ghcr-manager 0.9.7 → 0.9.8

package/dist/db/planner/_planner-output.js

@@ -1,20 +1,28 @@
 import { DeletePlanValidationReasonCodes, DeletePlanValidationStatuses } from "./_planner-types.js";
 export function buildPlanOutputs(directTargetTags, directTargetRoots, planArtifacts) {
     const rootDecisions = buildRootDecisions(directTargetRoots, planArtifacts);
-    const protectedRoots = buildProtectedRoots(planArtifacts.blockedRoots);
+    const fullyDeletableDigests = new Set(rootDecisions
+        .filter((decision) => decision.validationStatus === DeletePlanValidationStatuses.fullyDeletable)
+        .map((decision) => decision.digest));
+    const blockedDigests = new Set(rootDecisions
+        .filter((decision) => decision.validationStatus === DeletePlanValidationStatuses.blocked)
+        .map((decision) => decision.digest));
+    const blockedRoots = planArtifacts.blockedRoots.filter((blockedRoot) => blockedDigests.has(blockedRoot.blockedDigest));
+    const protectedRoots = buildProtectedRoots(blockedRoots);
     return {
         directTargetTags,
         directTargetRoots,
         rootDecisions,
         protectedRoots,
         closureManifests: planArtifacts.closureManifests,
-        blockedRoots: planArtifacts.blockedRoots,
-        fullyDeletableRoots: planArtifacts.fullyDeletableRoots,
+        blockedRoots,
+        fullyDeletableRoots: planArtifacts.fullyDeletableRoots.filter((root) => fullyDeletableDigests.has(root.digest)),
         collateralTags: []
     };
 }
 export function buildRootDecisions(directTargetRoots, planArtifacts) {
     const fullyDeletableDigests = new Set(planArtifacts.fullyDeletableRoots.map((root) => root.digest));
+    const supportedUntagOnlyRootDigests = planArtifacts.supportedUntagOnlyRootDigests;
     const blockedRootByDigest = new Map();
     for (const blockedRoot of planArtifacts.blockedRoots) {
         if (!blockedRootByDigest.has(blockedRoot.blockedDigest)) {
@@ -22,16 +30,21 @@ export function buildRootDecisions(directTargetRoots, planArtifacts) {
         }
     }
     return directTargetRoots.map((root) => {
-        if (root.selectionMode === "untag-only") {
+        const blockedRoot = blockedRootByDigest.get(root.digest);
+        if (_isUntagOnly(root, blockedRoot, supportedUntagOnlyRootDigests)) {
             return {
                 versionId: root.versionId,
                 digest: root.digest,
                 manifestKind: root.manifestKind,
-                selectionMode: root.selectionMode,
+                selectionMode: "untag-only",
                 selectionReason: root.reason,
                 validationStatus: DeletePlanValidationStatuses.untagOnly,
-                validationReasonCode: DeletePlanValidationReasonCodes.untagOnlyPartialTagMatch,
-                validationReason: "matched tags cover only part of this root's tag set, so the version is retained and only those tags can be detached"
+                validationReasonCode: root.selectionMode === "untag-only"
+                    ? DeletePlanValidationReasonCodes.untagOnlyPartialTagMatch
+                    : DeletePlanValidationReasonCodes.untagOnlyRetainedManifest,
+                validationReason: root.selectionMode === "untag-only"
+                    ? "matched tags cover only part of this root's tag set, so the version is retained and only those tags can be detached"
+                    : "selected tags can be detached, but the manifest itself must remain because surviving tags still need it"
             };
         }
         if (fullyDeletableDigests.has(root.digest)) {
@@ -46,7 +59,6 @@ export function buildRootDecisions(directTargetRoots, planArtifacts) {
                 validationReason: "selected tags cover the whole root and its manifest closure does not overlap any retained root"
             };
         }
-        const blockedRoot = blockedRootByDigest.get(root.digest);
         return {
             versionId: root.versionId,
             digest: root.digest,
@@ -89,3 +101,11 @@ export function buildBlockedValidationReason(blockedRoot) {
     }
     return `blocked because retained root ${blockedRoot.blockingDigest} still requires shared manifest ${blockedRoot.overlapDigest}`;
 }
+function _isUntagOnly(root, blockedRoot, supportedUntagOnlyRootDigests) {
+    if (root.selectionMode === "untag-only") {
+        return true;
+    }
+    return (root.reason === "delete-tags-all-tags-selected" &&
+        ((blockedRoot !== undefined && blockedRoot.overlapDigest === root.digest) ||
+            supportedUntagOnlyRootDigests.has(root.digest)));
+}

package/dist/db/planner/_planner-plan-artifacts-blocked-roots-sql.d.ts

@@ -0,0 +1 @@
+export declare const _LIST_BLOCKED_ROOTS_SQL = "\n  WITH selected_graphs AS (\n    SELECT DISTINCT\n      manifest_graphs.graph_id\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_graphs\n    WHERE manifest_graphs.scan_id = ?\n      AND manifest_graphs.digest = dtr.root_digest\n  ),\n  retained_tagged_manifests AS (\n    SELECT\n      m.version_id AS tagged_version_id,\n      m.digest AS tagged_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs\n    CROSS JOIN manifests m\n    JOIN tags t\n      ON t.scan_id = m.scan_id\n     AND t.version_id = m.version_id\n     AND t.is_digest_tag = 0\n    WHERE manifest_graphs.scan_id = m.scan_id\n      AND selected_graphs.graph_id = manifest_graphs.graph_id\n      AND manifest_graphs.digest = m.digest\n      AND m.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM temp_direct_target_roots dtr\n        WHERE dtr.root_digest = m.digest\n      )\n  ),\n  ranked_blocks AS (\n    SELECT\n      dtr.root_version_id AS blocked_version_id,\n      dtr.root_digest AS blocked_digest,\n      retained.tagged_version_id AS blocking_version_id,\n      retained.tagged_digest AS blocking_digest,\n      dtr.root_digest AS overlap_digest,\n      dtr.root_manifest_kind AS overlap_manifest_kind,\n      'overlap-with-retained-root' AS block_reason,\n      ROW_NUMBER() OVER (\n        PARTITION BY dtr.root_digest, retained.tagged_digest\n        ORDER BY\n          retained_overlap.min_distance,\n          dtr.root_digest\n      ) AS rn\n    FROM temp_direct_target_roots dtr\n    JOIN retained_tagged_manifests retained\n      ON retained.tagged_digest <> dtr.root_digest\n    JOIN manifest_reachability retained_overlap\n      ON retained_overlap.scan_id = ?\n     AND retained_overlap.ancestor_digest = retained.tagged_digest\n     AND retained_overlap.descendant_digest = dtr.root_digest\n  )\n  SELECT\n    blocked_version_id,\n    blocked_digest,\n    blocking_version_id,\n    blocking_digest,\n    overlap_digest,\n    overlap_manifest_kind,\n    block_reason\n  FROM ranked_blocks\n  WHERE rn = 1\n  ORDER BY blocked_digest, blocking_digest, overlap_digest\n";

package/dist/db/planner/_planner-plan-artifacts-blocked-roots-sql.js

@@ -0,0 +1,65 @@
+export const _LIST_BLOCKED_ROOTS_SQL = `
+  WITH selected_graphs AS (
+    SELECT DISTINCT
+      manifest_graphs.graph_id
+    FROM temp_direct_target_roots dtr
+    CROSS JOIN manifest_graphs
+    WHERE manifest_graphs.scan_id = ?
+      AND manifest_graphs.digest = dtr.root_digest
+  ),
+  retained_tagged_manifests AS (
+    SELECT
+      m.version_id AS tagged_version_id,
+      m.digest AS tagged_digest
+    FROM selected_graphs
+    CROSS JOIN manifest_graphs
+    CROSS JOIN manifests m
+    JOIN tags t
+      ON t.scan_id = m.scan_id
+     AND t.version_id = m.version_id
+     AND t.is_digest_tag = 0
+    WHERE manifest_graphs.scan_id = m.scan_id
+      AND selected_graphs.graph_id = manifest_graphs.graph_id
+      AND manifest_graphs.digest = m.digest
+      AND m.scan_id = ?
+      AND NOT EXISTS (
+        SELECT 1
+        FROM temp_direct_target_roots dtr
+        WHERE dtr.root_digest = m.digest
+      )
+  ),
+  ranked_blocks AS (
+    SELECT
+      dtr.root_version_id AS blocked_version_id,
+      dtr.root_digest AS blocked_digest,
+      retained.tagged_version_id AS blocking_version_id,
+      retained.tagged_digest AS blocking_digest,
+      dtr.root_digest AS overlap_digest,
+      dtr.root_manifest_kind AS overlap_manifest_kind,
+      'overlap-with-retained-root' AS block_reason,
+      ROW_NUMBER() OVER (
+        PARTITION BY dtr.root_digest, retained.tagged_digest
+        ORDER BY
+          retained_overlap.min_distance,
+          dtr.root_digest
+      ) AS rn
+    FROM temp_direct_target_roots dtr
+    JOIN retained_tagged_manifests retained
+      ON retained.tagged_digest <> dtr.root_digest
+    JOIN manifest_reachability retained_overlap
+      ON retained_overlap.scan_id = ?
+     AND retained_overlap.ancestor_digest = retained.tagged_digest
+     AND retained_overlap.descendant_digest = dtr.root_digest
+  )
+  SELECT
+    blocked_version_id,
+    blocked_digest,
+    blocking_version_id,
+    blocking_digest,
+    overlap_digest,
+    overlap_manifest_kind,
+    block_reason
+  FROM ranked_blocks
+  WHERE rn = 1
+  ORDER BY blocked_digest, blocking_digest, overlap_digest
+`;

package/dist/db/planner/_planner-plan-artifacts-closure-sql.d.ts

@@ -0,0 +1 @@
+export declare const _LIST_CLOSURE_MANIFESTS_SQL = "\n  WITH selected_graphs AS (\n    SELECT DISTINCT\n      manifest_graphs.graph_id\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_graphs\n    WHERE manifest_graphs.scan_id = ?\n      AND manifest_graphs.digest = dtr.root_digest\n  ),\n  retained_tagged_manifests AS (\n    SELECT DISTINCT\n      m.version_id,\n      m.digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs\n    CROSS JOIN manifests m\n    JOIN tags t\n      ON t.scan_id = m.scan_id\n     AND t.version_id = m.version_id\n     AND t.is_digest_tag = 0\n    WHERE manifest_graphs.scan_id = m.scan_id\n      AND selected_graphs.graph_id = manifest_graphs.graph_id\n      AND manifest_graphs.digest = m.digest\n      AND m.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM temp_direct_target_roots dtr\n        WHERE dtr.root_digest = m.digest\n      )\n  ),\n  retained_manifests AS (\n    SELECT\n      retained.version_id,\n      retained.digest\n    FROM retained_tagged_manifests retained\n\n    UNION\n\n    SELECT\n      m.version_id,\n      m.digest\n    FROM retained_tagged_manifests retained\n    CROSS JOIN manifest_reachability mr\n    CROSS JOIN manifests m\n    WHERE mr.scan_id = ?\n      AND mr.ancestor_digest = retained.digest\n      AND mr.min_distance > 0\n      AND m.scan_id = ?\n      AND m.digest = mr.descendant_digest\n  ),\n  direct_target_closure AS (\n    SELECT\n      dtr.root_version_id AS source_version_id,\n      dtr.root_digest AS source_digest,\n      dtr.root_version_id AS member_version_id,\n      dtr.root_digest AS member_digest,\n      dtr.root_manifest_kind AS member_manifest_kind,\n      0 AS hops_from_root\n    FROM temp_direct_target_roots dtr\n\n    UNION ALL\n\n    SELECT\n      dtr.root_version_id AS source_version_id,\n      dtr.root_digest AS source_digest,\n      m.version_id AS member_version_id,\n      m.digest AS member_digest,\n      m.manifest_kind AS member_manifest_kind,\n      mr.min_distance AS hops_from_root\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_reachability mr\n    CROSS JOIN manifests m\n    WHERE mr.scan_id = ?\n      AND mr.ancestor_digest = dtr.root_digest\n      AND mr.min_distance > 0\n      AND m.scan_id = ?\n      AND m.digest = mr.descendant_digest\n  ),\n  closure_seed AS (\n    SELECT\n      dtc.source_version_id,\n      dtc.source_digest,\n      dtc.member_digest,\n      dtc.hops_from_root\n    FROM direct_target_closure dtc\n    WHERE dtc.hops_from_root = 0\n       OR NOT EXISTS (\n         SELECT 1\n         FROM retained_manifests retained\n         WHERE retained.digest = dtc.member_digest\n       )\n  ),\n  undirected_edges AS (\n    SELECT\n      me.parent_digest AS source_digest,\n      me.child_digest AS target_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs parent_graph\n    CROSS JOIN manifest_edges me INDEXED BY idx_manifest_edges_scan_parent\n    WHERE parent_graph.scan_id = me.scan_id\n      AND selected_graphs.graph_id = parent_graph.graph_id\n      AND parent_graph.digest = me.parent_digest\n      AND me.scan_id = ?\n\n    UNION\n\n    SELECT\n      me.child_digest AS source_digest,\n      me.parent_digest AS target_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs child_graph\n    CROSS JOIN manifest_edges me INDEXED BY idx_manifest_edges_scan_child\n    WHERE child_graph.scan_id = me.scan_id\n      AND selected_graphs.graph_id = child_graph.graph_id\n      AND child_graph.digest = me.child_digest\n      AND me.scan_id = ?\n  ),\n  delete_component_members AS (\n    SELECT\n      seed.source_version_id,\n      seed.source_digest,\n      seed.member_digest\n    FROM closure_seed seed\n\n    UNION\n\n    SELECT\n      walk.source_version_id,\n      walk.source_digest,\n      m.digest AS member_digest\n    FROM delete_component_members walk\n    JOIN undirected_edges edge\n      ON edge.source_digest = walk.member_digest\n    JOIN manifests m\n      ON m.scan_id = ?\n     AND m.digest = edge.target_digest\n    WHERE NOT EXISTS (\n        SELECT 1\n        FROM retained_manifests retained\n        WHERE retained.digest = m.digest\n      )\n  ),\n  source_seed_hops AS (\n    SELECT\n      seed.source_digest,\n      MAX(seed.hops_from_root) AS max_seed_hops\n    FROM closure_seed seed\n    GROUP BY seed.source_digest\n  ),\n  descendant_hops AS (\n    SELECT\n      dtc.source_digest,\n      dtc.member_digest,\n      MIN(dtc.hops_from_root) AS min_hops_from_root\n    FROM direct_target_closure dtc\n    WHERE dtc.hops_from_root > 0\n    GROUP BY dtc.source_digest, dtc.member_digest\n  )\n  SELECT\n    walk.source_version_id,\n    walk.source_digest,\n    MIN(member_manifest.version_id) AS member_version_id,\n    walk.member_digest,\n    MIN(member_manifest.manifest_kind) AS member_manifest_kind,\n    CASE\n      WHEN walk.member_digest = walk.source_digest\n        THEN 0\n      WHEN descendant_hops.min_hops_from_root IS NOT NULL\n        THEN descendant_hops.min_hops_from_root\n      ELSE source_seed_hops.max_seed_hops + 1\n    END AS hops_from_root,\n    CASE\n      WHEN walk.member_digest = walk.source_digest\n        THEN 'root'\n      WHEN descendant_hops.min_hops_from_root IS NOT NULL\n        THEN 'descendant'\n      ELSE 'connected'\n    END AS member_role\n  FROM delete_component_members walk\n  JOIN manifests member_manifest\n    ON member_manifest.scan_id = ?\n   AND member_manifest.digest = walk.member_digest\n  JOIN source_seed_hops\n    ON source_seed_hops.source_digest = walk.source_digest\n  LEFT JOIN descendant_hops\n    ON descendant_hops.source_digest = walk.source_digest\n   AND descendant_hops.member_digest = walk.member_digest\n  GROUP BY\n    walk.source_version_id,\n    walk.source_digest,\n    walk.member_digest,\n    descendant_hops.min_hops_from_root,\n    source_seed_hops.max_seed_hops\n  ORDER BY walk.source_digest, hops_from_root, walk.member_digest\n";

package/dist/db/planner/_planner-plan-artifacts-closure-sql.js

@@ -0,0 +1,195 @@
+export const _LIST_CLOSURE_MANIFESTS_SQL = `
+  WITH selected_graphs AS (
+    SELECT DISTINCT
+      manifest_graphs.graph_id
+    FROM temp_direct_target_roots dtr
+    CROSS JOIN manifest_graphs
+    WHERE manifest_graphs.scan_id = ?
+      AND manifest_graphs.digest = dtr.root_digest
+  ),
+  retained_tagged_manifests AS (
+    SELECT DISTINCT
+      m.version_id,
+      m.digest
+    FROM selected_graphs
+    CROSS JOIN manifest_graphs
+    CROSS JOIN manifests m
+    JOIN tags t
+      ON t.scan_id = m.scan_id
+     AND t.version_id = m.version_id
+     AND t.is_digest_tag = 0
+    WHERE manifest_graphs.scan_id = m.scan_id
+      AND selected_graphs.graph_id = manifest_graphs.graph_id
+      AND manifest_graphs.digest = m.digest
+      AND m.scan_id = ?
+      AND NOT EXISTS (
+        SELECT 1
+        FROM temp_direct_target_roots dtr
+        WHERE dtr.root_digest = m.digest
+      )
+  ),
+  retained_manifests AS (
+    SELECT
+      retained.version_id,
+      retained.digest
+    FROM retained_tagged_manifests retained
+
+    UNION
+
+    SELECT
+      m.version_id,
+      m.digest
+    FROM retained_tagged_manifests retained
+    CROSS JOIN manifest_reachability mr
+    CROSS JOIN manifests m
+    WHERE mr.scan_id = ?
+      AND mr.ancestor_digest = retained.digest
+      AND mr.min_distance > 0
+      AND m.scan_id = ?
+      AND m.digest = mr.descendant_digest
+  ),
+  direct_target_closure AS (
+    SELECT
+      dtr.root_version_id AS source_version_id,
+      dtr.root_digest AS source_digest,
+      dtr.root_version_id AS member_version_id,
+      dtr.root_digest AS member_digest,
+      dtr.root_manifest_kind AS member_manifest_kind,
+      0 AS hops_from_root
+    FROM temp_direct_target_roots dtr
+
+    UNION ALL
+
+    SELECT
+      dtr.root_version_id AS source_version_id,
+      dtr.root_digest AS source_digest,
+      m.version_id AS member_version_id,
+      m.digest AS member_digest,
+      m.manifest_kind AS member_manifest_kind,
+      mr.min_distance AS hops_from_root
+    FROM temp_direct_target_roots dtr
+    CROSS JOIN manifest_reachability mr
+    CROSS JOIN manifests m
+    WHERE mr.scan_id = ?
+      AND mr.ancestor_digest = dtr.root_digest
+      AND mr.min_distance > 0
+      AND m.scan_id = ?
+      AND m.digest = mr.descendant_digest
+  ),
+  closure_seed AS (
+    SELECT
+      dtc.source_version_id,
+      dtc.source_digest,
+      dtc.member_digest,
+      dtc.hops_from_root
+    FROM direct_target_closure dtc
+    WHERE dtc.hops_from_root = 0
+       OR NOT EXISTS (
+         SELECT 1
+         FROM retained_manifests retained
+         WHERE retained.digest = dtc.member_digest
+       )
+  ),
+  undirected_edges AS (
+    SELECT
+      me.parent_digest AS source_digest,
+      me.child_digest AS target_digest
+    FROM selected_graphs
+    CROSS JOIN manifest_graphs parent_graph
+    CROSS JOIN manifest_edges me INDEXED BY idx_manifest_edges_scan_parent
+    WHERE parent_graph.scan_id = me.scan_id
+      AND selected_graphs.graph_id = parent_graph.graph_id
+      AND parent_graph.digest = me.parent_digest
+      AND me.scan_id = ?
+
+    UNION
+
+    SELECT
+      me.child_digest AS source_digest,
+      me.parent_digest AS target_digest
+    FROM selected_graphs
+    CROSS JOIN manifest_graphs child_graph
+    CROSS JOIN manifest_edges me INDEXED BY idx_manifest_edges_scan_child
+    WHERE child_graph.scan_id = me.scan_id
+      AND selected_graphs.graph_id = child_graph.graph_id
+      AND child_graph.digest = me.child_digest
+      AND me.scan_id = ?
+  ),
+  delete_component_members AS (
+    SELECT
+      seed.source_version_id,
+      seed.source_digest,
+      seed.member_digest
+    FROM closure_seed seed
+
+    UNION
+
+    SELECT
+      walk.source_version_id,
+      walk.source_digest,
+      m.digest AS member_digest
+    FROM delete_component_members walk
+    JOIN undirected_edges edge
+      ON edge.source_digest = walk.member_digest
+    JOIN manifests m
+      ON m.scan_id = ?
+     AND m.digest = edge.target_digest
+    WHERE NOT EXISTS (
+        SELECT 1
+        FROM retained_manifests retained
+        WHERE retained.digest = m.digest
+      )
+  ),
+  source_seed_hops AS (
+    SELECT
+      seed.source_digest,
+      MAX(seed.hops_from_root) AS max_seed_hops
+    FROM closure_seed seed
+    GROUP BY seed.source_digest
+  ),
+  descendant_hops AS (
+    SELECT
+      dtc.source_digest,
+      dtc.member_digest,
+      MIN(dtc.hops_from_root) AS min_hops_from_root
+    FROM direct_target_closure dtc
+    WHERE dtc.hops_from_root > 0
+    GROUP BY dtc.source_digest, dtc.member_digest
+  )
+  SELECT
+    walk.source_version_id,
+    walk.source_digest,
+    MIN(member_manifest.version_id) AS member_version_id,
+    walk.member_digest,
+    MIN(member_manifest.manifest_kind) AS member_manifest_kind,
+    CASE
+      WHEN walk.member_digest = walk.source_digest
+        THEN 0
+      WHEN descendant_hops.min_hops_from_root IS NOT NULL
+        THEN descendant_hops.min_hops_from_root
+      ELSE source_seed_hops.max_seed_hops + 1
+    END AS hops_from_root,
+    CASE
+      WHEN walk.member_digest = walk.source_digest
+        THEN 'root'
+      WHEN descendant_hops.min_hops_from_root IS NOT NULL
+        THEN 'descendant'
+      ELSE 'connected'
+    END AS member_role
+  FROM delete_component_members walk
+  JOIN manifests member_manifest
+    ON member_manifest.scan_id = ?
+   AND member_manifest.digest = walk.member_digest
+  JOIN source_seed_hops
+    ON source_seed_hops.source_digest = walk.source_digest
+  LEFT JOIN descendant_hops
+    ON descendant_hops.source_digest = walk.source_digest
+   AND descendant_hops.member_digest = walk.member_digest
+  GROUP BY
+    walk.source_version_id,
+    walk.source_digest,
+    walk.member_digest,
+    descendant_hops.min_hops_from_root,
+    source_seed_hops.max_seed_hops
+  ORDER BY walk.source_digest, hops_from_root, walk.member_digest
+`;

package/dist/db/planner/_planner-plan-artifacts-supported-untag-only-sql.d.ts

@@ -0,0 +1 @@
+export declare const _LIST_SUPPORTED_UNTAG_ONLY_ROOT_DIGESTS_SQL = "\n  WITH selected_graphs AS (\n    SELECT DISTINCT\n      manifest_graphs.graph_id\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_graphs\n    WHERE manifest_graphs.scan_id = ?\n      AND manifest_graphs.digest = dtr.root_digest\n  ),\n  retained_tagged_manifests AS (\n    SELECT DISTINCT\n      m.digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs\n    CROSS JOIN manifests m\n    JOIN tags t\n      ON t.scan_id = m.scan_id\n     AND t.version_id = m.version_id\n     AND t.is_digest_tag = 0\n    WHERE manifest_graphs.scan_id = m.scan_id\n      AND selected_graphs.graph_id = manifest_graphs.graph_id\n      AND manifest_graphs.digest = m.digest\n      AND m.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM temp_direct_target_roots dtr\n        WHERE dtr.root_digest = m.digest\n      )\n  ),\n  retained_manifests AS (\n    SELECT\n      retained.digest\n    FROM retained_tagged_manifests retained\n\n    UNION\n\n    SELECT\n      mr.descendant_digest AS digest\n    FROM retained_tagged_manifests retained\n    CROSS JOIN manifest_reachability mr\n    WHERE mr.scan_id = ?\n      AND mr.ancestor_digest = retained.digest\n      AND mr.min_distance > 0\n  )\n  SELECT DISTINCT\n    dtr.root_digest\n  FROM temp_direct_target_roots dtr\n  WHERE dtr.root_manifest_kind = 'index_manifest'\n    AND EXISTS (\n      SELECT 1\n      FROM manifest_edges me\n      JOIN manifests child\n        ON child.scan_id = ?\n       AND child.digest = me.child_digest\n      WHERE me.scan_id = ?\n        AND me.parent_digest = dtr.root_digest\n        AND me.edge_kind = 'referrer'\n        AND child.manifest_kind = 'signature_manifest'\n    )\n    AND EXISTS (\n      SELECT 1\n      FROM manifest_edges me\n      JOIN manifests child\n        ON child.scan_id = ?\n       AND child.digest = me.child_digest\n      WHERE me.scan_id = ?\n        AND me.parent_digest = dtr.root_digest\n        AND me.edge_kind = 'image-child'\n        AND child.manifest_kind <> 'signature_manifest'\n    )\n    AND NOT EXISTS (\n      SELECT 1\n      FROM manifest_edges me\n      JOIN manifests child\n        ON child.scan_id = ?\n       AND child.digest = me.child_digest\n      WHERE me.scan_id = ?\n        AND me.parent_digest = dtr.root_digest\n        AND me.edge_kind = 'image-child'\n        AND child.manifest_kind <> 'signature_manifest'\n        AND child.digest NOT IN (\n          SELECT digest\n          FROM retained_manifests\n        )\n    )\n";

package/dist/db/planner/_planner-plan-artifacts-supported-untag-only-sql.js

@@ -0,0 +1,86 @@
+export const _LIST_SUPPORTED_UNTAG_ONLY_ROOT_DIGESTS_SQL = `
+  WITH selected_graphs AS (
+    SELECT DISTINCT
+      manifest_graphs.graph_id
+    FROM temp_direct_target_roots dtr
+    CROSS JOIN manifest_graphs
+    WHERE manifest_graphs.scan_id = ?
+      AND manifest_graphs.digest = dtr.root_digest
+  ),
+  retained_tagged_manifests AS (
+    SELECT DISTINCT
+      m.digest
+    FROM selected_graphs
+    CROSS JOIN manifest_graphs
+    CROSS JOIN manifests m
+    JOIN tags t
+      ON t.scan_id = m.scan_id
+     AND t.version_id = m.version_id
+     AND t.is_digest_tag = 0
+    WHERE manifest_graphs.scan_id = m.scan_id
+      AND selected_graphs.graph_id = manifest_graphs.graph_id
+      AND manifest_graphs.digest = m.digest
+      AND m.scan_id = ?
+      AND NOT EXISTS (
+        SELECT 1
+        FROM temp_direct_target_roots dtr
+        WHERE dtr.root_digest = m.digest
+      )
+  ),
+  retained_manifests AS (
+    SELECT
+      retained.digest
+    FROM retained_tagged_manifests retained
+
+    UNION
+
+    SELECT
+      mr.descendant_digest AS digest
+    FROM retained_tagged_manifests retained
+    CROSS JOIN manifest_reachability mr
+    WHERE mr.scan_id = ?
+      AND mr.ancestor_digest = retained.digest
+      AND mr.min_distance > 0
+  )
+  SELECT DISTINCT
+    dtr.root_digest
+  FROM temp_direct_target_roots dtr
+  WHERE dtr.root_manifest_kind = 'index_manifest'
+    AND EXISTS (
+      SELECT 1
+      FROM manifest_edges me
+      JOIN manifests child
+        ON child.scan_id = ?
+       AND child.digest = me.child_digest
+      WHERE me.scan_id = ?
+        AND me.parent_digest = dtr.root_digest
+        AND me.edge_kind = 'referrer'
+        AND child.manifest_kind = 'signature_manifest'
+    )
+    AND EXISTS (
+      SELECT 1
+      FROM manifest_edges me
+      JOIN manifests child
+        ON child.scan_id = ?
+       AND child.digest = me.child_digest
+      WHERE me.scan_id = ?
+        AND me.parent_digest = dtr.root_digest
+        AND me.edge_kind = 'image-child'
+        AND child.manifest_kind <> 'signature_manifest'
+    )
+    AND NOT EXISTS (
+      SELECT 1
+      FROM manifest_edges me
+      JOIN manifests child
+        ON child.scan_id = ?
+       AND child.digest = me.child_digest
+      WHERE me.scan_id = ?
+        AND me.parent_digest = dtr.root_digest
+        AND me.edge_kind = 'image-child'
+        AND child.manifest_kind <> 'signature_manifest'
+        AND child.digest NOT IN (
+          SELECT digest
+          FROM retained_manifests
+        )
+    )
+`;

package/dist/db/planner/_planner-plan-artifacts.js

@@ -1,4 +1,7 @@
 import { mapBlockedRootRow, mapClosureManifestRow } from "./_planner-types.js";
+import { _LIST_BLOCKED_ROOTS_SQL } from "./_planner-plan-artifacts-blocked-roots-sql.js";
+import { _LIST_CLOSURE_MANIFESTS_SQL } from "./_planner-plan-artifacts-closure-sql.js";
+import { _LIST_SUPPORTED_UNTAG_ONLY_ROOT_DIGESTS_SQL } from "./_planner-plan-artifacts-supported-untag-only-sql.js";
 export class PlannerPlanArtifacts {
     #sql;
     constructor(sql) {
@@ -10,7 +13,8 @@ export class PlannerPlanArtifacts {
             return {
                 closureManifests: [],
                 blockedRoots: [],
-                fullyDeletableRoots: []
+                fullyDeletableRoots: [],
+                supportedUntagOnlyRootDigests: new Set()
             };
         }
         return this.#withDirectTargetRootsTempTable(deleteRootCandidates, () => {
@@ -18,143 +22,37 @@ export class PlannerPlanArtifacts {
             const blockedRoots = this.#listBlockedRoots(scanId);
             const blockedVersionIds = new Set(blockedRoots.map((root) => root.blockedVersionId));
             const fullyDeletableRoots = deleteRootCandidates.filter((root) => !blockedVersionIds.has(root.versionId));
+            const supportedUntagOnlyRootDigests = this.#listSupportedUntagOnlyRootDigests(scanId);
             return {
                 closureManifests,
                 blockedRoots,
-                fullyDeletableRoots
+                fullyDeletableRoots,
+                supportedUntagOnlyRootDigests
             };
         });
     }
+    #listSupportedUntagOnlyRootDigests(scanId) {
+        const rows = this.#sql.all(_LIST_SUPPORTED_UNTAG_ONLY_ROOT_DIGESTS_SQL, [
+            scanId,
+            scanId,
+            scanId,
+            scanId,
+            scanId,
+            scanId,
+            scanId,
+            scanId,
+            scanId
+        ]);
+        return new Set(rows.map((row) => row.root_digest));
+    }
     #listClosureManifests(scanId) {
-        const sql = `
-      WITH direct_target_closure AS (
-        SELECT
-          dtr.root_version_id AS source_version_id,
-          dtr.root_digest AS source_digest,
-          dtr.root_version_id AS member_version_id,
-          dtr.root_digest AS member_digest,
-          dtr.root_manifest_kind AS member_manifest_kind,
-          0 AS hops_from_root,
-          'root' AS member_role
-        FROM temp_direct_target_roots dtr
-
-        UNION ALL
-
-        SELECT
-          dtr.root_version_id AS source_version_id,
-          dtr.root_digest AS source_digest,
-          m.version_id AS member_version_id,
-          m.digest AS member_digest,
-          m.manifest_kind AS member_manifest_kind,
-          mr.min_distance AS hops_from_root,
-          'descendant' AS member_role
-        FROM temp_direct_target_roots dtr
-        JOIN manifest_reachability mr
-          ON mr.scan_id = ?
-         AND mr.ancestor_digest = dtr.root_digest
-         AND mr.min_distance > 0
-        JOIN manifests m
-          ON m.scan_id = ?
-         AND m.digest = mr.descendant_digest
-      )
-      SELECT
-        source_version_id,
-        source_digest,
-        member_version_id,
-        member_digest,
-        member_manifest_kind,
-        hops_from_root,
-        member_role
-      FROM direct_target_closure
-      ORDER BY source_digest, hops_from_root, member_digest
-    `;
-        return this.#sql.all(sql, [scanId, scanId]).map(mapClosureManifestRow);
+        return this.#sql
+            .all(_LIST_CLOSURE_MANIFESTS_SQL, [scanId, scanId, scanId, scanId, scanId, scanId, scanId, scanId, scanId, scanId])
+            .map(mapClosureManifestRow);
     }
     #listBlockedRoots(scanId) {
-        const sql = `
-      WITH retained_roots AS (
-        SELECT
-          m.version_id AS root_version_id,
-          m.digest AS root_digest
-        FROM manifests m
-        WHERE m.scan_id = ?
-          AND NOT EXISTS (
-            SELECT 1
-            FROM manifest_reachability mr
-            WHERE mr.scan_id = m.scan_id
-              AND mr.descendant_digest = m.digest
-              AND mr.min_distance > 0
-          )
-          AND NOT EXISTS (
-            SELECT 1
-            FROM temp_direct_target_roots dtr
-            WHERE dtr.root_digest = m.digest
-          )
-      ),
-      direct_target_closure AS (
-        SELECT
-          dtr.root_version_id AS root_version_id,
-          dtr.root_digest AS root_digest,
-          dtr.root_manifest_kind AS member_manifest_kind,
-          dtr.root_digest AS member_digest,
-          0 AS hops_from_root
-        FROM temp_direct_target_roots dtr
-
-        UNION ALL
-
-        SELECT
-          dtr.root_version_id AS root_version_id,
-          dtr.root_digest AS root_digest,
-          m.manifest_kind AS member_manifest_kind,
-          m.digest AS member_digest,
-          mr.min_distance AS hops_from_root
-        FROM temp_direct_target_roots dtr
-        JOIN manifest_reachability mr
-          ON mr.scan_id = ?
-         AND mr.ancestor_digest = dtr.root_digest
-         AND mr.min_distance > 0
-        JOIN manifests m
-          ON m.scan_id = ?
-         AND m.digest = mr.descendant_digest
-      ),
-      ranked_blocks AS (
-        SELECT
-          dtc.root_version_id AS blocked_version_id,
-          dtc.root_digest AS blocked_digest,
-          rr.root_version_id AS blocking_version_id,
-          rr.root_digest AS blocking_digest,
-          dtc.member_digest AS overlap_digest,
-          dtc.member_manifest_kind AS overlap_manifest_kind,
-          'overlap-with-retained-root' AS block_reason,
-          ROW_NUMBER() OVER (
-            PARTITION BY dtc.root_digest, rr.root_digest
-            ORDER BY
-              dtc.hops_from_root,
-              retained_overlap.min_distance,
-              dtc.member_digest
-          ) AS rn
-        FROM direct_target_closure dtc
-        JOIN retained_roots rr
-          ON rr.root_digest <> dtc.root_digest
-        JOIN manifest_reachability retained_overlap
-          ON retained_overlap.scan_id = ?
-         AND retained_overlap.ancestor_digest = rr.root_digest
-         AND retained_overlap.descendant_digest = dtc.member_digest
-      )
-      SELECT
-        blocked_version_id,
-        blocked_digest,
-        blocking_version_id,
-        blocking_digest,
-        overlap_digest,
-        overlap_manifest_kind,
-        block_reason
-      FROM ranked_blocks
-      WHERE rn = 1
-      ORDER BY blocked_digest, blocking_digest, overlap_digest
-    `;
         return this.#sql
-            .all(sql, [scanId, scanId, scanId, scanId])
+            .all(_LIST_BLOCKED_ROOTS_SQL, [scanId, scanId, scanId])
             .map(mapBlockedRootRow);
     }
     #withDirectTargetRootsTempTable(directTargetRoots, callback) {

package/dist/db/planner/_planner-sql.js

@@ -14,16 +14,24 @@ export class PlannerSql {
     }
     exec(sql, params = []) {
         this.#traceSql(sql, params);
+        const startedAt = Date.now();
         this.#database.prepare(sql).run(...params);
+        this.#logger.trace(`SQL exec completed in ${Date.now() - startedAt} ms`);
     }
     get(sql, params) {
+        this.#debugSql(sql, params);
         this.#traceSql(sql, params);
-        return this.#database.prepare(sql).get(...params);
+        const startedAt = Date.now();
+        const row = this.#database.prepare(sql).get(...params);
+        this.#logger.debug(`SQL returned ${row === undefined ? "0" : "1"} row(s) in ${Date.now() - startedAt} ms`);
+        return row;
     }
     all(sql, params) {
+        this.#debugSql(sql, params);
         this.#traceSql(sql, params);
+        const startedAt = Date.now();
         const rows = this.#database.prepare(sql).all(...params);
-        this.#logger.debug(`SQL returned ${rows.length} row(s)`);
+        this.#logger.debug(`SQL returned ${rows.length} row(s) in ${Date.now() - startedAt} ms`);
         return rows;
     }
     traceSql(sql, params) {
@@ -32,4 +40,7 @@ export class PlannerSql {
     #traceSql(sql, params) {
         this.#logger.trace(`SQL:\n${sql.trim()}\nPARAMS: ${JSON.stringify(params)}`);
     }
+    #debugSql(sql, params) {
+        this.#logger.debug(`SQL:\n${sql.trim()}\nPARAMS: ${JSON.stringify(params)}`);
+    }
 }

package/dist/db/planner/_planner-types.d.ts

@@ -48,6 +48,7 @@ export declare const DeletePlanValidationStatuses: {
 export type DeletePlanValidationStatus = (typeof DeletePlanValidationStatuses)[keyof typeof DeletePlanValidationStatuses];
 export declare const DeletePlanValidationReasonCodes: {
     readonly untagOnlyPartialTagMatch: "untag-only-partial-tag-match";
+    readonly untagOnlyRetainedManifest: "untag-only-retained-manifest";
     readonly fullyDeletableNoRetainedOverlap: "fully-deletable-no-retained-overlap";
     readonly blockedOverlapWithRetainedRoot: "blocked-overlap-with-retained-root";
 };
@@ -106,6 +107,7 @@ export interface PlanArtifacts {
     closureManifests: DeletePlanClosureManifest[];
     blockedRoots: DeletePlanBlockedRoot[];
     fullyDeletableRoots: DeletePlanRoot[];
+    supportedUntagOnlyRootDigests: Set<string>;
 }
 export interface DeletePlan {
     owner: string;