@preventive/upstream 1.0.0-alpha.4 → 1.0.0-alpha.6

package/advisories.d.ts

@@ -89,5 +89,5 @@ export interface Advisory {
 // renamed or blocked, add nothing. Any other failure, a malformed answer,
 // or one about something not asked, throws: nothing is left out quietly.
 // Sorted by ecosystem and name. Versions are matched by npm's semver, from
-// the npm beside node.
+// the npm beside node, or by the semver peer where there is no npm.
 export function advisories(packages: Iterable<Package>, options?: AdvisoryOptions): Promise<Advisory[]>

package/npm.d.ts

@@ -6,6 +6,9 @@
 // cache path, otherwise. Responses are read up to a size limit and within
 // a timeout, as github.d.ts describes, and lookups for many names go to
 // the registry eight at a time.
+//
+// Where NPM_TOKEN is set, it is sent with the requests for a scoped
+// package, so a private one can be read.
 
 // Where cached answers live, resolved when set. Unset by default, and
 // unset means no cache: every read misses and every write is skipped.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/upstream",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.6",
   "description": "Minimal npm, crates.io and Soldeer registry clients, a GitHub client, and a git checkout reader: the calls we use, nothing more",
   "type": "module",
   "exports": {
@@ -78,11 +78,13 @@
     "src/github/read.js",
     "src/github/write.js",
     "src/http.js",
+    "src/npm/registry.js",
     "src/npm/repos.js",
     "src/npm/tarball.js",
     "src/package.js",
     "src/pool.js",
     "src/remote.js",
+    "src/semver-peer.cjs",
     "src/semver.js",
     "src/tree.js",
     "src/soldeer.js"
@@ -110,5 +112,13 @@
   "homepage": "https://github.com/PreventiveMeasures/libraries/tree/main/upstream",
   "publishConfig": {
     "access": "public"
+  },
+  "peerDependencies": {
+    "semver": "^7.5.2"
+  },
+  "peerDependenciesMeta": {
+    "semver": {
+      "optional": true
+    }
   }
 }

package/semver.d.ts

@@ -1,7 +1,8 @@
 // Hand-written against semver.js; a change to either belongs with the other.
 
 // npm's own semver, borrowed from the npm beside node and passed through
-// as it is. Without it, every call throws, except valid() on a plain
+// as it is; where there is no npm, the `semver` package, an optional peer
+// dependency. Without either, every call throws, except valid() on a plain
 // MAJOR.MINOR.PATCH with no options.
 export function satisfies(version: string, range: string, options?: { includePrerelease?: boolean; loose?: boolean }): boolean
 export function compareVersions(a: string, b: string, options?: { loose?: boolean }): -1 | 0 | 1

package/src/advisories/index.js

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict'
 
-import { assertArgs, assertBoolean, assertRepo, assertion, optional, sameName } from '../args.js'
+import { assertArgs, assertBoolean, assertRepo, assertion, isIterable, optional, sameName } from '../args.js'
 import { order } from './common.js'
 import { GITHUB, SOLDEER, assertClient } from './github.js'
 import { NPM } from './npm.js'
@@ -14,7 +14,7 @@ const assertVersions = assertion('a non-empty array', (value) => Array.isArray(v
 // Ecosystem → name → { versions, github? }, a name given twice merged.
 // Every package is checked before any is used.
 function collect(packages) {
-  assert.ok(typeof packages?.[Symbol.iterator] === 'function' && typeof packages !== 'string', 'advisories: packages must be an iterable of { ecosystem, name, github?, versions }')
+  assert.ok(isIterable(packages), 'advisories: packages must be an iterable of { ecosystem, name, github?, versions }')
   const byEcosystem = new Map()
   for (const pkg of packages) {
     assertArgs('advisories', pkg, { ecosystem: assertEcosystem, name: null, github: optional(assertRepo), versions: assertVersions }, 'package')

package/src/advisories/repos.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict'
 
-import { isRepo, show } from '../args.js'
-import { readRecord, writeRecord } from '../cache.js'
+import { show } from '../args.js'
+import { addRepos, readRepos } from '../cache.js'
 import { lookUpCrateRepos } from '../cargo/repos.js'
 import { PACKAGIST_REPO, SOLDEER_API, buildUrl, isNotFound, recover, request } from '../http.js'
 import { lookUpPackageRepo } from '../npm/repos.js'
@@ -14,16 +14,8 @@ const PACKAGES_AT_ONCE = 8
 // or it names no GitHub repo; any other failure throws. Only a repo found
 // is cached, for a month.
 async function cachedRepos(dir, names, fetchMissing) {
-  const repos = new Map()
-  for (const name of names) {
-    const entry = await readRecord(dir, name)
-    if (isRepo(entry?.github)) repos.set(name, entry.github)
-  }
-  const missing = names.filter((name) => !repos.has(name))
-  for (const [name, github] of await fetchMissing(missing)) {
-    repos.set(name, github)
-    if (github) await writeRecord(dir, name, { github })
-  }
+  const repos = await readRepos(dir, names)
+  await addRepos(dir, repos, await fetchMissing(names.filter((name) => !repos.has(name))))
   return repos
 }
 

package/src/args.js

@@ -39,6 +39,7 @@ export function isRepo(value) {
 }
 
 export const isStrings = (value) => Array.isArray(value) && value.every((item) => typeof item === 'string')
+export const isIterable = (value) => typeof value?.[Symbol.iterator] === 'function' && typeof value !== 'string'
 export const sameName = (a, b) => typeof a === 'string' && a.toLowerCase() === b.toLowerCase()
 export const isTagName = (value) => isString(value, 255) && !BAD_REF.test(value)
 export const isRefName = (value) => isTagName(value) && !/^(?:@$|-)/u.test(value)
@@ -55,6 +56,16 @@ export function assertArgs(method, options, spec, name) {
   for (const [key, check] of Object.entries(spec)) check?.(method, label(key), options[key])
 }
 
+// The names a resolve*Repos call is given, each checked and given once,
+// and its options.
+export function assertNames(method, what, names, options, assertName) {
+  assert.ok(isIterable(names), `${method}: ${what} must be an iterable of names`)
+  assertArgs(method, options, { cachedOnly: optional(assertBoolean) })
+  const unique = [...new Set(names)]
+  for (const name of unique) assertName(method, 'name', name)
+  return unique
+}
+
 export const assertBoolean = assertion('a boolean', (value) => typeof value === 'boolean')
 export const assertNumber = assertion('a positive integer', (value) => Number.isSafeInteger(value) && value > 0)
 export const assertLine = assertion('a non-empty single line', (value) => isString(value, 1024) && value.trim() !== '')
@@ -84,5 +95,13 @@ export const assertSoldeerName = assertion('a Soldeer package name', matches(/^(
 // Soldeer takes any version but an empty one. Its registry has semver
 // (`5.7.0-rc.0`, `1.0.2-solc-0.8-simulate`), bare numbers and commit hashes.
 export const assertSoldeerVersion = assertion('letters, digits, `.`, `_`, `+` and `-`', matches(/^(?=.{1,128}$)[\dA-Za-z][\w.+-]*$/u))
+// A package's name and version, as a registry's getters take them.
+const assertNameVersion = (assertName, assertVersion) => (method, name, version) => {
+  assertName(method, 'name', name)
+  assertVersion(method, 'version', version)
+}
+export const assertCrate = assertNameVersion(assertCrateName, assertCrateVersion)
+export const assertPackage = assertNameVersion(assertPackageName, assertPackageVersion)
+export const assertSoldeerPackage = assertNameVersion(assertSoldeerName, assertSoldeerVersion)
 // As Cargo.lock and soldeer.lock write a checksum.
 export const assertSha256 = assertion('a sha256 in lowercase hex', matches(/^[\da-f]{64}$/u))

package/src/cache.js

@@ -3,7 +3,7 @@ import { constants } from 'node:fs'
 import { mkdir, open, rename, rm, writeFile } from 'node:fs/promises'
 import { dirname, join, resolve } from 'node:path'
 
-import { assertDirectoryPath } from './args.js'
+import { assertDirectoryPath, isRepo } from './args.js'
 import { MAX_BYTES, decode } from './http.js'
 
 const DIRS = new Set(['npm/repos', 'npm/tarballs', 'cargo/repos', 'cargo/crates', 'composer/repos', 'soldeer/repos', 'soldeer/zips', 'github/trees'])
@@ -93,3 +93,21 @@ export async function readRecord(dir, name) {
 }
 
 export const writeRecord = (dir, name, value) => writeCacheJSON(dir, `${name}.json`, { at: Date.now(), name, ...value })
+
+// Name → the GitHub repo cached for it, for those of `names` that have one.
+export async function readRepos(dir, names) {
+  const repos = new Map()
+  for (const name of names) {
+    const entry = await readRecord(dir, name)
+    if (isRepo(entry?.github)) repos.set(name, entry.github)
+  }
+  return repos
+}
+
+// An answer into `repos`, and into the cache where it found a repo.
+export async function addRepos(dir, repos, answer) {
+  for (const [name, github] of answer) {
+    repos.set(name, github)
+    if (github) await writeRecord(dir, name, { github })
+  }
+}

package/src/cargo/crate.js

@@ -3,7 +3,7 @@ import { readdir } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 
-import { assertCrateName, assertCrateVersion, assertSha256, printable, show } from '../args.js'
+import { assertCrate, assertSha256, printable, show } from '../args.js'
 import { verifiedDownload } from '../download.js'
 import { CRATES_INDEX, CRATES_STATIC, buildUrl, encodeSegment, request } from '../http.js'
 
@@ -37,11 +37,6 @@ async function localPaths(name, version) {
   return (await readdir(root).catch(() => [])).map((registry) => join(root, registry, `${name}-${version}.crate`))
 }
 
-function assertCrate(method, name, version) {
-  assertCrateName(method, 'name', name)
-  assertCrateVersion(method, 'version', version)
-}
-
 export async function verifyChecksum(name, version, checksum) {
   assertCrate('verifyChecksum', name, version)
   assertSha256('verifyChecksum', 'checksum', checksum)

package/src/cargo/repos.js

@@ -1,8 +1,8 @@
 import assert from 'node:assert/strict'
 import { setTimeout as sleep } from 'node:timers/promises'
 
-import { assertArgs, assertBoolean, assertCrateName, isRepo, optional, show } from '../args.js'
-import { readRecord, writeRecord } from '../cache.js'
+import { assertCrateName, assertNames, show } from '../args.js'
+import { addRepos, readRepos } from '../cache.js'
 import { CRATES_API, buildUrl, request } from '../http.js'
 import { chunks } from '../pool.js'
 import { githubRepoOfUrl } from '../remote.js'
@@ -32,11 +32,7 @@ async function askCrates(method, names) {
 // for a month. A failed request throws, or with `soft` leaves its names
 // out; `cachedOnly` asks nothing.
 export async function lookUpCrateRepos(method, names, { soft = false, cachedOnly = false } = {}) {
-  const repos = new Map()
-  for (const name of names) {
-    const entry = await readRecord(DIR, name)
-    if (isRepo(entry?.github)) repos.set(name, entry.github)
-  }
+  const repos = await readRepos(DIR, names)
   if (cachedOnly) return repos
   for (const [i, chunk] of chunks(names.filter((name) => !repos.has(name)), PER_REQUEST).entries()) {
     if (i > 0) await sleep(PACE_MS)
@@ -44,19 +40,13 @@ export async function lookUpCrateRepos(method, names, { soft = false, cachedOnly
       if (soft) return new Map()
       throw error
     })
-    for (const [name, github] of answer) {
-      repos.set(name, github)
-      if (github) await writeRecord(DIR, name, { github })
-    }
+    await addRepos(DIR, repos, answer)
   }
   return repos
 }
 
 export async function resolveCrateRepos(crateNames, options = {}) {
-  assert.ok(typeof crateNames?.[Symbol.iterator] === 'function' && typeof crateNames !== 'string', 'resolveCrateRepos: crateNames must be an iterable of names')
-  assertArgs('resolveCrateRepos', options, { cachedOnly: optional(assertBoolean) })
-  const names = [...new Set(crateNames)]
-  for (const name of names) assertCrateName('resolveCrateRepos', 'name', name)
+  const names = assertNames('resolveCrateRepos', 'crateNames', crateNames, options, assertCrateName)
   const repos = await lookUpCrateRepos('resolveCrateRepos', names, { soft: true, cachedOnly: options.cachedOnly })
   return new Map(names.flatMap((name) => (repos.get(name) ? [[name, { github: repos.get(name) }]] : [])))
 }

package/src/github/client.js

@@ -1,12 +1,11 @@
 import assert from 'node:assert/strict'
 
 import { assertArgs, assertToken, assertTokenOrNull, assertUserAgent, optional } from '../args.js'
-import { GITHUB_API, HttpError, buildUrl, request, requestWithHeaders } from '../http.js'
+import { GITHUB_API, HttpError, buildUrl, request } from '../http.js'
 
 export const api = (segments, query) => buildUrl(GITHUB_API, segments, query)
 export const repoApi = (repo, segments = [], query) => api(['repos', ...repo.split('/'), ...segments], query)
 export const call = (headers, url, options) => request(url, { as: 'json', headers, ...options })
-export const callWithHeaders = (headers, url, options) => requestWithHeaders(url, { as: 'json', headers, ...options })
 // A repository renamed (a redirect, refused), deleted or blocked, not a
 // failure that could pass.
 export const isGone = (err) => err instanceof HttpError && [301, 404, 410, 451].includes(err.status)

package/src/github/read.js

@@ -1,12 +1,11 @@
 import assert from 'node:assert/strict'
 import { Buffer } from 'node:buffer'
-import { createHash } from 'node:crypto'
 
 import { assertArgs, assertGhsa, assertLogin, assertNumber, assertPath, assertRef, assertRepo, assertSha, assertTagName, assertTreeId, isSha, isSha1, isTagName, optional, sameName, show } from '../args.js'
 import { verifiedDownload } from '../download.js'
-import { decode, encodeSegment } from '../http.js'
-import { gitTreeOfListing } from '../tree.js'
-import { api, bindMethods, call, callWithHeaders, clientHeaders, isGone, repoApi } from './client.js'
+import { decode, encodeSegment, requestWithHeaders } from '../http.js'
+import { gitTreeOfListing, objectId } from '../tree.js'
+import { api, bindMethods, call, clientHeaders, isGone, repoApi } from './client.js'
 
 const PER_PAGE = 100
 const MAX_PAGES = 100
@@ -29,7 +28,7 @@ async function* pages(method, headers, pageUrl, maxPages = MAX_PAGES) {
 async function* cursorPages(method, headers, pageUrl, maxPages = MAX_PAGES) {
   const paging = { per_page: PER_PAGE }
   for (let page = 1; ; page++) {
-    const answer = await callWithHeaders(headers, pageUrl(paging))
+    const answer = await requestWithHeaders(pageUrl(paging), { as: 'json', headers })
     assert.ok(Array.isArray(answer.body), `${method}: expected an array for page ${page}`)
     yield answer.body
     const next = /<([^>]*)>\s*;\s*rel="next"/u.exec(answer.headers.get('link') ?? '')?.[1]
@@ -107,7 +106,7 @@ async function getRepoFile(headers, options) {
   const bytes = file.encoding === 'none'
     ? await call({ ...headers, Accept: 'application/vnd.github.raw' }, repoApi(repo, ['git', 'blobs', file.sha]), { as: 'bytes' })
     : Buffer.from(file.content, 'base64')
-  const blob = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex')
+  const blob = objectId('blob', bytes).toString('hex')
   assert.ok(bytes.length === file.size && blob === file.sha, `getRepoFile: ${show(path)} came back as blob ${blob}, not ${file.sha}`)
   return decode(bytes, url)
 }

package/src/npm/registry.js

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict'
+
+import { show } from '../args.js'
+import { NPM_REGISTRY, buildUrl, request } from '../http.js'
+
+// Private packages are always scoped.
+export function withNpmToken(name, url, options = {}) {
+  const method = options.method ?? 'GET'
+  assert.ok(method === 'GET' && `${new URL(url)}` === url && url.startsWith(`${NPM_REGISTRY}/${name}/`), `Unexpected request for ${name}: ${method} ${url}`)
+  const token = process.env.NPM_TOKEN
+  return token && name.startsWith('@') ? { ...options, method, headers: { ...options.headers, Authorization: `Bearer ${token}` } } : options
+}
+
+export async function getDocument(method, name, spec) {
+  const url = buildUrl(NPM_REGISTRY, [...name.split('/'), spec])
+  const json = await request(url, withNpmToken(name, url, { as: 'json' }))
+  assert.ok(json?.name === name, `${method}: the registry answered for ${show(json?.name)}, not ${name}`)
+  return json
+}

package/src/npm/repos.js

@@ -1,20 +1,17 @@
 import assert from 'node:assert/strict'
 
-import { assertArgs, assertBoolean, assertPackageName, assertRepo, isRepo, optional, show } from '../args.js'
+import { assertNames, assertPackageName, assertRepo, isRepo } from '../args.js'
 import { readRecord, writeRecord } from '../cache.js'
-import { NPM_REGISTRY, buildUrl, isNotFound, recover, request } from '../http.js'
+import { isNotFound, recover } from '../http.js'
 import { assertRepoDirectory, getRepo, isRepoDirectory } from '../package.js'
 import { pool } from '../pool.js'
+import { getDocument } from './registry.js'
 
 const DIR = 'npm/repos'
 const CONCURRENCY = 8
 
 // `latest`, not the full packument, which is megabytes of version history.
-async function fetchRepo(method, name) {
-  const json = await request(buildUrl(NPM_REGISTRY, [...name.split('/'), 'latest']), { as: 'json' })
-  assert.ok(json?.name === name, `${method}: the registry answered for ${show(json?.name)}, not ${name}`)
-  return getRepo(json)
-}
+const fetchRepo = async (method, name) => getRepo(await getDocument(method, name, 'latest'))
 
 export async function getGitHub(name) {
   assertPackageName('getGitHub', 'name', name)
@@ -42,10 +39,7 @@ export async function writePackageRepoCache(name, github, directory = '') {
 }
 
 export async function resolvePackageRepos(packageNames, options = {}) {
-  assert.ok(typeof packageNames?.[Symbol.iterator] === 'function' && typeof packageNames !== 'string', 'resolvePackageRepos: packageNames must be an iterable of names')
-  assertArgs('resolvePackageRepos', options, { cachedOnly: optional(assertBoolean) })
-  const names = [...new Set(packageNames)]
-  for (const name of names) assertPackageName('resolvePackageRepos', 'name', name)
+  const names = assertNames('resolvePackageRepos', 'packageNames', packageNames, options, assertPackageName)
   const found = await pool(names, CONCURRENCY, (name) => (options.cachedOnly ? readPackageRepoCache(name) : lookUpPackageRepo(name)).catch(() => null))
   return new Map(names.flatMap((name, i) => (found[i] ? [[name, found[i]]] : [])))
 }

package/src/npm/tarball.js

@@ -3,9 +3,10 @@ import { Buffer } from 'node:buffer'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 
-import { assertArgs, assertPackageName, assertPackageVersion, assertion, matches, show } from '../args.js'
+import { assertArgs, assertPackage, assertion, matches, show } from '../args.js'
 import { verifiedDownload } from '../download.js'
-import { NPM_REGISTRY, buildUrl, request } from '../http.js'
+import { NPM_REGISTRY, buildUrl } from '../http.js'
+import { getDocument, withNpmToken } from './registry.js'
 
 const DIR = 'npm/tarballs' // No expiry: the registry never takes a version twice.
 // One sha512 and nothing else, as the registry writes it: a sha1, a second
@@ -13,11 +14,6 @@ const DIR = 'npm/tarballs' // No expiry: the registry never takes a version twic
 // last character before `==` two bits, so only A, Q, g or w is canonical.
 const assertIntegrity = assertion('"sha512-" and a base64 sha512', matches(/^sha512-[\dA-Za-z+/]{85}[AQgw]==$/u))
 
-function assertPackage(method, name, version) {
-  assertPackageName(method, 'name', name)
-  assertPackageVersion(method, 'version', version)
-}
-
 // `{ tarball, integrity }` and nothing else, the tarball exactly the
 // registry's own URL for that version. Each field is read once, and only
 // as the object's own, into a copy that is checked and used from then on:
@@ -34,8 +30,8 @@ function checkedDist(method, name, version, dist) {
 }
 
 async function getDist(method, name, version) {
-  const json = await request(buildUrl(NPM_REGISTRY, [...name.split('/'), version]), { as: 'json' })
-  assert.ok(json?.name === name && json.version === version, `${method}: the registry answered for ${show(json?.name)}@${show(json?.version)}, not ${name}@${version}`)
+  const json = await getDocument(method, name, version)
+  assert.ok(json.version === version, `${method}: the registry answered for ${name}@${show(json.version)}, not ${name}@${version}`)
   return checkedDist(method, name, version, { tarball: json.dist?.tarball, integrity: json.dist?.integrity })
 }
 
@@ -75,5 +71,5 @@ export async function verifyDist(name, version, dist) {
 export async function getTarball(name, version, dist) {
   assertPackage('getTarball', name, version)
   const { tarball, integrity } = dist === undefined ? await getDist('getTarball', name, version) : checkedDist('getTarball', name, version, dist)
-  return await verifiedDownload({ method: 'getTarball', dir: DIR, what: `${name}@${version}`, ext: 'tgz', algorithm: 'sha512', expected: integrity, local: localPaths(name, version, integrity), locate: () => tarball })
+  return await verifiedDownload({ method: 'getTarball', dir: DIR, what: `${name}@${version}`, ext: 'tgz', algorithm: 'sha512', expected: integrity, local: localPaths(name, version, integrity), locate: () => tarball, options: withNpmToken(name, tarball) })
 }

package/src/semver-peer.cjs

@@ -0,0 +1,8 @@
+'use strict'
+
+// The semver peer dependency by a plain require(), which a bundler follows
+// and bundles: CommonJS for that alone. In an ESM bundle that leaves semver
+// out, this require() is the bundler's stub, which throws.
+module.exports = function requirePeer() {
+  return require('semver')
+}

package/src/semver.js

@@ -1,9 +1,12 @@
 import assert from 'node:assert/strict'
 import { createRequire } from 'node:module'
 import { basename, dirname, resolve } from 'node:path'
+import requirePeer from './semver-peer.cjs'
 
 // npm's own semver, borrowed from the npm next to node rather than added
-// as a dependency: the same implementation `npm audit` uses.
+// as a dependency: the same implementation `npm audit` uses. Where there is
+// no npm, as in a bundled serverless function, the `semver` package itself,
+// an optional peer dependency.
 
 // Plain releases that semver.valid answers unchanged, so it need not be
 // loaded for them: no leading zeros, and at most 15 digits a part, under
@@ -11,26 +14,37 @@ import { basename, dirname, resolve } from 'node:path'
 // to semver.
 const PLAIN_RELEASE = /^(?:0|[1-9]\d{0,14})\.(?:0|[1-9]\d{0,14})\.(?:0|[1-9]\d{0,14})$/u
 
-let found
+// What load() returns if it is semver, or null if it is not or throws.
+function attempt(load) {
+  try {
+    const lib = load()
+    if (['compare', 'intersects', 'satisfies', 'valid', 'validRange'].every((name) => typeof lib?.[name] === 'function')) return lib
+  } catch {}
+  return null
+}
 
 function find() {
   const argv0 = process.argv[0]
   // Another host executable's `../lib` is not npm's.
-  if (!['node', 'node.exe'].includes(basename(argv0 ?? ''))) return null
-  const require = createRequire(import.meta.url)
-  // POSIX keeps npm in <prefix>/lib beside <prefix>/bin/node; Windows, beside node.exe.
-  for (const prefix of ['../lib', '.']) {
-    try {
-      const lib = require(resolve(dirname(argv0), prefix, 'node_modules/npm/node_modules/semver'))
-      if (['compare', 'intersects', 'satisfies', 'valid', 'validRange'].every((name) => typeof lib?.[name] === 'function')) return lib
-    } catch {}
+  if (['node', 'node.exe'].includes(basename(argv0 ?? ''))) {
+    // POSIX keeps npm in <prefix>/lib beside <prefix>/bin/node; Windows, beside node.exe.
+    for (const prefix of ['../lib', '.']) {
+      // Required from itself, which a bundle of any format leaves alone.
+      const path = resolve(dirname(argv0), prefix, 'node_modules/npm/node_modules/semver')
+      const lib = attempt(() => createRequire(path)(path))
+      if (lib) return lib
+    }
   }
-  return null
+  // The peer, by the plain require() a bundler follows; or, where an ESM
+  // bundle leaves it out, by node's own require() from beside the bundle.
+  return attempt(requirePeer) ?? attempt(() => createRequire(import.meta.url)('semver'))
 }
 
+let found
+
 function semver() {
   if (found === undefined) found = find()
-  assert.ok(found, 'semver: no npm beside node to borrow it from')
+  assert.ok(found, 'semver: no npm beside node to borrow it from, and the semver peer dependency is not installed')
   return found
 }
 

package/src/soldeer.js

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict'
 
-import { assertSha256, assertSoldeerName, assertSoldeerVersion, show } from './args.js'
+import { assertSha256, assertSoldeerPackage, show } from './args.js'
 import { verifiedDownload } from './download.js'
 import { SOLDEER_API, SOLDEER_REVISIONS, buildUrl, request } from './http.js'
 
@@ -20,8 +20,7 @@ async function zipUrl(name, version) {
 // The registry has no hash to check a zip against, so the caller brings
 // one, as soldeer.lock records it.
 export async function getZip(name, version, checksum) {
-  assertSoldeerName('getZip', 'name', name)
-  assertSoldeerVersion('getZip', 'version', version)
+  assertSoldeerPackage('getZip', name, version)
   assertSha256('getZip', 'checksum', checksum)
   return await verifiedDownload({ method: 'getZip', dir: DIR, what: `${name}@${version}`, ext: 'zip', algorithm: 'sha256', expected: checksum, locate: () => zipUrl(name, version) })
 }

package/src/tree.js

@@ -28,7 +28,7 @@ const octal = (header, start, end) => {
   const text = field(header, start, end).trim()
   return /^[0-7]{1,12}$/u.test(text) ? Number.parseInt(text, 8) : Number.NaN
 }
-const objectId = (type, content) => createHash('sha1').update(`${type} ${content.length}\0`).update(content).digest()
+export const objectId = (type, content) => createHash('sha1').update(`${type} ${content.length}\0`).update(content).digest()
 const checksum = (header) => header.reduce((sum, byte, i) => sum + (i >= 148 && i < 156 ? 32 : byte), 0)
 const isZero = (bytes) => bytes.every((byte) => byte === 0)
 
@@ -64,9 +64,9 @@ function emptyDirs(dir, prefix = '') {
 // Git sorts a subtree as if its name ended in `/`.
 function treeId(dir) {
   const entries = [...dir].map(([name, entry]) => (entry instanceof Map ? { mode: '40000', name, id: treeId(entry) } : { ...entry, name }))
-  const key = ({ mode, name }) => (mode === '40000' ? `${name}/` : name)
-  entries.sort((a, b) => (key(a) < key(b) ? -1 : Number(key(a) > key(b))))
-  return objectId('tree', Buffer.concat(entries.flatMap(({ mode, name, id }) => [Buffer.from(`${mode} ${name}\0`, 'latin1'), id])))
+  const keyed = entries.map((entry) => [entry.mode === '40000' ? `${entry.name}/` : entry.name, entry])
+  keyed.sort(([a], [b]) => (a < b ? -1 : Number(a > b)))
+  return objectId('tree', Buffer.concat(keyed.flatMap(([, { mode, name, id }]) => [Buffer.from(`${mode} ${name}\0`, 'latin1'), id])))
 }
 
 const EMPTY_TREE = objectId('tree', Buffer.alloc(0)).toString('hex')
@@ -90,11 +90,10 @@ async function holdsNothing(sha, listed) {
 // names any, and one is put back only once its own listings show it holds
 // nothing.
 async function putBackEmptyTrees(dir, sha, listed) {
-  if (treeId(dir).toString('hex') === sha) return
   for (const entry of await listed(sha)) {
     if (entry.type !== 'tree') continue
     const here = dir.get(entry.name)
-    if (here instanceof Map) await putBackEmptyTrees(here, entry.sha, listed)
+    if (here instanceof Map && treeId(here).toString('hex') !== entry.sha) await putBackEmptyTrees(here, entry.sha, listed)
     else if (here === undefined && await holdsNothing(entry.sha, listed)) dir.set(entry.name, subtree(entry.sha))
   }
 }
@@ -177,6 +176,8 @@ export async function gitTreeOfTarball(gzipped, { expected, list } = {}) {
     if (!isSha1(sha)) return `no tree: an empty directory, ${JSON.stringify(path)}, and no submodule there`
     dir.set(name, { mode: '160000', id: Buffer.from(sha, 'hex') })
   }
+  const id = treeId(root).toString('hex')
+  if (id === expected) return id
   await putBackEmptyTrees(root, expected, listed)
   return treeId(root).toString('hex')
 }