@preventive/upstream 1.0.0-alpha.3 → 1.0.0-alpha.5

package/src/semver.js

@@ -1,9 +1,12 @@
 import assert from 'node:assert/strict'
 import { createRequire } from 'node:module'
 import { basename, dirname, resolve } from 'node:path'
+import requirePeer from './semver-peer.cjs'
 
 // npm's own semver, borrowed from the npm next to node rather than added
-// as a dependency: the same implementation `npm audit` uses.
+// as a dependency: the same implementation `npm audit` uses. Where there is
+// no npm, as in a bundled serverless function, the `semver` package itself,
+// an optional peer dependency.
 
 // Plain releases that semver.valid answers unchanged, so it need not be
 // loaded for them: no leading zeros, and at most 15 digits a part, under
@@ -11,26 +14,37 @@ import { basename, dirname, resolve } from 'node:path'
 // to semver.
 const PLAIN_RELEASE = /^(?:0|[1-9]\d{0,14})\.(?:0|[1-9]\d{0,14})\.(?:0|[1-9]\d{0,14})$/u
 
-let found
+// What load() returns if it is semver, or null if it is not or throws.
+function attempt(load) {
+  try {
+    const lib = load()
+    if (['compare', 'intersects', 'satisfies', 'valid', 'validRange'].every((name) => typeof lib?.[name] === 'function')) return lib
+  } catch {}
+  return null
+}
 
 function find() {
   const argv0 = process.argv[0]
   // Another host executable's `../lib` is not npm's.
-  if (!['node', 'node.exe'].includes(basename(argv0 ?? ''))) return null
-  const require = createRequire(import.meta.url)
-  // POSIX keeps npm in <prefix>/lib beside <prefix>/bin/node; Windows, beside node.exe.
-  for (const prefix of ['../lib', '.']) {
-    try {
-      const lib = require(resolve(dirname(argv0), prefix, 'node_modules/npm/node_modules/semver'))
-      if (['compare', 'intersects', 'satisfies', 'valid', 'validRange'].every((name) => typeof lib?.[name] === 'function')) return lib
-    } catch {}
+  if (['node', 'node.exe'].includes(basename(argv0 ?? ''))) {
+    // POSIX keeps npm in <prefix>/lib beside <prefix>/bin/node; Windows, beside node.exe.
+    for (const prefix of ['../lib', '.']) {
+      // Required from itself, which a bundle of any format leaves alone.
+      const path = resolve(dirname(argv0), prefix, 'node_modules/npm/node_modules/semver')
+      const lib = attempt(() => createRequire(path)(path))
+      if (lib) return lib
+    }
   }
-  return null
+  // The peer, by the plain require() a bundler follows; or, where an ESM
+  // bundle leaves it out, by node's own require() from beside the bundle.
+  return attempt(requirePeer) ?? attempt(() => createRequire(import.meta.url)('semver'))
 }
 
+let found
+
 function semver() {
   if (found === undefined) found = find()
-  assert.ok(found, 'semver: no npm beside node to borrow it from')
+  assert.ok(found, 'semver: no npm beside node to borrow it from, and the semver peer dependency is not installed')
   return found
 }
 

package/src/soldeer.js

@@ -1,16 +1,10 @@
 import assert from 'node:assert/strict'
 
-import { assertSha256, assertion, matches, show } from './args.js'
+import { assertSha256, assertSoldeerPackage, show } from './args.js'
 import { verifiedDownload } from './download.js'
 import { SOLDEER_API, SOLDEER_REVISIONS, buildUrl, request } from './http.js'
 
 const DIR = 'soldeer/zips' // No expiry: the registry refuses a version it already has.
-// Soldeer's own rule for a name: 3 to 100 of lowercase letters, digits and
-// `-`, starting with one of them or `@`, ending with a letter or digit.
-const assertName = assertion('a Soldeer package name', matches(/^(?=.{3,100}$)[@\da-z][\da-z-]*[\da-z]$/u))
-// Soldeer takes any version but an empty one. Its registry has semver
-// (`5.7.0-rc.0`, `1.0.2-solc-0.8-simulate`), bare numbers and commit hashes.
-const assertVersion = assertion('letters, digits, `.`, `_`, `+` and `-`', matches(/^(?=.{1,128}$)[\dA-Za-z][\w.+-]*$/u))
 
 // Where the registry keeps the version's zip; it says nothing of what the
 // zip hashes to.
@@ -26,8 +20,7 @@ async function zipUrl(name, version) {
 // The registry has no hash to check a zip against, so the caller brings
 // one, as soldeer.lock records it.
 export async function getZip(name, version, checksum) {
-  assertName('getZip', 'name', name)
-  assertVersion('getZip', 'version', version)
+  assertSoldeerPackage('getZip', name, version)
   assertSha256('getZip', 'checksum', checksum)
   return await verifiedDownload({ method: 'getZip', dir: DIR, what: `${name}@${version}`, ext: 'zip', algorithm: 'sha256', expected: checksum, locate: () => zipUrl(name, version) })
 }

package/src/tree.js

@@ -28,7 +28,7 @@ const octal = (header, start, end) => {
   const text = field(header, start, end).trim()
   return /^[0-7]{1,12}$/u.test(text) ? Number.parseInt(text, 8) : Number.NaN
 }
-const objectId = (type, content) => createHash('sha1').update(`${type} ${content.length}\0`).update(content).digest()
+export const objectId = (type, content) => createHash('sha1').update(`${type} ${content.length}\0`).update(content).digest()
 const checksum = (header) => header.reduce((sum, byte, i) => sum + (i >= 148 && i < 156 ? 32 : byte), 0)
 const isZero = (bytes) => bytes.every((byte) => byte === 0)
 
@@ -64,9 +64,9 @@ function emptyDirs(dir, prefix = '') {
 // Git sorts a subtree as if its name ended in `/`.
 function treeId(dir) {
   const entries = [...dir].map(([name, entry]) => (entry instanceof Map ? { mode: '40000', name, id: treeId(entry) } : { ...entry, name }))
-  const key = ({ mode, name }) => (mode === '40000' ? `${name}/` : name)
-  entries.sort((a, b) => (key(a) < key(b) ? -1 : Number(key(a) > key(b))))
-  return objectId('tree', Buffer.concat(entries.flatMap(({ mode, name, id }) => [Buffer.from(`${mode} ${name}\0`, 'latin1'), id])))
+  const keyed = entries.map((entry) => [entry.mode === '40000' ? `${entry.name}/` : entry.name, entry])
+  keyed.sort(([a], [b]) => (a < b ? -1 : Number(a > b)))
+  return objectId('tree', Buffer.concat(keyed.flatMap(([, { mode, name, id }]) => [Buffer.from(`${mode} ${name}\0`, 'latin1'), id])))
 }
 
 const EMPTY_TREE = objectId('tree', Buffer.alloc(0)).toString('hex')
@@ -90,11 +90,10 @@ async function holdsNothing(sha, listed) {
 // names any, and one is put back only once its own listings show it holds
 // nothing.
 async function putBackEmptyTrees(dir, sha, listed) {
-  if (treeId(dir).toString('hex') === sha) return
   for (const entry of await listed(sha)) {
     if (entry.type !== 'tree') continue
     const here = dir.get(entry.name)
-    if (here instanceof Map) await putBackEmptyTrees(here, entry.sha, listed)
+    if (here instanceof Map && treeId(here).toString('hex') !== entry.sha) await putBackEmptyTrees(here, entry.sha, listed)
     else if (here === undefined && await holdsNothing(entry.sha, listed)) dir.set(entry.name, subtree(entry.sha))
   }
 }
@@ -177,6 +176,8 @@ export async function gitTreeOfTarball(gzipped, { expected, list } = {}) {
     if (!isSha1(sha)) return `no tree: an empty directory, ${JSON.stringify(path)}, and no submodule there`
     dir.set(name, { mode: '160000', id: Buffer.from(sha, 'hex') })
   }
+  const id = treeId(root).toString('hex')
+  if (id === expected) return id
   await putBackEmptyTrees(root, expected, listed)
   return treeId(root).toString('hex')
 }