checkly 8.21.0 → 8.22.0

package/dist/services/embedded-packages/lockfile-packages.js

@@ -0,0 +1,227 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import JSON5 from 'json5';
+import semver from 'semver';
+export class UnsupportedLockfileError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'UnsupportedLockfileError';
+    }
+}
+/**
+ * Enumerates every package entry in a lockfile, classified into embeddable
+ * registry packages and excluded (git/file/link/integrity-less) entries.
+ * Supports `pnpm-lock.yaml` (v6/v9) and `package-lock.json` (v2/v3).
+ */
+export async function loadLockfilePackages(lockfilePath) {
+    const basename = path.basename(lockfilePath);
+    const content = await fs.readFile(lockfilePath, 'utf8');
+    switch (basename) {
+        case 'pnpm-lock.yaml':
+            return parsePnpmLockfilePackages(content);
+        case 'package-lock.json':
+            return parseNpmLockfilePackages(content);
+        default:
+            throw new UnsupportedLockfileError(`Embedded packages are not supported for '${basename}' lockfiles yet.`
+                + ` Only pnpm (pnpm-lock.yaml) and npm (package-lock.json) are currently supported.`);
+    }
+}
+/**
+ * Strips a pnpm peer-dependency suffix (`(react@18.2.0)`) from a package
+ * key. The v9 `packages` section doesn't use them (they live in
+ * `snapshots`), but v6 keys do.
+ */
+function stripPeerSuffix(key) {
+    const cut = key.indexOf('(');
+    return cut === -1 ? key : key.slice(0, cut);
+}
+export function parsePnpmLockfilePackages(content) {
+    const data = parseYaml(content);
+    // The version can arrive as a number: pnpm writes `lockfileVersion: '9.0'`
+    // quoted, but a YAML re-serializer (merge tooling, formatters) may drop
+    // the quotes, turning it into the number 9.
+    const lockfileVersion = String(data?.lockfileVersion ?? '');
+    const lockfileMajor = Number.parseInt(lockfileVersion, 10);
+    if (lockfileMajor !== 6 && lockfileMajor !== 9) {
+        throw new UnsupportedLockfileError(`Embedded packages require pnpm lockfile version 6 or 9`
+            + ` (found '${lockfileVersion || 'unknown'}'). Regenerate the lockfile with a supported`
+            + ` pnpm version, or update the Checkly CLI if the lockfile is newer.`);
+    }
+    const result = { registry: [], excluded: [] };
+    // Workspace-linked packages never appear in the `packages` section — only
+    // as `link:` dependencies under `importers`. Record them so a user listing
+    // their own workspace package gets a precise "cannot be embedded" error
+    // instead of a "not found, check the spelling" one.
+    const importers = data?.importers;
+    if (typeof importers === 'object' && importers !== null) {
+        const linkedNames = new Set();
+        for (const importer of Object.values(importers)) {
+            for (const group of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+                for (const [name, dep] of Object.entries(importer?.[group] ?? {})) {
+                    const version = typeof dep === 'string' ? dep : dep?.version;
+                    if (typeof version === 'string' && version.startsWith('link:') && !linkedNames.has(name)) {
+                        linkedNames.add(name);
+                        // Same distinction as npm's `link: true` entries: a link whose
+                        // target escapes the workspace is not part of the project the
+                        // bundle carries.
+                        const target = version.slice('link:'.length);
+                        const escapesWorkspace = target === '..' || target.startsWith('../') || path.isAbsolute(target);
+                        result.excluded.push({
+                            name,
+                            reason: escapesWorkspace
+                                ? `'${name}' is a local directory link outside the workspace, which cannot be embedded`
+                                    + ` as a registry tarball`
+                                : `'${name}' is a workspace package, which cannot be embedded as a registry tarball`,
+                            kind: escapesWorkspace ? 'unfetchable' : 'workspace',
+                        });
+                    }
+                }
+            }
+        }
+    }
+    const packages = data?.packages;
+    if (typeof packages !== 'object' || packages === null) {
+        return result;
+    }
+    const seen = new Set();
+    for (const [rawKey, rawEntry] of Object.entries(packages)) {
+        // v6 keys have a leading slash (`/name@1.2.3`), v9 keys do not.
+        const key = stripPeerSuffix(rawKey.startsWith('/') ? rawKey.slice(1) : rawKey);
+        // The name/ref separator is the first `@` past the name. Searching from
+        // the front (after the scope, when present) keeps the name intact when
+        // the ref itself contains `@`, as git refs do
+        // (`foo@git+ssh://git@github.com/...`).
+        const searchFrom = key.startsWith('@') ? key.indexOf('/') + 1 : 1;
+        const separator = searchFrom > 0 ? key.indexOf('@', searchFrom) : -1;
+        if (separator <= 0) {
+            continue;
+        }
+        const name = key.slice(0, separator);
+        const ref = key.slice(separator + 1);
+        if (seen.has(`${name}@${ref}`)) {
+            continue;
+        }
+        seen.add(`${name}@${ref}`);
+        // Validate with semver but keep the ref as written: semver.valid()
+        // normalizes away build metadata (`1.0.0+sha.abc` → `1.0.0`), which
+        // would break both version-pin matching and the derived tarball URL.
+        const version = semver.valid(ref) !== null ? ref : null;
+        if (version === null) {
+            result.excluded.push({
+                name,
+                reason: `'${name}@${ref}' resolves to a git, file or URL dependency,`
+                    + ` which cannot be embedded as a registry tarball`,
+                kind: 'unfetchable',
+            });
+            continue;
+        }
+        const resolution = rawEntry?.resolution;
+        const integrity = resolution?.integrity;
+        if (typeof integrity !== 'string' || integrity === '') {
+            result.excluded.push({
+                name,
+                version,
+                reason: `the lockfile records no integrity hash for '${name}@${version}',`
+                    + ` which is required to embed it`,
+                kind: 'unfetchable',
+            });
+            continue;
+        }
+        const tarball = resolution?.tarball;
+        result.registry.push({
+            name,
+            version,
+            integrity,
+            // Only absolute http(s) URLs are usable for downloading; anything
+            // else falls back to the registry-derived URL.
+            tarballUrl: typeof tarball === 'string' && /^https?:/.test(tarball) ? tarball : undefined,
+        });
+    }
+    return result;
+}
+export function parseNpmLockfilePackages(content) {
+    const data = JSON5.parse(content);
+    const lockfileVersion = data?.lockfileVersion;
+    if (lockfileVersion !== 2 && lockfileVersion !== 3) {
+        throw new UnsupportedLockfileError(`Embedded packages require npm lockfile version 2 or 3`
+            + ` (found '${lockfileVersion ?? 'unknown'}'). Update npm and regenerate the lockfile.`);
+    }
+    const packages = data?.packages;
+    const result = { registry: [], excluded: [] };
+    if (typeof packages !== 'object' || packages === null) {
+        return result;
+    }
+    const seen = new Set();
+    for (const [key, entry] of Object.entries(packages)) {
+        const lastNodeModules = key.lastIndexOf('node_modules/');
+        if (lastNodeModules === -1) {
+            // The workspace root ('') and workspace member paths are not
+            // installable registry artifacts.
+            continue;
+        }
+        // Aliased installs record the real package name in the entry; the key
+        // segment is the alias.
+        const name = typeof entry?.name === 'string'
+            ? entry.name
+            : key.slice(lastNodeModules + 'node_modules/'.length);
+        if (entry?.link === true) {
+            // `link: true` covers both workspace members and `file:` directory
+            // dependencies. A link whose target escapes the workspace is not
+            // part of the project the bundle carries, so a wildcard must not
+            // skip it silently.
+            const target = typeof entry?.resolved === 'string' ? entry.resolved : '';
+            const escapesWorkspace = target === '..' || target.startsWith('../') || path.isAbsolute(target);
+            result.excluded.push({
+                name: key.slice(lastNodeModules + 'node_modules/'.length),
+                reason: escapesWorkspace
+                    ? `'${key}' is a local directory link outside the workspace, which cannot be embedded`
+                        + ` as a registry tarball`
+                    : `'${key}' is a workspace link, which cannot be embedded as a registry tarball`,
+                kind: escapesWorkspace ? 'unfetchable' : 'workspace',
+            });
+            continue;
+        }
+        // As above: validate with semver but keep the version as recorded.
+        const version = typeof entry?.version === 'string' && semver.valid(entry.version) !== null
+            ? entry.version
+            : null;
+        const resolved = typeof entry?.resolved === 'string' ? entry.resolved : undefined;
+        if (version === null || (resolved !== undefined && !/^https?:/.test(resolved))) {
+            result.excluded.push({
+                name,
+                version: version ?? undefined,
+                reason: `'${key}' resolves to a git, file or URL dependency,`
+                    + ` which cannot be embedded as a registry tarball`,
+                kind: 'unfetchable',
+            });
+            continue;
+        }
+        if (seen.has(`${name}@${version}`)) {
+            continue;
+        }
+        const integrity = entry?.integrity;
+        if (typeof integrity !== 'string' || integrity === '') {
+            // Deliberately not marked as seen: an integrity-less copy (typically
+            // a nested bundled dependency) must not shadow a proper registry
+            // entry of the same name@version appearing later in the map.
+            result.excluded.push({
+                name,
+                version,
+                reason: `the lockfile records no integrity hash for '${name}@${version}'`
+                    + ` (typically a bundled dependency), which is required to embed it`,
+                kind: 'unfetchable',
+            });
+            continue;
+        }
+        seen.add(`${name}@${version}`);
+        result.registry.push({
+            name,
+            version,
+            integrity,
+            tarballUrl: resolved,
+        });
+    }
+    return result;
+}
+//# sourceMappingURL=lockfile-packages.js.map

package/dist/services/embedded-packages/lockfile-packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile-packages.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/lockfile-packages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,MAAM,MAAM,QAAQ,CAAA;AA0C3B,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAa,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAE,YAAoB;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IAEvD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,gBAAgB;YACnB,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAA;QAC3C,KAAK,mBAAmB;YACtB,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAA;QAC1C;YACE,MAAM,IAAI,wBAAwB,CAChC,4CAA4C,QAAQ,kBAAkB;kBACpE,kFAAkF,CACrF,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAE,GAAW;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAE,OAAe;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAE/B,2EAA2E;IAC3E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IAC1D,IAAI,aAAa,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,wDAAwD;cACtD,YAAY,eAAe,IAAI,SAAS,8CAA8C;cACtF,oEAAoE,CACvE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAE/D,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAA;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QACrC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAM,SAAS,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;gBAChF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBACvE,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAA;oBAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzF,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;wBACrB,+DAA+D;wBAC/D,8DAA8D;wBAC9D,kBAAkB;wBAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;wBAC5C,MAAM,gBAAgB,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;wBAC/F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;4BACnB,IAAI;4BACJ,MAAM,EAAE,gBAAgB;gCACtB,CAAC,CAAC,IAAI,IAAI,6EAA6E;sCACrF,wBAAwB;gCAC1B,CAAC,CAAC,IAAI,IAAI,0EAA0E;4BACtF,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;yBACrD,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,CAAC,EAAE,CAAC;QAC/D,gEAAgE;QAChE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC9E,wEAAwE;QACxE,uEAAuE;QACvE,8CAA8C;QAC9C,wCAAwC;QACxC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACjE,MAAM,SAAS,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QAEpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QAE1B,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QACvD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,MAAM,EAAE,IAAI,IAAI,IAAI,GAAG,8CAA8C;sBACjE,iDAAiD;gBACrD,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,CAAA;QACvC,MAAM,SAAS,GAAG,UAAU,EAAE,SAAS,CAAA;QACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO;gBACP,MAAM,EAAE,+CAA+C,IAAI,IAAI,OAAO,IAAI;sBACtE,gCAAgC;gBACpC,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAA;QACnC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,OAAO;YACP,SAAS;YACT,kEAAkE;YAClE,+CAA+C;YAC/C,UAAU,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC1F,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAE,OAAe;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEjC,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,CAAA;IAC7C,IAAI,eAAe,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAwB,CAChC,uDAAuD;cACrD,YAAY,eAAe,IAAI,SAAS,6CAA6C,CACxF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,eAAe,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;QACxD,IAAI,eAAe,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3B,6DAA6D;YAC7D,kCAAkC;YAClC,SAAQ;QACV,CAAC;QACD,sEAAsE;QACtE,wBAAwB;QACxB,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ;YAC1C,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QAEvD,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,oBAAoB;YACpB,MAAM,MAAM,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;YACxE,MAAM,gBAAgB,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC/F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC;gBACzD,MAAM,EAAE,gBAAgB;oBACtB,CAAC,CAAC,IAAI,GAAG,6EAA6E;0BACpF,wBAAwB;oBAC1B,CAAC,CAAC,IAAI,GAAG,uEAAuE;gBAClF,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;aACrD,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,mEAAmE;QACnE,MAAM,OAAO,GAAG,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;YACxF,CAAC,CAAC,KAAK,CAAC,OAAiB;YACzB,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QAEjF,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO,EAAE,OAAO,IAAI,SAAS;gBAC7B,MAAM,EAAE,IAAI,GAAG,8CAA8C;sBACzD,iDAAiD;gBACrD,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,SAAQ;QACV,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,qEAAqE;YACrE,iEAAiE;YACjE,6DAA6D;YAC7D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO;gBACP,MAAM,EAAE,+CAA+C,IAAI,IAAI,OAAO,GAAG;sBACrE,kEAAkE;gBACtE,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAA;QAE9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,OAAO;YACP,SAAS;YACT,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/services/embedded-packages/materializer.d.ts

@@ -0,0 +1,88 @@
+import { LockfileRegistryPackage } from './lockfile-packages.js';
+/**
+ * The directory inside the code bundle where embedded package tarballs
+ * live. This path is a contract with Checkly runners: tarballs found there
+ * are served through a local registry during the bundle's install step.
+ */
+export declare const EMBEDDED_PACKAGES_ARCHIVE_DIR = ".checkly/embedded-packages";
+export interface EmbeddedPackagesIssue {
+    type: 'invalid-spec' | 'missing-lockfile' | 'unsupported-lockfile' | 'spec-not-found' | 'spec-version-not-found' | 'spec-not-embeddable';
+    /** The offending `bundle.packages.embed` entry, when tied to one. */
+    spec?: string;
+    /** Standalone sentence describing the issue, usable on its own. */
+    message: string;
+    /**
+     * Entry-scoped detail for grouped diagnostics, phrased to follow the
+     * entry under a per-type heading — e.g. the versions the lockfile does
+     * have, or the reasons the matches cannot be embedded.
+     */
+    detail?: string;
+}
+/**
+ * One tarball selected for embedding, resolved from the lockfile.
+ */
+export interface PlannedTarball extends LockfileRegistryPackage {
+    /** Archive filename, e.g. `@acme+foo@1.2.3.tgz` (scope slash → `+`). */
+    archiveFilename: string;
+}
+export interface EmbeddedPackagesPlan {
+    tarballs: PlannedTarball[];
+    issues: EmbeddedPackagesIssue[];
+    /**
+     * Non-fatal problems worth surfacing (e.g. a spec also matching
+     * dependencies that cannot be embedded). Reported through the
+     * diagnostics channel during project validation.
+     */
+    warnings: string[];
+    /**
+     * The lockfile the specs were resolved against, for diagnostics that
+     * name it once instead of once per issue. Absent when resolution never
+     * happened — no lockfile found, or an unsupported/unparsable one (the
+     * corresponding lockfile issue explains it).
+     */
+    lockfilePath?: string;
+}
+/**
+ * A planned tarball that has been sourced into the CLI cache and is ready
+ * to be added to the code bundle.
+ */
+export interface MaterializedTarball extends PlannedTarball {
+    /** Absolute path of the verified tarball in the CLI cache. */
+    filePath: string;
+    /** Bundle-root-relative archive path (POSIX). */
+    archivePath: string;
+}
+export declare class EmbeddedPackageError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export interface EmbeddedPackagesMaterializerOptions {
+    /** Raw `bundle.packages.embed` entries. */
+    specs: string[];
+    /** Absolute path of the workspace root lockfile, when one exists. */
+    lockfilePath?: string;
+    /** Workspace root directory, used to locate the root `.npmrc`. */
+    workspaceRoot?: string;
+    /**
+     * The directory the Checkly project lives in (a workspace member in a
+     * monorepo), whose `.npmrc` takes precedence over the workspace root's.
+     */
+    contextDir?: string;
+    env?: NodeJS.ProcessEnv;
+    homedir?: string;
+}
+/**
+ * Resolves the configured `bundle.packages.embed` specs against the
+ * workspace lockfile (plan) and sources the selected tarballs into the CLI
+ * cache (materialize), through a chain of CLI cache → npm cacache →
+ * registry download, always verified against the lockfile integrity.
+ *
+ * Both stages memoize their in-flight promise: multiple Playwright checks
+ * bundle concurrently, and validation and bundling share one instance per
+ * parsed project, so the work runs exactly once.
+ */
+export declare class EmbeddedPackagesMaterializer {
+    #private;
+    constructor(options: EmbeddedPackagesMaterializerOptions);
+    plan(): Promise<EmbeddedPackagesPlan>;
+    materialize(): Promise<MaterializedTarball[]>;
+}

package/dist/services/embedded-packages/materializer.js

@@ -0,0 +1,314 @@
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import axios from 'axios';
+import Debug from 'debug';
+import PQueue from 'p-queue';
+import { assignProxy } from '../proxy.js';
+import { TarballCache, lookupNpmCacache } from './cache.js';
+import { verifyIntegrity } from './integrity.js';
+import { UnsupportedLockfileError, loadLockfilePackages, } from './lockfile-packages.js';
+import { defaultNpmrcPaths, loadNpmrcConfig, resolveAuthHeader, resolveRegistryUrl } from './npmrc.js';
+import { InvalidEmbeddedPackageSpecError, parseEmbeddedPackageSpec, specMatchesPackageName, } from './spec.js';
+const debug = Debug('checkly:cli:services:embedded-packages');
+/**
+ * The directory inside the code bundle where embedded package tarballs
+ * live. This path is a contract with Checkly runners: tarballs found there
+ * are served through a local registry during the bundle's install step.
+ */
+export const EMBEDDED_PACKAGES_ARCHIVE_DIR = '.checkly/embedded-packages';
+export class EmbeddedPackageError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'EmbeddedPackageError';
+    }
+}
+const DOWNLOAD_CONCURRENCY = 5;
+const DOWNLOAD_TIMEOUT_MS = 120_000;
+const MAX_TARBALL_BYTES = 1024 * 1024 * 1024;
+/**
+ * Joins up to 8 items, appending `<overflow>N more` for the rest — the
+ * uniform truncation for user-facing lists of packages, versions and
+ * reasons.
+ */
+function capList(items, separator, overflow) {
+    const shown = items.slice(0, 8).join(separator);
+    return items.length > 8 ? `${shown}${overflow}${items.length - 8} more` : shown;
+}
+/**
+ * Removes userinfo credentials from a URL so it can be safely included in
+ * error messages and logs (a registry URL may embed a token).
+ */
+function redactUrl(url) {
+    try {
+        const parsed = new URL(url);
+        parsed.username = '';
+        parsed.password = '';
+        return parsed.toString();
+    }
+    catch {
+        // Not parseable as a URL (e.g. a scheme-less registry entry) — strip
+        // anything that looks like a userinfo segment before displaying it.
+        return url.replace(/(^|\/\/)[^/@\s]+@/, '$1');
+    }
+}
+/**
+ * Resolves the configured `bundle.packages.embed` specs against the
+ * workspace lockfile (plan) and sources the selected tarballs into the CLI
+ * cache (materialize), through a chain of CLI cache → npm cacache →
+ * registry download, always verified against the lockfile integrity.
+ *
+ * Both stages memoize their in-flight promise: multiple Playwright checks
+ * bundle concurrently, and validation and bundling share one instance per
+ * parsed project, so the work runs exactly once.
+ */
+export class EmbeddedPackagesMaterializer {
+    #options;
+    #cache;
+    #env;
+    #homedir;
+    #plan;
+    #materialized;
+    constructor(options) {
+        this.#options = options;
+        this.#env = options.env ?? process.env;
+        this.#homedir = options.homedir ?? os.homedir();
+        this.#cache = TarballCache.default(this.#env, this.#projectRoot, process.platform, this.#homedir);
+    }
+    get #projectRoot() {
+        const { workspaceRoot, lockfilePath } = this.#options;
+        return workspaceRoot ?? (lockfilePath !== undefined ? path.dirname(lockfilePath) : undefined);
+    }
+    plan() {
+        this.#plan ??= this.#createPlan();
+        return this.#plan;
+    }
+    materialize() {
+        this.#materialized ??= this.#materializeAll();
+        return this.#materialized;
+    }
+    async #createPlan() {
+        const issues = [];
+        const warnings = [];
+        const specs = [];
+        for (const raw of this.#options.specs) {
+            try {
+                specs.push(parseEmbeddedPackageSpec(raw));
+            }
+            catch (err) {
+                issues.push({
+                    type: 'invalid-spec',
+                    spec: String(raw),
+                    message: err.message,
+                    detail: err instanceof InvalidEmbeddedPackageSpecError ? err.reason : err.message,
+                });
+            }
+        }
+        const { lockfilePath } = this.#options;
+        if (lockfilePath === undefined) {
+            issues.push({
+                type: 'missing-lockfile',
+                message: `Embedded packages require a lockfile to resolve package versions and`
+                    + ` integrity hashes, but no lockfile was found for the project.`,
+            });
+            return { tarballs: [], issues, warnings };
+        }
+        let packages;
+        try {
+            packages = await loadLockfilePackages(lockfilePath);
+        }
+        catch (err) {
+            // Any failure to read or parse the lockfile (missing file, merge
+            // conflict markers, unknown format) becomes a diagnostic naming the
+            // lockfile instead of an unhandled exception aborting the command.
+            const message = err instanceof UnsupportedLockfileError
+                ? err.message
+                : `Failed to read or parse the lockfile ('${lockfilePath}'): ${err.message}`;
+            // No lockfilePath in the result: the specs were never resolved
+            // against the lockfile, so diagnostics must not credit it.
+            issues.push({ type: 'unsupported-lockfile', message });
+            return { tarballs: [], issues, warnings };
+        }
+        debug('lockfile %s: %d registry entries, %d excluded entries', lockfilePath, packages.registry.length, packages.excluded.length);
+        // Excluded entries that share a name@version with a proper registry
+        // entry are shadowed duplicates (npm nests integrity-less bundled
+        // copies): the artifact IS embeddable through its registry entry, so
+        // they must not trigger not-embeddable errors or skip warnings.
+        const registryKeys = new Set(packages.registry.map(entry => `${entry.name}@${entry.version}`));
+        const relevantExcluded = packages.excluded.filter(entry => entry.version === undefined || !registryKeys.has(`${entry.name}@${entry.version}`));
+        const tarballs = new Map();
+        for (const spec of specs) {
+            const nameMatches = packages.registry.filter(entry => specMatchesPackageName(spec, entry.name));
+            const candidates = nameMatches
+                .filter(entry => spec.version === undefined || entry.version === spec.version);
+            const nameExcluded = relevantExcluded.filter(entry => specMatchesPackageName(spec, entry.name));
+            const looseExcluded = nameExcluded.filter(entry => spec.version === undefined || entry.version === undefined || entry.version === spec.version);
+            if (candidates.length === 0) {
+                // Excluded entries matching the exact pin (or any entry, when
+                // unpinned) carry the most actionable reason and win; a version
+                // pin that filtered out real registry matches is blamed next.
+                // Version-less excluded entries (e.g. workspace links) are a last
+                // resort, so a pinned spec is never blamed on one while a better
+                // explanation exists.
+                const strictExcluded = nameExcluded.filter(entry => spec.version === undefined || entry.version === spec.version);
+                const excludedMatches = strictExcluded.length > 0
+                    ? strictExcluded
+                    : nameMatches.length === 0 ? looseExcluded : [];
+                if (excludedMatches.length > 0) {
+                    const reasons = capList([...new Set(excludedMatches.map(entry => entry.reason))], '; ', '; and ');
+                    issues.push({
+                        type: 'spec-not-embeddable',
+                        spec: spec.raw,
+                        message: `Embedded package '${spec.raw}' cannot be embedded: ${reasons}.`,
+                        detail: reasons,
+                    });
+                }
+                else if (nameMatches.length > 0) {
+                    const versions = capList([...new Set(nameMatches.map(entry => entry.version))], ', ', ' and ');
+                    issues.push({
+                        type: 'spec-version-not-found',
+                        spec: spec.raw,
+                        message: `Embedded package '${spec.raw}' matches package name(s) in the lockfile`
+                            + ` ('${lockfilePath}'), but none of them at version ${spec.version}`
+                            + ` (lockfile has: ${versions}).`,
+                        detail: `lockfile has: ${versions}`,
+                    });
+                }
+                else {
+                    const hint = spec.namePattern !== undefined
+                        ? `pattern matches its name${spec.version !== undefined ? ' and the version is spelled correctly' : ''}`
+                        : `name ${spec.version !== undefined ? 'and version are' : 'is'} spelled correctly`;
+                    issues.push({
+                        type: 'spec-not-found',
+                        spec: spec.raw,
+                        message: `Embedded package '${spec.raw}' does not match any package in the lockfile`
+                            + ` ('${lockfilePath}'). Make sure the package is installed and the ${hint}.`,
+                    });
+                }
+                continue;
+            }
+            // When the spec also reaches entries it cannot embed, that is not
+            // the hard error a fully-unresolvable spec gets. Workspace members
+            // (part of the project itself) are skipped silently; git/file/URL
+            // and integrity-less matches cannot be embedded but may still be
+            // needed at install time, so skipping them is said out loud.
+            const workspace = looseExcluded.filter(entry => entry.kind === 'workspace');
+            if (workspace.length > 0) {
+                debug('spec %s: %d workspace matches skipped: %j', spec.raw, workspace.length, workspace.map(entry => entry.name));
+            }
+            const unfetchable = looseExcluded.filter(entry => entry.kind === 'unfetchable');
+            if (unfetchable.length > 0) {
+                const names = [...new Set(unfetchable.map(entry => entry.name))];
+                warnings.push(`Embedded package '${spec.raw}' also matches ${names.length} package(s) that cannot`
+                    + ` be embedded as registry tarballs and were skipped: ${capList(names, ', ', ' and ')}.`
+                    + ` The runner must be able to fetch these itself.`);
+            }
+            if (spec.namePattern !== undefined) {
+                // Wildcards select invisibly, but only the debug log says what they
+                // selected. Selections that need attention surface louder: a
+                // pattern matching nothing is a fatal validation issue, and matches
+                // that cannot be embedded produce a warning diagnostic.
+                debug('pattern %s matched %d package(s): %j', spec.raw, candidates.length, candidates.map(entry => `${entry.name}@${entry.version}`));
+            }
+            for (const entry of candidates) {
+                tarballs.set(`${entry.name}@${entry.version}`, {
+                    ...entry,
+                    archiveFilename: `${entry.name.replace(/\//g, '+')}@${entry.version}.tgz`,
+                });
+            }
+        }
+        debug('plan: %d tarballs, %d issues, %d warnings', tarballs.size, issues.length, warnings.length);
+        return {
+            tarballs: [...tarballs.values()].sort((a, b) => a.archiveFilename.localeCompare(b.archiveFilename)),
+            issues,
+            warnings,
+            lockfilePath,
+        };
+    }
+    async #materializeAll() {
+        const { tarballs, issues } = await this.plan();
+        // Commands validate before bundling and exit on fatal diagnostics, so
+        // this is a defensive backstop for direct/programmatic use.
+        if (issues.length > 0) {
+            throw new EmbeddedPackageError(`Cannot embed packages due to configuration issues:\n\n`
+                + issues.map(issue => `  ${issue.message}`).join('\n'));
+        }
+        if (tarballs.length === 0) {
+            return [];
+        }
+        // Safe to assert: a missing lockfile is a plan issue, and issues abort
+        // above.
+        const npmrcConfig = await loadNpmrcConfig(defaultNpmrcPaths(this.#projectRoot, this.#homedir, this.#options.contextDir), this.#env);
+        const queue = new PQueue({ concurrency: DOWNLOAD_CONCURRENCY });
+        const results = await queue.addAll(tarballs.map(tarball => async () => {
+            const filePath = await this.#obtainTarball(tarball, npmrcConfig);
+            return {
+                ...tarball,
+                filePath,
+                archivePath: `${EMBEDDED_PACKAGES_ARCHIVE_DIR}/${tarball.archiveFilename}`,
+            };
+        }));
+        return results;
+    }
+    async #obtainTarball(tarball, npmrcConfig) {
+        const cached = await this.#cache.get(tarball.integrity);
+        if (cached !== undefined) {
+            debug('%s@%s: CLI cache hit', tarball.name, tarball.version);
+            return cached;
+        }
+        const fromNpmCacache = await lookupNpmCacache(tarball.integrity, this.#env, process.platform, this.#homedir);
+        if (fromNpmCacache !== undefined) {
+            debug('%s@%s: npm cache hit', tarball.name, tarball.version);
+            return await this.#cache.put(tarball.integrity, fromNpmCacache);
+        }
+        const url = tarball.tarballUrl ?? this.#deriveTarballUrl(tarball, npmrcConfig);
+        if (!URL.canParse(url)) {
+            throw new EmbeddedPackageError(`The tarball URL for embedded package '${tarball.name}@${tarball.version}'`
+                + ` is not a valid URL: '${redactUrl(url)}'. Check the 'registry' configuration`
+                + ` in your .npmrc (it must be an absolute URL including the protocol).`);
+        }
+        debug('%s@%s: downloading from %s', tarball.name, tarball.version, redactUrl(url));
+        const content = await this.#download(tarball, url, npmrcConfig);
+        if (!verifyIntegrity(content, tarball.integrity)) {
+            throw new EmbeddedPackageError(`The tarball downloaded for embedded package '${tarball.name}@${tarball.version}'`
+                + ` from '${redactUrl(url)}' does not match the integrity hash recorded in the lockfile`
+                + ` ('${tarball.integrity}'). The registry may be serving a different artifact`
+                + ` than the one the lockfile was created against.`);
+        }
+        return await this.#cache.put(tarball.integrity, content);
+    }
+    #deriveTarballUrl(tarball, npmrcConfig) {
+        const registryUrl = resolveRegistryUrl(npmrcConfig, tarball.name, this.#env);
+        const basename = tarball.name.split('/').pop();
+        return `${registryUrl}${tarball.name}/-/${basename}-${tarball.version}.tgz`;
+    }
+    async #download(tarball, url, npmrcConfig) {
+        const authHeader = resolveAuthHeader(npmrcConfig, url, this.#env);
+        try {
+            const response = await axios.get(url, assignProxy(url, {
+                responseType: 'arraybuffer',
+                headers: {
+                    // Ask for the raw artifact: a registry or proxy that labels the
+                    // already-gzipped tarball with `Content-Encoding: gzip` would
+                    // otherwise make axios gunzip it, breaking integrity verification
+                    // with a misleading "different artifact" error.
+                    'accept-encoding': 'identity',
+                    ...(authHeader !== undefined ? { authorization: authHeader } : {}),
+                },
+                timeout: DOWNLOAD_TIMEOUT_MS,
+                maxContentLength: MAX_TARBALL_BYTES,
+            }));
+            return Buffer.from(response.data);
+        }
+        catch (err) {
+            const status = err?.response?.status;
+            const statusHint = status !== undefined ? ` (HTTP ${status})` : '';
+            const authHint = status === 401 || status === 403
+                ? ` Check that your .npmrc contains valid credentials for this registry.`
+                : '';
+            throw new EmbeddedPackageError(`Failed to download embedded package '${tarball.name}@${tarball.version}'`
+                + ` from '${redactUrl(url)}'${statusHint}.${authHint}`, { cause: err });
+        }
+    }
+}
+//# sourceMappingURL=materializer.js.map