angular-compat-matrix 0.1.0 → 0.2.0

package/dist/cleanup.js

@@ -0,0 +1,117 @@
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { killAllChildren } from "./exec.js";
+/*
+ * Temporary apps and half-written cache entries must not outlive a run, however it ends:
+ * normally, with Ctrl+C, or killed outright. Each work folder records the pid that owns it,
+ * and each cache write goes through `<name>.<pid>.tmp`, so whatever a dead run left behind
+ * can be told apart from what a running one is still using.
+ */
+const PREFIX = 'ng-matrix-';
+const OWNER = '.ng-matrix-pid';
+export function createWorkDir() {
+    const dir = mkdtempSync(join(tmpdir(), PREFIX));
+    writeFileSync(join(dir, OWNER), String(process.pid));
+    return dir;
+}
+export function isAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+export function removeDir(dir) {
+    // On Windows a just-killed build can hold files open for a moment.
+    rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
+}
+/** Removes work folders whose run is gone. Folders without an owner file (0.1.0) go after a day. */
+export function sweepWorkDirs(base = tmpdir()) {
+    const removed = [];
+    let entries;
+    try {
+        entries = readdirSync(base).filter((name) => name.startsWith(PREFIX));
+    }
+    catch {
+        return removed;
+    }
+    for (const name of entries) {
+        const dir = join(base, name);
+        try {
+            const owner = join(dir, OWNER);
+            const stale = existsSync(owner)
+                ? !isAlive(Number(readFileSync(owner, 'utf8')))
+                : Date.now() - statSync(dir).mtimeMs > 24 * 60 * 60 * 1000;
+            if (stale) {
+                removeDir(dir);
+                removed.push(dir);
+            }
+        }
+        catch {
+            // Not ours to judge, or already gone.
+        }
+    }
+    return removed;
+}
+/** Removes `<name>.<pid>.tmp` entries in the cache left by runs that are gone. */
+export function sweepCache(cacheDir) {
+    const removed = [];
+    for (const sub of ['tools', 'registry']) {
+        const dir = join(cacheDir, sub);
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            continue;
+        }
+        for (const name of entries) {
+            const match = /\.(\d+)\.tmp$/.exec(name);
+            if (!match || isAlive(Number(match[1])))
+                continue;
+            try {
+                removeDir(join(dir, name));
+                removed.push(join(dir, name));
+            }
+            catch {
+                // Try again next run.
+            }
+        }
+    }
+    return removed;
+}
+/**
+ * On Ctrl+C (or SIGTERM, or a closed terminal): stop every child, remove the work folder unless
+ * --keep, and exit. A second Ctrl+C exits at once.
+ */
+export function cleanUpOnInterrupt(workDir, keep, log) {
+    let stopping = false;
+    const handler = (signal) => {
+        if (stopping)
+            process.exit(130);
+        stopping = true;
+        log(`Interrupted (${signal}): stopping, then ${keep ? `keeping ${workDir} (--keep)` : `removing ${workDir}`}.`);
+        killAllChildren();
+        if (!keep) {
+            try {
+                removeDir(workDir);
+            }
+            catch (error) {
+                log(`Couldn't remove ${workDir}: ${error.message}. The next run removes it.`);
+            }
+        }
+        process.exit(signal === 'SIGINT' || signal === 'SIGBREAK' ? 130 : 143);
+    };
+    const signals = process.platform === 'win32' ? ['SIGINT', 'SIGTERM', 'SIGBREAK'] : ['SIGINT', 'SIGTERM', 'SIGHUP'];
+    for (const signal of signals)
+        process.on(signal, handler);
+    return () => {
+        for (const signal of signals)
+            process.off(signal, handler);
+    };
+}

package/dist/cli.js

@@ -1,16 +1,20 @@
 #!/usr/bin/env node
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { existsSync, readFileSync } from 'node:fs';
+import { cleanUpOnInterrupt, createWorkDir, removeDir, sweepCache, sweepWorkDirs } from "./cleanup.js";
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
 import semver from 'semver';
 import { LibraryError, prepareLibrary } from "./library.js";
+import { SCHEMA_VERSION } from "./model.js";
 import { angularImports, scanPackage, summarize } from "./partial.js";
-import { Registry } from "./registry.js";
+import { Registry, RegistryError } from "./registry.js";
 import { exitCode, findings, renderJson, renderMarkdown, renderTerminal } from "./report.js";
 import { defaultConcurrency, runAll } from "./run.js";
-import { defaultCacheDir } from "./tools.js";
+import { setStepTimeout, setVerbose } from "./exec.js";
+import { Progress } from "./progress.js";
+import { ALLOW_SCRIPTS_WARNING } from "./scripts.js";
+import { cacheStats, cleanCache, defaultCacheDir, formatBytes } from "./tools.js";
 import { defaultMajors, describeMajor, loadVersionSources, majorsOf, nextVersion, nodeSatisfies, parseVersionList, } from "./versions.js";
 const HELP = `ng-matrix: which Angular versions does your published library really work with?
 
@@ -20,6 +24,8 @@ major (made with that major's own CLI), builds it, and reports a matrix.
 Usage
   npx angular-compat-matrix [options]
   ng-matrix [options]                  (once installed)
+  ng-matrix cache                      (show cache location and size)
+  ng-matrix cache clean                (delete the cache)
 
 Options
   --versions <list>      Angular majors to check: 22, 18-22, 20,22. Default: the supported
@@ -30,6 +36,7 @@ Options
   --tests                Also run the library's tests on each version (slow)
   --test-command <cmd>   The test command for --tests (default: <pm> test)
   --format <format>      terminal (default), markdown or json
+  --json                 Shorthand for --format json
   --pm <npm|pnpm>        Package manager for the apps (default: pnpm if there's a
                          pnpm-lock.yaml, else npm)
   --build <cmd>          Build the library with this command instead of the detected one
@@ -37,10 +44,13 @@ Options
   --tarball <file>       Check this packed .tgz instead of building
   --package <spec>       Check a published package, e.g. some-lib@3.1.0
   --concurrency <n>      Versions checked at once (default: as many as free memory allows)
+  --step-timeout <min>   Longest any one step (ng new, install, build, tests) may take (default: 20)
   --keep                 Keep the temporary apps, for debugging
+  --allow-scripts        Let the package's (and its dependencies') install scripts run. By
+                         default only the Angular toolchain's own builds run (esbuild, lmdb...)
   --offline              Use only cached registry answers and packages
   --cwd <dir>            The library's workspace (default: the current folder)
-  --verbose              Show every error line, not just the first few
+  --verbose              Show commands run and full build/install output for failures
   -h, --help             This help
   -v, --version          ng-matrix's version
 
@@ -66,6 +76,9 @@ function explain(error) {
     if (error instanceof Stop || error instanceof LibraryError) {
         process.stderr.write(`ng-matrix: ${error.message}\n${error.lines.map((l) => `  ${l}\n`).join('')}`);
     }
+    else if (error instanceof RegistryError) {
+        process.stderr.write(`ng-matrix: ${error.message}\n`);
+    }
     else if (String(error.code).startsWith('ERR_PARSE_ARGS')) {
         process.stderr.write(`ng-matrix: ${error.message}. See --help.\n`);
     }
@@ -85,13 +98,16 @@ export async function main(argv) {
             consumer: { type: 'string' },
             tests: { type: 'boolean', default: false },
             'test-command': { type: 'string' },
+            'allow-scripts': { type: 'boolean', default: false },
             format: { type: 'string', default: 'terminal' },
+            json: { type: 'boolean', default: false },
             pm: { type: 'string' },
             build: { type: 'string' },
             'skip-build': { type: 'boolean', default: false },
             tarball: { type: 'string' },
             package: { type: 'string' },
             concurrency: { type: 'string' },
+            'step-timeout': { type: 'string' },
             keep: { type: 'boolean', default: false },
             offline: { type: 'boolean', default: false },
             cwd: { type: 'string' },
@@ -108,28 +124,58 @@ export async function main(argv) {
         process.stdout.write(`${toolVersion()}\n`);
         return 0;
     }
+    if (positionals[0] === 'cache') {
+        const cacheDir = defaultCacheDir();
+        const sub = positionals[1];
+        if (!sub) {
+            const stats = cacheStats(cacheDir);
+            process.stdout.write(`Location: ${cacheDir}\nSize:     ${formatBytes(stats.bytes)} (${stats.count} files)\n`);
+            return 0;
+        }
+        if (sub === 'clean') {
+            cleanCache(cacheDir);
+            process.stdout.write(`Cleaned cache at ${cacheDir}\n`);
+            return 0;
+        }
+        fail(`Unknown cache command "ng-matrix cache ${sub}". See --help.`);
+    }
     if (positionals[0] === 'ci')
         fail('`ng-matrix ci github` is planned for v0.2.');
     if (positionals.length)
         fail(`Unknown argument "${positionals[0]}". See --help.`);
-    const format = values.format;
+    const format = values.json ? 'json' : values.format;
     if (!['terminal', 'markdown', 'json'].includes(format))
         fail(`--format must be terminal, markdown or json, not "${format}".`);
+    if (values.verbose)
+        setVerbose(true);
     const cwd = resolve(values.cwd ?? process.cwd());
     const pm = (values.pm ?? (existsSync(join(cwd, 'pnpm-lock.yaml')) ? 'pnpm' : 'npm'));
     if (pm !== 'npm' && pm !== 'pnpm')
         fail(`--pm must be npm or pnpm (yarn and bun come later), not "${pm}".`);
     const consumer = values.consumer ? resolve(cwd, values.consumer) : undefined;
-    const log = (line) => process.stderr.write(`[ng-matrix] ${line}\n`);
+    if (values['step-timeout'] !== undefined) {
+        const minutes = Number(values['step-timeout']);
+        if (!(minutes > 0))
+            fail(`--step-timeout must be a number of minutes above 0, not "${values['step-timeout']}".`);
+        setStepTimeout(minutes * 60_000);
+    }
+    const progress = new Progress(format !== 'json');
+    const log = (line) => progress.log(`[ng-matrix] ${line}`);
     const cacheDir = defaultCacheDir();
     const registry = new Registry({
         cacheDir,
         offline: values.offline,
         recordedDir: process.env.NG_MATRIX_RECORDED_REGISTRY,
     });
-    const workDir = mkdtempSync(join(tmpdir(), 'ng-matrix-'));
+    // Leftovers from runs that were killed before they could clean up.
+    sweepWorkDirs();
+    sweepCache(cacheDir);
+    const workDir = createWorkDir();
+    const stopListening = cleanUpOnInterrupt(workDir, values.keep, log);
     if (values.keep)
         log(`Working in ${workDir} (--keep)`);
+    if (values['allow-scripts'])
+        log(ALLOW_SCRIPTS_WARNING);
     try {
         const library = await prepareLibrary({
             cwd,
@@ -175,9 +221,12 @@ export async function main(argv) {
             testCommand: values['test-command'],
             consumer,
             keep: values.keep,
+            allowScripts: values['allow-scripts'],
             log,
+            progress,
         }, angular, concurrency);
         const report = {
+            schemaVersion: SCHEMA_VERSION,
             tool: { name: 'angular-compat-matrix', version: toolVersion() },
             checkedAt: now.toISOString(),
             library: {
@@ -190,12 +239,13 @@ export async function main(argv) {
                 declarations: summary.declarations,
             },
             packageManager: pm,
+            installScripts: values['allow-scripts'] ? 'all' : 'toolchain-only',
             node: process.version,
             versions,
             findings: findings(versions, library.manifest, angularImports(library.dir)),
             exitCode: exitCode(versions),
         };
-        const render = format === 'json' ? renderJson : format === 'markdown' ? renderMarkdown : (r) => renderTerminal(r, values.verbose);
+        const render = format === 'json' ? (r) => renderJson(r, values.verbose) : format === 'markdown' ? renderMarkdown : (r) => renderTerminal(r, values.verbose);
         process.stdout.write((format === 'terminal' ? '\n' : '') + render(report));
         return report.exitCode;
     }
@@ -203,8 +253,10 @@ export async function main(argv) {
         return explain(error);
     }
     finally {
+        progress.stop();
+        stopListening();
         if (!values.keep)
-            rmSync(workDir, { recursive: true, force: true, maxRetries: 3 });
+            removeDir(workDir);
     }
 }
 main(process.argv.slice(2)).then((code) => process.exit(code), (error) => process.exit(explain(error)));

package/dist/exec.js

@@ -19,12 +19,35 @@ export function quietEnv(extra = {}) {
         ...extra,
     };
 }
+/** Every child still running, so an interrupt can stop them all. */
+const running = new Set();
+/** Stops every running child and everything it started (npm, then the build it runs). */
+export function killAllChildren() {
+    for (const child of running)
+        killTree(child.pid);
+    running.clear();
+}
+let verboseEnabled = false;
+export function setVerbose(enabled) {
+    verboseEnabled = enabled;
+}
+export function isVerbose() {
+    return verboseEnabled;
+}
 export function exec(command, args, options) {
     const started = Date.now();
+    if (verboseEnabled) {
+        const fullCmd = options.shell ? [command, ...args].join(' ') : `${command} ${args.join(' ')}`;
+        process.stderr.write(`[ng-matrix] > ${fullCmd}\n`);
+    }
     return new Promise((resolve) => {
+        // On Linux and macOS each child leads its own process group, so killing the group stops
+        // its children too. Windows has taskkill /T for that.
+        const detached = process.platform !== 'win32';
         const child = options.shell
-            ? spawn([command, ...args].join(' '), { cwd: options.cwd, env: options.env ?? quietEnv(), shell: true })
-            : spawn(command, args, { cwd: options.cwd, env: options.env ?? quietEnv() });
+            ? spawn([command, ...args].join(' '), { cwd: options.cwd, env: options.env ?? quietEnv(), shell: true, detached })
+            : spawn(command, args, { cwd: options.cwd, env: options.env ?? quietEnv(), detached });
+        running.add(child);
         let output = '';
         let timedOut = false;
         const append = (chunk) => (output += chunk.toString('utf8'));
@@ -37,6 +60,7 @@ export function exec(command, args, options) {
             }, options.timeoutMs)
             : undefined;
         const finish = (code) => {
+            running.delete(child);
             if (timer)
                 clearTimeout(timer);
             resolve({ code, output: stripAnsi(output), durationMs: Date.now() - started, timedOut });
@@ -56,10 +80,15 @@ function killTree(pid) {
     }
     else {
         try {
-            process.kill(pid, 'SIGKILL');
+            process.kill(-pid, 'SIGKILL');
         }
         catch {
-            // already gone
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch {
+                // already gone
+            }
         }
     }
 }
@@ -108,3 +137,30 @@ export function errorLines(output, max = 12) {
     }
     return lines.filter((line) => line.trim()).slice(-max);
 }
+/** How long any one step (ng new, an install, a build, the tests) may take: --step-timeout. */
+let stepTimeoutMs = 20 * 60_000;
+export function setStepTimeout(ms) {
+    stepTimeoutMs = ms;
+}
+export function stepTimeout() {
+    return stepTimeoutMs;
+}
+/**
+ * Why a step failed when it's the machine's fault, not the package's: it timed out, the disk is
+ * full, or the network dropped. Such a version is reported as not checked (exit 2), not as failing.
+ */
+export function environmentProblem(result) {
+    if (result.timedOut)
+        return `timed out after ${formatMinutes(stepTimeoutMs)} (raise the limit with --step-timeout <minutes>)`;
+    if (/\bENOSPC\b|no space left on device|not enough space on the disk/i.test(result.output)) {
+        return 'the disk is full (ENOSPC). Free some space, or point TMPDIR/TEMP and NG_MATRIX_CACHE somewhere with room';
+    }
+    const network = /^.*\b(EAI_AGAIN|ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|ERR_SOCKET_TIMEOUT|ERR_PNPM_META_FETCH_FAIL|socket hang up)\b.*$/im.exec(result.output);
+    if (network)
+        return `a network error: ${network[0].trim().slice(0, 200)}`;
+    return undefined;
+}
+function formatMinutes(ms) {
+    const minutes = ms / 60_000;
+    return minutes >= 1 ? `${Number(minutes.toFixed(1))} min` : `${Math.round(ms / 1000)} s`;
+}

package/dist/install.js

@@ -2,7 +2,8 @@ import { copyFileSync, writeFileSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import semver from 'semver';
 import { readJson, writeJson } from "./app.js";
-import { errorLines, exec, npm, quietEnv } from "./exec.js";
+import { environmentProblem, errorLines, exec, npm, quietEnv, stepTimeout } from "./exec.js";
+import { npmInstall, pnpmBuildSettings, skippedByNpm, skippedByPnpm } from "./scripts.js";
 import { ensureTool, PNPM_VERSION, pnpmEntry } from "./tools.js";
 export function addDependencies(appDir, deps, extra = {}) {
     const path = join(appDir, 'package.json');
@@ -15,7 +16,7 @@ export async function installLibrary(request) {
     const tgz = basename(request.tarball);
     copyFileSync(request.tarball, join(request.appDir, tgz));
     const deps = { ...request.plan.installs, [request.libraryName]: `file:${tgz}` };
-    return request.pm === 'npm' ? installWithNpm(request, deps) : installWithPnpm(request, deps, tgz);
+    return request.pm === 'npm' ? installWithNpm(request, deps) : installWithPnpm(request, deps);
 }
 /**
  * npm 11 fails on any peer conflict and can't ignore just one. So: install without peer
@@ -26,13 +27,22 @@ async function installWithNpm(request, deps) {
     const args = ['install', '--legacy-peer-deps', '--no-audit', '--no-fund'];
     if (request.offline)
         args.push('--offline');
-    const result = await npm(args, { cwd: request.appDir, timeoutMs: 15 * 60_000 });
+    const result = await npmInstall(args, { cwd: request.appDir, timeoutMs: stepTimeout() }, request.allowScripts);
+    const skippedScripts = request.allowScripts ? [] : skippedByNpm(request.appDir);
     if (result.code !== 0) {
-        return { pass: false, message: 'npm install failed.', errorLines: errorLines(result.output), ignored: [] };
+        return {
+            pass: false,
+            message: 'npm install failed.',
+            errorLines: errorLines(result.output),
+            fullOutput: result.output,
+            ignored: [],
+            environment: environmentProblem(result),
+            skippedScripts,
+        };
     }
     const ls = await npm(['ls', '--all'], { cwd: request.appDir });
     const problems = parseNpmLs(ls.output);
-    return judgeProblems(request, problems);
+    return { ...judgeProblems(request, problems), skippedScripts };
 }
 /** Reads `npm ls --all` text output: `@angular/core@21.2.25 deduped invalid: "^22.0.0" from node_modules/@angular/cdk`. */
 export function parseNpmLs(output) {
@@ -79,10 +89,10 @@ function judgeProblems(request, problems) {
 }
 /**
  * pnpm only warns about peers by default, so strictPeerDependencies is on, with allowedVersions
- * for the one expected conflict. strictDepBuilds is off: otherwise pnpm 12 fails every install
- * on Angular's own esbuild, lmdb and @parcel/watcher scripts. The library's own scripts may run.
+ * for the one expected conflict. strictDepBuilds is off, so a package whose install script isn't
+ * allowed is skipped rather than failing the install; only the toolchain's builds are allowed.
  */
-async function installWithPnpm(request, deps, tgz) {
+async function installWithPnpm(request, deps) {
     addDependencies(request.appDir, deps, { packageManager: `pnpm@${PNPM_VERSION}` });
     const allowed = {};
     if (request.plan.claimed === false) {
@@ -91,20 +101,24 @@ async function installWithPnpm(request, deps, tgz) {
             allowed[`${request.libraryName}>${miss.name}`] = major;
         }
     }
-    writeFileSync(join(request.appDir, 'pnpm-workspace.yaml'), pnpmWorkspaceYaml(request.libraryName, tgz, allowed));
+    writeFileSync(join(request.appDir, 'pnpm-workspace.yaml'), pnpmWorkspaceYaml(allowed, request.allowScripts));
     const pnpm = await ensureTool(request.cacheDir, 'pnpm', PNPM_VERSION, request.offline);
     const args = [pnpmEntry(pnpm), 'install', '--no-frozen-lockfile'];
     if (request.offline)
         args.push('--offline');
-    const result = await exec(process.execPath, args, { cwd: request.appDir, env: quietEnv(), timeoutMs: 15 * 60_000 });
+    const result = await exec(process.execPath, args, { cwd: request.appDir, env: quietEnv(), timeoutMs: stepTimeout() });
     const ignored = Object.entries(allowed).map(([key, major]) => `${key} allowed at ${major}.x`);
+    const skippedScripts = request.allowScripts ? [] : skippedByPnpm(result.output);
     if (result.code !== 0) {
         const peer = /ERR_PNPM_PEER_DEP_ISSUES|unmet peer|Issues with peer dependencies/i.test(result.output);
         return {
             pass: false,
             message: peer ? 'Peer conflict (pnpm strict-peer-dependencies).' : 'pnpm install failed.',
             errorLines: errorLines(result.output),
+            fullOutput: result.output,
             ignored,
+            environment: environmentProblem(result),
+            skippedScripts,
         };
     }
     return {
@@ -112,16 +126,11 @@ async function installWithPnpm(request, deps, tgz) {
         message: ignored.length ? `Installed; allowed the expected conflict: ${ignored.join('; ')}.` : 'Installed.',
         errorLines: [],
         ignored,
+        skippedScripts,
     };
 }
-export function pnpmWorkspaceYaml(libraryName, tgz, allowed) {
-    const lines = [
-        'strictPeerDependencies: true',
-        'strictDepBuilds: false',
-        'allowBuilds:',
-        // pnpm keys a tarball dependency by its full spec; the bare name doesn't match it.
-        `  ${JSON.stringify(`${libraryName}@file:${tgz}`)}: true`,
-    ];
+export function pnpmWorkspaceYaml(allowed, allowScripts = false) {
+    const lines = ['strictPeerDependencies: true', ...pnpmBuildSettings(allowScripts)];
     if (Object.keys(allowed).length) {
         lines.push('peerDependencyRules:', '  allowedVersions:');
         for (const [key, range] of Object.entries(allowed))

package/dist/library.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, statSync } from 'node
 import { createRequire } from 'node:module';
 import { basename, dirname, join, resolve } from 'node:path';
 import * as tar from 'tar';
-import { errorLines, exec, npm, quietEnv } from "./exec.js";
+import { environmentProblem, errorLines, exec, npm, quietEnv } from "./exec.js";
 export class LibraryError extends Error {
     lines;
     constructor(message, lines = []) {
@@ -126,15 +126,31 @@ export function fullCompilationEvidence(dir) {
 async function pack(source, into) {
     const result = await npm(['pack', source, '--pack-destination', into, '--json', '--ignore-scripts'], { cwd: into });
     if (result.code !== 0)
-        throw new LibraryError(`npm pack ${source} failed.`, errorLines(result.output));
+        throw new LibraryError(packFailure(source, result.output), errorLines(result.output));
     const json = result.output.slice(result.output.indexOf('['));
     const [info] = JSON.parse(json);
     // Scoped packages: npm reports "@scope/name-1.0.0.tgz" but writes "scope-name-1.0.0.tgz".
     return join(into, info.filename.replace(/^@/, '').replace('/', '-'));
 }
+/** What went wrong with `npm pack <spec>`, in words: most often the name or the version doesn't exist. */
+export function packFailure(spec, output) {
+    if (/\bE404\b|404 Not Found/.test(output))
+        return `There's no package ${spec.replace(/(.)@[^@]*$/, '$1')} on the npm registry.`;
+    if (/\bETARGET\b|No matching version/.test(output))
+        return `${spec} doesn't match any published version.`;
+    const why = environmentProblem({ output, timedOut: false });
+    if (why)
+        return `Couldn't download ${spec}: ${why}.`;
+    return `npm pack ${spec} failed.`;
+}
 export async function extract(tarball, into) {
     mkdirSync(into, { recursive: true });
-    await tar.x({ file: tarball, cwd: into });
+    try {
+        await tar.x({ file: tarball, cwd: into, strict: true });
+    }
+    catch (error) {
+        throw new LibraryError(`${tarball} isn't a package tarball (.tgz): ${error.message}`);
+    }
     const dir = join(into, 'package');
     if (!existsSync(join(dir, 'package.json')))
         throw new LibraryError(`${tarball} has no package/package.json.`);

package/dist/model.js

@@ -7,6 +7,7 @@ export const CHECK_LABELS = {
     strict: 'strict types',
     tests: 'tests',
 };
+export const SCHEMA_VERSION = 1;
 export function result(status, message = '', extra = {}) {
     return { status, message, errorLines: [], durationMs: 0, ...extra };
 }

package/dist/progress.js

@@ -0,0 +1,65 @@
+export class Progress {
+    active = new Map();
+    timer;
+    isTTY;
+    rendered = false;
+    constructor(enabled) {
+        this.isTTY = enabled && Boolean(process.stderr.isTTY);
+        if (this.isTTY) {
+            this.timer = setInterval(() => this.render(), 1000);
+            this.timer.unref();
+        }
+    }
+    step(major, step) {
+        this.active.set(major, { step, started: Date.now() });
+        if (this.isTTY)
+            this.render();
+    }
+    done(major) {
+        this.active.delete(major);
+        if (this.isTTY)
+            this.render();
+    }
+    log(line) {
+        if (this.isTTY) {
+            this.clear();
+            process.stderr.write(`${line}\n`);
+            this.render();
+        }
+        else {
+            process.stderr.write(`${line}\n`);
+        }
+    }
+    render() {
+        if (!this.isTTY)
+            return;
+        if (this.active.size === 0) {
+            this.clear();
+            return;
+        }
+        const parts = [];
+        const now = Date.now();
+        for (const [major, item] of this.active) {
+            const elapsed = Math.floor((now - item.started) / 1000);
+            parts.push(`Angular ${major}: ${item.step} (${elapsed}s)`);
+        }
+        const text = `[ng-matrix] ${parts.join(' | ')}`;
+        process.stderr.write(`\r\x1b[K${text}`);
+        this.rendered = true;
+    }
+    clear() {
+        if (this.rendered) {
+            process.stderr.write('\r\x1b[K');
+            this.rendered = false;
+        }
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+        if (this.isTTY) {
+            this.clear();
+        }
+    }
+}