packtory 0.0.10 → 0.0.12

package/sbom/extract-license.js

@@ -1,2 +1,12 @@
 import { isPlainObject } from 'remeda';
+export function extractLicenseFromManifest(packageJson) {
+    if (!isPlainObject(packageJson)) {
+        return undefined;
+    }
+    const { license } = packageJson;
+    if (typeof license === 'string' && license.length > 0) {
+        return license;
+    }
+    return undefined;
+}
 //# sourceMappingURL=extract-license.js.map

package/sbom/extract-license.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-license.js","sourceRoot":"","sources":["../../../../source/sbom/extract-license.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ"}
+{"version":3,"file":"extract-license.js","sourceRoot":"","sources":["../../../../source/sbom/extract-license.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEvC,MAAM,UAAU,0BAA0B,CAAC,WAAoB;IAC3D,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/sbom/license-resolver.d.ts

@@ -1,14 +1,3 @@
 import type { FileManager } from '../file-manager/file-manager.ts';
-type LicenseResolverDependencies = {
-    readonly fileManager: FileManager;
-};
-type LicenseResolveOptions = {
-    readonly projectFolder: string;
-    readonly dependencyName: string;
-};
-export type LicenseResolver = {
-    resolveLicense: (options: LicenseResolveOptions) => Promise<string | undefined>;
-};
-export declare function createLicenseResolver(dependencies: LicenseResolverDependencies): LicenseResolver;
 export {};
 //# sourceMappingURL=license-resolver.d.ts.map

package/sbom/license-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license-resolver.d.ts","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAGnE,KAAK,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACrC,CAAC;AAEF,KAAK,qBAAqB,GAAG;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,cAAc,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACnF,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,eAAe,CAqBhG"}
+{"version":3,"file":"license-resolver.d.ts","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC"}

package/sbom/license-resolver.js

@@ -1,3 +1,22 @@
 import path from 'node:path';
 import { extractLicenseFromManifest } from "./extract-license.js";
+export function createLicenseResolver(dependencies) {
+    const { fileManager } = dependencies;
+    function buildMissingDependencyMessage(dependencyName) {
+        const intro = `Dependency "${dependencyName}" is declared in the published manifest`;
+        return `${intro} but is not installed in node_modules`;
+    }
+    return {
+        async resolveLicense({ projectFolder, dependencyName }) {
+            const packageJsonPath = path.join(projectFolder, 'node_modules', dependencyName, 'package.json');
+            const readability = await fileManager.checkReadability(packageJsonPath);
+            if (!readability.isReadable) {
+                throw new Error(buildMissingDependencyMessage(dependencyName));
+            }
+            const content = await fileManager.readFile(packageJsonPath);
+            const parsed = JSON.parse(content);
+            return extractLicenseFromManifest(parsed);
+        }
+    };
+}
 //# sourceMappingURL=license-resolver.js.map

package/sbom/license-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"license-resolver.js","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW;AAE5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB"}
+{"version":3,"file":"license-resolver.js","sourceRoot":"","sources":["../../../../source/sbom/license-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAelE,MAAM,UAAU,qBAAqB,CAAC,YAAyC;IAC3E,MAAM,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC;IAErC,SAAS,6BAA6B,CAAC,cAAsB;QACzD,MAAM,KAAK,GAAG,eAAe,cAAc,yCAAyC,CAAC;QACrF,OAAO,GAAG,KAAK,uCAAuC,CAAC;IAC3D,CAAC;IAED,OAAO;QACH,KAAK,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE;YAClD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;YACjG,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;YACxE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,cAAc,CAAC,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;YAC9C,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;KACJ,CAAC;AACN,CAAC"}

package/sbom/sbom-file.d.ts

@@ -3,17 +3,5 @@ import type { FileDescription } from '../file-manager/file-description.ts';
 import type { VersionedBundleWithManifest } from '../version-manager/versioned-bundle.ts';
 import type { LicenseResolver } from './license-resolver.ts';
 import type { SbomSerializer } from './sbom-serializer.ts';
-type ToolVersionProvider = () => Promise<string>;
-type SbomFileBuilderDependencies = {
-    readonly licenseResolver: LicenseResolver;
-    readonly sbomSerializer: SbomSerializer;
-    readonly toolVersionProvider: ToolVersionProvider;
-    readonly projectFolder: string;
-};
-type SbomSibling = Pick<VersionedBundleWithManifest, 'name' | 'packageJson'>;
-export type SbomFileBuilder = {
-    generate: (bundle: VersionedBundleWithManifest, siblings: readonly SbomSibling[], publishSettings: PublishSettings) => Promise<readonly FileDescription[] | undefined>;
-};
-export declare function createSbomFileBuilder(dependencies: SbomFileBuilderDependencies): SbomFileBuilder;
 export {};
 //# sourceMappingURL=sbom-file.d.ts.map

package/sbom/sbom-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-file.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAE1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,KAAK,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAEjD,KAAK,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,KAAK,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC;AAE7E,MAAM,MAAM,eAAe,GAAG;IAC1B,QAAQ,EAAE,CACN,MAAM,EAAE,2BAA2B,EACnC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,eAAe,EAAE,eAAe,KAC/B,OAAO,CAAC,SAAS,eAAe,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD,CAAC;AAuBF,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,eAAe,CAqDhG"}
+{"version":3,"file":"sbom-file.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC;AAC1E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wCAAwC;AAEzF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB"}

package/sbom/sbom-file.js

@@ -1,3 +1,57 @@
 import { extractLicenseFromManifest } from "./extract-license.js";
 import { buildSbom } from "./sbom-builder.js";
+const sbomFilePath = 'sbom.cdx.json';
+function isSbomEnabled(publishSettings) {
+    return publishSettings.sbom?.enabled ?? true;
+}
+function listDependencyEntries(bundle) {
+    return [
+        ...Object.entries(bundle.dependencies).map(([name, specifier]) => {
+            return { name, specifier, kind: 'runtime' };
+        }),
+        ...Object.entries(bundle.peerDependencies).map(([name, specifier]) => {
+            return { name, specifier, kind: 'peer' };
+        })
+    ];
+}
+export function createSbomFileBuilder(dependencies) {
+    const { licenseResolver, sbomSerializer, toolVersionProvider, projectFolder } = dependencies;
+    async function resolveDependencyEntries(bundle, siblings) {
+        const siblingsByName = new Map(siblings.map((sibling) => {
+            return [sibling.name, sibling];
+        }));
+        const entries = listDependencyEntries(bundle);
+        return Promise.all(entries.map(async (entry) => {
+            const sibling = siblingsByName.get(entry.name);
+            const license = sibling === undefined
+                ? await licenseResolver.resolveLicense({ projectFolder, dependencyName: entry.name })
+                : extractLicenseFromManifest(sibling.packageJson);
+            return { ...entry, license };
+        }));
+    }
+    async function buildFile(bundle, siblings) {
+        const [resolvedToolVersion, sbomDependencies] = await Promise.all([
+            toolVersionProvider(),
+            resolveDependencyEntries(bundle, siblings)
+        ]);
+        const bom = buildSbom({
+            toolVersion: resolvedToolVersion,
+            rootComponent: { name: bundle.packageJson.name, version: bundle.packageJson.version },
+            dependencies: sbomDependencies
+        });
+        return {
+            filePath: sbomFilePath,
+            content: sbomSerializer.serialize(bom),
+            isExecutable: false
+        };
+    }
+    return {
+        async generate(bundle, siblings, publishSettings) {
+            if (!isSbomEnabled(publishSettings)) {
+                return undefined;
+            }
+            return [await buildFile(bundle, siblings)];
+        }
+    };
+}
 //# sourceMappingURL=sbom-file.js.map

package/sbom/sbom-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-file.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB;AAGjE,OAAO,EAAE,SAAS,EAAgD,MAAM,mBAAmB"}
+{"version":3,"file":"sbom-file.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-file.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAGlE,OAAO,EAAE,SAAS,EAAgD,MAAM,mBAAmB,CAAC;AAE5F,MAAM,YAAY,GAAG,eAAe,CAAC;AA2BrC,SAAS,aAAa,CAAC,eAAgC;IACnD,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmC;IAC9D,OAAO;QACH,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAkB,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE;YAC9E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC,CAAC;QACF,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAkB,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE;YAClF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC,CAAC;KACL,CAAC;AACN,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAyC;IAC3E,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC;IAE7F,KAAK,UAAU,wBAAwB,CACnC,MAAmC,EACnC,QAAgC;QAEhC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC1B,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACrB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC,CAAC,CACL,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC,GAAG,CACd,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,OAAO,GACT,OAAO,KAAK,SAAS;gBACjB,CAAC,CAAC,MAAM,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrF,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC1D,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC;QACjC,CAAC,CAAC,CACL,CAAC;IACN,CAAC;IAED,KAAK,UAAU,SAAS,CACpB,MAAmC,EACnC,QAAgC;QAEhC,MAAM,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,mBAAmB,EAAE;YACrB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC;YAClB,WAAW,EAAE,mBAAmB;YAChC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACrF,YAAY,EAAE,gBAAgB;SACjC,CAAC,CAAC;QACH,OAAO;YACH,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC;YACtC,YAAY,EAAE,KAAK;SACtB,CAAC;IACN,CAAC;IAED,OAAO;QACH,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe;YAC5C,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/C,CAAC;KACJ,CAAC;AACN,CAAC"}

package/sbom/sbom-serializer.d.ts

@@ -1,6 +1,2 @@
 import * as cdx from '@cyclonedx/cyclonedx-library';
-export type SbomSerializer = {
-    serialize: (bom: cdx.Models.Bom) => string;
-};
-export declare function createSbomSerializer(): SbomSerializer;
 //# sourceMappingURL=sbom-serializer.d.ts.map

package/sbom/sbom-serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-serializer.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC;CAC9C,CAAC;AAEF,wBAAgB,oBAAoB,IAAI,cAAc,CASrD"}
+{"version":3,"file":"sbom-serializer.d.ts","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B"}

package/sbom/sbom-serializer.js

@@ -1,2 +1,11 @@
 import * as cdx from '@cyclonedx/cyclonedx-library';
+export function createSbomSerializer() {
+    const factory = new cdx.Serialize.JSON.Normalize.Factory(cdx.Spec.Spec1dot6);
+    const serializer = new cdx.Serialize.JsonSerializer(factory);
+    return {
+        serialize(bom) {
+            return serializer.serialize(bom, { sortLists: true, space: 4 });
+        }
+    };
+}
 //# sourceMappingURL=sbom-serializer.js.map

package/sbom/sbom-serializer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-serializer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B"}
+{"version":3,"file":"sbom-serializer.js","sourceRoot":"","sources":["../../../../source/sbom/sbom-serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,8BAA8B,CAAC;AAMpD,MAAM,UAAU,oBAAoB;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAE7D,OAAO;QACH,SAAS,CAAC,GAAG;YACT,OAAO,UAAU,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;KACJ,CAAC;AACN,CAAC"}

package/tar/extract-tar.js

@@ -1,4 +1,42 @@
 import { createGunzip } from 'node:zlib';
 import { Readable } from 'node:stream';
 import { extract } from 'tar-stream';
+function toError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+async function collectTarEntries(stream) {
+    const entries = [];
+    for await (const entry of stream) {
+        let result = '';
+        for await (const chunk of entry) {
+            result += chunk.toString();
+        }
+        entries.push({ header: entry.header, content: result });
+    }
+    return entries;
+}
+async function waitForStreamError(stream) {
+    return await new Promise((_resolve, reject) => {
+        stream.once('error', (error) => {
+            reject(toError(error));
+        });
+    });
+}
+export async function extractTarEntries(buffer) {
+    const extractStream = extract();
+    const source = Readable.from(buffer);
+    const gunzip = createGunzip();
+    const stream = source.pipe(gunzip).pipe(extractStream);
+    try {
+        return await Promise.race([
+            collectTarEntries(stream),
+            waitForStreamError(source),
+            waitForStreamError(gunzip),
+            waitForStreamError(extractStream)
+        ]);
+    }
+    catch (error) {
+        throw toError(error);
+    }
+}
 //# sourceMappingURL=extract-tar.js.map

package/tar/extract-tar.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-tar.js","sourceRoot":"","sources":["../../../../source/tar/extract-tar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa;AACtC,OAAO,EAAE,OAAO,EAAmC,MAAM,YAAY"}
+{"version":3,"file":"extract-tar.js","sourceRoot":"","sources":["../../../../source/tar/extract-tar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAmC,MAAM,YAAY,CAAC;AAOtE,SAAS,OAAO,CAAC,KAAc;IAC3B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC;AAUD,KAAK,UAAU,iBAAiB,CAAC,MAAqC;IAClE,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAoB;IAClD,OAAO,MAAM,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE;YACpC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc;IAClD,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAkC,CAAC;IAExF,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACtB,iBAAiB,CAAC,MAAM,CAAC;YACzB,kBAAkB,CAAC,MAAM,CAAC;YAC1B,kBAAkB,CAAC,MAAM,CAAC;YAC1B,kBAAkB,CAAC,aAAa,CAAC;SACpC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACL,CAAC"}

package/tar/tarball-builder.d.ts

@@ -1,6 +1,2 @@
 import type { FileDescription } from '../file-manager/file-description.ts';
-export type TarballBuilder = {
-    build: (fileDescriptions: readonly FileDescription[]) => Promise<Buffer>;
-};
-export declare function createTarballBuilder(): TarballBuilder;
 //# sourceMappingURL=tarball-builder.d.ts.map

package/tar/tarball-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tarball-builder.d.ts","sourceRoot":"","sources":["../../../../source/tar/tarball-builder.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE3E,MAAM,MAAM,cAAc,GAAG;IACzB,KAAK,EAAE,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E,CAAC;AAmBF,wBAAgB,oBAAoB,IAAI,cAAc,CAsCrD"}
+{"version":3,"file":"tarball-builder.d.ts","sourceRoot":"","sources":["../../../../source/tar/tarball-builder.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC"}

package/version-manager/manager.d.ts

@@ -1,11 +1,7 @@
 import type { ProgressBroadcastProvider } from '../progress/progress-broadcaster.ts';
 import { type BuildVersionedBundleOptions, type VersionedBundle, type VersionedBundleWithManifest } from './versioned-bundle.ts';
-export type VersionManagerDependencies = {
-    readonly progressBroadcaster: ProgressBroadcastProvider;
-};
 export type VersionManager = {
     addVersion: (options: BuildVersionedBundleOptions) => VersionedBundleWithManifest;
     increaseVersion: (bundle: VersionedBundle) => VersionedBundleWithManifest;
 };
-export declare function createVersionManager(dependencies: VersionManagerDependencies): VersionManager;
 //# sourceMappingURL=manager.d.ts.map

package/version-manager/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../../source/version-manager/manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAIrF,OAAO,EAEH,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,2BAA2B,EACnC,MAAM,uBAAuB,CAAC;AAE/B,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,UAAU,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,2BAA2B,CAAC;IAClF,eAAe,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,2BAA2B,CAAC;CAC7E,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,0BAA0B,GAAG,cAAc,CAuD7F"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../../source/version-manager/manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC;AAIpF,OAAO,EAEH,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,2BAA2B,EACnC,MAAM,uBAAuB;AAM9B,MAAM,MAAM,cAAc,GAAG;IACzB,UAAU,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,2BAA2B,CAAC;IAClF,eAAe,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,2BAA2B,CAAC;CAC7E"}

package/version-manager/manager.js

@@ -3,4 +3,50 @@ import { inspectPackageJsonProvenance } from "../report/inspectors.js";
 import { buildPackageManifest } from "./manifest/builder.js";
 import { serializePackageJson } from "./manifest/serialize.js";
 import { buildVersionedBundle } from "./versioned-bundle.js";
+export function createVersionManager(dependencies) {
+    const { progressBroadcaster } = dependencies;
+    return {
+        addVersion(options) {
+            const versionedBundle = buildVersionedBundle(options);
+            const manifest = buildPackageManifest(versionedBundle);
+            const packageJsonContent = serializePackageJson(manifest);
+            if (progressBroadcaster.hasSubscribers('packageJsonAssembled')) {
+                progressBroadcaster.emit('packageJsonAssembled', {
+                    packageName: versionedBundle.name,
+                    fields: inspectPackageJsonProvenance(manifest, options.mainPackageJson, options.additionalPackageJsonAttributes)
+                });
+            }
+            return {
+                ...versionedBundle,
+                packageJson: manifest,
+                manifestFile: {
+                    content: packageJsonContent,
+                    isExecutable: false,
+                    filePath: 'package.json'
+                }
+            };
+        },
+        increaseVersion(versionedBundle) {
+            const newVersion = semver.inc(versionedBundle.version, 'patch');
+            if (newVersion === null) {
+                throw new Error('Failed to increase version');
+            }
+            const newVersionedBundle = {
+                ...versionedBundle,
+                version: newVersion
+            };
+            const manifest = buildPackageManifest(newVersionedBundle);
+            const packageJsonContent = serializePackageJson(manifest);
+            return {
+                ...newVersionedBundle,
+                packageJson: manifest,
+                manifestFile: {
+                    content: packageJsonContent,
+                    isExecutable: false,
+                    filePath: 'package.json'
+                }
+            };
+        }
+    };
+}
 //# sourceMappingURL=manager.js.map

package/version-manager/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../../source/version-manager/manager.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ;AAE3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB;AAC9D,OAAO,EACH,oBAAoB,EAIvB,MAAM,uBAAuB"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../../source/version-manager/manager.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACH,oBAAoB,EAIvB,MAAM,uBAAuB,CAAC;AAW/B,MAAM,UAAU,oBAAoB,CAAC,YAAwC;IACzE,MAAM,EAAE,mBAAmB,EAAE,GAAG,YAAY,CAAC;IAE7C,OAAO;QACH,UAAU,CAAC,OAAO;YACd,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;YACvD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAE1D,IAAI,mBAAmB,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC7D,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBAC7C,WAAW,EAAE,eAAe,CAAC,IAAI;oBACjC,MAAM,EAAE,4BAA4B,CAChC,QAA6C,EAC7C,OAAO,CAAC,eAAoD,EAC5D,OAAO,CAAC,+BAAgF,CAC3F;iBACJ,CAAC,CAAC;YACP,CAAC;YAED,OAAO;gBACH,GAAG,eAAe;gBAClB,WAAW,EAAE,QAAQ;gBACrB,YAAY,EAAE;oBACV,OAAO,EAAE,kBAAkB;oBAC3B,YAAY,EAAE,KAAK;oBACnB,QAAQ,EAAE,cAAc;iBAC3B;aACJ,CAAC;QACN,CAAC;QAED,eAAe,CAAC,eAAe;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,kBAAkB,GAAoB;gBACxC,GAAG,eAAe;gBAClB,OAAO,EAAE,UAAU;aACtB,CAAC;YACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YAC1D,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAE1D,OAAO;gBACH,GAAG,kBAAkB;gBACrB,WAAW,EAAE,QAAQ;gBACrB,YAAY,EAAE;oBACV,OAAO,EAAE,kBAAkB;oBAC3B,YAAY,EAAE,KAAK;oBACnB,QAAQ,EAAE,cAAc;iBAC3B;aACJ,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC"}

package/version-manager/manifest/builder.js

@@ -1,3 +1,59 @@
 import { isEmpty } from 'remeda';
 // eslint-disable-next-line sonarjs/function-return-type -- distinct semantics for emit-false, emit-array, and omit
+function resolveSideEffectsValue(bundle) {
+    if (Object.hasOwn(bundle.additionalAttributes, 'sideEffects')) {
+        return undefined;
+    }
+    const field = bundle.sideEffectsField;
+    if (field === undefined) {
+        return undefined;
+    }
+    if (field === false) {
+        return false;
+    }
+    return Array.from(field);
+}
+function buildSideEffectsEntry(sideEffects) {
+    return sideEffects === undefined ? {} : { sideEffects };
+}
+function toPackageJsonImports(importsField) {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- config validation constrains imports values to JSON-compatible package.json data
+    return Object.fromEntries(Object.entries(importsField));
+}
+function buildImportsEntry(importsField) {
+    return importsField === undefined ? {} : { imports: toPackageJsonImports(importsField) };
+}
+function toPackageJsonBinTargets(binField) {
+    return Object.fromEntries(Object.entries(binField).flatMap(([name, target]) => {
+        return target === undefined ? [] : [[name, target]];
+    }));
+}
+function buildBinEntry(binField) {
+    if (binField === undefined) {
+        return {};
+    }
+    if (typeof binField === 'string') {
+        return { bin: binField };
+    }
+    return { bin: toPackageJsonBinTargets(binField) };
+}
+export function buildPackageManifest(bundle) {
+    const sideEffects = resolveSideEffectsValue(bundle);
+    const sideEffectsEntry = buildSideEffectsEntry(sideEffects);
+    const importsEntry = buildImportsEntry(bundle.importsField);
+    const binEntry = buildBinEntry(bundle.binField);
+    const packageJson = {
+        ...bundle.additionalAttributes,
+        ...sideEffectsEntry,
+        ...importsEntry,
+        ...binEntry,
+        exports: bundle.exportsField,
+        name: bundle.name,
+        version: bundle.version,
+        type: bundle.packageType,
+        ...(isEmpty(bundle.dependencies) ? {} : { dependencies: bundle.dependencies }),
+        ...(isEmpty(bundle.peerDependencies) ? {} : { peerDependencies: bundle.peerDependencies })
+    };
+    return packageJson;
+}
 //# sourceMappingURL=builder.js.map

package/version-manager/manifest/builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../../../../source/version-manager/manifest/builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ"}
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../../../../source/version-manager/manifest/builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAKjC,mHAAmH;AACnH,SAAS,uBAAuB,CAAC,MAAuB;IACpD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,aAAa,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAKD,SAAS,qBAAqB,CAC1B,WAAyC;IAEzC,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,oBAAoB,CAAC,YAA0D;IACpF,2JAA2J;IAC3J,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAuB,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CACtB,YAA6C;IAE7C,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,uBAAuB,CAC5B,QAAmE;IAEnE,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QAChD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CACL,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,QAAqC;IACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IACxD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAsB;QACnC,GAAG,MAAM,CAAC,oBAAoB;QAC9B,GAAG,gBAAgB;QACnB,GAAG,YAAY;QACf,GAAG,QAAQ;QACX,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,WAAW;QACxB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9E,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;KAC7F,CAAC;IAEF,OAAO,WAAW,CAAC;AACvB,CAAC"}

package/version-manager/manifest/serialize.js

@@ -1,2 +1,48 @@
 import { compareValues } from "./sort-values.js";
+const indentationSize = 4;
+function isArray(value) {
+    return Array.isArray(value);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function assertNoCircularStructures(value) {
+    const visitedObjects = new Set();
+    JSON.stringify(value, (_key, currentValue) => {
+        if (typeof currentValue === 'object' && currentValue !== null) {
+            if (visitedObjects.has(currentValue)) {
+                throw new Error('Circular structures are not supported');
+            }
+            visitedObjects.add(currentValue);
+        }
+        return currentValue;
+    });
+}
+function shouldPreserveArrayOrder(path) {
+    const [topLevelKey] = path;
+    return topLevelKey === 'imports' || topLevelKey === 'exports';
+}
+function deepSortValue(value, path = []) {
+    if (isArray(value)) {
+        const mapped = value.map((entry, index) => {
+            return deepSortValue(entry, [...path, String(index)]);
+        });
+        return shouldPreserveArrayOrder(path) ? mapped : mapped.toSorted(compareValues);
+    }
+    if (isRecord(value)) {
+        return Object.fromEntries(Object.entries(value)
+            .map(([key, nestedValue]) => {
+            return [key, deepSortValue(nestedValue, [...path, key])];
+        })
+            .toSorted(([leftKey], [rightKey]) => {
+            return compareValues(leftKey, rightKey);
+        }));
+    }
+    return value;
+}
+export function serializePackageJson(data) {
+    assertNoCircularStructures(data);
+    const sortedData = deepSortValue(data);
+    return JSON.stringify(sortedData, null, indentationSize);
+}
 //# sourceMappingURL=serialize.js.map

package/version-manager/manifest/serialize.js.map

@@ -1 +1 @@
-{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../../../../source/version-manager/manifest/serialize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB"}
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../../../../source/version-manager/manifest/serialize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,eAAe,GAAG,CAAC,CAAC;AAG1B,SAAS,OAAO,CAAC,KAAc;IAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAW,CAAC;IAE1C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,YAAqB,EAAE,EAAE;QAClD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC7D,CAAC;YAED,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,YAAY,CAAC;IACxB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAuB;IACrD,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;IAC3B,OAAO,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,OAA0B,EAAE;IAC/D,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtC,OAAO,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAChB,GAAG,CAAc,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE;YACrC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC;aACD,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAc,EAAE,CAAC,QAAQ,CAAc,EAAE,EAAE;YAC1D,OAAO,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CACT,CAAC;IACN,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC5D,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC7D,CAAC"}

package/version-manager/manifest/sort-values.js

@@ -1 +1,17 @@
+function comparePrimitiveValues(valueA, valueB) {
+    if (valueA < valueB) {
+        return -1;
+    }
+    if (valueA > valueB) {
+        return 1;
+    }
+    return 0;
+}
+export function compareValues(valueA, valueB) {
+    if ((typeof valueA === 'boolean' || typeof valueA === 'number' || typeof valueA === 'string') &&
+        (typeof valueB === 'boolean' || typeof valueB === 'number' || typeof valueB === 'string')) {
+        return comparePrimitiveValues(valueA, valueB);
+    }
+    return 0;
+}
 //# sourceMappingURL=sort-values.js.map

package/version-manager/manifest/sort-values.js.map

@@ -1 +1 @@
-{"version":3,"file":"sort-values.js","sourceRoot":"","sources":["../../../../../source/version-manager/manifest/sort-values.ts"],"names":[],"mappings":""}
+{"version":3,"file":"sort-values.js","sourceRoot":"","sources":["../../../../../source/version-manager/manifest/sort-values.ts"],"names":[],"mappings":"AAKA,SAAS,sBAAsB,CAAC,MAAsB,EAAE,MAAsB;IAC1E,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,CAAC;IACd,CAAC;IAED,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC;IACb,CAAC;IAED,OAAO,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAe,EAAE,MAAe;IAC1D,IACI,CAAC,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC;QACzF,CAAC,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAC3F,CAAC;QACC,OAAO,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,CAAC;AACb,CAAC"}

package/version-manager/specifier-classifier.js

@@ -1,2 +1,35 @@
 import npa from 'npm-package-arg';
+const workspaceProtocolPrefix = 'workspace:';
+const portalProtocolPrefix = 'portal:';
+const workspaceMalformedReason = 'workspace protocol is yarn/pnpm/bun-specific; resolved at install time by the workspace,' +
+    ' not valid in a published manifest';
+const portalMalformedReason = 'portal protocol is yarn-specific; resolved as a local symlink, not valid in a published manifest';
+const npaTypeKindMap = {
+    alias: { kind: 'registry' },
+    version: { kind: 'registry' },
+    range: { kind: 'registry' },
+    tag: { kind: 'registry' },
+    git: { kind: 'mutable', npaType: 'git' },
+    remote: { kind: 'mutable', npaType: 'remote' },
+    file: { kind: 'mutable', npaType: 'file' },
+    directory: { kind: 'mutable', npaType: 'directory' }
+};
+function classifyNpaResult(result) {
+    return npaTypeKindMap[result.type];
+}
+export function classifySpecifier(name, specifier) {
+    if (specifier.startsWith(workspaceProtocolPrefix)) {
+        return { kind: 'malformed', reason: workspaceMalformedReason };
+    }
+    if (specifier.startsWith(portalProtocolPrefix)) {
+        return { kind: 'malformed', reason: portalMalformedReason };
+    }
+    try {
+        const result = npa.resolve(name, specifier);
+        return classifyNpaResult(result);
+    }
+    catch (error) {
+        return { kind: 'malformed', reason: String(error) };
+    }
+}
 //# sourceMappingURL=specifier-classifier.js.map

package/version-manager/specifier-classifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"specifier-classifier.js","sourceRoot":"","sources":["../../../../source/version-manager/specifier-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,iBAAiB"}
+{"version":3,"file":"specifier-classifier.js","sourceRoot":"","sources":["../../../../source/version-manager/specifier-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,iBAAiB,CAAC;AAElC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAC7C,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAEvC,MAAM,wBAAwB,GAC1B,0FAA0F;IAC1F,oCAAoC,CAAC;AACzC,MAAM,qBAAqB,GACvB,kGAAkG,CAAC;AAWvG,MAAM,cAAc,GAAoD;IACpE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;IACxC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC9C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE;IAC1C,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE;CACvD,CAAC;AAEF,SAAS,iBAAiB,CAAC,MAAkB;IACzC,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB;IAC7D,IAAI,SAAS,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACxD,CAAC;AACL,CAAC"}

package/version-manager/specifier-errors.js

@@ -1 +1,44 @@
+function dependencyWord(count) {
+    return count === 1 ? 'dependency' : 'dependencies';
+}
+function entryWord(count) {
+    return count === 1 ? 'entry' : 'entries';
+}
+export function renderMutableSpecifierMessage(offenders) {
+    const isSingular = offenders.length === 1;
+    const verbAndNoun = isSingular ? 'uses a mutable specifier' : 'use mutable specifiers';
+    const bypassVerb = isSingular ? 'bypasses' : 'bypass';
+    const noun = dependencyWord(offenders.length);
+    const header = `Refusing to publish: ${offenders.length} ${noun} ${verbAndNoun},` +
+        ` which ${bypassVerb} the npm registry's integrity guarantees:`;
+    const lines = offenders.map((offender) => {
+        return `  - "${offender.name}" → "${offender.specifier}" (${offender.npaType})`;
+    });
+    const footer = 'Add the dep name to dependencyPolicy.allowMutableSpecifiers to allow this on purpose.';
+    return [header, ...lines, footer].join('\n');
+}
+export function renderMalformedSpecifierMessage(offenders) {
+    const isSingular = offenders.length === 1;
+    const verb = isSingular ? 'has' : 'have';
+    const noun = dependencyWord(offenders.length);
+    const header = `Refusing to publish: ${offenders.length} ${noun} ${verb} a specifier that npm cannot publish:`;
+    const lines = offenders.map((offender) => {
+        return `  - "${offender.name}" → "${offender.specifier}" (${offender.reason})`;
+    });
+    const replacementHint = 'Replace with a registry version (e.g. "^1.2.3").';
+    const allowListHint = 'Mutable-specifier allow-listing does not apply here.';
+    return [header, ...lines, `${replacementHint} ${allowListHint}`].join('\n');
+}
+export function renderUnusedAllowListMessage(unusedEntries) {
+    const isSingular = unusedEntries.length === 1;
+    const verb = isSingular ? 'is' : 'are';
+    const noun = entryWord(unusedEntries.length);
+    const header = `Refusing to publish: ${unusedEntries.length} ${noun} in` +
+        ` dependencyPolicy.allowMutableSpecifiers ${verb} not in use:`;
+    const lines = unusedEntries.map((entry) => {
+        return `  - "${entry}"`;
+    });
+    const footer = 'Remove unused entries — they reflect stale exceptions to the integrity policy.';
+    return [header, ...lines, footer].join('\n');
+}
 //# sourceMappingURL=specifier-errors.js.map

package/version-manager/specifier-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"specifier-errors.js","sourceRoot":"","sources":["../../../../source/version-manager/specifier-errors.ts"],"names":[],"mappings":""}
+{"version":3,"file":"specifier-errors.js","sourceRoot":"","sources":["../../../../source/version-manager/specifier-errors.ts"],"names":[],"mappings":"AAcA,SAAS,cAAc,CAAC,KAAa;IACjC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC5B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,SAAqC;IAC/E,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,wBAAwB,CAAC;IACvF,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GACR,wBAAwB,SAAS,CAAC,MAAM,IAAI,IAAI,IAAI,WAAW,GAAG;QAClE,UAAU,UAAU,2CAA2C,CAAC;IACpE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,OAAO,QAAQ,QAAQ,CAAC,IAAI,QAAQ,QAAQ,CAAC,SAAS,MAAM,QAAQ,CAAC,OAAO,GAAG,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,uFAAuF,CAAC;IACvG,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,SAAuC;IACnF,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,wBAAwB,SAAS,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,uCAAuC,CAAC;IAC/G,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,OAAO,QAAQ,QAAQ,CAAC,IAAI,QAAQ,QAAQ,CAAC,SAAS,MAAM,QAAQ,CAAC,MAAM,GAAG,CAAC;IACnF,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,kDAAkD,CAAC;IAC3E,MAAM,aAAa,GAAG,sDAAsD,CAAC;IAC7E,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,eAAe,IAAI,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,aAAgC;IACzE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GACR,wBAAwB,aAAa,CAAC,MAAM,IAAI,IAAI,KAAK;QACzD,4CAA4C,IAAI,cAAc,CAAC;IACnE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,OAAO,QAAQ,KAAK,GAAG,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,gFAAgF,CAAC;IAChG,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC"}