@exodus/stasis 1.0.0-beta.2 → 1.0.0-beta.5

package/src/vfs-bundle/entries.js

@@ -0,0 +1,140 @@
+import { join, normalize, relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { readJson } from '@exodus/stasis-core/bundle-util'
+import { isAutoExcludedDir, isPlainObject, posixPathEscapes, relativeEscapes } from '@exodus/stasis-core/util'
+import { Vfs } from '@preventive/vfs'
+import { checkVfsOptions, fieldResolverFor } from '../cmd/bundle.js'
+import { foundrySourceDir } from '../loaders/foundry.js'
+import { resolveTypescriptFallback, typescriptExportsTarget } from '../resolve-typescript.js'
+import { checkKind, checkVersion, packageManagerOf, vfsHost } from './tree.js'
+
+const JS = /\.[cm]?[jt]s$/u
+// Node's own conditions for require() and for import, which the build's are added to.
+const NODE_CONDITIONS = [['require', 'node', 'node-addons', 'module-sync'], ['import', 'node', 'node-addons', 'module-sync']]
+
+// The entry points the package.json in `dir` names, as paths from `dir`, resolved as the JS build
+// with the given options resolves: as Node does, `conditions` added, or with `mainFields` or
+// `metro` through the build's field resolver, once per platform of `platforms` under `metro`; what
+// that misses mapped as tsc maps it under `typescript`, as the build's fallback maps it. In
+// that order: its own entry, as the build resolves `./` there (`main`, or the first of the main
+// fields, else index); each subpath `exports` holds (but a pattern), as the package's name resolves
+// for require() and for import, with the conditions the build adds (the RN ones under `metro`); and
+// each `bin`. Only JS files in `dir` that are there, named from within it; none without a package.json.
+function packageEntries(host, dir, { conditions = [], mainFields, metro = false, platforms = [], jsx = false, typescript = false } = {}) {
+  const real = host.realpath(dir)
+  const manifest = join(real, 'package.json')
+  const pkg = readJson(manifest, host)
+  if (!isPlainObject(pkg)) return []
+  const found = new Set()
+  const add = (file) => {
+    const rel = file === undefined ? '' : relative(real, file)
+    if (rel !== '' && !relativeEscapes(rel) && JS.test(rel)) found.add(rel)
+  }
+  const passes = metro || mainFields !== undefined
+    ? (metro ? platforms : [null]).map((platform) => fieldResolverFor(platform, { mainFields, metro, conditions, jsx, typescript, host }))
+    : [{ extras: conditions, mainFields: ['main'] }]
+  // Node's resolution of `specifier`, else under `typescript` the miss `mapped` as tsc maps it; a
+  // real path either way, or undefined.
+  const viaNode = (specifier, names, extras, mapped) => {
+    const set = new Set([...names, ...extras])
+    try {
+      return host.resolve(manifest, specifier, set)
+    } catch {
+      const hit = typescript ? mapped(set) : null
+      return hit === null ? undefined : host.realpath(hit)
+    }
+  }
+  for (const { extras, mainFields: fields, resolver } of passes) {
+    const entry = fields.map((name) => pkg[name]).find((value) => typeof value === 'string' && value !== '')
+    if (entry !== undefined && posixPathEscapes(entry)) continue
+    if (resolver === undefined) {
+      add(viaNode('./', NODE_CONDITIONS[0], extras, (set) => resolveTypescriptFallback(manifest, './', { conditions: set, tsx: jsx, host })))
+    } else {
+      // A real path, as Node's resolution gives and the scan takes.
+      const hit = resolver(manifest, './')
+      if (hit?.url !== undefined) add(host.realpath(fileURLToPath(hit.url)))
+    }
+  }
+  const { exports, name } = pkg
+  const keyed = isPlainObject(exports) && Object.keys(exports).some((key) => key.startsWith('.'))
+  const subpaths = keyed ? Object.keys(exports) : exports === undefined || exports === null ? [] : ['.']
+  for (const subpath of typeof name === 'string' ? subpaths : []) {
+    if (!subpath.startsWith('.') || subpath.includes('*') || subpath.endsWith('/')) continue
+    const specifier = subpath === '.' ? name : `${name}${subpath.slice(1)}`
+    for (const { extras } of passes) {
+      for (const names of NODE_CONDITIONS) add(viaNode(specifier, names, extras, (set) => typescriptExportsTarget(real, exports, subpath, { conditions: set, tsx: jsx, host })))
+    }
+  }
+  const bins = typeof pkg.bin === 'string' ? [pkg.bin] : pkg.bin !== null && typeof pkg.bin === 'object' ? Object.values(pkg.bin) : []
+  for (const bin of bins) {
+    if (typeof bin === 'string' && !posixPathEscapes(bin) && host.stat(join(real, bin))?.isFile()) add(host.realpath(join(real, bin)))
+  }
+  return [...found]
+}
+
+// Directories whose .sol files are none of a project's entry points: its tests, scripts and mocks,
+// what it depends on or builds, and what no walk descends into.
+const SKIPPED_DIRS = new Set(['test', 'tests', 'script', 'scripts', 'mock', 'mocks', 'lib', 'node_modules', 'dependencies', 'out', 'cache', 'artifacts', 'build'])
+const isSkippedDir = (name) => SKIPPED_DIRS.has(name.toLowerCase()) || isAutoExcludedDir(name)
+// A .sol file but a test or script by its name.
+const isEntrySol = (entry) => entry.isFile() && entry.name.endsWith('.sol') && !/\.(?:t|s|test|spec)\.sol$/u.test(entry.name)
+
+// The .sol files under the directory `rel` of `real` that are entry points by name, but those in a
+// skipped directory; sorted. Links are not followed.
+function solidityFiles(host, real, rel) {
+  const out = []
+  const walk = (sub) => {
+    for (const entry of host.readdir(join(real, sub))) {
+      const path = sub === '.' ? entry.name : `${sub}/${entry.name}`
+      if (entry.isDirectory()) {
+        if (!isSkippedDir(entry.name)) walk(path)
+      } else if (isEntrySol(entry)) {
+        out.push(path)
+      }
+    }
+  }
+  walk(rel)
+  return out.toSorted()
+}
+
+// The entry points of the Soldeer project in `dir`, by name and layout, as paths from `dir`: its
+// .sol files directly in it, then those under contracts/, then those under its source directory
+// (its foundry.toml's default profile's `src`, else `src`); none of its tests, scripts or mocks,
+// nor any in what it depends on or builds. A link to a directory is none.
+function solidityEntries(host, dir) {
+  const real = host.realpath(dir)
+  const isDirectory = (rel) => !posixPathEscapes(rel) && host.stat(join(real, rel))?.isDirectory() && host.readlink(join(real, rel)) === null
+  const under = (rel) => (isDirectory(rel) ? solidityFiles(host, real, rel) : [])
+  const src = normalize(foundrySourceDir(real, { host })).replace(/\/+$/u, '')
+  const own = host.readdir(real).filter(isEntrySol).map((entry) => entry.name).toSorted()
+  return [...new Set([...own, ...under('contracts'), ...(src === 'contracts' ? [] : under(src))])]
+}
+
+// By the kind of bundle a package manager builds: an entry its options are checked over before
+// there are any, the entries the build takes where none are given, and what having none says.
+export const KINDS = {
+  js: { standIn: 'index.js', entries: packageEntries, none: 'has no package.json naming a JS entry point there' },
+  sol: { standIn: 'index.sol', entries: solidityEntries, none: 'has no .sol entry point directly in it, under contracts/, or under its source directory' },
+}
+
+const EMPTY = vfsHost(new Vfs())
+
+// The build's checks of `options` before anything is fetched, over an empty tree, which never
+// decides them: for the package manager given, else for any; over the entries given, else over one
+// of the kind the default ones are. -> the PACKAGE_MANAGERS entry of the one given
+export function checkAhead(name, packageManager, options) {
+  checkVersion(name, { packageManager, ...options })
+  const pm = packageManager === undefined ? undefined : packageManagerOf(name, packageManager)
+  const refusal = (entries) => {
+    try {
+      checkKind(name, checkVfsOptions(name, { ...options, entries, cwd: '/', host: EMPTY, fetched: false }), packageManager === undefined ? undefined : [packageManager])
+      return null
+    } catch (error) {
+      return error
+    }
+  }
+  const refusals = options.entries === undefined ? (pm === undefined ? Object.values(KINDS) : [KINDS[pm.kind]]).map(({ standIn }) => refusal([standIn])) : [refusal(options.entries)]
+  if (!refusals.includes(null)) throw refusals[0]
+  return pm
+}

package/src/vfs-bundle/github.js

@@ -0,0 +1,193 @@
+import { posix } from 'node:path'
+
+import { isValidRepoField } from '@exodus/stasis-core/bundle'
+import { posixPathEscapes } from '@exodus/stasis-core/util'
+import { decompress } from '@preventive/archive/compression.js'
+import { ArchiveError, unpack } from '@preventive/archive/tar.js'
+import { createClient } from '@preventive/upstream/github.js'
+import { vfsFromEntries } from '@preventive/vfs'
+import { buildVfsBundle } from '../cmd/bundle.js'
+import { KINDS, checkAhead } from './entries.js'
+import { checkTarget, detectPackageManager, installedAlone, lockfileOf, lockfileRoot, lockfilesListed, noLockfile, packageManagerOf, vfsHost } from './tree.js'
+
+// As upstream's tree verification bounds a tarball's unpacked size.
+const MAX_TAR_BYTES = 2 ** 30
+// What a git tree holds (upstream's verification refuses anything else from GitHub).
+const TREE_TYPES = new Set(['file', 'directory', 'symlink'])
+// Lockfile references to a path above the lockfile's directory (conservatively: any importer's):
+// pnpm's and yarn's specs, and package-lock.json's package keys and `resolved` paths, `..` itself
+// (`link:..`, npm's `".."`) or under it.
+const LOCKFILE_ESCAPE = /(?:link:|file:|directory: |["'])\.\.(?![^/"'\s])/u
+const TSCONFIG = /(?:^|\/)[jt]sconfig[^/]*\.json$/u
+
+// Whether `target`, a path relative to the file `from`, resolves outside the tree.
+const resolvesOutside = (from, target) => target.startsWith('/') || posixPathEscapes(posix.join(posix.dirname(from), target))
+
+// The mode a checkout gives an entry under the usual umask 022. Git keeps only a file's executable
+// bit (upstream verifies that much), and GitHub's tarballs are written with git archive's tar.umask
+// 0002, which makes them 664 and 775 besides.
+const checkoutMode = ({ type, mode }) => (type === 'symlink' ? mode : type === 'directory' || mode & 0o100 ? 0o755 : 0o644)
+
+// A GitHub tarball's entries, its one top directory dropped, with the modes a checkout has.
+async function treeEntries(tarball, where) {
+  const entries = []
+  for (const entry of unpack(await decompress(tarball, 'gzip', { limit: MAX_TAR_BYTES }))) {
+    const name = entry.name.slice(entry.name.indexOf('/') + 1)
+    if (!TREE_TYPES.has(entry.type)) throw new Error(`${where}: unexpected ${entry.type} ${JSON.stringify(name)} in the tarball`)
+    if (entry.name.includes('/')) entries.push({ ...entry, name, mode: checkoutMode(entry) })
+  }
+  return entries
+}
+
+// The first symlink pointing outside the tree, which would otherwise resolve within it.
+const escapingLink = (entries) => entries.find((entry) => entry.type === 'symlink' && resolvesOutside(entry.name, entry.linkname))
+
+// Whether a subtree's files refer to a path above it: a lockfile link or a [jt]sconfig path.
+function refersAbove(entries, lockfile) {
+  const text = (entry) => new TextDecoder().decode(entry.data)
+  return entries.some((entry) => entry.type === 'file' && (entry.name === lockfile
+    ? LOCKFILE_ESCAPE.test(text(entry))
+    : TSCONFIG.test(entry.name) && [...text(entry).matchAll(/"(\.\.?\/[^"]*)"/gu)].some(([, path]) => resolvesOutside(entry.name, path))))
+}
+
+// The directories above `directory`, the repo's root (undefined) last.
+function ancestorsOf(directory) {
+  const out = []
+  for (let dir = posix.dirname(directory); dir !== '.'; dir = posix.dirname(dir)) out.push(dir)
+  return [...out, undefined]
+}
+
+// The files of the subtree `tree`, or null where one is a symlink out of it.
+async function treeFiles(client, { github, tree, where }) {
+  let files
+  try {
+    files = await treeEntries(await client.getRepoTreeTarball({ repo: github, tree }), where)
+  } catch (error) {
+    if (error instanceof ArchiveError) return null // e.g. a symlink out of the subtree
+    throw error
+  }
+  return escapingLink(files) ? null : files
+}
+
+// The whole repo's files at `sha`.
+async function repoFiles(client, { github, sha, where }) {
+  const files = await treeEntries(await client.getRepoTarball({ repo: github, sha }), where)
+  const link = escapingLink(files)
+  if (link) throw new Error(`${where}: symlink ${JSON.stringify(link.name)} points outside the repo`)
+  return files
+}
+
+// Checked as the Bundle checks them, before anything is fetched; a tag's name is upstream's to check.
+function checkRepo(name, { github, sha, tag, directory }) {
+  if (github === undefined) throw new Error(`${name}: github is required`)
+  if (tag !== undefined && (typeof tag !== 'string' || tag === '')) throw new TypeError(`${name}: tag must be a non-empty string`)
+  if (sha !== undefined && tag !== undefined) throw new Error(`${name}: sha and tag both name the commit: give one`)
+  for (const [key, value] of Object.entries({ github, commit: sha, directory: directory || undefined })) {
+    if (value !== undefined && !isValidRepoField(key, value)) throw new Error(`${name}: invalid ${key}: ${JSON.stringify(value)}`)
+  }
+}
+
+// listRepoDir's listing of a directory of the repo at `sha`, each listed once.
+function lister(client, { github, sha }) {
+  const listings = new Map()
+  return (directory) => {
+    if (!listings.has(directory)) listings.set(directory, client.listRepoDir({ repo: github, sha, directory }))
+    return listings.get(directory)
+  }
+}
+
+// Of no package manager given, the one whose lockfile alone `directory` (or the repo's root) and
+// the directories above it list, which is then the only one that may install it; refused where
+// none does; undefined where more than one does, or the listings can't tell, for the tree to tell.
+async function listedPackageManager(list, { directory, where }) {
+  let listings
+  try {
+    listings = await Promise.all((directory ? [directory, ...ancestorsOf(directory)] : [undefined]).map(list))
+  } catch {
+    // No plain directory in git (a symlink, or under one); the root's failure is GitHub's.
+    await list(undefined)
+    return undefined
+  }
+  const listed = lockfilesListed(listings)
+  if (listed.length === 0) throw noLockfile(where, posix.resolve('/', directory || '.'))
+  return listed.length === 1 ? listed[0] : undefined
+}
+
+// The files of `directory` alone, when it holds the lockfile, is installed from itself and stands
+// alone; else null.
+async function subtreeEntries(client, list, { github, directory, packageManager, where }) {
+  const names = async (path) => (await list(path)).map((entry) => entry.path)
+  let listing
+  try {
+    listing = await list(directory)
+  } catch {
+    return null // no plain directory in git (a symlink, or under one): the whole repo resolves it
+  }
+  if (!lockfilesListed([listing]).includes(packageManager)) return null
+  const above = ancestorsOf(directory)
+  // Installed from a root above it (a workspace's), it is built from there.
+  if (!(await installedAlone(packageManager, listing.map((entry) => entry.path), () => Promise.all(above.map(names))))) return null
+  // Its tree id, as the listing above it holds it, held to that directory's own.
+  const tree = (await list(above[0])).find((entry) => entry.path === posix.basename(directory) && entry.type === 'tree')?.sha
+  const files = tree === undefined ? null : await treeFiles(client, { github, tree, where })
+  return files === null || refersAbove(files, lockfileOf(packageManager)) ? null : files
+}
+
+// The repo as buildGitHubBundle downloads it, for `name`: at `sha`, else the commit `tag` names (an
+// annotated tag followed to it), else the default branch's head; `directory` alone where it stands
+// alone for the package manager installing it, else the whole repo. That package manager is
+// `packageManager` if given, else the one the listings tell, before the tree is fetched, else the
+// tree; `options` are checked for it once it is known.
+// -> { vfs, host, cwd, subtree, sha, where, packageManager, kind }
+async function repoTree(name, { github, sha, tag, directory, client, packageManager }, options) {
+  checkAhead(name, packageManager, options)
+  checkRepo(name, { github, sha, tag, directory })
+  client ??= createClient({ token: null })
+  sha ??= tag === undefined ? (await client.getRepoHead({ repo: github })).oid : (await client.getRepoTag({ repo: github, tag })).oid
+  const where = `${name}: ${github}@${sha}`
+  const list = lister(client, { github, sha })
+  let found = packageManager
+  if (found === undefined) {
+    found = await listedPackageManager(list, { directory, where })
+    if (found !== undefined) checkAhead(name, found, options)
+  }
+  const subtree = directory && found !== undefined ? await subtreeEntries(client, list, { github, directory, packageManager: found, where }) : null
+  const vfs = vfsFromEntries(subtree ?? await repoFiles(client, { github, sha, where }))
+  const host = vfsHost(vfs)
+  const cwd = posix.resolve('/', subtree ? '.' : directory ?? '.')
+  if (packageManager === undefined) {
+    const detected = detectPackageManager(where, host, cwd, { os: options.os })
+    if (detected !== found) checkAhead(name, detected, options)
+    found = detected
+  }
+  return { vfs, host, cwd, subtree, sha, where, packageManager: found, kind: KINDS[packageManagerOf(name, found).kind] }
+}
+
+// A GitHub repo at a full commit, or the one `tag` names, the default branch's head without either,
+// as buildVfsBundle builds it: `directory` downloaded alone where it stands alone, else the whole
+// repo, and without a `packageManager`, the one whose lockfile installs it, where only one's does
+// (repoTree). Without `entries`, they are the ones suggestedEntries suggests. `repo` names the
+// commit and where the lockfile is, which the bundle's paths are relative to. Nothing is read from
+// disk: the tree's bytes come from GitHub, or from the cache setCacheDir names, held to the git tree
+// id either way (@preventive/upstream), and are unpacked into a Vfs that buildVfsBundle reads alone.
+export async function buildGitHubBundle({ github, sha, tag, directory, client, packageManager, ...options } = {}) {
+  checkTarget('buildGitHubBundle', options)
+  const tree = await repoTree('buildGitHubBundle', { github, sha, tag, directory, client, packageManager }, options)
+  const root = lockfileRoot(tree.host, tree.packageManager, tree.cwd, options.os)
+  const at = tree.subtree ? posix.join(directory, (root ?? '/').slice(1)) : (root ?? '/').slice(1)
+  const location = at === '' ? { root: true } : isValidRepoField('directory', at) ? { directory: at } : {}
+  let { entries } = options
+  if (entries === undefined) {
+    // As suggestedEntries suggests them, from the tree at hand.
+    entries = tree.kind.entries(tree.host, tree.cwd, options)
+    if (entries.length === 0) throw new Error(`${tree.where}: no entries given, and ${directory || 'the repo root'} ${tree.kind.none}`)
+  }
+  return buildVfsBundle({ ...options, entries, packageManager: tree.packageManager, vfs: tree.vfs, cwd: tree.cwd, repo: { github, commit: tree.sha, ...location } })
+}
+
+// suggestedEntries of a GitHub repo, `{ github, sha, tag, directory, client, packageManager }`, as
+// buildGitHubBundle downloads it.
+export async function suggestedRepoEntries(repo, resolution) {
+  const tree = await repoTree('suggestedEntries', repo, resolution)
+  return tree.kind.entries(tree.host, tree.cwd, resolution)
+}

package/src/vfs-bundle/soldeer.js

@@ -0,0 +1,125 @@
+import { join } from 'node:path'
+
+import { isTomlTable, readToml } from '../loaders/toml.js'
+
+// What `soldeer install` (0.12.0) writes beside the dependencies folder after installing it
+// (soldeer-core's update_config_libs and edit_remappings with RemappingsAction::Update): the
+// remappings.txt it would write is written into the tree, which then serves it in place of the
+// project's; a foundry.toml it would edit is refused, as is what this can't tell it would leave as
+// it is. `view` is the project's root by paths from `/`, `root` its real path, for messages.
+
+const SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[\dA-Za-z-]+(?:\.[\dA-Za-z-]+)*)?(?:\+[\dA-Za-z-]+(?:\.[\dA-Za-z-]+)*)?$/u
+// A requirement Soldeer takes as exact: a bare version (its `^` made `=`), or one written `=`.
+const EXACT = /^=?\s*(\S+)$/u
+const withoutBuild = (version) => version.replace(/\+.*$/u, '')
+
+// A file's text as Soldeer reads it (a byte order mark kept), or undefined.
+function textOf(view, path) {
+  try {
+    return view.stat(path).type === 'file' ? view.readFile(path).toString('utf8') : undefined
+  } catch {
+    return undefined
+  }
+}
+
+// Rust's `Path::components` of a remapping's target, `.` kept only at the start.
+function components(path) {
+  const out = path.startsWith('/') ? ['/'] : []
+  for (const [i, part] of path.split('/').entries()) {
+    if (part !== '' && (part !== '.' || i === 0)) out.push(part)
+  }
+  return out
+}
+
+// Whether the folder `name` of a remapping's target (its dependencies folder and the one in it) is
+// `dep`'s, as soldeer's path_matches tells, or null where only Rust's semver could tell.
+function folderMatches(dep, name) {
+  if (!name.startsWith(`${dep.name}-`)) return false
+  const version = name.slice(dep.name.length + 1)
+  if (version === dep.version) return true
+  if (!SEMVER.test(version)) return version === dep.req
+  const exact = EXACT.exec(dep.req.trim())?.[1]
+  if (exact !== undefined && SEMVER.test(exact)) return withoutBuild(exact) === withoutBuild(version)
+  return null
+}
+
+// The remappings Soldeer's update leaves, of `existing` (`[name, target]` pairs) and the config's
+// dependencies, sorted as it sorts them (by their UTF-8 bytes).
+function updatedRemappings(existing, deps, { regenerate, where }) {
+  const items = deps.map((dep) => ({ dep, line: `${dep.remapped}=dependencies/${dep.folder}/` }))
+  let lines
+  if (regenerate || existing.length === 0) {
+    lines = items.map(({ line }) => line)
+  } else {
+    lines = []
+    let rest = existing
+    for (const { dep, line } of items) {
+      let found = false
+      rest = rest.filter(([name, target]) => {
+        const path = components(target).slice(0, 2)
+        const folder = path.at(-1)
+        const matches = folder === undefined || ['/', '.', '..'].includes(folder) ? false : folderMatches(dep, folder)
+        if (matches === null) throw new Error(`${where}: "${name}=${target}" names ${folder}, which \`soldeer install\` may rewrite to dependencies/${dep.folder}`)
+        if (!matches) return true
+        lines.push(`${name}=${target.replaceAll(path.join('/').replace(/^\/\//u, '/'), `dependencies/${dep.folder}`)}`)
+        found = true
+        return false
+      })
+      if (!found) lines.push(line)
+    }
+    lines.push(...rest.map(([name, target]) => `${name}=${target}`))
+  }
+  return lines.toSorted((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)))
+}
+
+// `[name, target]` of each remapping in `lines`, as Soldeer reads them: split at the first `=`, any
+// line without one passed over.
+const pairs = (lines) => lines.flatMap((line) => {
+  const at = line.indexOf('=')
+  return at === -1 ? [] : [[line.slice(0, at), line.slice(at + 1)]]
+})
+
+export function settleSoldeer(view, vfs, root) {
+  const foundryText = textOf(view, '/foundry.toml')
+  const foundry = foundryText === undefined ? undefined : readToml(foundryText)
+  const configFile = isTomlTable(foundry?.dependencies) ? 'foundry.toml' : 'soldeer.toml'
+  const config = configFile === 'foundry.toml' ? foundry : readToml(textOf(view, '/soldeer.toml') ?? '')
+  const where = (file) => join(root, file)
+
+  if (configFile === 'foundry.toml') {
+    const libs = foundry.profile?.default?.libs
+    if (!Array.isArray(libs) || !libs.includes('dependencies')) {
+      throw new Error(`${where('foundry.toml')}: [profile.default] libs holds no "dependencies", which \`soldeer install\` adds`)
+    }
+  }
+
+  const settings = { remappings_generate: true, remappings_regenerate: false, remappings_version: true, remappings_prefix: '', remappings_location: 'txt', ...config.soldeer }
+  if (!settings.remappings_generate) return
+  const locked = new Map(readToml(textOf(view, '/soldeer.lock') ?? '').dependencies?.map((entry) => [entry.name, entry.version]) ?? [])
+  const deps = Object.entries(config.dependencies ?? {}).map(([name, value]) => {
+    const req = typeof value === 'string' ? value : value.version
+    const version = locked.get(name)
+    const remapped = `${settings.remappings_prefix}${name}${settings.remappings_version ? `-${req.replaceAll('=', '')}` : ''}/`
+    return { name, req, version, folder: `${name}-${version}`, remapped }
+  })
+
+  const remappingsTxt = textOf(view, '/remappings.txt')
+  if (configFile === 'foundry.toml' && settings.remappings_location === 'config') {
+    if (remappingsTxt !== undefined) throw new Error(`${where('remappings.txt')}: \`soldeer install\` removes it, as remappings_location is "config"`)
+    for (const [name, profile] of Object.entries(isTomlTable(foundry.profile) ? foundry.profile : {})) {
+      const current = Array.isArray(profile?.remappings) ? profile.remappings : undefined
+      if (current === undefined && name !== 'default') continue
+      const updated = updatedRemappings(pairs((current ?? []).filter((r) => typeof r === 'string')), deps, { regenerate: settings.remappings_regenerate, where: where('foundry.toml') })
+      if (current === undefined || updated.length !== current.length || updated.some((r, i) => r !== current[i])) {
+        throw new Error(`${where('foundry.toml')}: [profile.${name}] remappings are not as \`soldeer install\` leaves them`)
+      }
+    }
+    return
+  }
+
+  const lines = (settings.remappings_regenerate ? '' : remappingsTxt ?? '').split('\n')
+  if (lines.at(-1) === '') lines.pop()
+  const existing = pairs(lines.map((line) => line.replace(/\r$/u, '')))
+  const text = updatedRemappings(existing, deps, { regenerate: settings.remappings_regenerate, where: where('remappings.txt') }).map((line) => `${line}\n`).join('')
+  if (text !== remappingsTxt) vfs.writeFile('/remappings.txt', text, { mode: remappingsTxt === undefined ? 0o644 : view.lstat('/remappings.txt').mode })
+}