@microwiseai/snapshot 0.8.0 → 0.9.1

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/config.js

@@ -0,0 +1,62 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { asDowngradeMode } from './policy.js';
+const DEFAULT_FS = { existsSync, readFileSync, writeFileSync, mkdirSync };
+/** Default config directory (~/.config/ist-snapshot). */
+export function getConfigDir(opts = {}) {
+    return opts.configDir ?? join(homedir(), '.config', 'ist-snapshot');
+}
+/** Absolute path to config.json. */
+export function getConfigPath(opts = {}) {
+    return join(getConfigDir(opts), 'config.json');
+}
+/**
+ * Read the machine config. Returns {} when the file is absent or unparseable
+ * (tolerant — a broken/foreign file must not crash an install decision).
+ */
+export function readMachineConfig(opts = {}) {
+    const fs = opts.fs ?? DEFAULT_FS;
+    const path = getConfigPath(opts);
+    try {
+        if (!fs.existsSync(path))
+            return {};
+        const parsed = JSON.parse(fs.readFileSync(path, 'utf-8'));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Write the machine config (pretty JSON), creating the config dir if needed.
+ */
+export function writeMachineConfig(config, opts = {}) {
+    const fs = opts.fs ?? DEFAULT_FS;
+    const dir = getConfigDir(opts);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(getConfigPath(opts), JSON.stringify(config, null, 2) + '\n');
+}
+/**
+ * Read `install.onDowngrade` from machine config, validated.
+ * Returns null when unset or invalid.
+ */
+export function getMachineDowngradeMode(opts = {}) {
+    return asDowngradeMode(readMachineConfig(opts).install?.onDowngrade);
+}
+/**
+ * Set `install.onDowngrade` in machine config (read-modify-write), preserving
+ * every other key. Returns the written config.
+ */
+export function setMachineDowngradeMode(mode, opts = {}) {
+    const current = readMachineConfig(opts);
+    const next = {
+        ...current,
+        install: { ...(current.install ?? {}), onDowngrade: mode },
+    };
+    writeMachineConfig(next, opts);
+    return next;
+}
+//# sourceMappingURL=config.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA+B9C,MAAM,UAAU,GAAa,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AAEpF,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,OAAwB,EAAE;IACrD,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACtE,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,aAAa,CAAC,OAAwB,EAAE;IACtD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE;IAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC;IACjC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB,EAAE,OAAwB,EAAE;IAClF,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAwB,EAAE;IAChE,OAAO,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAmB,EACnB,OAAwB,EAAE;IAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAkB;QAC1B,GAAG,OAAO;QACV,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;KAC3D,CAAC;IACF,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/detect.d.ts

@@ -0,0 +1,30 @@
+import type { DetectResult } from './types.js';
+/**
+ * Reads the currently-installed (global) version of a package, or null/undefined
+ * when it is not installed. MUST be injected — this package never shells out to
+ * npm, keeping it pure and side-effect-free. Core supplies a real implementation
+ * (e.g. `npm ls -g`); tests inject a stub.
+ */
+export type ReadVersionFn = (pkg: string) => string | null | undefined;
+export interface DetectOptions {
+    /** Injected version reader. Required — no default npm execution. */
+    readVersion: ReadVersionFn;
+}
+/**
+ * Detect which pinned packages would be DOWNGRADED relative to what is already
+ * installed globally.
+ *
+ * For each `pkg -> pinned` entry:
+ *   - not installed (readVersion returns null/undefined/empty) → OK (skip)
+ *   - installed === pinned                                     → OK (skip)
+ *   - installed  <  pinned (an upgrade)                        → OK (skip)
+ *   - installed  >  pinned (a downgrade, strict)              → OFFENDER
+ *   - either side not an exact semver (incomparable)           → OK (skip, tolerant)
+ *
+ * A clean Docker sandbox has nothing installed globally, so every entry skips
+ * and `wouldDowngrade` is false — the guard auto-passes with no config.
+ *
+ * Pure: no I/O, no mutation of `installMap`.
+ */
+export declare function detectDowngrades(installMap: Record<string, string>, opts?: DetectOptions): DetectResult;
+//# sourceMappingURL=detect.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,WAAW,EAAE,aAAa,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,IAAI,CAAC,EAAE,aAAa,GACnB,YAAY,CAwBd"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/detect.js

@@ -0,0 +1,39 @@
+import { compareExact } from './semver.js';
+/**
+ * Detect which pinned packages would be DOWNGRADED relative to what is already
+ * installed globally.
+ *
+ * For each `pkg -> pinned` entry:
+ *   - not installed (readVersion returns null/undefined/empty) → OK (skip)
+ *   - installed === pinned                                     → OK (skip)
+ *   - installed  <  pinned (an upgrade)                        → OK (skip)
+ *   - installed  >  pinned (a downgrade, strict)              → OFFENDER
+ *   - either side not an exact semver (incomparable)           → OK (skip, tolerant)
+ *
+ * A clean Docker sandbox has nothing installed globally, so every entry skips
+ * and `wouldDowngrade` is false — the guard auto-passes with no config.
+ *
+ * Pure: no I/O, no mutation of `installMap`.
+ */
+export function detectDowngrades(installMap, opts) {
+    const readVersion = opts?.readVersion;
+    if (typeof readVersion !== 'function') {
+        throw new Error('detectDowngrades: opts.readVersion injection is required (this package never runs npm itself).');
+    }
+    const offenders = [];
+    for (const [pkg, pinned] of Object.entries(installMap ?? {})) {
+        const installed = readVersion(pkg);
+        if (installed === null || installed === undefined || installed === '') {
+            continue; // not installed → no downgrade
+        }
+        const cmp = compareExact(installed, pinned);
+        if (cmp === null) {
+            continue; // incomparable (non-exact semver) → tolerant skip
+        }
+        if (cmp > 0) {
+            offenders.push({ pkg, installed, pinned });
+        }
+    }
+    return { wouldDowngrade: offenders.length > 0, offenders };
+}
+//# sourceMappingURL=detect.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB3C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkC,EAClC,IAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtE,SAAS,CAAC,+BAA+B;QAC3C,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,SAAS,CAAC,kDAAkD;QAC9D,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;AAC7D,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @microwiseai/snapshot-downgrade-guard
+ *
+ * Auto-detects when a snapshot install would DOWNGRADE already-installed global
+ * tooling, and resolves the layered refuse/warn/allow policy. Pure and
+ * dependency-injected: it never runs npm, touches the network, or mutates state
+ * except through the explicit machine-config writers. A clean Docker sandbox
+ * (nothing installed globally) produces zero offenders and auto-passes.
+ *
+ * Usage (in core, at the npm-exec boundary):
+ *   import {
+ *     detectDowngrades, resolveDowngradePolicy, readOneShotOverride,
+ *     readMachineConfig, formatDowngradeReport,
+ *   } from '@microwiseai/snapshot-downgrade-guard';
+ *
+ *   const { wouldDowngrade, offenders } = detectDowngrades(installMap, { readVersion });
+ *   const mode = resolveDowngradePolicy({
+ *     override: readOneShotOverride({ env: process.env, allowDowngradeFlag }),
+ *     machine:  readMachineConfig().install?.onDowngrade,
+ *     snapshot: snapshot.policy?.onDowngrade,
+ *   });
+ *   if (wouldDowngrade && mode === 'refuse') throw new Error(formatDowngradeReport(offenders, mode));
+ */
+export { detectDowngrades } from './detect.js';
+export type { DetectOptions, ReadVersionFn } from './detect.js';
+export { resolveDowngradePolicy, readOneShotOverride, asDowngradeMode, DEFAULT_DOWNGRADE_MODE, } from './policy.js';
+export type { PolicySources, OneShotOverrideInput } from './policy.js';
+export { getConfigDir, getConfigPath, readMachineConfig, writeMachineConfig, getMachineDowngradeMode, setMachineDowngradeMode, } from './config.js';
+export type { MachineConfig, ConfigFs, ConfigIoOptions } from './config.js';
+export { formatDowngradeReport } from './report.js';
+export { extractGlobalInstallSpecs } from './command-specs.js';
+export { isExactSemver, compareExact } from './semver.js';
+export type { DowngradeMode, Offender, DetectResult } from './types.js';
+export { DOWNGRADE_MODES } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/index.js

@@ -0,0 +1,31 @@
+/**
+ * @microwiseai/snapshot-downgrade-guard
+ *
+ * Auto-detects when a snapshot install would DOWNGRADE already-installed global
+ * tooling, and resolves the layered refuse/warn/allow policy. Pure and
+ * dependency-injected: it never runs npm, touches the network, or mutates state
+ * except through the explicit machine-config writers. A clean Docker sandbox
+ * (nothing installed globally) produces zero offenders and auto-passes.
+ *
+ * Usage (in core, at the npm-exec boundary):
+ *   import {
+ *     detectDowngrades, resolveDowngradePolicy, readOneShotOverride,
+ *     readMachineConfig, formatDowngradeReport,
+ *   } from '@microwiseai/snapshot-downgrade-guard';
+ *
+ *   const { wouldDowngrade, offenders } = detectDowngrades(installMap, { readVersion });
+ *   const mode = resolveDowngradePolicy({
+ *     override: readOneShotOverride({ env: process.env, allowDowngradeFlag }),
+ *     machine:  readMachineConfig().install?.onDowngrade,
+ *     snapshot: snapshot.policy?.onDowngrade,
+ *   });
+ *   if (wouldDowngrade && mode === 'refuse') throw new Error(formatDowngradeReport(offenders, mode));
+ */
+export { detectDowngrades } from './detect.js';
+export { resolveDowngradePolicy, readOneShotOverride, asDowngradeMode, DEFAULT_DOWNGRADE_MODE, } from './policy.js';
+export { getConfigDir, getConfigPath, readMachineConfig, writeMachineConfig, getMachineDowngradeMode, setMachineDowngradeMode, } from './config.js';
+export { formatDowngradeReport } from './report.js';
+export { extractGlobalInstallSpecs } from './command-specs.js';
+export { isExactSemver, compareExact } from './semver.js';
+export { DOWNGRADE_MODES } from './types.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.d.ts

@@ -0,0 +1,42 @@
+import { type DowngradeMode } from './types.js';
+/**
+ * Policy values read from each layer. Any field may be absent (undefined/null)
+ * or invalid; invalid values are ignored (treated as absent) so a typo never
+ * silently weakens the guard.
+ *
+ * Precedence (highest wins):
+ *   (a) override  — CLI flag / one-shot env (already mapped to a mode)
+ *   (b) machine   — machine config (~/.config/ist-snapshot/config.json)
+ *   (c) snapshot  — snapshot.json `policy.onDowngrade`
+ *   (d) default   — 'refuse'
+ */
+export interface PolicySources {
+    override?: DowngradeMode | string | null;
+    machine?: DowngradeMode | string | null;
+    snapshot?: DowngradeMode | string | null;
+}
+/** The default when no layer specifies a valid mode. */
+export declare const DEFAULT_DOWNGRADE_MODE: DowngradeMode;
+/** Narrow an arbitrary value to a valid DowngradeMode, or null if invalid. */
+export declare function asDowngradeMode(v: unknown): DowngradeMode | null;
+/**
+ * Resolve the effective downgrade policy from the layered sources.
+ * Pure: first valid value in precedence order (a > b > c), else the default.
+ */
+export declare function resolveDowngradePolicy(sources?: PolicySources): DowngradeMode;
+export interface OneShotOverrideInput {
+    /** Environment map (e.g. process.env). SNAPSHOT_ALLOW_LOCAL=1 → allow. */
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
+    /** CLI flag, e.g. --allow-downgrade → allow. */
+    allowDowngradeFlag?: boolean;
+}
+/**
+ * Map the one-shot escape hatches (CLI `--allow-downgrade` or env
+ * `SNAPSHOT_ALLOW_LOCAL=1`) to an override mode.
+ *
+ * Returns 'allow' when either hatch is engaged, otherwise null (no override).
+ * Pure — reads only the injected inputs. Core passes the result as
+ * `PolicySources.override`.
+ */
+export declare function readOneShotOverride(input?: OneShotOverrideInput): DowngradeMode | null;
+//# sourceMappingURL=policy.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,EAAE,aAAwB,CAAC;AAE9D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAIhE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,aAAkB,GAAG,aAAa,CAOjF;AAED,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,gDAAgD;IAChD,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,oBAAyB,GAAG,aAAa,GAAG,IAAI,CAK1F"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.js

@@ -0,0 +1,36 @@
+import { DOWNGRADE_MODES } from './types.js';
+/** The default when no layer specifies a valid mode. */
+export const DEFAULT_DOWNGRADE_MODE = 'refuse';
+/** Narrow an arbitrary value to a valid DowngradeMode, or null if invalid. */
+export function asDowngradeMode(v) {
+    return typeof v === 'string' && DOWNGRADE_MODES.includes(v)
+        ? v
+        : null;
+}
+/**
+ * Resolve the effective downgrade policy from the layered sources.
+ * Pure: first valid value in precedence order (a > b > c), else the default.
+ */
+export function resolveDowngradePolicy(sources = {}) {
+    return (asDowngradeMode(sources.override) ??
+        asDowngradeMode(sources.machine) ??
+        asDowngradeMode(sources.snapshot) ??
+        DEFAULT_DOWNGRADE_MODE);
+}
+/**
+ * Map the one-shot escape hatches (CLI `--allow-downgrade` or env
+ * `SNAPSHOT_ALLOW_LOCAL=1`) to an override mode.
+ *
+ * Returns 'allow' when either hatch is engaged, otherwise null (no override).
+ * Pure — reads only the injected inputs. Core passes the result as
+ * `PolicySources.override`.
+ */
+export function readOneShotOverride(input = {}) {
+    const env = input.env ?? {};
+    if (input.allowDowngradeFlag === true)
+        return 'allow';
+    if (env.SNAPSHOT_ALLOW_LOCAL === '1')
+        return 'allow';
+    return null;
+}
+//# sourceMappingURL=policy.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAsB,MAAM,YAAY,CAAC;AAmBjE,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAkB,QAAQ,CAAC;AAE9D,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,CAAC,CAAE,CAAmB;QACtB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAyB,EAAE;IAChE,OAAO,CACL,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,sBAAsB,CACvB,CAAC;AACJ,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA8B,EAAE;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACtD,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/report.d.ts

@@ -0,0 +1,11 @@
+import type { DowngradeMode, Offender } from './types.js';
+/**
+ * Build a user-facing message describing the detected downgrades for the given
+ * policy mode. Korean + short English.
+ *
+ *   - refuse: block message with the offender list and the three bypass routes.
+ *   - warn:   warning header + offender list, install continues.
+ *   - allow:  minimal note (usually not shown by callers).
+ */
+export declare function formatDowngradeReport(offenders: Offender[], mode: DowngradeMode): string;
+//# sourceMappingURL=report.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAM1D;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAqCxF"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/report.js

@@ -0,0 +1,46 @@
+function offenderLines(offenders) {
+    return offenders.map((o) => `  • ${o.pkg}: ${o.installed} → ${o.pinned}`).join('\n');
+}
+/**
+ * Build a user-facing message describing the detected downgrades for the given
+ * policy mode. Korean + short English.
+ *
+ *   - refuse: block message with the offender list and the three bypass routes.
+ *   - warn:   warning header + offender list, install continues.
+ *   - allow:  minimal note (usually not shown by callers).
+ */
+export function formatDowngradeReport(offenders, mode) {
+    if (offenders.length === 0) {
+        return '다운그레이드 없음 / No downgrades detected.';
+    }
+    const list = offenderLines(offenders);
+    if (mode === 'refuse') {
+        return [
+            '스냅샷 설치가 현재 전역 패키지를 다운그레이드하므로 거부되었습니다.',
+            'Refused: this snapshot would downgrade already-installed global packages.',
+            '',
+            '다운그레이드 대상 / Would downgrade:',
+            list,
+            '',
+            '해결 / How to proceed:',
+            '  1) 깨끗한 Docker 샌드박스에서 실행 (권장) / run in a clean Docker sandbox (recommended)',
+            '  2) 이번 한 번만 강제 / force just this once:  --allow-downgrade  또는/or  SNAPSHOT_ALLOW_LOCAL=1',
+            '  3) 이 머신에서 항상 허용 / always allow on this machine:  snapshot config set install.onDowngrade allow',
+        ].join('\n');
+    }
+    if (mode === 'warn') {
+        return [
+            '⚠ 경고: 스냅샷 설치가 아래 전역 패키지를 다운그레이드합니다 (계속 진행).',
+            '⚠ Warning: this snapshot will downgrade the following global packages (continuing).',
+            '',
+            list,
+        ].join('\n');
+    }
+    // allow
+    return [
+        '스냅샷 설치가 아래 패키지를 다운그레이드합니다 (allow 정책으로 진행).',
+        'Proceeding despite downgrades (policy=allow):',
+        list,
+    ].join('\n');
+}
+//# sourceMappingURL=report.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAEA,SAAS,aAAa,CAAC,SAAqB;IAC1C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAqB,EAAE,IAAmB;IAC9E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAEtC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,uCAAuC;YACvC,2EAA2E;YAC3E,EAAE;YACF,8BAA8B;YAC9B,IAAI;YACJ,EAAE;YACF,sBAAsB;YACtB,8EAA8E;YAC9E,2FAA2F;YAC3F,kGAAkG;SACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO;YACL,6CAA6C;YAC7C,qFAAqF;YACrF,EAAE;YACF,IAAI;SACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,QAAQ;IACR,OAAO;QACL,4CAA4C;QAC5C,+CAA+C;QAC/C,IAAI;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/semver.d.ts

@@ -0,0 +1,11 @@
+/** True iff `v` is a single, exact semver (prerelease/build metadata allowed). */
+export declare function isExactSemver(v: unknown): boolean;
+/**
+ * Compare two exact semvers by SemVer-spec precedence (build metadata ignored).
+ *
+ * Returns -1 if a < b, 0 if equal precedence, 1 if a > b, or `null` when EITHER
+ * side is not an exact semver (incomparable — caller should skip). Never throws:
+ * tolerance is a design requirement.
+ */
+export declare function compareExact(a: unknown, b: unknown): -1 | 0 | 1 | null;
+//# sourceMappingURL=semver.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../src/semver.ts"],"names":[],"mappings":"AAiBA,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAEjD;AAuBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAgCtE"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/semver.js

@@ -0,0 +1,81 @@
+/**
+ * Minimal, self-contained exact-semver comparison.
+ *
+ * This package stays zero-runtime-dependency (no `semver`) on purpose so it is
+ * self-sufficient and side-effect-free. We only compare EXACT semvers; anything
+ * that is not a single exact version is reported as "incomparable" and the
+ * caller skips it (tolerant, same philosophy as the core-floor check).
+ *
+ * The pattern is the canonical semver.org regex, anchored — it accepts:
+ *   0.3.59            (plain)
+ *   0.3.70-dev.0      (prerelease)
+ *   1.2.3-rc.1+build  (prerelease + build metadata)
+ * and rejects ranges, `^`/`~`, `v` prefixes, dist-tags, partial versions, etc.
+ */
+const EXACT_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
+/** True iff `v` is a single, exact semver (prerelease/build metadata allowed). */
+export function isExactSemver(v) {
+    return typeof v === 'string' && EXACT_SEMVER.test(v.trim());
+}
+function parseSemver(v) {
+    if (typeof v !== 'string')
+        return null;
+    const m = EXACT_SEMVER.exec(v.trim());
+    if (!m)
+        return null;
+    const prerelease = [];
+    if (m[4]) {
+        for (const id of m[4].split('.')) {
+            prerelease.push(/^\d+$/.test(id) ? Number(id) : id);
+        }
+    }
+    return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]), prerelease };
+}
+/**
+ * Compare two exact semvers by SemVer-spec precedence (build metadata ignored).
+ *
+ * Returns -1 if a < b, 0 if equal precedence, 1 if a > b, or `null` when EITHER
+ * side is not an exact semver (incomparable — caller should skip). Never throws:
+ * tolerance is a design requirement.
+ */
+export function compareExact(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (!pa || !pb)
+        return null;
+    for (const k of ['major', 'minor', 'patch']) {
+        if (pa[k] !== pb[k])
+            return pa[k] < pb[k] ? -1 : 1;
+    }
+    // A version WITHOUT prerelease outranks one WITH (1.0.0 > 1.0.0-rc.1).
+    const aPre = pa.prerelease;
+    const bPre = pb.prerelease;
+    if (aPre.length === 0 && bPre.length === 0)
+        return 0;
+    if (aPre.length === 0)
+        return 1;
+    if (bPre.length === 0)
+        return -1;
+    const len = Math.min(aPre.length, bPre.length);
+    for (let i = 0; i < len; i++) {
+        const x = aPre[i];
+        const y = bPre[i];
+        if (x === y)
+            continue;
+        const xNum = typeof x === 'number';
+        const yNum = typeof y === 'number';
+        // Numeric identifiers always have lower precedence than non-numeric.
+        if (xNum && !yNum)
+            return -1;
+        if (!xNum && yNum)
+            return 1;
+        if (xNum && yNum)
+            return x < y ? -1 : 1;
+        return x < y ? -1 : 1;
+    }
+    // All shared identifiers equal — the longer prerelease list has higher precedence.
+    if (aPre.length === bPre.length)
+        return 0;
+    return aPre.length < bPre.length ? -1 : 1;
+}
+//# sourceMappingURL=semver.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../src/semver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,YAAY,GAChB,qLAAqL,CAAC;AAExL,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAUD,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,CAAU;IACjD,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE5B,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACrD,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,uEAAuE;IACvE,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC;QACnC,qEAAqE;QACrE,IAAI,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI;YAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,IAAI;YAAE,OAAQ,CAAY,GAAI,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,OAAQ,CAAY,GAAI,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,mFAAmF;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/types.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared types for @microwiseai/snapshot-downgrade-guard.
+ */
+/**
+ * Downgrade policy mode.
+ *   - refuse (default): block the install when a downgrade is detected.
+ *   - warn:   print a warning, then proceed.
+ *   - allow:  proceed silently.
+ */
+export type DowngradeMode = 'refuse' | 'warn' | 'allow';
+/** The set of valid policy modes (runtime guard). */
+export declare const DOWNGRADE_MODES: readonly DowngradeMode[];
+/** A single package whose currently-installed version is newer than the pin. */
+export interface Offender {
+    /** Package name. */
+    pkg: string;
+    /** Currently-installed (global) version. */
+    installed: string;
+    /** Version the snapshot would pin/install (a downgrade relative to `installed`). */
+    pinned: string;
+}
+/** Result of {@link detectDowngrades}. */
+export interface DetectResult {
+    /** True iff at least one offender was found. */
+    wouldDowngrade: boolean;
+    /** Packages that would be downgraded (installed > pinned, strict). */
+    offenders: Offender[];
+}
+//# sourceMappingURL=types.d.ts.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAExD,qDAAqD;AACrD,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAAgC,CAAC;AAErF,gFAAgF;AAChF,MAAM,WAAW,QAAQ;IACvB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,cAAc,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,SAAS,EAAE,QAAQ,EAAE,CAAC;CACvB"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * Shared types for @microwiseai/snapshot-downgrade-guard.
+ */
+/** The set of valid policy modes (runtime guard). */
+export const DOWNGRADE_MODES = ['refuse', 'warn', 'allow'];
+//# sourceMappingURL=types.js.map

package/node_modules/@microwiseai/snapshot-downgrade-guard/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC"}

package/node_modules/@microwiseai/snapshot-downgrade-guard/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@microwiseai/snapshot-downgrade-guard",
+  "version": "0.1.0",
+  "description": "Auto-detects when a snapshot install would downgrade already-installed global tooling, and resolves the layered refuse/warn/allow policy. Pure, dependency-injected, no side effects.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "lint": "eslint src",
+    "prepublishOnly": "npm run build"
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "snapshot",
+    "downgrade",
+    "guard",
+    "semver",
+    "install"
+  ],
+  "author": "IST Team",
+  "license": "MIT",
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^20.11.0",
+    "@typescript-eslint/eslint-plugin": "^8.57.0",
+    "@typescript-eslint/parser": "^8.57.0",
+    "eslint": "^10.0.3",
+    "typescript": "^5.7.3",
+    "vitest": "^4.0.18"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "glpkg": {
+    "group": "microwiseai"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/microwiseai/snapshot.downgrade-guard.git"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microwiseai/snapshot",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "CLI for installing IST Snapshot packages",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -25,6 +25,7 @@
   "scripts": {
     "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsc -p tsconfig.build.json",
+    "postbuild": "node scripts/write-build-info.mjs",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "test": "vitest",
@@ -32,7 +33,7 @@
     "lint": "eslint src",
     "prepublishOnly": "npm run build",
     "publish:npm": "set -a; . ./.env; set +a; npm publish --access public",
-    "publish:glpkg": "glpkg publish --git-tag false --push false",
+    "publish:glpkg": "glpkg publish",
     "publish:all": "npm run publish:npm && npm run publish:glpkg"
   },
   "files": [
@@ -53,6 +54,7 @@
     "@microwiseai/license": "^0.1.4",
     "@microwiseai/skit": "^0.1.19",
     "@microwiseai/snapshot-dedup": "0.2.0",
+    "@microwiseai/snapshot-downgrade-guard": "0.1.0",
     "@microwiseai/snapshot-parallel": "^0.1.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
@@ -75,6 +77,7 @@
     "@microwiseai/license",
     "@microwiseai/skit",
     "@microwiseai/snapshot-dedup",
+    "@microwiseai/snapshot-downgrade-guard",
     "@microwiseai/snapshot-parallel"
   ],
   "glpkg": {