.\n  - ' + gaps.join('\n  - '));
+        this.snapshotSpec = snapshotSpec;
+        this.gaps = gaps;
+        this.name = 'PartialClosureError';
+    }
+}
+/** Map snapshot.json `access` to the schema-1 access/productId pair (fail-loud). */
+export function indexAccess(snapshot) {
+    const a = snapshot.access;
+    if (a === 'public')
+        return { access: 'public', productId: null };
+    if (a && typeof a === 'object' && a.type === 'licensed') {
+        if (!a.productId || typeof a.productId !== 'string') {
+            throw new Error(`${snapshot.name}@${snapshot.version}: access is licensed but productId is missing`);
+        }
+        return { access: 'licensed', productId: a.productId };
+    }
+    throw new Error(`${snapshot.name}@${snapshot.version}: access-index schema 1 needs snapshot.json "access" = "public" ` +
+        `or { "type": "licensed", "productId": "…" } (got ${JSON.stringify(a ?? null)})`);
+}
+function sortVersions(versions) {
+    return [...new Set(versions)].sort((a, b) => {
+        const pa = parseVersion(a);
+        const pb = parseVersion(b);
+        if (pa && pb)
+            return compareVersions(pa, pb);
+        return a < b ? -1 : a > b ? 1 : 0;
+    });
+}
+/**
+ * Pure builder: closure → schema-1 index. The snapshot's own generic package
+ * (e.g. `ist__beta@<version>`) is included so the proxy can serve the snapshot
+ * artifact itself under the same rule as its members.
+ */
+export function buildAccessIndex(snapshot, closure, generatedBy, closureSource = 'gitlab') {
+    const { access, productId } = indexAccess(snapshot);
+    const merged = new Map();
+    const add = (kind, name, versions) => {
+        const key = `${kind}:${name}`;
+        const e = merged.get(key) ?? { name, kind, versions: [] };
+        e.versions.push(...versions);
+        merged.set(key, e);
+    };
+    for (const r of closure.resolved) {
+        add(r.kind, r.kind === 'generic' ? kitRegistryName(r.name) : r.name, r.versions);
+    }
+    add('generic', kitRegistryName(snapshot.name), [snapshot.version]);
+    const packages = [...merged.values()]
+        .filter((p) => p.versions.length > 0)
+        .map((p) => ({ name: p.name, versions: sortVersions(p.versions), kind: p.kind }))
+        .sort((a, b) => (a.kind === b.kind ? (a.name < b.name ? -1 : a.name > b.name ? 1 : 0) : a.kind < b.kind ? 1 : -1));
+    return {
+        schema: ACCESS_INDEX_SCHEMA,
+        snapshot: snapshot.name,
+        version: snapshot.version,
+        access,
+        productId,
+        generatedBy,
+        closureSource,
+        packages,
+    };
+}
+/** Stable serialization (2-space JSON + trailing newline). */
+export function serializeAccessIndex(index) {
+    return JSON.stringify(index, null, 2) + '\n';
+}
+let cachedGeneratedBy;
+/** "@microwiseai/snapshot@<ver> <git sha>" of the running CLI. */
+export function generatedByString() {
+    if (cachedGeneratedBy)
+        return cachedGeneratedBy;
+    const here = dirname(fileURLToPath(import.meta.url));
+    const require = createRequire(import.meta.url);
+    let name = '@microwiseai/snapshot';
+    let version = '0.0.0';
+    let pkgRoot = join(here, '..', '..');
+    try {
+        const pkgPath = require.resolve('../../package.json');
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        name = pkg.name ?? name;
+        version = pkg.version ?? version;
+        pkgRoot = dirname(pkgPath);
+    }
+    catch {
+        // keep defaults
+    }
+    let sha = process.env.SNAPSHOT_BUILD_SHA || '';
+    if (!sha) {
+        // dist/build-info.json is written at build time (scripts/write-build-info.mjs).
+        const info = join(pkgRoot, 'dist', 'build-info.json');
+        if (existsSync(info)) {
+            try {
+                sha = JSON.parse(readFileSync(info, 'utf-8')).gitSha ?? '';
+            }
+            catch {
+                // fall through
+            }
+        }
+    }
+    if (!sha) {
+        try {
+            sha = execFileSync('git', ['rev-parse', '--short=12', 'HEAD'], {
+                cwd: pkgRoot,
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).toString().trim();
+        }
+        catch {
+            sha = 'unknown';
+        }
+    }
+    cachedGeneratedBy = `${name}@${version} ${sha}`;
+    return cachedGeneratedBy;
+}
+/**
+ * Walk the closure and build the index. Throws PartialClosureError on gaps
+ * unless `allowPartial` (gaps are then returned for the caller to warn about).
+ */
+export async function generateAccessIndex(snapshot, options = {}) {
+    indexAccess(snapshot); // fail fast before any network walk
+    // Publisher-side read from GitLab by default (decision 2026-09-28 (A)).
+    const source = options.source ?? 'gitlab';
+    const closure = await resolveInstallClosure(snapshot, { transitive: true, verbose: options.verbose, source });
+    const gaps = closureGaps(closure);
+    if (gaps.length > 0 && !options.allowPartial) {
+        throw new PartialClosureError(`${snapshot.name}@${snapshot.version}`, gaps);
+    }
+    const index = buildAccessIndex(snapshot, closure, options.generatedBy ?? generatedByString(), source);
+    return { index, closure, gaps };
+}
+//# sourceMappingURL=access-index.js.map

package/dist/lib/access-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-index.js","sourceRoot":"","sources":["../../src/lib/access-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAA2C,MAAM,kBAAkB,CAAC;AACnH,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,uBAAuB,CAAC;AAC/B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAoBrC,+CAA+C;AAC/C,MAAM,UAAU,WAAW,CAAC,OAAuB;IACjD,OAAO;QACL,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;QACpD,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtD,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IACA;IAFX,YACW,YAAoB,EACpB,IAAc;QAEvB,KAAK,CACH,oBAAoB,YAAY,sBAAsB,IAAI,CAAC,MAAM,oCAAoC;YACnG,6CAA6C,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CACtE,CAAC;QANO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,SAAI,GAAJ,IAAI,CAAU;QAMvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,QAAkB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,+CAA+C,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,kEAAkE;QACpG,oDAAoD,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CACnF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAA0B;IAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAkB,EAClB,OAAuB,EACvB,WAAmB,EACnB,gBAA+B,QAAQ;IAEvC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,IAAuB,EAAE,IAAY,EAAE,QAAkB,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1D,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnF,CAAC;IACD,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAChF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErH,OAAO;QACL,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM;QACN,SAAS;QACT,WAAW;QACX,aAAa;QACb,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,KAAkB;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC/C,CAAC;AAED,IAAI,iBAAqC,CAAC;AAE1C,kEAAkE;AAClE,MAAM,UAAU,iBAAiB;IAC/B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,GAAG,uBAAuB,CAAC;IACnC,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAwC,CAAC;QAC9F,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;QACxB,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;QACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,gFAAgF;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAyB,CAAC,MAAM,IAAI,EAAE,CAAC;YACtF,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE;gBAC7D,GAAG,EAAE,OAAO;gBACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;IACH,CAAC;IACD,iBAAiB,GAAG,GAAG,IAAI,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;IAChD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAkB,EAClB,UAAuG,EAAE;IAEzG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,oCAAoC;IAC3D,wEAAwE;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;IACtG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/access-sync.d.ts

@@ -1,26 +1,75 @@
 /**
- * Access Sync - Synchronize snapshot package access with license-api
+ * Install-set closure resolver (formerly "access sync").
  *
- * When a snapshot is published, this module registers all packages
- * in the snapshot's install list with the appropriate access level.
+ * Walks a snapshot's install-set dependency closure through the registry-proxy.
+ * The result feeds access-index.json (see ./access-index.ts), the serving SSOT
+ * that registry-proxy reads to grant snapshot members.
+ *
+ * The former license-api write path (POST /admin/package-access/with-deps,
+ * LICENSE_API_ADMIN_KEY) was retired by the 2026-09-28 owner decision
+ * (global state `snapshot-tier-access`, `owner-decision-2026-09-28-proxy-snapshot-driven`):
+ * "license-api package_access 에 snapshot 의존 패키지를 등록하지 않음(access-sync 의
+ * license-api 쓰기 경로 폐기)". Nothing in this module writes anywhere.
  */
 import type { Snapshot } from './types.js';
-interface SyncResult {
-    success: boolean;
-    registered: string[];
-    failed: string[];
-    skipped: string[];
+/**
+ * Where the closure walk reads packuments / kit tarballs from.
+ *  - 'proxy'  (default): registry-proxy with the user's session/license token.
+ *  - 'gitlab': GitLab directly with the publisher's glpkg token. Used by
+ *    publish/backfill only (snapshot-mgr decision 2026-09-28 (A)): the proxy
+ *    grants from access-index.json, so reading the closure through it is
+ *    circular. GitLab 3xx/404 on a packument = npmjs origin (excluded).
+ */
+export type ClosureSource = 'proxy' | 'gitlab';
+/** Result of the install-set closure walk. @internal Exported for testing */
+export interface InstallClosure {
+    /** Package names to register (discovery order, deduped). */
+    packages: string[];
+    /** Transitive deps judged public npmjs — not registered, not descended. */
+    npmjsExcluded: string[];
+    /** Kits whose skit.json could not be read. */
+    skippedKits: string[];
+    /** Our packages whose deps could not be read (name@version (reason)). */
+    untraversed: string[];
+    /** Transitive deps that could not be classified (not registered). */
+    unresolved: string[];
+    /**
+     * Exact versions the walk resolved, per package (npmjs-origin excluded).
+     * Kits are `kind: 'generic'` and keep their `@scope/name` here; the index
+     * builder converts them to the proxy generic path form (ist__qa-kit).
+     */
+    resolved: ResolvedPackage[];
+}
+/** One package of the closure with every exact version the walk resolved. */
+export interface ResolvedPackage {
+    name: string;
+    kind: 'npm' | 'generic';
+    versions: string[];
 }
 /**
- * Sync snapshot packages with license-api
- *
- * @param snapshot - Parsed snapshot.json
- * @param options - Sync options
+ * Resolve a spec against a version list: dist-tag → exact → highest version
+ * satisfying the range (prerelease allowed only for prerelease pins).
+ * @internal Exported for testing
+ */
+export declare function resolveSpecVersion(versions: string[], distTags: Record<string, string>, spec: string): string | null;
+/**
+ * Pick the npm deps (name → spec) a kit's skit.json declares under
+ * `dependencies.npm`. Entries marked `source: "npm"` come from public npmjs
+ * and are excluded. Object entries use their `version` field.
+ * @internal Exported for testing
+ */
+export declare function kitNpmDeps(skitJson: unknown): Array<[string, string]>;
+/** @internal Exported for testing */
+export declare function kitNpmDepNames(skitJson: unknown): string[];
+/** `@ist/qa-kit` → `ist__qa-kit` (registry-proxy generic path form). */
+export declare function kitRegistryName(kit: string): string;
+/**
+ * Walk the install-set dependency closure once.
+ * @internal Exported for testing
  */
-export declare function syncPackageAccess(snapshot: Snapshot, options?: {
+export declare function resolveInstallClosure(snapshot: Snapshot, options?: {
+    transitive?: boolean;
     verbose?: boolean;
-    dryRun?: boolean;
-    includeTransitive?: boolean;
-}): Promise<SyncResult>;
-export {};
+    source?: ClosureSource;
+}): Promise<InstallClosure>;
 //# sourceMappingURL=access-sync.d.ts.map

package/dist/lib/access-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-sync.d.ts","sourceRoot":"","sources":["../../src/lib/access-sync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,YAAY,CAAC;AA8B3D,UAAU,UAAU;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAyJD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACxB,GACL,OAAO,CAAC,UAAU,CAAC,CA8GrB"}
+{"version":3,"file":"access-sync.d.ts","sourceRoot":"","sources":["../../src/lib/access-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS3C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAsD/C,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAgCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAIf;AAyDD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAerE;AAED,qCAAqC;AACrC,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAE1D;AA4RD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAO,GAChF,OAAO,CAAC,cAAc,CAAC,CAQzB"}