mxrb 0.1.0

data/lib/mxrb/module_initializer.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Mxrb
+  # Adds an application module to an existing Ruby-first project atomically.
+  class ModuleInitializer < Initializer
+    Result = Data.define(:root, :files, :project_file)
+
+    def initialize(name)
+      super(name, subject: :module)
+    end
+
+    def scaffold(into: Dir.pwd)
+      prepare(into)
+      install
+      Result.new(@module_root, module_files, @project_file)
+    ensure
+      cleanup
+    end
+
+    private
+
+    def prepare(into)
+      @project_root = File.expand_path(into)
+      @project_file = File.join(@project_root, 'project.rb')
+      raise ArgumentError, "#{@project_file}: project.rb not found" unless File.file?(@project_file)
+
+      @module_root = File.join(@project_root, 'modules', @module_name)
+      abort "#{@module_root}: directory already exists" if File.exist?(@module_root)
+
+      @staging = Dir.mktmpdir(".#{@module_name}.mxrb-module-", @project_root)
+      @project_staging = File.join(@project_root, ".project.rb.mxrb-#{Process.pid}")
+      write_module_scaffold(@staging)
+      stage_project
+    end
+
+    def stage_project
+      source = File.binread(@project_file)
+      File.binwrite(@project_staging, connect_module(source))
+      File.chmod(File.stat(@project_file).mode, @project_staging)
+    end
+
+    def install
+      FileUtils.mkdir_p(File.dirname(@module_root))
+      File.rename(@staging, @module_root)
+      @module_installed = true
+      File.rename(@project_staging, @project_file)
+      @completed = true
+    end
+
+    def module_files
+      relative_module_files.map { File.join(@module_root, _1) }.freeze
+    end
+
+    def connect_module(source)
+      raise ArgumentError, 'project.rb does not contain Mxrb.define' unless source.include?('Mxrb.define')
+
+      load_line = %(evaluate File.join(__dir__, "modules", "#{@module_name}", "module.rb"))
+      raise ArgumentError, "project.rb already loads #{@module_name}" if source.include?(load_line)
+
+      lines = source.lines
+      closing = lines.rindex { _1.strip == 'end' }
+      raise ArgumentError, 'project.rb does not contain a closing end' unless closing
+
+      indentation = lines.filter_map { |line| line[/\A\s+(?=evaluate File\.join\(__dir__, "modules")/] }.first || '  '
+      lines.insert(closing, "#{indentation}#{load_line}\n")
+      lines.join
+    end
+
+    def cleanup
+      FileUtils.rm_rf(@module_root) if @module_installed && !@completed
+      FileUtils.rm_rf(@staging) if @staging && File.exist?(@staging)
+      FileUtils.rm_f(@project_staging) if @project_staging && File.exist?(@project_staging)
+    end
+  end
+end

data/lib/mxrb/official_marketplace/content_api.rb

@@ -0,0 +1,292 @@
+# frozen_string_literal: true
+
+module Mxrb
+  module OfficialMarketplace
+    # Client and resolver for the documented Mendix Marketplace Content API.
+    class ContentApi # rubocop:disable Metrics/ClassLength
+      BASE_URL = 'https://marketplace-api.mendix.com/v1'
+      AUTHORIZED_HOSTS = %w[marketplace-api.mendix.com marketplace.mendix.com].freeze
+      CONTENT_LIMIT = 100
+      VERSION_LIMIT = 20
+      MENDIX_VERSION = /\A(?:\d{1,3}|1000)(?:\.(?:\d{1,3}|1000)){0,2}\z/
+      MENDIX_BUILD_VERSION = /\A(?:\d{1,3}|1000)(?:\.(?:\d{1,3}|1000)){2}\.\d{1,10}\z/
+      UUID = /\A[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}\z/i
+
+      def initialize(pat: nil, credentials: Credentials.new, client: HttpClient.new)
+        @pat = pat.to_s.strip
+        @pat = ENV['MXRB_MENDIX_PAT'].to_s.strip if @pat.empty?
+        @pat = credentials.pat.to_s.strip if @pat.empty?
+        raise MarketplaceError, missing_pat_message if @pat.empty?
+
+        @client = client
+      end
+
+      def search(name: nil, private: nil, approved: nil, published_since: nil, # rubocop:disable Metrics/ParameterLists
+                 limit: 10, offset: 0)
+        parameters = {
+          name:, isPrivate: boolean_filter(private), isCompanyApproved: boolean_filter(approved),
+          publishedSince: date_filter(published_since), limit: bounded_integer(limit, 1..CONTENT_LIMIT),
+          offset: bounded_integer(offset, 0..)
+        }.compact
+        items(request('/content', parameters))
+      end
+
+      def content(content_id)
+        identifier = positive_integer(content_id, 'content ID')
+        request("/content/#{identifier}")
+      end
+
+      def versions(content_id, version_id: nil, mendix_version: nil, published_since: nil, # rubocop:disable Metrics/ParameterLists
+                   limit: VERSION_LIMIT, offset: 0)
+        identifier = positive_integer(content_id, 'content ID')
+        parameters = {
+          versionId: uuid_filter(version_id),
+          supportedMendixVersion: mendix_version_filter(mendix_version),
+          publishedSince: date_filter(published_since),
+          limit: bounded_integer(limit, 1..VERSION_LIMIT), offset: bounded_integer(offset, 0..)
+        }.compact
+        items(request("/content/#{identifier}/versions", parameters))
+      end
+
+      def find(identifier)
+        return content(identifier) if identifier.to_s.match?(/\A\d+\z/)
+
+        candidates(identifier).each do |name|
+          matches = search(name:)
+          return matches.first if matches.one?
+          raise MarketplaceError, "Marketplace content name #{name.inspect} is ambiguous" \
+            if matches.length > 1
+        end
+        raise MarketplaceError, "Marketplace content not found: #{identifier.inspect}"
+      end
+
+      def resolve(identifier, version: nil, mendix_version: nil, allow_vulnerable: false)
+        selected_content = find(identifier)
+        selected_version = resolve_version(selected_content.fetch('contentId'), version, mendix_version)
+        ensure_compatible!(selected_version, mendix_version) if mendix_version
+        reject_vulnerable!(selected_version) unless allow_vulnerable
+        package(selected_content, selected_version)
+      end
+
+      def download(version_id, destination, download_url: nil)
+        identifier = uuid_filter(version_id)
+        url = download_url || "#{BASE_URL}/versions/#{identifier}/download"
+        uri = URI.parse(url)
+        trusted = AUTHORIZED_HOSTS.include?(uri.host)
+        @client.download(url, destination, authorization: trusted ? authorization : nil)
+      end
+
+      def all_versions(content_id, published_since: nil)
+        paginated(VERSION_LIMIT) do |limit, offset|
+          versions(content_id, published_since:, limit:, offset:)
+        end
+      end
+
+      private
+
+      def request(path, parameters = {})
+        @client.json(url(path, parameters), authorization: authorization)
+      end
+
+      def authorization = "MxToken #{@pat}"
+
+      def url(path, parameters)
+        query = URI.encode_www_form(parameters)
+        query.empty? ? "#{BASE_URL}#{path}" : "#{BASE_URL}#{path}?#{query}"
+      end
+
+      def items(payload)
+        value = payload.fetch('items', [])
+        raise MarketplaceError, 'invalid Marketplace Content API response: items must be an array' \
+          unless value.is_a?(Array)
+
+        value
+      end
+
+      def resolve_version(content_id, version, mendix_version)
+        values = version_candidates(content_id, version, mendix_version)
+        raise MarketplaceError, version_not_found_message(version, mendix_version) if values.empty?
+
+        values.max_by { version_key(_1) }
+      end
+
+      def version_candidates(content_id, version, mendix_version)
+        return versions(content_id, version_id: version) if version&.match?(UUID)
+        return all_versions(content_id).select { _1['versionNumber'].to_s == version } if version
+        return versions(content_id, mendix_version:) if mendix_version
+
+        versions(content_id)
+      end
+
+      def package(content, version)
+        OfficialPackage.new(
+          version['name'] || content.dig('latestVersion', 'name') || "Content#{content['contentId']}",
+          version.fetch('versionNumber'), :mendix, version['downloadURL'] || version['downloadUrl'],
+          "content:#{content.fetch('contentId')}", content.fetch('contentId'),
+          version.fetch('versionId'), content.fetch('type'), version['versionType'] || 'Regular',
+          security_codes(version), content['isPrivate'], content['isCompanyApproved']
+        )
+      end
+
+      def reject_vulnerable!(version)
+        return unless version['versionType'] == 'Vulnerable'
+
+        codes = security_codes(version)
+        suffix = codes.empty? ? '' : " (#{codes.join(', ')})"
+        raise MarketplaceError,
+              "Marketplace version #{version['versionNumber']} is marked vulnerable#{suffix}; " \
+              'select a security fix or pass --allow-vulnerable'
+      end
+
+      def ensure_compatible!(version, mendix_version)
+        minimum = version['minSupportedMendixVersion'].to_s
+        compatible = !minimum.empty? && Gem::Version.new(mendix_version) >= Gem::Version.new(minimum)
+        return if compatible
+
+        raise MarketplaceError,
+              "Marketplace version #{version['versionNumber']} requires Mendix #{minimum} or newer"
+      end
+
+      def security_codes(version)
+        issues = Array(version['vulnerabilities']) + Array(version['fixedSecurityIssues'])
+        issues.filter_map { _1['code'] }.uniq
+      end
+
+      def candidates(identifier)
+        name = identifier.to_s.strip
+        raise MarketplaceError, 'Marketplace content name must not be empty' if name.empty?
+
+        spaced = name.gsub(/([a-z\d])([A-Z])/, '\\1 \\2').tr('_-', ' ').squeeze(' ')
+        [name, spaced].uniq
+      end
+
+      def paginated(page_size)
+        offset = 0
+        result = []
+        loop do
+          page = yield(page_size, offset)
+          result.concat(page)
+          break if page.length < page_size
+
+          offset += page_size
+        end
+        result
+      end
+
+      def version_key(value)
+        [value['publicationDate'].to_s, Gem::Version.new(normalize_version(value['versionNumber']))]
+      end
+
+      def normalize_version(value)
+        value.to_s[/\A\d+(?:\.\d+){0,2}/] || '0'
+      end
+
+      def boolean_filter(value)
+        return if value.nil?
+        return value.to_s if [true, false].include?(value)
+        return value if %w[true false].include?(value)
+
+        raise MarketplaceError, "expected true or false, got #{value.inspect}"
+      end
+
+      def date_filter(value)
+        return if value.nil?
+
+        Date.iso8601(value.to_s).iso8601
+      rescue Date::Error
+        raise MarketplaceError, "invalid RFC 3339 full date #{value.inspect}"
+      end
+
+      def uuid_filter(value)
+        return if value.nil?
+        raise MarketplaceError, "invalid Marketplace version ID #{value.inspect}" unless value.to_s.match?(UUID)
+
+        value.to_s
+      end
+
+      def mendix_version_filter(value)
+        return if value.nil?
+
+        valid = value.to_s.match?(MENDIX_VERSION) || value.to_s.match?(MENDIX_BUILD_VERSION)
+        raise MarketplaceError, "invalid Mendix version #{value.inspect}" unless valid
+
+        value.to_s.split('.').first(3).join('.')
+      end
+
+      def bounded_integer(value, range)
+        integer = Integer(value)
+        raise MarketplaceError, "value #{value.inspect} is outside #{range}" unless range.cover?(integer)
+
+        integer
+      rescue ArgumentError, TypeError
+        raise MarketplaceError, "expected an integer, got #{value.inspect}"
+      end
+
+      def positive_integer(value, label)
+        integer = bounded_integer(value, 1..)
+        integer.to_s
+      rescue MarketplaceError
+        raise MarketplaceError, "invalid #{label} #{value.inspect}"
+      end
+
+      def version_not_found_message(version, mendix_version)
+        qualifier = if version
+                      "version #{version.inspect}"
+                    elsif mendix_version
+                      "a version compatible with Mendix #{mendix_version}"
+                    else
+                      'a published version'
+                    end
+        "Marketplace content does not have #{qualifier}"
+      end
+
+      def missing_pat_message
+        'Mendix PAT not found; run `mxrb marketplace login --help` and configure a PAT file ' \
+          'or Ruby .env with scope mx:marketplace-content:read'
+      end
+    end # rubocop:enable Metrics/ClassLength
+
+    AuditResult = Data.define(
+      :name, :installed_version, :latest_version, :version_type, :issues, :outdated, :valid
+    )
+
+    # Reviews Content API-backed lock entries for updates and known vulnerabilities.
+    class SecurityAuditor
+      def initialize(target:, api: nil)
+        @target = File.expand_path(target)
+        @api = api
+      end
+
+      def audit(mendix_version: nil)
+        entries = OfficialMarketplace.lock(@target).fetch('packages').select do |_name, entry|
+          entry['source'] == 'mendix' && entry['content_id']
+        end
+        return [] if entries.empty?
+
+        @api ||= ContentApi.new
+        entries.map do |name, entry|
+          audit_entry(name, entry, mendix_version)
+        end
+      end
+
+      private
+
+      def audit_entry(name, entry, mendix_version)
+        installed = @api.versions(entry.fetch('content_id'), version_id: entry['version_id']).first
+        latest = @api.resolve(entry.fetch('content_id').to_s, mendix_version:, allow_vulnerable: true)
+        type, issues, installed_version = installed_metadata(installed, entry)
+        AuditResult.new(
+          name, installed_version, latest.version, type, issues,
+          installed_version != latest.version, !installed.nil? && type != 'Vulnerable'
+        )
+      end
+
+      def installed_metadata(installed, entry)
+        type = installed&.fetch('versionType', nil) || 'Unknown'
+        issues = Array(installed&.fetch('vulnerabilities', nil)).filter_map { _1['code'] }
+        version = installed&.fetch('versionNumber', nil) || entry['version']
+        [type, issues, version]
+      end
+    end
+  end
+end

data/lib/mxrb/official_marketplace/dependency_resolver.rb

@@ -0,0 +1,329 @@
+# frozen_string_literal: true
+
+module Mxrb
+  module OfficialMarketplace
+    Dependency = Data.define(:module_name, :package, :archive, :dependencies)
+    WidgetDependency = Data.define(:package, :archive, :widget_ids, :required_ids)
+
+    # Preview for a recursively verified dependency installation.
+    class DependencyPlan
+      attr_reader :root, :dependencies, :widget_dependencies, :blockers
+
+      def initialize(root:, dependencies:, blockers:, widget_dependencies: [], &operation)
+        @root = root
+        @dependencies = dependencies.freeze
+        @widget_dependencies = widget_dependencies.freeze
+        @blockers = blockers.freeze
+        @operation = operation
+        @applied = false
+      end
+
+      def safe? = blockers.empty?
+      def applied? = @applied
+
+      def changes
+        dependencies.map { "install #{_1.module_name} #{_1.package.version}" } +
+          widget_dependencies.map { "install widget bundle #{_1.package.name} #{_1.package.version}" }
+      end
+
+      def apply!
+        raise MarketplaceError, 'Marketplace dependency plan was already applied' if applied?
+        raise MarketplaceError, "Marketplace dependency plan is blocked: #{blockers.join('; ')}" unless safe?
+        raise MarketplaceError, 'Marketplace dependency preview expired; rerun with apply enabled' unless @operation
+
+        apply_operation
+      end
+
+      def apply_resolved!
+        raise MarketplaceError, 'Marketplace dependency plan was already applied' if applied?
+        raise MarketplaceError, 'Marketplace dependency preview expired; rerun with apply enabled' unless @operation
+
+        apply_operation
+      end
+
+      def apply_operation
+        @operation.call
+        @applied = true
+        self
+      end
+
+      def expire!
+        @operation = nil unless applied?
+        self
+      end
+    end
+
+    # Discovers dependencies from unresolved qualified references inside the
+    # package MPR, then verifies Content API candidates against the MPK module.
+    class DependencyResolver # rubocop:disable Metrics/ClassLength
+      PLATFORM_MODULES = %w[System].freeze
+      OFFICIAL_CONTENT_IDS = {
+        'FeedbackModule' => 205_506,
+        'DataWidgets' => 116_540,
+        'Administration' => 23_513
+      }.freeze
+      DATA_WIDGET_PATTERN = /
+        \Acom\.mendix\.widget\.web\.
+        (?:datagrid|datagriddatefilter|datagriddropdownfilter|datagridnumberfilter|
+        datagridtextfilter|dropdownsort|gallery|selectionhelper|treenode)\.
+      /ix
+      OFFICIAL_WIDGET_CONTENT_IDS = {
+        DATA_WIDGET_PATTERN => 116_540,
+        /\Acom\.mendix\.widget\.web\.combobox\.Combobox\z/i => 219_304
+      }.freeze
+
+      def initialize(target:, mpr:, installer:, api:, mendix_version:)
+        @target = File.expand_path(target)
+        @mpr = File.expand_path(mpr)
+        @installer = installer
+        @api = api
+        @mendix_version = mendix_version
+        @resolved = {}
+        @visited = {}
+        @blockers = []
+        @project_modules = Mxrb.open(@mpr) { _1.modules.map(&:name) }
+        @required_widget_ids = widget_ids(@mpr)
+      end
+
+      # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+      def resolve(identifier, apply: false, apply_resolved: false)
+        lifecycle = Lifecycle.new(target: @target, mpr: @mpr, installer: @installer)
+        root, entry = lifecycle.installed(identifier)
+        Dir.mktmpdir('mxrb-marketplace-dependencies-') do |temporary|
+          @temporary = temporary
+          visit(root, safe_path(entry.fetch('archive')))
+          dependencies = @resolved.values.freeze
+          widget_dependencies = resolve_widget_dependencies
+          plan = DependencyPlan.new(
+            root:, dependencies:, widget_dependencies:, blockers: @blockers.uniq
+          ) do
+            apply_dependencies(dependencies, widget_dependencies)
+          end
+          plan.apply! if apply
+          plan.apply_resolved! if apply_resolved
+          plan.expire! unless apply || apply_resolved
+          return plan
+        end
+      ensure
+        @temporary = nil
+      end
+      # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
+
+      private
+
+      # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      def visit(module_name, archive)
+        return if @visited[module_name]
+
+        @visited[module_name] = true
+        dependency_names(archive).each do |dependency_name|
+          next if PLATFORM_MODULES.include?(dependency_name) || dependency_name == module_name
+          next if @project_modules.include?(dependency_name) && !packages.key?(dependency_name)
+
+          dependency = installed_dependency(dependency_name) || resolve_dependency(dependency_name)
+          next unless dependency
+
+          visit(dependency.module_name, dependency.archive)
+          @resolved[dependency.module_name] ||= dependency unless installed?(dependency.module_name)
+        end
+      end
+      # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+
+      def dependency_names(archive)
+        Dir.mktmpdir('mxrb-marketplace-dependency-model-') do |temporary|
+          project = extract_project(archive, temporary)
+          @required_widget_ids.concat(widget_ids(project)).uniq!
+          Mxrb.open(project) do |model|
+            return model.analyze.unresolved_references.filter_map do |reference|
+              reference.qualified_name.to_s.split(%r{[./]}, 2).first
+            end.uniq.sort
+          end
+        end
+      end
+
+      def extract_project(archive_path, temporary)
+        Zip::File.open(archive_path) do |archive|
+          reader = ModulePackageReader.new(archive)
+          descriptor = reader.descriptor
+          reader.extract_project(descriptor, temporary)
+        end
+      rescue Zip::Error, REXML::ParseException => e
+        raise MarketplaceError, "invalid Mendix dependency package: #{e.message}"
+      end
+
+      def installed_dependency(name)
+        pair = packages.find { |module_name, _entry| module_name.casecmp(name).zero? }
+        return unless pair
+
+        module_name, entry = pair
+        Dependency.new(module_name, nil, safe_path(entry.fetch('archive')), dependency_names_for(entry))
+      end
+
+      def dependency_names_for(entry)
+        Array(entry['dependencies'])
+      end
+
+      def resolve_dependency(name) # rubocop:disable Metrics/MethodLength
+        failures = []
+        candidates(name).each do |content|
+          package = resolve_candidate(content)
+          next unless package
+
+          archive = download_candidate(package)
+          inventory = ModulePackageInventory.read(archive)
+          next unless inventory.name == name
+
+          dependencies = dependency_names(archive)
+          return Dependency.new(name, package, archive, dependencies)
+        rescue MarketplaceError => e
+          failures << "#{name}: candidate #{content['contentId']} failed: #{e.message}"
+        end
+        @blockers.concat(failures)
+        @blockers << "#{name}: no official Marketplace package matched the module identity"
+        nil
+      end
+
+      def candidates(name)
+        (official_candidates(name) + queries(name).flat_map { @api.search(name: _1, limit: 100) })
+          .select { Installer::IMPORTABLE_CONTENT_TYPES.include?(_1['type']) }
+          .uniq { _1['contentId'] }
+      end
+
+      def official_candidates(name)
+        pair = OFFICIAL_CONTENT_IDS.find { |module_name, _content_id| module_name.casecmp(name).zero? }
+        pair ? [@api.content(pair.last)] : []
+      end
+
+      def queries(name)
+        humanized = name.gsub('_', ' ').gsub(/([a-z\d])([A-Z])/, '\\1 \\2')
+        [humanized, name].uniq
+      end
+
+      def resolve_candidate(content)
+        @api.resolve(content.fetch('contentId'), mendix_version: @mendix_version)
+      end
+
+      def download_candidate(package)
+        destination = File.join(@temporary, "#{package.content_id}-#{package.version_id}.mpk")
+        return destination if File.file?(destination)
+
+        @api.download(package.version_id, destination, download_url: package.download_url)
+      end
+
+      def resolve_widget_dependencies # rubocop:disable Metrics/MethodLength
+        missing = @required_widget_ids.reject { widget_installed?(_1) }
+        grouped = missing.group_by { official_widget_content_id(_1) }
+        Array(grouped.delete(nil)).each do |widget_id|
+          @blockers << "#{widget_id}: no verified official Marketplace widget mapping"
+        end
+        grouped.filter_map do |content_id, required_ids|
+          resolve_widget_dependency(content_id, required_ids)
+        rescue MarketplaceError => e
+          @blockers << "widget content #{content_id}: #{e.message}"
+          nil
+        end
+      end
+
+      # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+      def resolve_widget_dependency(content_id, required_ids)
+        if package_installed?(content_id)
+          raise MarketplaceError,
+                "locked official package is present but does not provide #{required_ids.join(', ')}"
+        end
+
+        existing = @resolved.values.find { _1.package&.content_id == content_id }
+        package = existing&.package || @api.resolve(content_id, mendix_version: @mendix_version)
+        @installer.validate_official_package!(package)
+        archive = existing&.archive || download_candidate(package)
+        inventory = WidgetBundleInventory.read(archive)
+        missing = required_ids - inventory.widget_ids
+        unless missing.empty?
+          raise MarketplaceError,
+                "downloaded package does not provide #{missing.join(', ')}"
+        end
+
+        WidgetDependency.new(package, archive, inventory.widget_ids, required_ids.sort)
+      end
+      # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
+
+      def official_widget_content_id(widget_id)
+        pair = OFFICIAL_WIDGET_CONTENT_IDS.find { |pattern, _content_id| pattern.match?(widget_id) }
+        pair&.last
+      end
+
+      def widget_installed?(widget_id)
+        !Mxrb::WidgetPackage.find(@target, widget_id).nil?
+      end
+
+      def widget_ids(mpr_path)
+        Mxrb.open(mpr_path) do |model|
+          model.all_units.flat_map do |unit|
+            collect_widget_ids(model.parse_bson(unit))
+          end.uniq.sort
+        end
+      end
+
+      def collect_widget_ids(value)
+        case value
+        when Hash
+          own = value['WidgetId'].to_s
+          nested = value.values.flat_map { collect_widget_ids(_1) }
+          own.empty? ? nested : [own] + nested
+        when Array
+          value.flat_map { collect_widget_ids(_1) }
+        else
+          []
+        end
+      end
+
+      def apply_dependencies(dependencies, widget_dependencies) # rubocop:disable Metrics/MethodLength
+        paths = rollback_paths(dependencies, widget_dependencies)
+        lifecycle = Lifecycle.new(target: @target, mpr: @mpr, installer: @installer)
+        lifecycle.send(:with_rollback, paths) do
+          dependencies.each do |dependency|
+            @installer.send(:import_module, dependency.archive, dependency.package, @mpr)
+          end
+          widget_dependencies.each do |dependency|
+            next if package_installed?(dependency.package.content_id)
+
+            @installer.send(:install_official_archive, dependency.archive, dependency.package, @mpr)
+          end
+        end
+      end
+
+      def rollback_paths(dependencies, widget_dependencies)
+        archives = (dependencies + widget_dependencies).map(&:archive)
+        assets = archives.flat_map { package_asset_paths(_1) }
+        [
+          @mpr, File.join(File.dirname(@mpr), 'mprcontents'),
+          File.join(@target, '.mxrb', 'marketplace.lock.json'),
+          File.join(@target, '.mxrb', 'marketplace'),
+          File.join(@target, '.mxrb', 'marketplace-originals'),
+          File.join(@target, 'theme', 'web', 'custom-variables.scss')
+        ] + assets.map { safe_path(_1) }
+      end
+
+      def package_asset_paths(archive)
+        return [File.join('widgets', WidgetPackageInventory.read(archive).project_filename)] \
+          if PackageEnvelope.kind(archive) == :widget
+
+        ModulePackageInventory.read(archive).files.keys
+      end
+
+      def package_installed?(content_id)
+        packages.any? { |_name, entry| entry['content_id'].to_s == content_id.to_s }
+      end
+
+      def packages = OfficialMarketplace.lock(@target).fetch('packages')
+      def installed?(name) = packages.key?(name)
+
+      def safe_path(relative)
+        path = File.expand_path(File.join(@target, relative.to_s))
+        prefix = "#{@target}#{File::SEPARATOR}"
+        raise MarketplaceError, "path is outside marketplace target: #{path}" unless path.start_with?(prefix)
+
+        path
+      end
+    end
+  end
+end