@shapeshift-labs/frontier-lang-package

Runtime-neutral package manifest semantic merge evidence for Frontier Lang.

This package parses npm-style package.json source into source-bound records for dependencies, scripts, exports, imports, bins, workspaces, package-manager settings, and project metadata. It does not run package managers, resolve registry state, execute scripts, or claim install/runtime equivalence. Script behavior, peer dependency compatibility, workspace expansion, overrides, lockfile effects, and package-manager changes remain explicit fail-closed proof gaps unless a higher-level coordinator supplies stronger evidence.

import { createPackageManifestSemanticMergeEvidence } from '@shapeshift-labs/frontier-lang-package';

const evidence = createPackageManifestSemanticMergeEvidence(
  JSON.stringify({
    name: 'app',
    scripts: { test: 'vitest', postinstall: 'node setup.js' },
    dependencies: { react: '^19.0.0' },
    peerDependencies: { typescript: '^5.9.0' }
  }, null, 2),
  { sourcePath: 'package.json' }
);

console.log(evidence.summary.dependencies);
console.log(evidence.proofGaps.map((gap) => gap.code));

Boundary

frontier-lang-package owns source-bound semantic evidence for npm-style package manifests. Lockfile solving, registry lookup, package-manager execution, dependency graph resolution, install artifacts, security policy, and final merge admission stay above this package.