@preventive/upstream 1.0.0-alpha.1 → 1.0.0-alpha.10

package/src/npm/repos.js

@@ -1,20 +1,28 @@
 import assert from 'node:assert/strict'
 
-import { assertArgs, assertBoolean, assertPackageName, assertRepo, isRepo, optional, show } from '../args.js'
+import { assertNames, assertPackageName, assertion, isRepo } from '../args.js'
 import { readRecord, writeRecord } from '../cache.js'
-import { NPM_REGISTRY, buildUrl, isNotFound, recover, request } from '../http.js'
+import { isNotFound, recover } from '../http.js'
 import { assertRepoDirectory, getRepo, isRepoDirectory } from '../package.js'
 import { pool } from '../pool.js'
+import { getDocument } from './registry.js'
 
 const DIR = 'npm/repos'
 const CONCURRENCY = 8
+// Stamped on each entry, and raised when getRepo would answer differently:
+// 2 is `repository` taking precedence over `bugs`; 3 the shorthand dropping
+// a `.git`, URLs read past whitespace, and `repository.directory`'s `\` read
+// as `/`.
+const VERSION = 3
+
+// A slug a lookup gives: getRepo answers no repo ending in `.git`, the
+// suffix it drops (withoutDotGit; `.GIT` it keeps, and so does this).
+const isLookedUpRepo = (github) => isRepo(github) && !github.endsWith('.git')
+// A write takes no slug a read would discard: whatever it writes reads back.
+const assertLookedUpRepo = assertion('"owner/name" with no trailing ".git"', isLookedUpRepo)
 
 // `latest`, not the full packument, which is megabytes of version history.
-async function fetchRepo(method, name) {
-  const json = await request(buildUrl(NPM_REGISTRY, [...name.split('/'), 'latest']), { as: 'json' })
-  assert.ok(json?.name === name, `${method}: the registry answered for ${show(json?.name)}, not ${name}`)
-  return getRepo(json)
-}
+const fetchRepo = async (method, name) => getRepo(await getDocument(method, name, 'latest'))
 
 export async function getGitHub(name) {
   assertPackageName('getGitHub', 'name', name)
@@ -23,12 +31,15 @@ export async function getGitHub(name) {
   return link
 }
 
-// An entry without `directory` predates the field: a miss, not a package
-// at the repo root.
+// An entry under another VERSION was resolved by other rules, and may
+// name a repo getRepo no longer would (a stale tracker's, or a shorthand's
+// with its `.git`): a miss, as is one naming a repo or a directory no
+// lookup gives, or without `directory`, which would read as a package at
+// the repo root.
 export async function readPackageRepoCache(name) {
   assertPackageName('readPackageRepoCache', 'name', name)
   const entry = await readRecord(DIR, name)
-  if (!isRepo(entry?.github) || !isRepoDirectory(entry.directory)) return null
+  if (entry?.v !== VERSION || !isLookedUpRepo(entry.github) || !isRepoDirectory(entry.directory)) return null
   return { github: entry.github, ...(entry.directory && { directory: entry.directory }) }
 }
 
@@ -36,16 +47,13 @@ export async function readPackageRepoCache(name) {
 // no repo link fail alike.
 export async function writePackageRepoCache(name, github, directory = '') {
   assertPackageName('writePackageRepoCache', 'name', name)
-  assertRepo('writePackageRepoCache', 'github', github)
+  assertLookedUpRepo('writePackageRepoCache', 'github', github)
   assertRepoDirectory('writePackageRepoCache', 'directory', directory)
-  return await writeRecord(DIR, name, { github, directory })
+  return await writeRecord(DIR, name, { v: VERSION, github, directory })
 }
 
 export async function resolvePackageRepos(packageNames, options = {}) {
-  assert.ok(typeof packageNames?.[Symbol.iterator] === 'function' && typeof packageNames !== 'string', 'resolvePackageRepos: packageNames must be an iterable of names')
-  assertArgs('resolvePackageRepos', options, { cachedOnly: optional(assertBoolean) })
-  const names = [...new Set(packageNames)]
-  for (const name of names) assertPackageName('resolvePackageRepos', 'name', name)
+  const names = assertNames('resolvePackageRepos', 'packageNames', packageNames, options, assertPackageName)
   const found = await pool(names, CONCURRENCY, (name) => (options.cachedOnly ? readPackageRepoCache(name) : lookUpPackageRepo(name)).catch(() => null))
   return new Map(names.flatMap((name, i) => (found[i] ? [[name, found[i]]] : [])))
 }

package/src/npm/tarball.js

@@ -3,9 +3,10 @@ import { Buffer } from 'node:buffer'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 
-import { assertArgs, assertPackageName, assertPackageVersion, assertion, matches, show } from '../args.js'
+import { assertArgs, assertPackage, assertion, matches, show } from '../args.js'
 import { verifiedDownload } from '../download.js'
-import { NPM_REGISTRY, buildUrl, request } from '../http.js'
+import { NPM_REGISTRY, buildUrl } from '../http.js'
+import { getDocument, withNpmToken } from './registry.js'
 
 const DIR = 'npm/tarballs' // No expiry: the registry never takes a version twice.
 // One sha512 and nothing else, as the registry writes it: a sha1, a second
@@ -13,11 +14,6 @@ const DIR = 'npm/tarballs' // No expiry: the registry never takes a version twic
 // last character before `==` two bits, so only A, Q, g or w is canonical.
 const assertIntegrity = assertion('"sha512-" and a base64 sha512', matches(/^sha512-[\dA-Za-z+/]{85}[AQgw]==$/u))
 
-function assertPackage(method, name, version) {
-  assertPackageName(method, 'name', name)
-  assertPackageVersion(method, 'version', version)
-}
-
 // `{ tarball, integrity }` and nothing else, the tarball exactly the
 // registry's own URL for that version. Each field is read once, and only
 // as the object's own, into a copy that is checked and used from then on:
@@ -34,8 +30,8 @@ function checkedDist(method, name, version, dist) {
 }
 
 async function getDist(method, name, version) {
-  const json = await request(buildUrl(NPM_REGISTRY, [...name.split('/'), version]), { as: 'json' })
-  assert.ok(json?.name === name && json.version === version, `${method}: the registry answered for ${show(json?.name)}@${show(json?.version)}, not ${name}@${version}`)
+  const json = await getDocument(method, name, version)
+  assert.ok(json.version === version, `${method}: the registry answered for ${name}@${show(json.version)}, not ${name}@${version}`)
   return checkedDist(method, name, version, { tarball: json.dist?.tarball, integrity: json.dist?.integrity })
 }
 
@@ -75,5 +71,5 @@ export async function verifyDist(name, version, dist) {
 export async function getTarball(name, version, dist) {
   assertPackage('getTarball', name, version)
   const { tarball, integrity } = dist === undefined ? await getDist('getTarball', name, version) : checkedDist('getTarball', name, version, dist)
-  return await verifiedDownload({ method: 'getTarball', dir: DIR, what: `${name}@${version}`, ext: 'tgz', algorithm: 'sha512', expected: integrity, local: localPaths(name, version, integrity), locate: () => tarball })
+  return await verifiedDownload({ method: 'getTarball', dir: DIR, what: `${name}@${version}`, ext: 'tgz', algorithm: 'sha512', expected: integrity, local: localPaths(name, version, integrity), ours: true, locate: () => tarball, options: withNpmToken(name, tarball) })
 }

package/src/package.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict'
 
 import { assertion, isRepo, isRepoPath, sameName } from './args.js'
-import { githubRepoOfUrl } from './remote.js'
+import { githubRepoOfUrl, withoutDotGit } from './remote.js'
 
 const bugsRegex = /^(?i:https?:\/\/github\.com)(?::\d{1,5})?\/(?<repo>[\w-]+\/[\w.-]+)\/issues\/?$/u
 // npm's `owner/name` shorthand means GitHub. No dots in the owner, so a
@@ -11,9 +11,12 @@ const shorthandRegex = /^(?:github:)?(?<repo>[\w-]+\/[\w.-]+)$/u
 // The ref is one segment: a branch with a `/` reads as part of the directory.
 const homepageRegex = /^(?:https?:\/\/)?(?:www\.)?github\.com(?::\d{1,5})?\/(?<repo>[\w-]+\/[\w.-]+?)(?:\.git)?(?:\/(?:tree\/[^/]+(?:\/(?<directory>.*))?)?)?$/iu
 const str = (value) => (typeof value === 'string' ? value : '')
-const urlOf = (field) => str(field?.url ?? field)
+// Read past the whitespace around it, as `homepage` is.
+const urlOf = (field) => str(field?.url ?? field).trim()
 const homepageUrl = (homepage) => str(homepage).trim().split(/[?#]/u)[0] // npm appends `#readme`.
-const repoIn = (regex, text) => regex.exec(text)?.groups.repo
+// Every trailing `.git` dropped, as the URLs' are: no answer ends in one
+// (the npm repo cache refuses one).
+const repoIn = (regex, text) => withoutDotGit(regex.exec(text)?.groups.repo)
 // A URL's path spells a tree path percent-encoded; one that does not decode names none.
 function decodePath(path = '') {
   try {
@@ -33,6 +36,11 @@ function repoSubdirectory(value) {
   return isRepoPath(path) ? path : undefined // No empty, `.`, `..` or `.git` part: a path inside the repo.
 }
 
+// `repository.directory` is a path its author may write with Windows' `\`.
+// A tree path is `/`-separated: a `\` is a name's own only in a homepage's
+// (`%5C`), which is the path itself.
+const declaredDirectory = (value) => repoSubdirectory(str(value).replaceAll('\\', '/'))
+
 export const isRepoDirectory = (value) => typeof value === 'string' && (value === '' || repoSubdirectory(value) === value)
 export const assertRepoDirectory = assertion('a path inside the repository', isRepoDirectory)
 
@@ -41,9 +49,12 @@ export function getRepo(pkg) {
   const { bugs, repository } = pkg
   const declared = repositoryRepo(urlOf(repository))
   const homepage = homepageRegex.exec(homepageUrl(pkg.homepage))?.groups
-  const github = [repoIn(bugsRegex, urlOf(bugs)), declared, homepage?.repo].find(isRepo)
+  const homepageRepo = withoutDotGit(homepage?.repo)
+  // `repository` first: it is the field a publisher maintains, where a
+  // `bugs` tracker can be left pointing at a former owner or misspelt.
+  const github = [declared, repoIn(bugsRegex, urlOf(bugs)), homepageRepo].find(isRepo)
   if (github === undefined) return {}
-  const directory = (sameName(declared, github) && repoSubdirectory(repository?.directory))
-    || (sameName(homepage?.repo, github) && repoSubdirectory(decodePath(homepage.directory)))
+  const directory = (sameName(declared, github) && declaredDirectory(repository?.directory))
+    || (sameName(homepageRepo, github) && repoSubdirectory(decodePath(homepage.directory)))
   return { github, ...(directory && { directory }), url: `https://github.com/${github}` }
 }

package/src/remote.js

@@ -7,9 +7,16 @@ import { isRepo } from './args.js'
 const gitUrlRegex = /^(?i:(?:git\+)?(?:https?|git|ssh)):\/\/(?:[\w.~%!$&'()*+,;=:-]*@)?(?i:github\.com)(?::\d{1,5})?\/(?<repo>[\w-]+\/[\w.-]+?)(?:\.git)?\/?$/u
 const scpRegex = /^(?i:git\+ssh:\/\/)?git@(?i:github\.com):(?<repo>[\w-]+\/[\w.-]+?)(?:\.git)?$/u
 
+// A repo with every trailing `.git` dropped, so none ends in one: in a loop,
+// as a regex would backtrack over a long run of them in a crafted URL.
+export function withoutDotGit(repo) {
+  while (repo?.endsWith('.git')) repo = repo.slice(0, -4)
+  return repo
+}
+
 export function githubRepoOfUrl(url) {
   if (typeof url !== 'string') return undefined
   const onGitHub = URL.parse(url.replace(/^git\+/iu, ''))?.hostname.toLowerCase() === 'github.com'
-  const repo = scpRegex.exec(url)?.groups.repo ?? (onGitHub ? gitUrlRegex.exec(url)?.groups.repo : undefined)
+  const repo = withoutDotGit(scpRegex.exec(url)?.groups.repo ?? (onGitHub ? gitUrlRegex.exec(url)?.groups.repo : undefined))
   return isRepo(repo) ? repo : undefined
 }

package/src/semver-peer.cjs

@@ -0,0 +1,8 @@
+'use strict'
+
+// The semver peer dependency by a plain require(), which a bundler follows
+// and bundles: CommonJS for that alone. In an ESM bundle that leaves semver
+// out, this require() is the bundler's stub, which throws.
+module.exports = function requirePeer() {
+  return require('semver')
+}

package/src/semver.js

@@ -1,9 +1,12 @@
 import assert from 'node:assert/strict'
 import { createRequire } from 'node:module'
 import { basename, dirname, resolve } from 'node:path'
+import requirePeer from './semver-peer.cjs'
 
 // npm's own semver, borrowed from the npm next to node rather than added
-// as a dependency: the same implementation `npm audit` uses.
+// as a dependency: the same implementation `npm audit` uses. Where there is
+// no npm, as in a bundled serverless function, the `semver` package itself,
+// an optional peer dependency.
 
 // Plain releases that semver.valid answers unchanged, so it need not be
 // loaded for them: no leading zeros, and at most 15 digits a part, under
@@ -11,26 +14,37 @@ import { basename, dirname, resolve } from 'node:path'
 // to semver.
 const PLAIN_RELEASE = /^(?:0|[1-9]\d{0,14})\.(?:0|[1-9]\d{0,14})\.(?:0|[1-9]\d{0,14})$/u
 
-let found
+// What load() returns if it is semver, or null if it is not or throws.
+function attempt(load) {
+  try {
+    const lib = load()
+    if (['compare', 'intersects', 'satisfies', 'valid', 'validRange'].every((name) => typeof lib?.[name] === 'function')) return lib
+  } catch {}
+  return null
+}
 
 function find() {
   const argv0 = process.argv[0]
   // Another host executable's `../lib` is not npm's.
-  if (!['node', 'node.exe'].includes(basename(argv0 ?? ''))) return null
-  const require = createRequire(import.meta.url)
-  // POSIX keeps npm in <prefix>/lib beside <prefix>/bin/node; Windows, beside node.exe.
-  for (const prefix of ['../lib', '.']) {
-    try {
-      const lib = require(resolve(dirname(argv0), prefix, 'node_modules/npm/node_modules/semver'))
-      if (['compare', 'intersects', 'satisfies', 'valid', 'validRange'].every((name) => typeof lib?.[name] === 'function')) return lib
-    } catch {}
+  if (['node', 'node.exe'].includes(basename(argv0 ?? ''))) {
+    // POSIX keeps npm in <prefix>/lib beside <prefix>/bin/node; Windows, beside node.exe.
+    for (const prefix of ['../lib', '.']) {
+      // Required from itself, which a bundle of any format leaves alone.
+      const path = resolve(dirname(argv0), prefix, 'node_modules/npm/node_modules/semver')
+      const lib = attempt(() => createRequire(path)(path))
+      if (lib) return lib
+    }
   }
-  return null
+  // The peer, by the plain require() a bundler follows; or, where an ESM
+  // bundle leaves it out, by node's own require() from beside the bundle.
+  return attempt(requirePeer) ?? attempt(() => createRequire(import.meta.url)('semver'))
 }
 
+let found
+
 function semver() {
   if (found === undefined) found = find()
-  assert.ok(found, 'semver: no npm beside node to borrow it from')
+  assert.ok(found, 'semver: no npm beside node to borrow it from, and the semver peer dependency is not installed')
   return found
 }
 
@@ -40,3 +54,5 @@ export const intersects = (...args) => semver().intersects(...args)
 export const compareVersions = (...args) => semver().compare(...args)
 export const valid = (version, ...rest) => (rest.length === 0 && typeof version === 'string' && PLAIN_RELEASE.test(version) ? version : semver().valid(version, ...rest))
 export const isExactVersion = (version) => typeof version === 'string' && valid(version) === version
+export const clean = (...args) => semver().clean(...args)
+export const major = (...args) => semver().major(...args)

package/src/soldeer.js

@@ -1,16 +1,10 @@
 import assert from 'node:assert/strict'
 
-import { assertSha256, assertion, matches, show } from './args.js'
+import { assertSha256, assertSoldeerPackage, show } from './args.js'
 import { verifiedDownload } from './download.js'
 import { SOLDEER_API, SOLDEER_REVISIONS, buildUrl, request } from './http.js'
 
 const DIR = 'soldeer/zips' // No expiry: the registry refuses a version it already has.
-// Soldeer's own rule for a name: 3 to 100 of lowercase letters, digits and
-// `-`, starting with one of them or `@`, ending with a letter or digit.
-const assertName = assertion('a Soldeer package name', matches(/^(?=.{3,100}$)[@\da-z][\da-z-]*[\da-z]$/u))
-// Soldeer takes any version but an empty one. Its registry has semver
-// (`5.7.0-rc.0`, `1.0.2-solc-0.8-simulate`), bare numbers and commit hashes.
-const assertVersion = assertion('letters, digits, `.`, `_`, `+` and `-`', matches(/^(?=.{1,128}$)[\dA-Za-z][\w.+-]*$/u))
 
 // Where the registry keeps the version's zip; it says nothing of what the
 // zip hashes to.
@@ -26,8 +20,7 @@ async function zipUrl(name, version) {
 // The registry has no hash to check a zip against, so the caller brings
 // one, as soldeer.lock records it.
 export async function getZip(name, version, checksum) {
-  assertName('getZip', 'name', name)
-  assertVersion('getZip', 'version', version)
+  assertSoldeerPackage('getZip', name, version)
   assertSha256('getZip', 'checksum', checksum)
   return await verifiedDownload({ method: 'getZip', dir: DIR, what: `${name}@${version}`, ext: 'zip', algorithm: 'sha256', expected: checksum, locate: () => zipUrl(name, version) })
 }

package/src/tree.js

@@ -0,0 +1,237 @@
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+import { gunzipSync } from 'node:zlib'
+
+import { isSha1, matches } from './args.js'
+import { withAttributes, writtenWithCrlf } from './attributes.js'
+
+const BLOCK = 512
+const MAX_UNPACKED_BYTES = 2 ** 30
+// Only what git writes is read: anything else, a pax `size` or a mode of
+// 0000, would be extracted as it is not hashed. Modes are as its umask,
+// 002 or 022, leaves them: a file 0664 or 0644, 0775 or 0755 executable;
+// a directory 0775 or 0755; a symlink 0777.
+const PAX_KEYS = new Set(['path', 'linkpath'])
+const MODES = { 0: [0o664, 0o644, 0o775, 0o755], 2: [0o777], 5: [0o775, 0o755] }
+// The top directory is not hashed, so it is held to GitHub's name for it,
+// owner-repo-id: another, `..\..`, `C:` or a Windows device such as
+// `con.txt`, could take an extractor elsewhere.
+const isTop = matches(/^(?!(?:con|prn|aux|nul|com\d|lpt\d)(?:\.|$))[\da-z][\w.-]*$/iu)
+
+// Names are kept as latin1 strings, a char per byte, so they sort and hash
+// as the bytes git has.
+const field = (header, start, end) => {
+  const bytes = header.subarray(start, end)
+  const nul = bytes.indexOf(0)
+  return Buffer.from(nul === -1 ? bytes : bytes.subarray(0, nul)).toString('latin1')
+}
+const octal = (header, start, end) => {
+  const text = field(header, start, end).trim()
+  return /^[0-7]{1,12}$/u.test(text) ? Number.parseInt(text, 8) : Number.NaN
+}
+export const objectId = (type, content) => createHash('sha1').update(`${type} ${content.length}\0`).update(content).digest()
+const checksum = (header) => header.reduce((sum, byte, i) => sum + (i >= 148 && i < 156 ? 32 : byte), 0)
+const isZero = (bytes) => bytes.every((byte) => byte === 0)
+
+// `<length> <key>=<value>\n`, the length counting the whole record. A NUL
+// would end a path for an extractor, and a name in a tree for git.
+function paxRecords(body) {
+  const text = Buffer.from(body).toString('latin1')
+  const records = new Map()
+  for (let at = 0; at < text.length;) {
+    const space = text.indexOf(' ', at)
+    const length = text.slice(at, space)
+    const end = at + Number(length)
+    if (!/^[1-9]\d*$/u.test(length) || end > text.length || text[end - 1] !== '\n') return null
+    const record = text.slice(space + 1, end - 1)
+    const equals = record.indexOf('=')
+    if (equals < 1 || record.includes('\0')) return null
+    records.set(record.slice(0, equals), record.slice(equals + 1))
+    at = end
+  }
+  return records
+}
+
+// Git keeps no empty directory: in a tarball, one is a submodule. Each as
+// [the directory holding it, its name, its path].
+function emptyDirs(dir, prefix = '') {
+  return [...dir].flatMap(([name, entry]) => {
+    if (!(entry instanceof Map)) return []
+    const path = `${prefix}${name}`
+    return entry.size === 0 ? [[dir, name, path]] : emptyDirs(entry, `${path}/`)
+  })
+}
+
+// Git sorts a subtree as if its name ended in `/`.
+function treeId(dir) {
+  const entries = [...dir].map(([name, entry]) => (entry instanceof Map ? { mode: '40000', name, id: treeId(entry) } : { ...entry, name }))
+  const keyed = entries.map((entry) => [entry.mode === '40000' ? `${entry.name}/` : entry.name, entry])
+  keyed.sort(([a], [b]) => (a < b ? -1 : Number(a > b)))
+  return objectId('tree', Buffer.concat(keyed.flatMap(([, { mode, name, id }]) => [Buffer.from(`${mode} ${name}\0`, 'latin1'), id])))
+}
+
+const EMPTY_TREE = objectId('tree', Buffer.alloc(0)).toString('hex')
+const isName = matches(/^[^\0/]+$/u)
+const isEntry = (entry) => isName(entry?.path) && isSha1(entry.sha)
+const nameOf = (path) => Buffer.from(path).toString('latin1')
+const subtree = (sha) => ({ mode: '40000', id: Buffer.from(sha, 'hex') })
+
+// A subtree with nothing in it but subtrees like it, down to the empty
+// tree: its listing, read as subtrees alone, hashes to its id.
+async function holdsNothing(sha, listed) {
+  if (sha === EMPTY_TREE) return true
+  const entries = await listed(sha)
+  if (treeId(new Map(entries.map((entry) => [entry.name, subtree(entry.sha)]))).toString('hex') !== sha) return false
+  for (const entry of entries) if (!await holdsNothing(entry.sha, listed)) return false
+  return true
+}
+
+const CHUNK = 64 * 1024
+
+// The id of the blob that `eol=crlf`, a CR written before each LF with
+// none, writes out as these bytes: theirs with each LF's CR taken out,
+// hashed a chunk at a time, the bytes only read. Null where no blob writes
+// them so: an LF with no CR before it, a CR before that CR, or no LF at
+// all. Most files are passed over at their first LF, a binary one with
+// none at once.
+function crlfBlobId(written) {
+  const first = written.indexOf(0x0a)
+  if (first < 1 || written[first - 1] !== 0x0d) return null
+  let lfs = 0
+  for (let i = first; i < written.length; i++) {
+    if (written[i] !== 0x0a) continue
+    if (written[i - 1] !== 0x0d || written[i - 2] === 0x0d) return null
+    lfs++
+  }
+  const hash = createHash('sha1').update(`blob ${written.length - lfs}\0`)
+  const chunk = Buffer.allocUnsafe(CHUNK)
+  let at = 0
+  for (let i = 0; i < written.length; i++) {
+    if (written[i] === 0x0d && written[i + 1] === 0x0a) continue
+    chunk[at++] = written[i]
+    if (at === CHUNK) {
+      hash.update(chunk)
+      at = 0
+    }
+  }
+  return hash.update(chunk.subarray(0, at)).digest()
+}
+
+// Where a directory's id is not the one listed, its listing names what
+// `git archive` wrote otherwise, as a checkout writes it. A subtree with no
+// file in it, which only plumbing makes, it leaves out: one is put back
+// only once its own listings show it holds nothing. A file marked
+// `eol=crlf` it writes with CRLF where git has LF: one is hashed as the
+// blob listed, its bytes left as written, where that blob writes them and
+// the tree's .gitattributes have git write it so.
+async function mend(dir, sha, listed, base = '', above = []) {
+  const own = dir.get('.gitattributes')
+  const attributes = withAttributes(above, base, own && (own.body ?? null))
+  for (const entry of await listed(sha)) {
+    const here = dir.get(entry.name)
+    if (entry.type === 'tree') {
+      if (here instanceof Map && treeId(here).toString('hex') !== entry.sha) await mend(here, entry.sha, listed, `${base}${entry.name}/`, attributes)
+      else if (here === undefined && await holdsNothing(entry.sha, listed)) dir.set(entry.name, subtree(entry.sha))
+    } else if (entry.type === 'blob' && here?.body && here.id.toString('hex') !== entry.sha
+      && crlfBlobId(here.body)?.toString('hex') === entry.sha && writtenWithCrlf(attributes, `${base}${entry.name}`, here.body)) {
+      dir.set(entry.name, { ...here, id: Buffer.from(entry.sha, 'hex') })
+    }
+  }
+}
+
+// The id of the git tree a gzipped tarball holds, as `git archive` writes
+// one, under a single top directory: a file's mode is its exec bit, a
+// symlink's blob its target. What a tarball cannot show comes from `list`,
+// which answers a listing of a tree by its id, as GitHub's trees API does
+// ({ type, path, sha } entries), walked from `expected`: a submodule's
+// commit for an empty directory, and, where the id comes out otherwise, the
+// subtrees with nothing in them it leaves out and the blobs of the files it
+// wrote with CRLF for `eol=crlf`. The id is `expected` only if those are
+// right. Where there is no such tree, a reason, never an id.
+export async function gitTreeOfTarball(gzipped, { expected, list } = {}) {
+  let bytes
+  try {
+    bytes = gunzipSync(gzipped, { maxOutputLength: MAX_UNPACKED_BYTES })
+  } catch {
+    return 'no tree: not gzip, or larger than 1 GiB unpacked'
+  }
+  const root = new Map()
+  let top
+  let pax = null
+  for (let at = 0; ;) {
+    const header = bytes.subarray(at, at + BLOCK)
+    if (header.length < BLOCK) return 'no tree: the tarball is cut short'
+    if (isZero(header)) {
+      if (!isZero(bytes.subarray(at))) return 'no tree: data after the end of the tarball'
+      break
+    }
+    if (Buffer.from(header.subarray(257, 265)).toString('latin1') !== 'ustar\u000000') return 'no tree: a header that is not POSIX ustar'
+    if (octal(header, 148, 156) !== checksum(header)) return 'no tree: a header that fails its checksum'
+    const size = octal(header, 124, 136)
+    const body = bytes.subarray(at + BLOCK, at + BLOCK + size)
+    if (body.length !== size) return 'no tree: the tarball is cut short'
+    at += BLOCK + Math.ceil(size / BLOCK) * BLOCK
+    const type = String.fromCodePoint(header[156])
+    if (type === 'x') {
+      const records = paxRecords(body)
+      if (records === null) return 'no tree: a malformed pax header'
+      const other = [...records.keys()].find((key) => !PAX_KEYS.has(key))
+      if (other !== undefined) return `no tree: a pax record git does not write, ${JSON.stringify(other)}`
+      if (pax !== null) return 'no tree: two pax headers for one entry'
+      pax = records
+      continue
+    }
+    const prefix = field(header, 345, 500)
+    const path = pax?.get('path') ?? (prefix ? `${prefix}/${field(header, 0, 100)}` : field(header, 0, 100))
+    const target = pax?.get('linkpath') ?? field(header, 157, 257)
+    pax = null
+    if (!Object.hasOwn(MODES, type)) return `no tree: an entry of type ${JSON.stringify(type)}`
+    const mode = octal(header, 100, 108)
+    const asGitWrites = MODES[type].includes(mode) && (type === '0' || size === 0) && path.endsWith('/') === (type === '5')
+      && octal(header, 108, 116) === 0 && octal(header, 116, 124) === 0 && field(header, 265, 297) === 'root' && field(header, 297, 329) === 'root'
+    if (!asGitWrites) return `no tree: a header git does not write, ${JSON.stringify(path)}`
+    const [first, ...parts] = path.replace(/\/$/u, '').split('/')
+    top ??= first
+    const name = type === '5' ? null : parts.pop()
+    if (!isTop(first) || first !== top || name === undefined || [...parts, name].some((part) => ['', '.', '..'].includes(part))) return `no tree: an entry outside one top directory, ${JSON.stringify(path)}`
+    let dir = root
+    for (const part of parts) {
+      if (!dir.has(part)) dir.set(part, new Map())
+      dir = dir.get(part)
+      if (!(dir instanceof Map)) return `no tree: a file where a directory is, ${JSON.stringify(path)}`
+    }
+    if (name === null) continue
+    if (dir.has(name)) return `no tree: ${JSON.stringify(path)} twice`
+    dir.set(name, type === '0' ? { mode: mode & 0o100 ? '100755' : '100644', id: objectId('blob', body), body } : { mode: '120000', id: objectId('blob', Buffer.from(target, 'latin1')) })
+  }
+  if (top === undefined) return 'no tree: an empty tarball'
+  const listed = async (sha) => (list && isSha1(sha) ? await list(sha) : [])
+    .filter(isEntry)
+    .map((entry) => ({ ...entry, name: nameOf(entry.path) }))
+  for (const [dir, name, path] of emptyDirs(root)) {
+    let sha = expected
+    const parts = path.split('/')
+    for (const [i, part] of parts.entries()) {
+      const type = i === parts.length - 1 ? 'commit' : 'tree'
+      sha = (await listed(sha)).find((entry) => entry.type === type && entry.name === part)?.sha
+    }
+    if (!isSha1(sha)) return `no tree: an empty directory, ${JSON.stringify(path)}, and no submodule there`
+    dir.set(name, { mode: '160000', id: Buffer.from(sha, 'hex') })
+  }
+  const id = treeId(root).toString('hex')
+  if (id === expected) return id
+  await mend(root, expected, listed)
+  return treeId(root).toString('hex')
+}
+
+// GitHub lists a subtree's mode as `040000`, which git writes `40000`.
+const LISTED = new Set(['100644 blob', '100755 blob', '120000 blob', '040000 tree', '160000 commit'])
+
+// The id of the tree a listing such as GitHub's names, its entries
+// { path, mode, type, sha }, or null where one is not an entry a tree can
+// hold, or a name is there twice.
+export function gitTreeOfListing(entries) {
+  if (!entries.every((entry) => isEntry(entry) && LISTED.has(`${entry.mode} ${entry.type}`))) return null
+  const dir = new Map(entries.map(({ path, mode, sha }) => [nameOf(path), { mode: mode.replace(/^0/u, ''), id: Buffer.from(sha, 'hex') }]))
+  return dir.size === entries.length ? treeId(dir).toString('hex') : null
+}

package/src/weak-edges.js

@@ -0,0 +1,87 @@
+// Package-relative coordinates keep this inventory independent of installation
+// roots, pnpm layouts, display-prefix stripping, and graph package grouping.
+const babelConfig = { package: '@babel/core', path: /^lib\/config\//u }
+const babelPlugins = { package: '@babel/core', path: /^lib\/config\/files\/(?:module-types|plugins)\.js$/u }
+
+export const weakEdges = Object.freeze([
+  {
+    id: 'react-native-codegen-discovery',
+    reason: 'Codegen discovers package metadata and React Native configuration.',
+    from: { package: 'react-native', path: /^scripts\/codegen\/generate-artifacts-executor\.js$/u },
+    to: { path: /(?:^|\/)(?:package\.json|react-native\.config\.js)$/u },
+  },
+  {
+    id: 'react-native-release-version',
+    reason: 'The CLI release checker reads the installed React Native version.',
+    from: { package: '@react-native-community/cli-tools', path: /^build\/releaseChecker\/index\.js$/u },
+    to: { package: 'react-native', path: /^package\.json$/u },
+  },
+  {
+    id: 'react-native-platform-config',
+    reason: 'React Native configuration loads platform CLIs supplied by the host project.',
+    from: { package: 'react-native', path: /^react-native\.config\.js$/u },
+    to: { package: /^@react-native-community\/cli-platform-(?:android|ios)$/u, path: /^build\/index\.js$/u },
+  },
+  {
+    id: 'babel-project-config',
+    reason: 'Babel discovers project configuration.',
+    from: babelConfig,
+    to: { path: /(?:^|\/)babel\.config\.js$/u },
+  },
+  {
+    id: 'babel-typescript-preset',
+    reason: 'Babel configuration loads the TypeScript preset.',
+    from: babelConfig,
+    to: { package: '@babel/preset-typescript', path: /./u },
+  },
+  {
+    id: 'babel-react-native-preset',
+    reason: 'Babel config loaders load the configured React Native preset.',
+    from: babelPlugins,
+    to: { package: '@react-native/babel-preset', path: /^(?:src\/)?index\.js$/u },
+  },
+  {
+    id: 'babel-reanimated-plugin',
+    reason: 'Babel config loaders load the configured Reanimated plugin, including scoped copies.',
+    from: babelPlugins,
+    to: { package: /^(?:@[^/]+\/)?react-native-reanimated$/u, path: /^plugin\/index\.js$/u },
+  },
+  {
+    id: 'babel-transform-plugin',
+    reason: 'Babel config loaders load configured transform plugins.',
+    from: babelPlugins,
+    to: { package: /^@babel\/plugin-transform-[^/]+$/u, path: /^lib\/index\.js$/u },
+  },
+  {
+    id: 'cosmiconfig-config',
+    reason: 'Cosmiconfig loads discovered configuration, including dependency configuration.',
+    from: { package: 'cosmiconfig', path: /^dist\/loaders\.js$/u },
+    to: { path: /\.config\.js$/u },
+  },
+  {
+    id: 'import-fresh-own-config',
+    reason: 'import-fresh loads host-project configuration.',
+    from: { package: 'import-fresh', path: /./u },
+    to: { path: /\.config\.js$/u },
+    ownSourceOnly: true,
+  },
+].map(rule => Object.freeze({ ...rule, from: Object.freeze(rule.from), to: Object.freeze(rule.to) })))
+
+// Do not guess ownership from a partial or shortened path. A nested dependency
+// must be passed as its own package, not as node_modules/... inside its parent.
+function normalizedPath(path) {
+  return typeof path === 'string' && !path.includes('\\') && !path.includes(':')
+    && path.split('/').every(part => part !== '' && part !== '.' && part !== '..' && part !== 'node_modules')
+}
+
+function matches(selector, file) {
+  const pkg = selector.package
+  if (pkg !== undefined && file.ownSource === true) return false
+  return (pkg === undefined || (typeof pkg === 'string' ? pkg === file.package : pkg.test(file.package ?? '')))
+    && selector.path.test(file.path)
+}
+
+export function getWeakEdge(from, to) {
+  if (from?.ownSource === true || !normalizedPath(from?.path) || !normalizedPath(to?.path)) return undefined
+  return weakEdges.find(rule => (!rule.ownSourceOnly || to.ownSource === true) && matches(rule.from, from) && matches(rule.to, to))
+}