@uapkg/cli 1.4.0 → 1.5.0

package/dist/types/uapkg-registry-tools/mutation/AddPackageVersionPlanner.d.ts

@@ -0,0 +1,25 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { AddPackageVersionRequest, RegistryMutationPlan, ResolvedRegistryToolsPolicy } from "../contracts/RegistryToolsTypes.js";
+import { RegistryRepoPaths } from "../paths/RegistryRepoPaths.js";
+import { ManifestStore } from "../io/ManifestStore.js";
+import { DependencyReachabilityValidator } from "../validation/DependencyReachabilityValidator.js";
+import { ExternalRegistryPolicyValidator } from "../validation/ExternalRegistryPolicyValidator.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/mutation/AddPackageVersionPlanner.d.ts
+/**
+ * Plans the addition of a single package version.
+ *
+ * Always produces a plan (never throws). Callers inspect the plan's
+ * diagnostics — if any are at level `error`, the plan must not be applied.
+ */
+declare class AddPackageVersionPlanner {
+  private readonly paths;
+  private readonly store;
+  private readonly externalRegistry;
+  private readonly dependencyReachability;
+  private readonly aggregator;
+  constructor(_policy: ResolvedRegistryToolsPolicy, paths: RegistryRepoPaths, store: ManifestStore, externalRegistry: ExternalRegistryPolicyValidator, dependencyReachability: DependencyReachabilityValidator, aggregator: RegistryToolsAggregator);
+  plan(request: AddPackageVersionRequest): Promise<Result<RegistryMutationPlan>>;
+}
+//#endregion
+export { AddPackageVersionPlanner };

package/dist/types/uapkg-registry-tools/mutation/RemovePackagePlanner.d.ts

@@ -0,0 +1,22 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { RegistryMutationPlan, RemovePackageRequest, ResolvedRegistryToolsPolicy } from "../contracts/RegistryToolsTypes.js";
+import { RegistryRepoPaths } from "../paths/RegistryRepoPaths.js";
+import { ManifestStore } from "../io/ManifestStore.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/mutation/RemovePackagePlanner.d.ts
+/**
+ * Plans the deletion of a package's manifest entirely.
+ *
+ * Requires `policy.removals === 'allow-package-remove'`. Any weaker setting
+ * blocks the plan.
+ */
+declare class RemovePackagePlanner {
+  private readonly policy;
+  private readonly paths;
+  private readonly store;
+  private readonly aggregator;
+  constructor(policy: ResolvedRegistryToolsPolicy, paths: RegistryRepoPaths, store: ManifestStore, aggregator: RegistryToolsAggregator);
+  plan(request: RemovePackageRequest): Promise<Result<RegistryMutationPlan>>;
+}
+//#endregion
+export { RemovePackagePlanner };

package/dist/types/uapkg-registry-tools/mutation/RemovePackageVersionPlanner.d.ts

@@ -0,0 +1,21 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { RegistryMutationPlan, RemovePackageVersionRequest, ResolvedRegistryToolsPolicy } from "../contracts/RegistryToolsTypes.js";
+import { RegistryRepoPaths } from "../paths/RegistryRepoPaths.js";
+import { ManifestStore } from "../io/ManifestStore.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/mutation/RemovePackageVersionPlanner.d.ts
+/**
+ * Plans the removal of a single version from a package.
+ *
+ * Honors `policy.removals` — by default, removals are denied.
+ */
+declare class RemovePackageVersionPlanner {
+  private readonly policy;
+  private readonly paths;
+  private readonly store;
+  private readonly aggregator;
+  constructor(policy: ResolvedRegistryToolsPolicy, paths: RegistryRepoPaths, store: ManifestStore, aggregator: RegistryToolsAggregator);
+  plan(request: RemovePackageVersionRequest): Promise<Result<RegistryMutationPlan>>;
+}
+//#endregion
+export { RemovePackageVersionPlanner };

package/dist/types/uapkg-registry-tools/mutation/VersionSorter.d.ts

@@ -0,0 +1,10 @@
+//#region src/mutation/VersionSorter.d.ts
+/**
+ * Sort registry version keys newest-first by SemVer.
+ *
+ * Invalid SemVer strings sort to the end in their original order so we never
+ * silently drop them; validation elsewhere reports them as schema errors.
+ */
+declare function sortVersionsNewestFirst(versions: readonly string[]): string[];
+//#endregion
+export { sortVersionsNewestFirst };

package/dist/types/uapkg-registry-tools/paths/RegistryRepoPaths.d.ts

@@ -0,0 +1,23 @@
+import { PackageName } from "../../uapkg-common-schema/index.js";
+//#region src/paths/RegistryRepoPaths.d.ts
+/**
+ * Pure path helpers for the registry repo layout used by `@uapkg/registry-tools`.
+ *
+ * The `cwd` passed in is the root of the registry repo, NOT a package dir.
+ * Layout: `{cwd}/packages/{first-letter}/{name}.json` for unscoped names and
+ * `{cwd}/packages/@{scope}/{name}.json` for scoped names.
+ */
+declare class RegistryRepoPaths {
+  private readonly cwd;
+  constructor(cwd: string);
+  /** Absolute path to the `packages` directory in the registry repo. */
+  packagesDir(): string;
+  /** Absolute path to the bucket dir for the given package, e.g. `packages/a` or `packages/@acme`. */
+  bucketDir(packageName: PackageName): string;
+  /** Absolute path to a package's manifest JSON file. */
+  manifestPath(packageName: PackageName): string;
+  /** Bucket folder name: the scope directory for scoped names, else the first lowercase character. */
+  firstLetter(packageName: PackageName): string;
+}
+//#endregion
+export { RegistryRepoPaths };

package/dist/types/uapkg-registry-tools/tools/RegistryTools.d.ts

@@ -0,0 +1,64 @@
+import { AddPackageVersionRequest, ChangedManifestValidation, DependencyValidationReport, ExternalRegistryPolicyReport, IntegrityAlgorithm, IntegrityVerificationResult, OfficialPackagePolicyReport, PackageSummary, RegistryLintReport, RegistryMutationPlan, RegistryMutationSummary, RegistryToolsOptions, RegistryValidationReport, ReleaseFileNameReport, RemovePackageRequest, RemovePackageVersionRequest, WriteManifestResult } from "../contracts/RegistryToolsTypes.js";
+import { OfficialRegistryPolicyRequest } from "../validation/OfficialRegistryPolicyValidator.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { Integrity, PackageRegistryManifest } from "../../uapkg-registry-schema/index.js";
+import { PackageName, PackageVersion } from "../../uapkg-common-schema/index.js";
+//#region src/tools/RegistryTools.d.ts
+/**
+ * Programmatic toolkit for registry-owner workflows over a uapkg registry repo.
+ *
+ * Always returns `Result<T>`. Never throws for expected failures. Diagnostics
+ * are also pushed into a process-wide singleton aggregator (with `once`
+ * deduplication) so a CI run can surface a single consolidated list.
+ *
+ * The `cwd` constructor option is the **registry repo root**, never a package
+ * directory inside it.
+ */
+declare class RegistryTools {
+  private readonly policy;
+  private readonly paths;
+  private readonly aggregator;
+  private readonly store;
+  private readonly manifestValidator;
+  private readonly externalRegistry;
+  private readonly dependencyReachability;
+  private readonly releaseFileNames;
+  private readonly officialPolicy;
+  private readonly integrity;
+  private readonly lister;
+  private readonly registryValidator;
+  private readonly addPlanner;
+  private readonly removeVersionPlanner;
+  private readonly removePackagePlanner;
+  constructor(options: RegistryToolsOptions);
+  getManifestPath(packageName: PackageName): Result<string>;
+  readPackageManifest(packageName: PackageName): Promise<Result<PackageRegistryManifest>>;
+  writePackageManifest(manifest: PackageRegistryManifest): Promise<Result<WriteManifestResult>>;
+  packageExists(packageName: PackageName): Result<boolean>;
+  listPackages(): Promise<Result<PackageSummary[]>>;
+  listVersions(packageName: PackageName): Promise<Result<PackageVersion[]>>;
+  validatePackageManifest(manifest: unknown): Result<PackageRegistryManifest>;
+  validateManifestFile(path: string): Promise<Result<PackageRegistryManifest>>;
+  validateRegistry(): Promise<Result<RegistryValidationReport>>;
+  validatePackages(packageNames: readonly PackageName[]): Promise<Result<RegistryValidationReport>>;
+  validateChangedManifestFiles(paths: readonly string[]): Promise<Result<ChangedManifestValidation>>;
+  validateDependencyReachability(packageName: PackageName, version: PackageVersion): Promise<Result<DependencyValidationReport>>;
+  validateExternalRegistryPolicy(manifest: PackageRegistryManifest): Result<ExternalRegistryPolicyReport>;
+  validateReleaseFileNames(packageName: PackageName, version: PackageVersion, fileNames: readonly string[]): Result<ReleaseFileNameReport>;
+  validateOfficialRegistryPolicy(request: OfficialRegistryPolicyRequest): Promise<Result<OfficialPackagePolicyReport>>;
+  /** Run lint-style checks across the whole registry. Currently equivalent to a full validation. */
+  lintRegistry(): Promise<Result<RegistryLintReport>>;
+  /** Lint a single in-memory manifest. */
+  lintPackageManifest(manifest: PackageRegistryManifest): Result<RegistryLintReport>;
+  planAddPackageVersion(request: AddPackageVersionRequest): Promise<Result<RegistryMutationPlan>>;
+  addPackageVersion(request: AddPackageVersionRequest): Promise<Result<RegistryMutationSummary>>;
+  planRemovePackageVersion(request: RemovePackageVersionRequest): Promise<Result<RegistryMutationPlan>>;
+  removePackageVersion(request: RemovePackageVersionRequest): Promise<Result<RegistryMutationSummary>>;
+  planRemovePackage(request: RemovePackageRequest): Promise<Result<RegistryMutationPlan>>;
+  removePackage(request: RemovePackageRequest): Promise<Result<RegistryMutationSummary>>;
+  computeFileIntegrity(filePath: string, algorithm?: IntegrityAlgorithm): Promise<Result<Integrity>>;
+  verifyFileIntegrity(filePath: string, expected: Integrity): Promise<Result<IntegrityVerificationResult>>;
+  private applyPlan;
+}
+//#endregion
+export { RegistryTools };

package/dist/types/uapkg-registry-tools/validation/DependencyReachabilityValidator.d.ts

@@ -0,0 +1,24 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { DependencyValidationReport, ResolvedRegistryToolsPolicy } from "../contracts/RegistryToolsTypes.js";
+import { ManifestStore } from "../io/ManifestStore.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { RegistryVersion } from "../../uapkg-registry-schema/index.js";
+import { PackageName, PackageVersion } from "../../uapkg-common-schema/index.js";
+//#region src/validation/DependencyReachabilityValidator.d.ts
+/**
+ * Verifies that the in-registry (non-external) dependencies of a single
+ * registry version both **exist** in the registry and have at least one
+ * published version that satisfies their declared range.
+ *
+ * Only `dependencies` are checked. `devDependencies` and `peerDependencies` are
+ * intentionally not enforced here (per spec).
+ */
+declare class DependencyReachabilityValidator {
+  private readonly policy;
+  private readonly store;
+  private readonly aggregator;
+  constructor(policy: ResolvedRegistryToolsPolicy, store: ManifestStore, aggregator: RegistryToolsAggregator);
+  validate(packageName: PackageName, version: PackageVersion, registryVersion: RegistryVersion): Promise<Result<DependencyValidationReport>>;
+}
+//#endregion
+export { DependencyReachabilityValidator };

package/dist/types/uapkg-registry-tools/validation/ExternalRegistryPolicyValidator.d.ts

@@ -0,0 +1,22 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { ExternalRegistryPolicyReport, ResolvedRegistryToolsPolicy } from "../contracts/RegistryToolsTypes.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { PackageRegistryManifest } from "../../uapkg-registry-schema/index.js";
+//#region src/validation/ExternalRegistryPolicyValidator.d.ts
+/**
+ * Enforces the external-registry policy on every dependency record of every
+ * version inside a package manifest.
+ *
+ * "External" means a dependency record whose normalized `registry` field is
+ * set. Records without a `registry` field belong to this registry and are
+ * intentionally untouched here.
+ */
+declare class ExternalRegistryPolicyValidator {
+  private readonly policy;
+  private readonly aggregator;
+  constructor(policy: ResolvedRegistryToolsPolicy, aggregator: RegistryToolsAggregator);
+  validate(manifest: PackageRegistryManifest): Result<ExternalRegistryPolicyReport>;
+  private checkBucket;
+}
+//#endregion
+export { ExternalRegistryPolicyValidator };

package/dist/types/uapkg-registry-tools/validation/ManifestValidator.d.ts

@@ -0,0 +1,16 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { PackageRegistryManifest } from "../../uapkg-registry-schema/index.js";
+//#region src/validation/ManifestValidator.d.ts
+/**
+ * Validates raw, untrusted manifest data against the registry schema.
+ * This is the trust boundary for any manifest content from disk or callers.
+ */
+declare class ManifestValidator {
+  private readonly aggregator;
+  constructor(aggregator: RegistryToolsAggregator);
+  /** Validate an in-memory candidate manifest. */
+  validate(input: unknown, sourceLabel?: string): Result<PackageRegistryManifest>;
+}
+//#endregion
+export { ManifestValidator };

package/dist/types/uapkg-registry-tools/validation/OfficialRegistryPolicyValidator.d.ts

@@ -0,0 +1,34 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { OfficialPackagePolicyReport } from "../contracts/RegistryToolsTypes.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { PackageName, PackageVersion } from "../../uapkg-common-schema/index.js";
+//#region src/validation/OfficialRegistryPolicyValidator.d.ts
+interface OfficialRegistryPolicyRequest {
+  /** Absolute path to the extracted package's root directory. */
+  readonly extractedPackageDir: string;
+  readonly expectedPackageName: PackageName;
+  readonly expectedVersion: PackageVersion;
+}
+/**
+ * Local-only validator for "official registry" rules on an already-extracted
+ * package directory.
+ *
+ * Rules:
+ *  - `uapkg.json` must exist.
+ *  - `uapkg.json#name` must match the registry-declared package name.
+ *  - `uapkg.json#version` must match the registry-declared version.
+ *  - `uapkg.json#private: true` is rejected.
+ *  - `uapkg.lock` must not be present.
+ *  - Dependencies must not target external registries.
+ *
+ * Never makes network calls. Never checks publish authority.
+ */
+declare class OfficialRegistryPolicyValidator {
+  private readonly aggregator;
+  constructor(aggregator: RegistryToolsAggregator);
+  validate(request: OfficialRegistryPolicyRequest): Promise<Result<OfficialPackagePolicyReport>>;
+  private checkExternalDeps;
+  private report;
+}
+//#endregion
+export { OfficialRegistryPolicyRequest, OfficialRegistryPolicyValidator };

package/dist/types/uapkg-registry-tools/validation/RegistryValidator.d.ts

@@ -0,0 +1,31 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { PackageValidationReport, RegistryValidationReport, ResolvedRegistryToolsPolicy } from "../contracts/RegistryToolsTypes.js";
+import { RegistryRepoPaths } from "../paths/RegistryRepoPaths.js";
+import { ManifestStore } from "../io/ManifestStore.js";
+import { PackageLister } from "../listing/PackageLister.js";
+import { DependencyReachabilityValidator } from "./DependencyReachabilityValidator.js";
+import { ExternalRegistryPolicyValidator } from "./ExternalRegistryPolicyValidator.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { PackageName } from "../../uapkg-common-schema/index.js";
+//#region src/validation/RegistryValidator.d.ts
+/**
+ * High-level validator that runs every cross-cutting check across one or more
+ * packages in the registry. Composes per-concern validators rather than doing
+ * the work itself (SRP).
+ */
+declare class RegistryValidator {
+  private readonly policy;
+  private readonly paths;
+  private readonly store;
+  private readonly lister;
+  private readonly externalRegistry;
+  private readonly dependencyReachability;
+  private readonly aggregator;
+  constructor(policy: ResolvedRegistryToolsPolicy, paths: RegistryRepoPaths, store: ManifestStore, lister: PackageLister, externalRegistry: ExternalRegistryPolicyValidator, dependencyReachability: DependencyReachabilityValidator, aggregator: RegistryToolsAggregator);
+  validateRegistry(): Promise<Result<RegistryValidationReport>>;
+  validatePackages(packageNames: readonly PackageName[]): Promise<Result<RegistryValidationReport>>;
+  validateSinglePackage(packageName: PackageName): Promise<PackageValidationReport>;
+  private checkVersionsSorted;
+}
+//#endregion
+export { RegistryValidator };

package/dist/types/uapkg-registry-tools/validation/ReleaseFileNameValidator.d.ts

@@ -0,0 +1,21 @@
+import { RegistryToolsAggregator } from "../aggregator/RegistryToolsAggregator.js";
+import { ReleaseFileNameReport } from "../contracts/RegistryToolsTypes.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { PackageName, PackageVersion } from "../../uapkg-common-schema/index.js";
+//#region src/validation/ReleaseFileNameValidator.d.ts
+/**
+ * Validates that release file names follow one of the accepted shapes.
+ *
+ * Accepted file names for `{packageName}@{version}`:
+ *   - `package.tgz`
+ *   - `${packageName}.tgz`
+ *   - `${packageName}@${version}.tgz`
+ */
+declare class ReleaseFileNameValidator {
+  private readonly aggregator;
+  constructor(aggregator: RegistryToolsAggregator);
+  validate(packageName: PackageName, version: PackageVersion, fileNames: readonly string[]): Result<ReleaseFileNameReport>;
+  acceptedNames(packageName: PackageName, version: PackageVersion): readonly string[];
+}
+//#endregion
+export { ReleaseFileNameValidator };

package/package.json

@@ -1,78 +1,51 @@
 {
   "name": "@uapkg/cli",
-  "version": "1.4.0",
-  "engines": {
-    "node": ">=22"
-  },
+  "version": "1.5.0",
+  "description": "UAPKG CLI engine, selected and run by the UAPKG launcher.",
+  "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/MaximDevoir/uapkg.git",
+    "url": "https://github.com/uapkg/uapkg.git",
     "directory": "packages/uapkg"
   },
-  "bin": {
-    "uapkg": "./dist/cli.js"
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=26.0.0",
+    "npm": ">=11.12.1"
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
-  "type": "module",
-  "sideEffects": false,
-  "types": "./dist/index.d.ts",
+  "types": "./dist/types/uapkg/index.d.ts",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
+      "types": "./dist/types/uapkg/index.d.ts",
       "default": "./dist/index.js"
     }
   },
   "dependencies": {
     "@amplication/csharp-ast": "0.1.0",
     "@napi-rs/keyring": "1.3.0",
+    "@types/react": "19.2.14",
+    "@types/semver": "7.7.0",
     "@types/yargs": "17.0.35",
+    "envinfo": "7.21.0",
     "esbuild": "0.28.0",
+    "ignore": "7.0.5",
     "ink": "6.8.0",
     "ink-select-input": "6.2.0",
     "ink-text-input": "6.0.0",
     "is-ci": "4.1.0",
     "oauth4webapi": "3.8.6",
     "open": "11.0.0",
+    "p-limit": "7.1.1",
     "react": "19.2.4",
+    "tar": "7.5.13",
+    "winston": "3.19.0",
     "yargs": "18.0.0",
-    "zod": "4.3.6",
-    "@uapkg/common": "^1.4.0",
-    "@uapkg/common-schema": "^1.4.0",
-    "@uapkg/config": "^1.4.0",
-    "@uapkg/diagnostics": "^1.4.0",
-    "@uapkg/diagnostics-format": "^1.4.0",
-    "@uapkg/installer": "^1.4.0",
-    "@uapkg/log": "^1.4.0",
-    "@uapkg/pack": "^1.4.0",
-    "@uapkg/package-claims": "^1.4.0",
-    "@uapkg/package-manifest": "^1.4.0",
-    "@uapkg/package-manifest-schema": "^1.4.0",
-    "@uapkg/registry-core": "^1.4.0",
-    "@uapkg/registry-schema": "^1.4.0"
-  },
-  "devDependencies": {
-    "@types/react": "19.2.14",
-    "tar": "7.5.13"
-  },
-  "imports": {
-    "#cli/*.ts": {
-      "uapkg-source": "./src/*.ts",
-      "types": "./dist/*.d.ts",
-      "default": "./dist/*.js"
-    },
-    "#cli/*.tsx": {
-      "uapkg-source": "./src/*.tsx",
-      "types": "./dist/*.d.ts",
-      "default": "./dist/*.js"
-    }
-  },
-  "scripts": {
-    "uapkg": "vp run -w --cache cli:build -- --development && vp exec node dist/cli.js",
-    "build": "node build/runCliBuild.ts",
-    "build:watch": "vp pack --watch --on-success \"vp exec node build/finalizeCliBuild.ts --development\"",
-    "verify:production-build": "vp exec node build/verifyProductionBuild.ts"
+    "zod": "4.3.6"
   }
 }

package/dist/app/CompositionRoot.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CompositionRoot.d.ts","names":[],"sources":["../../src/app/CompositionRoot.ts"],"mappings":";;;;;;;;;;UAUiB;WACN;;;;;;;;;;;;;;;;;;;cAoBE;mBAWyB;UAV5B;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAoC,SAAS;MAElC;MAIA,UAAU,oBAAoB;MAO9B,gBAAgB;MAgBhB,mBAAmB;MAWnB,aAAa;MAUb,eAAe;MAOf,eAAe;MAOf,QAAQ;MAOR,kBAAkB;MAOlB,yBAAyB"}

package/dist/app/CompositionRoot.js

@@ -1,93 +0,0 @@
-import { DiagnosticReporter } from "../reporting/DiagnosticReporter.js";
-import { AccountManager } from "../control-plane/AccountManager.js";
-import { RegistryTrustResolver } from "../control-plane/RegistryTrustResolver.js";
-import { PostinstallOrchestrator } from "../postinstall/runner/PostinstallOrchestrator.js";
-import { JsonReporter } from "../reporting/JsonReporter.js";
-import { ConfigInstance } from "@uapkg/config";
-import { PackageManifest } from "@uapkg/package-manifest";
-import { RegistryCore } from "@uapkg/registry-core";
-import { Installer } from "@uapkg/installer";
-
-//#region src/app/CompositionRoot.ts
-/**
-* Central dependency-injection root for the uapkg CLI.
-*
-* One instance is created per CLI invocation. It lazily constructs shared
-* services so commands that don't need them pay nothing. Every service this
-* root owns is either a pure facade (`PackageManifest`, `RegistryCore`) or a
-* stateless collaborator — there is no mutable shared state outside the
-* wrapped config/registry caches.
-*
-* Dependency graph (no cycles):
-*
-*   ConfigInstance ──► RegistryCore ──► PackageManifest
-*                     │                   │
-*                     └──► Installer ◄────┘
-*                          PostinstallOrchestrator
-*                          DiagnosticReporter / JsonReporter
-*/
-var CompositionRoot = class {
-	options;
-	_config;
-	_registryCore;
-	_packageManifest;
-	_installer;
-	_postinstall;
-	_diagnostics;
-	_json;
-	_accountManager;
-	_registryTrustResolver;
-	constructor(options) {
-		this.options = options;
-	}
-	get cwd() {
-		return this.options.cwd;
-	}
-	get config() {
-		if (!this._config) this._config = new ConfigInstance({ cwd: this.options.cwd });
-		return this._config;
-	}
-	get registryCore() {
-		if (!this._registryCore) this._registryCore = new RegistryCore({ configInstance: this.config });
-		return this._registryCore;
-	}
-	get packageManifest() {
-		if (!this._packageManifest) this._packageManifest = new PackageManifest({
-			manifestRoot: this.options.cwd,
-			registryCore: this.registryCore,
-			configInstance: this.config
-		});
-		return this._packageManifest;
-	}
-	get installer() {
-		if (!this._installer) this._installer = new Installer({
-			registryCore: this.registryCore,
-			config: this.config
-		});
-		return this._installer;
-	}
-	get postinstall() {
-		if (!this._postinstall) this._postinstall = new PostinstallOrchestrator();
-		return this._postinstall;
-	}
-	get diagnostics() {
-		if (!this._diagnostics) this._diagnostics = new DiagnosticReporter();
-		return this._diagnostics;
-	}
-	get json() {
-		if (!this._json) this._json = new JsonReporter();
-		return this._json;
-	}
-	get accountManager() {
-		if (!this._accountManager) this._accountManager = new AccountManager();
-		return this._accountManager;
-	}
-	get registryTrustResolver() {
-		if (!this._registryTrustResolver) this._registryTrustResolver = new RegistryTrustResolver(this);
-		return this._registryTrustResolver;
-	}
-};
-
-//#endregion
-export { CompositionRoot };
-//# sourceMappingURL=CompositionRoot.js.map

package/dist/app/CompositionRoot.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"CompositionRoot.js","names":[],"sources":["../../src/app/CompositionRoot.ts"],"sourcesContent":["import { ConfigInstance } from '@uapkg/config';\nimport { Installer } from '@uapkg/installer';\nimport { PackageManifest } from '@uapkg/package-manifest';\nimport { RegistryCore } from '@uapkg/registry-core';\nimport { AccountManager } from '#cli/control-plane/AccountManager.ts';\nimport { RegistryTrustResolver } from '#cli/control-plane/RegistryTrustResolver.ts';\nimport { PostinstallOrchestrator } from '#cli/postinstall/runner/PostinstallOrchestrator.ts';\nimport { DiagnosticReporter } from '#cli/reporting/DiagnosticReporter.ts';\nimport { JsonReporter } from '#cli/reporting/JsonReporter.ts';\n\nexport interface CompositionRootOptions {\n  readonly cwd: string;\n}\n\n/**\n * Central dependency-injection root for the uapkg CLI.\n *\n * One instance is created per CLI invocation. It lazily constructs shared\n * services so commands that don't need them pay nothing. Every service this\n * root owns is either a pure facade (`PackageManifest`, `RegistryCore`) or a\n * stateless collaborator — there is no mutable shared state outside the\n * wrapped config/registry caches.\n *\n * Dependency graph (no cycles):\n *\n *   ConfigInstance ──► RegistryCore ──► PackageManifest\n *                     │                   │\n *                     └──► Installer ◄────┘\n *                          PostinstallOrchestrator\n *                          DiagnosticReporter / JsonReporter\n */\nexport class CompositionRoot {\n  private _config?: InstanceType<typeof ConfigInstance>;\n  private _registryCore?: RegistryCore;\n  private _packageManifest?: PackageManifest;\n  private _installer?: Installer;\n  private _postinstall?: PostinstallOrchestrator;\n  private _diagnostics?: DiagnosticReporter;\n  private _json?: JsonReporter;\n  private _accountManager?: AccountManager;\n  private _registryTrustResolver?: RegistryTrustResolver;\n\n  public constructor(private readonly options: CompositionRootOptions) {}\n\n  public get cwd(): string {\n    return this.options.cwd;\n  }\n\n  public get config(): InstanceType<typeof ConfigInstance> {\n    if (!this._config) {\n      this._config = new ConfigInstance({ cwd: this.options.cwd });\n    }\n    return this._config;\n  }\n\n  public get registryCore(): RegistryCore {\n    if (!this._registryCore) {\n      // RegistryCore accepts a duck-typed config surface; ConfigInstance has\n      // wider return types, so cast through `unknown` to satisfy the narrower\n      // structural type.\n      this._registryCore = new RegistryCore({\n        configInstance: this.config as unknown as {\n          get: (p?: string) => unknown;\n          getAll: () => Record<string, unknown>;\n          getDefaultRegistry: () => { url: string; ref: { type: string; value: string } } | null;\n        },\n      });\n    }\n    return this._registryCore;\n  }\n\n  public get packageManifest(): PackageManifest {\n    if (!this._packageManifest) {\n      this._packageManifest = new PackageManifest({\n        manifestRoot: this.options.cwd,\n        registryCore: this.registryCore,\n        configInstance: this.config,\n      });\n    }\n    return this._packageManifest;\n  }\n\n  public get installer(): Installer {\n    if (!this._installer) {\n      this._installer = new Installer({\n        registryCore: this.registryCore,\n        config: this.config,\n      });\n    }\n    return this._installer;\n  }\n\n  public get postinstall(): PostinstallOrchestrator {\n    if (!this._postinstall) {\n      this._postinstall = new PostinstallOrchestrator();\n    }\n    return this._postinstall;\n  }\n\n  public get diagnostics(): DiagnosticReporter {\n    if (!this._diagnostics) {\n      this._diagnostics = new DiagnosticReporter();\n    }\n    return this._diagnostics;\n  }\n\n  public get json(): JsonReporter {\n    if (!this._json) {\n      this._json = new JsonReporter();\n    }\n    return this._json;\n  }\n\n  public get accountManager(): AccountManager {\n    if (!this._accountManager) {\n      this._accountManager = new AccountManager();\n    }\n    return this._accountManager;\n  }\n\n  public get registryTrustResolver(): RegistryTrustResolver {\n    if (!this._registryTrustResolver) {\n      this._registryTrustResolver = new RegistryTrustResolver(this);\n    }\n    return this._registryTrustResolver;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAa,kBAAb,MAA6B;CAWS;CAVpC,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,AAAO,YAAY,AAAiB,SAAiC;EAAjC;CAAkC;CAEtE,IAAW,MAAc;EACvB,OAAO,KAAK,QAAQ;CACtB;CAEA,IAAW,SAA8C;EACvD,IAAI,CAAC,KAAK,SACR,KAAK,UAAU,IAAI,eAAe,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC;EAE7D,OAAO,KAAK;CACd;CAEA,IAAW,eAA6B;EACtC,IAAI,CAAC,KAAK,eAIR,KAAK,gBAAgB,IAAI,aAAa,EACpC,gBAAgB,KAAK,OAKvB,CAAC;EAEH,OAAO,KAAK;CACd;CAEA,IAAW,kBAAmC;EAC5C,IAAI,CAAC,KAAK,kBACR,KAAK,mBAAmB,IAAI,gBAAgB;GAC1C,cAAc,KAAK,QAAQ;GAC3B,cAAc,KAAK;GACnB,gBAAgB,KAAK;EACvB,CAAC;EAEH,OAAO,KAAK;CACd;CAEA,IAAW,YAAuB;EAChC,IAAI,CAAC,KAAK,YACR,KAAK,aAAa,IAAI,UAAU;GAC9B,cAAc,KAAK;GACnB,QAAQ,KAAK;EACf,CAAC;EAEH,OAAO,KAAK;CACd;CAEA,IAAW,cAAuC;EAChD,IAAI,CAAC,KAAK,cACR,KAAK,eAAe,IAAI,wBAAwB;EAElD,OAAO,KAAK;CACd;CAEA,IAAW,cAAkC;EAC3C,IAAI,CAAC,KAAK,cACR,KAAK,eAAe,IAAI,mBAAmB;EAE7C,OAAO,KAAK;CACd;CAEA,IAAW,OAAqB;EAC9B,IAAI,CAAC,KAAK,OACR,KAAK,QAAQ,IAAI,aAAa;EAEhC,OAAO,KAAK;CACd;CAEA,IAAW,iBAAiC;EAC1C,IAAI,CAAC,KAAK,iBACR,KAAK,kBAAkB,IAAI,eAAe;EAE5C,OAAO,KAAK;CACd;CAEA,IAAW,wBAA+C;EACxD,IAAI,CAAC,KAAK,wBACR,KAAK,yBAAyB,IAAI,sBAAsB,IAAI;EAE9D,OAAO,KAAK;CACd;AACF"}

package/dist/app/UAPKGApplication.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UAPKGApplication.d.ts","names":[],"sources":["../../src/app/UAPKGApplication.ts"],"mappings":";;;;;;;;;;;cAgCa;EACL,IAAI,aAAa,mBAAmB"}