@graftland/package-manager 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -1,3 +1,18 @@
-# Temporary Holding Version
+# @graftland/package-manager
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Installs dependencies with npm, pnpm or Yarn, and rolls back on failure.
+
+```sh
+npm install @graftland/package-manager effect
+```
+
+`make` detects the project's package manager. Its `install` adds, updates or
+removes dependencies, and restores `package.json` and the lockfile if installing
+fails. `graft add` and `graft remove` use it.
+
+## Documentation
+
+- [Command line](https://graftland.github.io/graft/cli/)
+
+Part of [Graft](https://github.com/graftland/graft). Licensed under
+[Apache 2.0](https://github.com/graftland/graft/blob/main/LICENSE).

package/dist/index.d.ts

@@ -0,0 +1,61 @@
+import { Changes, PackageName } from "./manifest.js";
+import { Effect, FileSystem, HashMap, Path, PlatformError, Schema } from "effect";
+import { ChildProcessSpawner } from "effect/process";
+export declare const Agent: Schema.Literals<readonly ["npm", "pnpm", "yarn-classic", "yarn-berry"]>;
+export type Agent = typeof Agent.Type;
+declare const PackageManagerError_base: Schema.Class<PackageManagerError, Schema.TaggedStruct<"PackageManagerError", {
+  readonly operation: Schema.Literals<readonly ["detect", "install", "recover", "state"]>;
+  readonly message: Schema.String;
+  readonly exitCode: Schema.optionalKey<Schema.Int>;
+}>, import("effect/Cause").YieldableError & {
+  readonly brand: unique symbol;
+}>;
+export declare class PackageManagerError extends PackageManagerError_base {}
+export type Error = PackageManagerError | PlatformError.PlatformError | Schema.SchemaError;
+export interface Options {
+  /** Project directory, containing package.json. Use the workspace root for workspace installs. */
+  readonly directory: string;
+  /** Explicit selection takes precedence over detection. */
+  readonly agent?: Agent;
+  /** Optional npm_config_user_agent supplied by the caller; used only as a fallback. */
+  readonly userAgent?: string;
+}
+/** packageManager, then lockfile, then caller user-agent, then npm. Conflicting lockfiles fail. */
+export declare const detectAgent: (options: Options) => Effect.Effect<"npm" | "pnpm" | "yarn-berry" | "yarn-classic", PackageManagerError | PlatformError.PlatformError | Schema.SchemaError, FileSystem.FileSystem | Path.Path>;
+export interface PackageState {
+  readonly spec: string;
+  /** Missing optional or not-yet-installed dependencies have no version/path. */
+  readonly version: string | undefined;
+  readonly path: string | undefined;
+}
+/** Direct dependencies only, keyed by their manifest names (including aliases). */
+export type State = HashMap.HashMap<string, PackageState>;
+export interface PackageChange {
+  readonly name: string;
+  readonly before: PackageState | undefined;
+  readonly after: PackageState | undefined;
+}
+export interface StateDiff {
+  readonly added: ReadonlyArray<PackageChange>;
+  readonly removed: ReadonlyArray<PackageChange>;
+  readonly updated: ReadonlyArray<PackageChange>;
+}
+export declare const diffState: (before: State, after: State) => StateDiff;
+export interface InstallResult extends StateDiff {
+  readonly agent: Agent;
+}
+export interface PackageManager {
+  readonly directory: string;
+  readonly agent: Agent;
+  readonly readState: Effect.Effect<State, Error>;
+  /** Serialized per manager. Empty changes installs the current manifest, including first installs. */
+  readonly install: (changes: Changes) => Effect.Effect<InstallResult, Error>;
+}
+/**
+ * Own one manager per project. Failed or interrupted installs restore the exact
+ * manifest/lockfiles, then attempt to repair node_modules when a lockfile existed.
+ * Recovery failures are combined with the original cause. No crash recovery is promised.
+ */
+export declare const make: (options: Options) => Effect.Effect<PackageManager, Error, FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner>;
+export { Changes, PackageName };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;qBA0Ba,OAAK,OAAA;YAMN,eAAe,MAAM;;;;;;WAGd;;qBAFN,4BAA4B;YAQ7B,QACX,sBAAsB,cAAc,gBAAgB,OAAO;iBAC3C;;WAEP;;WAEA,QAAQ;;WAER;;;qBAuBG,cAAW,SAAA,YAAA,OAAA,uDAAA,sBAAA,cAAA,gBAAA,OAAA,aAAA,WAAA,aAAA,KAAA;iBAyDP;WACP;;WAEA;WACA;;;YAGE,QAAQ,QAAQ,gBAAgB;iBAC3B;WACP;WACA,QAAQ;WACR,OAAO;;iBAEA;WACP,OAAO,cAAc;WACrB,SAAS,cAAc;WACvB,SAAS,cAAc;;qBAEpB,YAAS,QAAY,OAAK,OAAS,UAAQ;iBA0BvC,sBAAsB;WAC7B,OAAO;;iBAEA;WACP;WACA,OAAO;WACP,WAAW,OAAO,OAAO,OAAO;;WAEhC,UAAU,SAAS,YAAY,OAAO,OAAO,eAAe;;;;;;;qBAQzD,OAAI,SACP,YACP,OAAO,OACT,gBACA,OACA,WAAW,aAAa,KAAK,OAAO,oBAAoB"}

package/dist/index.js

@@ -0,0 +1,204 @@
+import { Changes, PackageName, applyChanges, decodeManifest, encodeManifest, fields } from "./manifest.js";
+import { Array, Effect, Exit, FileSystem, HashMap, Option, Path, Record, Schema, Semaphore, String } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+// src/index.ts
+/** Non-interactive package installation. Provide platform services at the application boundary. */
+const Agent = Schema.Literals([
+	"npm",
+	"pnpm",
+	"yarn-classic",
+	"yarn-berry"
+]);
+var PackageManagerError = class extends Schema.TaggedError()("PackageManagerError", {
+	operation: Schema.Literals([
+		"detect",
+		"install",
+		"recover",
+		"state"
+	]),
+	message: Schema.String,
+	exitCode: Schema.optionalKey(Schema.Int)
+}) {};
+const lockfiles = [
+	"package-lock.json",
+	"npm-shrinkwrap.json",
+	"pnpm-lock.yaml",
+	"yarn.lock"
+];
+const backupFiles = [
+	"package.json",
+	...lockfiles,
+	".npmrc",
+	"pnpm-workspace.yaml",
+	".yarnrc",
+	".yarnrc.yml",
+	".yarn/install-state.gz",
+	".pnp.cjs",
+	".pnp.loader.mjs"
+];
+const executable = (agent) => String.startsWith("yarn")(agent) ? "yarn" : agent;
+/** packageManager, then lockfile, then caller user-agent, then npm. Conflicting lockfiles fail. */
+const detectAgent = Effect.fnUntraced(function* (options) {
+	if (options.agent !== void 0) return yield* Schema.decodeEffect(Agent)(options.agent);
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const manifest = yield* fs.readFileString(path.join(options.directory, "package.json")).pipe(Effect.flatMap(decodeManifest));
+	if (manifest.packageManager !== void 0) {
+		const match = /^(npm|pnpm|yarn)@(\d+)\.\d+\.\d+(?:[-+].*)?$/.exec(manifest.packageManager);
+		if (match === null) return yield* PackageManagerError.make({
+			operation: "detect",
+			message: `Unsupported packageManager: ${manifest.packageManager}`
+		});
+		return match[1] === "yarn" ? match[2] === "1" ? "yarn-classic" : "yarn-berry" : match[1];
+	}
+	const found = yield* Effect.filter(lockfiles, (file) => fs.exists(path.join(options.directory, file)));
+	const kinds = Array.dedupe(Array.map(found, (file) => file === "pnpm-lock.yaml" ? "pnpm" : file === "yarn.lock" ? "yarn" : "npm"));
+	if (kinds.length > 1) return yield* PackageManagerError.make({
+		operation: "detect",
+		message: "Conflicting lockfiles; select an agent explicitly"
+	});
+	if (kinds[0] === "yarn") {
+		const lock = yield* fs.readFileString(path.join(options.directory, "yarn.lock"));
+		return /^__metadata:/m.test(lock) ? "yarn-berry" : "yarn-classic";
+	}
+	if (kinds[0] !== void 0) return kinds[0];
+	const caller = /^(npm|pnpm|yarn)\/(\d+)/.exec(options.userAgent ?? "");
+	return caller?.[1] === "yarn" ? caller[2] === "1" ? "yarn-classic" : "yarn-berry" : caller?.[1] === "pnpm" ? "pnpm" : "npm";
+});
+const diffState = (before, after) => {
+	const changes = Array.map(Array.sort(Array.dedupe([...HashMap.keys(before), ...HashMap.keys(after)]), String.Order), (name) => ({
+		name,
+		before: Option.getOrUndefined(HashMap.get(before, name)),
+		after: Option.getOrUndefined(HashMap.get(after, name))
+	}));
+	return {
+		added: Array.filter(changes, (change) => change.before === void 0),
+		removed: Array.filter(changes, (change) => change.after === void 0),
+		updated: Array.filter(changes, ({ before, after }) => before !== void 0 && after !== void 0 && (before.spec !== after.spec || before.version !== after.version || before.path !== after.path))
+	};
+};
+/**
+* Own one manager per project. Failed or interrupted installs restore the exact
+* manifest/lockfiles, then attempt to repair node_modules when a lockfile existed.
+* Recovery failures are combined with the original cause. No crash recovery is promised.
+*/
+const make = (options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const directory = path.resolve(options.directory);
+	const agent = yield* detectAgent({
+		...options,
+		directory
+	});
+	const lock = yield* Semaphore.make(1);
+	const manifestFile = path.join(directory, "package.json");
+	const readManifest = fs.readFileString(manifestFile).pipe(Effect.flatMap(decodeManifest));
+	const installed = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.optionalKey(Schema.String) })));
+	const stateOf = Effect.fnUntraced(function* (manifest) {
+		if (yield* fs.exists(path.join(directory, ".pnp.cjs"))) return yield* PackageManagerError.make({
+			operation: "state",
+			message: "Plug'n'Play is not supported; configure Yarn with nodeLinker: node-modules"
+		});
+		const deps = Array.reduce(fields, {}, (all, field) => ({
+			...all,
+			...manifest[field]
+		}));
+		const entries = yield* Effect.forEach(Record.toEntries(deps), ([name, spec]) => Effect.gen(function* () {
+			const file = path.join(directory, "node_modules", name, "package.json");
+			if (!(yield* fs.exists(file))) return [name, {
+				spec,
+				version: void 0,
+				path: void 0
+			}];
+			return [name, {
+				spec,
+				version: (yield* fs.readFileString(file).pipe(Effect.flatMap(installed))).version,
+				path: yield* fs.realPath(path.dirname(file))
+			}];
+		}));
+		return HashMap.fromIterable(entries);
+	});
+	const readState = Effect.flatMap(readManifest, stateOf);
+	const run = Effect.fnUntraced(function* (operation) {
+		const recovery = operation === "recover";
+		const args = agent === "npm" ? [
+			"install",
+			"--no-audit",
+			"--no-fund",
+			...recovery ? ["--prefer-offline"] : []
+		] : agent === "pnpm" ? [
+			"install",
+			recovery ? "--frozen-lockfile" : "--no-frozen-lockfile",
+			"--config.confirmModulesPurge=false"
+		] : agent === "yarn-classic" ? [
+			"install",
+			"--non-interactive",
+			...recovery ? ["--frozen-lockfile", "--prefer-offline"] : []
+		] : ["install", ...recovery ? ["--immutable"] : []];
+		const code = yield* spawner.exitCode(ChildProcess.make(executable(agent), args, {
+			cwd: directory,
+			extendEnv: true,
+			stdin: "ignore",
+			stdout: "inherit",
+			stderr: "inherit",
+			env: {
+				CI: "true",
+				...agent === "yarn-berry" ? {
+					YARN_ENABLE_IMMUTABLE_INSTALLS: recovery ? "true" : "false",
+					YARN_NODE_LINKER: "node-modules"
+				} : {}
+			}
+		})).pipe(Effect.timeoutOrElse({
+			duration: "10 minutes",
+			orElse: () => PackageManagerError.make({
+				operation,
+				message: `${executable(agent)} ${operation} timed out`
+			})
+		}));
+		if (code !== 0) return yield* PackageManagerError.make({
+			operation,
+			exitCode: code,
+			message: `${executable(agent)} ${operation} exited with code ${code}`
+		});
+	});
+	const install = (changes) => lock.withPermits(1)(Effect.gen(function* () {
+		const validated = yield* Schema.decodeEffect(Changes)(changes);
+		const original = yield* fs.readFileString(manifestFile);
+		const manifest = yield* decodeManifest(original);
+		const before = yield* stateOf(manifest);
+		const text = yield* encodeManifest(applyChanges(manifest, validated), original);
+		const backups = yield* Effect.forEach(backupFiles, (name) => Effect.gen(function* () {
+			const file = path.join(directory, name);
+			return {
+				name,
+				file,
+				bytes: (yield* fs.exists(file)) ? yield* fs.readFile(file).pipe(Effect.asSome) : Option.none()
+			};
+		}));
+		const restore = Array.reduce(backups, Effect.void, (previous, { file, bytes }) => previous.pipe(Effect.onExit(() => Option.match(bytes, {
+			onNone: () => fs.remove(file, { force: true }),
+			onSome: (bytes) => fs.writeFile(file, bytes)
+		}))));
+		const agentLocks = agent === "npm" ? ["package-lock.json", "npm-shrinkwrap.json"] : agent === "pnpm" ? ["pnpm-lock.yaml"] : ["yarn.lock"];
+		const hasLock = Array.some(backups, ({ name, bytes }) => Array.contains(agentLocks, name) && Option.isSome(bytes));
+		return yield* Effect.acquireUseRelease(Effect.void, () => Effect.gen(function* () {
+			yield* fs.writeFileString(manifestFile, text);
+			yield* run("install");
+			const after = yield* readState;
+			return {
+				agent,
+				...diffState(before, after)
+			};
+		}), (_, exit) => Exit.isSuccess(exit) ? Effect.void : restore.pipe(Effect.andThen(hasLock ? run("recover") : Effect.void), Effect.onExit(() => restore)));
+	}));
+	return {
+		directory,
+		agent,
+		readState: lock.withPermits(1)(readState),
+		install
+	};
+});
+export { Agent, Changes, PackageManagerError, PackageName, detectAgent, diffState, make };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["Str","Arr"],"sources":["../src/index.ts"],"sourcesContent":["/** Non-interactive package installation. Provide platform services at the application boundary. */\nimport {\n\tArray as Arr,\n\tEffect,\n\tExit,\n\tFileSystem,\n\tHashMap,\n\tOption,\n\tPath,\n\tRecord,\n\tSchema,\n\tSemaphore,\n\tString as Str,\n} from \"effect\"\nimport type { PlatformError } from \"effect\"\nimport { ChildProcess, ChildProcessSpawner } from \"effect/process\"\nimport {\n\tapplyChanges,\n\tChanges,\n\tdecodeManifest,\n\tencodeManifest,\n\tfields,\n\ttype Manifest,\n} from \"./manifest\"\nexport { Changes, PackageName } from \"./manifest\"\n\nexport const Agent = Schema.Literals([\n\t\"npm\",\n\t\"pnpm\",\n\t\"yarn-classic\",\n\t\"yarn-berry\",\n])\nexport type Agent = typeof Agent.Type\nexport class PackageManagerError extends Schema.TaggedError<\n\tPackageManagerError,\n\t{ readonly brand: unique symbol }\n>()(\"PackageManagerError\", {\n\toperation: Schema.Literals([\"detect\", \"install\", \"recover\", \"state\"]),\n\tmessage: Schema.String,\n\texitCode: Schema.optionalKey(Schema.Int),\n}) {}\nexport type Error =\n\tPackageManagerError | PlatformError.PlatformError | Schema.SchemaError\nexport interface Options {\n\t/** Project directory, containing package.json. Use the workspace root for workspace installs. */\n\treadonly directory: string\n\t/** Explicit selection takes precedence over detection. */\n\treadonly agent?: Agent\n\t/** Optional npm_config_user_agent supplied by the caller; used only as a fallback. */\n\treadonly userAgent?: string\n}\nconst lockfiles = [\n\t\"package-lock.json\",\n\t\"npm-shrinkwrap.json\",\n\t\"pnpm-lock.yaml\",\n\t\"yarn.lock\",\n] as const\nconst backupFiles = [\n\t\"package.json\",\n\t...lockfiles,\n\t\".npmrc\",\n\t\"pnpm-workspace.yaml\",\n\t\".yarnrc\",\n\t\".yarnrc.yml\",\n\t\".yarn/install-state.gz\",\n\t\".pnp.cjs\",\n\t\".pnp.loader.mjs\",\n]\nconst executable = (agent: Agent) =>\n\tStr.startsWith(\"yarn\")(agent) ? \"yarn\" : agent\n\n/** packageManager, then lockfile, then caller user-agent, then npm. Conflicting lockfiles fail. */\nexport const detectAgent = Effect.fnUntraced(function* (options: Options) {\n\tif (options.agent !== undefined)\n\t\treturn yield* Schema.decodeEffect(Agent)(options.agent)\n\tconst fs = yield* FileSystem.FileSystem\n\tconst path = yield* Path.Path\n\tconst manifest = yield* fs\n\t\t.readFileString(path.join(options.directory, \"package.json\"))\n\t\t.pipe(Effect.flatMap(decodeManifest))\n\tif (manifest.packageManager !== undefined) {\n\t\tconst match = /^(npm|pnpm|yarn)@(\\d+)\\.\\d+\\.\\d+(?:[-+].*)?$/.exec(\n\t\t\tmanifest.packageManager,\n\t\t)\n\t\tif (match === null)\n\t\t\treturn yield* PackageManagerError.make({\n\t\t\t\toperation: \"detect\",\n\t\t\t\tmessage: `Unsupported packageManager: ${manifest.packageManager}`,\n\t\t\t})\n\t\treturn match[1] === \"yarn\"\n\t\t\t? match[2] === \"1\"\n\t\t\t\t? \"yarn-classic\"\n\t\t\t\t: \"yarn-berry\"\n\t\t\t: (match[1] as \"npm\" | \"pnpm\")\n\t}\n\tconst found = yield* Effect.filter(lockfiles, (file) =>\n\t\tfs.exists(path.join(options.directory, file)),\n\t)\n\tconst kinds = Arr.dedupe(\n\t\tArr.map(found, (file) =>\n\t\t\tfile === \"pnpm-lock.yaml\"\n\t\t\t\t? \"pnpm\"\n\t\t\t\t: file === \"yarn.lock\"\n\t\t\t\t\t? \"yarn\"\n\t\t\t\t\t: \"npm\",\n\t\t),\n\t)\n\tif (kinds.length > 1)\n\t\treturn yield* PackageManagerError.make({\n\t\t\toperation: \"detect\",\n\t\t\tmessage: \"Conflicting lockfiles; select an agent explicitly\",\n\t\t})\n\tif (kinds[0] === \"yarn\") {\n\t\tconst lock = yield* fs.readFileString(\n\t\t\tpath.join(options.directory, \"yarn.lock\"),\n\t\t)\n\t\treturn /^__metadata:/m.test(lock) ? \"yarn-berry\" : \"yarn-classic\"\n\t}\n\tif (kinds[0] !== undefined) return kinds[0]\n\tconst caller = /^(npm|pnpm|yarn)\\/(\\d+)/.exec(options.userAgent ?? \"\")\n\treturn caller?.[1] === \"yarn\"\n\t\t? caller[2] === \"1\"\n\t\t\t? \"yarn-classic\"\n\t\t\t: \"yarn-berry\"\n\t\t: caller?.[1] === \"pnpm\"\n\t\t\t? \"pnpm\"\n\t\t\t: \"npm\"\n})\n\nexport interface PackageState {\n\treadonly spec: string\n\t/** Missing optional or not-yet-installed dependencies have no version/path. */\n\treadonly version: string | undefined\n\treadonly path: string | undefined\n}\n/** Direct dependencies only, keyed by their manifest names (including aliases). */\nexport type State = HashMap.HashMap<string, PackageState>\nexport interface PackageChange {\n\treadonly name: string\n\treadonly before: PackageState | undefined\n\treadonly after: PackageState | undefined\n}\nexport interface StateDiff {\n\treadonly added: ReadonlyArray<PackageChange>\n\treadonly removed: ReadonlyArray<PackageChange>\n\treadonly updated: ReadonlyArray<PackageChange>\n}\nexport const diffState = (before: State, after: State): StateDiff => {\n\tconst changes = Arr.map(\n\t\tArr.sort(\n\t\t\tArr.dedupe([...HashMap.keys(before), ...HashMap.keys(after)]),\n\t\t\tStr.Order,\n\t\t),\n\t\t(name) => ({\n\t\t\tname,\n\t\t\tbefore: Option.getOrUndefined(HashMap.get(before, name)),\n\t\t\tafter: Option.getOrUndefined(HashMap.get(after, name)),\n\t\t}),\n\t)\n\treturn {\n\t\tadded: Arr.filter(changes, (change) => change.before === undefined),\n\t\tremoved: Arr.filter(changes, (change) => change.after === undefined),\n\t\tupdated: Arr.filter(\n\t\t\tchanges,\n\t\t\t({ before, after }) =>\n\t\t\t\tbefore !== undefined &&\n\t\t\t\tafter !== undefined &&\n\t\t\t\t(before.spec !== after.spec ||\n\t\t\t\t\tbefore.version !== after.version ||\n\t\t\t\t\tbefore.path !== after.path),\n\t\t),\n\t}\n}\nexport interface InstallResult extends StateDiff {\n\treadonly agent: Agent\n}\nexport interface PackageManager {\n\treadonly directory: string\n\treadonly agent: Agent\n\treadonly readState: Effect.Effect<State, Error>\n\t/** Serialized per manager. Empty changes installs the current manifest, including first installs. */\n\treadonly install: (changes: Changes) => Effect.Effect<InstallResult, Error>\n}\n\n/**\n * Own one manager per project. Failed or interrupted installs restore the exact\n * manifest/lockfiles, then attempt to repair node_modules when a lockfile existed.\n * Recovery failures are combined with the original cause. No crash recovery is promised.\n */\nexport const make = (\n\toptions: Options,\n): Effect.Effect<\n\tPackageManager,\n\tError,\n\tFileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner\n> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem\n\t\tconst path = yield* Path.Path\n\t\tconst spawner = yield* ChildProcessSpawner.ChildProcessSpawner\n\t\tconst directory = path.resolve(options.directory)\n\t\tconst agent = yield* detectAgent({ ...options, directory })\n\t\tconst lock = yield* Semaphore.make(1)\n\t\tconst manifestFile = path.join(directory, \"package.json\")\n\t\tconst readManifest = fs\n\t\t\t.readFileString(manifestFile)\n\t\t\t.pipe(Effect.flatMap(decodeManifest))\n\t\tconst installed = Schema.decodeUnknownEffect(\n\t\t\tSchema.fromJsonString(\n\t\t\t\tSchema.Struct({ version: Schema.optionalKey(Schema.String) }),\n\t\t\t),\n\t\t)\n\t\tconst stateOf = Effect.fnUntraced(function* (manifest: Manifest) {\n\t\t\tif (yield* fs.exists(path.join(directory, \".pnp.cjs\")))\n\t\t\t\treturn yield* PackageManagerError.make({\n\t\t\t\t\toperation: \"state\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"Plug'n'Play is not supported; configure Yarn with nodeLinker: node-modules\",\n\t\t\t\t})\n\t\t\tconst deps = Arr.reduce(\n\t\t\t\tfields,\n\t\t\t\t{} as Readonly<Record<string, string>>,\n\t\t\t\t(all, field) => ({ ...all, ...manifest[field] }),\n\t\t\t)\n\t\t\tconst entries = yield* Effect.forEach(\n\t\t\t\tRecord.toEntries(deps),\n\t\t\t\t([name, spec]) =>\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tconst file = path.join(\n\t\t\t\t\t\t\tdirectory,\n\t\t\t\t\t\t\t\"node_modules\",\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\t\"package.json\",\n\t\t\t\t\t\t)\n\t\t\t\t\t\tif (!(yield* fs.exists(file)))\n\t\t\t\t\t\t\treturn [\n\t\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\t\t{ spec, version: undefined, path: undefined },\n\t\t\t\t\t\t\t] as const\n\t\t\t\t\t\tconst pkg = yield* fs\n\t\t\t\t\t\t\t.readFileString(file)\n\t\t\t\t\t\t\t.pipe(Effect.flatMap(installed))\n\t\t\t\t\t\treturn [\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tspec,\n\t\t\t\t\t\t\t\tversion: pkg.version,\n\t\t\t\t\t\t\t\tpath: yield* fs.realPath(path.dirname(file)),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t] as const\n\t\t\t\t\t}),\n\t\t\t)\n\t\t\treturn HashMap.fromIterable<string, PackageState>(entries)\n\t\t})\n\t\tconst readState = Effect.flatMap(readManifest, stateOf)\n\t\tconst run = Effect.fnUntraced(function* (operation: \"install\" | \"recover\") {\n\t\t\tconst recovery = operation === \"recover\"\n\t\t\tconst args =\n\t\t\t\tagent === \"npm\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"install\",\n\t\t\t\t\t\t\t\"--no-audit\",\n\t\t\t\t\t\t\t\"--no-fund\",\n\t\t\t\t\t\t\t...(recovery ? [\"--prefer-offline\"] : []),\n\t\t\t\t\t\t]\n\t\t\t\t\t: agent === \"pnpm\"\n\t\t\t\t\t\t? [\n\t\t\t\t\t\t\t\t\"install\",\n\t\t\t\t\t\t\t\trecovery ? \"--frozen-lockfile\" : \"--no-frozen-lockfile\",\n\t\t\t\t\t\t\t\t\"--config.confirmModulesPurge=false\",\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t: agent === \"yarn-classic\"\n\t\t\t\t\t\t\t? [\n\t\t\t\t\t\t\t\t\t\"install\",\n\t\t\t\t\t\t\t\t\t\"--non-interactive\",\n\t\t\t\t\t\t\t\t\t...(recovery\n\t\t\t\t\t\t\t\t\t\t? [\"--frozen-lockfile\", \"--prefer-offline\"]\n\t\t\t\t\t\t\t\t\t\t: []),\n\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t: [\"install\", ...(recovery ? [\"--immutable\"] : [])]\n\t\t\tconst code = yield* spawner\n\t\t\t\t.exitCode(\n\t\t\t\t\tChildProcess.make(executable(agent), args, {\n\t\t\t\t\t\tcwd: directory,\n\t\t\t\t\t\textendEnv: true,\n\t\t\t\t\t\tstdin: \"ignore\",\n\t\t\t\t\t\tstdout: \"inherit\",\n\t\t\t\t\t\tstderr: \"inherit\",\n\t\t\t\t\t\tenv: {\n\t\t\t\t\t\t\tCI: \"true\",\n\t\t\t\t\t\t\t...(agent === \"yarn-berry\"\n\t\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\t\tYARN_ENABLE_IMMUTABLE_INSTALLS: recovery ? \"true\" : \"false\",\n\t\t\t\t\t\t\t\t\t\tYARN_NODE_LINKER: \"node-modules\",\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.timeoutOrElse({\n\t\t\t\t\t\tduration: \"10 minutes\",\n\t\t\t\t\t\torElse: () =>\n\t\t\t\t\t\t\tPackageManagerError.make({\n\t\t\t\t\t\t\t\toperation,\n\t\t\t\t\t\t\t\tmessage: `${executable(agent)} ${operation} timed out`,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\tif (code !== 0)\n\t\t\t\treturn yield* PackageManagerError.make({\n\t\t\t\t\toperation,\n\t\t\t\t\texitCode: code,\n\t\t\t\t\tmessage: `${executable(agent)} ${operation} exited with code ${code}`,\n\t\t\t\t})\n\t\t})\n\t\tconst install = (changes: Changes) =>\n\t\t\tlock.withPermits(1)(\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst validated = yield* Schema.decodeEffect(Changes)(changes)\n\t\t\t\t\tconst original = yield* fs.readFileString(manifestFile)\n\t\t\t\t\tconst manifest = yield* decodeManifest(original)\n\t\t\t\t\tconst before = yield* stateOf(manifest)\n\t\t\t\t\tconst text = yield* encodeManifest(\n\t\t\t\t\t\tapplyChanges(manifest, validated),\n\t\t\t\t\t\toriginal,\n\t\t\t\t\t)\n\t\t\t\t\tconst backups = yield* Effect.forEach(backupFiles, (name) =>\n\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\tconst file = path.join(directory, name)\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\t\tfile,\n\t\t\t\t\t\t\t\tbytes: (yield* fs.exists(file))\n\t\t\t\t\t\t\t\t\t? yield* fs.readFile(file).pipe(Effect.asSome)\n\t\t\t\t\t\t\t\t\t: Option.none<Uint8Array>(),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}),\n\t\t\t\t\t)\n\t\t\t\t\t// Every file gets a restoration attempt; onExit combines failures.\n\t\t\t\t\tconst restore = Arr.reduce<\n\t\t\t\t\t\t(typeof backups)[number],\n\t\t\t\t\t\tEffect.Effect<void, PlatformError.PlatformError>\n\t\t\t\t\t>(backups, Effect.void, (previous, { file, bytes }) =>\n\t\t\t\t\t\tprevious.pipe(\n\t\t\t\t\t\t\tEffect.onExit(() =>\n\t\t\t\t\t\t\t\tOption.match(bytes, {\n\t\t\t\t\t\t\t\t\tonNone: () => fs.remove(file, { force: true }),\n\t\t\t\t\t\t\t\t\tonSome: (bytes) => fs.writeFile(file, bytes),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t\tconst agentLocks =\n\t\t\t\t\t\tagent === \"npm\"\n\t\t\t\t\t\t\t? [\"package-lock.json\", \"npm-shrinkwrap.json\"]\n\t\t\t\t\t\t\t: agent === \"pnpm\"\n\t\t\t\t\t\t\t\t? [\"pnpm-lock.yaml\"]\n\t\t\t\t\t\t\t\t: [\"yarn.lock\"]\n\t\t\t\t\tconst hasLock = Arr.some(\n\t\t\t\t\t\tbackups,\n\t\t\t\t\t\t({ name, bytes }) =>\n\t\t\t\t\t\t\tArr.contains(agentLocks, name) && Option.isSome(bytes),\n\t\t\t\t\t)\n\t\t\t\t\treturn yield* Effect.acquireUseRelease(\n\t\t\t\t\t\tEffect.void,\n\t\t\t\t\t\t() =>\n\t\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\t\tyield* fs.writeFileString(manifestFile, text)\n\t\t\t\t\t\t\t\tyield* run(\"install\")\n\t\t\t\t\t\t\t\tconst after = yield* readState\n\t\t\t\t\t\t\t\treturn { agent, ...diffState(before, after) }\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t(_, exit) =>\n\t\t\t\t\t\t\tExit.isSuccess(exit)\n\t\t\t\t\t\t\t\t? Effect.void\n\t\t\t\t\t\t\t\t: restore.pipe(\n\t\t\t\t\t\t\t\t\t\tEffect.andThen(hasLock ? run(\"recover\") : Effect.void),\n\t\t\t\t\t\t\t\t\t\t// Recovery itself may rewrite the manifest or lockfile, including on failure.\n\t\t\t\t\t\t\t\t\t\tEffect.onExit(() => restore),\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}),\n\t\t\t)\n\t\treturn {\n\t\t\tdirectory,\n\t\t\tagent,\n\t\t\treadState: lock.withPermits(1)(readState),\n\t\t\tinstall,\n\t\t}\n\t})\n"],"mappings":";;;;;AA0BA,MAAa,QAAQ,OAAO,SAAS;CACpC;CACA;CACA;CACA;AACD,CAAC;AAED,IAAa,sBAAb,cAAyC,OAAO,YAG9C,CAAC,CAAC,uBAAuB;CAC1B,WAAW,OAAO,SAAS;EAAC;EAAU;EAAW;EAAW;CAAO,CAAC;CACpE,SAAS,OAAO;CAChB,UAAU,OAAO,YAAY,OAAO,GAAG;AACxC,CAAC,CAAC,CAAC,CAAC;AAWJ,MAAM,YAAY;CACjB;CACA;CACA;CACA;AACD;AACA,MAAM,cAAc;CACnB;CACA,GAAG;CACH;CACA;CACA;CACA;CACA;CACA;CACA;AACD;AACA,MAAM,cAAc,UACnBA,OAAI,WAAW,MAAM,CAAC,CAAC,KAAK,IAAI,SAAS;;AAG1C,MAAa,cAAc,OAAO,WAAW,WAAW,SAAkB;CACzE,IAAI,QAAQ,UAAU,KAAA,GACrB,OAAO,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,QAAQ,KAAK;CACvD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,WAAW,OAAO,GACtB,eAAe,KAAK,KAAK,QAAQ,WAAW,cAAc,CAAC,CAAC,CAC5D,KAAK,OAAO,QAAQ,cAAc,CAAC;CACrC,IAAI,SAAS,mBAAmB,KAAA,GAAW;EAC1C,MAAM,QAAQ,+CAA+C,KAC5D,SAAS,cACV;EACA,IAAI,UAAU,MACb,OAAO,OAAO,oBAAoB,KAAK;GACtC,WAAW;GACX,SAAS,+BAA+B,SAAS;EAClD,CAAC;EACF,OAAO,MAAM,OAAO,SACjB,MAAM,OAAO,MACZ,iBACA,eACA,MAAM;CACX;CACA,MAAM,QAAQ,OAAO,OAAO,OAAO,YAAY,SAC9C,GAAG,OAAO,KAAK,KAAK,QAAQ,WAAW,IAAI,CAAC,CAC7C;CACA,MAAM,QAAQC,MAAI,OACjBA,MAAI,IAAI,QAAQ,SACf,SAAS,mBACN,SACA,SAAS,cACR,SACA,KACL,CACD;CACA,IAAI,MAAM,SAAS,GAClB,OAAO,OAAO,oBAAoB,KAAK;EACtC,WAAW;EACX,SAAS;CACV,CAAC;CACF,IAAI,MAAM,OAAO,QAAQ;EACxB,MAAM,OAAO,OAAO,GAAG,eACtB,KAAK,KAAK,QAAQ,WAAW,WAAW,CACzC;EACA,OAAO,gBAAgB,KAAK,IAAI,IAAI,eAAe;CACpD;CACA,IAAI,MAAM,OAAO,KAAA,GAAW,OAAO,MAAM;CACzC,MAAM,SAAS,0BAA0B,KAAK,QAAQ,aAAa,EAAE;CACrE,OAAO,SAAS,OAAO,SACpB,OAAO,OAAO,MACb,iBACA,eACD,SAAS,OAAO,SACf,SACA;AACL,CAAC;AAoBD,MAAa,aAAa,QAAe,UAA4B;CACpE,MAAM,UAAUA,MAAI,IACnBA,MAAI,KACHA,MAAI,OAAO,CAAC,GAAG,QAAQ,KAAK,MAAM,GAAG,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,GAC5DD,OAAI,KACL,IACC,UAAU;EACV;EACA,QAAQ,OAAO,eAAe,QAAQ,IAAI,QAAQ,IAAI,CAAC;EACvD,OAAO,OAAO,eAAe,QAAQ,IAAI,OAAO,IAAI,CAAC;CACtD,EACD;CACA,OAAO;EACN,OAAOC,MAAI,OAAO,UAAU,WAAW,OAAO,WAAW,KAAA,CAAS;EAClE,SAASA,MAAI,OAAO,UAAU,WAAW,OAAO,UAAU,KAAA,CAAS;EACnE,SAASA,MAAI,OACZ,UACC,EAAE,QAAQ,YACV,WAAW,KAAA,KACX,UAAU,KAAA,MACT,OAAO,SAAS,MAAM,QACtB,OAAO,YAAY,MAAM,WACzB,OAAO,SAAS,MAAM,KACzB;CACD;AACD;;;;;;AAiBA,MAAa,QACZ,YAMA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,UAAU,OAAO,oBAAoB;CAC3C,MAAM,YAAY,KAAK,QAAQ,QAAQ,SAAS;CAChD,MAAM,QAAQ,OAAO,YAAY;EAAE,GAAG;EAAS;CAAU,CAAC;CAC1D,MAAM,OAAO,OAAO,UAAU,KAAK,CAAC;CACpC,MAAM,eAAe,KAAK,KAAK,WAAW,cAAc;CACxD,MAAM,eAAe,GACnB,eAAe,YAAY,CAAC,CAC5B,KAAK,OAAO,QAAQ,cAAc,CAAC;CACrC,MAAM,YAAY,OAAO,oBACxB,OAAO,eACN,OAAO,OAAO,EAAE,SAAS,OAAO,YAAY,OAAO,MAAM,EAAE,CAAC,CAC7D,CACD;CACA,MAAM,UAAU,OAAO,WAAW,WAAW,UAAoB;EAChE,IAAI,OAAO,GAAG,OAAO,KAAK,KAAK,WAAW,UAAU,CAAC,GACpD,OAAO,OAAO,oBAAoB,KAAK;GACtC,WAAW;GACX,SACC;EACF,CAAC;EACF,MAAM,OAAOA,MAAI,OAChB,QACA,CAAC,IACA,KAAK,WAAW;GAAE,GAAG;GAAK,GAAG,SAAS;EAAO,EAC/C;EACA,MAAM,UAAU,OAAO,OAAO,QAC7B,OAAO,UAAU,IAAI,IACpB,CAAC,MAAM,UACP,OAAO,IAAI,aAAa;GACvB,MAAM,OAAO,KAAK,KACjB,WACA,gBACA,MACA,cACD;GACA,IAAI,EAAE,OAAO,GAAG,OAAO,IAAI,IAC1B,OAAO,CACN,MACA;IAAE;IAAM,SAAS,KAAA;IAAW,MAAM,KAAA;GAAU,CAC7C;GAID,OAAO,CACN,MACA;IACC;IACA,UAAS,OAPQ,GACjB,eAAe,IAAI,CAAC,CACpB,KAAK,OAAO,QAAQ,SAAS,CAAC,EAAA,CAKjB;IACb,MAAM,OAAO,GAAG,SAAS,KAAK,QAAQ,IAAI,CAAC;GAC5C,CACD;EACD,CAAC,CACH;EACA,OAAO,QAAQ,aAAmC,OAAO;CAC1D,CAAC;CACD,MAAM,YAAY,OAAO,QAAQ,cAAc,OAAO;CACtD,MAAM,MAAM,OAAO,WAAW,WAAW,WAAkC;EAC1E,MAAM,WAAW,cAAc;EAC/B,MAAM,OACL,UAAU,QACP;GACA;GACA;GACA;GACA,GAAI,WAAW,CAAC,kBAAkB,IAAI,CAAC;EACxC,IACC,UAAU,SACT;GACA;GACA,WAAW,sBAAsB;GACjC;EACD,IACC,UAAU,iBACT;GACA;GACA;GACA,GAAI,WACD,CAAC,qBAAqB,kBAAkB,IACxC,CAAC;EACL,IACC,CAAC,WAAW,GAAI,WAAW,CAAC,aAAa,IAAI,CAAC,CAAE;EACtD,MAAM,OAAO,OAAO,QAClB,SACA,aAAa,KAAK,WAAW,KAAK,GAAG,MAAM;GAC1C,KAAK;GACL,WAAW;GACX,OAAO;GACP,QAAQ;GACR,QAAQ;GACR,KAAK;IACJ,IAAI;IACJ,GAAI,UAAU,eACX;KACA,gCAAgC,WAAW,SAAS;KACpD,kBAAkB;IACnB,IACC,CAAC;GACL;EACD,CAAC,CACF,CAAC,CACA,KACA,OAAO,cAAc;GACpB,UAAU;GACV,cACC,oBAAoB,KAAK;IACxB;IACA,SAAS,GAAG,WAAW,KAAK,EAAE,GAAG,UAAU;GAC5C,CAAC;EACH,CAAC,CACF;EACD,IAAI,SAAS,GACZ,OAAO,OAAO,oBAAoB,KAAK;GACtC;GACA,UAAU;GACV,SAAS,GAAG,WAAW,KAAK,EAAE,GAAG,UAAU,oBAAoB;EAChE,CAAC;CACH,CAAC;CACD,MAAM,WAAW,YAChB,KAAK,YAAY,CAAC,CAAC,CAClB,OAAO,IAAI,aAAa;EACvB,MAAM,YAAY,OAAO,OAAO,aAAa,OAAO,CAAC,CAAC,OAAO;EAC7D,MAAM,WAAW,OAAO,GAAG,eAAe,YAAY;EACtD,MAAM,WAAW,OAAO,eAAe,QAAQ;EAC/C,MAAM,SAAS,OAAO,QAAQ,QAAQ;EACtC,MAAM,OAAO,OAAO,eACnB,aAAa,UAAU,SAAS,GAChC,QACD;EACA,MAAM,UAAU,OAAO,OAAO,QAAQ,cAAc,SACnD,OAAO,IAAI,aAAa;GACvB,MAAM,OAAO,KAAK,KAAK,WAAW,IAAI;GACtC,OAAO;IACN;IACA;IACA,QAAQ,OAAO,GAAG,OAAO,IAAI,KAC1B,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAK,OAAO,MAAM,IAC3C,OAAO,KAAiB;GAC5B;EACD,CAAC,CACF;EAEA,MAAM,UAAUA,MAAI,OAGlB,SAAS,OAAO,OAAO,UAAU,EAAE,MAAM,YAC1C,SAAS,KACR,OAAO,aACN,OAAO,MAAM,OAAO;GACnB,cAAc,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC;GAC7C,SAAS,UAAU,GAAG,UAAU,MAAM,KAAK;EAC5C,CAAC,CACF,CACD,CACD;EACA,MAAM,aACL,UAAU,QACP,CAAC,qBAAqB,qBAAqB,IAC3C,UAAU,SACT,CAAC,gBAAgB,IACjB,CAAC,WAAW;EACjB,MAAM,UAAUA,MAAI,KACnB,UACC,EAAE,MAAM,YACRA,MAAI,SAAS,YAAY,IAAI,KAAK,OAAO,OAAO,KAAK,CACvD;EACA,OAAO,OAAO,OAAO,kBACpB,OAAO,YAEN,OAAO,IAAI,aAAa;GACvB,OAAO,GAAG,gBAAgB,cAAc,IAAI;GAC5C,OAAO,IAAI,SAAS;GACpB,MAAM,QAAQ,OAAO;GACrB,OAAO;IAAE;IAAO,GAAG,UAAU,QAAQ,KAAK;GAAE;EAC7C,CAAC,IACD,GAAG,SACH,KAAK,UAAU,IAAI,IAChB,OAAO,OACP,QAAQ,KACR,OAAO,QAAQ,UAAU,IAAI,SAAS,IAAI,OAAO,IAAI,GAErD,OAAO,aAAa,OAAO,CAC5B,CACJ;CACD,CAAC,CACF;CACD,OAAO;EACN;EACA;EACA,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS;EACxC;CACD;AACD,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,6 @@
+import { Effect, Schema } from "effect";
+export declare const PackageName: Schema.String;
+export declare const Changes: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Null]>>;
+/** A spec adds or updates a dependency; null removes it from all dependency fields. */
+export type Changes = typeof Changes.Type;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","names":[],"sources":["../src/manifest.ts"],"mappings":";qBAEa,aAAW,OAAA;qBAkBX,SAAO,OAAA,QAAA,OAAA,QAAA,OAAA,gBAAA,OAAA,QAAA,OAAA;;YAKR,iBAAiB,QAAQ"}

package/dist/manifest.js

@@ -0,0 +1,41 @@
+import { Array, Effect, Record, Schema, String } from "effect";
+// src/manifest.ts
+const PackageName = Schema.String.check(Schema.isPattern(/^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i), Schema.isMaxLength(214));
+const Dependencies = Schema.Record(PackageName, Schema.String);
+const Manifest = Schema.StructWithRest(Schema.Struct({
+	packageManager: Schema.optionalKey(Schema.String),
+	dependencies: Schema.optionalKey(Dependencies),
+	devDependencies: Schema.optionalKey(Dependencies),
+	optionalDependencies: Schema.optionalKey(Dependencies)
+}), [Schema.Record(Schema.String, Schema.Unknown)]);
+const decodeManifest = Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest));
+const Changes = Schema.Record(PackageName, Schema.Union([Schema.String.check(Schema.isPattern(/\S/)), Schema.Null]));
+const fields = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies"
+];
+const applyChanges = (manifest, changes) => {
+	let next = manifest;
+	for (const [name, spec] of Record.toEntries(changes)) {
+		const existing = Array.filter(fields, (field) => Record.has(next[field] ?? {}, name));
+		const targets = spec === null ? fields : existing.length > 0 ? existing : ["dependencies"];
+		for (const field of targets) {
+			const deps = next[field] ?? {};
+			next = {
+				...next,
+				[field]: spec === null ? Record.remove(deps, name) : Record.set(deps, name, spec)
+			};
+		}
+	}
+	return next;
+};
+const encodeManifest = Effect.fnUntraced(function* (manifest, original) {
+	const space = /^[{[]\r?\n([ \t]+)/.exec(original)?.[1] ?? 2;
+	const text = yield* Schema.encodeEffect(Schema.fromJsonString(Manifest, { space }))(manifest);
+	const eol = String.includes("\r\n")(original) ? "\r\n" : "\n";
+	return String.replaceAll("\n", eol)(text) + (/\r?\n$/.test(original) ? eol : "");
+});
+export { Changes, Manifest, PackageName, applyChanges, decodeManifest, encodeManifest, fields };
+
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","names":["Arr","Str"],"sources":["../src/manifest.ts"],"sourcesContent":["import { Array as Arr, Effect, Record, Schema, String as Str } from \"effect\"\n\nexport const PackageName = Schema.String.check(\n\tSchema.isPattern(/^(?:@[a-z0-9-~][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$/i),\n\tSchema.isMaxLength(214),\n)\nconst Dependencies = Schema.Record(PackageName, Schema.String)\nexport const Manifest = Schema.StructWithRest(\n\tSchema.Struct({\n\t\tpackageManager: Schema.optionalKey(Schema.String),\n\t\tdependencies: Schema.optionalKey(Dependencies),\n\t\tdevDependencies: Schema.optionalKey(Dependencies),\n\t\toptionalDependencies: Schema.optionalKey(Dependencies),\n\t}),\n\t[Schema.Record(Schema.String, Schema.Unknown)],\n)\nexport type Manifest = typeof Manifest.Type\nexport const decodeManifest = Schema.decodeUnknownEffect(\n\tSchema.fromJsonString(Manifest),\n)\nexport const Changes = Schema.Record(\n\tPackageName,\n\tSchema.Union([Schema.String.check(Schema.isPattern(/\\S/)), Schema.Null]),\n)\n/** A spec adds or updates a dependency; null removes it from all dependency fields. */\nexport type Changes = typeof Changes.Type\nexport const fields = [\n\t\"dependencies\",\n\t\"devDependencies\",\n\t\"optionalDependencies\",\n] as const\n\nexport const applyChanges = (\n\tmanifest: Manifest,\n\tchanges: Changes,\n): Manifest => {\n\tlet next = manifest\n\tfor (const [name, spec] of Record.toEntries(changes)) {\n\t\tconst existing = Arr.filter(fields, (field) =>\n\t\t\tRecord.has(next[field] ?? {}, name),\n\t\t)\n\t\tconst targets =\n\t\t\tspec === null\n\t\t\t\t? fields\n\t\t\t\t: existing.length > 0\n\t\t\t\t\t? existing\n\t\t\t\t\t: ([\"dependencies\"] as const)\n\t\tfor (const field of targets) {\n\t\t\tconst deps = next[field] ?? {}\n\t\t\tnext = {\n\t\t\t\t...next,\n\t\t\t\t[field]:\n\t\t\t\t\tspec === null\n\t\t\t\t\t\t? Record.remove(deps, name)\n\t\t\t\t\t\t: Record.set(deps, name, spec),\n\t\t\t}\n\t\t}\n\t}\n\treturn next\n}\n\nexport const encodeManifest = Effect.fnUntraced(function* (\n\tmanifest: Manifest,\n\toriginal: string,\n) {\n\tconst space = /^[{[]\\r?\\n([ \\t]+)/.exec(original)?.[1] ?? 2\n\tconst text = yield* Schema.encodeEffect(\n\t\tSchema.fromJsonString(Manifest, { space }),\n\t)(manifest)\n\tconst eol = Str.includes(\"\\r\\n\")(original) ? \"\\r\\n\" : \"\\n\"\n\treturn Str.replaceAll(\"\\n\", eol)(text) + (/\\r?\\n$/.test(original) ? eol : \"\")\n})\n"],"mappings":";;AAEA,MAAa,cAAc,OAAO,OAAO,MACxC,OAAO,UAAU,2DAA2D,GAC5E,OAAO,YAAY,GAAG,CACvB;AACA,MAAM,eAAe,OAAO,OAAO,aAAa,OAAO,MAAM;AAC7D,MAAa,WAAW,OAAO,eAC9B,OAAO,OAAO;CACb,gBAAgB,OAAO,YAAY,OAAO,MAAM;CAChD,cAAc,OAAO,YAAY,YAAY;CAC7C,iBAAiB,OAAO,YAAY,YAAY;CAChD,sBAAsB,OAAO,YAAY,YAAY;AACtD,CAAC,GACD,CAAC,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,CAAC,CAC9C;AAEA,MAAa,iBAAiB,OAAO,oBACpC,OAAO,eAAe,QAAQ,CAC/B;AACA,MAAa,UAAU,OAAO,OAC7B,aACA,OAAO,MAAM,CAAC,OAAO,OAAO,MAAM,OAAO,UAAU,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,CACxE;AAGA,MAAa,SAAS;CACrB;CACA;CACA;AACD;AAEA,MAAa,gBACZ,UACA,YACc;CACd,IAAI,OAAO;CACX,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,UAAU,OAAO,GAAG;EACrD,MAAM,WAAWA,MAAI,OAAO,SAAS,UACpC,OAAO,IAAI,KAAK,UAAU,CAAC,GAAG,IAAI,CACnC;EACA,MAAM,UACL,SAAS,OACN,SACA,SAAS,SAAS,IACjB,WACC,CAAC,cAAc;EACrB,KAAK,MAAM,SAAS,SAAS;GAC5B,MAAM,OAAO,KAAK,UAAU,CAAC;GAC7B,OAAO;IACN,GAAG;KACF,QACA,SAAS,OACN,OAAO,OAAO,MAAM,IAAI,IACxB,OAAO,IAAI,MAAM,MAAM,IAAI;GAChC;EACD;CACD;CACA,OAAO;AACR;AAEA,MAAa,iBAAiB,OAAO,WAAW,WAC/C,UACA,UACC;CACD,MAAM,QAAQ,qBAAqB,KAAK,QAAQ,CAAC,GAAG,MAAM;CAC1D,MAAM,OAAO,OAAO,OAAO,aAC1B,OAAO,eAAe,UAAU,EAAE,MAAM,CAAC,CAC1C,CAAC,CAAC,QAAQ;CACV,MAAM,MAAMC,OAAI,SAAS,MAAM,CAAC,CAAC,QAAQ,IAAI,SAAS;CACtD,OAAOA,OAAI,WAAW,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,KAAK,QAAQ,IAAI,MAAM;AAC3E,CAAC"}

package/package.json

@@ -1,6 +1,35 @@
 {
   "name": "@graftland/package-manager",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Installs dependencies with npm, pnpm or Yarn, and rolls back on failure",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/graftland/graft.git",
+    "directory": "packages/package-manager"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "src"
+  ],
+  "exports": {
+    ".": "./dist/index.js",
+    "./package.json": "./package.json"
+  },
+  "peerDependencies": {
+    "effect": "4.1.2"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.1.2",
+    "effect": "4.1.2",
+    "vitest": "5.1.0",
+    "@effect/platform-node": "4.1.2"
+  },
+  "dependencies": {},
+  "scripts": {
+    "build": "tsdown",
+    "test": "vitest run"
+  }
 }

package/src/index.ts

@@ -0,0 +1,391 @@
+/** Non-interactive package installation. Provide platform services at the application boundary. */
+import {
+	Array as Arr,
+	Effect,
+	Exit,
+	FileSystem,
+	HashMap,
+	Option,
+	Path,
+	Record,
+	Schema,
+	Semaphore,
+	String as Str,
+} from "effect"
+import type { PlatformError } from "effect"
+import { ChildProcess, ChildProcessSpawner } from "effect/process"
+import {
+	applyChanges,
+	Changes,
+	decodeManifest,
+	encodeManifest,
+	fields,
+	type Manifest,
+} from "./manifest"
+export { Changes, PackageName } from "./manifest"
+
+export const Agent = Schema.Literals([
+	"npm",
+	"pnpm",
+	"yarn-classic",
+	"yarn-berry",
+])
+export type Agent = typeof Agent.Type
+export class PackageManagerError extends Schema.TaggedError<
+	PackageManagerError,
+	{ readonly brand: unique symbol }
+>()("PackageManagerError", {
+	operation: Schema.Literals(["detect", "install", "recover", "state"]),
+	message: Schema.String,
+	exitCode: Schema.optionalKey(Schema.Int),
+}) {}
+export type Error =
+	PackageManagerError | PlatformError.PlatformError | Schema.SchemaError
+export interface Options {
+	/** Project directory, containing package.json. Use the workspace root for workspace installs. */
+	readonly directory: string
+	/** Explicit selection takes precedence over detection. */
+	readonly agent?: Agent
+	/** Optional npm_config_user_agent supplied by the caller; used only as a fallback. */
+	readonly userAgent?: string
+}
+const lockfiles = [
+	"package-lock.json",
+	"npm-shrinkwrap.json",
+	"pnpm-lock.yaml",
+	"yarn.lock",
+] as const
+const backupFiles = [
+	"package.json",
+	...lockfiles,
+	".npmrc",
+	"pnpm-workspace.yaml",
+	".yarnrc",
+	".yarnrc.yml",
+	".yarn/install-state.gz",
+	".pnp.cjs",
+	".pnp.loader.mjs",
+]
+const executable = (agent: Agent) =>
+	Str.startsWith("yarn")(agent) ? "yarn" : agent
+
+/** packageManager, then lockfile, then caller user-agent, then npm. Conflicting lockfiles fail. */
+export const detectAgent = Effect.fnUntraced(function* (options: Options) {
+	if (options.agent !== undefined)
+		return yield* Schema.decodeEffect(Agent)(options.agent)
+	const fs = yield* FileSystem.FileSystem
+	const path = yield* Path.Path
+	const manifest = yield* fs
+		.readFileString(path.join(options.directory, "package.json"))
+		.pipe(Effect.flatMap(decodeManifest))
+	if (manifest.packageManager !== undefined) {
+		const match = /^(npm|pnpm|yarn)@(\d+)\.\d+\.\d+(?:[-+].*)?$/.exec(
+			manifest.packageManager,
+		)
+		if (match === null)
+			return yield* PackageManagerError.make({
+				operation: "detect",
+				message: `Unsupported packageManager: ${manifest.packageManager}`,
+			})
+		return match[1] === "yarn"
+			? match[2] === "1"
+				? "yarn-classic"
+				: "yarn-berry"
+			: (match[1] as "npm" | "pnpm")
+	}
+	const found = yield* Effect.filter(lockfiles, (file) =>
+		fs.exists(path.join(options.directory, file)),
+	)
+	const kinds = Arr.dedupe(
+		Arr.map(found, (file) =>
+			file === "pnpm-lock.yaml"
+				? "pnpm"
+				: file === "yarn.lock"
+					? "yarn"
+					: "npm",
+		),
+	)
+	if (kinds.length > 1)
+		return yield* PackageManagerError.make({
+			operation: "detect",
+			message: "Conflicting lockfiles; select an agent explicitly",
+		})
+	if (kinds[0] === "yarn") {
+		const lock = yield* fs.readFileString(
+			path.join(options.directory, "yarn.lock"),
+		)
+		return /^__metadata:/m.test(lock) ? "yarn-berry" : "yarn-classic"
+	}
+	if (kinds[0] !== undefined) return kinds[0]
+	const caller = /^(npm|pnpm|yarn)\/(\d+)/.exec(options.userAgent ?? "")
+	return caller?.[1] === "yarn"
+		? caller[2] === "1"
+			? "yarn-classic"
+			: "yarn-berry"
+		: caller?.[1] === "pnpm"
+			? "pnpm"
+			: "npm"
+})
+
+export interface PackageState {
+	readonly spec: string
+	/** Missing optional or not-yet-installed dependencies have no version/path. */
+	readonly version: string | undefined
+	readonly path: string | undefined
+}
+/** Direct dependencies only, keyed by their manifest names (including aliases). */
+export type State = HashMap.HashMap<string, PackageState>
+export interface PackageChange {
+	readonly name: string
+	readonly before: PackageState | undefined
+	readonly after: PackageState | undefined
+}
+export interface StateDiff {
+	readonly added: ReadonlyArray<PackageChange>
+	readonly removed: ReadonlyArray<PackageChange>
+	readonly updated: ReadonlyArray<PackageChange>
+}
+export const diffState = (before: State, after: State): StateDiff => {
+	const changes = Arr.map(
+		Arr.sort(
+			Arr.dedupe([...HashMap.keys(before), ...HashMap.keys(after)]),
+			Str.Order,
+		),
+		(name) => ({
+			name,
+			before: Option.getOrUndefined(HashMap.get(before, name)),
+			after: Option.getOrUndefined(HashMap.get(after, name)),
+		}),
+	)
+	return {
+		added: Arr.filter(changes, (change) => change.before === undefined),
+		removed: Arr.filter(changes, (change) => change.after === undefined),
+		updated: Arr.filter(
+			changes,
+			({ before, after }) =>
+				before !== undefined &&
+				after !== undefined &&
+				(before.spec !== after.spec ||
+					before.version !== after.version ||
+					before.path !== after.path),
+		),
+	}
+}
+export interface InstallResult extends StateDiff {
+	readonly agent: Agent
+}
+export interface PackageManager {
+	readonly directory: string
+	readonly agent: Agent
+	readonly readState: Effect.Effect<State, Error>
+	/** Serialized per manager. Empty changes installs the current manifest, including first installs. */
+	readonly install: (changes: Changes) => Effect.Effect<InstallResult, Error>
+}
+
+/**
+ * Own one manager per project. Failed or interrupted installs restore the exact
+ * manifest/lockfiles, then attempt to repair node_modules when a lockfile existed.
+ * Recovery failures are combined with the original cause. No crash recovery is promised.
+ */
+export const make = (
+	options: Options,
+): Effect.Effect<
+	PackageManager,
+	Error,
+	FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner
+> =>
+	Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem
+		const path = yield* Path.Path
+		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner
+		const directory = path.resolve(options.directory)
+		const agent = yield* detectAgent({ ...options, directory })
+		const lock = yield* Semaphore.make(1)
+		const manifestFile = path.join(directory, "package.json")
+		const readManifest = fs
+			.readFileString(manifestFile)
+			.pipe(Effect.flatMap(decodeManifest))
+		const installed = Schema.decodeUnknownEffect(
+			Schema.fromJsonString(
+				Schema.Struct({ version: Schema.optionalKey(Schema.String) }),
+			),
+		)
+		const stateOf = Effect.fnUntraced(function* (manifest: Manifest) {
+			if (yield* fs.exists(path.join(directory, ".pnp.cjs")))
+				return yield* PackageManagerError.make({
+					operation: "state",
+					message:
+						"Plug'n'Play is not supported; configure Yarn with nodeLinker: node-modules",
+				})
+			const deps = Arr.reduce(
+				fields,
+				{} as Readonly<Record<string, string>>,
+				(all, field) => ({ ...all, ...manifest[field] }),
+			)
+			const entries = yield* Effect.forEach(
+				Record.toEntries(deps),
+				([name, spec]) =>
+					Effect.gen(function* () {
+						const file = path.join(
+							directory,
+							"node_modules",
+							name,
+							"package.json",
+						)
+						if (!(yield* fs.exists(file)))
+							return [
+								name,
+								{ spec, version: undefined, path: undefined },
+							] as const
+						const pkg = yield* fs
+							.readFileString(file)
+							.pipe(Effect.flatMap(installed))
+						return [
+							name,
+							{
+								spec,
+								version: pkg.version,
+								path: yield* fs.realPath(path.dirname(file)),
+							},
+						] as const
+					}),
+			)
+			return HashMap.fromIterable<string, PackageState>(entries)
+		})
+		const readState = Effect.flatMap(readManifest, stateOf)
+		const run = Effect.fnUntraced(function* (operation: "install" | "recover") {
+			const recovery = operation === "recover"
+			const args =
+				agent === "npm"
+					? [
+							"install",
+							"--no-audit",
+							"--no-fund",
+							...(recovery ? ["--prefer-offline"] : []),
+						]
+					: agent === "pnpm"
+						? [
+								"install",
+								recovery ? "--frozen-lockfile" : "--no-frozen-lockfile",
+								"--config.confirmModulesPurge=false",
+							]
+						: agent === "yarn-classic"
+							? [
+									"install",
+									"--non-interactive",
+									...(recovery
+										? ["--frozen-lockfile", "--prefer-offline"]
+										: []),
+								]
+							: ["install", ...(recovery ? ["--immutable"] : [])]
+			const code = yield* spawner
+				.exitCode(
+					ChildProcess.make(executable(agent), args, {
+						cwd: directory,
+						extendEnv: true,
+						stdin: "ignore",
+						stdout: "inherit",
+						stderr: "inherit",
+						env: {
+							CI: "true",
+							...(agent === "yarn-berry"
+								? {
+										YARN_ENABLE_IMMUTABLE_INSTALLS: recovery ? "true" : "false",
+										YARN_NODE_LINKER: "node-modules",
+									}
+								: {}),
+						},
+					}),
+				)
+				.pipe(
+					Effect.timeoutOrElse({
+						duration: "10 minutes",
+						orElse: () =>
+							PackageManagerError.make({
+								operation,
+								message: `${executable(agent)} ${operation} timed out`,
+							}),
+					}),
+				)
+			if (code !== 0)
+				return yield* PackageManagerError.make({
+					operation,
+					exitCode: code,
+					message: `${executable(agent)} ${operation} exited with code ${code}`,
+				})
+		})
+		const install = (changes: Changes) =>
+			lock.withPermits(1)(
+				Effect.gen(function* () {
+					const validated = yield* Schema.decodeEffect(Changes)(changes)
+					const original = yield* fs.readFileString(manifestFile)
+					const manifest = yield* decodeManifest(original)
+					const before = yield* stateOf(manifest)
+					const text = yield* encodeManifest(
+						applyChanges(manifest, validated),
+						original,
+					)
+					const backups = yield* Effect.forEach(backupFiles, (name) =>
+						Effect.gen(function* () {
+							const file = path.join(directory, name)
+							return {
+								name,
+								file,
+								bytes: (yield* fs.exists(file))
+									? yield* fs.readFile(file).pipe(Effect.asSome)
+									: Option.none<Uint8Array>(),
+							}
+						}),
+					)
+					// Every file gets a restoration attempt; onExit combines failures.
+					const restore = Arr.reduce<
+						(typeof backups)[number],
+						Effect.Effect<void, PlatformError.PlatformError>
+					>(backups, Effect.void, (previous, { file, bytes }) =>
+						previous.pipe(
+							Effect.onExit(() =>
+								Option.match(bytes, {
+									onNone: () => fs.remove(file, { force: true }),
+									onSome: (bytes) => fs.writeFile(file, bytes),
+								}),
+							),
+						),
+					)
+					const agentLocks =
+						agent === "npm"
+							? ["package-lock.json", "npm-shrinkwrap.json"]
+							: agent === "pnpm"
+								? ["pnpm-lock.yaml"]
+								: ["yarn.lock"]
+					const hasLock = Arr.some(
+						backups,
+						({ name, bytes }) =>
+							Arr.contains(agentLocks, name) && Option.isSome(bytes),
+					)
+					return yield* Effect.acquireUseRelease(
+						Effect.void,
+						() =>
+							Effect.gen(function* () {
+								yield* fs.writeFileString(manifestFile, text)
+								yield* run("install")
+								const after = yield* readState
+								return { agent, ...diffState(before, after) }
+							}),
+						(_, exit) =>
+							Exit.isSuccess(exit)
+								? Effect.void
+								: restore.pipe(
+										Effect.andThen(hasLock ? run("recover") : Effect.void),
+										// Recovery itself may rewrite the manifest or lockfile, including on failure.
+										Effect.onExit(() => restore),
+									),
+					)
+				}),
+			)
+		return {
+			directory,
+			agent,
+			readState: lock.withPermits(1)(readState),
+			install,
+		}
+	})

package/src/manifest.ts

@@ -0,0 +1,72 @@
+import { Array as Arr, Effect, Record, Schema, String as Str } from "effect"
+
+export const PackageName = Schema.String.check(
+	Schema.isPattern(/^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i),
+	Schema.isMaxLength(214),
+)
+const Dependencies = Schema.Record(PackageName, Schema.String)
+export const Manifest = Schema.StructWithRest(
+	Schema.Struct({
+		packageManager: Schema.optionalKey(Schema.String),
+		dependencies: Schema.optionalKey(Dependencies),
+		devDependencies: Schema.optionalKey(Dependencies),
+		optionalDependencies: Schema.optionalKey(Dependencies),
+	}),
+	[Schema.Record(Schema.String, Schema.Unknown)],
+)
+export type Manifest = typeof Manifest.Type
+export const decodeManifest = Schema.decodeUnknownEffect(
+	Schema.fromJsonString(Manifest),
+)
+export const Changes = Schema.Record(
+	PackageName,
+	Schema.Union([Schema.String.check(Schema.isPattern(/\S/)), Schema.Null]),
+)
+/** A spec adds or updates a dependency; null removes it from all dependency fields. */
+export type Changes = typeof Changes.Type
+export const fields = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies",
+] as const
+
+export const applyChanges = (
+	manifest: Manifest,
+	changes: Changes,
+): Manifest => {
+	let next = manifest
+	for (const [name, spec] of Record.toEntries(changes)) {
+		const existing = Arr.filter(fields, (field) =>
+			Record.has(next[field] ?? {}, name),
+		)
+		const targets =
+			spec === null
+				? fields
+				: existing.length > 0
+					? existing
+					: (["dependencies"] as const)
+		for (const field of targets) {
+			const deps = next[field] ?? {}
+			next = {
+				...next,
+				[field]:
+					spec === null
+						? Record.remove(deps, name)
+						: Record.set(deps, name, spec),
+			}
+		}
+	}
+	return next
+}
+
+export const encodeManifest = Effect.fnUntraced(function* (
+	manifest: Manifest,
+	original: string,
+) {
+	const space = /^[{[]\r?\n([ \t]+)/.exec(original)?.[1] ?? 2
+	const text = yield* Schema.encodeEffect(
+		Schema.fromJsonString(Manifest, { space }),
+	)(manifest)
+	const eol = Str.includes("\r\n")(original) ? "\r\n" : "\n"
+	return Str.replaceAll("\n", eol)(text) + (/\r?\n$/.test(original) ? eol : "")
+})