{
  "product": "Specification (reference)",
  "title": "Package Manager",
  "summary": "Resolve, install and lock dependencies so two machines agree.",
  "category": "devtools",
  "entries": [
    {
      "path": [
        "AI",
        "Manifest",
        "Declared dependencies with version ranges"
      ],
      "value": "",
      "status": "yes",
      "note": "runtime, dev, peer, optional"
    },
    {
      "path": [
        "AI",
        "Manifest",
        "Scripts with a documented lifecycle"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Resolution",
        "Semver range resolution"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Resolution",
        "Conflict resolution strategy stated"
      ],
      "value": "",
      "status": "yes",
      "note": "hoisting or isolation"
    },
    {
      "path": [
        "AI",
        "Resolution",
        "Peer dependency checking"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Resolution",
        "Overrides to force a transitive version"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Lockfile",
        "Exact resolved versions with integrity hashes"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Lockfile",
        "Reproducible install from the lockfile alone"
      ],
      "value": "",
      "status": "yes",
      "note": "the whole point"
    },
    {
      "path": [
        "AI",
        "Lockfile",
        "Frozen-lockfile mode for CI"
      ],
      "value": "",
      "status": "yes",
      "note": "fails rather than updates"
    },
    {
      "path": [
        "AI",
        "Install",
        "Content-addressed cache; offline install"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Install",
        "Parallel fetch and extraction"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Install",
        "Lifecycle scripts opt-in for untrusted packages"
      ],
      "value": "",
      "status": "yes",
      "note": "the supply-chain surface"
    },
    {
      "path": [
        "AI",
        "Workspaces",
        "Multiple packages in one repository"
      ],
      "value": "",
      "status": "yes",
      "note": "with internal linking"
    },
    {
      "path": [
        "AI",
        "Workspaces",
        "Run a script across workspaces in dependency order"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Trust",
        "Audit against a vulnerability database"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Trust",
        "Provenance or signature verification"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Publish",
        "Publish with a dry-run and a file allowlist"
      ],
      "value": "",
      "status": "yes",
      "note": "ship what you meant to ship"
    }
  ]
}