pray-cli 1.14.0 → 1.16.0

data/lib/pray/resolve.rb

@@ -98,6 +98,8 @@ module Pray
       end
       raise Error.resolution(local_errors.join("\n")) unless local_errors.empty?
 
+      ResolveDeps.reject_dependency_cycles(packages)
+
       ResolvedProject.new(
         manifest_path: manifest_path,
         project_root: project_root,
@@ -152,7 +154,7 @@ module Pray
     def resolve_package(project_root, sources, git_sources, user_config, declaration, lockfile, offline: false, options: nil)
       options ||= ResolveOptions.new(offline: offline)
       root, registry_latest_version = resolve_package_root_with_metadata(
-        project_root, sources, git_sources, user_config, declaration, lockfile, offline: options.offline
+        project_root, sources, git_sources, user_config, declaration, lockfile, options
       )
       spec_path = find_prayspec_file(root)
       spec_text = File.read(spec_path)
@@ -194,12 +196,16 @@ module Pray
     end
 
     def resolve_package_root_with_metadata(
-      project_root, sources, git_sources, user_config, declaration, lockfile, offline: false
+      project_root, sources, git_sources, user_config, declaration, lockfile, options = nil
     )
+      options ||= ResolveOptions.new
+      offline = options.offline
+      preferred_version = options.preferred_lock_version(lockfile, declaration.name)
       if (local_path = user_config.local.package[declaration.name])
         return [File.expand_path(local_path, project_root), nil]
       end
       return [File.expand_path(declaration.path, project_root), nil] if declaration.path
+      return [ResolveTarball.package_root(project_root, declaration.tarball, offline: offline), nil] if declaration.tarball
       source_name = ResolveSource.implied_source_name(declaration, sources)
       if source_name
         source = sources[source_name]
@@ -212,7 +218,7 @@ module Pray
             "local:#{source_name}",
             source_root,
             declaration,
-            preferred_version: lockfile_preferred_version(lockfile, declaration.name),
+            preferred_version: preferred_version,
             offline: offline
           )
           return [resolved.root, resolved.registry_latest_version]
@@ -226,7 +232,7 @@ module Pray
             project_root,
             source.url,
             declaration,
-            preferred_version: lockfile_preferred_version(lockfile, declaration.name),
+            preferred_version: preferred_version,
             offline: offline
           )
           return [resolved.root, resolved.registry_latest_version]
@@ -245,7 +251,7 @@ module Pray
               source_key,
               distribution_root,
               declaration,
-              preferred_version: lockfile_preferred_version(lockfile, declaration.name),
+              preferred_version: preferred_version,
               offline: offline
             )
           rescue Error => error
@@ -262,9 +268,7 @@ module Pray
         end
       end
 
-      if declaration.git || declaration.tarball || declaration.oci
-        raise Error.unsupported("remote sources are not implemented yet")
-      end
+      raise Error.unsupported("remote sources are not implemented yet") if declaration.git || declaration.oci
 
       [File.join(project_root, declaration.name.tr("/", "-")), nil]
     end
@@ -273,12 +277,6 @@ module Pray
       resolve_package_root_with_metadata(project_root, sources, git_sources, user_config, declaration, lockfile).first
     end
 
-    def lockfile_preferred_version(lockfile, package_name)
-      return nil unless lockfile
-
-      lockfile.package.find { |entry| entry.name == package_name }&.version
-    end
-
     def resolve_local_file(project_root, declaration)
       path = File.join(project_root, declaration.path)
       unless File.exist?(path)

data/lib/pray/resolve_context.rb

@@ -15,5 +15,12 @@ module Pray
     )
       super
     end
+
+    def preferred_lock_version(lockfile, package_name)
+      return nil unless lockfile
+      return nil if ignore_locked_versions || unlocked_packages.include?(package_name)
+
+      lockfile.package.find { |entry| entry.name == package_name }&.version
+    end
   end
 end

data/lib/pray/resolve_deps.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Pray
+  module ResolveDeps
+    module_function
+
+    def reject_dependency_cycles(packages)
+      edges = {}
+      packages.each do |package|
+        edges[package.declaration.name] = package.spec.dependencies.map(&:name)
+      end
+      cycle = DependencyGraph.find_dependency_cycle(edges)
+      return unless cycle
+
+      raise Error.resolution("dependency cycle detected: #{cycle.join(" -> ")}")
+    end
+  end
+end

data/lib/pray/resolve_tarball.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "pathname"
+require_relative "archive_unpack"
+require_relative "hashing"
+require_relative "resource_limits"
+
+module Pray
+  module ResolveTarball
+    module_function
+
+    def package_root(project_root, tarball, offline:)
+      artifact_bytes = read_tarball_bytes(project_root, tarball, offline: offline)
+      if artifact_bytes.bytesize > ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES
+        raise Error.integrity(
+          "package archive exceeds #{ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES} bytes"
+        )
+      end
+
+      cache_key = Hashing.sha256_prefixed(artifact_bytes).delete_prefix("sha256:")[0, 16]
+      cache_directory = File.join(project_root, ".pray", "cache", "tarball", cache_key)
+      if File.directory?(cache_directory)
+        begin
+          Resolve.find_prayspec_file(cache_directory)
+          return cache_directory
+        rescue Error
+          nil
+        end
+      end
+
+      staging_directory = "#{cache_directory}.staging"
+      FileUtils.rm_rf(staging_directory)
+      FileUtils.mkdir_p(staging_directory)
+      ArchiveUnpack.unpack_praypkg(artifact_bytes, staging_directory)
+      Resolve.find_prayspec_file(staging_directory)
+      FileUtils.mkdir_p(File.dirname(cache_directory))
+      FileUtils.rm_rf(cache_directory)
+      FileUtils.mv(staging_directory, cache_directory)
+      cache_directory
+    end
+
+    def read_tarball_bytes(project_root, tarball, offline:)
+      if tarball.start_with?("http://", "https://")
+        if offline
+          raise Error.resolution(
+            "tarball #{tarball} is not cached locally and offline mode is enabled"
+          )
+        end
+        return Registry.http_get(tarball)
+      end
+
+      path = local_tarball_path(project_root, tarball)
+      unless File.file?(path)
+        raise Error.resolution("tarball missing at #{path}")
+      end
+
+      File.binread(path)
+    end
+
+    def local_tarball_path(project_root, tarball)
+      path = tarball.delete_prefix("file://")
+      Pathname.new(path).absolute? ? path : File.expand_path(path, project_root)
+    end
+  end
+end

data/lib/pray/transaction.rb

@@ -57,5 +57,12 @@ module Pray
 
       journal.replace(path, TransactionJournal.snapshot(path), bytes.b)
     end
+
+    def remove_file(path)
+      journal = Thread.current[:pray_write_transaction]
+      return File.delete(path) unless journal
+
+      journal.replace(path, TransactionJournal.snapshot(path), nil)
+    end
   end
 end

data/lib/pray/upstream.rb

@@ -4,19 +4,6 @@ module Pray
   module Upstream
     module_function
 
-    def ensure_update_supported!(packages, selected = nil)
-      unsupported = packages.find do |package|
-        package.declaration.path && package.spec.upstream &&
-          (selected.nil? || package.declaration.name == selected)
-      end
-      return unless unsupported
-
-      raise Error.unsupported(
-        "this installation cannot refresh upstream package #{unsupported.declaration.name}; " \
-        "install pray with Cargo and retry"
-      )
-    end
-
     def to_lock_hash(entry)
       hash = {
         "name" => entry.name,

data/lib/pray/upstream_latest.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module Pray
+  module Upstream
+    module_function
+
+    PathUpstreamLatestConstraint = Struct.new(
+      :package_name, :upstream_name, :current_constraint, :latest_version, :new_constraint, :package_root,
+      keyword_init: true
+    )
+
+    def plan_path_upstream_latest_constraints(project, previous, selected, options)
+      user_config = Config.load_user_config
+      git_sources = GitSources.prepare_git_sources(
+        project.project_root,
+        project.manifest.sources,
+        previous,
+        refresh: options.refresh || options.refresh_source_revisions
+      )
+      sources = Resolve.source_map(project.manifest.sources)
+      plans = []
+      project.packages.each do |package|
+        next if selected && package.declaration.name != selected
+
+        plan = plan_one_path_upstream(project, package, sources, git_sources, user_config, previous, options)
+        plans << plan if plan
+      end
+      plans
+    end
+
+    def apply_path_upstream_latest_constraints(plans)
+      plans.each do |plan|
+        spec_path = Resolve.find_prayspec_file(plan.package_root)
+        spec = Pray.parse_package_spec(File.read(spec_path))
+        unless spec.upstream
+          raise Error.resolution("package #{plan.package_name} has no upstream pin")
+        end
+
+        spec.upstream = PackageUpstream.new(
+          name: spec.upstream.name,
+          constraint: plan.new_constraint
+        )
+        Transaction.write_file(spec_path, PackageSpecRender.render_package_spec(spec))
+      end
+    end
+
+    def latest_spec_upstream_constraint(current, latest_version)
+      derived = Constraint.latest_constraint_for_package(current, latest_version)
+      return "= #{latest_version}" if derived.start_with?("=")
+
+      derived
+    end
+
+    def plan_one_path_upstream(project, package, sources, git_sources, user_config, lockfile, options)
+      upstream = package.spec.upstream
+      return unless upstream && package.declaration.path
+
+      source = ResolveSource.implied_source_name(ManifestPackage.new(name: upstream.name), sources)
+      resolved = Resolve.resolve_package(
+        project.project_root,
+        sources,
+        git_sources,
+        user_config,
+        ManifestPackage.new(name: upstream.name, constraint: "*", source: source),
+        lockfile,
+        options: options
+      )
+      return if Constraint.version_satisfies(resolved.spec.version, upstream.constraint)
+
+      new_constraint = latest_spec_upstream_constraint(upstream.constraint, resolved.spec.version)
+      unless Constraint.version_satisfies(resolved.spec.version, new_constraint)
+        raise Error.resolution(
+          "derived constraint #{new_constraint} does not admit latest #{resolved.spec.version} for #{package.declaration.name}"
+        )
+      end
+
+      PathUpstreamLatestConstraint.new(
+        package_name: package.declaration.name,
+        upstream_name: upstream.name,
+        current_constraint: upstream.constraint,
+        latest_version: resolved.spec.version,
+        new_constraint: new_constraint,
+        package_root: package.root
+      )
+    end
+    private_class_method :plan_one_path_upstream
+  end
+end

data/lib/pray/upstream_merge.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Pray
+  module Upstream
+    module_function
+
+    def identity_path?(path)
+      File.extname(path.to_s) == ".prayspec"
+    end
+
+    def content_paths(files)
+      files.reject { |path| identity_path?(path) }
+    end
+
+    def clean_replica?(old_content, local_content)
+      local_content == old_content
+    end
+
+    def try_merge_content_files(old_content, new_content, local_content)
+      return [new_content.dup, []] if clean_replica?(old_content, local_content)
+
+      merged = {}
+      conflicts = []
+      (old_content.keys + new_content.keys + local_content.keys).uniq.sort.each do |path|
+        result = merge_one_content_path(old_content[path], new_content[path], local_content[path])
+        if result == :conflict
+          conflicts << path
+        elsif result != :omit
+          merged[path] = result
+        end
+      end
+      [merged, conflicts]
+    end
+
+    def merge_one_content_path(old, new, local)
+      case [old.nil?, new.nil?, local.nil?]
+      when [false, false, false]
+        merge_all_present(old, new, local)
+      when [false, true, false]
+        (local == old) ? :omit : :conflict
+      when [false, false, true]
+        (old == new) ? :omit : new
+      when [true, false, true]
+        new
+      when [true, true, false]
+        local
+      when [true, false, false]
+        (local == new) ? new : :conflict
+      else
+        :conflict
+      end
+    end
+
+    def merge_all_present(old, new, local)
+      return new if local == new || local == old
+      return local if old == new
+
+      :conflict
+    end
+
+    def merge_content_files(old_content, new_content, local_content)
+      merged, conflicts = try_merge_content_files(old_content, new_content, local_content)
+      return merged if conflicts.empty?
+
+      raise Error.resolution("upstream merge conflict in #{conflicts.join(", ")}")
+    end
+
+    def merge_conflict_message(fork, upstream_name, old_version, new_version, paths)
+      "upstream merge conflict in #{fork} while refreshing #{upstream_name} " \
+        "#{old_version} to #{new_version}: #{paths.join(", ")}"
+    end
+
+    def next_upstream_constraint(current, new_version)
+      trimmed = current.to_s.strip
+      return current if trimmed == "*" || trimmed.start_with?("~>", "^", ">=", ">", "<=", "<")
+
+      "= #{new_version}"
+    end
+    private_class_method :merge_one_content_path, :merge_all_present
+  end
+end

data/lib/pray/upstream_refresh.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+module Pray
+  module Upstream
+    module_function
+
+    def apply_path_upstream_refreshes(project, previous, selected, options)
+      user_config = Config.load_user_config
+      git_sources = GitSources.prepare_git_sources(
+        project.project_root,
+        project.manifest.sources,
+        previous,
+        refresh: options.refresh || options.refresh_source_revisions
+      )
+      sources = Resolve.source_map(project.manifest.sources)
+      changed = false
+      project.packages.each do |package|
+        next if selected && package.declaration.name != selected
+        next unless apply_one_path_upstream(project, package, previous, sources, git_sources, user_config, options)
+
+        changed = true
+      end
+      changed
+    end
+
+    def apply_one_path_upstream(project, package, previous, sources, git_sources, user_config, options)
+      new_upstream = package.upstream
+      return false unless new_upstream && package.declaration.path
+
+      old_upstream = previous&.package&.find { |entry| entry.name == package.declaration.name }&.upstream
+      return false unless old_upstream
+      return false if old_upstream.version == new_upstream.version && old_upstream.tree_hash == new_upstream.tree_hash
+
+      old_package, new_package = resolve_upstream_pair(
+        project, previous, sources, git_sources, user_config, options, old_upstream, new_upstream
+      )
+      old_content, local_content, merged = merge_fork_content(package, old_upstream, new_upstream, old_package, new_package)
+      write_content_files(package.root, old_content, merged)
+      write_refreshed_spec(package, new_package, old_content, local_content, merged)
+      true
+    end
+
+    def resolve_upstream_pair(project, previous, sources, git_sources, user_config, options, old_upstream, new_upstream)
+      old_package = resolve_named(
+        project.project_root, sources, git_sources, user_config, previous, options,
+        old_upstream.name, "= #{old_upstream.version}", old_upstream.source
+      )
+      resolved_old = LockedUpstream.new(
+        name: old_upstream.name,
+        version: old_package.spec.version,
+        source: old_upstream.source,
+        tree_hash: old_package.tree_hash,
+        artifact_hash: old_package.artifact_hash
+      )
+      ensure_locked_match!(old_upstream, resolved_old)
+      new_package = resolve_named(
+        project.project_root, sources, git_sources, user_config, previous, options,
+        new_upstream.name, "= #{new_upstream.version}", new_upstream.source
+      )
+      [old_package, new_package]
+    end
+
+    def merge_fork_content(package, old_upstream, new_upstream, old_package, new_package)
+      old_content = content_file_bytes(old_package.root, old_package.spec)
+      new_content = content_file_bytes(new_package.root, new_package.spec)
+      local_content = content_file_bytes(package.root, package.spec)
+      merged, conflicts = try_merge_content_files(old_content, new_content, local_content)
+      unless conflicts.empty?
+        raise Error.resolution(
+          merge_conflict_message(
+            package.declaration.name, old_upstream.name, old_upstream.version, new_upstream.version, conflicts
+          )
+        )
+      end
+      [old_content, local_content, merged]
+    end
+
+    def write_refreshed_spec(package, new_package, old_content, local_content, merged)
+      spec_path = Resolve.find_prayspec_file(package.root)
+      updated = PackageSpecRender.fork_spec_after_refresh(
+        package.spec,
+        new_package.spec,
+        File.basename(spec_path),
+        clean_replica?(old_content, local_content),
+        merged.keys
+      )
+      Transaction.write_file(spec_path, PackageSpecRender.render_package_spec(updated))
+    end
+
+    def resolve_named(project_root, sources, git_sources, user_config, lockfile, options, name, constraint, source)
+      Resolve.resolve_package(
+        project_root,
+        sources,
+        git_sources,
+        user_config,
+        ManifestPackage.new(name: name, constraint: constraint, source: source),
+        lockfile,
+        options: options
+      )
+    end
+
+    def content_file_bytes(root, spec)
+      paths = content_paths(spec.files)
+      if paths.length > ResourceLimits::MAX_ARCHIVE_ENTRIES
+        raise Error.integrity("package content exceeds #{ResourceLimits::MAX_ARCHIVE_ENTRIES} files")
+      end
+
+      files = {}
+      total_bytes = 0
+      paths.each do |relative|
+        PathSafety.validate_archive_member_path!(relative)
+        path = File.join(root, relative)
+        raise Error.integrity("package file missing: #{relative}") unless File.file?(path)
+
+        size = File.size(path)
+        if size > ResourceLimits::MAX_ARCHIVE_ENTRY_BYTES
+          raise Error.integrity("package file exceeds #{ResourceLimits::MAX_ARCHIVE_ENTRY_BYTES} bytes: #{relative}")
+        end
+
+        total_bytes += size
+        if total_bytes > ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES
+          raise Error.integrity("package content exceeds #{ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES} bytes")
+        end
+
+        files[relative] = File.binread(path)
+      end
+      files
+    end
+
+    def write_content_files(root, old_content, merged)
+      (old_content.keys + merged.keys).each { |path| PathSafety.validate_archive_member_path!(path) }
+      old_content.each_key do |path|
+        next if merged.key?(path)
+
+        Transaction.remove_file(File.join(root, path))
+      end
+      merged.each do |relative, bytes|
+        Transaction.write_file(File.join(root, relative), bytes)
+      end
+    end
+    private_class_method :apply_one_path_upstream, :resolve_upstream_pair, :merge_fork_content,
+      :write_refreshed_spec, :resolve_named
+  end
+end

data/lib/pray/verify_locked_dest.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Pray
+  module Verify
+    module_function
+
+    def inspect_locked_destinations(project_root, lockfile)
+      report = VerificationReport.new
+      lockfile.managed_span.group_by(&:target).each do |target_path, spans|
+        absolute_path = File.join(project_root, target_path)
+        unless File.exist?(absolute_path)
+          report.findings << VerificationFinding.new(
+            kind: "verify_error",
+            message: "Rendered file `#{target_path}` is missing. Run `pray install` to generate it."
+          )
+          next
+        end
+
+        text = RenderDest.decode_utf8(
+          RenderDest.read_regular_bytes(absolute_path, target_path),
+          target_path
+        )
+        markers = marker_positions(text.lines(chomp: true))
+        spans.each do |span|
+          marker = markers[span.id]
+          unless marker
+            report.findings << VerificationFinding.new(
+              kind: "removed_prayer",
+              message: "`#{target_path}` is missing managed marker `#{span.id}` for `#{span.package}::#{span.export}`. Run `pray install` to restore the managed span."
+            )
+            next
+          end
+          next if marker[2] == span.ideal_checksum
+
+          report.findings << VerificationFinding.new(
+            kind: "custom_implementation",
+            message: "`#{target_path}` marker `#{span.id}` (`#{span.package}::#{span.export}`) was edited. Restore the managed block or run `pray install` to regenerate it."
+          )
+        end
+        find_orphan_marker_findings(spans, markers, target_path).each do |finding|
+          report.findings << finding
+        end
+      end
+      report
+    end
+  end
+end

data/lib/pray/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Pray
-  VERSION = "1.14.0"
-  GENERATED_BY = "pray 1.14.0"
+  VERSION = "1.16.0"
+  GENERATED_BY = "pray 1.16.0"
 end

data/lib/pray.rb

@@ -21,10 +21,17 @@ require_relative "pray/environment"
 require_relative "pray/resolve_context"
 require_relative "pray/resolve_source"
 require_relative "pray/resolve_exports"
+require_relative "pray/dependency_graph"
+require_relative "pray/resolve_deps"
+require_relative "pray/resolve_tarball"
 require_relative "pray/invocation"
 require_relative "pray/git_refresh"
 require_relative "pray/resolve"
 require_relative "pray/upstream"
+require_relative "pray/upstream_merge"
+require_relative "pray/package_spec_render"
+require_relative "pray/upstream_refresh"
+require_relative "pray/upstream_latest"
 require_relative "pray/compose_dest"
 require_relative "pray/render_patch"
 require_relative "pray/render"
@@ -34,6 +41,7 @@ require_relative "pray/render_layout"
 require_relative "pray/verify_position"
 require_relative "pray/verify_provisioned"
 require_relative "pray/verify"
+require_relative "pray/verify_locked_dest"
 require_relative "pray/resource_limits"
 require_relative "pray/http_body"
 require_relative "pray/registry_install"
@@ -57,6 +65,6 @@ class << Pray
     :parse_package_spec, :parse_lockfile, :read_lockfile, :serialize_lockfile, :lockfile_hash,
     :write_lockfile, :write_lockfile_if_changed, :lockfiles_equivalent?, :build_lockfile,
     :resolve_project, :render_project, :materialize_project,
-    :inspect_project, :verify_project, :drift_project,
+    :inspect_project, :inspect_locked_destinations, :verify_project, :drift_project,
     :default_manifest_path, :default_lockfile_path, :project_root_from_manifest
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pray-cli
 version: !ruby/object:Gem::Version
-  version: 1.14.0
+  version: 1.16.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -113,6 +113,7 @@ files:
 - lib/pray/cli/commands/meta.rb
 - lib/pray/cli/commands/packages.rb
 - lib/pray/cli/commands/trust.rb
+- lib/pray/cli/commands/update_latest.rb
 - lib/pray/cli/commands/workflow.rb
 - lib/pray/cli/help.rb
 - lib/pray/cli/helpers.rb
@@ -124,6 +125,7 @@ files:
 - lib/pray/confess.rb
 - lib/pray/config.rb
 - lib/pray/constraint.rb
+- lib/pray/dependency_graph.rb
 - lib/pray/destination.rb
 - lib/pray/dotenv.rb
 - lib/pray/environment.rb
@@ -147,6 +149,7 @@ files:
 - lib/pray/manifest_parser_helpers.rb
 - lib/pray/materialize.rb
 - lib/pray/package_spec.rb
+- lib/pray/package_spec_render.rb
 - lib/pray/path_safety.rb
 - lib/pray/plan.rb
 - lib/pray/project_context.rb
@@ -154,6 +157,7 @@ files:
 - lib/pray/registry.rb
 - lib/pray/registry_install.rb
 - lib/pray/registry_integrity.rb
+- lib/pray/registry_paths.rb
 - lib/pray/render.rb
 - lib/pray/render_content.rb
 - lib/pray/render_dest.rb
@@ -161,8 +165,10 @@ files:
 - lib/pray/render_patch.rb
 - lib/pray/resolve.rb
 - lib/pray/resolve_context.rb
+- lib/pray/resolve_deps.rb
 - lib/pray/resolve_exports.rb
 - lib/pray/resolve_source.rb
+- lib/pray/resolve_tarball.rb
 - lib/pray/resource_limits.rb
 - lib/pray/serve.rb
 - lib/pray/serve_federation.rb
@@ -181,7 +187,11 @@ files:
 - lib/pray/trust_feed.rb
 - lib/pray/trust_ops.rb
 - lib/pray/upstream.rb
+- lib/pray/upstream_latest.rb
+- lib/pray/upstream_merge.rb
+- lib/pray/upstream_refresh.rb
 - lib/pray/verify.rb
+- lib/pray/verify_locked_dest.rb
 - lib/pray/verify_position.rb
 - lib/pray/verify_provisioned.rb
 - lib/pray/version.rb