@xemahq/lockfile-resolver

Resolves an App's installed units into a pinned lockfile

Overview

A leaf resolver that turns an App's installed-biome list — plus optional agent, workflow, deliverable-spec, and skill references — into a fully pinned lockfile. It ships the closed freeze-policy enum, a minimal caret/tilde/exact semver matcher (no semver dependency), a pluggable source interface, and structured errors. Lockfile keys are sorted so equivalent inputs serialize identically. Concrete sources live in the consuming service; this package owns only the resolution algebra — no NestJS, no fetch.

When to use it

• Use it to compute a deterministic, byte-stable lockfile from declared install refs and version constraints.

Installation

pnpm add @xemahq/lockfile-resolver

Usage

import { LockfileResolver } from '@xemahq/lockfile-resolver';

const resolver = new LockfileResolver({ sources });

const lockfile = await resolver.resolve({
  installs: [{ kind: 'biome', ref: 'my-biome', constraint: '^1.2.0' }],
});

License

Apache-2.0 © Xema — xema.dev