4 Commits

Include renames

Author	SHA1	Message	Date
jochen	10b5e8188a	Refuse a yarn lockfile the scanner stopped in, and a forge answer the cap cut ... Either was read as whole and could leave a pinned version unnamed (review of #128).	2026-10-08 14:52:06 +02:00
jochen	d69c0db4fc	gitea: stop a real npm retention when a file was not read whole ... A lockfile that could not be read is one of its repository's files that could not be read (hq ADR 0251 §4): a version only it pins would be deleted while in use. A real run now refuses on files_not_read as it does on repositories_unread; a dry run still reports.	2026-10-08 13:52:07 +02:00
jochen	a9960d7a1b	gitea: read npm lockfiles of every version and measure every version's size ... Retention read no package-lock.json on the forge: in lockfile v2 and v3 a packages entry's dependencies is a map of name to range, which the reader decoded as nested entries, so all 32 files failed whole and the versions they pin were kept by nothing. Entries are now read one by one, tolerating unknown fields and skipping workspace links; an entry of an unknown shape is said, not the whole file. A dry run measured only the versions it would delete, so every kept version answered 0 bytes. Every version is now measured, the registry's total is answered, and a size that cannot be read is said (hq ADR 0251 §4).	2026-10-08 13:48:12 +02:00
jochen	8059f35d17	gitea: say what keeps each npm version and delete only what nothing names (hq ADR 0251) ... Every publish added a version and nothing removed one. A Go bundle beside the TypeScript one keeps what a lockfile or a range on the forge names, what a dist-tag names and the newest five; a dry run unless asked with a why, and nothing deleted while any repository is unread.	2026-10-08 12:00:57 +02:00