ghcr-manager 0.9.6 → 0.9.8

package/CHANGELOG.md

@@ -7,6 +7,69 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.8] - 2026-06-03
+
+### Added
+
+- Added dedicated graph-matrix GHCR scenarios and workflows to exercise shared-image, multi-arch, cosign, and
+  attestation cleanup cases in isolation.
+- Added a local manifest-graph visualizer with browser UI for `ghcr-manager` SQLite databases, including manifest
+  details, zoom controls, one-hop expansion, and scan-to-scan compare mode.
+- Added a separately publishable npm package, `ghcr-manager-visualizer`, plus user-facing visualizer documentation.
+- Added repo-local manual visualizer demo scripts for seeding and updating GHCR packages during graph investigation.
+
+### Changed
+
+- Cleanup planning was reworked around the current graph model, including direct SQL-backed tagged/untagged root
+  selection, graph-scoped closure walking, and refined `untag-only` vs `fully-deletable` decisions for complex
+  multi-arch, cosign, and attestation shapes.
+- Large planner SQL bodies were split into smaller internal modules, and direct-target root selection logic was split
+  into smaller planner helpers.
+- Orphaned digest-tag resolution now uses a direct latest-scan query instead of relying on older helper views.
+- Manifest platform display now derives from descriptor data in the visualizer instead of relying on manifest-level
+  platform fields.
+- Cross-architecture terminology is now consistently named `multi-arch` across runtime, tests, and docs.
+- The root action and public CLI surface are now centered on `scan` and `cleanup` only.
+
+### Fixed
+
+- Fixed digest-tag helper-edge direction and root-detection behavior so helper-tagged artifacts no longer interfere with
+  normal cleanup root semantics.
+- Fixed shared-graph cleanup handling so selected indexes and helper-linked artifacts are deleted or retained according
+  to surviving real tags instead of simplistic descendant-only closure rules.
+
+### Removed
+
+- The public `untag` CLI command, root-action mode, and dedicated direct-untag workflow coverage were removed. Internal
+  tag detachment for partial-tag cleanup matches remains part of `cleanup`.
+- Several older cleanup helper views were removed after the planner rewrite moved the live logic into direct SQL query
+  paths.
+
+## [0.9.7] - 2026-05-23
+
+### Added
+
+- The root action now prepares `cleanup` and `untag` CLI arguments through `tools/prepare-action-args.mjs`, keeping
+  printed and executed argument lists aligned.
+- Cleanup planning now traverses recursively beyond `sha256-*` helper-tag manifest links as well, if deeper helper
+  chains ever occur.
+
+### Changed
+
+- Cleanup dry-run output and GitHub step summaries were reworked to explain the plan more clearly, including a filters
+  table and clearer counts for tags, images, and cross-arch manifests.
+- Informational manifest classification was tuned so only real multi-arch roots are labeled `multi_arch_manifest`, while
+  helper-tagged indexes remain `index_manifest`.
+- `merge-run-artifacts` now uses a simpler current-run download flow with direct artifact download handling.
+- Cleanup selected-tag audit and DB-merge metadata handling were tightened alongside the summary/output refactor.
+
+### Fixed
+
+- `delete-orphaned-images` now carries orphaned `sha256-*` digest-tag targets through planner selection instead of
+  dropping them at the normal non-digest tag boundary.
+- Fully deletable cleanup execution now deletes the planned closure package versions instead of deleting only the root
+  package version.
+
 ## [0.9.6] - 2026-05-21
 
 ### Added

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 gh-workflow
+Copyright (c) 2026 Stefan Kuhn
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,9 +1,9 @@
 # ghcr-manager
 
-[![Release](https://img.shields.io/github/v/release/gh-workflow/ghcr-manager?style=flat-square)](https://github.com/gh-workflow/ghcr-manager/releases)
-[![Immutable Releases](https://img.shields.io/badge/releases-immutable-blue?labelColor=333)](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases)
 [![GitHub Marketplace](https://img.shields.io/badge/marketplace-ghcr--manager-blue?logo=github&labelColor=333&style=flat-square)](https://github.com/marketplace/actions/ghcr-manager)
-[![Tests](https://img.shields.io/github/actions/workflow/status/gh-workflow/ghcr-manager/.github/workflows/ci_change-validation.yml?branch=main&label=test&style=flat-square)](https://github.com/gh-workflow/ghcr-manager/actions/workflows/change-validation.yml)
+[![Release](https://img.shields.io/github/v/release/ghcr-manager/ghcr-manager?style=flat-square)](https://github.com/ghcr-manager/ghcr-manager/releases)
+[![Immutable Releases](https://img.shields.io/badge/releases-immutable-blue?labelColor=333)](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases)
+[![Tests](https://img.shields.io/github/actions/workflow/status/ghcr-manager/ghcr-manager/.github/workflows/ci_change-validation.yml?branch=main&label=test&style=flat-square)](https://github.com/ghcr-manager/ghcr-manager/actions/workflows/ci_change-validation.yml)
 
 Inspect, review, and manage GitHub Container Registry packages.
 
@@ -12,7 +12,6 @@ Inspect, review, and manage GitHub Container Registry packages.
 - scanning one GHCR package into a SQLite database artifact
 - running cleanup with a GitHub step summary and optional DB artifact
 - previewing cleanup decisions with `dry-run` before making changes
-- directly removing selected tags with `untag`
 
 ## Quick Start
 
@@ -33,7 +32,7 @@ jobs:
 
       - name: Preview GHCR cleanup
         id: ghcr-manager
-        uses: gh-workflow/ghcr-manager@0.9.6
+        uses: ghcr-manager/ghcr-manager@0.9.8
         with:
           command: cleanup
           token: ${{ github.token }}
@@ -55,16 +54,14 @@ After the run:
 
 ## Commands
 
-The action supports three commands:
+The action supports two commands:
 
 - `cleanup`: Cleans using filters; use `dry-run` to preview the result
-- `untag`: Removes one or more tags directly
 - `scan`: Scans one package and uploads the resulting DB artifact
 
 ### Purpose of commands
 
 - `cleanup`: Normal entry point for registry maintenance
-- `untag`: Works directly without a full package scan
 - `scan`: For investigation and audit
 
 ## Common Usage
@@ -72,7 +69,7 @@ The action supports three commands:
 ### Preview cleanup
 
 ```yaml
-- uses: gh-workflow/ghcr-manager@0.9.6
+- uses: ghcr-manager/ghcr-manager@0.9.8
   with:
     command: cleanup
     token: ${{ github.token }}
@@ -82,7 +79,7 @@ The action supports three commands:
     delete-tags: |
       pr-.*
     use-regex: true
-    older-than: 30d
+    older-than: 30 days
     keep-n-tagged: "5"
     exclude-tags: |
       latest
@@ -93,7 +90,7 @@ The action supports three commands:
 ### Apply cleanup
 
 ```yaml
-- uses: gh-workflow/ghcr-manager@0.9.6
+- uses: ghcr-manager/ghcr-manager@0.9.8
   with:
     command: cleanup
     token: ${{ github.token }}
@@ -109,26 +106,10 @@ If `scan-after-cleanup` is `true`, `cleanup` performs a second scan so the uploa
 
 Note: the second scan only runs if cleanup actually makes changes.
 
-### Remove selected tags directly
-
-```yaml
-- uses: gh-workflow/ghcr-manager@0.9.6
-  with:
-    command: untag
-    token: ${{ github.token }}
-    owner: OWNER
-    package: PACKAGE
-    delete-tags: |
-      old-tag
-      test-tag
-```
-
-`untag` does not use a scan DB and does not support DB artifact upload.
-
 ### Scan one package
 
 ```yaml
-- uses: gh-workflow/ghcr-manager@0.9.6
+- uses: ghcr-manager/ghcr-manager@0.9.8
   with:
     command: scan
     token: ${{ github.token }}
@@ -142,45 +123,48 @@ Note: the second scan only runs if cleanup actually makes changes.
 
 <!-- markdownlint-disable MD013 MD060 -->
 
-| Input                        | Description                         | Cmds | Required    | Default                        |
-| ---------------------------- | ----------------------------------- | ---- | ----------- | ------------------------------ |
-| `command`                    | `scan`, `cleanup`, or `untag`       | all  | Yes         |                                |
-| `token`                      | GitHub token for API calls          | all  | Yes         | `${{ github.token }}`          |
-| `owner`                      | Package owner                       | all  | Yes         |                                |
-| `package`                    | Package name                        | all  | Yes         |                                |
-| `db-path`                    | Local SQLite DB path                | s,c  | No          |                                |
-| `upload-artifacts`           | Upload DB and summary artifacts     | s,c  | No          | `false`                        |
-| `scan-after-cleanup`         | Run a second scan after cleanup     | c    | No          | `false`                        |
-| `db-artifact-retention-days` | Override artifact retention days    | s,c  | No          | `${{ github.retention_days }}` |
-| `delete-tags`                | Newline-separated tags to delete    | c,u  | for `untag` |                                |
-| `exclude-tags`               | Newline-separated tags to exclude   | c    | No          |                                |
-| `keep-n-tagged`              | Keep newest tagged roots            | c    | No          |                                |
-| `keep-n-untagged`            | Keep newest untagged roots          | c    | No          |                                |
-| `delete-untagged`            | Delete untagged roots               | c    | No          | `false`                        |
-| `delete-ghost-images`        | Delete ghost multi-arch roots       | c    | No          | `false`                        |
-| `delete-partial-images`      | Delete partial multi-arch roots     | c    | No          | `false`                        |
-| `delete-orphaned-images`     | Delete orphaned digest-derived tags | c    | No          | `false`                        |
-| `older-than`                 | Age cutoff for cleanup selectors    | c    | No          |                                |
-| `use-regex`                  | Use regex for cleanup tag selectors | c    | No          | `false`                        |
-| `dry-run`                    | Show changes without mutating GHCR  | c,u  | No          | `false`                        |
-| `log-level`                  | CLI log level                       | all  | No          | `info`                         |
+| Input                        | Description                         | Cmds | Required | Default                        |
+| ---------------------------- | ----------------------------------- | ---- | -------- | ------------------------------ |
+| `command`                    | `scan` or `cleanup`                 | all  | Yes      |                                |
+| `token`                      | GitHub token for API calls          | all  | Yes      | `${{ github.token }}`          |
+| `owner`                      | Package owner                       | all  | Yes      |                                |
+| `package`                    | Package name                        | all  | Yes      |                                |
+| `db-path`                    | Local SQLite DB path                | s,c  | No       |                                |
+| `upload-artifacts`           | Upload DB and summary artifacts     | s,c  | No       | `false`                        |
+| `scan-after-cleanup`         | Run a second scan after cleanup     | c    | No       | `false`                        |
+| `db-artifact-retention-days` | Override artifact retention days    | s,c  | No       | `${{ github.retention_days }}` |
+| `delete-tags`                | Newline-separated tags to delete    | c    | No       |                                |
+| `exclude-tags`               | Newline-separated tags to exclude   | c    | No       |                                |
+| `keep-n-tagged`              | Keep newest tagged roots            | c    | No       |                                |
+| `keep-n-untagged`            | Keep newest untagged roots          | c    | No       |                                |
+| `delete-untagged`            | Delete untagged roots               | c    | No       | `false`                        |
+| `delete-ghost-images`        | Delete ghost multi-arch roots       | c    | No       | `false`                        |
+| `delete-partial-images`      | Delete partial multi-arch roots     | c    | No       | `false`                        |
+| `delete-orphaned-images`     | Delete orphaned digest-derived tags | c    | No       | `false`                        |
+| `older-than`                 | Age cutoff for cleanup selectors    | c    | No       |                                |
+| `use-regex`                  | Use regex for cleanup tag selectors | c    | No       | `false`                        |
+| `dry-run`                    | Show changes without mutating GHCR  | c    | No       | `false`                        |
+| `log-level`                  | CLI log level                       | all  | No       | `info`                         |
 
 <!-- markdownlint-enable MD013 MD060 -->
 
-`Cmds`: `s` = `scan`, `c` = `cleanup`, `u` = `untag`
+`Cmds`: `s` = `scan`, `c` = `cleanup`
 
-Cleanup notes:
+Cleanup command notes:
 
 - Tagged selector families may be combined with `delete-untagged`.
 - `exclude-tags` requires at least one tagged selector family.
 - `delete-untagged` and `keep-n-untagged` cannot be combined.
+- `older-than` takes one integer plus one unit.
+  - Supported `older-than` units: `minutes`, `hours`, `days`, `weeks`, `months`, `years`.
+  - Example values: `30 days`, `2 hours`, `1 month`.
 
 ## Outputs
 
-| Output              | Description                                      |
-| ------------------- | ------------------------------------------------ |
-| `db-path`           | SQLite DB path on the runner                     |
-| `summary-json-path` | Summary JSON file path for `cleanup` and `untag` |
+| Output              | Description                          |
+| ------------------- | ------------------------------------ |
+| `db-path`           | SQLite DB path on the runner         |
+| `summary-json-path` | Summary JSON file path for `cleanup` |
 
 ## Artifacts
 
@@ -188,7 +172,6 @@ When artifacts are enabled:
 
 - `scan` always uploads one SQLite DB artifact
 - `cleanup` optionally uploads the DB artifact and a cleanup summary JSON artifact
-- `untag` uploads no artifacts
 
 Current naming:
 
@@ -199,12 +182,11 @@ Current naming:
 
 ## Documentation Map
 
-- [docs/action-usage.md](docs/action-usage.md): action commands, including `cleanup`, `scan`, and `untag`
-- [docs/db-merge-workflows.md](docs/db-merge-workflows.md): cleaning up multiple packages with one combined DB
-- [docs/schema-description.md](docs/schema-description.md): practical explanation of the SQLite schema
-- [docs/queries/missing-manifests-queries.md](docs/queries/missing-manifests-queries.md): SQL recipes for missing
-  manifest references
-- [docs/cli-usage.md](docs/cli-usage.md): companion CLI usage
+- [GitHub Action usage](docs/action-usage.md): action commands, including `cleanup` and `scan`
+- [Visualizer](docs/visualizer.md): local graph inspection and scan-to-scan comparison
+- [Multi-package workflows](docs/db-merge-workflows.md): cleaning up multiple packages with one combined DB
+- [SQLite schema guide](docs/schema-description.md): practical explanation of the SQLite schema
+- [CLI usage](docs/cli-usage.md): companion CLI usage
 
 ## Acknowledgment
 

package/dist/cleanup-summary/_cleanup-summary-markdown.d.ts

@@ -2,5 +2,4 @@ import type { CleanupSummary } from "./_cleanup-summary.js";
 export declare function renderCleanupSummaryMarkdown(summary: CleanupSummary, options: {
     maxDirectTargetTags?: number;
     maxRootsPerSection?: number;
-    maxTagsPerRoot?: number;
 }): string;

package/dist/cleanup-summary/_cleanup-summary-markdown.js

@@ -1,10 +1,11 @@
+import { ManifestKinds } from "../core/index.js";
+import { DeletePlanValidationStatuses } from "../db/index.js";
 const _DEFAULT_MAX_DIRECT_TARGET_TAGS = 100;
 const _DEFAULT_MAX_ROOTS_PER_SECTION = 100;
-const _DEFAULT_MAX_TAGS_PER_ROOT = 4;
+const _DEFAULT_MAX_TAG_TEXT_LENGTH = 40;
 export function renderCleanupSummaryMarkdown(summary, options) {
     const maxDirectTargetTags = options.maxDirectTargetTags ?? _DEFAULT_MAX_DIRECT_TARGET_TAGS;
     const maxRootsPerSection = options.maxRootsPerSection ?? _DEFAULT_MAX_ROOTS_PER_SECTION;
-    const maxTagsPerRoot = options.maxTagsPerRoot ?? _DEFAULT_MAX_TAGS_PER_ROOT;
     const lines = [
         "## Cleanup Summary",
         "",
@@ -12,31 +13,62 @@ export function renderCleanupSummaryMarkdown(summary, options) {
         "| --- | --- |",
         `| 📦 Package | \`${_escapeInlineCode(`${summary.owner}/${summary.packageName}`)}\` |`,
         `| ⚙️ Mode | ${summary.dryRun ? "Cleanup dry-run" : "Cleanup"} |`,
-        `| 🏷️ Matched tags | ${summary.directTargetTags.length} |`,
-        `| 🗑️ Fully deletable roots | ${summary.fullyDeletableRoots.length} |`,
-        `| 🔗 Untag-only roots | ${summary.untagOnlyRoots.length} |`,
-        `| 🛡️ Blocked roots | ${summary.blockedRoots.length} |`,
-        `| 📄 Affected manifests | ${summary.affectedManifests.length} |`,
+        `| 🏷️ Selected tags | ${summary.directTargetTags.length} |`,
+        `| 🔖 Deleted tags | ${summary.changes.deletedTags} |`,
+        `| 🖼️ Deleted images | ${summary.changes.deletedImages} |`,
+        `| 📚 Deleted multi-arch manifests | ${summary.changes.deletedMultiArchManifests} |`,
+        `| 🧱 Deleted indexes | ${summary.changes.deletedIndexes} |`,
+        `| 📄 Deleted total | ${summary.changes.deletedTotal} |`,
+        `| 🔗 Tag-only updates | ${summary.untagOnlyRoots.length} |`,
+        `| 🛡️ Blocked items | ${summary.blockedRoots.length} |`,
         ""
     ];
-    lines.push(..._renderJsonDetails("⚙️ Cleanup filter", summary.plannerInputs));
+    lines.push(..._renderPlannedDeleteBreakdown(summary));
+    lines.push(..._renderPlannerInputs(summary.plannerInputs));
     lines.push(..._renderDirectTargetTags(summary.directTargetTags, maxDirectTargetTags));
-    lines.push(..._renderRootSection("🗑️ Fully deletable roots", summary.fullyDeletableRoots, maxRootsPerSection, maxTagsPerRoot));
-    lines.push(..._renderRootSection("🔗 Untag-only roots", summary.untagOnlyRoots, maxRootsPerSection, maxTagsPerRoot));
-    lines.push(..._renderRootSection("🛡️ Blocked roots", summary.blockedRoots, maxRootsPerSection, maxTagsPerRoot));
-    if (!summary.dryRun && (summary.deletedPackageVersions.length > 0 || summary.untaggedTags.length > 0)) {
+    lines.push(..._renderRootSection("🗑️ Deleted items", summary.fullyDeletableRoots, maxRootsPerSection));
+    lines.push(..._renderRootSection("🔗 Tags removed only", summary.untagOnlyRoots, maxRootsPerSection));
+    lines.push(..._renderRootSection("🛡️ Blocked items", summary.blockedRoots, maxRootsPerSection));
+    if (!summary.dryRun && (summary.deletedPackageVersionCount > 0 || summary.detachedTagCount > 0)) {
         lines.push(..._renderLiveEffects(summary));
     }
     return `${lines.join("\n").trimEnd()}\n`;
 }
-function _renderJsonDetails(title, value) {
+function _renderPlannedDeleteBreakdown(summary) {
+    const rows = [
+        { label: "Images", count: summary.changes.deletedImages },
+        { label: "Multi-arch manifests", count: summary.changes.deletedMultiArchManifests },
+        { label: "Artifact manifests", count: summary.changes.deletedArtifactManifests },
+        { label: "Signatures", count: summary.changes.deletedSignatures },
+        { label: "Attestations", count: summary.changes.deletedAttestations },
+        { label: "Generic indexes", count: summary.changes.deletedIndexes }
+    ].filter((row) => row.count > 0);
+    if (rows.length === 0) {
+        return [];
+    }
     return [
-        `<details>`,
-        `<summary>${title}</summary>`,
+        "<details>",
+        "<summary>📦 Deleted item breakdown</summary>",
         "",
-        "```json",
-        JSON.stringify(value, null, 2),
-        "```",
+        "| Type | Count |",
+        "| --- | --- |",
+        ...rows.map((row) => `| ${row.label} | ${row.count} |`),
+        "",
+        "</details>",
+        ""
+    ];
+}
+function _renderPlannerInputs(plannerInputs) {
+    const rows = _getPlannerInputRows(plannerInputs);
+    const patternLines = _getPlannerPatternLines(plannerInputs);
+    return [
+        "<details>",
+        "<summary>⚙️ Cleanup filter</summary>",
+        "",
+        "| Filter | Value |",
+        "| --- | --- |",
+        ...(rows.length > 0 ? rows : ["| (none) | No cleanup filters recorded |"]),
+        ...(patternLines.length > 0 ? ["", ...patternLines] : []),
         "",
         "</details>",
         ""
@@ -47,23 +79,24 @@ function _renderDirectTargetTags(tags, maxDirectTargetTags) {
         return [];
     }
     const visibleTags = tags.slice(0, maxDirectTargetTags).map((tag) => `- \`${_escapeInlineCode(tag)}\``);
-    const lines = ["<details>", "<summary>🏷️ Matched tags</summary>", "", ...visibleTags];
+    const lines = ["<details>", "<summary>🏷️ Selected tags</summary>", "", ...visibleTags];
     if (tags.length > maxDirectTargetTags) {
-        lines.push("", `_Showing first ${maxDirectTargetTags} of ${tags.length} matched tags._`);
+        lines.push("", `_Showing first ${maxDirectTargetTags} of ${tags.length} selected tags._`);
     }
     lines.push("", "</details>", "");
     return lines;
 }
-function _renderRootSection(title, roots, maxRootsPerSection, maxTagsPerRoot) {
+function _renderRootSection(title, roots, maxRootsPerSection) {
     if (roots.length === 0) {
         return [];
     }
     const lines = ["<details>", `<summary>${title}</summary>`, ""];
-    lines.push("| Version | Digest | Tags | Reason |");
-    lines.push("| --- | --- | --- | --- |");
+    lines.push("| Version | Type | Digest | Tags | Outcome |");
+    lines.push("| --- | --- | --- | --- | --- |");
     for (const root of roots.slice(0, maxRootsPerSection)) {
-        lines.push(`| ${root.versionId} | \`${_escapeInlineCode(_shortDigest(root.digest))}\` | ${_escapeMarkdown(_formatTags(root, maxTagsPerRoot))} | ${_escapeMarkdown(_formatReason(root))} |`);
+        lines.push(`| ${root.versionId} | ${_escapeMarkdown(_describeManifestKind(root.manifestKind))} | \`${_escapeInlineCode(_shortDigest(root.digest))}\` | ${_escapeMarkdown(_formatTags(root))} | ${_escapeMarkdown(_formatReason(root))} |`);
     }
+    lines.push("", "_Tag lists may be truncated for table width._");
     if (roots.length > maxRootsPerSection) {
         lines.push("", `_Showing first ${maxRootsPerSection} of ${roots.length} ${title.toLowerCase()}._`);
     }
@@ -72,33 +105,32 @@ function _renderRootSection(title, roots, maxRootsPerSection, maxTagsPerRoot) {
 }
 function _renderLiveEffects(summary) {
     const lines = ["### Applied changes", ""];
-    lines.push(`- Deleted package versions: ${summary.deletedPackageVersions.length}`);
-    lines.push(`- Detached tags: ${summary.untaggedTags.length}`);
-    if (summary.unsupportedUntagRoots.length > 0) {
-        lines.push(`- Unsupported untag roots: ${summary.unsupportedUntagRoots.length}`);
-    }
+    lines.push(`- Deleted package versions: ${summary.deletedPackageVersionCount}`);
+    lines.push(`- Detached tags: ${summary.detachedTagCount}`);
     lines.push("");
     return lines;
 }
-function _formatTags(root, maxTagsPerRoot) {
+function _formatTags(root) {
     const tags = root.rootTags.length > 0 ? root.rootTags : root.matchedTags;
     if (tags.length === 0) {
         return "(untagged)";
     }
-    const visible = tags.slice(0, maxTagsPerRoot);
-    const suffix = tags.length > maxTagsPerRoot ? `, +${tags.length - maxTagsPerRoot} more` : "";
-    return visible.join(", ") + suffix;
+    const joinedTags = tags.join(", ");
+    if (joinedTags.length <= _DEFAULT_MAX_TAG_TEXT_LENGTH) {
+        return joinedTags;
+    }
+    return `${joinedTags.slice(0, _DEFAULT_MAX_TAG_TEXT_LENGTH - 3)}...`;
 }
 function _formatReason(root) {
-    if (root.validationStatus === "blocked") {
-        const blocking = root.blockingDigest ? _shortDigest(root.blockingDigest) : "another root";
+    if (root.validationStatus === DeletePlanValidationStatuses.blocked) {
+        const blocking = root.blockingDigest ? _shortDigest(root.blockingDigest) : "another item";
         const overlap = root.overlapDigest ? ` via ${_shortDigest(root.overlapDigest)}` : "";
-        return `Blocked by ${blocking}${overlap}`;
+        return `Blocked by retained item ${blocking}${overlap}`;
     }
-    if (root.validationStatus === "untag-only") {
-        return "Selected tags detach; root remains";
+    if (root.validationStatus === DeletePlanValidationStatuses.untagOnly) {
+        return "Remove selected tags, keep item";
     }
-    return "Root and closure can be deleted";
+    return "Delete item and descendants";
 }
 function _shortDigest(value) {
     if (!value.startsWith("sha256:") || value.length <= 20) {
@@ -112,3 +144,81 @@ function _escapeInlineCode(value) {
 function _escapeMarkdown(value) {
     return value.replaceAll("|", "\\|").replaceAll("\n", " ");
 }
+function _getPlannerInputRows(plannerInputs) {
+    const rows = [];
+    for (const [key, value] of Object.entries(plannerInputs)) {
+        rows.push(`| ${_escapeMarkdown(_plannerInputLabel(key))} | ${_escapeMarkdown(_formatPlannerInputValue(value))} |`);
+    }
+    return rows;
+}
+function _plannerInputLabel(key) {
+    switch (key) {
+        case "deleteTags":
+            return "Delete tags";
+        case "excludeTags":
+            return "Exclude tags";
+        case "useRegex":
+            return "Use regex";
+        case "deleteUntagged":
+            return "Delete untagged";
+        case "keepNTagged":
+            return "Keep newest tagged";
+        case "keepNUntagged":
+            return "Keep newest untagged";
+        case "olderThan":
+            return "Older than";
+        case "cutoffTimestamp":
+            return "Cutoff timestamp";
+        case "deleteGhostImages":
+            return "Delete ghost images";
+        case "deletePartialImages":
+            return "Delete partial images";
+        case "deleteOrphanedImages":
+            return "Delete orphaned images";
+        default:
+            return key;
+    }
+}
+function _formatPlannerInputValue(value) {
+    if (Array.isArray(value)) {
+        if (value.length === 0) {
+            return "(none)";
+        }
+        return value.length === 1 ? "1 pattern" : `${value.length} patterns`;
+    }
+    if (typeof value === "boolean") {
+        return value ? "yes" : "no";
+    }
+    return String(value);
+}
+function _getPlannerPatternLines(plannerInputs) {
+    const lines = [];
+    for (const [key, value] of Object.entries(plannerInputs)) {
+        if (!Array.isArray(value) || value.length === 0) {
+            continue;
+        }
+        lines.push(`- ${_plannerInputLabel(key)}:`);
+        for (const item of value) {
+            lines.push(`  - \`${_escapeInlineCode(String(item))}\``);
+        }
+    }
+    return lines;
+}
+function _describeManifestKind(manifestKind) {
+    switch (manifestKind) {
+        case ManifestKinds.imageManifest:
+            return "image";
+        case ManifestKinds.multiArchManifest:
+            return "multi-arch";
+        case ManifestKinds.indexManifest:
+            return "index";
+        case ManifestKinds.signatureManifest:
+            return "signature";
+        case ManifestKinds.attestationManifest:
+            return "attestation";
+        case ManifestKinds.artifactManifest:
+            return "artifact";
+        default:
+            return "item";
+    }
+}

package/dist/cleanup-summary/_cleanup-summary.d.ts

@@ -1,23 +1,35 @@
-import type { DeletePlan, DeletePlanSelectionMode, DeletePlanSelectionReason } from "../db/index.js";
+import type { ManifestKind } from "../core/index.js";
+import type { DeletePlan, DeletePlanSelectionMode, DeletePlanSelectionReason, DeletePlanValidationReasonCode, DeletePlanValidationStatus } from "../db/index.js";
 import type { DeleteExecutionSummary } from "../execute/index.js";
 export interface CleanupSummaryRoot {
     versionId: number;
     digest: string;
-    manifestKind?: string;
+    manifestKind?: ManifestKind;
     rootTags: string[];
     matchedTags: string[];
     selectionMode: DeletePlanSelectionMode;
     selectionReason: DeletePlanSelectionReason;
-    validationStatus: "fully-deletable" | "blocked" | "untag-only";
-    validationReasonCode: "untag-only-partial-tag-match" | "fully-deletable-no-retained-overlap" | "blocked-overlap-with-retained-root";
+    validationStatus: DeletePlanValidationStatus;
+    validationReasonCode: DeletePlanValidationReasonCode;
     validationReason: string;
     blockingVersionId?: number;
     blockingDigest?: string;
     overlapDigest?: string;
-    overlapManifestKind?: string;
+    overlapManifestKind?: ManifestKind;
 }
 export interface CleanupSummaryAffectedManifest {
     digest: string;
+    manifestKind?: ManifestKind;
+}
+export interface CleanupSummaryChanges {
+    deletedTags: number;
+    deletedImages: number;
+    deletedIndexes: number;
+    deletedMultiArchManifests: number;
+    deletedArtifactManifests: number;
+    deletedAttestations: number;
+    deletedSignatures: number;
+    deletedTotal: number;
 }
 export interface CleanupSummary {
     command: "cleanup";
@@ -32,13 +44,13 @@ export interface CleanupSummary {
     untagOnlyRoots: CleanupSummaryRoot[];
     blockedRoots: CleanupSummaryRoot[];
     affectedManifests: CleanupSummaryAffectedManifest[];
-    deletedPackageVersions: DeleteExecutionSummary["deletedPackageVersions"];
-    untaggedTags: DeleteExecutionSummary["untaggedTags"];
-    unsupportedUntagRoots: DeleteExecutionSummary["unsupportedUntagRoots"];
+    changes: CleanupSummaryChanges;
+    deletedPackageVersionCount: DeleteExecutionSummary["deletedPackageVersionCount"];
+    detachedTagCount: DeleteExecutionSummary["detachedTagCount"];
 }
 export declare function buildCleanupSummary(plan: DeletePlan, options: {
     dryRun: boolean;
-    listRootTags: (versionId: number) => string[];
-    listAffectedManifestDigests: (rootDigests: string[]) => string[];
+    rootTagsByVersionId: ReadonlyMap<number, string[]>;
+    changes: CleanupSummaryChanges;
     executionSummary?: DeleteExecutionSummary;
 }): CleanupSummary;