@qvac/sdk 0.20.1 → 0.21.1

package/dist/src/commands/verify/abi.js

@@ -70,30 +70,37 @@ export function formatConfigLabel(projectRoot, configPath) {
         return configPath;
     return rel;
 }
+export function formatRuntimeSource(runtime) {
+    return runtime.detail === undefined ? runtime.source : `${runtime.source}: ${runtime.detail}`;
+}
 export function checkAbi(options) {
-    const { addons, runtime } = options;
-    const addonsWithEngines = addons.filter((addon) => addon.enginesBare !== undefined);
-    if (addonsWithEngines.length === 0)
+    const { addons, runtime, packages = [] } = options;
+    const constrained = [
+        ...addons.map((addon) => ({
+            id: formatAddonId(addon),
+            range: addon.enginesBare,
+            isAddon: true
+        })),
+        ...packages.map((pkg) => ({ id: formatAddonId(pkg), range: pkg.enginesBare, isAddon: false }))
+    ].filter((entry) => !!entry.range);
+    if (constrained.length === 0)
         return [];
     const issues = [];
     const checkable = [];
-    for (const addon of addonsWithEngines) {
-        const range = addon.enginesBare;
-        if (!range)
-            continue;
-        if (!semver.validRange(range)) {
+    for (const entry of constrained) {
+        if (!semver.validRange(entry.range)) {
             issues.push({
                 code: 'malformed-engines-bare',
                 level: 'warning',
-                addon: formatAddonId(addon),
-                enginesBare: range,
-                message: `${formatAddonId(addon)} declares engines.bare "${range}", which is ` +
-                    'not a valid semver range. ABI check skipped for this addon. ' +
-                    'Report this to the addon maintainer.'
+                addon: entry.id,
+                enginesBare: entry.range,
+                message: `${entry.id} declares engines.bare "${entry.range}", which is ` +
+                    `not a valid semver range. ABI check skipped for this ${entry.isAddon ? 'addon' : 'package'}. ` +
+                    'Report this to the package maintainer.'
             });
             continue;
         }
-        checkable.push({ addon, range });
+        checkable.push(entry);
     }
     if (checkable.length === 0)
         return issues;
@@ -102,24 +109,39 @@ export function checkAbi(options) {
             code: 'unknown-runtime-version',
             level: 'warning',
             message: `${runtime.error.reason}. ABI checks skipped for ${checkable.length} ` +
-                `addon${checkable.length === 1 ? '' : 's'}. ` +
-                'Pass bareRuntimeVersion to enable strict ABI verification.',
+                `package${checkable.length === 1 ? '' : 's'}. ` +
+                'For mobile hosts, install react-native-bare-kit; for a desktop build, ' +
+                'install bare-runtime or pass bareRuntimeVersion.',
             triedPaths: runtime.error.triedPaths
         });
         return issues;
     }
-    for (const { addon, range } of checkable) {
-        if (semver.satisfies(runtime.runtime.version, range))
+    const { version } = runtime.runtime;
+    for (const entry of checkable) {
+        if (semver.satisfies(version, entry.range))
             continue;
-        issues.push({
-            code: 'abi-mismatch',
-            level: 'error',
-            addon: formatAddonId(addon),
-            enginesBare: range,
-            runtimeVersion: runtime.runtime.version,
-            message: `${formatAddonId(addon)} requires bare ${range}, ` +
-                `runtime is ${runtime.runtime.version} (from ${runtime.runtime.source}).`
-        });
+        const message = `${entry.id} requires bare ${entry.range}, ` +
+            `runtime is ${version} (from ${formatRuntimeSource(runtime.runtime)}).`;
+        if (entry.isAddon) {
+            issues.push({
+                code: 'abi-mismatch',
+                level: 'error',
+                addon: entry.id,
+                enginesBare: entry.range,
+                runtimeVersion: version,
+                message
+            });
+        }
+        else {
+            issues.push({
+                code: 'engines-mismatch',
+                level: 'error',
+                package: entry.id,
+                enginesBare: entry.range,
+                runtimeVersion: version,
+                message
+            });
+        }
     }
     return issues;
 }

package/dist/src/commands/verify/addon-source.d.ts

@@ -19,6 +19,19 @@ export interface AddonPackageJson {
     engines?: {
         bare?: string;
     };
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+}
+/** Any package in the collected graph, addon or not. */
+export interface PackageRecord {
+    name: string;
+    version?: string;
+    packageJsonPath: string;
+    isAddon: boolean;
+    enginesBare?: string;
+    /** Declared ranges of every dependency kind, keyed by dependency name. */
+    dependencies: Record<string, string>;
 }
 export interface ReadAddonPackageJsonOptions {
     packageJsonPath: string;
@@ -34,13 +47,22 @@ export interface ReadAddonPackageJsonResult {
     isAddon: boolean;
     invalid?: InvalidPackageJsonRecord;
     addon?: NativeAddon;
+    record?: PackageRecord;
 }
 export declare function readAddonPackageJson(options: ReadAddonPackageJsonOptions): Promise<ReadAddonPackageJsonResult>;
 export interface CollectDiagnostics {
     invalidPackageJsons: InvalidPackageJsonRecord[];
     emptyResolutions: boolean;
+    /** Every readable package the collector visited, in visit order. */
+    packages: PackageRecord[];
 }
 export declare function createCollectDiagnostics(): CollectDiagnostics;
+/**
+ * Caps concurrent filesystem calls so a large node_modules tree is read in
+ * parallel without exhausting file descriptors.
+ */
+export declare function createLimiter(max: number): <T>(task: () => Promise<T>) => Promise<T>;
+export declare const FS_CONCURRENCY = 32;
 export declare function formatAddonId(addon: {
     name: string;
     version?: string;

package/dist/src/commands/verify/addon-source.js

@@ -29,8 +29,11 @@ export async function readAddonPackageJson(options) {
         };
     }
     const pkg = parsed;
+    const record = buildRecord(pkg, packageJsonPath, expectedName);
     if (pkg.addon !== true) {
-        return { found: true, isAddon: false };
+        return record === null
+            ? { found: true, isAddon: false }
+            : { found: true, isAddon: false, record };
     }
     const name = pkg.name ?? expectedName;
     if (!name) {
@@ -49,7 +52,39 @@ export async function readAddonPackageJson(options) {
         addon.version = pkg.version;
     if (typeof pkg.engines?.bare === 'string')
         addon.enginesBare = pkg.engines.bare;
-    return { found: true, isAddon: true, addon };
+    return record === null
+        ? { found: true, isAddon: true, addon }
+        : { found: true, isAddon: true, addon, record };
+}
+function stringRecord(value) {
+    const out = {};
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return out;
+    for (const [key, range] of Object.entries(value)) {
+        if (typeof range === 'string')
+            out[key] = range;
+    }
+    return out;
+}
+function buildRecord(pkg, packageJsonPath, expectedName) {
+    const name = typeof pkg.name === 'string' ? pkg.name : expectedName;
+    if (!name)
+        return null;
+    const record = {
+        name,
+        packageJsonPath,
+        isAddon: pkg.addon === true,
+        dependencies: {
+            ...stringRecord(pkg.peerDependencies),
+            ...stringRecord(pkg.optionalDependencies),
+            ...stringRecord(pkg.dependencies)
+        }
+    };
+    if (typeof pkg.version === 'string')
+        record.version = pkg.version;
+    if (typeof pkg.engines?.bare === 'string')
+        record.enginesBare = pkg.engines.bare;
+    return record;
 }
 function buildInvalid(packageJsonPath, expectedName, reason) {
     const record = { packageJsonPath, reason };
@@ -58,8 +93,39 @@ function buildInvalid(packageJsonPath, expectedName, reason) {
     return record;
 }
 export function createCollectDiagnostics() {
-    return { invalidPackageJsons: [], emptyResolutions: false };
+    return { invalidPackageJsons: [], emptyResolutions: false, packages: [] };
+}
+/**
+ * Caps concurrent filesystem calls so a large node_modules tree is read in
+ * parallel without exhausting file descriptors.
+ */
+export function createLimiter(max) {
+    let active = 0;
+    const queue = [];
+    // A finishing task hands its slot straight to the next waiter, so a caller
+    // arriving in between cannot take it as well.
+    function release() {
+        const next = queue.shift();
+        if (next)
+            next();
+        else
+            active--;
+    }
+    async function run(task) {
+        if (active >= max)
+            await new Promise((resolve) => queue.push(resolve));
+        else
+            active++;
+        try {
+            return await task();
+        }
+        finally {
+            release();
+        }
+    }
+    return run;
 }
+export const FS_CONCURRENCY = 32;
 export function formatAddonId(addon) {
     return `${addon.name}@${addon.version ?? 'unknown'}`;
 }

package/dist/src/commands/verify/bare-kit-runtime.d.ts

@@ -0,0 +1,38 @@
+import type { BareRuntimeResolution } from './abi.js';
+export declare const REACT_NATIVE_BARE_KIT = "react-native-bare-kit";
+export declare const NETWORK_TIMEOUT_MS = 5000;
+export type FetchText = (url: string) => Promise<string>;
+export type ProgressFn = (message: string) => void;
+export interface ResolveMobileBareRuntimeOptions {
+    projectRoot: string;
+    network?: boolean | undefined;
+    onProgress?: ProgressFn | undefined;
+    fetchText?: FetchText | undefined;
+}
+export declare function isReactNativeBareKitInstalled(projectRoot: string): boolean;
+export declare function fetchText(url: string): Promise<string>;
+export declare function parseBareKitReleaseVersion(cmakeLists: string): string | null;
+export declare function parseBareVersion(cmakeLists: string): string | null;
+export declare function parseInfoPlistVersion(plist: string): string | null;
+export declare function fetchBareKitVersionFromGitHub(reactNativeBareKitVersion: string, fetch?: FetchText): Promise<string | null>;
+export declare function fetchBareVersionFromGitHub(bareKitVersion: string, fetch?: FetchText): Promise<string | null>;
+export declare function bareVersionForBareKit(bareKitVersion: string): string | null;
+/**
+ * The oldest react-native-bare-kit release newer than `currentVersion` whose
+ * embedded Bare satisfies every range, or null if the table has none.
+ */
+export declare function findReactNativeBareKitUpgrade(currentVersion: string, ranges: string[]): {
+    version: string;
+    bareKit: string;
+    bare: string;
+} | null;
+/**
+ * Bare version the app runs on mobile: the one compiled into the bare-kit
+ * binaries that react-native-bare-kit ships, not any `bare-runtime` package
+ * in node_modules.
+ *
+ * Checks the built-in table, then the installed iOS framework's Info.plist,
+ * and only then GitHub.
+ */
+export declare function resolveMobileBareRuntime(options: ResolveMobileBareRuntimeOptions): Promise<BareRuntimeResolution>;
+//# sourceMappingURL=bare-kit-runtime.d.ts.map

package/dist/src/commands/verify/bare-kit-runtime.js

@@ -0,0 +1,201 @@
+import { promises as fsp } from 'node:fs';
+import path from 'node:path';
+import semver from 'semver';
+import { BARE_KIT_BARE_VERSIONS, REACT_NATIVE_BARE_KIT_RUNTIMES } from './bare-kit-runtimes.js';
+import { findInAncestorNodeModules } from '../../expo/plugins/find-in-ancestor-node-modules.js';
+export const REACT_NATIVE_BARE_KIT = 'react-native-bare-kit';
+export const NETWORK_TIMEOUT_MS = 5000;
+const RAW_GITHUB_BASE = 'https://raw.githubusercontent.com/holepunchto';
+/**
+ * The iOS framework ships inside the npm package, and its bundle version is
+ * the bare-kit release it was built from, so it identifies the embedded
+ * runtime without a network request.
+ */
+const BARE_KIT_INFO_PLIST = path.join('ios', 'BareKit.xcframework', 'ios-arm64', 'BareKit.framework', 'Info.plist');
+export function isReactNativeBareKitInstalled(projectRoot) {
+    return findInAncestorNodeModules(projectRoot, REACT_NATIVE_BARE_KIT) !== null;
+}
+export async function fetchText(url) {
+    const response = await fetch(url, { signal: AbortSignal.timeout(NETWORK_TIMEOUT_MS) });
+    if (!response.ok)
+        throw new Error(`GET ${url} returned HTTP ${response.status}`);
+    return response.text();
+}
+export function parseBareKitReleaseVersion(cmakeLists) {
+    const match = /holepunchto\/bare-kit\/releases\/download\/v(\d+\.\d+\.\d+[^/"\s]*)\//.exec(cmakeLists);
+    return match?.[1] ?? null;
+}
+export function parseBareVersion(cmakeLists) {
+    const match = /fetch_package\(\s*"github:holepunchto\/bare@(\d+\.\d+\.\d+[^"\s]*)"/.exec(cmakeLists);
+    return match?.[1] ?? null;
+}
+export function parseInfoPlistVersion(plist) {
+    const match = /<key>CFBundleShortVersionString<\/key>\s*<string>(\d+\.\d+\.\d+[^<]*)<\/string>/.exec(plist);
+    return match?.[1] ?? null;
+}
+export async function fetchBareKitVersionFromGitHub(reactNativeBareKitVersion, fetch = fetchText) {
+    const cmakeLists = await fetch(`${RAW_GITHUB_BASE}/${REACT_NATIVE_BARE_KIT}/v${reactNativeBareKitVersion}/CMakeLists.txt`);
+    return parseBareKitReleaseVersion(cmakeLists);
+}
+export async function fetchBareVersionFromGitHub(bareKitVersion, fetch = fetchText) {
+    const cmakeLists = await fetch(`${RAW_GITHUB_BASE}/bare-kit/v${bareKitVersion}/CMakeLists.txt`);
+    return parseBareVersion(cmakeLists);
+}
+export function bareVersionForBareKit(bareKitVersion) {
+    return BARE_KIT_BARE_VERSIONS[bareKitVersion] ?? null;
+}
+function newestKey(record) {
+    const versions = Object.keys(record).filter((version) => semver.valid(version) !== null);
+    return versions.length === 0 ? null : versions.sort(semver.rcompare)[0];
+}
+/**
+ * The table generator has already probed every release up to the newest
+ * entry, so only newer releases can have data on GitHub that the table lacks.
+ */
+function isNewerThanTable(version, record) {
+    const newest = newestKey(record);
+    return newest === null || semver.valid(version) === null || semver.gt(version, newest);
+}
+/**
+ * The oldest react-native-bare-kit release newer than `currentVersion` whose
+ * embedded Bare satisfies every range, or null if the table has none.
+ */
+export function findReactNativeBareKitUpgrade(currentVersion, ranges) {
+    const candidates = Object.entries(REACT_NATIVE_BARE_KIT_RUNTIMES)
+        .filter(([version]) => semver.valid(version) !== null && semver.prerelease(version) === null)
+        .sort(([a], [b]) => semver.compare(a, b));
+    for (const [version, runtime] of candidates) {
+        if (semver.valid(currentVersion) !== null && !semver.gt(version, currentVersion))
+            continue;
+        if (ranges.every((range) => semver.satisfies(runtime.bare, range))) {
+            return { version, bareKit: runtime.bareKit, bare: runtime.bare };
+        }
+    }
+    return null;
+}
+async function readJsonVersion(packageJsonPath) {
+    try {
+        const parsed = JSON.parse(await fsp.readFile(packageJsonPath, 'utf8'));
+        return typeof parsed.version === 'string' ? parsed.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readInfoPlistVersion(packageDir) {
+    try {
+        return parseInfoPlistVersion(await fsp.readFile(path.join(packageDir, BARE_KIT_INFO_PLIST), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function resolved(version, reactNativeBareKitVersion, bareKitVersion, via) {
+    return {
+        resolved: true,
+        runtime: {
+            version,
+            source: 'react-native-bare-kit',
+            packageVersion: reactNativeBareKitVersion,
+            detail: `react-native-bare-kit@${reactNativeBareKitVersion} embeds bare-kit ${bareKitVersion}` +
+                (via === 'github' ? ', looked up on GitHub' : '')
+        }
+    };
+}
+/**
+ * Bare version the app runs on mobile: the one compiled into the bare-kit
+ * binaries that react-native-bare-kit ships, not any `bare-runtime` package
+ * in node_modules.
+ *
+ * Checks the built-in table, then the installed iOS framework's Info.plist,
+ * and only then GitHub.
+ */
+export async function resolveMobileBareRuntime(options) {
+    const { projectRoot, network = true, onProgress, fetchText: fetch = fetchText } = options;
+    const packageDir = findInAncestorNodeModules(projectRoot, REACT_NATIVE_BARE_KIT);
+    if (packageDir === null) {
+        return {
+            resolved: false,
+            error: {
+                reason: `${REACT_NATIVE_BARE_KIT} is not installed, so the mobile Bare version is unknown`,
+                triedPaths: [path.join(projectRoot, 'node_modules', REACT_NATIVE_BARE_KIT)]
+            }
+        };
+    }
+    const packageJsonPath = path.join(packageDir, 'package.json');
+    const version = await readJsonVersion(packageJsonPath);
+    if (version === null) {
+        return {
+            resolved: false,
+            error: {
+                reason: `Could not read the version of ${REACT_NATIVE_BARE_KIT}`,
+                triedPaths: [packageJsonPath]
+            }
+        };
+    }
+    const known = REACT_NATIVE_BARE_KIT_RUNTIMES[version];
+    if (known !== undefined)
+        return resolved(known.bare, version, known.bareKit, 'table');
+    let bareKitVersion = await readInfoPlistVersion(packageDir);
+    if (bareKitVersion !== null) {
+        const bare = bareVersionForBareKit(bareKitVersion);
+        if (bare !== null)
+            return resolved(bare, version, bareKitVersion, 'info-plist');
+    }
+    const canLookUp = bareKitVersion === null
+        ? isNewerThanTable(version, REACT_NATIVE_BARE_KIT_RUNTIMES)
+        : isNewerThanTable(bareKitVersion, BARE_KIT_BARE_VERSIONS);
+    if (!canLookUp) {
+        return {
+            resolved: false,
+            error: {
+                reason: `The Bare version of ${REACT_NATIVE_BARE_KIT}@${version} could not be determined: ` +
+                    (bareKitVersion === null
+                        ? 'the release does not record its bare-kit version and its iOS framework Info.plist could not be read'
+                        : `bare-kit ${bareKitVersion} does not name its Bare version in CMakeLists.txt`),
+                triedPaths: [packageJsonPath, path.join(packageDir, BARE_KIT_INFO_PLIST)]
+            }
+        };
+    }
+    if (!network) {
+        return {
+            resolved: false,
+            error: {
+                reason: `${REACT_NATIVE_BARE_KIT}@${version} is not in the built-in runtime table ` +
+                    'and network lookups are disabled',
+                triedPaths: [packageJsonPath]
+            }
+        };
+    }
+    onProgress?.(`Looking up the Bare version embedded in ${REACT_NATIVE_BARE_KIT}@${version} on ` +
+        `raw.githubusercontent.com (not in the built-in table, timeout ${NETWORK_TIMEOUT_MS / 1000}s per request)...`);
+    try {
+        if (bareKitVersion === null) {
+            bareKitVersion = await fetchBareKitVersionFromGitHub(version, fetch);
+        }
+        const bare = bareKitVersion === null
+            ? null
+            : (bareVersionForBareKit(bareKitVersion) ??
+                (await fetchBareVersionFromGitHub(bareKitVersion, fetch)));
+        if (bareKitVersion !== null && bare !== null) {
+            return resolved(bare, version, bareKitVersion, 'github');
+        }
+        return {
+            resolved: false,
+            error: {
+                reason: `Could not find the bare-kit or Bare version in the CMakeLists.txt of ${REACT_NATIVE_BARE_KIT}@${version}`,
+                triedPaths: [packageJsonPath]
+            }
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            resolved: false,
+            error: {
+                reason: `Could not look up the Bare version of ${REACT_NATIVE_BARE_KIT}@${version}: ${message}`,
+                triedPaths: [packageJsonPath]
+            }
+        };
+    }
+}

package/dist/src/commands/verify/bare-kit-runtimes.d.ts

@@ -0,0 +1,12 @@
+export interface BareKitRuntime {
+    bareKit: string;
+    bare: string;
+}
+/**
+ * react-native-bare-kit releases whose CMakeLists.txt names the bare-kit
+ * prebuilds it ships. Older releases carry no such reference.
+ */
+export declare const REACT_NATIVE_BARE_KIT_RUNTIMES: Record<string, BareKitRuntime>;
+/** Bare version each bare-kit release is built against. */
+export declare const BARE_KIT_BARE_VERSIONS: Record<string, string>;
+//# sourceMappingURL=bare-kit-runtimes.d.ts.map

package/dist/src/commands/verify/bare-kit-runtimes.js

@@ -0,0 +1,108 @@
+// Generated by scripts/generate-bare-kit-runtimes.ts. Do not edit by hand.
+/**
+ * react-native-bare-kit releases whose CMakeLists.txt names the bare-kit
+ * prebuilds it ships. Older releases carry no such reference.
+ */
+export const REACT_NATIVE_BARE_KIT_RUNTIMES = {
+    '0.13.3': { bareKit: '2.0.2', bare: '1.28.1' },
+    '0.14.0': { bareKit: '2.1.0', bare: '1.28.1' },
+    '0.14.1': { bareKit: '2.1.1', bare: '1.28.1' },
+    '0.14.2': { bareKit: '2.1.2', bare: '1.28.6' },
+    '0.14.3': { bareKit: '2.1.3', bare: '1.28.6' },
+    '0.14.4': { bareKit: '2.2.0', bare: '1.29.3' },
+    '0.14.5': { bareKit: '2.2.1', bare: '1.29.4' },
+    '0.15.0': { bareKit: '2.3.0', bare: '1.29.4' },
+    '0.15.1': { bareKit: '2.5.0', bare: '1.33.1' },
+    '0.15.2': { bareKit: '2.5.0', bare: '1.33.1' },
+    '0.15.3': { bareKit: '2.5.1', bare: '1.33.2' },
+    '0.15.4': { bareKit: '2.5.3', bare: '1.33.3' },
+    '0.15.5': { bareKit: '2.5.4', bare: '1.33.4' },
+    '0.15.6': { bareKit: '2.5.4', bare: '1.33.4' }
+};
+/** Bare version each bare-kit release is built against. */
+export const BARE_KIT_BARE_VERSIONS = {
+    '1.0.0': '1.12.2',
+    '1.0.1': '1.12.3',
+    '1.0.2': '1.12.3',
+    '1.1.0': '1.13.1',
+    '1.2.0': '1.15.0',
+    '1.2.1': '1.15.0',
+    '1.2.2': '1.15.2',
+    '1.2.3': '1.15.2',
+    '1.2.4': '1.15.2',
+    '1.2.5': '1.15.2',
+    '1.3.0': '1.16.0',
+    '1.3.1': '1.16.0',
+    '1.3.2': '1.16.1',
+    '1.3.3': '1.16.1',
+    '1.3.4': '1.16.2',
+    '1.3.5': '1.16.4',
+    '1.3.6': '1.16.5',
+    '1.4.0': '1.17.0',
+    '1.4.1': '1.17.1',
+    '1.4.2': '1.17.3',
+    '1.4.3': '1.17.3',
+    '1.4.4': '1.17.3',
+    '1.4.5': '1.17.5',
+    '1.4.6': '1.17.6',
+    '1.5.0': '1.17.6',
+    '1.5.1': '1.17.6',
+    '1.5.2': '1.18.0',
+    '1.5.3': '1.18.1',
+    '1.5.4': '1.18.2',
+    '1.5.5': '1.18.3',
+    '1.5.6': '1.18.4',
+    '1.6.0': '1.19.0',
+    '1.7.0': '1.20.1',
+    '1.7.1': '1.20.2',
+    '1.8.0': '1.20.2',
+    '1.8.1': '1.20.2',
+    '1.8.2': '1.20.2',
+    '1.8.3': '1.20.2',
+    '1.9.0': '1.21.5',
+    '1.9.1': '1.21.6',
+    '1.9.2': '1.21.6',
+    '1.9.3': '1.21.7',
+    '1.9.4': '1.21.8',
+    '1.9.5': '1.21.8',
+    '1.10.0': '1.22.0',
+    '1.10.1': '1.22.0',
+    '1.10.2': '1.22.1',
+    '1.11.0': '1.23.3',
+    '1.11.1': '1.23.4',
+    '1.11.2': '1.23.4',
+    '1.11.3': '1.23.4',
+    '1.12.0': '1.24.0',
+    '1.12.1': '1.24.1',
+    '1.12.2': '1.24.1',
+    '1.12.3': '1.24.3',
+    '1.12.4': '1.24.3',
+    '1.13.0': '1.24.3',
+    '1.13.1': '1.24.3',
+    '1.13.2': '1.24.5',
+    '1.13.3': '1.24.6',
+    '1.14.0': '1.25.0',
+    '1.15.0': '1.27.0',
+    '1.15.1': '1.27.0',
+    '1.15.2': '1.27.0',
+    '2.0.0': '1.28.1',
+    '2.0.1': '1.28.1',
+    '2.0.2': '1.28.1',
+    '2.1.0': '1.28.1',
+    '2.1.1': '1.28.1',
+    '2.1.2': '1.28.6',
+    '2.1.3': '1.28.6',
+    '2.2.0': '1.29.3',
+    '2.2.1': '1.29.4',
+    '2.3.0': '1.29.4',
+    '2.4.0': '1.29.4',
+    '2.4.1': '1.31.1',
+    '2.4.2': '1.31.2',
+    '2.4.3': '1.31.2',
+    '2.5.0': '1.33.1',
+    '2.5.1': '1.33.2',
+    '2.5.2': '1.33.3',
+    '2.5.3': '1.33.3',
+    '2.5.4': '1.33.4',
+    '2.5.5': '1.33.4'
+};

package/dist/src/commands/verify/bundle-source.js

@@ -2,7 +2,7 @@ import { promises as fsp } from 'node:fs';
 import path from 'node:path';
 import { DEFAULT_HOSTS } from '../bundle/constants.js';
 import { buildNestedPathIndex, extractBarePackHeader, extractPackedString } from '../bundle/manifest.js';
-import { deduplicateAddons, readAddonPackageJson } from './addon-source.js';
+import { createLimiter, deduplicateAddons, FS_CONCURRENCY, readAddonPackageJson } from './addon-source.js';
 /** bare-pack resolves a linked native addon to this prefix instead of a module path. */
 const LINKED_PREFIX = 'linked:';
 /** Reserved resolution key naming the package.json that owns a module. */
@@ -58,21 +58,22 @@ export async function collectAddonsFromBundle(options) {
         projectRoot,
         pathsByPackage
     });
+    const limit = createLimiter(FS_CONCURRENCY);
+    const lookups = [...pathsByPackage].flatMap(([pkgName, candidates]) => [...candidates].map((candidate) => ({ pkgName, candidate })));
+    const results = await Promise.all(lookups.map(({ pkgName, candidate }) => limit(() => readAddonPackageJson({ packageJsonPath: candidate, expectedName: pkgName }))));
     const addons = [];
-    for (const [pkgName, candidates] of pathsByPackage) {
-        for (const candidate of candidates) {
-            const result = await readAddonPackageJson({
-                packageJsonPath: candidate,
-                expectedName: pkgName
-            });
-            if (result.isAddon && result.addon) {
-                if (analysed !== null)
-                    result.addon.linkedHosts = analysed.get(candidate) ?? [];
-                addons.push(result.addon);
-            }
-            else if (result.invalid !== undefined && diagnostics !== undefined) {
-                diagnostics.invalidPackageJsons.push(result.invalid);
-            }
+    for (const [index, { candidate }] of lookups.entries()) {
+        const result = results[index];
+        if (result.record !== undefined && diagnostics !== undefined) {
+            diagnostics.packages.push(result.record);
+        }
+        if (result.isAddon && result.addon) {
+            if (analysed !== null)
+                result.addon.linkedHosts = analysed.get(candidate) ?? [];
+            addons.push(result.addon);
+        }
+        else if (result.invalid !== undefined && diagnostics !== undefined) {
+            diagnostics.invalidPackageJsons.push(result.invalid);
         }
     }
     return deduplicateAddons(addons);