refactor: split `graphcal-package/src/lib.rs` (2785 non-test lines, six responsibilities)

[shunichironomura]

Warning

This content was written by an AI agent and must be verified by a human developer. After human verification, this alert may be removed.

Summary

crates/graphcal-package/src/lib.rs is 2785 non-test lines (4158 total; the test module starts at line 2785) covering six unrelated responsibilities at different abstraction layers.

What is in the file

1. Validated name newtypes — PackageName, DependencyName, PackageInstanceId, GitCommitHash, Sha256Digest (lines ~29-378)
2. A complete Git URL parser — HTTPS / ssh:// / scp-like, with its own error taxonomy (lines ~59-108, 382-707, ~230 lines of parsing)
3. Portable path types — PackageSourceDirectory, PluginArtifactPath (lines ~109-218, 1356-1429)
4. Plugin execution policy — PluginFuelBudget, PluginFunctionName, PluginFunctionSelector, PluginExecutionPolicy (lines ~732-875)
5. TOML manifest parsing — parse_manifest_str and ~10 helpers (lines ~877-1292)
6. Lockfile modelling — Lockfile, ValidatedLockfile, DFS cycle detection, cross-manifest validation (lines ~1293-2784)

Why this is a finding

AGENTS.md asks for the opposite:

Prefer small modules with a single, atomic responsibility over broad domain grab-bags. Two concepts belonging to the same user-facing domain is not enough reason to implement them in the same file; they should also live at the same abstraction layer and have a real implementation dependency.

Items 2 and 5-6 in particular are separate layers: URL syntax has no implementation dependency on lock-graph semantics.

Note on quality

The contents are of high quality and this is a packaging concern, not a correctness one. For the record, the Git URL parser rejects credentials, control characters, backslashes, query/fragment, %2f/%2e path smuggling, option-shaped (--leading) components, and every scheme except https/ssh — and the repository never shells out to git (it uses gix; the only Command::new anywhere in crates/ is the opt-in Lean conformance oracle).

Suggested fix

Split into focused modules, re-exporting from lib.rs so the public API is unchanged:

• names.rs — the validated name newtypes
• git_url.rs — GitUrl, GitTransport, GitUrlError and the parsers
• paths.rs — PackageSourceDirectory, PluginArtifactPath
• plugin_policy.rs — fuel budget, function name/selector, execution policy
• manifest.rs — PackageManifest and TOML parsing
• lockfile.rs — Lockfile, validation, cycle detection

Pairs naturally with centralizing this crate's url dependency into [workspace.dependencies].

Provenance

Found during a full-workspace code review at 6e462341a (v0.0.1-alpha.27). Baseline at that commit: cargo clippy --workspace --all-targets clean, cargo test --workspace 2926 passed / 0 failed, cargo deny check advisories ok.