akm-cli 0.9.0-rc.8 → 0.9.0

package/dist/registry/resolve.js

@@ -10,9 +10,6 @@ import { fetchWithRetry, jsonWithByteCap } from "../core/common.js";
 import { NotFoundError, UsageError } from "../core/errors.js";
 import { asRecord, asString, GITHUB_API_BASE, githubHeaders } from "../integrations/github.js";
 import { isExactSemver, isSemverRange, maxSatisfying } from "./semver.js";
-// The semver engine lives in ./semver (WI-9.3 verbatim move); `maxSatisfying`
-// stays re-exported here so this module's public surface is unchanged.
-export { maxSatisfying } from "./semver.js";
 /**
  * Validate that a URL is safe to pass to git.
  * Allowlists https:, http:, ssh:, git: schemes and git@ SSH shorthand.
@@ -112,13 +109,13 @@ function detectRegistrySearchId(ref) {
     const suggestedRef = segments.length >= 2 ? `github:${segments[0]}/${segments[1]}` : undefined;
     const lines = [
         `"${ref}" looks like a registry search result ID, not an installable ref.`,
-        `The "${prefix}:" prefix is a registry identifier and cannot be passed to \`akm add\`.`,
+        `The "${prefix}:" prefix is a registry identifier and cannot be passed to \`akm bundle add\`.`,
         "",
     ];
     if (suggestedRef) {
-        lines.push(`Try installing the source repository directly:`, `  akm add ${suggestedRef}`, "");
+        lines.push(`Try installing the source repository directly:`, `  akm bundle add ${suggestedRef}`, "");
     }
-    lines.push("Or search for the installable ref:", `  akm search "${segments.length > 2 ? segments[segments.length - 1] : rest}" --source registry`, "Then install using the installRef value from the result:", "  akm add github:owner/repo", "  akm add npm:package-name");
+    lines.push("Or search for the installable ref:", `  akm search "${segments.length > 2 ? segments[segments.length - 1] : rest}" --from registry`, "Then install using the installRef value from the result:", "  akm bundle add github:owner/repo", "  akm bundle add npm:package-name");
     return lines.join("\n");
 }
 export async function resolveRegistryArtifact(parsed) {
@@ -254,6 +251,16 @@ function isPathLikeRef(ref) {
     if (ref.startsWith("./") || ref.startsWith("../") || ref.startsWith(".\\") || ref.startsWith("..\\")) {
         return true;
     }
+    // R-007: a bare `owner/repo` (or `owner/repo#ref`) shorthand is ambiguous
+    // with a relative directory of the same shape, and is never an EXPLICIT
+    // local path the way `./owner/repo` is. Treating it as non-path here means
+    // `tryParseLocalRef` silently returns `undefined` (rather than throwing
+    // NotFoundError) when no such directory exists on disk, letting
+    // `parseRegistryRef`'s GitHub-shorthand fallback run instead. A directory
+    // that DOES exist with this shape is unaffected — `tryParseLocalRef`
+    // resolves it before the missing-path distinction ever matters.
+    if (looksLikeGithubOwnerRepo(ref))
+        return false;
     return ref.includes("/") || ref.includes("\\");
 }
 /** Default public npm registry host. */
@@ -321,9 +328,37 @@ export function validateNpmTarballUrl(tarballUrl, packageRef) {
         throw new UntrustedNpmTarballError(`npm package ${packageRef} returned a tarball URL on untrusted host "${host}" (allowed: ${allowed}).`);
     }
 }
+/**
+ * Resolve the npm registry base URL used to fetch package METADATA.
+ *
+ * R-035: `AKM_NPM_REGISTRY` previously only widened the trusted-tarball-host
+ * allowlist (see {@link trustedNpmTarballHosts}) while the metadata endpoint
+ * stayed hardcoded to the public registry — so an operator-configured mirror
+ * was never actually consulted, making the `UntrustedNpmTarballError.hint()`
+ * text below false. Honoring the override here for metadata too makes the
+ * hint true: installs really do resolve entirely against the configured
+ * mirror when it is set, mirroring how a private npm registry replaces the
+ * default wholesale (like npm's own `--registry` flag) rather than being
+ * merged with it.
+ */
+function npmMetadataRegistryBase() {
+    const override = process.env.AKM_NPM_REGISTRY?.trim();
+    if (override) {
+        try {
+            const url = new URL(override);
+            const base = `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
+            return base.replace(/\/+$/, "");
+        }
+        catch {
+            // Ignore unparseable overrides; fall back to the public registry.
+        }
+    }
+    return `https://${DEFAULT_NPM_REGISTRY_HOST}`;
+}
 async function resolveNpmArtifact(parsed) {
     const encodedName = encodeURIComponent(parsed.packageName);
-    const metadata = await fetchJson(`https://registry.npmjs.org/${encodedName}`);
+    const registryBase = npmMetadataRegistryBase();
+    const metadata = await fetchJson(`${registryBase}/${encodedName}`);
     const versions = asRecord(metadata.versions);
     const distTags = asRecord(metadata["dist-tags"]);
     const requested = parsed.requestedVersionOrTag;

package/dist/registry/semver.js

@@ -1,93 +1,43 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-function parseSemver(version) {
-    const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);
-    if (!match)
-        return undefined;
-    return {
-        major: parseInt(match[1], 10),
-        minor: parseInt(match[2], 10),
-        patch: parseInt(match[3], 10),
-        prerelease: match[4],
-    };
-}
+/**
+ * Registry semver engine (§4.6 dedup, WI-9.3).
+ *
+ * R-068 #3: this used to be a hand-rolled parse/compare/range implementation
+ * (a verbatim move from `./resolve.ts`) that only understood exact versions,
+ * `^x.y.z`, `~x.y.z`, `>=x.y.z`, and `*`/`latest`. Every OTHER valid npm range
+ * form was silently REJECTED by `satisfiesRange` even though the looser
+ * `isSemverRange` classifier correctly recognized it as a range: `1.2.x`,
+ * `>1.0.0`, `<2.0.0`, compound ranges (`>=1.0.0 <2.0.0`), partial carets
+ * (`^1.2`), OR-ranges (`a || b`), hyphen ranges (`1.2.3 - 2.3.4`), and plain
+ * exact versions used as a range. A silently-empty `maxSatisfying` result for
+ * a genuinely satisfiable range meant `akm bundle add pkg@<range>` could fail to
+ * resolve a real, installable version.
+ *
+ * `semver` (the npm package) is already a runtime dependency
+ * (`package.json`) — it was simply never imported from `src/`. This module
+ * now delegates to it directly instead of re-deriving a subset of its
+ * behavior, so every range form `semver` itself understands is supported.
+ *
+ * NOTE: `src/runtime.ts` has its own `semverOrder` with a DIFFERENT
+ * contract (engine-version ordering, not range satisfaction) — the two are
+ * intentionally not unified.
+ */
+import semver from "semver";
+/** True when `version` is an exact, fully-specified semver (not a range, wildcard, or partial version). */
 export function isExactSemver(version) {
-    return /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.+-]+)?$/.test(version);
+    return semver.valid(version) !== null;
 }
+/**
+ * True when `input` is a semver RANGE expression `maxSatisfying` can
+ * evaluate. Deliberately false for npm dist-tag conventions like `"latest"`
+ * — those are resolved via `dist-tags` lookup, not range satisfaction.
+ */
 export function isSemverRange(input) {
-    return /^[~^>=<*]/.test(input) || /^\d+\.(\d+|\*)/.test(input);
-}
-function compareSemver(a, b) {
-    if (a.major !== b.major)
-        return a.major - b.major;
-    if (a.minor !== b.minor)
-        return a.minor - b.minor;
-    if (a.patch !== b.patch)
-        return a.patch - b.patch;
-    // Versions with prerelease are lower than release
-    if (a.prerelease && !b.prerelease)
-        return -1;
-    if (!a.prerelease && b.prerelease)
-        return 1;
-    return 0;
-}
-function semverGte(a, b) {
-    return compareSemver(a, b) >= 0;
-}
-function satisfiesRange(version, range) {
-    // Skip pre-release versions unless range specifically mentions one
-    if (version.prerelease && !range.includes("-"))
-        return false;
-    // ^1.2.3 — compatible with version: same major, >= minor.patch
-    const caretMatch = range.match(/^\^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);
-    if (caretMatch) {
-        const rMajor = parseInt(caretMatch[1], 10);
-        const rMinor = parseInt(caretMatch[2], 10);
-        const rPatch = parseInt(caretMatch[3], 10);
-        if (version.major !== rMajor)
-            return false;
-        // ^0.x has special behavior: ^0.2.3 means >=0.2.3 <0.3.0
-        if (rMajor === 0) {
-            if (version.minor !== rMinor)
-                return false;
-            return version.patch >= rPatch;
-        }
-        return semverGte(version, { major: rMajor, minor: rMinor, patch: rPatch });
-    }
-    // ~1.2.3 — same major.minor, patch >= specified
-    const tildeMatch = range.match(/^~(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);
-    if (tildeMatch) {
-        const rMajor = parseInt(tildeMatch[1], 10);
-        const rMinor = parseInt(tildeMatch[2], 10);
-        const rPatch = parseInt(tildeMatch[3], 10);
-        return version.major === rMajor && version.minor === rMinor && version.patch >= rPatch;
-    }
-    // >=1.2.3
-    const gteMatch = range.match(/^>=(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);
-    if (gteMatch) {
-        const rMajor = parseInt(gteMatch[1], 10);
-        const rMinor = parseInt(gteMatch[2], 10);
-        const rPatch = parseInt(gteMatch[3], 10);
-        return semverGte(version, { major: rMajor, minor: rMinor, patch: rPatch });
-    }
-    // * or latest
-    if (range === "*" || range === "latest")
-        return true;
-    return false;
+    return semver.validRange(input) !== null;
 }
+/** Highest version in `versions` that satisfies `range`, or `undefined` if none match. */
 export function maxSatisfying(versions, range) {
-    const candidates = [];
-    for (const v of versions) {
-        const parsed = parseSemver(v);
-        if (!parsed)
-            continue;
-        if (satisfiesRange(parsed, range)) {
-            candidates.push({ version: v, parsed });
-        }
-    }
-    if (candidates.length === 0)
-        return undefined;
-    candidates.sort((a, b) => compareSemver(b.parsed, a.parsed));
-    return candidates[0].version;
+    return semver.maxSatisfying(versions, range) ?? undefined;
 }

package/dist/runtime.js

@@ -137,28 +137,7 @@ function stdinIterator() {
 }
 // ── File write ──────────────────────────────────────────────────────────────
 /**
- * Stream a `Response` (or its body) to `filePath`. On Bun uses `Bun.write`,
- * which natively streams a `Response` to disk; on Node pipes the response body
- * through `stream/promises.pipeline` so the archive is never fully buffered.
- */
-export async function writeResponseToFile(filePath, res) {
-    if (isBun) {
-        await bunGlobal().write(filePath, res);
-        return;
-    }
-    if (res.body) {
-        const readable = Readable.fromWeb(res.body);
-        await pipeline(readable, createWriteStream(filePath));
-        return;
-    }
-    const buf = Buffer.from(await res.arrayBuffer());
-    await pipeline(Readable.from(buf), createWriteStream(filePath));
-}
-/**
- * Defensive ceiling on a streamed-to-disk download (1 GiB). `writeResponseToFile`
- * imposes no size or duration bound — a compromised or misconfigured endpoint
- * could stream until the disk fills or dribble bytes forever. Archive-download
- * paths use {@link writeResponseToFileCapped} with these bounds instead.
+ * Defensive ceiling on a streamed-to-disk download (1 GiB).
  */
 export const MAX_STREAMED_DOWNLOAD_BYTES = 1024 * 1024 * 1024;
 /** Default overall wall-clock budget for streaming a download body (5 min). */
@@ -176,7 +155,7 @@ function endWriteStream(out) {
 }
 /**
  * Stream a `Response` body to `filePath` enforcing an explicit max-bytes cap
- * and an overall body-read deadline — the bounds `writeResponseToFile` lacks.
+ * and an overall body-read deadline.
  *
  * Refuses before reading when `Content-Length` exceeds the cap; otherwise
  * streams chunk-by-chunk, aborting with {@link ResponseTooLargeError} the