@nimbus-sh/worker 0.9.0 → 0.11.0

package/dist/npm/cache.js

@@ -1,5 +1,5 @@
 /**
- * npm-cache.ts — SQLite-backed package cache for Nimbus npm v2.
+ * npm/cache.ts — SQLite-backed package cache for Nimbus npm v2.
  *
  * Four tables:
  *   1. pkg_registry_cache — packument metadata (avoids re-fetching full JSON)
@@ -18,6 +18,7 @@
  *   Hit = row(s) returned with size > 0; miss = empty result set. Callers
  *   fall through to L2/L3/L4 on miss.
  */
+import { placementName } from './placement.js';
 import { recordHit as _l1RecordHit, recordMiss as _l1RecordMiss } from '@nimbus-sh/core/_shared/cache-stats.js';
 // ── NpmCache ────────────────────────────────────────────────────────────
 export class NpmCache {
@@ -233,7 +234,7 @@ export class NpmCache {
         return { written, failed };
     }
     // ── Lockfile ──────────────────────────────────────────────────────────
-    /** Read the lockfile for a project. Returns null if not found. */
+    /** Read the lockfile for a project, keyed by placement path. Null if not found. */
     readLockfile(projectPath) {
         this.ensureSchema();
         const rows = [...this.sql.exec(`SELECT name, resolved_ver, integrity, deps_json, hoisted_path
@@ -242,8 +243,9 @@ export class NpmCache {
             return null;
         const result = new Map();
         for (const r of rows) {
-            result.set(String(r.name), {
-                name: String(r.name),
+            const placement = String(r.name);
+            result.set(placement, {
+                name: placementName(placement),
                 resolvedVer: String(r.resolved_ver),
                 integrity: String(r.integrity),
                 depsJson: String(r.deps_json),
@@ -252,6 +254,18 @@ export class NpmCache {
         }
         return result;
     }
+    /**
+     * Every installed package directory (namespace key, no leading slash) and
+     * the integrity its tarball was pinned to, across projects.
+     */
+    installedIntegrities() {
+        this.ensureSchema();
+        const out = new Map();
+        for (const r of this.sql.exec(`SELECT hoisted_path, integrity FROM pkg_lockfile WHERE integrity <> ''`)) {
+            out.set(String(r.hoisted_path).replace(/^\/+/, ''), String(r.integrity));
+        }
+        return out;
+    }
     /** Write/overwrite the lockfile for a project. Atomic via transaction. */
     writeLockfile(projectPath, entries, ctx) {
         this.ensureSchema();
@@ -267,14 +281,14 @@ export class NpmCache {
             // Clear existing lockfile for this project
             this.sql.exec(`DELETE FROM pkg_lockfile WHERE project_path = ?`, projectPath);
             // Batch insert: DO SQLite ~100 var limit. 6 cols → max 16 rows (16×6=96).
-            const entryList = [...entries.values()];
+            const entryList = [...entries];
             const BATCH = 16;
             for (let i = 0; i < entryList.length; i += BATCH) {
                 const batch = entryList.slice(i, i + BATCH);
                 const placeholders = batch.map(() => '(?,?,?,?,?,?)').join(',');
                 const values = [];
-                for (const e of batch) {
-                    values.push(projectPath, e.name, e.resolvedVer, e.integrity, e.depsJson, e.hoistedPath);
+                for (const [placement, e] of batch) {
+                    values.push(projectPath, placement, e.resolvedVer, e.integrity, e.depsJson, e.hoistedPath);
                 }
                 this.sql.exec(`INSERT INTO pkg_lockfile (project_path, name, resolved_ver, integrity, deps_json, hoisted_path) VALUES ${placeholders}`, ...values);
             }

package/dist/npm/install-batch-facet.d.ts

@@ -7,7 +7,7 @@
  * ONE dynamic worker per pool slot. With concurrency=4, that's 4 permanent
  * loader entries in workerd's loader cache (each `loader.get(id, …)` call
  * is cached by id and the cache is never released — confirmed in
- * src/loaders/loader-pool.ts). Combine with:
+ * packages/fabric/src/isolate-pool.ts). Combine with:
  *   - resolver-facet pool: 1 loader entry
  *   - fetch-proxy: 1 loader entry
  *   - pre-bundle pool: 1 effective entry
@@ -19,7 +19,7 @@
  * The fix: ONE facet for the whole install batch. The facet receives
  * the full FacetPackageSpec[] and loops internally with pLimit(3),
  * producing 1 loader entry instead of 4. Same architectural shape as
- * src/npm-resolve-facet.ts — proven to work in production (commit 9194998).
+ * src/npm/resolve-facet.ts — proven to work in production (commit 9194998).
  *
  * The shared producer wave pre-flushes before 4 MiB or 128 paths. One
  * oversize file may occupy a wave by itself; the supervisor's weighted
@@ -49,6 +49,8 @@ export interface InstallBatchSpec {
 export interface InstallBatchPerPackage {
     name: string;
     version: string;
+    /** The spec's identity: one version may land at two directories. Absent from pre-placement shards. */
+    pkgDir?: string;
     fileCount: number;
     bytesWritten: number;
     elapsed: number;

package/dist/npm/install-batch-facet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-batch-facet.d.ts","sourceRoot":"","sources":["../../src/npm/install-batch-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAShF,MAAM,WAAW,gBAAgB;IAC/B;mDAC+C;IAC/C,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB;uFACmF;IACnF,aAAa,EAAE;QACb,iBAAiB,EAAE,MAAM,CAAC;QAC1B,sBAAsB,EAAE,MAAM,CAAC;QAC/B,YAAY,EAAE,MAAM,CAAC;QACrB;;uDAE+C;QAC/C,wBAAwB,EAAE,MAAM,CAAC;QACjC,0BAA0B,EAAE,MAAM,CAAC;QACnC;;;0DAGkD;QAClD,WAAW,EAAE,MAAM,CAAC;QACpB,kBAAkB,EAAE,MAAM,CAAC;QAC3B;;;;qEAI6D;QAC7D,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;;;;OAUG;IACH,eAAe,EAAE,KAAK,CAClB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC9E;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,SAAS,CAAA;KAAE,CACnE,CAAC;CACH;AAUD,eAAO,MAAM,sBAAsB,GACjC,OAAO,gBAAgB,EACvB,KAAK;IACH,UAAU,EAAE;QAIV,gBAAgB,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAK1F,gBAAgB,CAAC,EAAE,CACjB,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;YACX,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;YACzB,MAAM,EAAE,KAAK,CACT;gBAAE,IAAI,EAAE,KAAK,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAA;aAAE,GAC/D;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,CACpD,CAAC;SACH,CAAC,CAAC;QACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC7F,CAAC;CACH,KACA,OAAO,CAAC,kBAAkB,CAs1B5B,CAAC"}
+{"version":3,"file":"install-batch-facet.d.ts","sourceRoot":"","sources":["../../src/npm/install-batch-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAShF,MAAM,WAAW,gBAAgB;IAC/B;mDAC+C;IAC/C,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB;uFACmF;IACnF,aAAa,EAAE;QACb,iBAAiB,EAAE,MAAM,CAAC;QAC1B,sBAAsB,EAAE,MAAM,CAAC;QAC/B,YAAY,EAAE,MAAM,CAAC;QACrB;;uDAE+C;QAC/C,wBAAwB,EAAE,MAAM,CAAC;QACjC,0BAA0B,EAAE,MAAM,CAAC;QACnC;;;0DAGkD;QAClD,WAAW,EAAE,MAAM,CAAC;QACpB,kBAAkB,EAAE,MAAM,CAAC;QAC3B;;;;qEAI6D;QAC7D,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;;;;OAUG;IACH,eAAe,EAAE,KAAK,CAClB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC9E;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,SAAS,CAAA;KAAE,CACnE,CAAC;CACH;AAUD,eAAO,MAAM,sBAAsB,GACjC,OAAO,gBAAgB,EACvB,KAAK;IACH,UAAU,EAAE;QAIV,gBAAgB,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAK1F,gBAAgB,CAAC,EAAE,CACjB,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;YACX,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;YACzB,MAAM,EAAE,KAAK,CACT;gBAAE,IAAI,EAAE,KAAK,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAA;aAAE,GAC/D;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,CACpD,CAAC;SACH,CAAC,CAAC;QACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC7F,CAAC;CACH,KACA,OAAO,CAAC,kBAAkB,CAo2B5B,CAAC"}

package/dist/npm/install-batch-facet.js

@@ -7,7 +7,7 @@
  * ONE dynamic worker per pool slot. With concurrency=4, that's 4 permanent
  * loader entries in workerd's loader cache (each `loader.get(id, …)` call
  * is cached by id and the cache is never released — confirmed in
- * src/loaders/loader-pool.ts). Combine with:
+ * packages/fabric/src/isolate-pool.ts). Combine with:
  *   - resolver-facet pool: 1 loader entry
  *   - fetch-proxy: 1 loader entry
  *   - pre-bundle pool: 1 effective entry
@@ -19,7 +19,7 @@
  * The fix: ONE facet for the whole install batch. The facet receives
  * the full FacetPackageSpec[] and loops internally with pLimit(3),
  * producing 1 loader entry instead of 4. Same architectural shape as
- * src/npm-resolve-facet.ts — proven to work in production (commit 9194998).
+ * src/npm/resolve-facet.ts — proven to work in production (commit 9194998).
  *
  * The shared producer wave pre-flushes before 4 MiB or 128 paths. One
  * oversize file may occupy a wave by itself; the supervisor's weighted
@@ -66,7 +66,7 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
     const SPECULATIVE_FETCH_DELAY_MS = 75;
     const concurrency = Math.max(1, Math.min(batch.concurrency ?? 3, 8));
     // ── pLimit (inlined; preamble doesn't carry a limiter helper) ────────
-    // Identical semantics to src/npm-resolver.ts:31-50 / src/npm-resolve-facet.ts.
+    // Waiting package tasks enter in arrival order.
     let active = 0;
     const queue = [];
     const limit = (fn) => {
@@ -363,6 +363,11 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
         });
         sharedBufferedBytes += additionalBytes;
     });
+    // A tarball placed twice in this shard is acquired once: the first owner
+    // publishes its bytes here, later owners of the URL wait for them. `null`
+    // means it had nothing to share and the waiter acquires on its own.
+    // Owners register on entry, so no waiter blocks an unstarted owner.
+    const tarballBytesByUrl = new Map();
     // ── Per-package install (inlined fetchAndStagePackage logic) ─────────
     //
     // Kept inline because cloudflare-parallel serializes this whole function
@@ -374,6 +379,19 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
         inFlight++;
         if (inFlight > inFlightPeak)
             inFlightPeak = inFlight;
+        let publishTarballBytes = () => { };
+        let sharedBytes = null;
+        const owner = tarballBytesByUrl.get(spec.tarballUrl);
+        if (owner) {
+            sharedBytes = await owner;
+        }
+        else {
+            tarballBytesByUrl.set(spec.tarballUrl, new Promise((rs) => { publishTarballBytes = rs; }));
+        }
+        // [W4] Compressed bytes for R2 write-back, captured by the integrity
+        // tee below (null without integrity); published to duplicates on exit.
+        let capturedTgzBytes = null;
+        let r2HitBytes = sharedBytes;
         // [W4] 1a. R2 cache lookup, hedged by the network fetch.
         //
         // The R2 GET is bounded by R2_RACE_TIMEOUT_MS. That bound guards against a
@@ -393,7 +411,7 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
         // supervisor deployment) the R2 leg becomes a noop and there is nothing to
         // overlap with, so no hedge is armed — the retry loop's own first fetch is
         // already the first thing that happens.
-        const r2Available = typeof env.SUPERVISOR.getCachedTarball === 'function';
+        const r2Available = sharedBytes === null && typeof env.SUPERVISOR.getCachedTarball === 'function';
         const r2WaitStart = Date.now();
         const r2P = r2Available
             ? Promise.race([
@@ -438,13 +456,6 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
             hedgeAbort.abort();
         };
         try {
-            // [W4] Captured compressed bytes for write-back to R2 on miss.
-            // Populated by the integrity-tee path below; remains null when
-            // integrity isn't present (rare; we only writeback when we can
-            // verify on next read). Hoisted to installOne scope per W4-plan
-            // §11 finding #4 lifecycle correctness.
-            let capturedTgzBytes = null;
-            let r2HitBytes = null;
             // Acquisition span, measured from the first cache probe to the moment
             // the tarball body is in hand.
             let tarballElapsedMs = 0;
@@ -501,10 +512,12 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
                 // Cache HIT. The cross-tenant store is content-addressed and
                 // re-hashes on every read, so bytes that come back are already
                 // proven to be spec.integrity's tarball — there is exactly one
-                // verification point and it is not here.
+                // verification point and it is not here. Bytes shared by another
+                // placement were verified by their owner; not an R2 outcome.
                 discardPendingNetwork();
                 tarballElapsedMs = Date.now() - r2WaitStart;
-                pipelinedTarballRaceWins++;
+                if (!sharedBytes)
+                    pipelinedTarballRaceWins++;
                 tarballsCompleted++;
                 cumulativeBytesDecoded += r2HitBytes.length;
                 // Synthesize a Response body from the R2 bytes so the existing
@@ -556,14 +569,14 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
                 }
                 if (!resp) {
                     return {
-                        name: spec.name, version: spec.version,
+                        name: spec.name, version: spec.version, pkgDir: spec.pkgDir,
                         fileCount: 0, bytesWritten: 0, elapsed: Date.now() - t0, warnings,
                         errorText: `fetch failed: ${lastErr?.message || String(lastErr)}`,
                     };
                 }
                 if (!resp.ok) {
                     return {
-                        name: spec.name, version: spec.version,
+                        name: spec.name, version: spec.version, pkgDir: spec.pkgDir,
                         fileCount: 0, bytesWritten: 0, elapsed: Date.now() - t0, warnings,
                         errorText: `HTTP ${resp.status}`,
                     };
@@ -571,7 +584,7 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
                 const body = resp.body;
                 if (!body) {
                     return {
-                        name: spec.name, version: spec.version,
+                        name: spec.name, version: spec.version, pkgDir: spec.pkgDir,
                         fileCount: 0, bytesWritten: 0, elapsed: Date.now() - t0, warnings,
                         errorText: 'no response body',
                     };
@@ -767,7 +780,7 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
                 }
             }
             return {
-                name: spec.name, version: spec.version,
+                name: spec.name, version: spec.version, pkgDir: spec.pkgDir,
                 fileCount: totalFileInodes, bytesWritten: totalBytesWritten,
                 elapsed: Date.now() - t0, warnings,
                 tarballSource: r2HitBytes ? 'cache' : 'registry',
@@ -776,7 +789,7 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
         }
         catch (e) {
             return {
-                name: spec.name, version: spec.version,
+                name: spec.name, version: spec.version, pkgDir: spec.pkgDir,
                 fileCount: 0, bytesWritten: 0, elapsed: Date.now() - t0, warnings,
                 errorText: e?.message || String(e),
             };
@@ -784,6 +797,7 @@ export const installPackagesInFacet = async function installPackagesInFacet(batc
         finally {
             // No-op once the retry loop has taken it; closes every early return.
             discardPendingNetwork();
+            publishTarballBytes(capturedTgzBytes ?? r2HitBytes);
             inFlight = Math.max(0, inFlight - 1);
         }
     };

package/dist/npm/installer.d.ts

@@ -1,5 +1,5 @@
 /**
- * npm-installer.ts — Unified npm installer for Nimbus.
+ * npm/installer.ts — Unified npm installer for Nimbus.
  *
  * Designed for bun/pnpm-level performance on Cloudflare DO + SQLite.
  *
@@ -88,9 +88,11 @@ export declare class NpmInstaller {
     install(projectDir: string, opts?: {
         packages?: string[];
         production?: boolean;
+        fromLockfile?: boolean;
         pid?: number;
         npmLog?: NpmLogEmitter;
         onProgress?: (msg: string) => void;
+        registry?: string;
     }): Promise<NpmInstallResult>;
     private _installInner;
     /**
@@ -103,8 +105,13 @@ export declare class NpmInstaller {
      *   width <  IN_DO_THRESHOLD (5)  → in-DO fanout in-DO loader-pool
      *   width >= IN_DO_THRESHOLD       → peer-DO fanout peer-DO (sibling NimbusSession DOs)
      *
+     * Resolution is per edge, not per name: the first version of a name goes
+     * to root; a later edge the nearest visible placement does not satisfy
+     * nests a copy under its dependent, never higher (placement.ts; live case
+     * in tests/unit/npm-install-nested-conflict.mjs).
+     *
      * The supervisor still owns:
-     *   - cycle detection (`seen`),
+     *   - placement (`placed` / `pending` / `settled`, by placement path),
      *   - X.5-F top-level / required-peer policy,
      *   - X.5-G G1 optional-native silent-skip,
      *   - X.5-drizzle best-effort tagging on optional-peer subtrees,
@@ -155,6 +162,13 @@ export declare class NpmInstaller {
      * W6: apply the PACKAGE_ABI_POLICY swap rewrites and reject deny list
      * to a top-level spec map. Emits `[swap]` notices via onProgress.
      *
+     * A swap rewrites the spec's RANGE to an npm alias of the swap target
+     * (`esbuild` → `npm:esbuild-wasm@<range>`), never its key: the key names
+     * the install directory, so `resolved`, node_modules, the bin links, the
+     * lockfile and package.json all keep the name the user declared. The
+     * resolver facet treats the alias as authoritative and does not announce
+     * the swap a second time.
+     *
      * G2: rejects are advisories — a listed package stays in the spec map
      * and installs like any other (npm parity: it cannot run here, but
      * install is the wrong place to say so). Each gets one `[npm] note:`
@@ -171,8 +185,14 @@ export declare class NpmInstaller {
      */
     private isLockfileValid;
     /**
-     * Convert a lockfile back to resolved packages (for cache restore).
+     * npm ci: the placements package-lock.json (or npm-shrinkwrap.json)
+     * records, checked against package.json first. The ABI policy the resolver
+     * applies still holds: platform-native optional shards are skipped, a
+     * required one is refused, and a swapped package resolves its swap target
+     * at the locked version.
      */
+    private treeFromPackageLock;
+    /** Convert a lockfile back to resolved packages: root by name, nested by placement path. */
     private lockfileToResolved;
     /**
      * Write lockfile to SQLite.

package/dist/npm/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/npm/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,SAAS,EAGV,MAAM,mCAAmC,CAAC;AAM3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,QAAQ,EAAsB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAEiC,KAAK,OAAO,EACnD,MAAM,eAAe,CAAC;AAGvB,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,2DAA2D,CAAC;AASnE,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AA2DvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAiCD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAID,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,OAAO,CAAwB;IACvC,mFAAmF;IACnF,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAiC;IAC5C,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAsB;IACrC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAA2B;gBAGvC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,UAAU,CAAC,EAAE,kBAAkB,CAAC;QAChC,GAAG,CAAC,EAAE,kBAAkB,CAAC;QACzB,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACnC,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB;IAaH,4EAA4E;IAC5E,IAAI,QAAQ,IAAI,QAAQ,CAAuB;IAI/C;;;;;OAKG;IACG,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;KACpC,GACA,OAAO,CAAC,gBAAgB,CAAC;YAuBd,aAAa;IAyV3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,oBAAoB;IAoXlC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,kBAAkB;YAyNlB,UAAU;IAwDxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IA2BvB;;OAEG;IACH,OAAO,CAAC,eAAe;IA+CvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAqC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;OAEG;YACW,QAAQ;YA4DR,kBAAkB;IAehC,OAAO,CAAC,iBAAiB;IAuCzB;;;;;;;;;;OAUG;YACW,oBAAoB;IAkiBlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,eAAe;IAgFvB;;OAEG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAsD/B,2EAA2E;IAC3E,OAAO,CAAC,kBAAkB;IAI1B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,0BAA0B;CAenC"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/npm/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,SAAS,EAGV,MAAM,mCAAmC,CAAC;AAM3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,QAAQ,EAAsB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAEiC,KAAK,OAAO,EACnD,MAAM,eAAe,CAAC;AAKvB,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,2DAA2D,CAAC;AAUnE,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AA2DvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAoCD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAID,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,OAAO,CAAwB;IACvC,mFAAmF;IACnF,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAiC;IAC5C,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAsB;IACrC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAA2B;gBAGvC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,UAAU,CAAC,EAAE,kBAAkB,CAAC;QAChC,GAAG,CAAC,EAAE,kBAAkB,CAAC;QACzB,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACnC,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB;IAaH,4EAA4E;IAC5E,IAAI,QAAQ,IAAI,QAAQ,CAAuB;IAI/C;;;;;OAKG;IACG,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,gBAAgB,CAAC;YAuBd,aAAa;IAgX3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;YACW,oBAAoB;IAialC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,kBAAkB;YA2NlB,UAAU;IAwDxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,eAAe;IA2BvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgDvB;;;;;;OAMG;YACW,mBAAmB;IAoHjC,4FAA4F;IAC5F,OAAO,CAAC,kBAAkB;IAkC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;YACW,QAAQ;YA4DR,kBAAkB;IAehC,OAAO,CAAC,iBAAiB;IA8BzB;;;;;;;;;;OAUG;YACW,oBAAoB;IAkiBlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,eAAe;IAgFvB;;OAEG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAsD/B,2EAA2E;IAC3E,OAAO,CAAC,kBAAkB;IAI1B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,0BAA0B;CAenC"}