Package Manager

# Package Manager PRD

## Overview
Build a package manager that reads a manifest file, resolves dependency version constraints using semver, generates a deterministic lockfile, downloads packages from a mock registry, and installs them into a flat dependency tree.

## Requirements
- Package manifest file (package.json-like) with name, version, and dependencies
- Semantic version parsing and comparison supporting ^1.2.3, ~1.2.3, >=1.0.0 <2.0.0 ranges
- Dependency resolution that builds a complete dependency graph and resolves version conflicts
- Lockfile generation and reading for deterministic, reproducible installs
- Mock registry server (HTTP) that serves package metadata and tarballs
- install command that resolves dependencies, downloads packages, and extracts to a node_modules-like directory
- Flat dependency tree with shared dependency hoisting to minimize duplication
- Circular dependency detection with clear error reporting
- uninstall command that removes a package and cleans up orphaned dependencies
- list command showing installed packages as a tree view
- outdated command that checks the registry for newer versions of installed packages
- Cache downloaded packages locally to avoid redundant network requests
- Integrity checking using SHA hash verification on downloaded tarballs
- Install from lockfile mode for fast installs skipping resolution
- CLI with colored output and progress indicators
- Handle dependency trees of 50+ packages

## Tech Stack
- TypeScript / Node.js
- No external package manager or semver libraries — raw implementation required
- HTTP for registry communication, file system for package storage

## Scoring Criteria
- **Functional (40%)**: Dependencies resolve correctly, packages install, lockfile produces deterministic results
- **Quality (20%)**: Correct semver logic, clean dependency graph, proper conflict resolution
- **Fidelity (25%)**: All commands work including outdated, cache, integrity checks, and flat hoisting
- **Speed (15%)**: Time bonus