@geastack/compiler 1.0.15

package/dist/project-preparation.js

@@ -0,0 +1,314 @@
+import { existsSync, readFileSync, mkdirSync, writeFileSync, realpathSync } from 'node:fs';
+import { dirname, resolve, isAbsolute, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const disk = {
+    exists: existsSync,
+    read: (file) => readFileSync(file, 'utf8'),
+    write: (file, text) => {
+        writeFileSync(file, text);
+    },
+    realpath: realpathSync
+};
+const manifestAt = (root, files = disk) => object(JSON.parse(files.read(join(root, 'package.json'))));
+/**
+ * The running compiler's own package name, read off its manifest rather than
+ * spelled here, so a rename or a fork still recognises itself.
+ *
+ * The dependency walk below stops at this package. A program never imports
+ * its compiler, so nothing reachable only through the compiler's manifest can
+ * be program input -- but node-compat states the compiler as a peer, and the
+ * compiler in turn states TypeScript as a dependency and the Apple package
+ * (hence the whole gea toolchain) as peers. Walking through it acquired the
+ * TypeScript repository twice, Babel four times, Vite, Rolldown and Postcss
+ * for `raw-http-hello`, a program whose only import is `node:http`: 2.1 GB of
+ * checkouts and a serial registry round trip per package, on every cold cache.
+ */
+const ownPackageName = () => {
+    try {
+        const name = manifestAt(resolve(dirname(fileURLToPath(import.meta.url)), '..')).name;
+        return typeof name === 'string' ? name : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const run = (command, args, cwd) => {
+    const result = spawnSync(command, [...args], {
+        cwd,
+        encoding: 'utf8',
+        timeout: 120000,
+        maxBuffer: 16 * 1024 * 1024,
+        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
+    });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(`${command} failed (${result.status ?? result.signal}): ${result.stderr.trim()}`);
+    return result.stdout.trim();
+};
+export const installedPackage = (name, from, files = disk) => {
+    if (!/^(?:@[\w.-]+\/)?[\w.-]+$/.test(name))
+        return undefined;
+    let directory = resolve(from);
+    for (;;) {
+        const candidate = join(directory, 'node_modules', name);
+        if (files.exists(join(candidate, 'package.json')))
+            return files.realpath(candidate);
+        const parent = dirname(directory);
+        if (directory === parent)
+            return undefined;
+        directory = parent;
+    }
+};
+export const dependencyInstallCommand = (manifest, locks) => {
+    const declared = typeof manifest.packageManager === 'string' ? manifest.packageManager : '';
+    const manager = declared.split('@')[0] || (locks.has('pnpm-lock.yaml') ? 'pnpm' : locks.has('yarn.lock') ? 'yarn' : 'npm');
+    if (manager === 'npm')
+        return {
+            command: manager,
+            args: [
+                locks.has('package-lock.json') || locks.has('npm-shrinkwrap.json') ? 'ci' : 'install',
+                '--ignore-scripts',
+                '--no-audit',
+                '--no-fund'
+            ],
+            env: {}
+        };
+    if (manager === 'pnpm')
+        return {
+            command: manager,
+            args: ['install', '--ignore-scripts', ...(locks.has('pnpm-lock.yaml') ? ['--frozen-lockfile'] : [])],
+            env: {}
+        };
+    if (manager === 'yarn') {
+        const modern = /^yarn@(?:[2-9]|[1-9][0-9])\./.test(declared);
+        return {
+            command: manager,
+            args: [
+                'install',
+                ...(modern
+                    ? locks.has('yarn.lock')
+                        ? ['--immutable']
+                        : []
+                    : ['--ignore-scripts', ...(locks.has('yarn.lock') ? ['--frozen-lockfile'] : [])])
+            ],
+            env: modern ? { YARN_ENABLE_SCRIPTS: 'false' } : {}
+        };
+    }
+    throw new Error(`Unsupported package manager: ${manager}`);
+};
+/** Install through the project's chosen package manager, without lifecycle execution. */
+export const ensureDependencies = (directory, log = console.error) => {
+    const manifest = manifestAt(directory);
+    const required = Object.keys({ ...object(manifest.dependencies), ...object(manifest.devDependencies) });
+    if (required.every((name) => installedPackage(name, directory)))
+        return;
+    let root = directory;
+    const lockNames = ['pnpm-lock.yaml', 'yarn.lock', 'package-lock.json', 'npm-shrinkwrap.json'];
+    for (let parent = directory;; parent = dirname(parent)) {
+        if (lockNames.some((name) => existsSync(join(parent, name)))) {
+            root = parent;
+            break;
+        }
+        if (dirname(parent) === parent)
+            break;
+    }
+    const owner = existsSync(join(root, 'package.json')) ? manifestAt(root) : manifest;
+    const plan = dependencyInstallCommand(owner, new Set(lockNames.filter((name) => existsSync(join(root, name)))));
+    log(`[geatsc] Installing dependencies with ${plan.command}`);
+    const result = spawnSync(plan.command, plan.args, { cwd: root, stdio: 'inherit', env: { ...process.env, ...plan.env } });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(`${plan.command} dependency installation failed (${result.status ?? result.signal})`);
+};
+const repositoryIdentity = (metadata) => {
+    const repository = typeof metadata.repository === 'string' ? { url: metadata.repository } : object(metadata.repository);
+    if (typeof repository.url !== 'string')
+        return undefined;
+    let url = repository.url.replace(/^git\+/, '').replace(/^git@github\.com:/, 'https://github.com/');
+    if (url.startsWith('github:'))
+        url = `https://github.com/${url.slice(7)}`;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.hash || parsed.search)
+        return undefined;
+    const directory = typeof repository.directory === 'string' ? repository.directory : '.';
+    if (isAbsolute(directory) || directory.split(/[\\/]/).includes('..'))
+        return undefined;
+    return { url, directory };
+};
+export const sourceIdentity = (metadata) => {
+    if (typeof metadata.gitHead !== 'string' || !/^[a-f0-9]{40}$/i.test(metadata.gitHead))
+        return undefined;
+    const repository = repositoryIdentity(metadata);
+    return repository ? { ...repository, commit: metadata.gitHead.toLowerCase() } : undefined;
+};
+const decodedPayload = (entry) => {
+    const envelope = object(object(entry).bundle).dsseEnvelope;
+    const payload = object(envelope).payload;
+    if (typeof payload !== 'string')
+        return undefined;
+    try {
+        return object(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')));
+    }
+    catch {
+        return undefined;
+    }
+};
+/** Recover the exact source commit from npm's signed publication provenance when legacy gitHead metadata is absent. */
+export const provenanceSourceIdentity = (metadata, response) => {
+    if (typeof metadata.name !== 'string' || typeof metadata.version !== 'string')
+        return undefined;
+    const repository = repositoryIdentity(metadata);
+    if (!repository)
+        return undefined;
+    const dist = object(metadata.dist);
+    const integrity = typeof dist.integrity === 'string' ? dist.integrity.match(/^sha512-(.+)$/)?.[1] : undefined;
+    if (!integrity)
+        return undefined;
+    const expectedDigest = Buffer.from(integrity, 'base64').toString('hex');
+    const encodedName = encodeURIComponent(metadata.name).replace(/%2F/gi, '/');
+    const expectedSubject = `pkg:npm/${encodedName}@${metadata.version}`;
+    const expectedRepository = repository.url.replace(/\.git$/, '').replace(/\/$/, '');
+    const entries = Array.isArray(response.attestations) ? response.attestations : [];
+    for (const entry of entries) {
+        if (object(entry).predicateType !== 'https://slsa.dev/provenance/v1')
+            continue;
+        const payload = decodedPayload(entry);
+        if (!payload || payload.predicateType !== 'https://slsa.dev/provenance/v1')
+            continue;
+        const subjects = Array.isArray(payload.subject) ? payload.subject : [];
+        const subject = subjects.find((candidate) => object(candidate).name === expectedSubject);
+        if (object(object(subject).digest).sha512 !== expectedDigest)
+            continue;
+        const definition = object(object(payload.predicate).buildDefinition);
+        const dependencies = Array.isArray(definition.resolvedDependencies) ? definition.resolvedDependencies : [];
+        for (const dependency of dependencies) {
+            const record = object(dependency);
+            const commit = object(record.digest).gitCommit;
+            if (typeof record.uri !== 'string' || typeof commit !== 'string' || !/^[a-f0-9]{40}$/i.test(commit))
+                continue;
+            const separator = record.uri.lastIndexOf('@');
+            if (separator < 0)
+                continue;
+            const source = record.uri
+                .slice(0, separator)
+                .replace(/^git\+/, '')
+                .replace(/\.git$/, '')
+                .replace(/\/$/, '');
+            if (source !== expectedRepository)
+                continue;
+            return { ...repository, commit: commit.toLowerCase() };
+        }
+    }
+    return undefined;
+};
+const fetchAttestations = async (url) => {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.hash)
+        throw new Error('Invalid provenance URL');
+    const response = await fetch(parsed, { signal: AbortSignal.timeout(30000) });
+    if (!response.ok)
+        throw new Error(`Provenance request failed (${response.status})`);
+    return object(await response.json());
+};
+const checkout = (identity, destination) => {
+    mkdirSync(destination, { recursive: true });
+    run('git', ['init', '--quiet', destination], destination);
+    const args = ['-c', 'core.hooksPath=/dev/null', '-c', 'protocol.file.allow=never', '-c', 'protocol.ext.allow=never'];
+    run('git', [...args, 'fetch', '--quiet', '--depth=1', '--no-tags', identity.url, identity.commit], destination);
+    // This is a newly created compiler-owned cache, never a user checkout.
+    run('git', [...args, 'checkout', '--quiet', '--detach', identity.commit], destination);
+    if (run('git', ['rev-parse', 'HEAD'], destination) !== identity.commit)
+        throw new Error('Source checkout did not match the published commit');
+};
+/** Acquire missing typed sources at the installed version; plain JS remains usable. */
+export const preparePackageSources = async (root, options = {}) => {
+    const files = options.files ?? disk;
+    const log = options.log ?? console.error;
+    const metadata = options.metadata ?? (async (name, version, cwd) => object(JSON.parse(run('npm', ['view', `${name}@${version}`, '--json'], cwd))));
+    const attestations = options.attestations ?? (async (url) => fetchAttestations(url));
+    const sources = [];
+    const visited = new Set();
+    const compiler = ownPackageName();
+    const pending = [resolve(root)];
+    while (pending.length > 0) {
+        const directory = pending.shift();
+        if (visited.has(directory) || !files.exists(join(directory, 'package.json')))
+            continue;
+        visited.add(directory);
+        const manifest = manifestAt(directory, files);
+        if (compiler !== undefined && manifest.name === compiler)
+            continue;
+        for (const name of Object.keys({
+            ...object(manifest.dependencies),
+            ...object(manifest.optionalDependencies),
+            ...object(manifest.peerDependencies)
+        })) {
+            const installed = installedPackage(name, directory, files);
+            if (installed)
+                pending.push(installed);
+        }
+        if (directory === resolve(root) || typeof manifest.name !== 'string' || typeof manifest.version !== 'string')
+            continue;
+        // Authored JavaScript already is source. Only generated packages with type
+        // metadata benefit from acquiring the missing TypeScript build inputs.
+        const serialized = JSON.stringify({ main: manifest.main, exports: manifest.exports });
+        if (!/(?:dist|lib|build)\//.test(serialized) || !/\.d\.[cm]?ts|"types"|"typings"/.test(JSON.stringify(manifest)))
+            continue;
+        if (files.exists(join(directory, 'src')) || files.exists(join(directory, 'tsconfig.json')))
+            continue;
+        // Keyed by the published identity alone. A version is published once, so
+        // every installed copy of it -- hoisted, or nested under a dependency that
+        // pinned it -- names the same commit, and the checkout is one checkout.
+        // Keying on the install directory as well fetched TypeScript's repository
+        // once per `node_modules` it appeared in.
+        const cache = join(root, 'node_modules', '.cache', 'geatsc', 'sources', createHash('sha256').update(`${manifest.name}@${manifest.version}`).digest('hex').slice(0, 24));
+        const record = join(cache, 'source.json');
+        try {
+            if (files.exists(record)) {
+                const saved = object(JSON.parse(files.read(record)));
+                if (saved.name === manifest.name &&
+                    saved.version === manifest.version &&
+                    typeof saved.root === 'string' &&
+                    files.exists(join(saved.root, 'package.json'))) {
+                    sources.push({ root: saved.root, origin: directory });
+                    continue;
+                }
+            }
+            const published = await metadata(manifest.name, manifest.version, directory);
+            if (published.name !== manifest.name || published.version !== manifest.version)
+                throw new Error('Registry returned a different package version');
+            let identity = sourceIdentity(published);
+            const provenanceUrl = object(object(published.dist).attestations).url;
+            if (!identity && typeof provenanceUrl === 'string')
+                identity = provenanceSourceIdentity(published, await attestations(provenanceUrl, directory));
+            if (!identity) {
+                log(`[geatsc] ${manifest.name}@${manifest.version}: no pinned source metadata; using installed JavaScript`);
+                continue;
+            }
+            const destination = join(cache, identity.commit);
+            log(`[geatsc] Fetching ${manifest.name}@${manifest.version} source (${identity.commit.slice(0, 12)})`);
+            (options.checkout ?? checkout)(identity, destination);
+            const packageRoot = resolve(destination, identity.directory);
+            const found = manifestAt(packageRoot, files);
+            if (found.name !== manifest.name || found.version !== manifest.version)
+                throw new Error('Checkout package identity does not match the installed package');
+            files.write(record, `${JSON.stringify({ name: manifest.name, version: manifest.version, ...identity, root: packageRoot }, null, 2)}\n`);
+            sources.push({ root: packageRoot, origin: directory });
+        }
+        catch (error) {
+            log(`[geatsc] ${manifest.name}@${manifest.version}: source unavailable (${error instanceof Error ? error.message : String(error)}); using installed JavaScript`);
+        }
+    }
+    return sources;
+};

package/dist/projection/abi.d.ts

@@ -0,0 +1,82 @@
+import type { DiagnosticLocation } from '../diagnostics/model.js';
+import { type DeclarationId, type FunctionId, type SemanticResultId } from '../identity/ids.js';
+import type { RepresentationDeriver } from '../representation/derive.js';
+import type { CallableAbi } from '../representation/model.js';
+import type { SealedRepresentationPlan } from '../representation/plan.js';
+import type { SemanticGraph } from '../semantics/model/graph.js';
+/**
+ * Projecting each source function's physical calling convention.
+ *
+ * This stage decides nothing. The convention was already fixed when the plan
+ * selected a carrier for the callable value a `function-object` allocation
+ * publishes: a `function-value-dispatch`/`function` carrier *is* an ABI, and
+ * re-deriving one here from the parameter list would be a second authority over
+ * a question the fixed point already answered -- the classic way one function
+ * ends up called through one convention and defined with another.
+ *
+ * What this stage does do is check the two ends against each other. The frame
+ * the body reads (its `parameter`-sourced binding initializations) and the
+ * frame the ABI declares are published independently; if they disagree in
+ * count or in carrier, the disagreement is reported, never reconciled. A
+ * reconciliation here would silently pick a winner and emit a body that reads
+ * arguments the caller did not push.
+ */
+export interface AbiProjectionBlocker {
+    readonly functionId: FunctionId;
+    readonly reason: string;
+    /**
+     * Where the blocked declaration is, or `null` when this program has no node
+     * for it (an identity `locationOfDeclaration` was never asked to index, or a
+     * blocker minted ahead of a full compiler run -- see `AbiProjectionInput.
+     * locationOfDeclaration`). ⛔ DISPLAY ONLY, never an admission input, same as
+     * every other `DiagnosticLocation` in the compiler.
+     */
+    readonly location: DiagnosticLocation | null;
+}
+export interface AbiProjection {
+    readonly abis: ReadonlyMap<FunctionId, CallableAbi>;
+    /** Exact declaration provenance for callable values, proved by the semantic graph. */
+    readonly callableOrigins: ReadonlyMap<SemanticResultId, FunctionId>;
+    /** Own-property writes keyed by that same exact Function identity. */
+    readonly callableOwnPropertyWrites: ReadonlyMap<FunctionId, ReadonlySet<string>>;
+    /** Mutations of the inherited Function.prototype methods shared by every callable. */
+    readonly functionPrototypePropertyWrites: ReadonlySet<string>;
+    /**
+     * The convention `new` invokes, for the bodies that have one of their own.
+     *
+     * Only a `function-and-constructor` carrier is in here: a pre-`class`
+     * JavaScript constructor function, whose ONE body is entered two ways. The
+     * two are stated separately because they are separately physical --
+     * `[[Call]]` is handed a receiver and returns what the body returns, while
+     * `[[Construct]]` manufactures the receiver (ECMA-262 10.2.2) and evaluates
+     * to it -- and the emitter needs both to render the two function pointers
+     * `gea::CallableConstructorObject` holds. A class is NOT here: its
+     * construction is a `ClassLayout` (`projection/classes.ts`), rendered from
+     * its own declaration.
+     */
+    readonly constructs: ReadonlyMap<FunctionId, CallableAbi>;
+    readonly blocked: readonly AbiProjectionBlocker[];
+}
+export interface AbiProjectionInput {
+    readonly graph: SemanticGraph;
+    readonly plan: SealedRepresentationPlan;
+    /**
+     * Optional only for callers that predate this field (`preflight/run.ts`
+     * builds its own `AbiProjectionInput` ahead of a full compiler run, where
+     * no boxed-callable body could exist yet to need it). Every carrier that
+     * needs it -- `abiOfCarrier`'s fallback for a `dynamic` function-object
+     * allocation -- is unreachable without `--dynamic-fallback`, so its
+     * absence there costs nothing real.
+     */
+    readonly deriver?: RepresentationDeriver;
+    /**
+     * Where a DeclarationId is, for a blocker to carry as display evidence --
+     * `CompilationResult.locationOfDeclaration`, the frontend's own position
+     * index. Optional for the same reason `deriver` is: `preflight/run.ts`
+     * builds its own `AbiProjectionInput` ahead of a full compiler run, before
+     * there is a frontend result to ask. A blocker minted there carries a `null`
+     * location rather than one this stage invented a second way to compute.
+     */
+    readonly locationOfDeclaration?: (declaration: DeclarationId) => DiagnosticLocation | null;
+}
+export declare const projectAbis: (input: AbiProjectionInput) => AbiProjection;