@uapkg/cli 1.4.0 → 1.5.0

package/dist/types/uapkg-installer/index.d.ts

@@ -0,0 +1,16 @@
+import { InstallAction, InstallActionType, InstallPlan, InstallReport, InstallSummary, InstallerOptions, PackageInstallOutcome, PackageInstallStatus } from "./contracts/InstallerTypes.js";
+import { BuiltInSafetyPolicyId, SafetyContext, SafetyEvaluation, SafetyPolicy } from "./contracts/SafetyPolicyTypes.js";
+import { DownloadStatusSnapshot, InstallTotals, SlotSnapshot, SlotState } from "./contracts/StatusStreamTypes.js";
+import { ClaimsVerificationInput, ClaimsVerifier } from "./core/ClaimsVerifier.js";
+import { DiskStateEntry, DiskStateInspector } from "./core/DiskStateInspector.js";
+import { InstallPlanner } from "./core/InstallPlanner.js";
+import { SafetyPolicyRegistry, SafetyVerdict } from "./safety/SafetyPolicyRegistry.js";
+import { Installer, InstallerConstructorOptions } from "./core/Installer.js";
+import { IntegrityVerifier } from "./core/IntegrityVerifier.js";
+import { DownloadOptions, DownloadProgress, DownloadResult, PackageDownloader } from "./core/PackageDownloader.js";
+import { PackageExtractor } from "./core/PackageExtractor.js";
+import { PackageRemover } from "./core/PackageRemover.js";
+import { NoMarkerPolicy } from "./safety/NoMarkerPolicy.js";
+import { SlotTable } from "./status/SlotTable.js";
+import { StatusStream } from "./status/StatusStream.js";
+export { type BuiltInSafetyPolicyId, type ClaimsVerificationInput, ClaimsVerifier, type DiskStateEntry, DiskStateInspector, type DownloadOptions, type DownloadProgress, type DownloadResult, type DownloadStatusSnapshot, type InstallAction, type InstallActionType, type InstallPlan, InstallPlanner, type InstallReport, type InstallSummary, type InstallTotals, Installer, type InstallerConstructorOptions, type InstallerOptions, IntegrityVerifier, NoMarkerPolicy, PackageDownloader, PackageExtractor, type PackageInstallOutcome, type PackageInstallStatus, PackageRemover, type SafetyContext, type SafetyEvaluation, type SafetyPolicy, SafetyPolicyRegistry, type SafetyVerdict, type SlotSnapshot, type SlotState, SlotTable, StatusStream };

package/dist/types/uapkg-installer/safety/NoMarkerPolicy.d.ts

@@ -0,0 +1,17 @@
+import { SafetyContext, SafetyEvaluation, SafetyPolicy } from "../contracts/SafetyPolicyTypes.js";
+//#region src/safety/NoMarkerPolicy.d.ts
+/**
+ * Policy: "target directory exists but contains no `uapkg.json`".
+ *
+ * Fail-safe behavior: if the install path already exists on disk but lacks
+ * the marker manifest, we refuse to overwrite. `--force` downgrades to an
+ * info diagnostic and allows the action.
+ */
+declare class NoMarkerPolicy implements SafetyPolicy {
+  readonly id = "no-marker";
+  evaluate(context: SafetyContext): Promise<SafetyEvaluation>;
+  private dirExists;
+  private fileExists;
+}
+//#endregion
+export { NoMarkerPolicy };

package/dist/types/uapkg-installer/safety/SafetyPolicyRegistry.d.ts

@@ -0,0 +1,32 @@
+import { InstallAction } from "../contracts/InstallerTypes.js";
+import { SafetyPolicy } from "../contracts/SafetyPolicyTypes.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/safety/SafetyPolicyRegistry.d.ts
+/**
+ * Per-action safety evaluation result.
+ */
+interface SafetyVerdict {
+  readonly action: InstallAction;
+  readonly blocked: boolean;
+  readonly warnings: number;
+}
+/**
+ * Registry of installed safety policies. Pluggable — consumers can register
+ * custom policies (e.g. future git-dirty checks) via {@link register}.
+ *
+ * Evaluation is fail-fast per-action: the first policy that returns
+ * `block` stops further policy evaluation for that action.
+ */
+declare class SafetyPolicyRegistry {
+  private readonly policies;
+  register(policy: SafetyPolicy): this;
+  get ids(): readonly string[];
+  /**
+   * Evaluate all registered policies against every action in a plan. Returns
+   * a DiagnosticBag collecting all warnings/blocks, plus the per-action
+   * verdict.
+   */
+  evaluatePlan(manifestRoot: string, actions: readonly InstallAction[], force: boolean): Promise<Result<readonly SafetyVerdict[]>>;
+}
+//#endregion
+export { SafetyPolicyRegistry, SafetyVerdict };

package/dist/types/uapkg-installer/status/SlotTable.d.ts

@@ -0,0 +1,36 @@
+import { DownloadStatusSnapshot, InstallTotals, SlotSnapshot, SlotState } from "../contracts/StatusStreamTypes.js";
+//#region src/status/SlotTable.d.ts
+/**
+ * Stable, indexed slot table. One row per concurrent installer worker.
+ *
+ * The slot at a given index is reused across actions — this is what lets the
+ * CLI render a fixed-height region in Ink without row reflow.
+ */
+declare class SlotTable {
+  private readonly slots;
+  private totals;
+  constructor(slotCount: number);
+  /** Claim the first idle slot and populate its initial state. */
+  claim(patch: Omit<MutableSlot, 'slotId'>): number | null;
+  /** Update a specific slot. */
+  update(slotId: number, patch: Partial<Omit<MutableSlot, 'slotId'>>): void;
+  /** Reset a slot to idle after its work is done. */
+  release(slotId: number): void;
+  /** Set the aggregate totals. */
+  setTotals(totals: InstallTotals): void;
+  /** Add bytes to the global counter. */
+  addBytesDone(delta: number): void;
+  /** Take an immutable snapshot of the current state. */
+  snapshot(): DownloadStatusSnapshot;
+}
+interface MutableSlot {
+  slotId: number;
+  state: SlotState;
+  packageName?: SlotSnapshot['packageName'];
+  version?: SlotSnapshot['version'];
+  bytesDone: number;
+  bytesTotal?: number;
+  attempt: number;
+}
+//#endregion
+export { SlotTable };

package/dist/types/uapkg-installer/status/StatusStream.d.ts

@@ -0,0 +1,25 @@
+import { DownloadStatusSnapshot } from "../contracts/StatusStreamTypes.js";
+import { SlotTable } from "./SlotTable.js";
+//#region src/status/StatusStream.d.ts
+/**
+ * Minimal async-iterable broadcaster of status snapshots.
+ *
+ * The Installer owns the `SlotTable` and calls `publish()` after every
+ * state mutation. Consumers (e.g. Ink views) iterate via
+ * `for await (const snap of stream)`.
+ *
+ * This is intentionally a simple "latest-wins" queue — we do not buffer
+ * historical snapshots.
+ */
+declare class StatusStream implements AsyncIterable<DownloadStatusSnapshot> {
+  private readonly table;
+  private pending;
+  private readonly waiters;
+  private closed;
+  constructor(table: SlotTable);
+  publish(): void;
+  close(): void;
+  [Symbol.asyncIterator](): AsyncIterator<DownloadStatusSnapshot>;
+}
+//#endregion
+export { StatusStream };

package/dist/types/uapkg-log/contracts/LoggerTypes.d.ts

@@ -0,0 +1,22 @@
+//#region src/contracts/LoggerTypes.d.ts
+type LogLevel = 'error' | 'warn' | 'info' | 'debug';
+interface Logger {
+  info(message: string): void;
+  warn(message: string): void;
+  error(message: string): void;
+  debug(message: string): void;
+}
+interface LoggerOptions {
+  context?: string;
+  verbose?: boolean;
+  quiet?: boolean;
+}
+interface LoggerStateResolver {
+  isVerboseEnabled(): boolean;
+  isQuietEnabled(): boolean;
+}
+interface LogEngine {
+  log(level: LogLevel, message: string): void;
+}
+//#endregion
+export { LogEngine, LogLevel, Logger, LoggerOptions, LoggerStateResolver };

package/dist/types/uapkg-log/core/LogLevelPolicy.d.ts

@@ -0,0 +1,15 @@
+import { LogLevel, LoggerStateResolver } from "../contracts/LoggerTypes.js";
+//#region src/core/LogLevelPolicy.d.ts
+declare class LogLevelPolicy {
+  resolveLevel(options: {
+    verbose: boolean;
+    quiet: boolean;
+  }): LogLevel;
+  resolveEffectiveLevel(options: {
+    explicitVerbose?: boolean;
+    explicitQuiet?: boolean;
+    resolver?: LoggerStateResolver;
+  }): LogLevel;
+}
+//#endregion
+export { LogLevelPolicy };

package/dist/types/uapkg-log/core/LoggerFactory.d.ts

@@ -0,0 +1,11 @@
+import { LoggerOptions, LoggerStateResolver } from "../contracts/LoggerTypes.js";
+import { LogLevelPolicy } from "./LogLevelPolicy.js";
+import { LoggerInstance } from "./LoggerInstance.js";
+//#region src/core/LoggerFactory.d.ts
+declare class LoggerFactory {
+  private readonly policy;
+  constructor(policy?: LogLevelPolicy);
+  create(options?: LoggerOptions, resolver?: LoggerStateResolver): LoggerInstance;
+}
+//#endregion
+export { LoggerFactory };

package/dist/types/uapkg-log/core/LoggerInstance.d.ts

@@ -0,0 +1,17 @@
+import { LogEngine, LogLevel } from "../contracts/LoggerTypes.js";
+//#region src/core/LoggerInstance.d.ts
+declare class LoggerInstance {
+  private readonly engine;
+  private readonly level;
+  private readonly context?;
+  constructor(engine: LogEngine, level: LogLevel, context?: string | undefined);
+  info(message: string): void;
+  warn(message: string): void;
+  error(message: string): void;
+  debug(message: string): void;
+  private withContext;
+  private shouldLog;
+  private levelWeight;
+}
+//#endregion
+export { LoggerInstance };

package/dist/types/uapkg-log/core/WinstonLoggerAdapter.d.ts

@@ -0,0 +1,8 @@
+import { LogEngine, LogLevel } from "../contracts/LoggerTypes.js";
+//#region src/core/WinstonLoggerAdapter.d.ts
+declare class WinstonLoggerAdapter implements LogEngine {
+  private readonly logger;
+  log(level: LogLevel, message: string): void;
+}
+//#endregion
+export { WinstonLoggerAdapter };

package/dist/types/uapkg-log/index.d.ts

@@ -0,0 +1,8 @@
+import { Logger, LoggerOptions, LoggerStateResolver } from "./contracts/LoggerTypes.js";
+import { LoggerInstance } from "./core/LoggerInstance.js";
+//#region src/index.d.ts
+declare function configureLogger(resolver: LoggerStateResolver): void;
+declare function createLogger(options?: LoggerOptions): LoggerInstance;
+declare const Log: Logger;
+//#endregion
+export { type Logger, type LoggerOptions, type LoggerStateResolver, configureLogger, createLogger, Log as default };

package/dist/types/uapkg-pack/contracts/PackTypes.d.ts

@@ -0,0 +1,29 @@
+//#region src/contracts/PackTypes.d.ts
+interface PackOptions {
+  cwd?: string;
+  outFile?: string;
+  dryRun?: boolean;
+  allowMissingLfs?: boolean;
+}
+interface PackResult {
+  pluginRoot: string;
+  archivePath: string;
+  integrityPath?: string;
+  files: string[];
+  warnings: string[];
+  dryRun: boolean;
+}
+interface PackManifest {
+  name: string;
+  version: string;
+}
+interface CollectedFile {
+  absolutePath: string;
+  relativePath: string;
+}
+interface IgnoreRuleSet {
+  gitRoot: string;
+  ruleFiles: string[];
+}
+//#endregion
+export { CollectedFile, IgnoreRuleSet, PackManifest, PackOptions, PackResult };

package/dist/types/uapkg-pack/core/FileCrawler.d.ts

@@ -0,0 +1,12 @@
+import { CollectedFile } from "../contracts/PackTypes.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/core/FileCrawler.d.ts
+declare class FileCrawler {
+  collect(pluginRoot: string): Result<CollectedFile[]>;
+  private walk;
+  private walkResolved;
+  private normalizeRelative;
+  private isPathInRoot;
+}
+//#endregion
+export { FileCrawler };

package/dist/types/uapkg-pack/core/IgnoreEvaluator.d.ts

@@ -0,0 +1,7 @@
+import { IgnoreRule } from "./IgnoreRuleLoader.js";
+//#region src/core/IgnoreEvaluator.d.ts
+declare class IgnoreEvaluator {
+  shouldIgnore(relativePath: string, absolutePath: string, rules: IgnoreRule[]): boolean;
+}
+//#endregion
+export { IgnoreEvaluator };

package/dist/types/uapkg-pack/core/IgnoreRuleLoader.d.ts

@@ -0,0 +1,14 @@
+//#region src/core/IgnoreRuleLoader.d.ts
+interface IgnoreRule {
+  filePath: string;
+  ruleDirectory: string;
+  pattern: string;
+}
+declare class IgnoreRuleLoader {
+  load(gitRoot: string, pluginRoot: string): IgnoreRule[];
+  private collectDirectories;
+  private collectSubdirectories;
+  private readRuleFile;
+}
+//#endregion
+export { IgnoreRule, IgnoreRuleLoader };

package/dist/types/uapkg-pack/core/IntegrityWriter.d.ts

@@ -0,0 +1,6 @@
+//#region src/core/IntegrityWriter.d.ts
+declare class IntegrityWriter {
+  write(archivePath: string): string;
+}
+//#endregion
+export { IntegrityWriter };

package/dist/types/uapkg-pack/core/LFSPointerDetector.d.ts

@@ -0,0 +1,6 @@
+//#region src/core/LFSPointerDetector.d.ts
+declare class LFSPointerDetector {
+  isPointerFile(filePath: string): boolean;
+}
+//#endregion
+export { LFSPointerDetector };

package/dist/types/uapkg-pack/core/PackArtifactExcluder.d.ts

@@ -0,0 +1,11 @@
+import { CollectedFile } from "../contracts/PackTypes.js";
+//#region src/core/PackArtifactExcluder.d.ts
+/**
+ * Computes generated artifact paths that should never be re-packed.
+ */
+declare class PackArtifactExcluder {
+  collect(pluginRoot: string, archivePath: string, files: readonly CollectedFile[]): Set<string>;
+  private toRelativeWithinRoot;
+}
+//#endregion
+export { PackArtifactExcluder };

package/dist/types/uapkg-pack/core/PackManifestReader.d.ts

@@ -0,0 +1,8 @@
+import { PackManifest } from "../contracts/PackTypes.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/core/PackManifestReader.d.ts
+declare class PackManifestReader {
+  read(pluginRoot: string): Result<PackManifest>;
+}
+//#endregion
+export { PackManifestReader };

package/dist/types/uapkg-pack/core/PackService.d.ts

@@ -0,0 +1,32 @@
+import { PackOptions, PackResult } from "../contracts/PackTypes.js";
+import { FileCrawler } from "./FileCrawler.js";
+import { IgnoreRuleLoader } from "./IgnoreRuleLoader.js";
+import { IgnoreEvaluator } from "./IgnoreEvaluator.js";
+import { IntegrityWriter } from "./IntegrityWriter.js";
+import { LFSPointerDetector } from "./LFSPointerDetector.js";
+import { PackArtifactExcluder } from "./PackArtifactExcluder.js";
+import { PackManifestReader } from "./PackManifestReader.js";
+import { PluginDescriptorGuard } from "./PluginDescriptorGuard.js";
+import { PluginRootResolver } from "./PluginRootResolver.js";
+import { TarArchiveWriter } from "./TarArchiveWriter.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/core/PackService.d.ts
+declare class PackService {
+  private readonly rootResolver;
+  private readonly manifestReader;
+  private readonly fileCrawler;
+  private readonly ruleLoader;
+  private readonly ignoreEvaluator;
+  private readonly artifactExcluder;
+  private readonly descriptorGuard;
+  private readonly lfsPointerDetector;
+  private readonly tarWriter;
+  private readonly integrityWriter;
+  private readonly logger;
+  constructor(rootResolver?: PluginRootResolver, manifestReader?: PackManifestReader, fileCrawler?: FileCrawler, ruleLoader?: IgnoreRuleLoader, ignoreEvaluator?: IgnoreEvaluator, artifactExcluder?: PackArtifactExcluder, descriptorGuard?: PluginDescriptorGuard, lfsPointerDetector?: LFSPointerDetector, tarWriter?: TarArchiveWriter, integrityWriter?: IntegrityWriter);
+  pack(options?: PackOptions): Promise<Result<PackResult>>;
+  private resolveArchivePath;
+  private isEnforcedInclude;
+}
+//#endregion
+export { PackService };

package/dist/types/uapkg-pack/core/PluginDescriptorGuard.d.ts

@@ -0,0 +1,11 @@
+import { CollectedFile } from "../contracts/PackTypes.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/core/PluginDescriptorGuard.d.ts
+/**
+ * Verifies a plugin descriptor file exists before packing.
+ */
+declare class PluginDescriptorGuard {
+  validate(pluginRoot: string, files: readonly CollectedFile[]): Result<void>;
+}
+//#endregion
+export { PluginDescriptorGuard };

package/dist/types/uapkg-pack/core/PluginRootResolver.d.ts

@@ -0,0 +1,14 @@
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/core/PluginRootResolver.d.ts
+interface ResolvedRoots {
+  cwd: string;
+  pluginRoot: string;
+  gitRoot: string;
+}
+declare class PluginRootResolver {
+  resolve(cwd: string): Result<ResolvedRoots>;
+  private findNearestManifestRoot;
+  private findGitRoot;
+}
+//#endregion
+export { PluginRootResolver, ResolvedRoots };

package/dist/types/uapkg-pack/core/TarArchiveWriter.d.ts

@@ -0,0 +1,11 @@
+//#region src/core/TarArchiveWriter.d.ts
+declare class TarArchiveWriter {
+  write(options: {
+    archivePath: string;
+    pluginRoot: string;
+    rootPrefix: string;
+    files: string[];
+  }): Promise<void>;
+}
+//#endregion
+export { TarArchiveWriter };

package/dist/types/uapkg-pack/index.d.ts

@@ -0,0 +1,7 @@
+import { PackOptions, PackResult } from "./contracts/PackTypes.js";
+import { PackService } from "./core/PackService.js";
+import { Result } from "../uapkg-diagnostics/index.js";
+//#region src/index.d.ts
+declare function pack(options?: PackOptions): Promise<Result<PackResult>>;
+//#endregion
+export { type PackOptions, type PackResult, PackService, pack };

package/dist/types/uapkg-package-claims/archive/PackagedManifestReader.d.ts

@@ -0,0 +1,28 @@
+import { PackageClaims } from "../schema/PackageClaimsSchema.js";
+import "../claims/PackageClaims.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/archive/PackagedManifestReader.d.ts
+/** Raw packaged manifest read out of an artifact archive. */
+interface PackagedManifest {
+  /** Archive-internal path of the manifest entry. */
+  readonly entryPath: string;
+  /** Raw UTF-8 manifest text. */
+  readonly raw: string;
+  /** Parsed JSON value (duplicate keys rejected). */
+  readonly value: unknown;
+}
+interface ReadPackagedManifestOptions {
+  /** Upper bound for the manifest entry size. Default 1 MiB. */
+  readonly maxManifestBytes?: number;
+}
+/**
+ * Read the packaged `uapkg.json` out of a `.tgz` artifact without extracting
+ * it to disk. The packaged manifest is the artifact's identity authority.
+ */
+declare function readPackagedManifest(archivePath: string, options?: ReadPackagedManifestOptions): Promise<Result<PackagedManifest>>;
+/**
+ * Convenience: read the packaged manifest and normalize publication claims.
+ */
+declare function readPackageClaimsFromArchive(archivePath: string, options?: ReadPackagedManifestOptions): Promise<Result<PackageClaims>>;
+//#endregion
+export { PackagedManifest, ReadPackagedManifestOptions, readPackageClaimsFromArchive, readPackagedManifest };

package/dist/types/uapkg-package-claims/claims/ClaimsComparison.d.ts

@@ -0,0 +1,44 @@
+import { PackageClaims } from "../schema/PackageClaimsSchema.js";
+import "./PackageClaims.js";
+import { PackageName, PackageVersion } from "../../uapkg-common-schema/index.js";
+import { RegistryVersion } from "../../uapkg-registry-schema/index.js";
+//#region src/claims/ClaimsComparison.d.ts
+/**
+ * The permanent mandatory comparison core. These keys are always materialized
+ * on both comparison sides (with empty/default normalization), so dropping a
+ * key can never remove them from verification.
+ */
+declare const MANDATORY_CLAIM_KEYS: readonly ['name', 'version', 'private', 'dependencies', 'devDependencies', 'peerDependencies'];
+/**
+ * Optional claim keys this build understands beyond the mandatory core.
+ * Comparison includes an optional key only when it is present and understood
+ * on BOTH sides (the shared-key intersection); one-sided keys are ignored.
+ * The v1 baseline understands none.
+ */
+declare const UNDERSTOOD_OPTIONAL_CLAIM_KEYS: readonly string[];
+/** One differing shared field between the packaged and registry views. */
+interface ClaimsDifference {
+  readonly key: string;
+  readonly packaged: string;
+  readonly registry: string;
+}
+interface ClaimsComparisonResult {
+  readonly equal: boolean;
+  readonly packagedHash: string;
+  readonly registryHash: string;
+  readonly differences: readonly ClaimsDifference[];
+}
+/**
+ * Compare packaged-manifest claims with the projected registry record's
+ * claims over the mandatory core plus the shared understood optional keys,
+ * by hashing both canonical views with SHA-256.
+ */
+declare function compareClaims(packaged: PackageClaims, registry: PackageClaims): ClaimsComparisonResult;
+/**
+ * Build the registry-side claims view for one projected version record.
+ * Absent buckets and the pre-`private` record default normalize exactly like
+ * packaged claims so both sides always materialize the mandatory core.
+ */
+declare function claimsFromRegistryVersion(name: PackageName, version: PackageVersion, entry: RegistryVersion): PackageClaims;
+//#endregion
+export { ClaimsComparisonResult, ClaimsDifference, MANDATORY_CLAIM_KEYS, UNDERSTOOD_OPTIONAL_CLAIM_KEYS, claimsFromRegistryVersion, compareClaims };

package/dist/types/uapkg-package-claims/claims/PackageClaims.d.ts

@@ -0,0 +1,9 @@
+import { ClaimedDependency, PackageClaims } from "../schema/PackageClaimsSchema.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/claims/PackageClaims.d.ts
+/**
+ * Normalize a parsed packaged-manifest value into publication claims.
+ */
+declare function normalizePackageClaims(rawManifest: unknown): Result<PackageClaims>;
+//#endregion
+export { type ClaimedDependency, type PackageClaims, normalizePackageClaims };

package/dist/types/uapkg-package-claims/index.d.ts

@@ -0,0 +1,7 @@
+import { ClaimedDependency, PackageClaims } from "./schema/PackageClaimsSchema.js";
+import { normalizePackageClaims } from "./claims/PackageClaims.js";
+import { PackagedManifest, ReadPackagedManifestOptions, readPackageClaimsFromArchive, readPackagedManifest } from "./archive/PackagedManifestReader.js";
+import { ClaimsComparisonResult, ClaimsDifference, MANDATORY_CLAIM_KEYS, UNDERSTOOD_OPTIONAL_CLAIM_KEYS, claimsFromRegistryVersion, compareClaims } from "./claims/ClaimsComparison.js";
+import { canonicalJsonStringify, parseJsonStrict, sha256OfCanonicalJson } from "./json/CanonicalJson.js";
+import "./schema/index.js";
+export { type ClaimedDependency, type ClaimsComparisonResult, type ClaimsDifference, MANDATORY_CLAIM_KEYS, type PackageClaims, type PackagedManifest, type ReadPackagedManifestOptions, UNDERSTOOD_OPTIONAL_CLAIM_KEYS, canonicalJsonStringify, claimsFromRegistryVersion, compareClaims, normalizePackageClaims, parseJsonStrict, readPackageClaimsFromArchive, readPackagedManifest, sha256OfCanonicalJson };

package/dist/types/uapkg-package-claims/json/CanonicalJson.d.ts

@@ -0,0 +1,17 @@
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/json/CanonicalJson.d.ts
+/**
+ * Parse JSON while rejecting duplicate object keys, which `JSON.parse`
+ * silently collapses (last key wins). Duplicate keys in a packaged manifest
+ * could otherwise smuggle a second value past comparison.
+ */
+declare function parseJsonStrict(text: string, sourceLabel?: string): Result<unknown>;
+/**
+ * Deterministic canonical JSON: object keys sorted lexicographically,
+ * no insignificant whitespace, `undefined` members omitted.
+ */
+declare function canonicalJsonStringify(value: unknown): string;
+/** SHA-256 (lowercase hex) of the canonical JSON encoding of `value`. */
+declare function sha256OfCanonicalJson(value: unknown): string;
+//#endregion
+export { canonicalJsonStringify, parseJsonStrict, sha256OfCanonicalJson };

package/dist/types/uapkg-package-claims/schema/PackageClaimsSchema.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+//#region src/schema/PackageClaimsSchema.d.ts
+/** A dependency claim in the canonical published-claims representation. */
+declare const ClaimedDependencySchema: z.ZodObject<{
+  version: z.core.$ZodBranded<z.ZodString, "VersionRange", "out">;
+  registry: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "RegistryName", "out">>;
+}, z.core.$strict>;
+type ClaimedDependencyRecord = Record<string, z.output<typeof ClaimedDependencySchema>>;
+type ClaimedDependencyRecordInput = Record<string, z.input<typeof ClaimedDependencySchema>>;
+/**
+ * The normalized mandatory publication-claims core.
+ *
+ * The request-facing claims contract is strict: only explicitly versioned
+ * claim members can cross the admission boundary.
+ */
+declare const PackageClaimsSchema: z.ZodObject<{
+  name: z.core.$ZodBranded<z.ZodString, "PackageName", "out">;
+  version: z.core.$ZodBranded<z.ZodString, "PackageVersion", "out">;
+  private: z.ZodBoolean;
+  dependencies: z.ZodType<ClaimedDependencyRecord, ClaimedDependencyRecordInput, z.core.$ZodTypeInternals<ClaimedDependencyRecord, ClaimedDependencyRecordInput>>;
+  devDependencies: z.ZodType<ClaimedDependencyRecord, ClaimedDependencyRecordInput, z.core.$ZodTypeInternals<ClaimedDependencyRecord, ClaimedDependencyRecordInput>>;
+  peerDependencies: z.ZodType<ClaimedDependencyRecord, ClaimedDependencyRecordInput, z.core.$ZodTypeInternals<ClaimedDependencyRecord, ClaimedDependencyRecordInput>>;
+}, z.core.$strict>;
+type ClaimedDependency = z.infer<typeof ClaimedDependencySchema>;
+type PackageClaims = z.infer<typeof PackageClaimsSchema>;
+//#endregion
+export { ClaimedDependency, ClaimedDependencySchema, PackageClaims, PackageClaimsSchema };

package/dist/types/uapkg-package-claims/schema/index.d.ts

@@ -0,0 +1,2 @@
+import { ClaimedDependency, ClaimedDependencySchema, PackageClaims, PackageClaimsSchema } from "./PackageClaimsSchema.js";
+export { type ClaimedDependency, ClaimedDependencySchema, type PackageClaims, PackageClaimsSchema };

package/dist/types/uapkg-package-manifest/contracts/ManifestTypes.d.ts

@@ -0,0 +1,37 @@
+import { Dependency, Lockfile, Manifest } from "../../uapkg-package-manifest-schema/index.js";
+//#region src/contracts/ManifestTypes.d.ts
+/** Options shared by manifest operations. */
+interface ManifestOperationOptions {
+  /** Root directory containing `uapkg.json`. */
+  readonly manifestRoot: string;
+}
+/** Result from adding or removing a dependency. */
+interface DependencyChangeResult {
+  readonly manifest: Manifest;
+  readonly lockfile: Lockfile;
+}
+/** A resolved node in the dependency graph. */
+interface PackageNode {
+  readonly name: string;
+  readonly version: string;
+  readonly registry: string;
+  readonly integrity: string;
+  readonly gitTree?: string;
+  readonly dependencies: ReadonlyMap<string, PackageNode>;
+}
+/** Options for the Resolver. */
+interface ResolverOptions {
+  /** Overrides to apply before resolution (from project manifest). */
+  readonly overrides?: Record<string, Dependency>;
+  /** If true, use lockfile and skip fresh resolution. */
+  readonly frozen?: boolean;
+}
+/** The result of dependency resolution. */
+interface ResolvedGraph {
+  /** One node per unique (registry + name + version). */
+  readonly nodes: ReadonlyMap<string, PackageNode>;
+  /** Direct dependencies of the root manifest. */
+  readonly roots: readonly PackageNode[];
+}
+//#endregion
+export { DependencyChangeResult, ManifestOperationOptions, PackageNode, ResolvedGraph, ResolverOptions };

package/dist/types/uapkg-package-manifest/core/DependencyMutator.d.ts

@@ -0,0 +1,48 @@
+import { Dependency, Manifest } from "../../uapkg-package-manifest-schema/index.js";
+//#region src/core/DependencyMutator.d.ts
+/**
+ * Which dependency bucket a mutation targets.
+ */
+type DependencyBucket = 'dependencies' | 'devDependencies' | 'peerDependencies';
+/**
+ * Options controlling `addDependency`.
+ */
+interface AddDependencyOptions {
+  readonly bucket?: DependencyBucket;
+  /**
+   * When true AND the manifest is a project, the dependency is also written
+   * to `overrides`, pinning the exact version across the tree.
+   */
+  readonly pin?: boolean;
+}
+interface RemoveDependencyResult {
+  readonly manifest: Manifest;
+  readonly removed: boolean;
+}
+/**
+ * Pure, immutable mutations of a `Manifest`.
+ *
+ * Responsibilities:
+ *  - Return a *new* `Manifest` value; never mutate the input.
+ *  - Know nothing about IO — `PackageManifest` composes with `ManifestWriter`.
+ *
+ * All inputs are already Zod-validated by callers (reader layer).
+ */
+declare class DependencyMutator {
+  /**
+   * Add or replace a dependency. When `options.pin` and the manifest is a
+   * project, the same entry is mirrored into `overrides`.
+   */
+  addDependency(manifest: Manifest, name: string, dep: Dependency, options?: AddDependencyOptions): Manifest;
+  /**
+   * Remove a dependency from every bucket. If the manifest is a project, the
+   * matching `overrides` entry (if any) is also removed.
+   */
+  removeDependency(manifest: Manifest, name: string): RemoveDependencyResult;
+  /**
+   * Set or clear an override pin on a project manifest. No-op on plugin manifests.
+   */
+  setPin(manifest: Manifest, name: string, dep: Dependency | null): Manifest;
+}
+//#endregion
+export { AddDependencyOptions, DependencyBucket, DependencyMutator, RemoveDependencyResult };