@_linked/cli 1.41.1 → 1.42.0

package/lib/esm/localize/ensure.js

@@ -0,0 +1,152 @@
+/**
+ * One copy, always: every package the app provides loads once, whichever tool
+ * runs the code -- Vite, `tsc`, plain Node, `tsx`, a test runner.
+ *
+ * Two halves:
+ *
+ * - **`ensure(entry)`** -- the ONLY way a checkout gets installed: `npm
+ *   install` inside it, then prune it (prune.ts). localize's install step,
+ *   `--relink`'s reinstall and `linked localize --reinstall <pkg>` all go
+ *   through it, so the copies an install puts back exist only until it
+ *   returns. Hand-running `npm install` in a checkout is what `--reinstall`
+ *   replaces.
+ * - **`checkOneCopy(appRoot)`** -- the run-time check. Before `linked start`,
+ *   `script`, `call` and `build-all` (a commander `preAction` in cli.ts), and
+ *   as `linked localize --ensure` for an app's npm `pre*` scripts. Stat-only:
+ *   for every recorded checkout and every name the app provides, does
+ *   `<checkout>/node_modules/<name>` exist with a real path other than the
+ *   app's copy? Only then does it prune -- through prune's guarded path, so a
+ *   copy whose ranges the app does not satisfy stays -- and it says what it
+ *   removed in one line. It never runs npm, prints nothing when there is
+ *   nothing to do (or no manifest), and never throws: a run command must not
+ *   fail over a developer's private checkout state.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { EXIT_INSTALL_FAILED, EXIT_REFUSED, EXIT_WARNED, LocalizeError, } from './errors.js';
+import { manifestPath, readManifest } from './manifest.js';
+import { readJson } from './fsops.js';
+import { nodeModulesRoots, pruneProvided, realOrSelf, shouldPrune, } from './prune.js';
+import { providedPackages } from './provided.js';
+import { defaultDeps } from './run.js';
+import { reportError } from './localize.js';
+/**
+ * `npm install` inside the checkout at `entry.path`, then prune it.
+ *
+ * The package's name is read from the checkout's own `package.json`; the
+ * other localized packages (siblings) from the manifest, so a checkout being
+ * localized right now prunes before the manifest records it.
+ *
+ * @returns 0, or `EXIT_WARNED` when the prune failed (the install stands).
+ * @throws {LocalizeError} `EXIT_INSTALL_FAILED` when `npm install` fails.
+ */
+export function ensure(entry, deps, opts = {}) {
+    var _a;
+    const pkgDir = path.join(deps.appRoot, entry.path);
+    deps.log(`[localize] npm install in ${entry.path}`);
+    const install = deps.run('npm', ['install', '--no-audit', '--no-fund'], {
+        cwd: pkgDir,
+    });
+    if (install.status !== 0) {
+        throw new LocalizeError(`npm install failed in ${entry.path}:\n${(install.stderr || install.stdout).trim()}`, EXIT_INSTALL_FAILED);
+    }
+    if (!shouldPrune(opts))
+        return 0;
+    const name = (_a = readJson(path.join(pkgDir, 'package.json'))) === null || _a === void 0 ? void 0 : _a.name;
+    if (typeof name !== 'string')
+        return 0;
+    try {
+        const entries = Object.assign(Object.assign({}, recordedEntries(deps)), { [name]: entry });
+        pruneProvided(entries, opts, deps, { owners: [name] });
+        return 0;
+    }
+    catch (e) {
+        deps.warn(`[localize] pruning ${entry.path} failed, its node_modules are as npm left them: ${e.message}`);
+        return EXIT_WARNED;
+    }
+}
+/** `linked localize --reinstall <pkg>`: `ensure` for one recorded package. */
+export function reinstall(name, opts, deps) {
+    try {
+        const entry = readManifest(deps.appRoot, deps).entries[name];
+        if (!entry) {
+            throw new LocalizeError(`${name} is not localized here, so there is no checkout to reinstall. ` +
+                '`linked localize --list` shows what is.', EXIT_REFUSED);
+        }
+        if (!fs.existsSync(path.join(deps.appRoot, entry.path, 'package.json'))) {
+            throw new LocalizeError(`${name} is recorded at ${entry.path}, which has no package.json.`, EXIT_REFUSED);
+        }
+        return ensure(entry, deps, opts);
+    }
+    catch (e) {
+        return reportError(e, deps);
+    }
+}
+/**
+ * The run-time check: remove every recorded checkout's own copy of what the
+ * app provides. Stat-only until there is something to remove.
+ *
+ * @returns what was removed, as `<checkout>/node_modules/<name>@<version>`.
+ */
+export function checkOneCopy(appRoot = process.cwd(), deps = defaultDeps(appRoot)) {
+    var _a;
+    try {
+        if (!fs.existsSync(manifestPath(appRoot)))
+            return { pruned: [] };
+        const entries = readManifest(appRoot, { warn: () => { } }).entries;
+        const owners = Object.keys(entries);
+        if (!owners.length)
+            return { pruned: [] };
+        // The app's copy of each provided name, by real path.
+        const appReal = new Map();
+        for (const name of providedPackages(appRoot, owners).names) {
+            const dir = path.join(appRoot, 'node_modules', name);
+            if (fs.existsSync(dir))
+                appReal.set(name, realOrSelf(dir));
+        }
+        const hitOwners = new Set();
+        const hitNames = new Set();
+        for (const [owner, entry] of Object.entries(entries)) {
+            const pkgDir = path.join(appRoot, entry.path);
+            for (const nm of nodeModulesRoots(pkgDir, entry)) {
+                for (const [name, real] of appReal) {
+                    if (name === owner)
+                        continue;
+                    const copy = path.join(nm, name);
+                    if (fs.existsSync(copy) && realOrSelf(copy) !== real) {
+                        hitOwners.add(owner);
+                        hitNames.add(name);
+                    }
+                }
+            }
+        }
+        if (!hitOwners.size)
+            return { pruned: [] };
+        // Prune's own report is per checkout and also speaks of what it keeps;
+        // here only what went is worth a line, on every run command.
+        const quiet = { appRoot, log: () => { }, warn: () => { } };
+        const { removed } = pruneProvided(entries, {}, quiet, {
+            owners: [...hitOwners],
+            deps: [...hitNames],
+        });
+        const pruned = removed.map((r) => `${r.owner}/node_modules/${r.dep}@${r.version}`);
+        if (pruned.length) {
+            deps.log(`[localize] one copy: removed ${pruned.join(', ')} — the app provides ` +
+                `${pruned.length === 1 ? 'it' : 'them'}.`);
+        }
+        return { pruned };
+    }
+    catch (e) {
+        deps.warn(`[localize] one-copy check failed, nothing more was removed: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+        return { pruned: [] };
+    }
+}
+function recordedEntries(deps) {
+    try {
+        return readManifest(deps.appRoot, { warn: () => { } }).entries;
+    }
+    catch (_a) {
+        return {};
+    }
+}
+//# sourceMappingURL=ensure.js.map

package/lib/esm/localize/ensure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure.js","sourceRoot":"","sources":["../../../src/localize/ensure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAC,YAAY,EAAE,YAAY,EAAC,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAC,QAAQ,EAAC,MAAM,YAAY,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAC,gBAAgB,EAAC,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAC,WAAW,EAAC,MAAM,UAAU,CAAC;AAErC,OAAO,EAAC,WAAW,EAAC,MAAM,eAAe,CAAC;AAE1C;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CACpB,KAA6C,EAC7C,IAAU,EACV,OAAqB,EAAE;;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,6BAA6B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE;QACtE,GAAG,EAAE,MAAM;KACZ,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CACrB,yBAAyB,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACpF,mBAAmB,CACpB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,MAAA,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,0CAAE,IAAI,CAAC;IAC/D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,mCAAO,eAAe,CAAC,IAAI,CAAC,KAAE,CAAC,IAAI,CAAC,EAAE,KAAsB,GAAC,CAAC;QAC3E,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,IAAI,CACP,sBAAsB,KAAK,CAAC,IAAI,mDAAmD,CAAC,CAAC,OAAO,EAAE,CAC/F,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,IAAkB,EAClB,IAAU;IAEV,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CACrB,GAAG,IAAI,gEAAgE;gBACrE,yCAAyC,EAC3C,YAAY,CACb,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,aAAa,CACrB,GAAG,IAAI,mBAAmB,KAAK,CAAC,IAAI,8BAA8B,EAClE,YAAY,CACb,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAkB,OAAO,CAAC,GAAG,EAAE,EAC/B,OAAmC,WAAW,CAAC,OAAO,CAAC;;IAEvD,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,EAAC,MAAM,EAAE,EAAE,EAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,EAAC,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAC,CAAC,CAAC,OAAO,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAC,MAAM,EAAE,EAAE,EAAC,CAAC;QAExC,sDAAsD;QACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YACrD,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,KAAK,MAAM,EAAE,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;oBACnC,IAAI,IAAI,KAAK,KAAK;wBAAE,SAAS;oBAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;oBACjC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;wBACrD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI;YAAE,OAAO,EAAC,MAAM,EAAE,EAAE,EAAC,CAAC;QAEzC,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,KAAK,GAAG,EAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAC,CAAC;QACvD,MAAM,EAAC,OAAO,EAAC,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE;YAClD,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC;YACtB,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC;SACpB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CACvD,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,GAAG,CACN,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;gBACrE,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAC5C,CAAC;QACJ,CAAC;QACD,OAAO,EAAC,MAAM,EAAC,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,IAAI,CACP,+DAA+D,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,CAAC,EAAE,CACjF,CAAC;QACF,OAAO,EAAC,MAAM,EAAE,EAAE,EAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAC,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * One copy, always: every package the app provides loads once, whichever tool\n * runs the code -- Vite, `tsc`, plain Node, `tsx`, a test runner.\n *\n * Two halves:\n *\n * - **`ensure(entry)`** -- the ONLY way a checkout gets installed: `npm\n *   install` inside it, then prune it (prune.ts). localize's install step,\n *   `--relink`'s reinstall and `linked localize --reinstall <pkg>` all go\n *   through it, so the copies an install puts back exist only until it\n *   returns. Hand-running `npm install` in a checkout is what `--reinstall`\n *   replaces.\n * - **`checkOneCopy(appRoot)`** -- the run-time check. Before `linked start`,\n *   `script`, `call` and `build-all` (a commander `preAction` in cli.ts), and\n *   as `linked localize --ensure` for an app's npm `pre*` scripts. Stat-only:\n *   for every recorded checkout and every name the app provides, does\n *   `<checkout>/node_modules/<name>` exist with a real path other than the\n *   app's copy? Only then does it prune -- through prune's guarded path, so a\n *   copy whose ranges the app does not satisfy stays -- and it says what it\n *   removed in one line. It never runs npm, prints nothing when there is\n *   nothing to do (or no manifest), and never throws: a run command must not\n *   fail over a developer's private checkout state.\n */\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n  EXIT_INSTALL_FAILED,\n  EXIT_REFUSED,\n  EXIT_WARNED,\n  LocalizeError,\n} from './errors.js';\nimport {manifestPath, readManifest} from './manifest.js';\nimport type {ManifestEntry} from './manifest.js';\nimport {readJson} from './fsops.js';\nimport {\n  nodeModulesRoots,\n  pruneProvided,\n  realOrSelf,\n  shouldPrune,\n} from './prune.js';\nimport type {PruneOptions} from './prune.js';\nimport {providedPackages} from './provided.js';\nimport {defaultDeps} from './run.js';\nimport type {Deps} from './run.js';\nimport {reportError} from './localize.js';\n\n/**\n * `npm install` inside the checkout at `entry.path`, then prune it.\n *\n * The package's name is read from the checkout's own `package.json`; the\n * other localized packages (siblings) from the manifest, so a checkout being\n * localized right now prunes before the manifest records it.\n *\n * @returns 0, or `EXIT_WARNED` when the prune failed (the install stands).\n * @throws {LocalizeError} `EXIT_INSTALL_FAILED` when `npm install` fails.\n */\nexport function ensure(\n  entry: Pick<ManifestEntry, 'path' | 'subdir'>,\n  deps: Deps,\n  opts: PruneOptions = {},\n): number {\n  const pkgDir = path.join(deps.appRoot, entry.path);\n  deps.log(`[localize] npm install in ${entry.path}`);\n  const install = deps.run('npm', ['install', '--no-audit', '--no-fund'], {\n    cwd: pkgDir,\n  });\n  if (install.status !== 0) {\n    throw new LocalizeError(\n      `npm install failed in ${entry.path}:\\n${(install.stderr || install.stdout).trim()}`,\n      EXIT_INSTALL_FAILED,\n    );\n  }\n  if (!shouldPrune(opts)) return 0;\n\n  const name = readJson(path.join(pkgDir, 'package.json'))?.name;\n  if (typeof name !== 'string') return 0;\n  try {\n    const entries = {...recordedEntries(deps), [name]: entry as ManifestEntry};\n    pruneProvided(entries, opts, deps, {owners: [name]});\n    return 0;\n  } catch (e) {\n    deps.warn(\n      `[localize] pruning ${entry.path} failed, its node_modules are as npm left them: ${e.message}`,\n    );\n    return EXIT_WARNED;\n  }\n}\n\n/** `linked localize --reinstall <pkg>`: `ensure` for one recorded package. */\nexport function reinstall(\n  name: string,\n  opts: PruneOptions,\n  deps: Deps,\n): number {\n  try {\n    const entry = readManifest(deps.appRoot, deps).entries[name];\n    if (!entry) {\n      throw new LocalizeError(\n        `${name} is not localized here, so there is no checkout to reinstall. ` +\n          '`linked localize --list` shows what is.',\n        EXIT_REFUSED,\n      );\n    }\n    if (!fs.existsSync(path.join(deps.appRoot, entry.path, 'package.json'))) {\n      throw new LocalizeError(\n        `${name} is recorded at ${entry.path}, which has no package.json.`,\n        EXIT_REFUSED,\n      );\n    }\n    return ensure(entry, deps, opts);\n  } catch (e) {\n    return reportError(e, deps);\n  }\n}\n\n/**\n * The run-time check: remove every recorded checkout's own copy of what the\n * app provides. Stat-only until there is something to remove.\n *\n * @returns what was removed, as `<checkout>/node_modules/<name>@<version>`.\n */\nexport function checkOneCopy(\n  appRoot: string = process.cwd(),\n  deps: Pick<Deps, 'log' | 'warn'> = defaultDeps(appRoot),\n): {pruned: string[]} {\n  try {\n    if (!fs.existsSync(manifestPath(appRoot))) return {pruned: []};\n    const entries = readManifest(appRoot, {warn: () => {}}).entries;\n    const owners = Object.keys(entries);\n    if (!owners.length) return {pruned: []};\n\n    // The app's copy of each provided name, by real path.\n    const appReal = new Map<string, string>();\n    for (const name of providedPackages(appRoot, owners).names) {\n      const dir = path.join(appRoot, 'node_modules', name);\n      if (fs.existsSync(dir)) appReal.set(name, realOrSelf(dir));\n    }\n\n    const hitOwners = new Set<string>();\n    const hitNames = new Set<string>();\n    for (const [owner, entry] of Object.entries(entries)) {\n      const pkgDir = path.join(appRoot, entry.path);\n      for (const nm of nodeModulesRoots(pkgDir, entry)) {\n        for (const [name, real] of appReal) {\n          if (name === owner) continue;\n          const copy = path.join(nm, name);\n          if (fs.existsSync(copy) && realOrSelf(copy) !== real) {\n            hitOwners.add(owner);\n            hitNames.add(name);\n          }\n        }\n      }\n    }\n    if (!hitOwners.size) return {pruned: []};\n\n    // Prune's own report is per checkout and also speaks of what it keeps;\n    // here only what went is worth a line, on every run command.\n    const quiet = {appRoot, log: () => {}, warn: () => {}};\n    const {removed} = pruneProvided(entries, {}, quiet, {\n      owners: [...hitOwners],\n      deps: [...hitNames],\n    });\n    const pruned = removed.map(\n      (r) => `${r.owner}/node_modules/${r.dep}@${r.version}`,\n    );\n    if (pruned.length) {\n      deps.log(\n        `[localize] one copy: removed ${pruned.join(', ')} — the app provides ` +\n          `${pruned.length === 1 ? 'it' : 'them'}.`,\n      );\n    }\n    return {pruned};\n  } catch (e) {\n    deps.warn(\n      `[localize] one-copy check failed, nothing more was removed: ${e?.message ?? e}`,\n    );\n    return {pruned: []};\n  }\n}\n\nfunction recordedEntries(deps: Deps): Record<string, ManifestEntry> {\n  try {\n    return readManifest(deps.appRoot, {warn: () => {}}).entries;\n  } catch {\n    return {};\n  }\n}\n"]}

package/lib/esm/localize/errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Every refusal in localize throws a LocalizeError carrying an exit code, so
+ * callers can branch on `.code` rather than matching on a message.
+ *
+ * The codes are a public contract: scripts depend on them.
+ */
+/** The manifest file is unusable and localize refuses to touch it. */
+export declare const EXIT_BAD_FILE = 3;
+/** No git repository could be resolved for the package name. */
+export declare const EXIT_NOT_FOUND = 4;
+/** Something was warned about and skipped; the command otherwise worked. */
+export declare const EXIT_WARNED = 5;
+/** A guard refused to act. `--force` overrides. */
+export declare const EXIT_REFUSED = 6;
+/** The install inside the checkout failed: nothing linked, nothing recorded. */
+export declare const EXIT_INSTALL_FAILED = 7;
+/** package.json / package-lock.json changed -- the failure this tool exists to prevent. */
+export declare const EXIT_MANIFEST_DIRTY = 8;
+export declare class LocalizeError extends Error {
+    code: number;
+    constructor(message: string, code: number);
+}
+//# sourceMappingURL=errors.d.ts.map

package/lib/esm/localize/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/localize/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sEAAsE;AACtE,eAAO,MAAM,aAAa,IAAI,CAAC;AAC/B,gEAAgE;AAChE,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,4EAA4E;AAC5E,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,mDAAmD;AACnD,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,2FAA2F;AAC3F,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,qBAAa,aAAc,SAAQ,KAAK;IACtC,IAAI,EAAE,MAAM,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C"}

package/lib/esm/localize/errors.js

@@ -0,0 +1,26 @@
+/**
+ * Every refusal in localize throws a LocalizeError carrying an exit code, so
+ * callers can branch on `.code` rather than matching on a message.
+ *
+ * The codes are a public contract: scripts depend on them.
+ */
+/** The manifest file is unusable and localize refuses to touch it. */
+export const EXIT_BAD_FILE = 3;
+/** No git repository could be resolved for the package name. */
+export const EXIT_NOT_FOUND = 4;
+/** Something was warned about and skipped; the command otherwise worked. */
+export const EXIT_WARNED = 5;
+/** A guard refused to act. `--force` overrides. */
+export const EXIT_REFUSED = 6;
+/** The install inside the checkout failed: nothing linked, nothing recorded. */
+export const EXIT_INSTALL_FAILED = 7;
+/** package.json / package-lock.json changed -- the failure this tool exists to prevent. */
+export const EXIT_MANIFEST_DIRTY = 8;
+export class LocalizeError extends Error {
+    constructor(message, code) {
+        super(message);
+        this.name = 'LocalizeError';
+        this.code = code;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/lib/esm/localize/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/localize/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,mDAAmD;AACnD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEtC,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF","sourcesContent":["/**\n * Every refusal in localize throws a LocalizeError carrying an exit code, so\n * callers can branch on `.code` rather than matching on a message.\n *\n * The codes are a public contract: scripts depend on them.\n */\n\n/** The manifest file is unusable and localize refuses to touch it. */\nexport const EXIT_BAD_FILE = 3;\n/** No git repository could be resolved for the package name. */\nexport const EXIT_NOT_FOUND = 4;\n/** Something was warned about and skipped; the command otherwise worked. */\nexport const EXIT_WARNED = 5;\n/** A guard refused to act. `--force` overrides. */\nexport const EXIT_REFUSED = 6;\n/** The install inside the checkout failed: nothing linked, nothing recorded. */\nexport const EXIT_INSTALL_FAILED = 7;\n/** package.json / package-lock.json changed -- the failure this tool exists to prevent. */\nexport const EXIT_MANIFEST_DIRTY = 8;\n\nexport class LocalizeError extends Error {\n  code: number;\n  constructor(message: string, code: number) {\n    super(message);\n    this.name = 'LocalizeError';\n    this.code = code;\n  }\n}\n"]}

package/lib/esm/localize/fsops.d.ts

@@ -0,0 +1,36 @@
+export declare function isSymlink(p: string): boolean;
+export declare function isGitCheckout(p: string): boolean;
+/** Is `child` at or below `parent`? Both must be absolute, real paths. */
+export declare function isInside(child: string, parent: string): boolean;
+export declare function readJson(file: string): any;
+/** Where `node_modules/<name>` points, resolved, or null when it is not a link. */
+export declare function linkTarget(appRoot: string, name: string): string | null;
+/**
+ * Write `node_modules/<name> -> <checkout>` and nothing else.
+ *
+ * The target is stored RELATIVE so the tree survives being moved or bind-mounted
+ * into a container at a different path.
+ */
+export declare function writeLink(appRoot: string, name: string, checkout: string): string;
+/** Every symlink directly under node_modules whose target leaves node_modules. */
+export declare function scanLinks(appRoot: string): {
+    name: string;
+    target: string;
+}[];
+/** The files no localize command may ever touch. */
+export declare const MANIFEST_FILES: string[];
+/**
+ * Hash the consumer's manifests.
+ *
+ * Content hashes, NOT `git status`. `git status` compares against HEAD, so in
+ * any tree with an uncommitted `package.json` it reports a modification the
+ * command did not make -- an earlier version of this tool shipped that bug and
+ * reported correct runs as failures. Hashes also work in a tree with no git,
+ * and catch an edit that HEAD happens to agree with.
+ *
+ * `latin1` is a byte-exact round-trip for arbitrary bytes; `utf8` is not.
+ */
+export declare function snapshotManifests(appRoot: string): Record<string, string | null>;
+/** @returns {string[]} a human description of each manifest that changed. */
+export declare function diffManifests(before: Record<string, string | null>, after: Record<string, string | null>): string[];
+//# sourceMappingURL=fsops.d.ts.map

package/lib/esm/localize/fsops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fsops.d.ts","sourceRoot":"","sources":["../../../src/localize/fsops.ts"],"names":[],"mappings":"AAiBA,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAM5C;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAG/D;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAM1C;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASvE;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,MAAM,CAOR;AAED,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,EAAE,CAqC3E;AAMD,oDAAoD;AACpD,eAAO,MAAM,cAAc,UAAwC,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAW/B;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GACnC,MAAM,EAAE,CAMV"}

package/lib/esm/localize/fsops.js

@@ -0,0 +1,155 @@
+/**
+ * The filesystem primitives, and the guard that proves localize kept its
+ * promise.
+ *
+ * The link is written with `fs.symlink` and never by invoking npm. Two
+ * separate reasons, both measured rather than assumed:
+ *
+ * - `npm install <path> --no-save` brings npm's peer resolution along, which
+ *   hard-failed an app's boot on a missing peer dependency. Module resolution
+ *   happens from the symlink's REAL path, whose ancestors have no
+ *   `node_modules`, so the checkout needs its own installed tree.
+ * - a `postinstall` hook that invokes an install at the consumer root recurses.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+export function isSymlink(p) {
+    try {
+        return fs.lstatSync(p).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}
+export function isGitCheckout(p) {
+    return fs.existsSync(path.join(p, '.git'));
+}
+/** Is `child` at or below `parent`? Both must be absolute, real paths. */
+export function isInside(child, parent) {
+    const rel = path.relative(parent, child);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+export function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/** Where `node_modules/<name>` points, resolved, or null when it is not a link. */
+export function linkTarget(appRoot, name) {
+    const link = path.join(appRoot, 'node_modules', name);
+    if (!isSymlink(link))
+        return null;
+    try {
+        return fs.realpathSync(link);
+    }
+    catch (_a) {
+        // A dangling link is still linked intent; its target is simply gone.
+        return path.resolve(path.dirname(link), fs.readlinkSync(link));
+    }
+}
+/**
+ * Write `node_modules/<name> -> <checkout>` and nothing else.
+ *
+ * The target is stored RELATIVE so the tree survives being moved or bind-mounted
+ * into a container at a different path.
+ */
+export function writeLink(appRoot, name, checkout) {
+    const link = path.join(appRoot, 'node_modules', name);
+    fs.mkdirSync(path.dirname(link), { recursive: true });
+    if (isSymlink(link))
+        fs.unlinkSync(link);
+    else if (fs.existsSync(link))
+        fs.rmSync(link, { recursive: true, force: true });
+    fs.symlinkSync(path.relative(path.dirname(link), checkout), link, 'dir');
+    return link;
+}
+/** Every symlink directly under node_modules whose target leaves node_modules. */
+export function scanLinks(appRoot) {
+    const root = path.join(appRoot, 'node_modules');
+    const out = [];
+    let top;
+    try {
+        top = fs.readdirSync(root, { withFileTypes: true });
+    }
+    catch (_a) {
+        return out;
+    }
+    const collect = (name, full) => {
+        if (!isSymlink(full))
+            return;
+        let target;
+        try {
+            target = fs.realpathSync(full);
+        }
+        catch (_a) {
+            return;
+        }
+        if (isInside(target, root))
+            return; // an ordinary hoisting link, not a checkout
+        out.push({ name, target });
+    };
+    for (const item of top) {
+        if (item.name === '.bin' || item.name.startsWith('.'))
+            continue;
+        const full = path.join(root, item.name);
+        if (item.name.startsWith('@')) {
+            let inner;
+            try {
+                inner = fs.readdirSync(full, { withFileTypes: true });
+            }
+            catch (_b) {
+                continue;
+            }
+            for (const sub of inner)
+                collect(`${item.name}/${sub.name}`, path.join(full, sub.name));
+        }
+        else {
+            collect(item.name, full);
+        }
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// the post-condition
+// ---------------------------------------------------------------------------
+/** The files no localize command may ever touch. */
+export const MANIFEST_FILES = ['package.json', 'package-lock.json'];
+/**
+ * Hash the consumer's manifests.
+ *
+ * Content hashes, NOT `git status`. `git status` compares against HEAD, so in
+ * any tree with an uncommitted `package.json` it reports a modification the
+ * command did not make -- an earlier version of this tool shipped that bug and
+ * reported correct runs as failures. Hashes also work in a tree with no git,
+ * and catch an edit that HEAD happens to agree with.
+ *
+ * `latin1` is a byte-exact round-trip for arbitrary bytes; `utf8` is not.
+ */
+export function snapshotManifests(appRoot) {
+    const snap = {};
+    for (const file of MANIFEST_FILES) {
+        try {
+            const bytes = fs.readFileSync(path.join(appRoot, file), 'latin1');
+            snap[file] = createHash('sha256').update(bytes, 'latin1').digest('hex');
+        }
+        catch (_a) {
+            snap[file] = null;
+        }
+    }
+    return snap;
+}
+/** @returns {string[]} a human description of each manifest that changed. */
+export function diffManifests(before, after) {
+    return MANIFEST_FILES.filter((f) => before[f] !== after[f]).map((f) => {
+        if (before[f] === null)
+            return `${f} (created)`;
+        if (after[f] === null)
+            return `${f} (deleted)`;
+        return `${f} (modified)`;
+    });
+}
+//# sourceMappingURL=fsops.js.map

package/lib/esm/localize/fsops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fsops.js","sourceRoot":"","sources":["../../../src/localize/fsops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAEvC,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC1C,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,MAAc;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,WAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,OAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;SACpC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;IAC9E,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChD,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAC,aAAa,EAAE,IAAI,EAAC,CAAC,CAAC;IACpD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7B,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,WAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,4CAA4C;QAChF,GAAG,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,MAAM,EAAC,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAC,aAAa,EAAE,IAAI,EAAC,CAAC,CAAC;YACtD,CAAC;YAAC,WAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,KAAK;gBACrB,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe;IAEf,MAAM,IAAI,GAAkC,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QAAC,WAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,MAAqC,EACrC,KAAoC;IAEpC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,YAAY,CAAC;QAChD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,YAAY,CAAC;QAC/C,OAAO,GAAG,CAAC,aAAa,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * The filesystem primitives, and the guard that proves localize kept its\n * promise.\n *\n * The link is written with `fs.symlink` and never by invoking npm. Two\n * separate reasons, both measured rather than assumed:\n *\n * - `npm install <path> --no-save` brings npm's peer resolution along, which\n *   hard-failed an app's boot on a missing peer dependency. Module resolution\n *   happens from the symlink's REAL path, whose ancestors have no\n *   `node_modules`, so the checkout needs its own installed tree.\n * - a `postinstall` hook that invokes an install at the consumer root recurses.\n */\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport {createHash} from 'node:crypto';\n\nexport function isSymlink(p: string): boolean {\n  try {\n    return fs.lstatSync(p).isSymbolicLink();\n  } catch {\n    return false;\n  }\n}\n\nexport function isGitCheckout(p: string): boolean {\n  return fs.existsSync(path.join(p, '.git'));\n}\n\n/** Is `child` at or below `parent`? Both must be absolute, real paths. */\nexport function isInside(child: string, parent: string): boolean {\n  const rel = path.relative(parent, child);\n  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n}\n\nexport function readJson(file: string): any {\n  try {\n    return JSON.parse(fs.readFileSync(file, 'utf8'));\n  } catch {\n    return null;\n  }\n}\n\n/** Where `node_modules/<name>` points, resolved, or null when it is not a link. */\nexport function linkTarget(appRoot: string, name: string): string | null {\n  const link = path.join(appRoot, 'node_modules', name);\n  if (!isSymlink(link)) return null;\n  try {\n    return fs.realpathSync(link);\n  } catch {\n    // A dangling link is still linked intent; its target is simply gone.\n    return path.resolve(path.dirname(link), fs.readlinkSync(link));\n  }\n}\n\n/**\n * Write `node_modules/<name> -> <checkout>` and nothing else.\n *\n * The target is stored RELATIVE so the tree survives being moved or bind-mounted\n * into a container at a different path.\n */\nexport function writeLink(\n  appRoot: string,\n  name: string,\n  checkout: string,\n): string {\n  const link = path.join(appRoot, 'node_modules', name);\n  fs.mkdirSync(path.dirname(link), {recursive: true});\n  if (isSymlink(link)) fs.unlinkSync(link);\n  else if (fs.existsSync(link)) fs.rmSync(link, {recursive: true, force: true});\n  fs.symlinkSync(path.relative(path.dirname(link), checkout), link, 'dir');\n  return link;\n}\n\n/** Every symlink directly under node_modules whose target leaves node_modules. */\nexport function scanLinks(appRoot: string): {name: string; target: string}[] {\n  const root = path.join(appRoot, 'node_modules');\n  const out: {name: string; target: string}[] = [];\n  let top;\n  try {\n    top = fs.readdirSync(root, {withFileTypes: true});\n  } catch {\n    return out;\n  }\n  const collect = (name, full) => {\n    if (!isSymlink(full)) return;\n    let target;\n    try {\n      target = fs.realpathSync(full);\n    } catch {\n      return;\n    }\n    if (isInside(target, root)) return; // an ordinary hoisting link, not a checkout\n    out.push({name, target});\n  };\n  for (const item of top) {\n    if (item.name === '.bin' || item.name.startsWith('.')) continue;\n    const full = path.join(root, item.name);\n    if (item.name.startsWith('@')) {\n      let inner;\n      try {\n        inner = fs.readdirSync(full, {withFileTypes: true});\n      } catch {\n        continue;\n      }\n      for (const sub of inner)\n        collect(`${item.name}/${sub.name}`, path.join(full, sub.name));\n    } else {\n      collect(item.name, full);\n    }\n  }\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// the post-condition\n// ---------------------------------------------------------------------------\n\n/** The files no localize command may ever touch. */\nexport const MANIFEST_FILES = ['package.json', 'package-lock.json'];\n\n/**\n * Hash the consumer's manifests.\n *\n * Content hashes, NOT `git status`. `git status` compares against HEAD, so in\n * any tree with an uncommitted `package.json` it reports a modification the\n * command did not make -- an earlier version of this tool shipped that bug and\n * reported correct runs as failures. Hashes also work in a tree with no git,\n * and catch an edit that HEAD happens to agree with.\n *\n * `latin1` is a byte-exact round-trip for arbitrary bytes; `utf8` is not.\n */\nexport function snapshotManifests(\n  appRoot: string,\n): Record<string, string | null> {\n  const snap: Record<string, string | null> = {};\n  for (const file of MANIFEST_FILES) {\n    try {\n      const bytes = fs.readFileSync(path.join(appRoot, file), 'latin1');\n      snap[file] = createHash('sha256').update(bytes, 'latin1').digest('hex');\n    } catch {\n      snap[file] = null;\n    }\n  }\n  return snap;\n}\n\n/** @returns {string[]} a human description of each manifest that changed. */\nexport function diffManifests(\n  before: Record<string, string | null>,\n  after: Record<string, string | null>,\n): string[] {\n  return MANIFEST_FILES.filter((f) => before[f] !== after[f]).map((f) => {\n    if (before[f] === null) return `${f} (created)`;\n    if (after[f] === null) return `${f} (deleted)`;\n    return `${f} (modified)`;\n  });\n}\n"]}

package/lib/esm/localize/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * localize's programmatic API: `linked localize` / `linked delocalize` (see
+ * `commands/localize.ts`, the commander adapter) and `create-package`'s adopt
+ * reach it through here.
+ *
+ * Every function takes `deps` -- `{appRoot, run, log, warn, error}` -- so a
+ * caller can point it at another root or capture its output. `defaultDeps()`
+ * builds the normal one.
+ */
+export { localize } from './localize.js';
+export { adopt } from './adopt.js';
+export { delocalize } from './delocalize.js';
+export { list, collect } from './list.js';
+export { relink } from './relink.js';
+export { pruneProvided, satisfies, shouldPrune } from './prune.js';
+export type { PruneOptions, PruneScope } from './prune.js';
+export { providedPackages } from './provided.js';
+export type { Provided, ProvidedSkip } from './provided.js';
+export { ensure, reinstall, checkOneCopy } from './ensure.js';
+export type { LocalizeOptions } from './localize.js';
+export type { ListRow } from './list.js';
+export type { Resolved } from './resolve.js';
+export type { Manifest, ManifestEntry } from './manifest.js';
+export type { Deps, Run, RunOptions, RunResult } from './run.js';
+export { resolvePackage, normalizeGitUrl, checkoutNameFor } from './resolve.js';
+export { readManifest, writeManifest, manifestPath, MANIFEST_FILENAME, SCHEMA_VERSION, DEFAULT_DIR, } from './manifest.js';
+export { defaultDeps, makeRun } from './run.js';
+export { LocalizeError, EXIT_BAD_FILE, EXIT_NOT_FOUND, EXIT_WARNED, EXIT_REFUSED, EXIT_INSTALL_FAILED, EXIT_MANIFEST_DIRTY, } from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/esm/localize/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/localize/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAC;AACvC,OAAO,EAAC,KAAK,EAAC,MAAM,YAAY,CAAC;AACjC,OAAO,EAAC,UAAU,EAAC,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAC,IAAI,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AACxC,OAAO,EAAC,MAAM,EAAC,MAAM,aAAa,CAAC;AACnC,OAAO,EAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAC,MAAM,YAAY,CAAC;AACjE,YAAY,EAAC,YAAY,EAAE,UAAU,EAAC,MAAM,YAAY,CAAC;AACzD,OAAO,EAAC,gBAAgB,EAAC,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAC,QAAQ,EAAE,YAAY,EAAC,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAC,MAAM,aAAa,CAAC;AAC5D,YAAY,EAAC,eAAe,EAAC,MAAM,eAAe,CAAC;AACnD,YAAY,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AACvC,YAAY,EAAC,QAAQ,EAAC,MAAM,cAAc,CAAC;AAC3C,YAAY,EAAC,QAAQ,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAC3D,YAAY,EAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAC,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAC,cAAc,EAAE,eAAe,EAAE,eAAe,EAAC,MAAM,cAAc,CAAC;AAC9E,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,WAAW,EAAE,OAAO,EAAC,MAAM,UAAU,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,aAAa,CAAC"}

package/lib/esm/localize/index.js

@@ -0,0 +1,22 @@
+/**
+ * localize's programmatic API: `linked localize` / `linked delocalize` (see
+ * `commands/localize.ts`, the commander adapter) and `create-package`'s adopt
+ * reach it through here.
+ *
+ * Every function takes `deps` -- `{appRoot, run, log, warn, error}` -- so a
+ * caller can point it at another root or capture its output. `defaultDeps()`
+ * builds the normal one.
+ */
+export { localize } from './localize.js';
+export { adopt } from './adopt.js';
+export { delocalize } from './delocalize.js';
+export { list, collect } from './list.js';
+export { relink } from './relink.js';
+export { pruneProvided, satisfies, shouldPrune } from './prune.js';
+export { providedPackages } from './provided.js';
+export { ensure, reinstall, checkOneCopy } from './ensure.js';
+export { resolvePackage, normalizeGitUrl, checkoutNameFor } from './resolve.js';
+export { readManifest, writeManifest, manifestPath, MANIFEST_FILENAME, SCHEMA_VERSION, DEFAULT_DIR, } from './manifest.js';
+export { defaultDeps, makeRun } from './run.js';
+export { LocalizeError, EXIT_BAD_FILE, EXIT_NOT_FOUND, EXIT_WARNED, EXIT_REFUSED, EXIT_INSTALL_FAILED, EXIT_MANIFEST_DIRTY, } from './errors.js';
+//# sourceMappingURL=index.js.map

package/lib/esm/localize/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/localize/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAC;AACvC,OAAO,EAAC,KAAK,EAAC,MAAM,YAAY,CAAC;AACjC,OAAO,EAAC,UAAU,EAAC,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAC,IAAI,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AACxC,OAAO,EAAC,MAAM,EAAC,MAAM,aAAa,CAAC;AACnC,OAAO,EAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAC,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAC,gBAAgB,EAAC,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAC,MAAM,aAAa,CAAC;AAM5D,OAAO,EAAC,cAAc,EAAE,eAAe,EAAE,eAAe,EAAC,MAAM,cAAc,CAAC;AAC9E,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,WAAW,EAAE,OAAO,EAAC,MAAM,UAAU,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,aAAa,CAAC","sourcesContent":["/**\n * localize's programmatic API: `linked localize` / `linked delocalize` (see\n * `commands/localize.ts`, the commander adapter) and `create-package`'s adopt\n * reach it through here.\n *\n * Every function takes `deps` -- `{appRoot, run, log, warn, error}` -- so a\n * caller can point it at another root or capture its output. `defaultDeps()`\n * builds the normal one.\n */\nexport {localize} from './localize.js';\nexport {adopt} from './adopt.js';\nexport {delocalize} from './delocalize.js';\nexport {list, collect} from './list.js';\nexport {relink} from './relink.js';\nexport {pruneProvided, satisfies, shouldPrune} from './prune.js';\nexport type {PruneOptions, PruneScope} from './prune.js';\nexport {providedPackages} from './provided.js';\nexport type {Provided, ProvidedSkip} from './provided.js';\nexport {ensure, reinstall, checkOneCopy} from './ensure.js';\nexport type {LocalizeOptions} from './localize.js';\nexport type {ListRow} from './list.js';\nexport type {Resolved} from './resolve.js';\nexport type {Manifest, ManifestEntry} from './manifest.js';\nexport type {Deps, Run, RunOptions, RunResult} from './run.js';\nexport {resolvePackage, normalizeGitUrl, checkoutNameFor} from './resolve.js';\nexport {\n  readManifest,\n  writeManifest,\n  manifestPath,\n  MANIFEST_FILENAME,\n  SCHEMA_VERSION,\n  DEFAULT_DIR,\n} from './manifest.js';\nexport {defaultDeps, makeRun} from './run.js';\nexport {\n  LocalizeError,\n  EXIT_BAD_FILE,\n  EXIT_NOT_FOUND,\n  EXIT_WARNED,\n  EXIT_REFUSED,\n  EXIT_INSTALL_FAILED,\n  EXIT_MANIFEST_DIRTY,\n} from './errors.js';\n"]}

package/lib/esm/localize/list.d.ts

@@ -0,0 +1,18 @@
+import type { Deps } from './run.js';
+/** One row of `--list`: a recorded package, or a link the manifest does not know. */
+export interface ListRow {
+    name: string;
+    state: 'linked' | 'checkout-missing' | 'not-linked' | 'malformed' | 'untracked' | 'unrecorded';
+    path: string;
+    branch: string;
+    note: string;
+}
+/** @returns {{rows: object[], notLinked: number}} */
+export declare function collect(deps: Deps): {
+    rows: ListRow[];
+    notLinked: number;
+};
+export declare function list(opts: {
+    check?: boolean;
+}, deps: Deps): number;
+//# sourceMappingURL=list.d.ts.map

package/lib/esm/localize/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/localize/list.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,UAAU,CAAC;AAEnC,qFAAqF;AACrF,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EACD,QAAQ,GACR,kBAAkB,GAClB,YAAY,GACZ,WAAW,GACX,WAAW,GACX,YAAY,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qDAAqD;AACrD,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG;IAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAwFxE;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,CA0ChE"}