checkly 8.21.0 → 8.22.0

package/dist/services/checkly-config-loader.d.ts

@@ -69,6 +69,38 @@ export type ChecklyConfig = {
          */
         playwrightChecks?: PlaywrightSlimmedProp[];
     };
+    /**
+     * Code-bundle configuration properties.
+     */
+    bundle?: {
+        /**
+         * Configuration for npm packages shipped inside the code bundle.
+         */
+        packages?: {
+            /**
+             * Dependencies to embed into the code bundle, letting Checkly runners
+             * install packages they cannot fetch themselves — e.g. packages from a
+             * private registry that is only reachable from your own network.
+             * Applies to Playwright Check Suites only.
+             *
+             * Each entry is a package name (`'@acme/private-utils'`), which embeds
+             * every version of that package found in the workspace lockfile, or an
+             * exact `name@version` pin (`'legacy-private-pkg@2.1.0'`). Names may
+             * contain `*` wildcards (`'@acme/*'`, `'acme-*'`); a wildcard never
+             * crosses the `/` scope separator. List every package the runner
+             * cannot fetch, including private packages that only appear as
+             * transitive dependencies of other private packages — dependencies of
+             * listed packages are not embedded automatically.
+             *
+             * Only npm and pnpm are supported at this time: packages are resolved
+             * against the workspace lockfile (`pnpm-lock.yaml` or
+             * `package-lock.json`) and always verified against its recorded
+             * integrity hashes. Changing the resolved set of embedded packages
+             * invalidates the runner's dependency cache.
+             */
+            embed?: string[];
+        };
+    };
     /**
      * Caching-related configuration properties.
      */
@@ -81,7 +113,8 @@ export type ChecklyConfig = {
         dependencyCache?: {
             /**
              * Optional value mixed into the code bundle's cache hash in addition
-             * to its usual inputs (lockfile, package.json and .npmrc files).
+             * to its usual inputs (lockfile, package.json and .npmrc files, and
+             * the resolved `bundle.packages.embed` tarball set).
              * Change the value to force runners to reinstall the bundle's
              * dependencies. Setting it for the first time invalidates the cache
              * once. Numbers must be safe integers; unset and empty string leave

package/dist/services/checkly-config-loader.js

@@ -3,6 +3,7 @@ import fs from 'node:fs/promises';
 import { findPlaywrightConfigPath, getDefaultChecklyConfig, writeChecklyConfigFile } from './util.js';
 import { Session } from '../constructs/index.js';
 import { normalizeDependencyCacheVersion } from './check-parser/cache-hash.js';
+import { parseEmbeddedPackageSpec } from './embedded-packages/spec.js';
 function isString(obj) {
     return (Object.prototype.toString.call(obj) === '[object String]');
 }
@@ -82,6 +83,7 @@ export async function loadChecklyConfig(dir, filenames = defaultFilenames, write
         }
         validateConfigFields(config, ['logicalId', 'projectName']);
         validateDependencyCacheVersion(config);
+        validateBundle(config);
         const constructs = Session.checklyConfigFileConstructs;
         Session.checklyConfigFileConstructs = [];
         if (config.cli?.loader) {
@@ -120,4 +122,39 @@ function validateDependencyCacheVersion(config) {
         throw new Error(`Config field 'caching.dependencyCache.version' must be a string or a safe integer if set`, { cause });
     }
 }
+function validateBundle(config) {
+    const { bundle } = config;
+    if (bundle === undefined) {
+        return;
+    }
+    // A misshapen `bundle` block would otherwise read as `embed: undefined`
+    // and silently disable embedding, surfacing only as an install failure on
+    // the runner. Plain-JS configs bypass the TypeScript type, so the shape
+    // must be enforced at runtime.
+    if (bundle === null || typeof bundle !== 'object' || Array.isArray(bundle)) {
+        throw new Error(`Config field 'bundle' must be an object if set`);
+    }
+    const { packages } = bundle;
+    if (packages === undefined) {
+        return;
+    }
+    if (packages === null || typeof packages !== 'object' || Array.isArray(packages)) {
+        throw new Error(`Config field 'bundle.packages' must be an object if set`);
+    }
+    const embeddedPackages = packages.embed;
+    if (embeddedPackages === undefined) {
+        return;
+    }
+    if (!Array.isArray(embeddedPackages)) {
+        throw new Error(`Config field 'bundle.packages.embed' must be an array of strings if set`);
+    }
+    for (const spec of embeddedPackages) {
+        try {
+            parseEmbeddedPackageSpec(spec);
+        }
+        catch (cause) {
+            throw new Error(`Config field 'bundle.packages.embed' is invalid: ${cause.message}`, { cause });
+        }
+    }
+}
 //# sourceMappingURL=checkly-config-loader.js.map

package/dist/services/checkly-config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkly-config-loader.js","sourceRoot":"","sources":["../../src/services/checkly-config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAGrG,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAMhD,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAA;AAkI9E,SAAS,QAAQ,CAAE,GAAQ;IACzB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,iBAAiB,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,SAAS,GAAG;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;KACrB,CAAA;IACD,IAAI,MAAM,CAAA;IACV,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QAClD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG;gBACP,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC9B,QAAQ,EAAE,UAAU;aACrB,CAAA;YACD,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,WAAW,CAAU;IACrB,WAAW,CAAU;IAErB,YAAa,WAAqB,EAAE,WAAqB,EAAE,OAAsB;QAC/E,MAAM,OAAO,GAAG,8EAA8E;cAC1F,MAAM;cACN,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;cAChE,MAAM;cACN,oCAAoC;cACpC,MAAM;cACN,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;CACrB,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,SAAS,GAAG,gBAAgB,EAC5B,qBAA8B,IAAI,EAClC,oBAA6B;IAE7B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAA;IACvC,IAAI,CAAC;QACH,IAAI,MAAiC,CAAA;QACrC,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAA;QACxC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAgB,QAAQ,CAAC,CAAA;YACxD,MAAK;QACP,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;QAC9F,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC,CAAA;QACnE,8BAA8B,CAAC,MAAM,CAAC,CAAA;QAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAA;QAEtD,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAA;QACxC,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAA;QACpC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,wBAAwB,GAAG,KAAK,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,SAAmB,EACnB,oBAA6B,IAAI,EACjC,MAAe;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,oBAAoB,GAAG,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACpE,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAA;QACxG,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAE,MAAqB,EAAE,MAA+B;IACnF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,iBAAiB,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CAAE,MAAqB;IAC5D,IAAI,CAAC;QACH,+BAA+B,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0FAA0F,EAC1F,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"checkly-config-loader.js","sourceRoot":"","sources":["../../src/services/checkly-config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAGrG,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAMhD,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAA;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAmKtE,SAAS,QAAQ,CAAE,GAAQ;IACzB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,iBAAiB,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,SAAS,GAAG;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;KACrB,CAAA;IACD,IAAI,MAAM,CAAA;IACV,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QAClD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG;gBACP,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC9B,QAAQ,EAAE,UAAU;aACrB,CAAA;YACD,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,WAAW,CAAU;IACrB,WAAW,CAAU;IAErB,YAAa,WAAqB,EAAE,WAAqB,EAAE,OAAsB;QAC/E,MAAM,OAAO,GAAG,8EAA8E;cAC1F,MAAM;cACN,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;cAChE,MAAM;cACN,oCAAoC;cACpC,MAAM;cACN,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;CACrB,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,SAAS,GAAG,gBAAgB,EAC5B,qBAA8B,IAAI,EAClC,oBAA6B;IAE7B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAA;IACvC,IAAI,CAAC;QACH,IAAI,MAAiC,CAAA;QACrC,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAA;QACxC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAgB,QAAQ,CAAC,CAAA;YACxD,MAAK;QACP,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;QAC9F,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC,CAAA;QACnE,8BAA8B,CAAC,MAAM,CAAC,CAAA;QACtC,cAAc,CAAC,MAAM,CAAC,CAAA;QAEtB,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAA;QAEtD,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAA;QACxC,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAA;QACpC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,wBAAwB,GAAG,KAAK,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,SAAmB,EACnB,oBAA6B,IAAI,EACjC,MAAe;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,oBAAoB,GAAG,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACpE,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAA;QACxG,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAE,MAAqB,EAAE,MAA+B;IACnF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,iBAAiB,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CAAE,MAAqB;IAC5D,IAAI,CAAC;QACH,+BAA+B,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0FAA0F,EAC1F,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAE,MAAqB;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IACzB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAM;IACR,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;IAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAA;IACvC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAM;IACR,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oDAAqD,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5G,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/services/config.js

@@ -74,7 +74,9 @@ class ChecklyConfig {
     }
     getMqttUrl() {
         const environments = {
-            local: 'wss://events-local.checklyhq.com',
+            // Overridable for local development setups whose event stream is served
+            // from a different broker, mirroring how CHECKLY_API_URL overrides the API.
+            local: process.env.CHECKLY_MQTT_URL || 'wss://events-local.checklyhq.com',
             development: 'wss://events-dev.checklyhq.com',
             staging: 'wss://events-test.checklyhq.com',
             production: 'wss://events.checklyhq.com',

package/dist/services/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/services/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,MAAM,UAAU,GAAG;IACjB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAChC,CAAA;AAED,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAC3B,CAAA;AAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAA;AAEnD,gDAAgD;AAChD,IAAK,GAKJ;AALD,WAAK,GAAG;IACN,gCAAyB,CAAA;IACzB,0BAAmB,CAAA;IACnB,kCAA2B,CAAA;IAC3B,sBAAe,CAAA;AACjB,CAAC,EALI,GAAG,KAAH,GAAG,QAKP;AAED,MAAM,aAAa;IACT,KAAK,CAA4B;IACjC,KAAK,CAAqD;IAElE,iEAAiE;IACjE,iHAAiH;IACjH,IAAI,IAAI;QACN,2BAA2B;QAC3B,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC;YAC1C,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,MAAM;YAClB,aAAa;YACb,aAAa;YACb,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,IAAI,IAAI;QACN,2BAA2B;QAC3B,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC;YAC1C,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,QAAQ;YACpB,aAAa;YACb,aAAa;YACb,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;QACjB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;IACnB,CAAC;IAED,MAAM;QACJ,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAqB,IAAI,YAAY,CAAC,CAAC,CAAW,CAAA;QAE1E,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,GAAU,CAAA;IACnB,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAS,QAAQ,CAAW,IAAI,EAAE,CAAA;IACvF,CAAC;IAED,YAAY;QACV,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAS,WAAW,CAAW,IAAI,EAAE,CAAA;IAC7F,CAAC;IAED,oBAAoB;QAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;QACtD,OAAO,MAAM,KAAK,EAAE,IAAI,SAAS,KAAK,EAAE,CAAA;IAC1C,CAAC;IAED,SAAS;QACP,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,uBAAuB;YAC7D,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,2BAA2B;SACxC,CAAA;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,CAAE,CAAA;IACrC,CAAC;IAED,UAAU;QACR,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,gCAAgC;YAC7C,OAAO,EAAE,iCAAiC;YAC1C,UAAU,EAAE,4BAA4B;SACzC,CAAA;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,CAAE,CAAA;IACrC,CAAC;IAED,mBAAmB;QACjB,IAAI,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAA;AAClC,eAAe,MAAM,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/services/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,MAAM,UAAU,GAAG;IACjB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAChC,CAAA;AAED,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAC3B,CAAA;AAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAA;AAEnD,gDAAgD;AAChD,IAAK,GAKJ;AALD,WAAK,GAAG;IACN,gCAAyB,CAAA;IACzB,0BAAmB,CAAA;IACnB,kCAA2B,CAAA;IAC3B,sBAAe,CAAA;AACjB,CAAC,EALI,GAAG,KAAH,GAAG,QAKP;AAED,MAAM,aAAa;IACT,KAAK,CAA4B;IACjC,KAAK,CAAqD;IAElE,iEAAiE;IACjE,iHAAiH;IACjH,IAAI,IAAI;QACN,2BAA2B;QAC3B,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC;YAC1C,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,MAAM;YAClB,aAAa;YACb,aAAa;YACb,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,IAAI,IAAI;QACN,2BAA2B;QAC3B,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC;YAC1C,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,QAAQ;YACpB,aAAa;YACb,aAAa;YACb,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;QACjB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;IACnB,CAAC;IAED,MAAM;QACJ,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAqB,IAAI,YAAY,CAAC,CAAC,CAAW,CAAA;QAE1E,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,GAAU,CAAA;IACnB,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAS,QAAQ,CAAW,IAAI,EAAE,CAAA;IACvF,CAAC;IAED,YAAY;QACV,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAS,WAAW,CAAW,IAAI,EAAE,CAAA;IAC7F,CAAC;IAED,oBAAoB;QAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;QACtD,OAAO,MAAM,KAAK,EAAE,IAAI,SAAS,KAAK,EAAE,CAAA;IAC1C,CAAC;IAED,SAAS;QACP,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,uBAAuB;YAC7D,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,2BAA2B;SACxC,CAAA;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,CAAE,CAAA;IACrC,CAAC;IAED,UAAU;QACR,MAAM,YAAY,GAAG;YACnB,wEAAwE;YACxE,4EAA4E;YAC5E,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,kCAAkC;YACzE,WAAW,EAAE,gCAAgC;YAC7C,OAAO,EAAE,iCAAiC;YAC1C,UAAU,EAAE,4BAA4B;SACzC,CAAA;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,CAAE,CAAA;IACrC,CAAC;IAED,mBAAmB;QACjB,IAAI,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAA;AAClC,eAAe,MAAM,CAAA"}

package/dist/services/embedded-packages/cache.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The Checkly CLI's cache directories, in precedence order. A
+ * `CHECKLY_CACHE_DIR` override is the sole location. Otherwise the primary
+ * is the project-local `node_modules/.cache/checkly` (the conventional
+ * tool-cache location — incremental installs leave it alone, and CI setups
+ * that cache `node_modules` persist it automatically), backed by a
+ * per-user platform cache directory (macOS: `~/Library/Caches/checkly`,
+ * Windows: `%LOCALAPPDATA%\checkly\Cache`, elsewhere:
+ * `$XDG_CACHE_HOME/checkly` or `~/.cache/checkly`) that serves as a read
+ * tier and as the write fallback when the project location isn't writable
+ * (e.g. a read-only checkout).
+ */
+export declare function resolveCacheDirs(env?: NodeJS.ProcessEnv, projectRoot?: string, platform?: NodeJS.Platform, homedir?: string): string[];
+/**
+ * A content-addressed store of package tarballs, keyed by the lockfile's
+ * integrity hash, spread over one or more root directories in precedence
+ * order (typically the project-local cache backed by the per-user one).
+ * Reads consult every root and verify the content, so a corrupt entry
+ * degrades to a cache miss rather than a user-facing error. Writes go to
+ * the first root that accepts them, so an unwritable project tree falls
+ * back to the per-user cache instead of failing.
+ */
+export declare class TarballCache {
+    #private;
+    constructor(rootDirs: string | string[]);
+    static default(env?: NodeJS.ProcessEnv, projectRoot?: string, platform?: NodeJS.Platform, homedir?: string): TarballCache;
+    /**
+     * Returns the path of a cached, integrity-verified tarball, or undefined
+     * on a miss. A file that fails verification is deleted best-effort.
+     */
+    get(integrity: string): Promise<string | undefined>;
+    /**
+     * Stores verified tarball content in the first writable root and returns
+     * its path. The write is atomic (temp file + rename), so concurrent
+     * processes sharing the cache never observe a torn file. The caller is
+     * responsible for verifying the content against the lockfile integrity
+     * beforehand.
+     */
+    put(integrity: string, content: Buffer): Promise<string>;
+}
+/**
+ * Looks up a tarball in npm's cache (cacache), which stores raw registry
+ * tarballs content-addressed by the same sha512 the lockfile records, at
+ * `content-v2/sha512/<hex[0:2]>/<hex[2:4]>/<hex[4:]>`. Returns verified
+ * content, or undefined when absent, unverifiable, or keyed by an
+ * algorithm other than sha512. Read-only: npm's cache is never written to.
+ */
+export declare function lookupNpmCacache(integrity: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, homedir?: string): Promise<Buffer | undefined>;

package/dist/services/embedded-packages/cache.js

@@ -0,0 +1,171 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import Debug from 'debug';
+import { integrityHashToHex, strongestIntegrityHash, verifyIntegrity } from './integrity.js';
+const debug = Debug('checkly:cli:services:embedded-packages');
+function platformCacheDir(env, platform, homedir) {
+    switch (platform) {
+        case 'darwin':
+            return path.join(homedir, 'Library', 'Caches', 'checkly');
+        case 'win32': {
+            const localAppData = env.LOCALAPPDATA !== undefined && env.LOCALAPPDATA !== ''
+                ? env.LOCALAPPDATA
+                : path.join(homedir, 'AppData', 'Local');
+            return path.join(localAppData, 'checkly', 'Cache');
+        }
+        default: {
+            const xdgCacheHome = env.XDG_CACHE_HOME;
+            const cacheHome = xdgCacheHome !== undefined && xdgCacheHome !== ''
+                ? xdgCacheHome
+                : path.join(homedir, '.cache');
+            return path.join(cacheHome, 'checkly');
+        }
+    }
+}
+/**
+ * The Checkly CLI's cache directories, in precedence order. A
+ * `CHECKLY_CACHE_DIR` override is the sole location. Otherwise the primary
+ * is the project-local `node_modules/.cache/checkly` (the conventional
+ * tool-cache location — incremental installs leave it alone, and CI setups
+ * that cache `node_modules` persist it automatically), backed by a
+ * per-user platform cache directory (macOS: `~/Library/Caches/checkly`,
+ * Windows: `%LOCALAPPDATA%\checkly\Cache`, elsewhere:
+ * `$XDG_CACHE_HOME/checkly` or `~/.cache/checkly`) that serves as a read
+ * tier and as the write fallback when the project location isn't writable
+ * (e.g. a read-only checkout).
+ */
+export function resolveCacheDirs(env = process.env, projectRoot, platform = process.platform, homedir = os.homedir()) {
+    const override = env.CHECKLY_CACHE_DIR;
+    if (override !== undefined && override !== '') {
+        return [path.resolve(override)];
+    }
+    const dirs = [];
+    if (projectRoot !== undefined) {
+        dirs.push(path.join(projectRoot, 'node_modules', '.cache', 'checkly'));
+    }
+    dirs.push(platformCacheDir(env, platform, homedir));
+    return [...new Set(dirs)];
+}
+/**
+ * A content-addressed store of package tarballs, keyed by the lockfile's
+ * integrity hash, spread over one or more root directories in precedence
+ * order (typically the project-local cache backed by the per-user one).
+ * Reads consult every root and verify the content, so a corrupt entry
+ * degrades to a cache miss rather than a user-facing error. Writes go to
+ * the first root that accepts them, so an unwritable project tree falls
+ * back to the per-user cache instead of failing.
+ */
+export class TarballCache {
+    #rootDirs;
+    constructor(rootDirs) {
+        this.#rootDirs = Array.isArray(rootDirs) ? rootDirs : [rootDirs];
+    }
+    static default(env = process.env, projectRoot, platform = process.platform, homedir = os.homedir()) {
+        return new TarballCache(resolveCacheDirs(env, projectRoot, platform, homedir)
+            .map(dir => path.join(dir, 'embedded-packages')));
+    }
+    #pathFor(rootDir, hash) {
+        const hex = integrityHashToHex(hash);
+        return path.join(rootDir, hash.algorithm, hex.slice(0, 2), `${hex.slice(2)}.tgz`);
+    }
+    /**
+     * Returns the path of a cached, integrity-verified tarball, or undefined
+     * on a miss. A file that fails verification is deleted best-effort.
+     */
+    async get(integrity) {
+        const hash = strongestIntegrityHash(integrity);
+        if (hash === undefined) {
+            return undefined;
+        }
+        for (const rootDir of this.#rootDirs) {
+            const filePath = this.#pathFor(rootDir, hash);
+            let content;
+            try {
+                content = await fs.readFile(filePath);
+            }
+            catch {
+                continue;
+            }
+            if (!verifyIntegrity(content, integrity)) {
+                await fs.rm(filePath, { force: true }).catch(() => { });
+                continue;
+            }
+            return filePath;
+        }
+        return undefined;
+    }
+    /**
+     * Stores verified tarball content in the first writable root and returns
+     * its path. The write is atomic (temp file + rename), so concurrent
+     * processes sharing the cache never observe a torn file. The caller is
+     * responsible for verifying the content against the lockfile integrity
+     * beforehand.
+     */
+    async put(integrity, content) {
+        const hash = strongestIntegrityHash(integrity);
+        if (hash === undefined) {
+            throw new Error(`Cannot cache a tarball without a supported integrity hash ('${integrity}')`);
+        }
+        let lastError;
+        for (const [index, rootDir] of this.#rootDirs.entries()) {
+            const filePath = this.#pathFor(rootDir, hash);
+            const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+            try {
+                await fs.mkdir(path.dirname(filePath), { recursive: true });
+                await fs.writeFile(tempPath, content);
+                await fs.rename(tempPath, filePath);
+                if (index > 0) {
+                    debug('cache write fell back to %s', rootDir);
+                }
+                return filePath;
+            }
+            catch (err) {
+                debug('cache root %s is not writable: %s', rootDir, err.message);
+                lastError = err;
+            }
+            finally {
+                await fs.rm(tempPath, { force: true }).catch(() => { });
+            }
+        }
+        throw new Error(`Unable to write the embedded-packages cache`
+            + ` (tried ${this.#rootDirs.map(dir => `'${dir}'`).join(', ')}).`
+            + ` Set CHECKLY_CACHE_DIR to a writable directory to override the cache location.`, { cause: lastError });
+    }
+}
+/**
+ * Looks up a tarball in npm's cache (cacache), which stores raw registry
+ * tarballs content-addressed by the same sha512 the lockfile records, at
+ * `content-v2/sha512/<hex[0:2]>/<hex[2:4]>/<hex[4:]>`. Returns verified
+ * content, or undefined when absent, unverifiable, or keyed by an
+ * algorithm other than sha512. Read-only: npm's cache is never written to.
+ */
+export async function lookupNpmCacache(integrity, env = process.env, platform = process.platform, homedir = os.homedir()) {
+    const hash = strongestIntegrityHash(integrity);
+    if (hash === undefined || hash.algorithm !== 'sha512') {
+        return undefined;
+    }
+    const npmCacheDir = env.npm_config_cache !== undefined && env.npm_config_cache !== ''
+        ? env.npm_config_cache
+        : platform === 'win32'
+            ? path.join(env.LOCALAPPDATA !== undefined && env.LOCALAPPDATA !== ''
+                ? env.LOCALAPPDATA
+                : path.join(homedir, 'AppData', 'Local'), 'npm-cache')
+            : path.join(homedir, '.npm');
+    const hex = integrityHashToHex(hash);
+    const contentPath = path.join(npmCacheDir, '_cacache', 'content-v2', 'sha512', hex.slice(0, 2), hex.slice(2, 4), hex.slice(4));
+    let content;
+    try {
+        content = await fs.readFile(contentPath);
+    }
+    catch {
+        return undefined;
+    }
+    if (!verifyIntegrity(content, integrity)) {
+        return undefined;
+    }
+    return content;
+}
+//# sourceMappingURL=cache.js.map

package/dist/services/embedded-packages/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,OAAO,MAAM,cAAc,CAAA;AAElC,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAiB,kBAAkB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE3G,MAAM,KAAK,GAAG,KAAK,CAAC,wCAAwC,CAAC,CAAA;AAE7D,SAAS,gBAAgB,CACvB,GAAsB,EACtB,QAAyB,EACzB,OAAe;IAEf,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC3D,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;gBAC5E,CAAC,CAAC,GAAG,CAAC,YAAY;gBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAA;YACvC,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;gBACjE,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAChC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,OAAO,CAAC,GAAG,EACpC,WAAoB,EACpB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAA;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAA;IACf,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACvB,SAAS,CAAU;IAEnB,YAAa,QAA2B;QACtC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,CAAC,OAAO,CACZ,MAAyB,OAAO,CAAC,GAAG,EACpC,WAAoB,EACpB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;QAEtB,OAAO,IAAI,YAAY,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC;aAC1E,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,QAAQ,CAAE,OAAe,EAAE,IAAmB;QAC5C,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACnF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAE,SAAiB;QAC1B,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAE7C,IAAI,OAAe,CAAA;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBACzC,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACtD,SAAQ;YACV,CAAC;YAED,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAE,SAAiB,EAAE,OAAe;QAC3C,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,IAAI,CAAC,CAAA;QAC/F,CAAC;QAED,IAAI,SAAkB,CAAA;QACtB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAA;YACjE,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;gBACrC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;gBACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,KAAK,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAA;gBAC/C,CAAC;gBACD,OAAO,QAAQ,CAAA;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;gBAC3E,SAAS,GAAG,GAAG,CAAA;YACjB,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,6CAA6C;cAC3C,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cAC/D,gFAAgF,EAClF,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAA;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IAEtB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,GAAG,CAAC,gBAAgB,KAAK,EAAE;QACnF,CAAC,CAAC,GAAG,CAAC,gBAAgB;QACtB,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;gBACvD,CAAC,CAAC,GAAG,CAAC,YAAY;gBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAC1C,WAAW,CACZ;YACH,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAC/C,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAC/C,CAAA;IAED,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/services/embedded-packages/integrity.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A single parsed SRI (Subresource Integrity) hash, e.g. one
+ * `sha512-<base64>` segment of a lockfile `integrity` value.
+ */
+export interface IntegrityHash {
+    algorithm: string;
+    digestBase64: string;
+}
+/**
+ * Parses an SRI string (one or more space-separated `algorithm-base64`
+ * entries) into its supported hashes, unknown algorithms excluded.
+ */
+export declare function parseIntegrity(integrity: string): IntegrityHash[];
+/**
+ * Returns the strongest supported hash of an SRI string, or undefined if
+ * none of its entries use a supported algorithm.
+ */
+export declare function strongestIntegrityHash(integrity: string): IntegrityHash | undefined;
+/**
+ * Verifies content against an SRI string using its strongest supported
+ * hash. Returns false when no supported hash is present.
+ */
+export declare function verifyIntegrity(content: Buffer, integrity: string): boolean;
+/**
+ * The hex encoding of an SRI hash's digest. npm's cacache stores content
+ * under this encoding, e.g. `content-v2/sha512/<hex[0:2]>/<hex[2:4]>/<hex[4:]>`.
+ */
+export declare function integrityHashToHex(hash: IntegrityHash): string;

package/dist/services/embedded-packages/integrity.js

@@ -0,0 +1,58 @@
+import { createHash } from 'node:crypto';
+// Ordered strongest first. Lockfiles produced in the last decade only use
+// sha512 and (for very old entries) sha1, but sha384/sha256 are valid SRI.
+const SUPPORTED_ALGORITHMS = ['sha512', 'sha384', 'sha256', 'sha1'];
+/**
+ * Parses an SRI string (one or more space-separated `algorithm-base64`
+ * entries) into its supported hashes, unknown algorithms excluded.
+ */
+export function parseIntegrity(integrity) {
+    const hashes = [];
+    for (const entry of integrity.trim().split(/\s+/)) {
+        const separator = entry.indexOf('-');
+        if (separator === -1) {
+            continue;
+        }
+        const algorithm = entry.slice(0, separator);
+        const digestBase64 = entry.slice(separator + 1);
+        if (!SUPPORTED_ALGORITHMS.includes(algorithm) || digestBase64 === '') {
+            continue;
+        }
+        hashes.push({ algorithm, digestBase64 });
+    }
+    return hashes;
+}
+/**
+ * Returns the strongest supported hash of an SRI string, or undefined if
+ * none of its entries use a supported algorithm.
+ */
+export function strongestIntegrityHash(integrity) {
+    const hashes = parseIntegrity(integrity);
+    for (const algorithm of SUPPORTED_ALGORITHMS) {
+        const match = hashes.find(hash => hash.algorithm === algorithm);
+        if (match !== undefined) {
+            return match;
+        }
+    }
+    return undefined;
+}
+/**
+ * Verifies content against an SRI string using its strongest supported
+ * hash. Returns false when no supported hash is present.
+ */
+export function verifyIntegrity(content, integrity) {
+    const hash = strongestIntegrityHash(integrity);
+    if (hash === undefined) {
+        return false;
+    }
+    const digest = createHash(hash.algorithm).update(content).digest('base64');
+    return digest === hash.digestBase64;
+}
+/**
+ * The hex encoding of an SRI hash's digest. npm's cacache stores content
+ * under this encoding, e.g. `content-v2/sha512/<hex[0:2]>/<hex[2:4]>/<hex[4:]>`.
+ */
+export function integrityHashToHex(hash) {
+    return Buffer.from(hash.digestBase64, 'base64').toString('hex');
+}
+//# sourceMappingURL=integrity.js.map

package/dist/services/embedded-packages/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAWxC,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;AAEnE;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAE,SAAiB;IAC/C,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QAC/C,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACrE,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAE,SAAiB;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAA;IACxC,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAE,OAAe,EAAE,SAAiB;IACjE,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC1E,OAAO,MAAM,KAAK,IAAI,CAAC,YAAY,CAAA;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAE,IAAmB;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC"}

package/dist/services/embedded-packages/lockfile-packages.d.ts

@@ -0,0 +1,48 @@
+/**
+ * One embeddable `name@version` entry from the lockfile: a package that a
+ * registry serves as a tarball, with the integrity hash recorded for it.
+ */
+export interface LockfileRegistryPackage {
+    name: string;
+    version: string;
+    integrity: string;
+    /**
+     * The full tarball URL when the lockfile records one (npm's `resolved`,
+     * pnpm's `resolution.tarball`). When absent, the URL is derived from the
+     * registry configuration.
+     */
+    tarballUrl?: string;
+}
+/**
+ * A lockfile entry that cannot be embedded as a registry tarball, kept so
+ * that a configured spec matching only such entries gets a precise error
+ * instead of a generic "not found in the lockfile".
+ */
+export interface ExcludedLockfilePackage {
+    name: string;
+    version?: string;
+    reason: string;
+    /**
+     * Why the entry is excluded, machine-readable: 'workspace' entries are
+     * part of the project itself (safe for a wildcard to skip silently),
+     * while 'unfetchable' entries (git/file/URL dependencies, or entries
+     * without an integrity hash) cannot be embedded but may still be needed
+     * at install time.
+     */
+    kind: 'workspace' | 'unfetchable';
+}
+export interface LockfilePackages {
+    registry: LockfileRegistryPackage[];
+    excluded: ExcludedLockfilePackage[];
+}
+export declare class UnsupportedLockfileError extends Error {
+    constructor(message: string);
+}
+/**
+ * Enumerates every package entry in a lockfile, classified into embeddable
+ * registry packages and excluded (git/file/link/integrity-less) entries.
+ * Supports `pnpm-lock.yaml` (v6/v9) and `package-lock.json` (v2/v3).
+ */
+export declare function loadLockfilePackages(lockfilePath: string): Promise<LockfilePackages>;
+export declare function parsePnpmLockfilePackages(content: string): LockfilePackages;
+export declare function parseNpmLockfilePackages(content: string): LockfilePackages;