ghcr-manager 0.9.5 → 0.9.7

package/CHANGELOG.md

@@ -7,6 +7,55 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.7] - 2026-05-23
+
+### Added
+
+- The root action now prepares `cleanup` and `untag` CLI arguments through `tools/prepare-action-args.mjs`, keeping
+  printed and executed argument lists aligned.
+- Cleanup planning now traverses recursively beyond `sha256-*` helper-tag manifest links as well, if deeper helper
+  chains ever occur.
+
+### Changed
+
+- Cleanup dry-run output and GitHub step summaries were reworked to explain the plan more clearly, including a filters
+  table and clearer counts for tags, images, and cross-arch manifests.
+- Informational manifest classification was tuned so only real multi-arch roots are labeled `cross_arch_manifest`, while
+  helper-tagged indexes remain `index_manifest`.
+- `merge-run-artifacts` now uses a simpler current-run download flow with direct artifact download handling.
+- Cleanup selected-tag audit and DB-merge metadata handling were tightened alongside the summary/output refactor.
+
+### Fixed
+
+- `delete-orphaned-images` now carries orphaned `sha256-*` digest-tag targets through planner selection instead of
+  dropping them at the normal non-digest tag boundary.
+- Fully deletable cleanup execution now deletes the planned closure package versions instead of deleting only the root
+  package version.
+
+## [0.9.6] - 2026-05-21
+
+### Added
+
+- Cleanup audit now persists concrete selected tags in `cleanup_selected_tags`.
+- Cleanup schema docs now include a readable cleanup-decision view plus example SQL queries for audit inspection.
+- GHCR digest-tag helper relations are now modeled explicitly in scan data and manifest reachability.
+
+### Changed
+
+- Cleanup summary JSON now exposes derived affected manifests for fully deletable roots.
+- Cleanup Markdown now reads displayed counts from the summary arrays instead of carrying duplicate count fields.
+- Cleanup decision audit fields are now constrained more tightly in SQLite and TypeScript, including `selection_mode`,
+  `selection_reason`, and related block reason codes.
+- Digest-tag helper artifacts are now classified on `tags.is_digest_tag` and excluded from normal user-facing tag
+  selection and output.
+- Digest-tag helper terminology was simplified across code and SQL surfaces.
+- Schema docs now include a table of contents and collapsible example query blocks for easier GitHub browsing.
+
+### Fixed
+
+- Fixed remote action path handling for artifact upload and merge helper actions.
+- Cleanup reachability now follows digest-tag helper edges recursively, matching helper-artifact cascades more closely.
+
 ## [0.9.5] - 2026-05-21
 
 ### Changed

package/README.md

@@ -33,7 +33,7 @@ jobs:
 
       - name: Preview GHCR cleanup
         id: ghcr-manager
-        uses: gh-workflow/ghcr-manager@0.9.5
+        uses: gh-workflow/ghcr-manager@0.9.7
         with:
           command: cleanup
           token: ${{ github.token }}
@@ -72,7 +72,7 @@ The action supports three commands:
 ### Preview cleanup
 
 ```yaml
-- uses: gh-workflow/ghcr-manager@0.9.5
+- uses: gh-workflow/ghcr-manager@0.9.7
   with:
     command: cleanup
     token: ${{ github.token }}
@@ -82,7 +82,7 @@ The action supports three commands:
     delete-tags: |
       pr-.*
     use-regex: true
-    older-than: 30d
+    older-than: 30 days
     keep-n-tagged: "5"
     exclude-tags: |
       latest
@@ -93,7 +93,7 @@ The action supports three commands:
 ### Apply cleanup
 
 ```yaml
-- uses: gh-workflow/ghcr-manager@0.9.5
+- uses: gh-workflow/ghcr-manager@0.9.7
   with:
     command: cleanup
     token: ${{ github.token }}
@@ -112,7 +112,7 @@ Note: the second scan only runs if cleanup actually makes changes.
 ### Remove selected tags directly
 
 ```yaml
-- uses: gh-workflow/ghcr-manager@0.9.5
+- uses: gh-workflow/ghcr-manager@0.9.7
   with:
     command: untag
     token: ${{ github.token }}
@@ -128,7 +128,7 @@ Note: the second scan only runs if cleanup actually makes changes.
 ### Scan one package
 
 ```yaml
-- uses: gh-workflow/ghcr-manager@0.9.5
+- uses: gh-workflow/ghcr-manager@0.9.7
   with:
     command: scan
     token: ${{ github.token }}
@@ -169,11 +169,14 @@ Note: the second scan only runs if cleanup actually makes changes.
 
 `Cmds`: `s` = `scan`, `c` = `cleanup`, `u` = `untag`
 
-Cleanup notes:
+Cleanup command notes:
 
 - Tagged selector families may be combined with `delete-untagged`.
 - `exclude-tags` requires at least one tagged selector family.
 - `delete-untagged` and `keep-n-untagged` cannot be combined.
+- `older-than` takes one integer plus one unit.
+  - Supported `older-than` units: `minutes`, `hours`, `days`, `weeks`, `months`, `years`.
+  - Example values: `30 days`, `2 hours`, `1 month`.
 
 ## Outputs
 
@@ -199,12 +202,10 @@ Current naming:
 
 ## Documentation Map
 
-- [docs/action-usage.md](docs/action-usage.md): action commands, including `cleanup`, `scan`, and `untag`
-- [docs/db-merge-workflows.md](docs/db-merge-workflows.md): cleaning up multiple packages with one combined DB
-- [docs/schema-description.md](docs/schema-description.md): practical explanation of the SQLite schema
-- [docs/queries/missing-manifests-queries.md](docs/queries/missing-manifests-queries.md): SQL recipes for missing
-  manifest references
-- [docs/cli-usage.md](docs/cli-usage.md): companion CLI usage
+- [GitHub Action usage](docs/action-usage.md): action commands, including `cleanup`, `scan`, and `untag`
+- [Multi-package workflows](docs/db-merge-workflows.md): cleaning up multiple packages with one combined DB
+- [SQLite schema guide](docs/schema-description.md): practical explanation of the SQLite schema
+- [CLI usage](docs/cli-usage.md): companion CLI usage
 
 ## Acknowledgment
 

package/dist/cleanup-summary/_cleanup-summary-markdown.d.ts

@@ -2,5 +2,4 @@ import type { CleanupSummary } from "./_cleanup-summary.js";
 export declare function renderCleanupSummaryMarkdown(summary: CleanupSummary, options: {
     maxDirectTargetTags?: number;
     maxRootsPerSection?: number;
-    maxTagsPerRoot?: number;
 }): string;

package/dist/cleanup-summary/_cleanup-summary-markdown.js

@@ -1,10 +1,11 @@
+import { ManifestKinds } from "../core/index.js";
+import { DeletePlanValidationStatuses } from "../db/index.js";
 const _DEFAULT_MAX_DIRECT_TARGET_TAGS = 100;
 const _DEFAULT_MAX_ROOTS_PER_SECTION = 100;
-const _DEFAULT_MAX_TAGS_PER_ROOT = 4;
+const _DEFAULT_MAX_TAG_TEXT_LENGTH = 40;
 export function renderCleanupSummaryMarkdown(summary, options) {
     const maxDirectTargetTags = options.maxDirectTargetTags ?? _DEFAULT_MAX_DIRECT_TARGET_TAGS;
     const maxRootsPerSection = options.maxRootsPerSection ?? _DEFAULT_MAX_ROOTS_PER_SECTION;
-    const maxTagsPerRoot = options.maxTagsPerRoot ?? _DEFAULT_MAX_TAGS_PER_ROOT;
     const lines = [
         "## Cleanup Summary",
         "",
@@ -12,30 +13,62 @@ export function renderCleanupSummaryMarkdown(summary, options) {
         "| --- | --- |",
         `| 📦 Package | \`${_escapeInlineCode(`${summary.owner}/${summary.packageName}`)}\` |`,
         `| ⚙️ Mode | ${summary.dryRun ? "Cleanup dry-run" : "Cleanup"} |`,
-        `| 🏷️ Matched tags | ${summary.validationSummary.directTargetTagCount} |`,
-        `| 🗑️ Fully deletable roots | ${summary.validationSummary.fullyDeletableRootCount} |`,
-        `| 🔗 Untag-only roots | ${summary.validationSummary.untagOnlyRootCount} |`,
-        `| 🛡️ Blocked roots | ${summary.validationSummary.blockedDeleteRootCount} |`,
+        `| 🏷️ Selected tags | ${summary.directTargetTags.length} |`,
+        `| 🔖 Deleted tags | ${summary.changes.deletedTags} |`,
+        `| 🖼️ Deleted images | ${summary.changes.deletedImages} |`,
+        `| 📚 Deleted cross-arch manifests | ${summary.changes.deletedCrossArchManifests} |`,
+        `| 🧱 Deleted indexes | ${summary.changes.deletedIndexes} |`,
+        `| 📄 Deleted total | ${summary.changes.deletedTotal} |`,
+        `| 🔗 Tag-only updates | ${summary.untagOnlyRoots.length} |`,
+        `| 🛡️ Blocked items | ${summary.blockedRoots.length} |`,
         ""
     ];
-    lines.push(..._renderJsonDetails("⚙️ Cleanup filter", summary.plannerInputs));
+    lines.push(..._renderPlannedDeleteBreakdown(summary));
+    lines.push(..._renderPlannerInputs(summary.plannerInputs));
     lines.push(..._renderDirectTargetTags(summary.directTargetTags, maxDirectTargetTags));
-    lines.push(..._renderRootSection("🗑️ Fully deletable roots", summary.fullyDeletableRoots, maxRootsPerSection, maxTagsPerRoot));
-    lines.push(..._renderRootSection("🔗 Untag-only roots", summary.untagOnlyRoots, maxRootsPerSection, maxTagsPerRoot));
-    lines.push(..._renderRootSection("🛡️ Blocked roots", summary.blockedRoots, maxRootsPerSection, maxTagsPerRoot));
+    lines.push(..._renderRootSection("🗑️ Deleted items", summary.fullyDeletableRoots, maxRootsPerSection));
+    lines.push(..._renderRootSection("🔗 Tags removed only", summary.untagOnlyRoots, maxRootsPerSection));
+    lines.push(..._renderRootSection("🛡️ Blocked items", summary.blockedRoots, maxRootsPerSection));
     if (!summary.dryRun && (summary.deletedPackageVersions.length > 0 || summary.untaggedTags.length > 0)) {
         lines.push(..._renderLiveEffects(summary));
     }
     return `${lines.join("\n").trimEnd()}\n`;
 }
-function _renderJsonDetails(title, value) {
+function _renderPlannedDeleteBreakdown(summary) {
+    const rows = [
+        { label: "Images", count: summary.changes.deletedImages },
+        { label: "Cross-arch manifests", count: summary.changes.deletedCrossArchManifests },
+        { label: "Artifact manifests", count: summary.changes.deletedArtifactManifests },
+        { label: "Signatures", count: summary.changes.deletedSignatures },
+        { label: "Attestations", count: summary.changes.deletedAttestations },
+        { label: "Generic indexes", count: summary.changes.deletedIndexes }
+    ].filter((row) => row.count > 0);
+    if (rows.length === 0) {
+        return [];
+    }
+    return [
+        "<details>",
+        "<summary>📦 Deleted item breakdown</summary>",
+        "",
+        "| Type | Count |",
+        "| --- | --- |",
+        ...rows.map((row) => `| ${row.label} | ${row.count} |`),
+        "",
+        "</details>",
+        ""
+    ];
+}
+function _renderPlannerInputs(plannerInputs) {
+    const rows = _getPlannerInputRows(plannerInputs);
+    const patternLines = _getPlannerPatternLines(plannerInputs);
     return [
-        `<details>`,
-        `<summary>${title}</summary>`,
+        "<details>",
+        "<summary>⚙️ Cleanup filter</summary>",
         "",
-        "```json",
-        JSON.stringify(value, null, 2),
-        "```",
+        "| Filter | Value |",
+        "| --- | --- |",
+        ...(rows.length > 0 ? rows : ["| (none) | No cleanup filters recorded |"]),
+        ...(patternLines.length > 0 ? ["", ...patternLines] : []),
         "",
         "</details>",
         ""
@@ -46,23 +79,24 @@ function _renderDirectTargetTags(tags, maxDirectTargetTags) {
         return [];
     }
     const visibleTags = tags.slice(0, maxDirectTargetTags).map((tag) => `- \`${_escapeInlineCode(tag)}\``);
-    const lines = ["<details>", "<summary>🏷️ Matched tags</summary>", "", ...visibleTags];
+    const lines = ["<details>", "<summary>🏷️ Selected tags</summary>", "", ...visibleTags];
     if (tags.length > maxDirectTargetTags) {
-        lines.push("", `_Showing first ${maxDirectTargetTags} of ${tags.length} matched tags._`);
+        lines.push("", `_Showing first ${maxDirectTargetTags} of ${tags.length} selected tags._`);
     }
     lines.push("", "</details>", "");
     return lines;
 }
-function _renderRootSection(title, roots, maxRootsPerSection, maxTagsPerRoot) {
+function _renderRootSection(title, roots, maxRootsPerSection) {
     if (roots.length === 0) {
         return [];
     }
     const lines = ["<details>", `<summary>${title}</summary>`, ""];
-    lines.push("| Version | Digest | Tags | Reason |");
-    lines.push("| --- | --- | --- | --- |");
+    lines.push("| Version | Type | Digest | Tags | Outcome |");
+    lines.push("| --- | --- | --- | --- | --- |");
     for (const root of roots.slice(0, maxRootsPerSection)) {
-        lines.push(`| ${root.versionId} | \`${_escapeInlineCode(_shortDigest(root.digest))}\` | ${_escapeMarkdown(_formatTags(root, maxTagsPerRoot))} | ${_escapeMarkdown(_formatReason(root))} |`);
+        lines.push(`| ${root.versionId} | ${_escapeMarkdown(_describeManifestKind(root.manifestKind))} | \`${_escapeInlineCode(_shortDigest(root.digest))}\` | ${_escapeMarkdown(_formatTags(root))} | ${_escapeMarkdown(_formatReason(root))} |`);
     }
+    lines.push("", "_Tag lists may be truncated for table width._");
     if (roots.length > maxRootsPerSection) {
         lines.push("", `_Showing first ${maxRootsPerSection} of ${roots.length} ${title.toLowerCase()}._`);
     }
@@ -79,25 +113,27 @@ function _renderLiveEffects(summary) {
     lines.push("");
     return lines;
 }
-function _formatTags(root, maxTagsPerRoot) {
+function _formatTags(root) {
     const tags = root.rootTags.length > 0 ? root.rootTags : root.matchedTags;
     if (tags.length === 0) {
         return "(untagged)";
     }
-    const visible = tags.slice(0, maxTagsPerRoot);
-    const suffix = tags.length > maxTagsPerRoot ? `, +${tags.length - maxTagsPerRoot} more` : "";
-    return visible.join(", ") + suffix;
+    const joinedTags = tags.join(", ");
+    if (joinedTags.length <= _DEFAULT_MAX_TAG_TEXT_LENGTH) {
+        return joinedTags;
+    }
+    return `${joinedTags.slice(0, _DEFAULT_MAX_TAG_TEXT_LENGTH - 3)}...`;
 }
 function _formatReason(root) {
-    if (root.validationStatus === "blocked") {
-        const blocking = root.blockingDigest ? _shortDigest(root.blockingDigest) : "another root";
+    if (root.validationStatus === DeletePlanValidationStatuses.blocked) {
+        const blocking = root.blockingDigest ? _shortDigest(root.blockingDigest) : "another item";
         const overlap = root.overlapDigest ? ` via ${_shortDigest(root.overlapDigest)}` : "";
-        return `Blocked by ${blocking}${overlap}`;
+        return `Blocked by retained item ${blocking}${overlap}`;
     }
-    if (root.validationStatus === "untag-only") {
-        return "Selected tags detach; root remains";
+    if (root.validationStatus === DeletePlanValidationStatuses.untagOnly) {
+        return "Remove selected tags, keep item";
     }
-    return "Root and closure can be deleted";
+    return "Delete item and descendants";
 }
 function _shortDigest(value) {
     if (!value.startsWith("sha256:") || value.length <= 20) {
@@ -111,3 +147,81 @@ function _escapeInlineCode(value) {
 function _escapeMarkdown(value) {
     return value.replaceAll("|", "\\|").replaceAll("\n", " ");
 }
+function _getPlannerInputRows(plannerInputs) {
+    const rows = [];
+    for (const [key, value] of Object.entries(plannerInputs)) {
+        rows.push(`| ${_escapeMarkdown(_plannerInputLabel(key))} | ${_escapeMarkdown(_formatPlannerInputValue(value))} |`);
+    }
+    return rows;
+}
+function _plannerInputLabel(key) {
+    switch (key) {
+        case "deleteTags":
+            return "Delete tags";
+        case "excludeTags":
+            return "Exclude tags";
+        case "useRegex":
+            return "Use regex";
+        case "deleteUntagged":
+            return "Delete untagged";
+        case "keepNTagged":
+            return "Keep newest tagged";
+        case "keepNUntagged":
+            return "Keep newest untagged";
+        case "olderThan":
+            return "Older than";
+        case "cutoffTimestamp":
+            return "Cutoff timestamp";
+        case "deleteGhostImages":
+            return "Delete ghost images";
+        case "deletePartialImages":
+            return "Delete partial images";
+        case "deleteOrphanedImages":
+            return "Delete orphaned images";
+        default:
+            return key;
+    }
+}
+function _formatPlannerInputValue(value) {
+    if (Array.isArray(value)) {
+        if (value.length === 0) {
+            return "(none)";
+        }
+        return value.length === 1 ? "1 pattern" : `${value.length} patterns`;
+    }
+    if (typeof value === "boolean") {
+        return value ? "yes" : "no";
+    }
+    return String(value);
+}
+function _getPlannerPatternLines(plannerInputs) {
+    const lines = [];
+    for (const [key, value] of Object.entries(plannerInputs)) {
+        if (!Array.isArray(value) || value.length === 0) {
+            continue;
+        }
+        lines.push(`- ${_plannerInputLabel(key)}:`);
+        for (const item of value) {
+            lines.push(`  - \`${_escapeInlineCode(String(item))}\``);
+        }
+    }
+    return lines;
+}
+function _describeManifestKind(manifestKind) {
+    switch (manifestKind) {
+        case ManifestKinds.imageManifest:
+            return "image";
+        case ManifestKinds.crossArchManifest:
+            return "cross-arch";
+        case ManifestKinds.indexManifest:
+            return "index";
+        case ManifestKinds.signatureManifest:
+            return "signature";
+        case ManifestKinds.attestationManifest:
+            return "attestation";
+        case ManifestKinds.artifactManifest:
+            return "artifact";
+        default:
+            return "item";
+    }
+}

package/dist/cleanup-summary/_cleanup-summary.d.ts

@@ -1,20 +1,35 @@
-import type { DeletePlan } from "../db/index.js";
+import type { ManifestKind } from "../core/index.js";
+import type { DeletePlan, DeletePlanSelectionMode, DeletePlanSelectionReason, DeletePlanValidationReasonCode, DeletePlanValidationStatus } from "../db/index.js";
 import type { DeleteExecutionSummary } from "../execute/index.js";
 export interface CleanupSummaryRoot {
     versionId: number;
     digest: string;
-    manifestKind?: string;
+    manifestKind?: ManifestKind;
     rootTags: string[];
     matchedTags: string[];
-    selectionMode: string;
-    selectionReason: string;
-    validationStatus: "fully-deletable" | "blocked" | "untag-only";
-    validationReasonCode: "untag-only-partial-tag-match" | "fully-deletable-no-retained-overlap" | "blocked-overlap-with-retained-root";
+    selectionMode: DeletePlanSelectionMode;
+    selectionReason: DeletePlanSelectionReason;
+    validationStatus: DeletePlanValidationStatus;
+    validationReasonCode: DeletePlanValidationReasonCode;
     validationReason: string;
     blockingVersionId?: number;
     blockingDigest?: string;
     overlapDigest?: string;
-    overlapManifestKind?: string;
+    overlapManifestKind?: ManifestKind;
+}
+export interface CleanupSummaryAffectedManifest {
+    digest: string;
+    manifestKind?: ManifestKind;
+}
+export interface CleanupSummaryChanges {
+    deletedTags: number;
+    deletedImages: number;
+    deletedIndexes: number;
+    deletedCrossArchManifests: number;
+    deletedArtifactManifests: number;
+    deletedAttestations: number;
+    deletedSignatures: number;
+    deletedTotal: number;
 }
 export interface CleanupSummary {
     command: "cleanup";
@@ -23,18 +38,20 @@ export interface CleanupSummary {
     scanCompletedAt: string;
     dryRun: boolean;
     plannerInputs: DeletePlan["plannerInputs"];
-    validationSummary: DeletePlan["validationSummary"];
     directTargetTags: string[];
     collateralTags: string[];
     fullyDeletableRoots: CleanupSummaryRoot[];
     untagOnlyRoots: CleanupSummaryRoot[];
     blockedRoots: CleanupSummaryRoot[];
+    affectedManifests: CleanupSummaryAffectedManifest[];
+    changes: CleanupSummaryChanges;
     deletedPackageVersions: DeleteExecutionSummary["deletedPackageVersions"];
     untaggedTags: DeleteExecutionSummary["untaggedTags"];
     unsupportedUntagRoots: DeleteExecutionSummary["unsupportedUntagRoots"];
 }
 export declare function buildCleanupSummary(plan: DeletePlan, options: {
     dryRun: boolean;
-    listRootTags: (versionId: number) => string[];
+    rootTagsByVersionId: ReadonlyMap<number, string[]>;
+    changes: CleanupSummaryChanges;
     executionSummary?: DeleteExecutionSummary;
 }): CleanupSummary;

package/dist/cleanup-summary/_cleanup-summary.js

@@ -1,6 +1,11 @@
+import { DeletePlanValidationStatuses } from "../db/index.js";
 export function buildCleanupSummary(plan, options) {
     const directTargetTagSet = new Set(plan.directTargetTags);
-    const roots = plan.rootDecisions.map((decision) => _mapRootDecision(decision, directTargetTagSet, options.listRootTags));
+    const roots = plan.rootDecisions.map((decision) => _mapRootDecision(decision, directTargetTagSet, options.rootTagsByVersionId));
+    const fullyDeletableRoots = roots.filter((root) => root.validationStatus === DeletePlanValidationStatuses.fullyDeletable);
+    const blockedRoots = roots.filter((root) => root.validationStatus === DeletePlanValidationStatuses.blocked);
+    const untagOnlyRoots = roots.filter((root) => root.validationStatus === DeletePlanValidationStatuses.untagOnly);
+    const affectedManifests = _listAffectedManifests(plan, fullyDeletableRoots.map((root) => root.digest));
     return {
         command: "cleanup",
         owner: plan.owner,
@@ -8,19 +13,20 @@ export function buildCleanupSummary(plan, options) {
         scanCompletedAt: plan.scanCompletedAt,
         dryRun: options.dryRun,
         plannerInputs: plan.plannerInputs,
-        validationSummary: plan.validationSummary,
         directTargetTags: plan.directTargetTags,
         collateralTags: plan.collateralTags,
-        fullyDeletableRoots: roots.filter((root) => root.validationStatus === "fully-deletable"),
-        untagOnlyRoots: roots.filter((root) => root.validationStatus === "untag-only"),
-        blockedRoots: roots.filter((root) => root.validationStatus === "blocked"),
+        fullyDeletableRoots,
+        untagOnlyRoots,
+        blockedRoots,
+        affectedManifests,
+        changes: options.changes,
         deletedPackageVersions: options.executionSummary?.deletedPackageVersions ?? [],
         untaggedTags: options.executionSummary?.untaggedTags ?? [],
         unsupportedUntagRoots: options.executionSummary?.unsupportedUntagRoots ?? []
     };
 }
-function _mapRootDecision(decision, directTargetTagSet, listRootTags) {
-    const rootTags = listRootTags(decision.versionId);
+function _mapRootDecision(decision, directTargetTagSet, rootTagsByVersionId) {
+    const rootTags = rootTagsByVersionId.get(decision.versionId) ?? [];
     return {
         versionId: decision.versionId,
         digest: decision.digest,
@@ -38,3 +44,17 @@ function _mapRootDecision(decision, directTargetTagSet, listRootTags) {
         overlapManifestKind: decision.overlapManifestKind
     };
 }
+function _listAffectedManifests(plan, fullyDeletableRootDigests) {
+    const fullyDeletableRootDigestSet = new Set(fullyDeletableRootDigests);
+    const manifestsByDigest = new Map();
+    for (const manifest of plan.closureManifests) {
+        if (!fullyDeletableRootDigestSet.has(manifest.sourceDigest)) {
+            continue;
+        }
+        manifestsByDigest.set(manifest.memberDigest, {
+            digest: manifest.memberDigest,
+            manifestKind: manifest.memberManifestKind
+        });
+    }
+    return [...manifestsByDigest.values()].sort((left, right) => left.digest.localeCompare(right.digest));
+}

package/dist/cleanup-summary/index.d.ts

@@ -1,2 +1,2 @@
-export { buildCleanupSummary, type CleanupSummary, type CleanupSummaryRoot } from "./_cleanup-summary.js";
+export { buildCleanupSummary, type CleanupSummary, type CleanupSummaryAffectedManifest, type CleanupSummaryChanges, type CleanupSummaryRoot } from "./_cleanup-summary.js";
 export { renderCleanupSummaryMarkdown } from "./_cleanup-summary-markdown.js";

package/dist/cli/_cleanup-command.js

@@ -1,7 +1,9 @@
+import { ManifestKinds } from "../core/index.js";
 import { buildCleanupSummary } from "../cleanup-summary/index.js";
 import { CleanupRunWriter, openDatabase, PlannerRepository } from "../db/index.js";
 import { executeDeletePlan } from "../execute/index.js";
 import { hasFlag, resolveLogLevel, resolveToken } from "./_args.js";
+import { writeJsonOutput } from "./_json-output.js";
 import { createLogger } from "./_logger.js";
 import { loadDeletePlan, resolvePlanCommandInputs } from "./_planner-options.js";
 import { resolveTagSelectors } from "./_tag-selector-resolver.js";
@@ -14,19 +16,22 @@ export async function handleCleanup(args) {
     try {
         const repository = new PlannerRepository(database, logger);
         const cleanupRunWriter = new CleanupRunWriter(database);
+        const scanId = repository.getLatestCompletedScanId(inputs.owner, inputs.packageName);
         logger.debug(`Starting cleanup for ${inputs.owner}/${inputs.packageName}`);
         const plan = loadDeletePlan(repository, resolveTagSelectors(database, inputs));
-        cleanupRunWriter.persistCleanupRun(repository.getLatestCompletedScanId(inputs.owner, inputs.packageName), plan, {
+        const rootTagsByVersionId = _loadRootTagsByVersionId(database, inputs.owner, inputs.packageName, plan.rootDecisions.map((decision) => decision.versionId));
+        const cleanupRunId = cleanupRunWriter.persistCleanupRun(scanId, plan, {
             dryRun,
             cleanupStartedAt: new Date().toISOString()
         });
         if (dryRun) {
             const summary = buildCleanupSummary(plan, {
                 dryRun: true,
-                listRootTags: (versionId) => _listRootTags(database, inputs.owner, inputs.packageName, versionId)
+                rootTagsByVersionId,
+                changes: _loadSummaryChanges(database, cleanupRunId)
             });
             logger.debug(`Completed dry-run cleanup for ${inputs.owner}/${inputs.packageName}`);
-            console.log(JSON.stringify(summary));
+            writeJsonOutput(args, "--summary-json-path", summary);
             return 0;
         }
         const executionSummary = await executeDeletePlan(plan, {
@@ -36,11 +41,12 @@ export async function handleCleanup(args) {
         });
         const summary = buildCleanupSummary(plan, {
             dryRun: false,
-            listRootTags: (versionId) => _listRootTags(database, inputs.owner, inputs.packageName, versionId),
+            rootTagsByVersionId,
+            changes: _loadSummaryChanges(database, cleanupRunId),
             executionSummary
         });
         logger.debug(`Completed cleanup for ${inputs.owner}/${inputs.packageName}`);
-        console.log(JSON.stringify(summary));
+        writeJsonOutput(args, "--summary-json-path", summary);
         return 0;
     }
     finally {
@@ -56,8 +62,81 @@ function _listRootTags(database, owner, packageName, versionId) {
         WHERE latest_scan.owner = ?
           AND latest_scan.package_name = ?
           AND tags.version_id = ?
+          AND tags.is_digest_tag = 0
         ORDER BY tags.tag
       `)
         .all(owner, packageName, versionId);
     return rows.map((row) => row.tag);
 }
+function _loadRootTagsByVersionId(database, owner, packageName, versionIds) {
+    const requestedVersionIds = new Set(versionIds);
+    const tagsByVersionId = new Map();
+    for (const versionId of requestedVersionIds) {
+        tagsByVersionId.set(versionId, []);
+    }
+    if (requestedVersionIds.size === 0) {
+        return tagsByVersionId;
+    }
+    const rows = database
+        .prepare(`
+        SELECT tags.version_id, tags.tag
+        FROM tags
+        INNER JOIN v_latest_scan_per_package latest_scan ON latest_scan.scan_id = tags.scan_id
+        WHERE latest_scan.owner = ?
+          AND latest_scan.package_name = ?
+          AND tags.is_digest_tag = 0
+        ORDER BY tags.version_id, tags.tag
+      `)
+        .all(owner, packageName);
+    for (const row of rows) {
+        if (!requestedVersionIds.has(row.version_id)) {
+            continue;
+        }
+        tagsByVersionId.get(row.version_id)?.push(row.tag);
+    }
+    return tagsByVersionId;
+}
+function _loadSummaryChanges(database, cleanupRunId) {
+    const deletedTags = database
+        .prepare(`
+          SELECT COUNT(*) AS count
+          FROM cleanup_selected_tags
+          WHERE cleanup_run_id = ?
+            AND is_deleted = 1
+        `)
+        .get(cleanupRunId).count;
+    const manifestCounts = database
+        .prepare(`
+        WITH fully_deletable_manifests AS (
+          SELECT DISTINCT
+            reachable.descendant_digest AS digest,
+            manifest.manifest_kind
+          FROM cleanup_root_decisions decision
+          JOIN manifest_reachability reachable
+            ON reachable.scan_id = decision.scan_id
+           AND reachable.ancestor_digest = decision.digest
+          JOIN manifests manifest
+            ON manifest.scan_id = reachable.scan_id
+           AND manifest.digest = reachable.descendant_digest
+          WHERE decision.cleanup_run_id = ?
+            AND decision.validation_status = 'fully-deletable'
+        )
+        SELECT
+          manifest_kind,
+          COUNT(*) AS count
+        FROM fully_deletable_manifests
+        GROUP BY manifest_kind
+      `)
+        .all(cleanupRunId);
+    const countsByKind = new Map(manifestCounts.map((row) => [row.manifest_kind ?? "", row.count]));
+    return {
+        deletedTags,
+        deletedImages: countsByKind.get(ManifestKinds.imageManifest) ?? 0,
+        deletedIndexes: countsByKind.get(ManifestKinds.indexManifest) ?? 0,
+        deletedCrossArchManifests: countsByKind.get(ManifestKinds.crossArchManifest) ?? 0,
+        deletedArtifactManifests: countsByKind.get(ManifestKinds.artifactManifest) ?? 0,
+        deletedAttestations: countsByKind.get(ManifestKinds.attestationManifest) ?? 0,
+        deletedSignatures: countsByKind.get(ManifestKinds.signatureManifest) ?? 0,
+        deletedTotal: manifestCounts.reduce((total, row) => total + row.count, 0)
+    };
+}

package/dist/cli/_json-output.d.ts

@@ -0,0 +1 @@
+export declare function writeJsonOutput(args: string[], optionName: string, payload: unknown): void;

package/dist/cli/_json-output.js

@@ -0,0 +1,11 @@
+import { writeFileSync } from "node:fs";
+import { findOption } from "./_args.js";
+export function writeJsonOutput(args, optionName, payload) {
+    const json = JSON.stringify(payload);
+    const outputPath = findOption(args, optionName);
+    if (outputPath) {
+        writeFileSync(outputPath, `${json}\n`, "utf8");
+        return;
+    }
+    console.log(json);
+}