@absolutejs/manifest - npm Package Compare versions

Comparing version 0.5.0 to 0.6.0

dist/packagePolicy.d.ts

+export type RuntimePeerPolicy = {
+    buildExternals?: readonly string[];
+    optional?: boolean;
+    range: string;
+    tested: string;
+};
+export type PackageRuntimePolicyIssue = {
+    code: "dependency_conflict" | "dev_dependency_mismatch" | "external_missing" | "invalid_policy" | "optional_mismatch" | "peer_range_mismatch";
+    message: string;
+    runtime?: string;
+};
+export type PackageRuntimePolicyResult = {
+    issues: readonly [];
+    ok: true;
+} | {
+    issues: readonly PackageRuntimePolicyIssue[];
+    ok: false;
+};
+export type PackageRuntimePolicyInput = {
+    absolutejs?: {
+        runtimePeers?: unknown;
+    };
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    peerDependenciesMeta?: Record<string, {
+        optional?: boolean;
+    }>;
+    scripts?: Record<string, string>;
+};
+export declare const validatePackageRuntimePolicy: (packageJson: PackageRuntimePolicyInput) => {
+    issues: [];
+    ok: true;
+} | {
+    issues: PackageRuntimePolicyIssue[];
+    ok: false;
+};

dist/index.d.ts

@@ -11,2 +11,4 @@ export { defineImplementation, defineManifest } from "./defineManifest";
 export type { LoadManifestResult } from "./load";
+export { validatePackageRuntimePolicy } from "./packagePolicy";
+export type { PackageRuntimePolicyInput, PackageRuntimePolicyIssue, PackageRuntimePolicyResult, RuntimePeerPolicy, } from "./packagePolicy";
 export { TOOL_NAME_PATTERN } from "./types";
@@ -13,0 +15,0 @@ export { digestToolInput, inspectManifestSecurity } from "./security";

package.json

 {
   "name": "@absolutejs/manifest",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "The AbsoluteJS package manifest contract. Every @absolutejs/* package exports a typed manifest (settings schema, env requirements, adapter slots, wiring recipes, AI tools) from its ./manifest subpath; this package is the contract those manifests are written against, plus bridges that turn any manifest into an AI tool map or a remote MCP tool registry.",
@@ -32,2 +32,14 @@ "repository": {
   },
+  "absolutejs": {
+    "runtimePeers": {
+      "@sinclair/typebox": {
+        "range": ">=0.34.0 <0.35.0",
+        "tested": "0.34.52",
+        "buildExternals": [
+          "@sinclair/typebox",
+          "@sinclair/typebox/*"
+        ]
+      }
+    }
+  },
   "files": [
@@ -40,3 +52,3 @@ "dist",
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts src/cli.ts --outdir dist --root src --sourcemap --target=bun && tsc --project tsconfig.build.json",
+    "build": "rm -rf dist && bun build src/index.ts src/cli.ts --outdir dist --root src --sourcemap --target=bun --external @sinclair/typebox --external '@sinclair/typebox/*' && tsc --project tsconfig.build.json",
     "test": "bun test tests/",
@@ -46,3 +58,4 @@ "typecheck": "tsc --noEmit",
     "lint": "eslint . --max-warnings 0",
-    "check:package": "bun run typecheck && bun run lint && bun run build && bun run test",
+    "check:package": "bun run typecheck && bun run lint && bun run verify-package && bun run build && bun run test",
+    "verify-package": "bun src/cli.ts verify-package",
     "release": "bun run format && bun run check:package && bun publish"
@@ -60,3 +73,3 @@ },
   "peerDependencies": {
-    "@sinclair/typebox": "^0.34.0"
+    "@sinclair/typebox": ">=0.34.0 <0.35.0"
   },
@@ -67,3 +80,3 @@ "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@sinclair/typebox": "^0.34.0",
+    "@sinclair/typebox": "0.34.52",
     "@stylistic/eslint-plugin": "^5.10.0",
@@ -70,0 +83,0 @@ "@types/bun": "^1.3.14",

README.md

@@ -154,3 +154,12 @@ # @absolutejs/manifest
 {
-  "absolutejs": { "manifestContract": 2 },
+  "absolutejs": {
+    "manifestContract": 2,
+    "runtimePeers": {
+      "@absolutejs/agency": {
+        "range": ">=0.7.1 <0.8.0",
+        "tested": "0.7.1",
+        "buildExternals": ["@absolutejs/agency", "@absolutejs/agency/*"],
+      },
+    },
+  },
   "exports": {
@@ -170,7 +179,16 @@ "./manifest": {
 `absolute-manifest emit` validates the manifest (schema, tool-key naming,
-preset values, package.json agreement) and writes `dist/manifest.json` — the
-serializable projection (handlers stripped) for consumers that can't execute
-package code. It is derived, never hand-authored, so the two forms cannot
-diverge. `absolute-manifest scaffold` generates a starter `src/manifest.ts`.
+preset values, package.json agreement, and shared-runtime ownership) and writes
+`dist/manifest.json` — the serializable projection (handlers stripped) for
+consumers that can't execute package code. It is derived, never hand-authored,
+so the two forms cannot diverge. `absolute-manifest scaffold` generates a
+starter `src/manifest.ts`.
 
+`absolutejs.runtimePeers` declares contracts that must be supplied once by the
+host. The validator rejects a runtime duplicated in `dependencies`, a peer
+range or optionality mismatch, a dev dependency that differs from the exact
+tested version, and any missing build external. Keep compatibility windows
+conservative; supporting a new pre-1.0 minor requires a deliberate package
+release. Run `absolute-manifest verify-package` directly for packages that want
+the package policy gate without emitting a manifest.
+
 ## Consuming manifests
@@ -177,0 +195,0 @@

New alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Improved metrics

Number of package files

20

5.26%

Number of lines in readme file

235

8.29%

Number of medium supply chain risk alerts

1

-90%

Worsened metrics

Total package byte prevSize

281645

-84.57%

Lines of code

2200

-84.09%

No dependency changes