@kindgi/cli 0.1.9 → 0.1.10-rc.1

package/dist/build/loaded-install-check.js

@@ -0,0 +1,240 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The check on a lockfile cut down to what the pack loads
+ * (`loaded-install.ts`), against the app's own: the image's install must
+ * keep the app's pins. Every entry of the cut-down lockfile must be the
+ * app's entry for that package, the same version, resolution and
+ * integrity; nothing in it may be missing from the app's. And every
+ * package the cut-down manifest installs as a production dependency must
+ * be in the app's production graph, so the image never ships what the app
+ * has only for development.
+ *
+ * It reads both lockfiles itself and shares no code with the reducer, so a
+ * reducer bug can't pass its own output. The package manager's own
+ * supply-chain settings (pnpm's minimumReleaseAge, trustPolicy, allowBuilds)
+ * apply to the cut-down install unchanged: the workspace file goes along.
+ */
+import { isDeepStrictEqual } from 'node:util';
+import { parseAllDocuments } from 'yaml';
+/** Whether the cut-down lockfile keeps the app's pins (`ReducedLockfileCheck`). */
+export function checkReducedLockfile(check) {
+    let manifest;
+    try {
+        manifest = record(JSON.parse(check.manifest));
+    }
+    catch {
+        return refused("the cut-down package.json isn't JSON");
+    }
+    switch (check.manager) {
+        case 'pnpm':
+            return checkPnpm(check, manifest);
+        case 'npm':
+            return checkNpm(check, manifest);
+        case 'yarn':
+            return checkYarnClassic(check, manifest);
+    }
+}
+// ---------------------------------------------------------------------
+// pnpm
+// ---------------------------------------------------------------------
+function checkPnpm(check, manifest) {
+    const app = pnpmDocuments(check.lockfile);
+    const cut = pnpmDocuments(check.reduced);
+    if (app === undefined || cut === undefined)
+        return refused("a lockfile isn't pnpm's YAML");
+    if (app.length !== cut.length)
+        return refused('the env document differs');
+    for (let i = 0; i < app.length - 1; i++) {
+        if (!isDeepStrictEqual(app[i], cut[i]))
+            return refused('the env document differs');
+    }
+    const appLock = app[app.length - 1] ?? {};
+    const cutLock = cut[cut.length - 1] ?? {};
+    for (const key of new Set([...Object.keys(appLock), ...Object.keys(cutLock)])) {
+        if (['importers', 'packages', 'snapshots', 'patchedDependencies'].includes(key))
+            continue;
+        if (!isDeepStrictEqual(appLock[key], cutLock[key]))
+            return refused(`its ${key} differs from the app's`);
+    }
+    for (const section of ['packages', 'snapshots', 'patchedDependencies']) {
+        const ours = record(appLock[section]);
+        for (const [key, entry] of Object.entries(record(cutLock[section]))) {
+            if (!Object.hasOwn(ours, key))
+                return refused(`${section} has ${key}, which the app's lockfile doesn't`);
+            if (!isDeepStrictEqual(ours[key], entry))
+                return refused(`${section} ${key} differs from the app's`);
+        }
+    }
+    const importers = record(cutLock.importers);
+    const extra = Object.keys(importers).filter((key) => key !== '.');
+    if (extra.length > 0)
+        return refused(`it has importer ${extra[0]}, and the image installs one project`);
+    const appImporters = record(appLock.importers);
+    const packImporters = check.packRel === '' ? ['.'] : [check.packRel, '.'];
+    const snapshots = record(appLock.snapshots);
+    const keyOf = (name, version) => !/^[a-z+]+:/.test(version) && stem(version).indexOf('@', 1) > 0
+        ? version
+        : `${name}@${version}`;
+    const graph = (fields) => {
+        const seen = new Set();
+        const todo = packImporters.flatMap((importer) => fields.flatMap((field) => Object.entries(record(record(appImporters[importer])[field])).map(([name, dep]) => keyOf(name, String(record(dep).version)))));
+        for (let key = todo.pop(); key !== undefined; key = todo.pop()) {
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const snapshot = record(snapshots[key]);
+            for (const field of ['dependencies', 'optionalDependencies']) {
+                for (const [name, version] of Object.entries(record(snapshot[field])))
+                    todo.push(keyOf(name, String(version)));
+            }
+        }
+        return seen;
+    };
+    const production = graph(['dependencies', 'optionalDependencies']);
+    const everything = graph(['dependencies', 'optionalDependencies', 'devDependencies']);
+    const cutImporter = record(importers['.']);
+    for (const field of ['dependencies', 'optionalDependencies', 'devDependencies']) {
+        const listed = record(manifest[field]);
+        const locked = record(cutImporter[field]);
+        for (const [name, dep] of Object.entries(locked)) {
+            const key = keyOf(name, String(record(dep).version));
+            if (listed[name] !== record(dep).specifier)
+                return refused(`${name}'s specifier isn't the cut-down package.json's`);
+            const allowed = field === 'devDependencies' ? everything : production;
+            if (!allowed.has(key)) {
+                return refused(field === 'devDependencies'
+                    ? `${key} isn't in the app's dependency graph`
+                    : `${key} isn't in the app's production dependencies`);
+            }
+        }
+        for (const name of Object.keys(listed)) {
+            if (!Object.hasOwn(locked, name))
+                return refused(`the cut-down package.json has ${name}, which its lockfile doesn't`);
+        }
+    }
+    return { kind: 'ok' };
+}
+function pnpmDocuments(text) {
+    const docs = parseAllDocuments(text);
+    if (!Array.isArray(docs) || docs.some((doc) => doc.errors.length > 0))
+        return undefined;
+    return docs.map((doc) => record(doc.toJS()));
+}
+/** A snapshot key or version, without its peer and patch suffixes. */
+function stem(value) {
+    const paren = value.indexOf('(');
+    return paren === -1 ? value : value.slice(0, paren);
+}
+// ---------------------------------------------------------------------
+// npm
+// ---------------------------------------------------------------------
+/** The flags the cut-down lockfile recomputes for its own tree. */
+const NPM_FLAGS = ['dev', 'optional', 'devOptional', 'peer'];
+function checkNpm(check, manifest) {
+    let app;
+    let cut;
+    try {
+        app = record(JSON.parse(check.lockfile));
+        cut = record(JSON.parse(check.reduced));
+    }
+    catch {
+        return refused("a lockfile isn't JSON");
+    }
+    if (app.lockfileVersion !== cut.lockfileVersion)
+        return refused('its lockfileVersion differs');
+    const appEntries = record(app.packages);
+    const without = (entry) => Object.fromEntries(Object.entries(record(entry)).filter(([field]) => !NPM_FLAGS.includes(field)));
+    for (const [path, entry] of Object.entries(record(cut.packages))) {
+        if (path === '')
+            continue;
+        // A pack in a workspace member: its own nested packages move to the root's node_modules.
+        const candidates = [path, ...(check.packRel === '' ? [] : [`${check.packRel}/${path}`])];
+        const match = candidates.find((candidate) => Object.hasOwn(appEntries, candidate) &&
+            isDeepStrictEqual(without(appEntries[candidate]), without(entry)));
+        if (match === undefined) {
+            return candidates.some((candidate) => Object.hasOwn(appEntries, candidate))
+                ? refused(`${path} differs from the app's`)
+                : refused(`it has ${path}, which the app's lockfile doesn't`);
+        }
+        if (record(entry).dev !== true && record(appEntries[match]).dev === true) {
+            return refused(`${match} is only a dev dependency of the app`);
+        }
+    }
+    const root = record(record(cut.packages)['']);
+    for (const field of ['dependencies', 'optionalDependencies', 'devDependencies']) {
+        if (!isDeepStrictEqual(record(root[field]), record(manifest[field]))) {
+            return refused(`its ${field} aren't the cut-down package.json's`);
+        }
+    }
+    return { kind: 'ok' };
+}
+// ---------------------------------------------------------------------
+// yarn 1
+// ---------------------------------------------------------------------
+function checkYarnClassic(check, manifest) {
+    const app = yarnEntries(check.lockfile);
+    const cut = yarnEntries(check.reduced);
+    const appTexts = new Set(app.map((entry) => entry.text));
+    for (const entry of cut) {
+        if (!appTexts.has(entry.text)) {
+            return app.some((ours) => ours.keys.some((key) => entry.keys.includes(key)))
+                ? refused(`${entry.keys[0]} differs from the app's`)
+                : refused(`it has ${entry.keys[0]}, which the app's lockfile doesn't`);
+        }
+    }
+    // The app's production graph: the pack project's (and, for a pack in a member, the root's) production dependencies.
+    const byKey = new Map(app.flatMap((entry) => entry.keys.map((key) => [key, entry])));
+    const manifests = check.packRel === '' ? [check.rootManifest] : [check.packManifest, check.rootManifest];
+    const production = new Set();
+    const todo = manifests.flatMap((m) => ['dependencies', 'optionalDependencies'].flatMap((field) => Object.entries(record(m[field])).map(([name, range]) => `${name}@${String(range)}`)));
+    for (let key = todo.pop(); key !== undefined; key = todo.pop()) {
+        const entry = byKey.get(key);
+        if (entry === undefined || production.has(entry))
+            continue;
+        production.add(entry);
+        todo.push(...entry.dependencies);
+    }
+    const cutKeys = new Map(cut.flatMap((entry) => entry.keys.map((key) => [key, entry])));
+    for (const field of ['dependencies', 'optionalDependencies', 'devDependencies']) {
+        for (const [name, range] of Object.entries(record(manifest[field]))) {
+            const key = `${name}@${String(range)}`;
+            const entry = cutKeys.get(key);
+            if (entry === undefined)
+                return refused(`the cut-down package.json has ${key}, which its lockfile doesn't`);
+            const ours = byKey.get(key);
+            if (field !== 'devDependencies' && (ours === undefined || !production.has(ours))) {
+                return refused(`${key} isn't in the app's production dependencies`);
+            }
+        }
+    }
+    return { kind: 'ok' };
+}
+function yarnEntries(text) {
+    const unquote = (value) => value.replace(/^"(.*)"$/, '$1');
+    return text
+        .split(/\n\s*\n/)
+        .map((chunk) => chunk.split('\n').filter((line) => line !== '' && !line.startsWith('#')))
+        .filter((lines) => lines[0] !== undefined && !lines[0].startsWith(' '))
+        .map((lines) => ({
+        text: lines.join('\n'),
+        keys: (lines[0] ?? '')
+            .replace(/:$/, '')
+            .split(/,\s*/)
+            .map((key) => unquote(key.trim())),
+        dependencies: lines
+            .filter((line) => line.startsWith('    '))
+            .map((line) => /^\s+("[^"]+"|\S+)\s+(.+)$/.exec(line))
+            .filter((match) => match !== null)
+            .map((match) => `${unquote(match[1] ?? '')}@${unquote(match[2] ?? '')}`),
+    }));
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function refused(message) {
+    return { kind: 'refused', message };
+}
+//# sourceMappingURL=loaded-install-check.js.map

package/dist/build/loaded-install-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loaded-install-check.js","sourceRoot":"","sources":["../../src/build/loaded-install-check.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAuBzC,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,IAAI,QAAc,CAAC;IACnB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpC,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACnC,KAAK,MAAM;YACT,OAAO,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,OAAO;AACP,wEAAwE;AAExE,SAAS,SAAS,CAAC,KAA2B,EAAE,QAAc;IAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1F,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC,OAAO,GAAG,yBAAyB,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;gBAC3B,OAAO,OAAO,CAAC,GAAG,OAAO,QAAQ,GAAG,oCAAoC,CAAC,CAAC;YAC5E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;gBACtC,OAAO,OAAO,CAAC,GAAG,OAAO,IAAI,GAAG,yBAAyB,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,OAAO,CAAC,mBAAmB,KAAK,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC;IACpF,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE,CACtD,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,MAAyB,EAAe,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAChF,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CACzC,CACF,CACF,CAAC;QACF,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,EAAE,CAAC;gBAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;oBACnE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,cAAc,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS;gBACxC,OAAO,OAAO,CAAC,GAAG,IAAI,gDAAgD,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,OAAO,CACZ,KAAK,KAAK,iBAAiB;oBACzB,CAAC,CAAC,GAAG,GAAG,sCAAsC;oBAC9C,CAAC,CAAC,GAAG,GAAG,6CAA6C,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;gBAC9B,OAAO,OAAO,CAAC,iCAAiC,IAAI,8BAA8B,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,sEAAsE;AACtE,SAAS,IAAI,CAAC,KAAa;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,wEAAwE;AACxE,MAAM;AACN,wEAAwE;AAExE,mEAAmE;AACnE,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;AAE7D,SAAS,QAAQ,CAAC,KAA2B,EAAE,QAAc;IAC3D,IAAI,GAAS,CAAC;IACd,IAAI,GAAS,CAAC;IACd,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,KAAc,EAAQ,EAAE,CACvC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC9E,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,yFAAyF;QACzF,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAC3B,CAAC,SAAS,EAAE,EAAE,CACZ,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC;YACpC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CACpE,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;gBACzE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,yBAAyB,CAAC;gBAC3C,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,oCAAoC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,OAAO,CAAC,OAAO,KAAK,qCAAqC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS;AACT,wEAAwE;AAExE,SAAS,gBAAgB,CAAC,KAA2B,EAAE,QAAc;IACnE,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1E,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBACpD,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,oHAAoH;IACpH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAU,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GACb,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAa,CAAC;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CACpF,CACF,CAAC;IACF,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3D,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAU,CAAC,CAAC,CAAC,CAAC;IAChG,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAChF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,KAAK,SAAS;gBACrB,OAAO,OAAO,CAAC,iCAAiC,GAAG,8BAA8B,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,iBAAiB,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjF,OAAO,OAAO,CAAC,GAAG,GAAG,6CAA6C,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AASD,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC3E,OAAO,IAAI;SACR,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;SACxF,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,KAAK,CAAC,MAAM,CAAC;aACb,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,YAAY,EAAE,KAAK;aAChB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACrD,MAAM,CAAC,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;aAC3D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAc;QACjB,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/build/loaded-install.d.ts

@@ -0,0 +1,78 @@
+import type { HostInstall, ImagePackageManager, ReducedInstall } from './host-install.js';
+import type { ResolvedImage } from './image-config.js';
+/** A package as the host has it installed. */
+export interface HostPackage {
+    readonly name: string;
+    /** Its folder's real path, relative to the install root (`node_modules/.pnpm/chalk@4.1.2/node_modules/chalk`). */
+    readonly folder: string;
+    /** Its `package.json` version. */
+    readonly version: string;
+}
+export type ReduceOutcome = {
+    readonly kind: 'reduced';
+    readonly reduced: ReducedInstall;
+} | {
+    readonly kind: 'fallback';
+    readonly reason: string;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+/** What `reduceInstall` cuts down. Pure: the caller reads the files and the host's folders. */
+export interface ReduceInputs {
+    readonly manager: ImagePackageManager;
+    /** The pack folder relative to the install root (`''` at the root). */
+    readonly packRel: string;
+    /** The app's install files (`HostInstall.files`). */
+    readonly files: readonly string[];
+    readonly lockfile: {
+        readonly name: string;
+        readonly text: string;
+    };
+    readonly rootManifest: Manifest;
+    readonly packManifest: Manifest;
+    /** `pnpm-workspace.yaml`, when the app has one. */
+    readonly workspaceText?: string;
+    /** What the pack loads. */
+    readonly roots: readonly HostPackage[];
+    /** The build steps' tools. */
+    readonly tools: readonly HostPackage[];
+    /**
+     * yarn 1, whose lockfile has no peer dependencies: each installed
+     * package's peers (`name@version`), as the host resolves them.
+     */
+    readonly peers?: Readonly<Record<string, readonly HostPackage[]>>;
+}
+type Manifest = Readonly<Record<string, unknown>>;
+/** The command that brings node_modules back in line with the lockfile. */
+export declare function reinstallCommand(manager: ImagePackageManager): string;
+/** Cut the app's install down to the roots and what they depend on. */
+export declare function reduceInstall(inputs: ReduceInputs): ReduceOutcome;
+/** Where Node finds `name` from `fromDir`, up to the install root: its real folder and version. */
+export declare function findHostPackage(root: string, fromDir: string, name: string): Promise<HostPackage | undefined>;
+/** The installed packages, for the pack at `packDir`: what the cut-down install starts from. */
+export interface LoadedInstallOptions {
+    readonly install: HostInstall;
+    readonly packDir: string;
+    /** What the bundles import by name (`externals.json`'s packages). */
+    readonly externals: readonly string[];
+    readonly image: Pick<ResolvedImage, 'keep' | 'keepIfInstalled' | 'steps'>;
+}
+export type LoadedInstallOutcome = {
+    readonly kind: 'reduced';
+    readonly install: HostInstall;
+} | {
+    readonly kind: 'fallback';
+    readonly reason: string;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+/**
+ * With `image.dependencies: 'loaded'`: the app's install, cut down to what
+ * the pack loads, checked against the app's lockfile; or why the image
+ * takes the full install and trims it.
+ */
+export declare function loadedInstall(opts: LoadedInstallOptions): Promise<LoadedInstallOutcome>;
+export {};
+//# sourceMappingURL=loaded-install.d.ts.map

package/dist/build/loaded-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loaded-install.d.ts","sourceRoot":"","sources":["../../src/build/loaded-install.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kHAAkH;IAClH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,+FAA+F;AAC/F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC,CAAC;CACnE;AAED,KAAK,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAgBlD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAErE;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,CAyBjE;AA2qBD,mGAAmG;AACnG,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAiBlC;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,GAAG,OAAO,CAAC,CAAC;CAC3E;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6F7F"}