Bump @phcdevworks/spectre-manifest from 1.1.0 to 1.2.0

[dependabot]

Bumps @phcdevworks/spectre-manifest from 1.1.0 to 1.2.0.

Release notes

Sourced from @​phcdevworks/spectre-manifest's releases.

Contract Tooling and Validation Corrections

Contract change type: semantic change

Fixed

• Package export checks recognize string, array, and conditional root exports, report missing declared subpaths, and reject null targets as unavailable.
• Package checks return structured diagnostics for malformed package metadata instead of throwing, and require an own manifest entry for registration.
• Manifest diffs classify introducing allowedTargets restrictions as breaking and removing all restrictions as additive, matching the validator's treatment of absent and empty lists.
• Manifest diffs use own-property registry lookups so valid package and layer names such as constructor are detected on addition and removal without crashes.
• Export availability checks honor blocking default conditions, nested unmatched conditions, and array fallbacks; a later target no longer bypasses an earlier blocking default.
• Manifest diffs report previously omitted metadata as semantic changes: $schema, $id, system package-manager/repository fields, notes throughout the manifest, and forbidden-import/boundary-constraint reasons. Matching preserves duplicate entries and ignores registry reordering.
• Manifest diffs distinguish an absent consumer list from an empty list. Introducing a consumer restriction or removing a listed consumer is breaking; removing the restriction or expanding an existing list is additive.
• Corrected release guidance to version the published package, synchronize the README, verify before pushing, and avoid stacking repository releases ahead of npm publication.

Changed

• Upgraded the pinned package manager to pnpm 12.3.4 and regenerated its lockfile.
• Pinned CI actions to reviewed release commits for checkout v7.0.1, setup-node v7.0.0, and pnpm/action-setup v6.1.0.
• Upgraded Node type definitions to 26 across the workspace and synchronized the lockfile, with a release-age exception scoped to the exact types version.
• Updated the workspace's transitive fast-uri resolution from 3.1.2 to 3.1.7 within the existing dependency range, clearing six high-severity dependency advisories from the workspace audit.
• Expanded the full CI verification matrix to Node 26 alongside Node 22.13.0, current Node 22, and Node 24. Added a dependency audit on Node 24 that fails on high or critical advisories.

Added

• Added a packed-install validation gate that checks public imports, TypeScript declarations, bundled schema and manifest data, and all three installed CLI commands from a temporary consumer.
• Included root TypeScript tooling scripts in typechecking and documented the expanded verification gate.

Validation and compatibility

• Added regression tests for export forms, malformed metadata, target and consumer restriction transitions, registry-name collisions, metadata edits, conditional exports, and CLI JSON output and exit codes.
• schemaVersion remains 0.1: schema, exported types, direct dependency ranges, supported runtimes, and manifest validation semantics are unchanged. Checker and diff corrections may reject blocked exports, report metadata changes that previously appeared identical, or classify previously missed restrictions as breaking. The packed-install and audit gates require registry access.

Changelog

Sourced from @​phcdevworks/spectre-manifest's changelog.

[1.2.0] - 2026-09-06

Release Title: Contract Tooling and Validation Corrections

Contract change type: semantic change

Fixed

• Package export checks recognize string, array, and conditional root exports, report missing declared subpaths, and reject null targets as unavailable.
• Package checks return structured diagnostics for malformed package metadata instead of throwing, and require an own manifest entry for registration.
• Manifest diffs classify introducing allowedTargets restrictions as breaking and removing all restrictions as additive, matching the validator's treatment of absent and empty lists.
• Manifest diffs use own-property registry lookups so valid package and layer names such as constructor are detected on addition and removal without crashes.
• Export availability checks honor blocking default conditions, nested unmatched conditions, and array fallbacks; a later target no longer bypasses an earlier blocking default.
• Manifest diffs report previously omitted metadata as semantic changes: $schema, $id, system package-manager/repository fields, notes throughout the manifest, and forbidden-import/boundary-constraint reasons. Matching preserves duplicate entries and ignores registry reordering.
• Manifest diffs distinguish an absent consumer list from an empty list. Introducing a consumer restriction or removing a listed consumer is breaking; removing the restriction or expanding an existing list is additive.
• Corrected release guidance to version the published package, synchronize the README, verify before pushing, and avoid stacking repository releases ahead of npm publication.

Changed

• Upgraded the pinned package manager to pnpm 12.3.4 and regenerated its lockfile.
• Pinned CI actions to reviewed release commits for checkout v7.0.1, setup-node v7.0.0, and pnpm/action-setup v6.1.0.
• Upgraded Node type definitions to 26 across the workspace and synchronized the lockfile, with a release-age exception scoped to the exact types version.
• Updated the workspace's transitive fast-uri resolution from 3.1.2 to 3.1.7 within the existing dependency range, clearing six high-severity dependency advisories from the workspace audit.
• Expanded the full CI verification matrix to Node 26 alongside Node 22.13.0, current Node 22, and Node 24. Added a dependency audit on Node 24 that fails on high or critical advisories.

Added

• Added a packed-install validation gate that checks public imports, TypeScript declarations, bundled schema and manifest data, and all three installed CLI commands from a temporary consumer.
• Included root TypeScript tooling scripts in typechecking and documented the expanded verification gate.

Validation and compatibility

• Added regression tests for export forms, malformed metadata, target and consumer restriction transitions, registry-name collisions, metadata edits, conditional exports, and CLI JSON output and exit codes.
• schemaVersion remains 0.1: schema, exported types, direct dependency ranges, supported runtimes, and manifest validation semantics are unchanged. Checker and diff corrections may reject blocked exports, report metadata changes that previously appeared identical, or classify previously missed restrictions as breaking. The packed-install and audit gates require registry access.

Commits

• c9258c7 chore: consolidate pending release as v1.2.0
• cb3db2e chore: align workspace Node type definitions
• 78108ee chore: consolidate repository release as v1.5.0
• b187f0f chore: update transitive dependency and expand runtime verification
• 022b1b7 fix: detect consumer restrictions and restore release verification
• fcf2723 fix: handle registry names, export defaults, and metadata diffs
• bcf0e2e chore: modernize toolchain and verify packed consumers for 1.3.0
• eab61af fix: correct package checks and restriction diffs for 1.2.0
• 7ce9191 chore: update package tooling dependencies
• 51f9838 docs: clarify release note requirements
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: be9ddd85-f376-4862-980b-ca9df7d1fe40

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}