ghcr-cleanup-manager 1.1.0

package/dist/cli/_older-than.js

@@ -0,0 +1,42 @@
+export function resolveOlderThan(rawValue, now) {
+    const normalized = rawValue.trim().toLowerCase();
+    const match = normalized.match(/^(\d+)\s+(minute|minutes|hour|hours|day|days|week|weeks|month|months|year|years)$/);
+    if (!match) {
+        throw new Error(`invalid older-than interval: ${rawValue}`);
+    }
+    const amount = Number(match[1]);
+    const unit = match[2];
+    const cutoff = new Date(now.getTime());
+    switch (unit) {
+        case "minute":
+        case "minutes":
+            cutoff.setUTCMinutes(cutoff.getUTCMinutes() - amount);
+            break;
+        case "hour":
+        case "hours":
+            cutoff.setUTCHours(cutoff.getUTCHours() - amount);
+            break;
+        case "day":
+        case "days":
+            cutoff.setUTCDate(cutoff.getUTCDate() - amount);
+            break;
+        case "week":
+        case "weeks":
+            cutoff.setUTCDate(cutoff.getUTCDate() - amount * 7);
+            break;
+        case "month":
+        case "months":
+            cutoff.setUTCMonth(cutoff.getUTCMonth() - amount);
+            break;
+        case "year":
+        case "years":
+            cutoff.setUTCFullYear(cutoff.getUTCFullYear() - amount);
+            break;
+        default:
+            throw new Error(`invalid older-than unit: ${unit}`);
+    }
+    return {
+        olderThan: normalized,
+        cutoffTimestamp: cutoff.toISOString()
+    };
+}

package/dist/cli/_planner-options.d.ts

@@ -0,0 +1,20 @@
+import type { DeletePlan, PlannerRepository } from "../db/index.js";
+export interface PlanCommandInputs {
+    databasePath: string;
+    owner: string;
+    packageName: string;
+    deleteTags: string[];
+    deleteTagsRequested: boolean;
+    deleteGhostImages: boolean;
+    deletePartialImages: boolean;
+    deleteOrphanedImages: boolean;
+    excludeTags: string[];
+    deleteUntagged: boolean;
+    useRegex: boolean;
+    keepNTagged?: number;
+    keepNUntagged?: number;
+    olderThan?: string;
+    cutoffTimestamp?: string;
+}
+export declare function resolvePlanCommandInputs(args: string[]): PlanCommandInputs;
+export declare function loadDeletePlan(repository: PlannerRepository, inputs: PlanCommandInputs): DeletePlan;

package/dist/cli/_planner-options.js

@@ -0,0 +1,83 @@
+import { collectRepeatedOption, hasFlag, requireOption } from "./_args.js";
+import { resolveOlderThan } from "./_older-than.js";
+export function resolvePlanCommandInputs(args) {
+    const databasePath = requireOption(args, "--db");
+    const owner = requireOption(args, "--owner");
+    const packageName = requireOption(args, "--package");
+    const deleteTags = collectRepeatedOption(args, "--delete-tag");
+    const deleteGhostImages = hasFlag(args, "--delete-ghost-images");
+    const deletePartialImages = hasFlag(args, "--delete-partial-images");
+    const deleteOrphanedImages = hasFlag(args, "--delete-orphaned-images");
+    const excludeTags = collectRepeatedOption(args, "--exclude-tag");
+    const deleteUntagged = hasFlag(args, "--delete-untagged");
+    const useRegex = hasFlag(args, "--use-regex");
+    const keepNTaggedRaw = collectRepeatedOption(args, "--keep-n-tagged");
+    const keepNUntaggedRaw = collectRepeatedOption(args, "--keep-n-untagged");
+    const olderThanRaw = collectRepeatedOption(args, "--older-than");
+    if (keepNTaggedRaw.length > 1) {
+        throw new Error("--keep-n-tagged may only be provided once");
+    }
+    if (keepNUntaggedRaw.length > 1) {
+        throw new Error("--keep-n-untagged may only be provided once");
+    }
+    const keepNTagged = keepNTaggedRaw[0] ? resolveKeepCount("--keep-n-tagged", keepNTaggedRaw[0]) : undefined;
+    const keepNUntagged = keepNUntaggedRaw[0] ? resolveKeepCount("--keep-n-untagged", keepNUntaggedRaw[0]) : undefined;
+    const taggedSelectorActive = deleteTags.length > 0 ||
+        deleteGhostImages ||
+        deletePartialImages ||
+        deleteOrphanedImages ||
+        keepNTagged !== undefined;
+    const hasAnySelector = deleteUntagged || taggedSelectorActive || keepNUntagged !== undefined;
+    if (deleteUntagged && keepNUntagged !== undefined) {
+        throw new Error("--delete-untagged and --keep-n-untagged cannot be combined");
+    }
+    if (!hasAnySelector) {
+        throw new Error("missing required cleanup selector: --delete-untagged, --delete-tag, --delete-ghost-images, --delete-partial-images, --delete-orphaned-images, --keep-n-tagged, or --keep-n-untagged");
+    }
+    if (!taggedSelectorActive && excludeTags.length > 0) {
+        throw new Error("--exclude-tag is only supported with tagged selector families");
+    }
+    if (olderThanRaw.length > 1) {
+        throw new Error("--older-than may only be provided once");
+    }
+    const olderThan = olderThanRaw[0] ? resolveOlderThan(olderThanRaw[0], new Date()) : undefined;
+    return {
+        databasePath,
+        owner,
+        packageName,
+        deleteTags,
+        deleteTagsRequested: deleteTags.length > 0 || deleteGhostImages || deletePartialImages || deleteOrphanedImages,
+        deleteGhostImages,
+        deletePartialImages,
+        deleteOrphanedImages,
+        excludeTags,
+        deleteUntagged,
+        useRegex,
+        keepNTagged,
+        keepNUntagged,
+        olderThan: olderThan?.olderThan,
+        cutoffTimestamp: olderThan?.cutoffTimestamp
+    };
+}
+export function loadDeletePlan(repository, inputs) {
+    return repository.getCleanupPlanWithCutoff(inputs.owner, inputs.packageName, {
+        deleteTags: inputs.deleteTags,
+        deleteTagsRequested: inputs.deleteTagsRequested,
+        deleteGhostImages: inputs.deleteGhostImages,
+        deletePartialImages: inputs.deletePartialImages,
+        deleteOrphanedImages: inputs.deleteOrphanedImages,
+        excludeTags: inputs.excludeTags,
+        deleteUntagged: inputs.deleteUntagged,
+        useRegex: inputs.useRegex,
+        keepNTagged: inputs.keepNTagged,
+        keepNUntagged: inputs.keepNUntagged,
+        olderThan: inputs.olderThan,
+        cutoffTimestamp: inputs.cutoffTimestamp
+    });
+}
+function resolveKeepCount(optionName, rawValue) {
+    if (!/^\d+$/.test(rawValue)) {
+        throw new Error(`${optionName} must be a non-negative integer`);
+    }
+    return Number.parseInt(rawValue, 10);
+}

package/dist/cli/_scan-command.d.ts

@@ -0,0 +1 @@
+export declare function handleScan(args: string[]): Promise<number>;

package/dist/cli/_scan-command.js

@@ -0,0 +1,39 @@
+import { ScanWriter, SnapshotRepository, openDatabase } from "../db/index.js";
+import { importGitHubScan } from "../ingest/github/index.js";
+import { findOption, requireOption, resolveLogLevel, resolveToken } from "./_args.js";
+import { writeGitHubScanOutputs } from "./_github-output.js";
+import { createLogger } from "./_logger.js";
+export async function handleScan(args) {
+    const databasePath = requireOption(args, "--db");
+    const owner = requireOption(args, "--owner");
+    const packageName = requireOption(args, "--package");
+    const githubOutputPath = findOption(args, "--github-output");
+    const token = resolveToken(args);
+    const logger = createLogger(resolveLogLevel(args));
+    const database = openDatabase(databasePath);
+    const repository = new SnapshotRepository(database);
+    const writer = new ScanWriter(database);
+    await importGitHubScan({
+        owner,
+        packageName,
+        token,
+        logger
+    }, writer, repository);
+    const scanId = writer.getActiveScanId();
+    const metadata = repository.getPackageMetadata(scanId);
+    const summary = {
+        owner: metadata.owner,
+        packageName: metadata.packageName,
+        scanCompletedAt: metadata.scanCompletedAt,
+        packageVersions: repository.countPackageVersions(scanId),
+        tags: repository.countTags(scanId),
+        manifests: repository.countManifests(scanId),
+        manifestEdges: repository.countManifestEdges(scanId)
+    };
+    if (githubOutputPath) {
+        writeGitHubScanOutputs(githubOutputPath, summary);
+    }
+    console.log(JSON.stringify(summary));
+    database.close();
+    return 0;
+}

package/dist/cli/_tag-selector-resolver.d.ts

@@ -0,0 +1,3 @@
+import type Database from "better-sqlite3";
+import type { PlanCommandInputs } from "./_planner-options.js";
+export declare function resolveTagSelectors(database: Database.Database, inputs: PlanCommandInputs): PlanCommandInputs;

package/dist/cli/_tag-selector-resolver.js

@@ -0,0 +1,132 @@
+const BrokenIndexModes = {
+    allMissing: "all-missing",
+    someMissing: "some-missing"
+};
+export function resolveTagSelectors(database, inputs) {
+    if (!inputs.deleteGhostImages && !inputs.deletePartialImages && !inputs.deleteOrphanedImages) {
+        return inputs;
+    }
+    return {
+        ...inputs,
+        deleteTags: inputs.deleteGhostImages
+            ? _listLatestGhostTags(database, inputs.owner, inputs.packageName, inputs.cutoffTimestamp)
+            : inputs.deletePartialImages
+                ? _listLatestPartialTags(database, inputs.owner, inputs.packageName, inputs.cutoffTimestamp)
+                : inputs.deleteOrphanedImages
+                    ? _listLatestOrphanedTags(database, inputs.owner, inputs.packageName, inputs.cutoffTimestamp)
+                    : inputs.deleteTags
+    };
+}
+function _listLatestGhostTags(database, owner, packageName, cutoffTimestamp) {
+    return _listLatestBrokenIndexTags(database, owner, packageName, cutoffTimestamp, BrokenIndexModes.allMissing);
+}
+function _listLatestPartialTags(database, owner, packageName, cutoffTimestamp) {
+    return _listLatestBrokenIndexTags(database, owner, packageName, cutoffTimestamp, BrokenIndexModes.someMissing);
+}
+function _listLatestBrokenIndexTags(database, owner, packageName, cutoffTimestamp, mode) {
+    const havingClause = mode === BrokenIndexModes.allMissing
+        ? "COUNT(*) > 0 AND COUNT(child.digest) = 0"
+        : "COUNT(child.digest) > 0 AND COUNT(child.digest) < COUNT(*)";
+    const rows = database
+        .prepare(`
+        WITH latest_scan AS (
+          SELECT scan_id
+          FROM v_latest_scan_per_package
+          WHERE owner = ?
+            AND package_name = ?
+        ),
+        ghost_roots AS (
+          SELECT
+            m.scan_id,
+            m.version_id
+          FROM latest_scan ls
+          JOIN manifests m
+            ON m.scan_id = ls.scan_id
+          JOIN package_versions pv
+            ON pv.scan_id = m.scan_id
+           AND pv.version_id = m.version_id
+          JOIN tags root_tags
+            ON root_tags.scan_id = m.scan_id
+           AND root_tags.version_id = m.version_id
+          JOIN manifest_descriptors md
+            ON md.scan_id = m.scan_id
+           AND md.parent_digest = m.digest
+          LEFT JOIN manifests child
+            ON child.scan_id = md.scan_id
+           AND child.digest = md.child_digest
+          WHERE m.media_type IN (
+            'application/vnd.oci.image.index.v1+json',
+            'application/vnd.docker.distribution.manifest.list.v2+json'
+          )
+            AND NOT EXISTS (
+              SELECT 1
+              FROM manifest_reachability mr
+              WHERE mr.scan_id = m.scan_id
+                AND mr.descendant_digest = m.digest
+                AND mr.min_distance > 0
+            )
+            AND (? IS NULL OR pv.created_at < ?)
+          GROUP BY m.scan_id, m.version_id
+          HAVING ${havingClause}
+        )
+        SELECT DISTINCT t.tag
+        FROM ghost_roots gr
+        JOIN tags t
+          ON t.scan_id = gr.scan_id
+         AND t.version_id = gr.version_id
+        ORDER BY t.tag
+      `)
+        .all(owner, packageName, cutoffTimestamp ?? null, cutoffTimestamp ?? null);
+    return rows.map((row) => row.tag);
+}
+// Some OCI tooling publishes companion artifacts such as signatures or attestations under
+// digest tags in the same repository, for example `sha256-<digest>.sig`, while the
+// actual relationship is the artifact's subject/referrer link to the parent digest.
+//
+// Public references:
+// - Sigstore Cosign example pushing `sha256-<digest>.sig`:
+//   https://docs.sigstore.dev/cosign/signing/other_types/
+// - OCI referrers / subject model:
+//   https://github.com/opencontainers/distribution-spec/blob/main/spec.md
+//
+// This resolver intentionally mirrors the `delete-orphaned-images` behavior from
+// `dataaxiom/ghcr-cleanup-action`, but keeps the check narrow and local to the current package
+// scan: derive the parent digest from the tag, then treat the tag as orphaned only when that
+// digest is absent from the scanned manifests for the same package.
+function _listLatestOrphanedTags(database, owner, packageName, cutoffTimestamp) {
+    const rows = database
+        .prepare(`
+        WITH latest_scan AS (
+          SELECT scan_id
+          FROM v_latest_scan_per_package
+          WHERE owner = ?
+            AND package_name = ?
+        ),
+        digest_tag_artifacts AS (
+          SELECT
+            t.tag,
+            t.scan_id,
+            t.version_id AS artifact_version_id,
+            'sha256:' || SUBSTR(t.tag, 8, 64) AS parent_digest
+          FROM latest_scan ls
+          JOIN tags t
+            ON t.scan_id = ls.scan_id
+          WHERE t.is_digest_tag = 1
+        )
+        SELECT DISTINCT dta.tag
+        FROM digest_tag_artifacts dta
+        JOIN package_versions pv
+          ON pv.scan_id = dta.scan_id
+         AND pv.version_id = dta.artifact_version_id
+        WHERE NOT EXISTS (
+            SELECT 1
+            FROM manifests parent
+            WHERE parent.scan_id = dta.scan_id
+              AND parent.digest = dta.parent_digest
+          )
+          AND (? IS NULL OR pv.created_at < ?)
+        ORDER BY dta.tag
+      `)
+        .all(owner, packageName, cutoffTimestamp ?? null, cutoffTimestamp ?? null);
+    return rows.map((row) => row.tag);
+}

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function main(argv: string[]): Promise<number>;

package/dist/cli/index.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { handleCleanup } from "./_cleanup-command.js";
+import { handleDbMerge } from "./_db-merge-command.js";
+import { handleScan } from "./_scan-command.js";
+export async function main(argv) {
+    const [command, ...rest] = argv;
+    if (!command) {
+        printUsage();
+        return 1;
+    }
+    switch (command) {
+        case "cleanup":
+            return handleCleanup(rest);
+        case "db-merge":
+            return handleDbMerge(rest);
+        case "scan":
+            return handleScan(rest);
+        default:
+            throw new Error(`unknown command: ${command}`);
+    }
+}
+function printUsage() {
+    console.error(`Usage:
+  ghcr-cleanup-manager cleanup --db <path> [--log-level <trace|debug|info|warn|error|silent>] [--dry-run] [--summary-json-path <path>] --owner <org> --package <name> [--token <token>] <cleanup selectors...> [--exclude-tag <tag> ...] [--use-regex] [--older-than <interval>]
+  ghcr-cleanup-manager db-merge --db <target-path> --source-db <path> [--source-db <path> ...]
+  ghcr-cleanup-manager scan --db <path> [--log-level <trace|debug|info|warn|error|silent>] [--github-output <path>] --owner <org> --package <name> --token <token>
+
+Cleanup selectors:
+  --delete-untagged
+  --delete-ghost-images
+  --delete-partial-images
+  --delete-orphaned-images
+  --delete-tag <tag> [--delete-tag <tag> ...]
+  --keep-n-tagged <count>
+  --keep-n-untagged <count>
+
+Notes:
+  - Tagged selector families may be combined with --delete-untagged.
+  - --exclude-tag requires at least one tagged selector family.
+  - --delete-untagged and --keep-n-untagged cannot be combined.`);
+}
+const _entryPath = process.argv[1];
+const _isDirectExecution = realpathSync(_entryPath) === realpathSync(fileURLToPath(import.meta.url));
+if (_isDirectExecution) {
+    main(process.argv.slice(2)).catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(message);
+        process.exitCode = 1;
+    });
+}

package/dist/config/_service-constants.d.ts

@@ -0,0 +1,3 @@
+export declare const githubApiBaseUrl = "https://api.github.com";
+export declare const githubApiVersion = "2022-11-28";
+export declare const ghcrRegistryBaseUrl = "https://ghcr.io";

package/dist/config/_service-constants.js

@@ -0,0 +1,3 @@
+export const githubApiBaseUrl = "https://api.github.com";
+export const githubApiVersion = "2022-11-28";
+export const ghcrRegistryBaseUrl = "https://ghcr.io";

package/dist/config/index.d.ts

@@ -0,0 +1,9 @@
+export declare const packageVersionPageFetchConcurrency = 4;
+export declare const manifestFetchConcurrency = 16;
+export declare const ingestRequestRetryCount = 3;
+export declare const ingestRequestRetryDelayMs = 1000;
+export declare const executeRequestRetryCount = 3;
+export declare const executeRequestRetryDelayMs = 1000;
+export declare const paginatedIngestProgressIntervalPages = 10;
+export declare const manifestIngestProgressStepRatio = 0.05;
+export { ghcrRegistryBaseUrl, githubApiBaseUrl, githubApiVersion } from "./_service-constants.js";

package/dist/config/index.js

@@ -0,0 +1,9 @@
+export const packageVersionPageFetchConcurrency = 4;
+export const manifestFetchConcurrency = 16;
+export const ingestRequestRetryCount = 3;
+export const ingestRequestRetryDelayMs = 1000;
+export const executeRequestRetryCount = 3;
+export const executeRequestRetryDelayMs = 1000;
+export const paginatedIngestProgressIntervalPages = 10;
+export const manifestIngestProgressStepRatio = 0.05;
+export { ghcrRegistryBaseUrl, githubApiBaseUrl, githubApiVersion } from "./_service-constants.js";

package/dist/core/_digest-tag.d.ts

@@ -0,0 +1,2 @@
+export declare function isDigestTag(tag: string): boolean;
+export declare function digestFromDigestTag(tag: string): string | null;

package/dist/core/_digest-tag.js

@@ -0,0 +1,12 @@
+export function isDigestTag(tag) {
+    return tag.startsWith("sha256-") && tag.length >= 71 && !_containsNonHex(tag.slice(7, 71));
+}
+export function digestFromDigestTag(tag) {
+    if (!isDigestTag(tag)) {
+        return null;
+    }
+    return `sha256:${tag.slice(7, 71)}`;
+}
+function _containsNonHex(value) {
+    return /[^0-9A-Fa-f]/.test(value);
+}

package/dist/core/_github-package-owner.d.ts

@@ -0,0 +1,11 @@
+interface _FetchLikeResponse {
+    ok: boolean;
+    status: number;
+    headers: Headers;
+    json(): Promise<unknown>;
+}
+interface _Logger {
+    warn(message: string): void;
+}
+export declare function getOwnerURIComponent(fetchImpl: (input: string, init?: RequestInit) => Promise<_FetchLikeResponse>, owner: string, token: string, logger: _Logger): Promise<string>;
+export {};

package/dist/core/_github-package-owner.js

@@ -0,0 +1,45 @@
+import { githubApiBaseUrl, githubApiVersion, ingestRequestRetryCount, ingestRequestRetryDelayMs } from "../config/index.js";
+import { buildHttpErrorMessage } from "./_http-error.js";
+const _ownerUriComponentByOwner = new Map();
+export async function getOwnerURIComponent(fetchImpl, owner, token, logger) {
+    const cachedOwnerURIComponent = _ownerUriComponentByOwner.get(owner);
+    if (cachedOwnerURIComponent) {
+        return cachedOwnerURIComponent;
+    }
+    const url = new URL(`/users/${encodeURIComponent(owner)}`, githubApiBaseUrl).toString();
+    for (let attempt = 1;; attempt += 1) {
+        const response = await fetchImpl(url, {
+            headers: {
+                Accept: "application/vnd.github+json",
+                Authorization: `Bearer ${token}`,
+                "User-Agent": "ghcr-cleanup-manager",
+                "X-GitHub-Api-Version": githubApiVersion
+            }
+        });
+        if (response.ok) {
+            const payload = (await response.json());
+            if (payload.type === "Organization") {
+                const ownerURIComponent = `orgs/${encodeURIComponent(owner)}`;
+                _ownerUriComponentByOwner.set(owner, ownerURIComponent);
+                return ownerURIComponent;
+            }
+            if (payload.type === "User") {
+                const ownerURIComponent = `users/${encodeURIComponent(owner)}`;
+                _ownerUriComponentByOwner.set(owner, ownerURIComponent);
+                return ownerURIComponent;
+            }
+            throw new Error(`GitHub owner lookup did not include a supported type`);
+        }
+        if (!_isRetryableStatus(response.status) || attempt > ingestRequestRetryCount) {
+            throw new Error(await buildHttpErrorMessage(response, "GitHub owner lookup failed"));
+        }
+        logger.warn(`GitHub owner lookup failed on attempt ${attempt}/${ingestRequestRetryCount + 1}; retrying in ${ingestRequestRetryDelayMs}ms - ${await buildHttpErrorMessage(response, "GitHub owner lookup failed")}`);
+        await _sleep(ingestRequestRetryDelayMs);
+    }
+}
+function _isRetryableStatus(status) {
+    return status === 429 || status === 502 || status === 503 || status === 504;
+}
+function _sleep(delayMs) {
+    return new Promise((resolve) => setTimeout(resolve, delayMs));
+}

package/dist/core/_http-error.d.ts

@@ -0,0 +1,6 @@
+export interface HttpErrorResponse {
+    status: number;
+    headers: Headers;
+    json(): Promise<unknown>;
+}
+export declare function buildHttpErrorMessage(response: HttpErrorResponse, fallback: string): Promise<string>;

package/dist/core/_http-error.js

@@ -0,0 +1,33 @@
+export async function buildHttpErrorMessage(response, fallback) {
+    const details = [fallback, `status ${response.status}`];
+    const body = await _readJsonErrorBody(response);
+    const message = typeof body?.message === "string" ? body.message : undefined;
+    const documentationUrl = typeof body?.documentation_url === "string" ? body.documentation_url : undefined;
+    const authenticateHeader = response.headers.get("www-authenticate") ?? undefined;
+    if (message) {
+        details.push(message);
+    }
+    if (documentationUrl) {
+        details.push(documentationUrl);
+    }
+    if (authenticateHeader) {
+        details.push(`www-authenticate: ${authenticateHeader}`);
+    }
+    return details.join(" - ");
+}
+async function _readJsonErrorBody(response) {
+    const contentType = response.headers.get("content-type")?.split(";")[0];
+    if (contentType && contentType !== "application/json" && !contentType.endsWith("+json")) {
+        return undefined;
+    }
+    try {
+        const body = await response.json();
+        if (body && typeof body === "object") {
+            return body;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}

package/dist/core/_types.d.ts

@@ -0,0 +1,54 @@
+export declare const ManifestKinds: {
+    readonly indexManifest: "index_manifest";
+    readonly multiArchManifest: "multi_arch_manifest";
+    readonly imageManifest: "image_manifest";
+    readonly artifactManifest: "artifact_manifest";
+    readonly attestationManifest: "attestation_manifest";
+    readonly signatureManifest: "signature_manifest";
+};
+export type ManifestKind = (typeof ManifestKinds)[keyof typeof ManifestKinds];
+export type ManifestEdgeKind = "image-child" | "referrer" | "digest-tag-referrer";
+export interface PackageVersionRecord {
+    versionId: number;
+    createdAt: string;
+    updatedAt: string;
+    metadata?: Record<string, unknown>;
+}
+export interface TagRecord {
+    tag: string;
+    versionId: number;
+}
+export interface ManifestRecord {
+    versionId: number;
+    digest: string;
+    mediaType: string;
+    artifactType?: string;
+    configMediaType?: string;
+    subjectDigest?: string;
+    annotations?: Record<string, unknown>;
+    manifestKind?: ManifestKind;
+}
+export interface ManifestDescriptorRecord {
+    parentDigest: string;
+    childDigest: string;
+    mediaType: string;
+    artifactType?: string;
+    platform?: {
+        architecture?: string;
+        os?: string;
+        variant?: string;
+    };
+}
+export interface ManifestEdgeRecord {
+    parentDigest: string;
+    childDigest: string;
+    edgeKind: ManifestEdgeKind;
+}
+export interface PackageSnapshot {
+    packageName: string;
+    scanCompletedAt: string;
+    packageVersions: PackageVersionRecord[];
+    tags: TagRecord[];
+    manifests: ManifestRecord[];
+    manifestEdges: ManifestEdgeRecord[];
+}

package/dist/core/_types.js

@@ -0,0 +1,8 @@
+export const ManifestKinds = {
+    indexManifest: "index_manifest",
+    multiArchManifest: "multi_arch_manifest",
+    imageManifest: "image_manifest",
+    artifactManifest: "artifact_manifest",
+    attestationManifest: "attestation_manifest",
+    signatureManifest: "signature_manifest"
+};

package/dist/core/index.d.ts

@@ -0,0 +1,6 @@
+export type { ManifestEdgeKind, ManifestEdgeRecord, ManifestDescriptorRecord, ManifestKind, ManifestRecord, PackageSnapshot, PackageVersionRecord, TagRecord } from "./_types.js";
+export { ManifestKinds } from "./_types.js";
+export type { HttpErrorResponse } from "./_http-error.js";
+export { buildHttpErrorMessage } from "./_http-error.js";
+export { getOwnerURIComponent } from "./_github-package-owner.js";
+export { digestFromDigestTag, isDigestTag } from "./_digest-tag.js";

package/dist/core/index.js

@@ -0,0 +1,4 @@
+export { ManifestKinds } from "./_types.js";
+export { buildHttpErrorMessage } from "./_http-error.js";
+export { getOwnerURIComponent } from "./_github-package-owner.js";
+export { digestFromDigestTag, isDigestTag } from "./_digest-tag.js";

package/dist/db/_cleanup-run-writer.d.ts

@@ -0,0 +1,10 @@
+import type Database from "better-sqlite3";
+import { type DeletePlan } from "./planner/index.js";
+export declare class CleanupRunWriter {
+    #private;
+    constructor(database: Database.Database);
+    persistCleanupRun(scanId: number, plan: DeletePlan, options: {
+        dryRun: boolean;
+        cleanupStartedAt: string;
+    }): number;
+}