cli/manifest/inventory: tt package list and tt package uninstall

.golangci.yml

@@ -70,6 +70,14 @@ linters:
             - []
             - - skip-package-name-checks: true
 
+    tagliatelle:
+      case:
+        rules:
+          # tt's machine-readable payloads are snake_case, matching the manifest
+          # and lock files they are derived from.
+          json: snake
+          yaml: snake
+
     exhaustive:
       # A switch with a default clause is treated as exhaustive.
       default-signifies-exhaustive: true
@@ -110,6 +118,21 @@ linters:
             - "github.com/klauspost/compress/zstd"
             # cli/manifest/pack drives the build before archiving its result.
             - "github.com/tarantool/tt/cli/manifest/build"
+            # cli/manifest/install refetches dependencies through the luarocks
+            # adapter and reuses the build package's exit-code machinery.
+            - "github.com/tarantool/tt/cli/manifest/rocks"
+            # cli/manifest/install and cli/manifest/inventory both read and write
+            # the on-disk install state that cli/manifest/state owns.
+            #
+            # NOTE: depguard matches the longest prefix, not any prefix. Listing a
+            # sub-package here shadows the broader "…/cli/manifest" entry for its
+            # siblings, so an entry added for one package can start flagging
+            # imports that used to pass. Add sub-packages only where the broader
+            # entry is already shadowed, as it is in this list.
+            - "github.com/tarantool/tt/cli/manifest/state"
+            # cli/manifest/inventory renders tt package list as YAML, the
+            # machine-readable default for non-TTY output.
+            - "gopkg.in/yaml.v3"
         test:
           files:
             - "$test"
@@ -122,3 +145,5 @@ linters:
             - "github.com/tarantool/go-luarocks"
             # cli/manifest/pack tests decompress the archive they just wrote.
             - "github.com/klauspost/compress/zstd"
+            # cli/manifest/inventory tests round-trip the YAML they rendered.
+            - "gopkg.in/yaml.v3"

CHANGELOG.md

@@ -27,6 +27,47 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
   the active tt environment when it satisfies `[platform]`, with a warning.
   Archives are byte-reproducible for a given commit; set `SOURCE_DATE_EPOCH` to
   pin the build timestamp explicitly.
+- `tt package install`: unpack a `.tt` archive into a scope and bring the tree
+  to a runnable state. `--scope project` (default) accepts both archive modes; a
+  with-deps archive in the project scope is a plain offline extraction, while a
+  `--without-deps` archive additionally refetches its dependency closure from
+  the registry using the lock's pins. `--scope user`/`--scope system` accept
+  only `--without-deps` archives — a with-deps archive there is refused from the
+  archive header before anything is written. Several packages installed into one
+  project share a `.rocks/` tree, so a dependency they lock at different
+  versions is reconciled to the highest locked version satisfying every
+  package's constraints, or the install fails with a breakdown. Per-package
+  metadata (manifest, lock, VERSION) is recorded under `.rocks/manifests/<pkg>/`
+  for inventory and dependency refcounting. `--locked` refuses an archive whose
+  lock diverges from its manifest, `--upgrade` installs only a strictly higher
+  version, `--force` reinstalls over a collision, and `--yes` skips the
+  reconciliation prompt. Installing several archives at once exits 3 when some
+  succeed and some fail.
+- `tt package list`: show the packages installed in a scope — in the project
+  scope the project's own package plus every guest installed from an archive.
+  The source is the metadata `tt package install` records under
+  `.rocks/manifests/<pkg>/`, so nothing is fetched and nothing is resolved; this
+  reports what is on disk, not what the current manifest declares. `--scope`
+  selects the tree and `-o/--format` picks the output: `table` by default on a
+  terminal, `yaml` by default otherwise, or an explicit `table`/`json`/`yaml`.
+  `--tree` renders the scope as a single tree rooted at the project's own
+  package, with each guest beneath it and each rock beneath whatever requires
+  it, read from the LuaRocks tree manifest. Every rock is annotated with whether
+  another package holds it too — that is, whether `tt package uninstall` would
+  take it along or leave it. A rock the walk cannot root, because the tree
+  carries no manifest or its edges are incomplete, is still shown, under a group
+  that says its parent is not recorded. In the machine formats the same
+  information arrives as a top-level `rocks` index giving each rock's owners and
+  what it `requires`, plus a per-package `direct` list naming the declared
+  subset of the closure. The index is `rocks` rather than `dependencies` because
+  a package entry already carries a `dependencies` object, and one name must not
+  stand for two shapes.
+- `tt package uninstall <name>`: remove an installed guest package — its files
+  and its metadata, plus every shared dependency nothing else still needs. A
+  dependency is owned by every installed package whose lock pins it, so one
+  another package still holds stays in place and is reported as kept. The
+  project's own package is not a guest and uninstall refuses to remove it.
+  `--scope` selects the tree and `--yes` skips the confirmation prompt.
 - `tt pack`: support nested `.packignore` at the root of tt environment.
 - `tt status`: add `--format` option to support JSON and YAML output formats
 for machine-readable output.