@exodus/stasis 1.0.0-beta.5 → 1.0.0-beta.7

package/README.md

@@ -59,7 +59,7 @@ _Lockfiles (npm/pnpm/etc) not mentioned: they are like the "tarball" column, but
 | `stasis run --lock=add --child-process app.js` | also attest modules loaded in forked child processes (e.g. Metro transform workers) |
 | `stasis run --bundle=add --fs=sync app.js` | build a bundle that also captures sync `fs.readFileSync`/`readdirSync` reads |
 | `stasis run --lock=add --import=./instrument.mjs app.js` | forward extra preload modules (repeatable) to the node process running the entry: a preload's own module graph is runner infrastructure like stasis's loader itself — evaluated, but not captured. Modules the app graph *also* reaches (or that execute through a preload-transplanted `require()` pipeline) are still attested like any other app code, so frozen replays and `--bundle=load` stay fail-closed |
-| `stasis bundle src/index.js` | build a bundle statically, without executing it |
+| `stasis bundle src/index.js` | build a bundle statically, without executing it, into the `stasis.code.br` of the project root its paths are relative to (from a workspace package, the workspace root), where `stasis run --bundle=load` finds it |
 | `stasis bundle --add src/worker.js` | merge more entries (and their import graph) into an existing `stasis.code.br` instead of replacing it |
 | `stasis add a.js icon.svg` | add the listed files to the project's bundles (config-driven), with no dependency resolution |
 | `stasis add src assets` | same, expanding each directory to every file under it, minus an auto-excluded set unless explicitly named |
@@ -68,21 +68,22 @@ _Lockfiles (npm/pnpm/etc) not mentioned: they are like the "tarball" column, but
 | `stasis bundle --metro --platforms=ios,android app.js` | statically bundle the way Metro resolves: RN conditions + mainFields + `.ios`/`.android`/`.native` suffixes, all platforms at once, plus each bundled native dependency's `ios/`/`android/` sources + podspec |
 | `stasis bundle --metro --metro-resolver --platforms=ios,android app.js` | same, but resolve through the project's own `metro-resolver` (byte-for-byte Metro fidelity) instead of the built-in approximation; requires `metro-resolver` installed (it ships with `react-native`/`metro`) |
 | `stasis bundle --flow app.js` | statically bundle Flow-typed sources: when oxc can't parse a `.js`/`.cjs`/`.mjs` file, strip its Flow syntax and retry so the import graph resolves (needs the optional `flow-remove-types` dependency; the stored source stays the original bytes). Combines with `--jsx`/`--conditions`/`--mainFields`/`--metro` |
-| `stasis bundle --typescript src/index.ts` | statically bundle TS sources that import by output name, the way tsc resolves: a `./x.js` (or `.mjs`/`.cjs`) specifier with no such file on disk lands on its on-disk `./x.ts` (`.mts`/`.cts`) source, and an extensionless `./x` probes `./x.ts` and `./x/index.ts`; the same substitution applies to package `main`/`exports`/`imports` targets and bare subpaths, and an existing `.js` always wins over its `.ts` twin. Combines with `--jsx` (also maps to `.tsx`)/`--conditions`/`--mainFields`/`--metro` (not `--metro-resolver`, which can't substitute) |
-| `stasis bundle --typescript --tsconfig=tsconfig.build.json src/index.ts` | same, honoring tsconfig `compilerOptions.paths` aliases (e.g. `"@/*": ["./src/*"]`, resolved against `baseUrl`, `extends` followed) for bare specifiers nothing else resolves; without `--tsconfig`, the project root's tsconfig.json applies when present |
-| `stasis github-bundle --github=owner/name [--sha=<commit>] [--tag=<name>] [--directory=path] [--package-manager=pnpm] [src/index.js]` | statically bundle a GitHub repo at a commit, or the one `--tag` names (the default branch's head without either), as `stasis bundle` bundles a clone of it once installed: the tree is fetched (with `GITHUB_TOKEN` where set) and held to its git tree id, and the dependencies are laid out in memory from the lockfile alone (`pnpm`, `yarn1`, `npm`, or `soldeer` for `.sol` entries; without `--package-manager`, the one whose lockfile installs the directory, where only one's does), with nothing installed and no package script run; where no entries are given, they are the JS files the directory's `package.json` names (`main`, `exports`, `bin`), resolved as the build resolves (`--conditions`, `--mainFields`, `--metro --platforms`, `--typescript`), or for Soldeer its `.sol` files directly in it, under `contracts/`, and under its source directory (`foundry.toml`'s `src`, else `src/`), but tests, scripts, mocks and dependency or build directories; written to `owner-name.<commit's first 7>.stasis.code.br` by default, `owner-name.<directory, its / made ->.<commit's first 7>.stasis.code.br` with `--directory` (each character outside `[A-Za-z0-9._-]` made `_`, and a directory too deep to fit in 255 characters cut, with a hash of it); takes `stasis bundle`'s options for the entries and `--lockfile` (as a library: `buildGitHubBundle` in `@exodus/stasis/vfs-bundle`, and `suggestedEntries` for the entries it would take, of a GitHub repo or a Vfs) |
+| `stasis bundle --typescript src/index.ts` | statically bundle TS sources that import by output name, the way tsc resolves: a `./x.js` (or `.jsx`/`.mjs`/`.cjs`) specifier with no such file on disk lands on its on-disk `./x.ts` or `./x.tsx` (`.tsx`/`.mts`/`.cts`) source, and an extensionless `./x` probes `./x.ts`, `./x.tsx` and `./x/index.ts(x)`; the same substitution applies to package `main`/`exports`/`imports` targets and bare subpaths, and an existing `.js` always wins over its `.ts` twin. None of this applies from or into `node_modules`, by real path: an installed package is used as published, while a monorepo's workspace packages, linked in through `node_modules`, really live outside it and resolve like the project's own files. On without the flag when every entry is TypeScript and their relative imports of JS outputs (`./x.js`) are each only on disk as the TS source (`./x.ts`) -- tsc's convention; a project of Node-compatible `.ts` files importing `./x.ts` keeps Node's resolution. Otherwise an import that fails but would resolve under it names the file and `--typescript` in the error. Combines with `--jsx`/`--conditions`/`--mainFields`/`--metro` (not `--metro-resolver`, which can't substitute) |
+| `stasis bundle --typescript --tsconfig=tsconfig.build.json src/index.ts` | same, honoring tsconfig `compilerOptions.paths` aliases (e.g. `"@/*": ["./src/*"]`, resolved against `baseUrl`, `extends` followed) for bare specifiers nothing else resolves, an extensionless target completing as tsc's does (`.ts`, `.tsx`, then `.js`, `.jsx`, then the directory's `index`); without `--tsconfig`, the `tsconfig.json` beside the importing file's `package.json` applies when present: in a monorepo (a `pnpm-workspace.yaml` or `package.json` `workspaces` at or above the cwd) the nearest named `package.json` at or above the file, else the project's one (the nearest named `package.json` at or above the cwd); never for a file in `node_modules`, and no lookup walks through one |
+| `stasis github-bundle --github=owner/name [--sha=<commit>] [--tag=<name>] [--directory=path] [--package-manager=pnpm] [src/index.js]` | statically bundle a GitHub repo at a commit, or the one `--tag` names (the default branch's head without either), as `stasis bundle` bundles a clone of it once installed: the tree is fetched (with `GITHUB_TOKEN` where set) and held to its git tree id, and the dependencies are laid out in memory from the lockfile alone (`pnpm`, `yarn1`, `npm`, or `soldeer` for `.sol` entries, a Soldeer git dependency on GitHub fetched as the repo is; without `--package-manager`, the one whose lockfile installs the directory, where only one's does), with nothing installed and no package script run; where no entries are given, they are the JS files the directory's `package.json` names (`main`, `exports`, `bin`), resolved as the build resolves (`--conditions`, `--mainFields`, `--metro --platforms`, `--typescript`), or for Soldeer its `.sol` files directly in it, under `contracts/`, and under its source directory (`foundry.toml`'s `src`, else `src/`), but tests, scripts, mocks and dependency or build directories; its paths, and the directory its `repo` names, are the directory's, or for a JS bundle, the innermost package's at or above it that holds every file it bundles (the project root's, where one is outside it, such as a sibling workspace package or the root's `node_modules`); written to `owner-name.<commit's first 7>.stasis.code.br` by default, `owner-name.<directory, its / made ->.<commit's first 7>.stasis.code.br` with `--directory` (each character outside `[A-Za-z0-9._-]` made `_`, and a directory too deep to fit in 255 characters cut, with a hash of it); takes `stasis bundle`'s options for the entries and `--lockfile` (as a library: `buildGitHubBundle` in `@exodus/stasis/vfs-bundle`, and `suggestedEntries` for the entries it would take, of a GitHub repo or a Vfs) |
+| `stasis github-bundle --github=owner/name --generate=prisma packages/api/src/index.ts` | same, with the Prisma Client each project's `prisma generate` would write first: for each project the lockfile installs with a `prisma-client` generator in its schema (the one its Prisma config names as a string literal or `path.join` of them, else `schema.prisma` or `prisma/schema.prisma`), as the Prisma it installs (7.4.0 to 7.10.0: its `prisma`, or beside Prisma 8, the one its `@prisma/prisma7` runs) writes it, byte for byte, where the generator's `output` says, the bundle then carrying it as a source like any other. Nothing of the repo runs: the schema, the config's `schema` path, and the `tsconfig.json` and `package.json` the generator infers its module format and import extensions from are read as data, its installed `prisma` only for its version (and, for an edge runtime's client, the query compiler it ships). The client is generated by the optional `@prisma/client-generator-ts` 7.10.0 dependency and rewritten as the version installed writes it; a project it can't generate for is skipped with a warning |
 | `stasis build --output=out.js app.stasis.code.br [entry]` | rebuild a runnable JS bundle with esbuild, following the bundle's recorded import graph exactly (entry optional when the bundle has one) |
 | `stasis build --output=out.js stasis.lock.json [entry]` | same, reading + verifying sources from disk against the lockfile |
 | `stasis extract app.stasis.code.br` | unpack a bundle back to sources + a `stasis.lock.json` |
 | `stasis diff --stat a.lock.json b.stasis.code.br` | summarize module/file differences between two lockfiles/bundles |
 | `stasis prune` | trim `node_modules` to the lockfile, verifying the rest |
 | `stasis audit stasis.lock.json` | report npm advisories for a lockfile's dependencies |
-| `stasis audit app.stasis.code.br` | report advisories for a bundle's dependencies: npm packages by npm's advisories, vendored crates and Composer packages by OSV's, and Soldeer packages and GitHub repos (Foundry's `lib/`) by those their GitHub repository publishes, asked with `GITHUB_TOKEN` where it is set; a Composer dev version is listed as not audited |
+| `stasis audit app.stasis.code.br` | report advisories for a bundle's dependencies: npm packages by npm's advisories, crates vendored from a registry and Composer packages by OSV's, and Soldeer packages and GitHub repos (Foundry's `lib/`) by those their GitHub repository publishes, asked with `GITHUB_TOKEN` where it is set; a Composer dev version, and a crate vendored from git or with no `.cargo-checksum.json` (never sent to OSV), are listed as not audited |
 | `stasis audit --why app.stasis.code.br` | same, with the cross-module import paths that pull each flagged package in (`run: a -> b -> c`), prefixed by the consumer that imports each chain at the top level; a chain is skipped when its full tail is already listed as its own chain |
 | `stasis audit --why-deep app.stasis.code.br` | like `--why`, but keep those longer chains too (every path, shared tails collapsed to `a -> b -> ... -> d`) |
 | `stasis audit --why-full app.stasis.code.br` | like `--why`, but spell every chain out with no `...` collapse (combine with `--why-deep` for the complete raw listing) |
 | `stasis audit --reason=run app.stasis.code.br` | show only advisories related to one consumer (`run`); with `--why`, keep only that consumer's chains |
-| `GITHUB_TOKEN=... stasis audit --repo-advisories stasis.lock.json` | also ask each dependency's GitHub repository for the advisories its maintainers published there, which npm's database has only once GitHub reviews them; needs a GitHub token in `GITHUB_TOKEN`. Each package's repository is cached for a month in the user cache directory (`$XDG_CACHE_HOME/stasis`, `~/.cache/stasis`, `~/Library/Caches/stasis` on macOS, `%LOCALAPPDATA%\stasis\Cache` on Windows) |
+| `GITHUB_TOKEN=... stasis audit --repo-advisories stasis.lock.json` | also ask each dependency's GitHub repository for the advisories its maintainers published there, which npm's database has only once GitHub reviews them; needs a GitHub token in `GITHUB_TOKEN`. Each package's repository is the one its artifact records (its `package.json`'s, see `repo` in [file formats](https://github.com/ExodusOSS/stasis/blob/main/doc/file-formats.md)), else, for an npm package a bundle records none for but carries the `package.json` of (one built before the field), the one that names, else it is looked up in npm's registry, Packagist or crates.io and cached for a month in the user cache directory (`$XDG_CACHE_HOME/stasis`, `~/.cache/stasis`, `~/Library/Caches/stasis` on macOS, `%LOCALAPPDATA%\stasis\Cache` on Windows) |
 | `stasis sbom --format=spdx stasis.lock.json` | export an SPDX SBOM for a lockfile or bundle |
 | `stasis sbom --format=cyclonedx app.stasis.code.br` | export a CycloneDX SBOM for a lockfile or bundle |
 

package/bin/stasis.js

@@ -38,8 +38,8 @@ function usage(prefix = '') {
   remappings.txt, foundry.lock, soldeer.lock, .gitmodules and package.json of the project and its
   bundled dependencies, as written: RPC/Etherscan keys and URL credentials in them included)
  stasis bundle [--add] [--output=(path|-)] path/to/file.php ...
- stasis bundle [--scope=(node_modules|full)] [--conditions=cond1,cond2] [--mainFields=field1,field2] [--jsx] [--flow] [--typescript [--tsconfig=path/to/tsconfig.json]] [--resources=ext,ext] [--package-json] [--lockfile=path/to/stasis.lock.json] [--add] [--output=(path|-)] path/to/file.(js|ts) ...
- stasis bundle --metro [--metro-resolver] --platforms=ios,android [--platforms=web] [--jsx] [--flow] [--typescript [--tsconfig=path/to/tsconfig.json]] [--resources=ext,ext] [--package-json] [--lockfile=path/to/stasis.lock.json] [--add] [--output=(path|-)] path/to/file.(js|ts) ...
+ stasis bundle [--scope=(node_modules|full)] [--conditions=cond1,cond2] [--mainFields=field1,field2] [--jsx] [--flow] [--typescript [--tsconfig=path/to/tsconfig.json]] [--resources=ext,ext] [--package-json] [--lockfile=path/to/stasis.lock.json] [--add] [--output=(path|-)] path/to/file.(js|ts|jsx|tsx) ...
+ stasis bundle --metro [--metro-resolver] --platforms=ios,android [--platforms=web] [--jsx] [--flow] [--typescript [--tsconfig=path/to/tsconfig.json]] [--resources=ext,ext] [--package-json] [--lockfile=path/to/stasis.lock.json] [--add] [--output=(path|-)] path/to/file.(js|ts|jsx|tsx) ...
  stasis bundle [--add] [--output=(path|-)] path/to/file.(sh|bash) ...
  stasis bundle [--cargo] [--cargo-features=a,b,pkg/c] [--cargo-no-default-features] [--cargo-all-features] [--cargo-target=(triple|host)] [--cargo-manifests] [--add] [--output=(path|-)] path/to/file.rs ...
  (Rust: each crate's Cargo features are resolved from Cargo.toml/Cargo.lock like "cargo build" of the
@@ -52,17 +52,21 @@ function usage(prefix = '') {
   out too, otherwise it is all kept; --cargo-manifests also bundles each bundled package's Cargo.toml
   and build script (a vendored crate's .cargo-checksum.json too), the workspace Cargo.toml, Cargo.lock
   and cargo configs, as written: tokens and URL credentials in them included)
- (writes to stasis.code.br by default; --output=- streams to stdout; --add merges into an
+ (writes to stasis.code.br by default, a JS bundle's in the project root its paths are relative to,
+  where stasis run --bundle=load finds it; --output=- streams to stdout; --add merges into an
   existing bundle instead of replacing it (not with --output=-); --brotli-quality=0..11, default 9;
-  --jsx parses JSX in .js/.cjs/.mjs files, e.g. React Native source (put JSX-in-TS in a .tsx file);
+  --jsx parses JSX in .js/.cjs/.mjs files, e.g. React Native source (.jsx/.tsx files need no flag;
+   put JSX-in-TS in a .tsx file);
   --flow strips Flow types from .js/.cjs/.mjs sources oxc can't parse (needs the optional flow-remove-types dep);
   --typescript resolves TS the way tsc does: an import of ./x.js lands on ./x.ts when no .js is on disk
    (likewise .mjs/.cjs -> .mts/.cts, extensionless ./x -> ./x.ts, incl. exports/imports/main targets),
-   honouring tsconfig compilerOptions.paths aliases (from ./tsconfig.json, or --tsconfig=path);
-   not with --metro-resolver;
+   honouring tsconfig compilerOptions.paths aliases (from the tsconfig.json beside the importing
+   file's package.json -- its workspace package's in a monorepo, else the project's -- or --tsconfig=path);
+   never from or into node_modules (by real path, so linked workspace packages still are); not with --metro-resolver; implied when every entry is TS and each relative ./x.js-style import
+   in them exists only as its TS source (otherwise a failing import it would resolve names it);
   --resources carries reached assets (e.g. --resources=png,svg) as resources instead of failing to bundle them;
   --package-json auto-includes each bundled module's package.json, even ones the scan never reached)
- stasis github-bundle --github=owner/name [--sha=commit|--tag=name] [--directory=path] [--package-manager=(pnpm|yarn1|npm|soldeer)] [--package-manager-version=version] [--lockfile=path/to/stasis.lock.json] [--output=(path|-)] [stasis bundle's options for the entries] [path/in/repo/to/(file.(js|ts)|file.sol|dir) ...]
+ stasis github-bundle --github=owner/name [--sha=commit|--tag=name] [--directory=path] [--package-manager=(pnpm|yarn1|npm|soldeer)] [--package-manager-version=version] [--generate=prisma] [--lockfile=path/to/stasis.lock.json] [--output=(path|-)] [stasis bundle's options for the entries] [path/in/repo/to/(file.(js|ts|jsx|tsx)|file.sol|dir) ...]
  (bundles a GitHub repo at a commit, or the one --tag names, its default branch's head without
   either, as "stasis bundle" bundles a clone of it once installed: the tree is fetched (with
   GITHUB_TOKEN where set) and held to its git tree id, and the dependencies are laid out in memory
@@ -78,8 +82,14 @@ function usage(prefix = '') {
   main, exports and bin, resolved as the build resolves them (--conditions, --mainFields, --metro
   --platforms, --typescript), or for Soldeer its .sol files directly in it, under contracts/, and
   under its source directory (foundry.toml's src, else src/), but tests, scripts, mocks and
-  dependency or build directories; not with --metro-resolver, --cargo* or --add; writes to
-  owner-name.<commit's first 7>.stasis.code.br by default,
+  dependency or build directories; its paths, and the directory its repo names, are
+  --directory's, or of a JS bundle, the innermost package's at or above it holding every file it
+  bundles, the project root's where one is outside; not with --metro-resolver, --cargo* or --add;
+  --generate=prisma first writes, for each project with a "prisma-client" generator, the Prisma
+  Client its "prisma generate" would (Prisma 7.4.0 to 7.10.0), with the optional
+  @prisma/client-generator-ts 7.10.0 dependency: nothing of the repo runs, its schema and config
+  are read as data, and its prisma for its version alone;
+  writes to owner-name.<commit's first 7>.stasis.code.br by default,
   owner-name.<--directory, its / made ->.<commit's first 7>.stasis.code.br with --directory, each
   character outside [A-Za-z0-9._-] made _, and a directory too deep to fit in 255 characters cut,
   with a hash of it; --output=- streams to stdout)
@@ -105,8 +115,9 @@ function usage(prefix = '') {
   --reason=consumer shows only advisories related to that consumer, and with --why only its chains;
   --repo-advisories also asks each package's GitHub repository for the advisories its maintainers
   published there, before GitHub reviews them into the databases above; it needs a token in
-  GITHUB_TOKEN, and caches each package's repository for a month in the user cache dir, e.g.
-  ~/.cache/stasis)
+  GITHUB_TOKEN, and asks the repository each package's artifact records, else the one the
+  package.json a bundle carries of an npm package names, else looks one up and caches it for a
+  month in the user cache dir, e.g. ~/.cache/stasis)
  stasis sbom --format=(spdx|cyclonedx) [--output=(path|-)] path/to/(lockfile|bundle) ...
  (streams to stdout by default; --output=- is explicit stdout)
 `.trim())
@@ -289,11 +300,11 @@ if (command === '-v' || command === '--version') {
   if (dirError !== null) usage(`Error: ${dirError}`)
   const allSol = argv.every((f) => isSolidityEntry(f))
   const allPhp = argv.every((f) => f.endsWith('.php'))
-  const allJs = argv.every((f) => /\.(?:js|cjs|mjs|ts|cts|mts)$/u.test(f))
+  const allJs = argv.every((f) => /\.(?:js|cjs|mjs|ts|cts|mts|jsx|tsx)$/u.test(f))
   const allBash = argv.every((f) => /\.(?:sh|bash)$/u.test(f))
   const allRust = argv.every((f) => f.endsWith('.rs'))
   if (!allSol && !allPhp && !allJs && !allBash && !allRust) {
-    usage('Error: bundle entries must all be .sol, all be .php, all be .js/.cjs/.mjs/.ts/.cts/.mts, all be .sh/.bash, or all be .rs')
+    usage('Error: bundle entries must all be .sol, all be .php, all be .js/.cjs/.mjs/.ts/.cts/.mts/.jsx/.tsx, all be .sh/.bash, or all be .rs')
   }
   if (values.mapping && !allSol) usage('Error: --mapping is only valid for .sol bundles')
   // --manifests: carry the Solidity build's description files (foundry.toml, remappings.txt, ...).
@@ -350,8 +361,8 @@ if (command === '-v' || command === '--version') {
   // extensionless) lands on its on-disk TS source (./x.ts, .mts, .cts); an existing .js always wins.
   if (values.typescript && !allJs) usage('Error: --typescript is only valid for JS bundles')
   const typescript = Boolean(values.typescript)
-  // --tsconfig: the config whose compilerOptions.paths aliases --typescript honours (default:
-  // the project root's tsconfig.json when present). Meaningless without --typescript.
+  // --tsconfig: the config whose compilerOptions.paths aliases --typescript honours (default: the
+  // tsconfig.json beside each importing file's package.json). Meaningless without --typescript.
   if (values.tsconfig !== undefined && !typescript) usage('Error: --tsconfig is only valid with --typescript')
   // --mainFields: legacy package entry fields (e.g. react-native,browser,main) for the non-exports resolver.
   if (values.mainFields !== undefined && !allJs) usage('Error: --mainFields is only valid for JS bundles')
@@ -374,7 +385,7 @@ if (command === '-v' || command === '--version') {
   }
   if ((metro || platforms.length > 0) && !allJs) usage('Error: --metro is only valid for JS bundles')
   // --jsx: parse React Native's JSX-in-.js source in the static scanner (off by default; oxc,
-  // like tsc, only auto-enables JSX for .jsx/.tsx). Orthogonal to the resolver, so it pairs with
+  // like tsc, auto-enables JSX for .jsx/.tsx only). Orthogonal to the resolver, so it pairs with
   // plain/--mainFields/--metro alike -- JS-only, since no other entry language is scanned.
   const jsx = Boolean(values.jsx)
   if (jsx && !allJs) usage('Error: --jsx is only valid for JS bundles')
@@ -472,8 +483,9 @@ if (command === '-v' || command === '--version') {
     resources: { type: 'string' },
     'package-json': { type: 'boolean' },
     'brotli-quality': { type: 'string' },
+    generate: { type: 'string', multiple: true },
   }, {
-    valueFlags: ['--github', '--sha', '--tag', '--directory', '--package-manager', '--package-manager-version', '--mapping', '--output', '--scope', '--lockfile', '--conditions', '--mainFields', '--platforms', '--tsconfig', '--resources', '--brotli-quality', '-o'],
+    valueFlags: ['--github', '--sha', '--tag', '--directory', '--package-manager', '--package-manager-version', '--mapping', '--output', '--scope', '--lockfile', '--conditions', '--mainFields', '--platforms', '--tsconfig', '--resources', '--brotli-quality', '--generate', '-o'],
     onError: usage,
   })
   if (values.github === undefined) usage('Error: github-bundle requires --github=owner/name, the repo to bundle')
@@ -515,6 +527,7 @@ if (command === '-v' || command === '--version') {
     tsconfig: values.tsconfig,
     resources: list(values.resources),
     packageJSON: Boolean(values['package-json']),
+    generate: list(values.generate),
     brotliQuality,
   })
 } else if (command === 'add') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/stasis",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.7",
   "description": "File-level source bundles and lockfiles",
   "type": "module",
   "exports": {
@@ -68,6 +68,7 @@
     "src/vfs-bundle.js",
     "src/vfs-bundle/entries.js",
     "src/vfs-bundle/github.js",
+    "src/vfs-bundle/prisma.js",
     "src/vfs-bundle/soldeer.js",
     "src/vfs-bundle/tree.js",
     "src/webpack.js",
@@ -92,20 +93,24 @@
   "homepage": "https://github.com/PreventiveMeasures/stasis#readme",
   "dependencies": {
     "@exodus/bytes": "^1.16.0",
-    "@exodus/stasis-core": "1.0.0-beta.5",
-    "@exodus/stasis-plugins": "1.0.0-beta.5",
-    "@preventive/archive": "1.0.0-beta.3",
-    "@preventive/deptree": "1.0.0-alpha.6",
-    "@preventive/lockfile": "1.0.0-alpha.5",
-    "@preventive/upstream": "1.0.0-alpha.4",
-    "@preventive/vfs": "1.0.0-beta.3",
-    "oxc-parser": "^0.94.0"
+    "@exodus/stasis-core": "1.0.0-beta.7",
+    "@exodus/stasis-plugins": "1.0.0-beta.7",
+    "@preventive/archive": "1.0.0-beta.4",
+    "@preventive/deptree": "1.0.0-alpha.8",
+    "@preventive/lockfile": "1.0.0-alpha.7",
+    "@preventive/upstream": "1.0.0-alpha.10",
+    "@preventive/vfs": "1.0.0-beta.4",
+    "oxc-parser": "^0.152.0"
   },
   "peerDependencies": {
+    "@prisma/client-generator-ts": "7.10.0",
     "esbuild": "*",
     "flow-remove-types": "*"
   },
   "peerDependenciesMeta": {
+    "@prisma/client-generator-ts": {
+      "optional": true
+    },
     "esbuild": {
       "optional": true
     },

package/src/audit-corrections.js

@@ -48,10 +48,14 @@ function isCorrectedFile(name, version, rel) {
 // alongside bundled files, but no package code ships through one. So too for the
 // manifests the other ecosystems' bundles carry beside a dependency's code
 // (--cargo-manifests, --manifests): its Cargo.toml and the checksums cargo vendored
-// it with, its composer.json, a Solidity dependency's foundry.toml and remappings.
+// it with (a registry's copy, a git checkout's, or one whose source isn't known),
+// its composer.json, a Solidity dependency's foundry.toml and remappings.
+const CARGO_MANIFESTS = new Set(['Cargo.toml', 'Cargo.lock', '.cargo-checksum.json'])
 const MANIFESTS = {
   npm: new Set(['package.json']),
-  cargo: new Set(['Cargo.toml', 'Cargo.lock', '.cargo-checksum.json']),
+  cargo: CARGO_MANIFESTS,
+  'cargo-git': CARGO_MANIFESTS,
+  'cargo-unknown': CARGO_MANIFESTS,
   composer: new Set(['composer.json', 'composer.lock']),
   soldeer: new Set(['package.json', 'foundry.toml', 'remappings.txt', 'soldeer.toml']),
   github: new Set(['package.json', 'foundry.toml', 'remappings.txt', 'soldeer.toml']),

package/src/audit.js

@@ -1,19 +1,24 @@
-import { hasNodeModulesSegment, moduleFileKey } from '@exodus/stasis-core/util'
+import { packageRepo } from '@exodus/stasis-core/bundle-util'
+import { dependencyEcosystem, moduleFileKey, sameGithub } from '@exodus/stasis-core/util'
 import { advisories } from '@preventive/upstream/advisories.js'
 import { compareVersions, valid } from '@preventive/upstream/semver.js'
 import { isEvidenceFile } from './audit-corrections.js'
-import { parseFile } from './parse.js'
+import { parseFile, parseFileWithKind } from './parse.js'
 import { collectWhy, invertReason } from './why.js'
 
-// Where advisories() asks for each ecosystem's advisories: npm's registry; OSV for crates and
-// Composer packages; for Soldeer packages and GitHub repos (Foundry's lib/ submodules), the
-// advisories their GitHub repository publishes, a Soldeer package's as Soldeer names it.
+// Where advisories() asks for each ecosystem's advisories: npm's registry; OSV for crates (those
+// vendored from a registry, which OSV takes for crates.io's) and Composer packages; for Soldeer
+// packages and GitHub repos (Foundry's lib/ submodules), the advisories their GitHub repository
+// publishes, a Soldeer package's as Soldeer names it.
 const SOURCES = { npm: ['npm'], cargo: ['OSV'], composer: ['OSV'], soldeer: ['Soldeer', 'GitHub'], github: ['GitHub'] }
 
-// A bundle's dependency's ecosystem: its bucket's `ecosystem` tag, or npm for an untagged bucket
-// under node_modules (an artifact from before the tag); undefined for first-party code, which must
-// not be sent to a public registry (leaks names, adds noise).
-const ecosystemOf = (dir, ecosystem) => ecosystem ?? (hasNodeModulesSegment(dir) ? 'npm' : undefined)
+// Why a vendored crate that may not be crates.io's is asked nowhere: by its name, crates.io's
+// advisories would be another crate's, and a private git dependency's name must not reach a public
+// database at all.
+const UNREGISTERED_CRATES = {
+  'cargo-git': 'a crate vendored from a git repository, not crates.io',
+  'cargo-unknown': 'a vendored crate with no .cargo-checksum.json, which may be a git checkout, not crates.io\'s',
+}
 
 // A dependency's version as it is audited: a GitHub repo's `.gitmodules` branch `.`, git's for the
 // superproject's own branch, which the bundle does not know and advisories() takes for no branch, is
@@ -31,13 +36,15 @@ const isComposerDev = (version) => /^dev-|-dev$/iu.test(version.replace(/#.*$/su
 
 // Why `pkg` cannot be audited, or undefined where it can.
 function unaudited({ ecosystem, version }) {
+  if (Object.hasOwn(UNREGISTERED_CRATES, ecosystem)) return UNREGISTERED_CRATES[ecosystem]
   if (!Object.hasOwn(SOURCES, ecosystem)) return `no advisories are looked up for ${ecosystem}`
   if (ecosystem === 'composer' && isComposerDev(version)) return 'a Composer dev version, which no advisory database lists'
   return undefined
 }
 
 // Only audit installed dependencies, `{ ecosystem, name, version }`: an npm package, a vendored
-// crate, a Composer package, a Soldeer package or a GitHub repo, as the bundle tags it.
+// crate, a Composer package, a Soldeer package or a GitHub repo, as the bundle tags it (a crate
+// vendored from git, or from where no `.cargo-checksum.json` tells, is listed but never asked about).
 //
 // A package counts as present only when its REAL code is, and recorded = present:
 // an artifact records exactly the files it ships or attested -- imported, entry,
@@ -49,34 +56,68 @@ function unaudited({ ecosystem, version }) {
 // skipped, while one whose real code was bundled stays. Which consumers and import
 // EDGES reach that code is the reason column's concern -- collectReasons and
 // why.js apply the same evidence rule per file/edge there.
+//
+// A package's `github` is the repository its artifact records for it (its package.json's), where
+// one does; else, for an npm package a bundle carries the package.json of (one built before builds
+// recorded `repo`), the one that names, read by the rule builds record it by. A GitHub repo is its
+// own, and has none.
 export function collectPackagesFromFile(file) {
   const out = []
-  for (const [dir, { name, version, ecosystem: tagged, files }] of parseFile(file).modules) {
-    const ecosystem = ecosystemOf(dir, tagged)
+  const { kind, artifact } = parseFileWithKind(file)
+  for (const [dir, { name, version, ecosystem: tagged, repo, files }] of artifact.modules) {
+    const ecosystem = dependencyEcosystem(dir, tagged)
+    // First-party code is never sent to a public registry (leaks names, adds noise).
     if (ecosystem === undefined) continue
     if (!name || !version) continue
     if (!Object.keys(files).some((rel) => isEvidenceFile(name, version, rel, ecosystem))) continue
-    out.push({ ecosystem, name, version: versionOf(ecosystem, version) })
+    let github = ecosystem === 'github' ? undefined : repo?.github
+    if (github === undefined && ecosystem === 'npm' && kind === 'bundle') github = manifestRepo(files['package.json'])
+    out.push({ ecosystem, name, version: versionOf(ecosystem, version), ...(github === undefined ? {} : { github }) })
   }
   return out
 }
 
+// The GitHub repository a bundled package.json's text names (packageRepo), or undefined where it
+// names none or doesn't parse. Read as Node reads one, past a byte order mark (packageJSONText),
+// which a bundle keeps in the text. A lockfile holds the file's digest alone, never asked here.
+function manifestRepo(text) {
+  if (typeof text !== 'string') return undefined
+  try {
+    return packageRepo(JSON.parse(text.replace(/^\uFEFF/u, '')))?.github
+  } catch {
+    return undefined
+  }
+}
+
 // Versions in semver's order where both are semver's, else as numbers in text compare.
 const byNumbers = new Intl.Collator('en', { numeric: true }).compare
 const byVersion = (a, b) => (valid(a) && valid(b) ? compareVersions(a, b) : byNumbers(a, b))
 
+// Each package once, with the GitHub repository its artifacts record for its name, which
+// advisories() asks instead of looking one up. It takes one repository a name, so a name recorded
+// with two, by two of its versions (a package that moved) or by two artifacts, has none, and is
+// looked up as before.
 export function collectPackages(files) {
-  const seen = new Set()
-  const out = []
+  const byKey = new Map()
+  const repos = new Map() // `ecosystem:name` -> the one repository recorded for it, or null
   for (const file of files) {
-    for (const pkg of collectPackagesFromFile(file)) {
+    for (const { github, ...pkg } of collectPackagesFromFile(file)) {
       const key = keyOf(pkg.ecosystem, pkg.name, pkg.version)
-      if (seen.has(key)) continue
-      seen.add(key)
-      out.push(pkg)
+      if (!byKey.has(key)) byKey.set(key, pkg)
+      if (github === undefined) continue
+      const name = `${pkg.ecosystem}:${pkg.name}`
+      const known = repos.get(name)
+      // The first spelling stands.
+      if (known === undefined) repos.set(name, github)
+      else if (known !== null && !sameGithub(known, github)) repos.set(name, null)
     }
   }
-  return out.toSorted((a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name) || byVersion(a.version, b.version))
+  return [...byKey.values()]
+    .map((pkg) => {
+      const github = repos.get(`${pkg.ecosystem}:${pkg.name}`)
+      return github ? { ...pkg, github } : pkg
+    })
+    .toSorted((a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name) || byVersion(a.version, b.version))
 }
 
 // Map each audited package (keyOf it) to the bundle consumers ("reasons") that recorded its files.
@@ -93,7 +134,7 @@ export function collectReasons(files) {
     if (!fileReasons) continue
     const fileToPkg = new Map()
     for (const [dir, { name, version, ecosystem: tagged, files: modFiles }] of artifact.modules) {
-      const ecosystem = ecosystemOf(dir, tagged)
+      const ecosystem = dependencyEcosystem(dir, tagged)
       if (ecosystem === undefined || !name || !version) continue
       for (const rel of Object.keys(modFiles)) {
         if (!isEvidenceFile(name, version, rel, ecosystem)) continue
@@ -240,7 +281,7 @@ export async function audit(files, { why = false, whyDeep = false, whyFull = fal
   }
   let result
   try {
-    result = await advisories(asked.map(({ ecosystem, name, version }) => ({ ecosystem, name, versions: [version] })), { repoAdvisories, github })
+    result = await advisories(asked.map(({ version, ...pkg }) => ({ ...pkg, versions: [version] })), { repoAdvisories, github })
   } catch (cause) {
     // Refused input or a malformed answer is an assertion that says so itself; a transport or
     // HTTP failure gets the context of which request it was.

package/src/bundle-from-lockfile.js

@@ -4,7 +4,7 @@ import { resolve } from 'node:path'
 
 import { Bundle } from '@exodus/stasis-core/bundle'
 import { sha512integrity } from '@exodus/stasis-core/state-util'
-import { moduleFileKey, narrowExecutable } from '@exodus/stasis-core/util'
+import { moduleFileKey, moduleInfo, narrowExecutable } from '@exodus/stasis-core/util'
 
 // Reconstruct an in-memory Bundle from a lockfile, reading every attested file from disk and
 // verifying each against the lockfile's SRI digest -- fail closed on mismatch, so this is as
@@ -14,7 +14,7 @@ export function bundleFromLockfile(lockfile, { root }) {
   if (!lockfile.imports) throw new Error('stasis: lockfile has no recorded import graph')
   const formats = lockfile.formats ?? new Map()
   const modules = new Map()
-  for (const [dir, { name, version, ecosystem, files }] of lockfile.modules) {
+  for (const [dir, { files, ...info }] of lockfile.modules) {
     const out = Object.create(null)
     for (const [rel, integrity] of Object.entries(files)) {
       const file = moduleFileKey(dir, rel)
@@ -42,9 +42,7 @@ export function bundleFromLockfile(lockfile, { root }) {
         out[rel] = bytes.toString('utf8')
       }
     }
-    modules.set(dir, ecosystem === undefined
-      ? { name, version, files: out }
-      : { name, version, ecosystem, files: out })
+    modules.set(dir, moduleInfo({ ...info, files: out }))
   }
   return new Bundle({
     config: lockfile.config,