ghcr-manager 0.9.7 → 0.9.8

package/dist/db/planner/_planner-types.js

@@ -5,6 +5,7 @@ export const DeletePlanValidationStatuses = {
 };
 export const DeletePlanValidationReasonCodes = {
     untagOnlyPartialTagMatch: "untag-only-partial-tag-match",
+    untagOnlyRetainedManifest: "untag-only-retained-manifest",
     fullyDeletableNoRetainedOverlap: "fully-deletable-no-retained-overlap",
     blockedOverlapWithRetainedRoot: "blocked-overlap-with-retained-root"
 };

package/dist/execute/_plan-executor.js

@@ -2,8 +2,8 @@ import { DeletePlanValidationStatuses } from "../db/index.js";
 import { deletePackageVersion } from "./_package-version-delete-client.js";
 import { untagRootTags } from "./_untag-client.js";
 export async function executeDeletePlan(plan, options) {
-    const deletedPackageVersions = [];
-    const untaggedTags = [];
+    let deletedPackageVersionCount = 0;
+    let detachedTagCount = 0;
     const directTargetTagSet = new Set(plan.directTargetTags);
     const deletedVersionIds = new Set();
     for (const decision of plan.rootDecisions) {
@@ -24,7 +24,7 @@ export async function executeDeletePlan(plan, options) {
         if (selectedTags.length === 0) {
             throw new Error(`no selected tags resolved for untag-only root ${decision.digest}`);
         }
-        untaggedTags.push(...(await untagRootTags(plan.owner, plan.packageName, decision.versionId, decision.digest, selectedTags, options)));
+        detachedTagCount += await untagRootTags(plan.owner, plan.packageName, decision.versionId, decision.digest, selectedTags, options);
     }
     const closureMembersByRootDigest = new Map(plan.fullyDeletableRoots.map((root) => [
         root.digest,
@@ -54,10 +54,7 @@ export async function executeDeletePlan(plan, options) {
                 fetchImpl: options.fetchImpl
             });
             deletedVersionIds.add(target.versionId);
-            deletedPackageVersions.push({
-                versionId: target.versionId,
-                digest: target.digest
-            });
+            deletedPackageVersionCount += 1;
         }
     }
     return {
@@ -65,9 +62,8 @@ export async function executeDeletePlan(plan, options) {
         packageName: plan.packageName,
         scanCompletedAt: plan.scanCompletedAt,
         plannerInputs: plan.plannerInputs,
-        deletedPackageVersions,
-        untaggedTags,
-        blockedRoots: plan.blockedRoots,
-        unsupportedUntagRoots: []
+        deletedPackageVersionCount,
+        detachedTagCount,
+        blockedRoots: plan.blockedRoots
     };
 }

package/dist/execute/_types.d.ts

@@ -1,29 +1,12 @@
 import type { DeletePlan } from "../db/index.js";
-export interface DeletePackageVersionOperation {
-    versionId: number;
-    digest: string;
-}
-export interface UnsupportedUntagRoot {
-    versionId: number;
-    digest: string;
-    reason: string;
-}
-export interface UntagTagOperation {
-    tag: string;
-    sourceVersionId: number;
-    sourceDigest: string;
-    detachedVersionId: number;
-    detachedDigest: string;
-}
 export interface DeleteExecutionSummary {
     owner: string;
     packageName: string;
     scanCompletedAt: string;
     plannerInputs: DeletePlan["plannerInputs"];
-    deletedPackageVersions: DeletePackageVersionOperation[];
-    untaggedTags: UntagTagOperation[];
+    deletedPackageVersionCount: number;
+    detachedTagCount: number;
     blockedRoots: DeletePlan["blockedRoots"];
-    unsupportedUntagRoots: UnsupportedUntagRoot[];
 }
 export interface DeleteExecutionOptions {
     token: string;

package/dist/execute/_untag-client.d.ts

@@ -1,2 +1,2 @@
-import type { DeleteExecutionOptions, UntagTagOperation } from "./_types.js";
-export declare function untagRootTags(owner: string, packageName: string, sourceVersionId: number, sourceDigest: string, tags: string[], options: DeleteExecutionOptions): Promise<UntagTagOperation[]>;
+import type { DeleteExecutionOptions } from "./_types.js";
+export declare function untagRootTags(owner: string, packageName: string, sourceVersionId: number, sourceDigest: string, tags: string[], options: DeleteExecutionOptions): Promise<number>;

package/dist/execute/_untag-client.js

@@ -1,6 +1,5 @@
 import { buildDetachedManifestClone } from "./_manifest-detach.js";
 import { findPackageVersionByDigestAndTag } from "./_package-version-page-client.js";
-import { listPackageVersionTagSources, listPresentPackageVersionIds } from "./_package-version-tag-source-client.js";
 import { deletePackageVersion } from "./_package-version-delete-client.js";
 import { loadRegistryManifestByDigest, putRegistryManifestForTag } from "./_registry-manifest-client.js";
 import { loadRegistryPushToken } from "./_registry-token-client.js";
@@ -11,7 +10,6 @@ export async function untagRootTags(owner, packageName, sourceVersionId, sourceD
     const sourceManifest = await loadRegistryManifestByDigest(owner, packageName, sourceDigest, registryToken, options.logger, {
         fetchImpl: options.fetchImpl
     });
-    const operations = [];
     for (const tag of tags) {
         options.logger.info(`Detaching tag ${owner}/${packageName}:${tag} from ${sourceDigest}`);
         const detachedManifestJson = buildDetachedManifestClone(sourceManifest.rawJson, sourceManifest.mediaType, {
@@ -27,45 +25,6 @@ export async function untagRootTags(owner, packageName, sourceVersionId, sourceD
         await deletePackageVersion(owner, packageName, detachedVersionId, options.token, options.logger, {
             fetchImpl: options.fetchImpl
         });
-        await _assertTagRemoved(owner, packageName, tag, options);
-        await _assertVersionRemoved(owner, packageName, detachedVersionId, options);
-        operations.push({
-            tag,
-            sourceVersionId,
-            sourceDigest,
-            detachedVersionId,
-            detachedDigest
-        });
-    }
-    return operations;
-}
-async function _assertTagRemoved(owner, packageName, tag, options) {
-    for (let attempt = 1; attempt <= 5; attempt += 1) {
-        const remaining = await listPackageVersionTagSources(owner, packageName, [tag], options.token, options.logger, {
-            fetchImpl: options.fetchImpl
-        });
-        if (remaining.length === 0) {
-            return;
-        }
-        if (attempt < 5) {
-            options.logger.warn(`Tag ${owner}/${packageName}:${tag} is still visible after untag; retrying check ${attempt}/5`);
-            await new Promise((resolve) => setTimeout(resolve, 1000));
-        }
-    }
-    throw new Error(`tag ${owner}/${packageName}:${tag} is still visible after untag`);
-}
-async function _assertVersionRemoved(owner, packageName, versionId, options) {
-    for (let attempt = 1; attempt <= 5; attempt += 1) {
-        const presentVersionIds = await listPresentPackageVersionIds(owner, packageName, [versionId], options.token, options.logger, {
-            fetchImpl: options.fetchImpl
-        });
-        if (presentVersionIds.length === 0) {
-            return;
-        }
-        if (attempt < 5) {
-            options.logger.warn(`Temporary package version ${owner}/${packageName}#${versionId} is still visible after untag; retrying check ${attempt}/5`);
-            await new Promise((resolve) => setTimeout(resolve, 1000));
-        }
     }
-    throw new Error(`temporary package version ${owner}/${packageName}#${versionId} is still visible after untag`);
+    return tags.length;
 }

package/dist/execute/index.d.ts

@@ -2,4 +2,4 @@ export { executeDeletePlan } from "./_plan-executor.js";
 export { listPackageVersionTagSources, listPresentPackageVersionIds } from "./_package-version-tag-source-client.js";
 export { untagRootTags } from "./_untag-client.js";
 export type { GitHubPackageVersionTagSource } from "./_package-version-tag-source-client.js";
-export type { DeleteExecutionSummary, UntagTagOperation } from "./_types.js";
+export type { DeleteExecutionSummary } from "./_types.js";

package/dist/ingest/github/_manifest-kind.d.ts

@@ -7,6 +7,12 @@ interface _RegistryManifestDocument {
     mediaType?: string;
     artifactType?: string;
     annotations?: Record<string, unknown>;
+    manifests?: Array<{
+        platform?: {
+            architecture?: string;
+            os?: string;
+        };
+    }>;
     config?: {
         mediaType?: string;
         artifactType?: string;

package/dist/ingest/github/_manifest-kind.js

@@ -2,7 +2,7 @@ import { ManifestKinds } from "../../core/index.js";
 export function classifyManifestKind(document) {
     if (document.mediaType === "application/vnd.oci.image.index.v1+json" ||
         document.mediaType === "application/vnd.docker.distribution.manifest.list.v2+json") {
-        return ManifestKinds.indexManifest;
+        return _isMultiArchManifest(document) ? ManifestKinds.multiArchManifest : ManifestKinds.indexManifest;
     }
     if (_isSignatureManifest(document)) {
         return ManifestKinds.signatureManifest;
@@ -10,7 +10,8 @@ export function classifyManifestKind(document) {
     if (_isAttestationManifest(document)) {
         return ManifestKinds.attestationManifest;
     }
-    if (document.mediaType === "application/vnd.oci.image.manifest.v1+json") {
+    if (document.mediaType === "application/vnd.oci.image.manifest.v1+json" ||
+        document.mediaType === "application/vnd.docker.distribution.manifest.v2+json") {
         return ManifestKinds.imageManifest;
     }
     if (document.mediaType === "application/vnd.oci.artifact.manifest.v1+json") {
@@ -18,6 +19,19 @@ export function classifyManifestKind(document) {
     }
     return undefined;
 }
+function _isMultiArchManifest(document) {
+    const realPlatformDescriptorCount = document.manifests?.filter((descriptor) => {
+        const architecture = descriptor.platform?.architecture;
+        const os = descriptor.platform?.os;
+        return (typeof architecture === "string" &&
+            typeof os === "string" &&
+            architecture.length > 0 &&
+            os.length > 0 &&
+            architecture !== "unknown" &&
+            os !== "unknown");
+    }).length ?? 0;
+    return realPlatformDescriptorCount > 1;
+}
 function _isSignatureManifest(document) {
     const candidates = [
         document.artifactType,

package/package.json

@@ -1,18 +1,21 @@
 {
   "name": "ghcr-manager",
   "description": "Inspect, analyze, and manage GitHub Container Registry packages.",
-  "homepage": "https://github.com/gh-workflow/ghcr-manager#readme",
+  "homepage": "https://github.com/ghcr-manager/ghcr-manager#readme",
   "bugs": {
-    "url": "https://github.com/gh-workflow/ghcr-manager/issues"
+    "url": "https://github.com/ghcr-manager/ghcr-manager/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/gh-workflow/ghcr-manager"
+    "url": "https://github.com/ghcr-manager/ghcr-manager"
   },
-  "version": "0.9.7",
+  "version": "0.9.8",
   "type": "module",
+  "workspaces": [
+    "visualizer"
+  ],
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=24.0.0"
   },
   "files": [
     "dist",
@@ -26,19 +29,22 @@
   },
   "scripts": {
     "build": "tsc --project tsconfig.json",
-    "coverage": "c8 --src src --reporter=text --reporter=text-summary node --import tsx --test",
+    "build:visualizer": "npm run build --workspace visualizer",
     "ghcr-manager": "tsx src/cli/index.ts",
     "ghcr-manager:dist": "node dist/cli/index.js",
+    "visualize": "npm run dev --workspace visualizer --",
+    "visualizer:start": "npm run start --workspace visualizer --",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint": "npm run check:file-names && npm run check:test-mapping && npm run typecheck && npm run lint:ts && npm run lint:yaml && npm run lint:markdown && npm run format:check",
+    "lint": "npm run check:file-names && npm run check:test-mapping && npm run typecheck && npm run typecheck --workspace visualizer && npm run lint:ts && npm run lint:yaml && npm run lint:markdown && npm run lint --workspace visualizer && npm run format:check",
     "check:file-names": "node tools/tests/check-src-file-names.mjs",
     "check:test-mapping": "node tools/tests/check-test-mapping.mjs",
     "lint:ts": "eslint \"src/**/*.ts\" \"tests/**/*.ts\"",
     "lint:yaml": "eslint \".github/**/*.yml\" \"*.yml\"",
     "lint:markdown": "markdownlint-cli2",
     "typecheck": "tsc --noEmit --project tsconfig.json",
-    "test": "node --import tsx --test"
+    "test": "bash -lc 'shopt -s globstar nullglob; node --import tsx --test tests/**/*.test.ts' && npm run test --workspace visualizer",
+    "coverage": "bash -lc 'shopt -s globstar nullglob; c8 --src src --reporter=text --reporter=text-summary node --import tsx --test tests/**/*.test.ts'"
   },
   "dependencies": {
     "better-sqlite3": "^12.9.0"
@@ -46,10 +52,10 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^25.6.0",
+    "@types/node": "^24.12.4",
     "c8": "^11.0.0",
     "eslint": "^10.2.1",
-    "eslint-plugin-yml": "^3.3.2",
+    "eslint-plugin-yml": "^3.4.0",
     "globals": "^17.5.0",
     "markdownlint-cli2": "^0.22.1",
     "prettier": "^3.8.3",

package/resources/sql/schema/001_schema.sql

@@ -49,13 +49,10 @@ CREATE TABLE IF NOT EXISTS manifests (
   config_media_type TEXT,
   subject_digest TEXT,
   annotations_json TEXT,
-  platform_os TEXT,
-  platform_architecture TEXT,
-  platform_variant TEXT,
   manifest_kind TEXT,
   CHECK(manifest_kind IN (
     'index_manifest',
-    'cross_arch_manifest',
+    'multi_arch_manifest',
     'image_manifest',
     'artifact_manifest',
     'attestation_manifest',
@@ -109,6 +106,15 @@ CREATE TABLE IF NOT EXISTS manifest_reachability (
   CHECK(min_distance >= 0)
 );
 
+CREATE TABLE IF NOT EXISTS manifest_graphs (
+  scan_id INTEGER NOT NULL,
+  digest TEXT NOT NULL,
+  graph_id INTEGER NOT NULL,
+  PRIMARY KEY(scan_id, digest),
+  FOREIGN KEY(scan_id, digest) REFERENCES manifests(scan_id, digest),
+  CHECK(graph_id > 0)
+);
+
 CREATE TABLE IF NOT EXISTS cleanup_runs (
   cleanup_run_id INTEGER PRIMARY KEY,
   scan_id INTEGER NOT NULL,
@@ -152,6 +158,7 @@ CREATE TABLE IF NOT EXISTS cleanup_root_decisions (
   CHECK(validation_status IN ('fully-deletable', 'blocked', 'untag-only')),
   CHECK(validation_reason_code IN (
     'untag-only-partial-tag-match',
+    'untag-only-retained-manifest',
     'fully-deletable-no-retained-overlap',
     'blocked-overlap-with-retained-root'
   )),
@@ -200,7 +207,10 @@ CREATE INDEX IF NOT EXISTS idx_tags_scan_version ON tags(scan_id, version_id);
 CREATE INDEX IF NOT EXISTS idx_manifest_descriptors_scan_child ON manifest_descriptors(scan_id, child_digest);
 CREATE INDEX IF NOT EXISTS idx_manifest_edges_scan_parent ON manifest_edges(scan_id, parent_digest);
 CREATE INDEX IF NOT EXISTS idx_manifest_edges_scan_child ON manifest_edges(scan_id, child_digest);
+CREATE INDEX IF NOT EXISTS idx_manifest_edges_scan_child_kind ON manifest_edges(scan_id, child_digest, edge_kind);
 CREATE INDEX IF NOT EXISTS idx_manifest_reachability_scan_descendant
   ON manifest_reachability(scan_id, descendant_digest);
 CREATE INDEX IF NOT EXISTS idx_manifest_reachability_scan_descendant_distance
   ON manifest_reachability(scan_id, descendant_digest, min_distance);
+CREATE INDEX IF NOT EXISTS idx_manifest_graphs_scan_graph_id
+  ON manifest_graphs(scan_id, graph_id);

package/dist/cli/_untag-command.d.ts

@@ -1 +0,0 @@
-export declare function handleUntag(args: string[]): Promise<number>;

package/dist/cli/_untag-command.js

@@ -1,58 +0,0 @@
-import { listPackageVersionTagSources, untagRootTags } from "../execute/index.js";
-import { collectRepeatedOption, hasFlag, requireOption, resolveLogLevel, resolveToken } from "./_args.js";
-import { writeJsonOutput } from "./_json-output.js";
-import { createLogger } from "./_logger.js";
-export async function handleUntag(args) {
-    const owner = requireOption(args, "--owner");
-    const packageName = requireOption(args, "--package");
-    const requestedTags = [...new Set(collectRepeatedOption(args, "--tag"))];
-    if (requestedTags.length === 0) {
-        throw new Error("missing required option: --tag");
-    }
-    const token = resolveToken(args);
-    const dryRun = hasFlag(args, "--dry-run");
-    const logger = createLogger(resolveLogLevel(args));
-    const tagSources = await listPackageVersionTagSources(owner, packageName, requestedTags, token, logger);
-    const matchedTags = new Set(tagSources.map((tagSource) => tagSource.tag));
-    const missingTags = requestedTags.filter((tag) => !matchedTags.has(tag));
-    if (missingTags.length > 0) {
-        throw new Error(`could not resolve tag(s): ${missingTags.join(", ")}`);
-    }
-    const roots = _groupTagSources(tagSources);
-    const untaggedTags = [];
-    if (!dryRun) {
-        for (const root of roots) {
-            untaggedTags.push(...(await untagRootTags(owner, packageName, root.versionId, root.digest, root.tags, {
-                token,
-                logger
-            })));
-        }
-    }
-    const summary = {
-        owner,
-        packageName,
-        requestedTags,
-        dryRun,
-        roots,
-        untaggedTags
-    };
-    writeJsonOutput(args, "--summary-json-path", summary);
-    return 0;
-}
-function _groupTagSources(tagSources) {
-    const groups = new Map();
-    for (const tagSource of tagSources) {
-        const key = `${tagSource.sourceVersionId}:${tagSource.sourceDigest}`;
-        const existing = groups.get(key);
-        if (existing) {
-            existing.tags.push(tagSource.tag);
-            continue;
-        }
-        groups.set(key, {
-            versionId: tagSource.sourceVersionId,
-            digest: tagSource.sourceDigest,
-            tags: [tagSource.tag]
-        });
-    }
-    return [...groups.values()];
-}

package/dist/db/_manifest-kind-refinement.d.ts

@@ -1,2 +0,0 @@
-import type Database from "better-sqlite3";
-export declare function refineManifestKinds(database: Database.Database, scanId: number): void;

package/dist/db/_manifest-kind-refinement.js

@@ -1,43 +0,0 @@
-import { ManifestKinds } from "../core/index.js";
-const _refineManifestKindsStatementByDatabase = new WeakMap();
-export function refineManifestKinds(database, scanId) {
-    _refineManifestKindsStatement(database).run(ManifestKinds.crossArchManifest, scanId, ManifestKinds.indexManifest);
-}
-function _refineManifestKindsStatement(database) {
-    const cached = _refineManifestKindsStatementByDatabase.get(database);
-    if (cached) {
-        return cached;
-    }
-    const statement = database.prepare(`
-    UPDATE manifests AS parent
-    SET manifest_kind = ?
-    WHERE parent.scan_id = ?
-      AND parent.manifest_kind = ?
-      AND parent.media_type IN (
-        'application/vnd.oci.image.index.v1+json',
-        'application/vnd.docker.distribution.manifest.list.v2+json'
-      )
-      AND NOT EXISTS (
-        SELECT 1
-        FROM tags helper_tag
-        WHERE helper_tag.scan_id = parent.scan_id
-          AND helper_tag.version_id = parent.version_id
-          AND helper_tag.is_digest_tag = 1
-      )
-      AND EXISTS (
-        SELECT 1
-        FROM manifest_descriptors descriptor
-        JOIN manifests child
-          ON child.scan_id = descriptor.scan_id
-         AND child.digest = descriptor.child_digest
-        WHERE descriptor.scan_id = parent.scan_id
-          AND descriptor.parent_digest = parent.digest
-          AND child.media_type IN (
-            'application/vnd.oci.image.manifest.v1+json',
-            'application/vnd.docker.distribution.manifest.v2+json'
-          )
-      )
-  `);
-    _refineManifestKindsStatementByDatabase.set(database, statement);
-    return statement;
-}

package/resources/sql/views/002_v_scan_root_manifests.sql

@@ -1,44 +0,0 @@
-DROP VIEW IF EXISTS v_scan_root_manifests;
-
-CREATE VIEW v_scan_root_manifests AS
-SELECT
-  ps.scan_id,
-  ps.owner,
-  ps.package_name,
-  m.version_id AS root_version_id,
-  m.digest AS root_digest,
-  m.manifest_kind AS root_manifest_kind,
-  pv.created_at,
-  pv.updated_at,
-  COUNT(t.tag) AS tag_count,
-  CASE WHEN COUNT(t.tag) > 0 THEN 1 ELSE 0 END AS is_tagged,
-  CASE
-    WHEN EXISTS (
-      SELECT 1
-      FROM manifest_reachability mr
-      WHERE mr.scan_id = m.scan_id
-        AND mr.descendant_digest = m.digest
-        AND mr.min_distance > 0
-    ) THEN 1
-    ELSE 0
-  END AS has_ancestor
-FROM manifests m
-JOIN package_versions pv
-  ON pv.scan_id = m.scan_id
- AND pv.version_id = m.version_id
-JOIN package_scans ps
-  ON ps.scan_id = m.scan_id
-LEFT JOIN tags t
-  ON t.scan_id = m.scan_id
- AND t.version_id = m.version_id
- AND t.is_digest_tag = 0
-GROUP BY
-  ps.scan_id,
-  ps.owner,
-  ps.package_name,
-  m.version_id,
-  m.digest,
-  m.manifest_kind,
-  pv.created_at,
-  pv.updated_at
-;

package/resources/sql/views/003_v_digest_tag_relations.sql

@@ -1,50 +0,0 @@
-DROP VIEW IF EXISTS v_digest_tag_relations;
-
-CREATE VIEW v_digest_tag_relations AS
-WITH digest_like_tags AS (
-  SELECT
-    lsp.scan_id,
-    lsp.owner,
-    lsp.package_name,
-    t.tag,
-    t.version_id AS artifact_version_id,
-    m.digest AS artifact_digest,
-    m.manifest_kind AS artifact_manifest_kind,
-    m.subject_digest AS artifact_subject_digest,
-    'sha256:' || SUBSTR(t.tag, 8, 64) AS parent_digest,
-    SUBSTR(t.tag, 72) AS tag_suffix
-  FROM tags t
-  JOIN v_latest_scan_per_package lsp
-    ON lsp.scan_id = t.scan_id
-  JOIN manifests m
-    ON m.scan_id = t.scan_id
-   AND m.version_id = t.version_id
-  WHERE t.tag LIKE 'sha256-%'
-    AND LENGTH(t.tag) >= 71
-    AND SUBSTR(t.tag, 8, 64) NOT GLOB '*[^0-9A-Fa-f]*'
-)
-SELECT
-  dlt.scan_id,
-  dlt.owner,
-  dlt.package_name,
-  dlt.tag,
-  dlt.artifact_version_id,
-  dlt.artifact_digest,
-  dlt.artifact_manifest_kind,
-  dlt.artifact_subject_digest,
-  dlt.parent_digest,
-  dlt.tag_suffix,
-  pm.version_id AS parent_version_id,
-  pm.manifest_kind AS parent_manifest_kind,
-  CASE
-    WHEN dlt.artifact_subject_digest = dlt.parent_digest THEN 1
-    ELSE 0
-  END AS subject_matches_parent,
-  CASE
-    WHEN pm.digest IS NULL THEN 0
-    ELSE 1
-  END AS parent_exists
-FROM digest_like_tags dlt
-LEFT JOIN manifests pm
-  ON pm.scan_id = dlt.scan_id
- AND pm.digest = dlt.parent_digest;

package/resources/sql/views/004_v_cleanup_root_closure_members.sql

@@ -1,101 +0,0 @@
-DROP VIEW IF EXISTS v_cleanup_root_closure_members;
-
-CREATE VIEW v_cleanup_root_closure_members AS
-WITH selected_roots AS (
-  SELECT
-    run.cleanup_run_id,
-    run.scan_id,
-    ps.owner,
-    ps.package_name,
-    decision.digest AS root_digest,
-    root_manifest.version_id AS root_version_id,
-    root_manifest.manifest_kind AS root_manifest_kind,
-    decision.selection_mode,
-    decision.selection_reason,
-    decision.validation_status,
-    decision.validation_reason_code,
-    decision.validation_reason
-  FROM cleanup_root_decisions decision
-  JOIN cleanup_runs run
-    ON run.cleanup_run_id = decision.cleanup_run_id
-   AND run.scan_id = decision.scan_id
-  JOIN package_scans ps
-    ON ps.scan_id = run.scan_id
-  JOIN manifests root_manifest
-    ON root_manifest.scan_id = decision.scan_id
-   AND root_manifest.digest = decision.digest
-),
-closure_members AS (
-  SELECT
-    sr.cleanup_run_id,
-    sr.scan_id,
-    sr.owner,
-    sr.package_name,
-    sr.root_digest,
-    sr.root_version_id,
-    sr.root_manifest_kind,
-    sr.selection_mode,
-    sr.selection_reason,
-    sr.validation_status,
-    sr.validation_reason_code,
-    sr.validation_reason,
-    sr.root_digest AS member_digest,
-    sr.root_version_id AS member_version_id,
-    sr.root_manifest_kind AS member_manifest_kind,
-    0 AS hops_from_root,
-    'root' AS member_role
-  FROM selected_roots sr
-
-  UNION ALL
-
-  SELECT
-    sr.cleanup_run_id,
-    sr.scan_id,
-    sr.owner,
-    sr.package_name,
-    sr.root_digest,
-    sr.root_version_id,
-    sr.root_manifest_kind,
-    sr.selection_mode,
-    sr.selection_reason,
-    sr.validation_status,
-    sr.validation_reason_code,
-    sr.validation_reason,
-    member_manifest.digest AS member_digest,
-    member_manifest.version_id AS member_version_id,
-    member_manifest.manifest_kind AS member_manifest_kind,
-    reachability.min_distance AS hops_from_root,
-    'descendant' AS member_role
-  FROM selected_roots sr
-  JOIN manifest_reachability reachability
-    ON reachability.scan_id = sr.scan_id
-   AND reachability.ancestor_digest = sr.root_digest
-   AND reachability.min_distance > 0
-  JOIN manifests member_manifest
-    ON member_manifest.scan_id = sr.scan_id
-   AND member_manifest.digest = reachability.descendant_digest
-)
-SELECT
-  cm.cleanup_run_id,
-  cm.scan_id,
-  cm.owner,
-  cm.package_name,
-  cm.root_digest,
-  cm.root_version_id,
-  cm.root_manifest_kind,
-  cm.selection_mode,
-  cm.selection_reason,
-  cm.validation_status,
-  cm.validation_reason_code,
-  cm.validation_reason,
-  cm.member_digest,
-  cm.member_version_id,
-  cm.member_manifest_kind,
-  cm.hops_from_root,
-  cm.member_role,
-  tag.tag AS member_tag
-FROM closure_members cm
-LEFT JOIN tags tag
-  ON tag.scan_id = cm.scan_id
- AND tag.version_id = cm.member_version_id
- AND tag.is_digest_tag = 0;