# Packagist Version Runtime & Reference Evidence API (`soilair/packagist-version-runtime-reference-evidence-api`) Actor

Inspect exact Composer versions with correctly expanded p2 metadata, PHP constraints and declared source/dist references. No installs, scripts, downloads, authors or license clearance.

- **URL**: https://apify.com/soilair/packagist-version-runtime-reference-evidence-api.md
- **Developed by:** [Salih Can Kurnaz](https://apify.com/soilair) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 metadata observations

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Packagist Version Runtime & Reference Evidence API

Read official repo.packagist.org p2 stable-version metadata for up to five vendor/package@version identifiers. No development branches or implicit latest selection. The source may return a bounded complete package-version response before the exact version is selected. Support composer/2.0 metadata minification: fields inherit from the preceding version and \_\_unset removes a top-level field. Only selected scalar/maps are reconstructed for output; authors, emails, funding, scripts, autoload and descriptions are never emitted. Limit source version arrays to five hundred entries and decoded responses to two MiB; larger responses fail without pagination or dump crawling. A per-run successful-response cache avoids downloading the same package payload twice. Match exact version text with an optional leading v removed; do not normalize or solve a Composer range. Return license declarations, type, time, PHP constraint, up to one hundred require name/constraint pairs and source/dist type/reference/checksum declarations. Missing abandoned is null, false stays false and an abandoned replacement string remains a declaration. No URLs are followed, archives are downloaded, install/plugins/scripts run, advisories interpreted or safe/compatible/license-cleared verdict produced. Source/dist references are not checked out or independently authenticated.

### Input example

```json
{
  "packageVersions": [
    "monolog/monolog@3.8.1",
    "monolog/monolog@3.9.0"
  ],
  "maxResults": 2
}
```

### Outputs and change comparison

One saved observation is one dataset row with itemKey, sourceUrl, contentHash and observedAt. The SHA256 covers only selected semantic fields; retrieval times, API request URLs, download/popularity counters and people are excluded. Copy SNAPSHOT.previousHashes into the next input to compare the same exact watchlist. Statuses are NO_BASELINE, FIRST_SEEN, UNCHANGED or CHANGED. Unchanged observations are still billable. There is no hidden persistent baseline and no missing-row/deletion inference. OUTPUT records actual requestCount, rowsEmitted, source summaries, errors, status and complete. SNAPSHOT.complete is false after any error or when any requested observation could not be delivered. Reaching the selected result cap is PARTIAL_RESULT_CAP; a monetary budget stop is PARTIAL_BUDGET. Provider restrictions produce PARTIAL_PROVIDER_LIMIT. A saved observation means successful metadata extraction only, not that the declared package state is good or safe.

### Pricing and bounded work

$0.005 startup plus $0.001 per saved observation, pay per event. Startup quantity follows Apify memory rules with minimum one. Default 256 MB, timeout120 seconds, no restart. Five identifiers and at most five rows; a 55-second fetch deadline and two-MiB decoded-body cap apply. API requests are made only after checking the affordable result capacity. Zero affordable observations causes zero source requests, including no NuGet discovery call. Before each later request and dataset write the budget is checked again. Responses that do not produce a saved row are not charged as observations; startup can still apply. No browser, paid proxy, paid external API or credentials. No network retries, bypasses, API search or bulk pagination. Shared-IP provider limits still apply across runs: avoid parallel requests that exceed provider policy and use supported bulk data channels for large extraction.

### Failure and access behavior

Only constructed official HTTPS API endpoints are contacted. Dynamic NuGet resource links must remain within the validated official registration scope. Private addresses and credential-bearing/cross-provider redirects are rejected. HTTP403/429 or Retry-After stops further provider work; successful current responses can be retained. Unknown/missing identifiers are errors, never guessed missing/safe states. All-source failure exits nonzero after preserving OUTPUT; partial delivery preserves successful rows and explicit errors. Source versions and raw declarations can change, and the Actor does not independently verify artifact bytes, publisher identity, signatures or legal rights. Public upstream APIs/data may be free; the fee covers the bounded selection, validation, comparison/output workflow and Apify execution. There is no affiliation, exclusive data access, guaranteed availability, completeness or revenue claim.

### Official sources

- https://packagist.org/apidoc
- https://getcomposer.org/doc/05-repositories.md#composer
- https://github.com/composer/metadata-minifier/blob/main/src/MetadataMinifier.php

# Actor input Schema

## `packageVersions` (type: `array`):

1..5 exact public package-version identifiers. No URLs, credentials or version ranges.

## `maxResults` (type: `integer`):

1..5 observations. Reaching this cap is reported separately from a monetary budget stop.

## `previousHashes` (type: `object`):

At most500 itemKey/SHA256 pairs from SNAPSHOT. No missing-row deletion inference.

## Actor input object example

```json
{
  "packageVersions": [
    "monolog/monolog@3.8.1",
    "monolog/monolog@3.9.0"
  ],
  "maxResults": 5,
  "previousHashes": {}
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `summary` (type: `string`):

No description

## `snapshot` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packageVersions": [
        "monolog/monolog@3.8.1",
        "monolog/monolog@3.9.0"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("soilair/packagist-version-runtime-reference-evidence-api").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packageVersions": [
        "monolog/monolog@3.8.1",
        "monolog/monolog@3.9.0",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("soilair/packagist-version-runtime-reference-evidence-api").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packageVersions": [
    "monolog/monolog@3.8.1",
    "monolog/monolog@3.9.0"
  ]
}' |
apify call soilair/packagist-version-runtime-reference-evidence-api --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,soilair/packagist-version-runtime-reference-evidence-api"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/blsamUSyUgwcSYw8f/builds/fTqOzODcyh2AZUzdV/openapi.json