checkly 8.22.0 → 8.23.0

package/dist/services/checkly-config-loader.js

@@ -3,7 +3,9 @@ import fs from 'node:fs/promises';
 import { findPlaywrightConfigPath, getDefaultChecklyConfig, writeChecklyConfigFile } from './util.js';
 import { Session } from '../constructs/index.js';
 import { normalizeDependencyCacheVersion } from './check-parser/cache-hash.js';
+import { normalizePackagePrune } from './check-parser/package-prune.js';
 import { parseEmbeddedPackageSpec } from './embedded-packages/spec.js';
+import { validateRegistries } from './runner/registries.js';
 function isString(obj) {
     return (Object.prototype.toString.call(obj) === '[object String]');
 }
@@ -84,6 +86,7 @@ export async function loadChecklyConfig(dir, filenames = defaultFilenames, write
         validateConfigFields(config, ['logicalId', 'projectName']);
         validateDependencyCacheVersion(config);
         validateBundle(config);
+        validateRunner(config);
         const constructs = Session.checklyConfigFileConstructs;
         Session.checklyConfigFileConstructs = [];
         if (config.cli?.loader) {
@@ -141,6 +144,12 @@ function validateBundle(config) {
     if (packages === null || typeof packages !== 'object' || Array.isArray(packages)) {
         throw new Error(`Config field 'bundle.packages' must be an object if set`);
     }
+    try {
+        normalizePackagePrune(packages.prune);
+    }
+    catch (cause) {
+        throw new Error(`Config field 'bundle.packages.prune' is invalid: ${cause.message}`, { cause });
+    }
     const embeddedPackages = packages.embed;
     if (embeddedPackages === undefined) {
         return;
@@ -157,4 +166,34 @@ function validateBundle(config) {
         }
     }
 }
+function validateRunner(config) {
+    const { runner } = config;
+    if (runner === undefined) {
+        return;
+    }
+    // Same rationale as `validateBundle`: plain-JS configs bypass the
+    // TypeScript type, and a misshapen `runner` block would otherwise read as
+    // `registries: undefined` and silently disable routing, surfacing only as
+    // an install failure on the runner.
+    if (runner === null || typeof runner !== 'object' || Array.isArray(runner)) {
+        throw new Error(`Config field 'runner' must be an object if set`);
+    }
+    // A misspelled key (`registires`) would silently disable routing the same
+    // way a misshapen block would.
+    for (const key of Object.keys(runner)) {
+        if (key !== 'registries') {
+            throw new Error(`Config field 'runner' contains unknown field '${key}' (expected only: 'registries')`);
+        }
+    }
+    const { registries } = runner;
+    if (registries === undefined) {
+        return;
+    }
+    try {
+        validateRegistries(registries);
+    }
+    catch (cause) {
+        throw new Error(`Config field 'runner.registries' is invalid: ${cause.message}`, { cause });
+    }
+}
 //# sourceMappingURL=checkly-config-loader.js.map

package/dist/services/checkly-config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkly-config-loader.js","sourceRoot":"","sources":["../../src/services/checkly-config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAGrG,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAMhD,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAA;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAmKtE,SAAS,QAAQ,CAAE,GAAQ;IACzB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,iBAAiB,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,SAAS,GAAG;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;KACrB,CAAA;IACD,IAAI,MAAM,CAAA;IACV,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QAClD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG;gBACP,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC9B,QAAQ,EAAE,UAAU;aACrB,CAAA;YACD,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,WAAW,CAAU;IACrB,WAAW,CAAU;IAErB,YAAa,WAAqB,EAAE,WAAqB,EAAE,OAAsB;QAC/E,MAAM,OAAO,GAAG,8EAA8E;cAC1F,MAAM;cACN,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;cAChE,MAAM;cACN,oCAAoC;cACpC,MAAM;cACN,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;CACrB,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,SAAS,GAAG,gBAAgB,EAC5B,qBAA8B,IAAI,EAClC,oBAA6B;IAE7B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAA;IACvC,IAAI,CAAC;QACH,IAAI,MAAiC,CAAA;QACrC,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAA;QACxC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAgB,QAAQ,CAAC,CAAA;YACxD,MAAK;QACP,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;QAC9F,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC,CAAA;QACnE,8BAA8B,CAAC,MAAM,CAAC,CAAA;QACtC,cAAc,CAAC,MAAM,CAAC,CAAA;QAEtB,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAA;QAEtD,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAA;QACxC,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAA;QACpC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,wBAAwB,GAAG,KAAK,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,SAAmB,EACnB,oBAA6B,IAAI,EACjC,MAAe;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,oBAAoB,GAAG,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACpE,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAA;QACxG,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAE,MAAqB,EAAE,MAA+B;IACnF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,iBAAiB,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CAAE,MAAqB;IAC5D,IAAI,CAAC;QACH,+BAA+B,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0FAA0F,EAC1F,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAE,MAAqB;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IACzB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAM;IACR,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;IAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAA;IACvC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAM;IACR,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oDAAqD,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5G,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"checkly-config-loader.js","sourceRoot":"","sources":["../../src/services/checkly-config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAGrG,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAMhD,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAA;AAC9E,OAAO,EAAuB,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAc,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AA2TvE,SAAS,QAAQ,CAAE,GAAQ;IACzB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,iBAAiB,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,SAAS,GAAG;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;KACrB,CAAA;IACD,IAAI,MAAM,CAAA;IACV,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;QAClD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG;gBACP,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC9B,QAAQ,EAAE,UAAU;aACrB,CAAA;YACD,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,WAAW,CAAU;IACrB,WAAW,CAAU;IAErB,YAAa,WAAqB,EAAE,WAAqB,EAAE,OAAsB;QAC/E,MAAM,OAAO,GAAG,8EAA8E;cAC1F,MAAM;cACN,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;cAChE,MAAM;cACN,oCAAoC;cACpC,MAAM;cACN,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;CACrB,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,SAAS,GAAG,gBAAgB,EAC5B,qBAA8B,IAAI,EAClC,oBAA6B;IAE7B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAA;IACvC,IAAI,CAAC;QACH,IAAI,MAAiC,CAAA;QACrC,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAA;QACxC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAgB,QAAQ,CAAC,CAAA;YACxD,MAAK;QACP,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;QAC9F,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC,CAAA;QACnE,8BAA8B,CAAC,MAAM,CAAC,CAAA;QACtC,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,cAAc,CAAC,MAAM,CAAC,CAAA;QAEtB,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAA;QAEtD,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAA;QACxC,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAA;QACpC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,wBAAwB,GAAG,KAAK,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,SAAmB,EACnB,oBAA6B,IAAI,EACjC,MAAe;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,oBAAoB,GAAG,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACpE,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAA;QACxG,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAE,MAAqB,EAAE,MAA+B;IACnF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,iBAAiB,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CAAE,MAAqB;IAC5D,IAAI,CAAC;QACH,+BAA+B,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0FAA0F,EAC1F,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAE,MAAqB;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IACzB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAM;IACR,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;IAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,CAAC;QACH,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAqD,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5G,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAA;IACvC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAM;IACR,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oDAAqD,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5G,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAE,MAAqB;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IACzB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAM;IACR,CAAC;IAED,kEAAkE;IAClE,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,0EAA0E;IAC1E,+BAA+B;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,iCAAiC,CAAC,CAAA;QACxG,CAAC;IACH,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IAC7B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gDAAiD,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACxG,CAAC;AACH,CAAC"}

package/dist/services/embedded-packages/cache.d.ts

@@ -18,7 +18,8 @@ export declare function resolveCacheDirs(env?: NodeJS.ProcessEnv, projectRoot?:
  * Reads consult every root and verify the content, so a corrupt entry
  * degrades to a cache miss rather than a user-facing error. Writes go to
  * the first root that accepts them, so an unwritable project tree falls
- * back to the per-user cache instead of failing.
+ * back to the per-user cache instead of failing — unless the unwritable
+ * root already holds a verifying entry, which satisfies the write as-is.
  */
 export declare class TarballCache {
     #private;
@@ -32,9 +33,12 @@ export declare class TarballCache {
     /**
      * Stores verified tarball content in the first writable root and returns
      * its path. The write is atomic (temp file + rename), so concurrent
-     * processes sharing the cache never observe a torn file. The caller is
-     * responsible for verifying the content against the lockfile integrity
-     * beforehand.
+     * processes sharing the cache never observe a torn file — and because
+     * the store is content-addressed, losing a write race is itself a
+     * success: a write that fails while the destination already holds
+     * content matching the integrity returns that entry instead of erroring.
+     * The caller is responsible for verifying the content against the
+     * lockfile integrity beforehand.
      */
     put(integrity: string, content: Buffer): Promise<string>;
 }

package/dist/services/embedded-packages/cache.js

@@ -56,7 +56,8 @@ export function resolveCacheDirs(env = process.env, projectRoot, platform = proc
  * Reads consult every root and verify the content, so a corrupt entry
  * degrades to a cache miss rather than a user-facing error. Writes go to
  * the first root that accepts them, so an unwritable project tree falls
- * back to the per-user cache instead of failing.
+ * back to the per-user cache instead of failing — unless the unwritable
+ * root already holds a verifying entry, which satisfies the write as-is.
  */
 export class TarballCache {
     #rootDirs;
@@ -100,9 +101,12 @@ export class TarballCache {
     /**
      * Stores verified tarball content in the first writable root and returns
      * its path. The write is atomic (temp file + rename), so concurrent
-     * processes sharing the cache never observe a torn file. The caller is
-     * responsible for verifying the content against the lockfile integrity
-     * beforehand.
+     * processes sharing the cache never observe a torn file — and because
+     * the store is content-addressed, losing a write race is itself a
+     * success: a write that fails while the destination already holds
+     * content matching the integrity returns that entry instead of erroring.
+     * The caller is responsible for verifying the content against the
+     * lockfile integrity beforehand.
      */
     async put(integrity, content) {
         const hash = strongestIntegrityHash(integrity);
@@ -123,7 +127,23 @@ export class TarballCache {
                 return filePath;
             }
             catch (err) {
-                debug('cache root %s is not writable: %s', rootDir, err.message);
+                // Concurrent writers race onto the same content-addressed path —
+                // two same-integrity puts in this process, or another process
+                // sharing the cache. POSIX rename silently replaces, but on
+                // Windows the losing rename fails with EPERM while the winner
+                // still holds the destination open. Whatever failed, a
+                // destination that verifies means the content is cached, which is
+                // all a put promises. The recovery read is deliberately
+                // single-shot and best-effort: retrying would add fixed latency to
+                // every genuinely unwritable root (the common non-race case), so a
+                // read that itself hits a transient lock falls through to the
+                // normal failure path instead.
+                const existing = await fs.readFile(filePath).catch(() => undefined);
+                if (existing !== undefined && verifyIntegrity(existing, integrity)) {
+                    debug('cache write under %s failed (%s), but the destination already verifies', rootDir, err.message);
+                    return filePath;
+                }
+                debug('cache write under %s failed: %s', rootDir, err.message);
                 lastError = err;
             }
             finally {
@@ -131,7 +151,8 @@ export class TarballCache {
             }
         }
         throw new Error(`Unable to write the embedded-packages cache`
-            + ` (tried ${this.#rootDirs.map(dir => `'${dir}'`).join(', ')}).`
+            + ` (tried ${this.#rootDirs.map(dir => `'${dir}'`).join(', ')}):`
+            + ` ${lastError?.message ?? 'unknown error'}.`
             + ` Set CHECKLY_CACHE_DIR to a writable directory to override the cache location.`, { cause: lastError });
     }
 }

package/dist/services/embedded-packages/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,OAAO,MAAM,cAAc,CAAA;AAElC,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAiB,kBAAkB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE3G,MAAM,KAAK,GAAG,KAAK,CAAC,wCAAwC,CAAC,CAAA;AAE7D,SAAS,gBAAgB,CACvB,GAAsB,EACtB,QAAyB,EACzB,OAAe;IAEf,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC3D,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;gBAC5E,CAAC,CAAC,GAAG,CAAC,YAAY;gBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAA;YACvC,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;gBACjE,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAChC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,OAAO,CAAC,GAAG,EACpC,WAAoB,EACpB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAA;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAA;IACf,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACvB,SAAS,CAAU;IAEnB,YAAa,QAA2B;QACtC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,CAAC,OAAO,CACZ,MAAyB,OAAO,CAAC,GAAG,EACpC,WAAoB,EACpB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;QAEtB,OAAO,IAAI,YAAY,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC;aAC1E,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,QAAQ,CAAE,OAAe,EAAE,IAAmB;QAC5C,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACnF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAE,SAAiB;QAC1B,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAE7C,IAAI,OAAe,CAAA;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBACzC,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACtD,SAAQ;YACV,CAAC;YAED,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAE,SAAiB,EAAE,OAAe;QAC3C,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,IAAI,CAAC,CAAA;QAC/F,CAAC;QAED,IAAI,SAAkB,CAAA;QACtB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAA;YACjE,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;gBACrC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;gBACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,KAAK,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAA;gBAC/C,CAAC;gBACD,OAAO,QAAQ,CAAA;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;gBAC3E,SAAS,GAAG,GAAG,CAAA;YACjB,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,6CAA6C;cAC3C,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cAC/D,gFAAgF,EAClF,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAA;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IAEtB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,GAAG,CAAC,gBAAgB,KAAK,EAAE;QACnF,CAAC,CAAC,GAAG,CAAC,gBAAgB;QACtB,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;gBACvD,CAAC,CAAC,GAAG,CAAC,YAAY;gBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAC1C,WAAW,CACZ;YACH,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAC/C,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAC/C,CAAA;IAED,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,OAAO,MAAM,cAAc,CAAA;AAElC,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAiB,kBAAkB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE3G,MAAM,KAAK,GAAG,KAAK,CAAC,wCAAwC,CAAC,CAAA;AAE7D,SAAS,gBAAgB,CACvB,GAAsB,EACtB,QAAyB,EACzB,OAAe;IAEf,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC3D,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;gBAC5E,CAAC,CAAC,GAAG,CAAC,YAAY;gBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAA;YACvC,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;gBACjE,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAChC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,OAAO,CAAC,GAAG,EACpC,WAAoB,EACpB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAA;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAA;IACf,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,SAAS,CAAU;IAEnB,YAAa,QAA2B;QACtC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,CAAC,OAAO,CACZ,MAAyB,OAAO,CAAC,GAAG,EACpC,WAAoB,EACpB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;QAEtB,OAAO,IAAI,YAAY,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC;aAC1E,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,QAAQ,CAAE,OAAe,EAAE,IAAmB;QAC5C,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACnF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAE,SAAiB;QAC1B,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAE7C,IAAI,OAAe,CAAA;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBACzC,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACtD,SAAQ;YACV,CAAC;YAED,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CAAE,SAAiB,EAAE,OAAe;QAC3C,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,IAAI,CAAC,CAAA;QAC/F,CAAC;QAED,IAAI,SAAkB,CAAA;QACtB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAA;YACjE,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;gBACrC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;gBACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,KAAK,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAA;gBAC/C,CAAC;gBACD,OAAO,QAAQ,CAAA;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iEAAiE;gBACjE,8DAA8D;gBAC9D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,uDAAuD;gBACvD,kEAAkE;gBAClE,wDAAwD;gBACxD,mEAAmE;gBACnE,mEAAmE;gBACnE,8DAA8D;gBAC9D,+BAA+B;gBAC/B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;oBACnE,KAAK,CAAC,wEAAwE,EAC5E,OAAO,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;oBAClC,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBACD,KAAK,CAAC,iCAAiC,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;gBACzE,SAAS,GAAG,GAAG,CAAA;YACjB,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,6CAA6C;cAC3C,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cAC/D,IAAK,SAA+B,EAAE,OAAO,IAAI,eAAe,GAAG;cACnE,gFAAgF,EAClF,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAA;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IAEtB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,GAAG,CAAC,gBAAgB,KAAK,EAAE;QACnF,CAAC,CAAC,GAAG,CAAC,gBAAgB;QACtB,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;gBACvD,CAAC,CAAC,GAAG,CAAC,YAAY;gBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAC1C,WAAW,CACZ;YACH,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAC/C,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAC/C,CAAA;IAED,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/services/embedded-packages/diagnostics.d.ts

@@ -0,0 +1,129 @@
+import { LoadedNpmrcConfig } from './npmrc.js';
+/**
+ * Joins up to 8 items, appending `<overflow>N more` for the rest — the
+ * uniform truncation for user-facing lists of packages, versions and
+ * reasons.
+ */
+export declare function capList(items: string[], separator: string, overflow: string): string;
+/** Quotes and joins a list of names for a message. */
+export declare function quotedList(names: string[]): string;
+/** Stand-in for a URL that cannot be shown without risking a credential. */
+export declare const UNPRINTABLE_URL = "(withheld: unparseable and may contain credentials)";
+/**
+ * Rebuilds a URL from the parts that cannot carry a credential, so it can
+ * safely appear in error messages and logs.
+ *
+ * Only scheme and host survive. Userinfo, path, query and fragment are
+ * dropped by construction rather than stripped: a registry URL may embed a
+ * token in its userinfo, a pre-signed CDN URL puts its signature in the
+ * query, and some registries take a token as a PATH segment
+ * (`https://host/<token>/npm/`). The path is the component least worth
+ * keeping anyway — every message that shows a URL already names the
+ * package and version separately, which is what the path encodes.
+ *
+ * A string that does not parse, parses without a host, or names a scheme
+ * nothing here fetches over yields the placeholder instead — deliberately
+ * the same rule as what may be requested, so a URL is echoable exactly when
+ * it was fetchable. Earlier revisions tried to redact such strings with
+ * a regex and leaked a credential four times over as many review rounds —
+ * through the first `@` only, through an empty userinfo, through a
+ * host-less parse, and through an authority that did not start at offset
+ * zero. Nothing short of a parser can tell userinfo from a path in a
+ * malformed string, so this follows the precedent already set for proxy
+ * URLs in `rest/errors.ts` and declines to echo it at all. Callers name the
+ * configuration key and file that produced the value instead, which is
+ * where the reader would go to look anyway.
+ */
+export declare function redactUrl(url: string): string;
+/**
+ * Where the credentials sent with a request came from: a nerf-darted
+ * config entry, or userinfo embedded in the URL itself.
+ *
+ * The `url` case carries a whole `UrlOrigin` rather than mirroring its
+ * members, because the two must agree on every variant and a hand-kept
+ * copy did not: a variant added to `UrlOrigin` alone once reported
+ * registry-issued credentials as coming from a config line that contained
+ * none. Reusing the type makes the compiler enforce what review had to.
+ */
+export type SentCredentials = {
+    from: 'config';
+    keys: string[];
+} | {
+    from: 'url';
+    origin: UrlOrigin;
+};
+/**
+ * Where a tarball URL came from: the lockfile recorded it verbatim, the
+ * registry returned it in this package's metadata, or the CLI built it from
+ * a registry. `registryKey` is absent when nothing configured one and the
+ * public npm registry was assumed.
+ *
+ * Read both to attribute credentials the URL itself carries and to say
+ * which setting produced a URL nothing can be fetched from — and the two
+ * answers differ, so the variants are not interchangeable: a metadata URL
+ * is the registry's to fix, not the project's.
+ */
+export type UrlOrigin = RecordedUrlOrigin | {
+    registryKey?: string;
+};
+/**
+ * A URL this CLI did not compose: something else handed it over already
+ * formed, so it can be unusable however it likes.
+ *
+ * A URL the CLI builds itself cannot be. The registry it is built from is
+ * checked first, and appending a path to a URL that parses with a host
+ * leaves both intact — so those origins never reach a message about an
+ * unusable URL, and are not in this type.
+ */
+export type RecordedUrlOrigin = {
+    lockfile: string;
+} | {
+    metadata: {
+        registryKey?: string;
+    };
+};
+/**
+ * Says where an unusable URL came from, and therefore whose it is to fix.
+ * The advice has to match the branch: telling someone to correct their
+ * registry setting when the bad value came out of the lockfile sends them
+ * to a setting that is already correct.
+ */
+export declare function describeUnusableUrlOrigin(origin: RecordedUrlOrigin, npmrc: LoadedNpmrcConfig): string;
+/** What a redirect did to the credentials on a request. */
+export interface RedirectOutcome {
+    /** The host the request was last redirected to. */
+    host?: string;
+    /** True when credentials were sent but did not survive the hop. */
+    credentialsDropped?: boolean;
+}
+/**
+ * Names config keys and where they came from, for a hint sentence. Keys are
+ * listed individually because precedence is per key: the halves of a
+ * `username`/`_password` pair can come from different sources.
+ */
+export declare function describeConfigKeys(keys: string[], npmrc: LoadedNpmrcConfig): string;
+/**
+ * Explains an HTTP failure that authentication could account for.
+ *
+ * 404 gets the same treatment as 401/403 because registries routinely hide
+ * packages the caller is not authorized to see behind a 404 — npmjs does —
+ * which otherwise reads as "this package does not exist" and sends people
+ * looking in entirely the wrong place. The wording stays hedged for 404,
+ * where a genuinely missing package is equally likely.
+ *
+ * Whenever credentials were sent, the message names where they came from.
+ * They can come from any of several files or an environment variable, so
+ * "your credentials were rejected" without saying which source supplied
+ * them leaves the reader exactly as stuck as a bare 404.
+ */
+export declare function downloadFailureHint(status: number | undefined, sent: SentCredentials | undefined, npmrc: LoadedNpmrcConfig, redirect?: RedirectOutcome): string;
+/**
+ * Names any config file that existed but could not be read, as a sentence
+ * with a leading space or the empty string.
+ *
+ * Worth saying on any failure a credential could explain, not only the ones
+ * that got as far as a status code: a skipped `auth.ini` is invisible
+ * otherwise, and it is the likeliest thing to be missing when a private
+ * package cannot be resolved at all.
+ */
+export declare function describeUnreadableConfig(npmrc: LoadedNpmrcConfig): string;

package/dist/services/embedded-packages/diagnostics.js

@@ -0,0 +1,212 @@
+import { NPM_CONFIG_ENV_PREFIX } from './npmrc.js';
+import { FETCHABLE_URL_REQUIREMENT, parseFetchableUrl } from './url.js';
+/**
+ * Joins up to 8 items, appending `<overflow>N more` for the rest — the
+ * uniform truncation for user-facing lists of packages, versions and
+ * reasons.
+ */
+export function capList(items, separator, overflow) {
+    const shown = items.slice(0, 8).join(separator);
+    return items.length > 8 ? `${shown}${overflow}${items.length - 8} more` : shown;
+}
+/** Quotes and joins a list of names for a message. */
+export function quotedList(names) {
+    return capList(names.map(name => `'${name}'`), ', ', ' and ');
+}
+/** Stand-in for a URL that cannot be shown without risking a credential. */
+export const UNPRINTABLE_URL = '(withheld: unparseable and may contain credentials)';
+/**
+ * Rebuilds a URL from the parts that cannot carry a credential, so it can
+ * safely appear in error messages and logs.
+ *
+ * Only scheme and host survive. Userinfo, path, query and fragment are
+ * dropped by construction rather than stripped: a registry URL may embed a
+ * token in its userinfo, a pre-signed CDN URL puts its signature in the
+ * query, and some registries take a token as a PATH segment
+ * (`https://host/<token>/npm/`). The path is the component least worth
+ * keeping anyway — every message that shows a URL already names the
+ * package and version separately, which is what the path encodes.
+ *
+ * A string that does not parse, parses without a host, or names a scheme
+ * nothing here fetches over yields the placeholder instead — deliberately
+ * the same rule as what may be requested, so a URL is echoable exactly when
+ * it was fetchable. Earlier revisions tried to redact such strings with
+ * a regex and leaked a credential four times over as many review rounds —
+ * through the first `@` only, through an empty userinfo, through a
+ * host-less parse, and through an authority that did not start at offset
+ * zero. Nothing short of a parser can tell userinfo from a path in a
+ * malformed string, so this follows the precedent already set for proxy
+ * URLs in `rest/errors.ts` and declines to echo it at all. Callers name the
+ * configuration key and file that produced the value instead, which is
+ * where the reader would go to look anyway.
+ */
+export function redactUrl(url) {
+    // `origin` is deliberately not used to rebuild it: that is the string
+    // "null" for non-special schemes.
+    const parsed = parseFetchableUrl(url);
+    return parsed === undefined ? UNPRINTABLE_URL : `${parsed.protocol}//${parsed.host}`;
+}
+/**
+ * Names the registry a URL came from, by the key that configured it or as
+ * the assumed default when nothing did.
+ */
+function describeRegistrySource(registryKey, npmrc) {
+    return registryKey !== undefined
+        ? `the registry configured by ${describeConfigKeys([registryKey], npmrc)}`
+        : 'the default registry';
+}
+/**
+ * Says where an unusable URL came from, and therefore whose it is to fix.
+ * The advice has to match the branch: telling someone to correct their
+ * registry setting when the bad value came out of the lockfile sends them
+ * to a setting that is already correct.
+ */
+export function describeUnusableUrlOrigin(origin, npmrc) {
+    if ('lockfile' in origin) {
+        return `It was recorded in '${origin.lockfile}', whose tarball URL for this package`
+            + ` is not ${FETCHABLE_URL_REQUIREMENT}.`;
+    }
+    const registry = describeRegistrySource(origin.metadata.registryKey, npmrc);
+    const whose = origin.metadata.registryKey !== undefined
+        ? `so check that the setting points at the registry you meant before taking it up with whoever runs it.`
+        : `and nothing here configures a registry, so this came from the public one.`;
+    return `It came from the package metadata served by ${registry}, which returned a tarball URL`
+        + ` that is not ${FETCHABLE_URL_REQUIREMENT}. The URL is the registry's to correct, ${whose}`;
+}
+/**
+ * Names config keys and where they came from, for a hint sentence. Keys are
+ * listed individually because precedence is per key: the halves of a
+ * `username`/`_password` pair can come from different sources.
+ */
+export function describeConfigKeys(keys, npmrc) {
+    const described = keys.map(key => {
+        const origin = npmrc.origins.get(key);
+        switch (origin?.kind) {
+            // Name the variable verbatim: the stored key has the `npm_config_`
+            // prefix stripped and may be case-folded, so echoing it would name
+            // nothing the user can search their environment for.
+            case 'env':
+                return `the '${origin.variable}' environment variable`;
+            case 'file':
+                return `'${key}' in '${origin.path}'`;
+            default:
+                return `'${key}'`;
+        }
+    });
+    return capList(described, ', ', ' and ');
+}
+/**
+ * The places a credential could have been configured, highest precedence
+ * first. The environment channel is always consulted and outranks every
+ * file, so a list that omits it sends people to edit files that cannot win.
+ */
+function describeConfigSources(npmrc) {
+    return quotedList([
+        `${NPM_CONFIG_ENV_PREFIX}* environment variables`,
+        ...npmrc.files,
+    ]);
+}
+/**
+ * Names where the credentials on a request came from, as a sentence tail
+ * ending in a full stop.
+ */
+function describeSentCredentials(sent, npmrc) {
+    if (sent.from === 'config') {
+        return `${describeConfigKeys(sent.keys, npmrc)}.`;
+    }
+    const { origin } = sent;
+    if ('lockfile' in origin) {
+        return `the tarball URL recorded in '${origin.lockfile}'.`;
+    }
+    if ('metadata' in origin) {
+        return `the tarball URL that ${describeRegistrySource(origin.metadata.registryKey, npmrc)} returned`
+            + ` in this package's metadata, so they were issued by that registry rather than configured here.`;
+    }
+    return `the URL of ${describeRegistrySource(origin.registryKey, npmrc)}.`;
+}
+/**
+ * Explains an HTTP failure that authentication could account for.
+ *
+ * 404 gets the same treatment as 401/403 because registries routinely hide
+ * packages the caller is not authorized to see behind a 404 — npmjs does —
+ * which otherwise reads as "this package does not exist" and sends people
+ * looking in entirely the wrong place. The wording stays hedged for 404,
+ * where a genuinely missing package is equally likely.
+ *
+ * Whenever credentials were sent, the message names where they came from.
+ * They can come from any of several files or an environment variable, so
+ * "your credentials were rejected" without saying which source supplied
+ * them leaves the reader exactly as stuck as a bare 404.
+ */
+export function downloadFailureHint(status, sent, npmrc, redirect = {}) {
+    if (status !== 401 && status !== 403 && status !== 404) {
+        // The URL in the message is the one that was requested; whatever the
+        // status, say so when something else handled it. Without a status
+        // nothing answered at all, so the hop is reported without claiming it
+        // produced the failure.
+        if (redirect.host === undefined) {
+            return '';
+        }
+        return status === undefined
+            ? ` The request was redirected to '${redirect.host}' before it failed.`
+            : ` The request was redirected to '${redirect.host}', which is what answered.`;
+    }
+    const sentences = [];
+    if (redirect.credentialsDropped === true) {
+        // Never say the credentials were rejected: the host that answered never
+        // saw them, and blaming them sends the reader to rotate a working
+        // token. A redirect to an unauthenticated CDN is normal for GitHub
+        // Packages and for Artifactory or Nexus fronted by object storage, so
+        // this is often not the fault at all — hence the pointer to the
+        // redirect target rather than a verdict about it.
+        sentences.push(`The request was redirected to '${redirect.host}', and the credentials were dropped rather`
+            + ` than forwarded there, so that host answered without them. This is normal when a registry`
+            + ` redirects to a pre-signed URL; look at what that host returned.`);
+        if (sent !== undefined) {
+            sentences.push(`The credentials the original host received came from ${describeSentCredentials(sent, npmrc)}`);
+        }
+    }
+    else if (sent === undefined) {
+        sentences.push(`No credentials for this registry were found in ${describeConfigSources(npmrc)}.`);
+        if (status === 404) {
+            sentences.push(`A registry may answer 404 for a package you are not authorized to see, so the package`
+                + ` may exist but be invisible without credentials.`);
+        }
+        if (redirect.host !== undefined) {
+            // Without this the reader is told to configure credentials for a host
+            // that never asked for any, when the status came from elsewhere.
+            sentences.push(`Note that the request was redirected to '${redirect.host}', which is what answered.`);
+        }
+    }
+    else {
+        if (status === 404) {
+            sentences.push(`Credentials were sent but did not grant access, so either the package does not exist`
+                + ` or the credentials do not cover it.`);
+        }
+        else {
+            sentences.push(`The credentials sent for this registry were rejected — an expired token fails this way.`);
+        }
+        sentences.push(`They came from ${describeSentCredentials(sent, npmrc)}`);
+        if (redirect.host !== undefined) {
+            sentences.push(`They were carried through a redirect to '${redirect.host}', which is what answered.`);
+        }
+    }
+    return ` ${sentences.join(' ')}${describeUnreadableConfig(npmrc)}`;
+}
+/**
+ * Names any config file that existed but could not be read, as a sentence
+ * with a leading space or the empty string.
+ *
+ * Worth saying on any failure a credential could explain, not only the ones
+ * that got as far as a status code: a skipped `auth.ini` is invisible
+ * otherwise, and it is the likeliest thing to be missing when a private
+ * package cannot be resolved at all.
+ */
+export function describeUnreadableConfig(npmrc) {
+    if (npmrc.unreadable.length === 0) {
+        return '';
+    }
+    return ` Note that ${quotedList(npmrc.unreadable)} could not be read, so any credentials it holds`
+        + ` were not used.`;
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/services/embedded-packages/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,qBAAqB,EAAE,MAAM,YAAY,CAAA;AACrE,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAEvE;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAE,KAAe,EAAE,SAAiB,EAAE,QAAgB;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAA;AACjF,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAE,KAAe;IACzC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;AAC/D,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,qDAAqD,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,SAAS,CAAE,GAAW;IACpC,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAA;AACtF,CAAC;AA+BD;;;GAGG;AACH,SAAS,sBAAsB,CAAE,WAA+B,EAAE,KAAwB;IACxF,OAAO,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,8BAA8B,kBAAkB,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,EAAE;QAC1E,CAAC,CAAC,sBAAsB,CAAA;AAC5B,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAE,MAAyB,EAAE,KAAwB;IAC5F,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,OAAO,uBAAuB,MAAM,CAAC,QAAQ,uCAAuC;cAChF,WAAW,yBAAyB,GAAG,CAAA;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;QACrD,CAAC,CAAC,sGAAsG;QACxG,CAAC,CAAC,2EAA2E,CAAA;IAC/E,OAAO,+CAA+C,QAAQ,gCAAgC;UAC1F,gBAAgB,yBAAyB,2CAA2C,KAAK,EAAE,CAAA;AACjG,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAE,IAAc,EAAE,KAAwB;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrC,QAAQ,MAAM,EAAE,IAAI,EAAE,CAAC;YACrB,mEAAmE;YACnE,mEAAmE;YACnE,qDAAqD;YACrD,KAAK,KAAK;gBACR,OAAO,QAAQ,MAAM,CAAC,QAAQ,wBAAwB,CAAA;YACxD,KAAK,MAAM;gBACT,OAAO,IAAI,GAAG,SAAS,MAAM,CAAC,IAAI,GAAG,CAAA;YACvC;gBACE,OAAO,IAAI,GAAG,GAAG,CAAA;QACrB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAE,KAAwB;IACtD,OAAO,UAAU,CAAC;QAChB,GAAG,qBAAqB,yBAAyB;QACjD,GAAG,KAAK,CAAC,KAAK;KACf,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAE,IAAqB,EAAE,KAAwB;IAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAA;IACnD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACvB,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,OAAO,gCAAgC,MAAM,CAAC,QAAQ,IAAI,CAAA;IAC5D,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,OAAO,wBAAwB,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW;cAChG,gGAAgG,CAAA;IACtG,CAAC;IACD,OAAO,cAAc,sBAAsB,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAA;AAC3E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA0B,EAC1B,IAAiC,EACjC,KAAwB,EACxB,WAA4B,EAAE;IAE9B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,wBAAwB;QACxB,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,mCAAmC,QAAQ,CAAC,IAAI,qBAAqB;YACvE,CAAC,CAAC,mCAAmC,QAAQ,CAAC,IAAI,4BAA4B,CAAA;IAClF,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,IAAI,QAAQ,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACzC,wEAAwE;QACxE,kEAAkE;QAClE,mEAAmE;QACnE,sEAAsE;QACtE,gEAAgE;QAChE,kDAAkD;QAClD,SAAS,CAAC,IAAI,CACZ,kCAAkC,QAAQ,CAAC,IAAI,4CAA4C;cACzF,2FAA2F;cAC3F,kEAAkE,CACrE,CAAA;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,wDAAwD,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QAChH,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,kDAAkD,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACjG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,SAAS,CAAC,IAAI,CACZ,uFAAuF;kBACrF,kDAAkD,CACrD,CAAA;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,sEAAsE;YACtE,iEAAiE;YACjE,SAAS,CAAC,IAAI,CAAC,4CAA4C,QAAQ,CAAC,IAAI,4BAA4B,CAAC,CAAA;QACvG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,SAAS,CAAC,IAAI,CACZ,sFAAsF;kBACpF,sCAAsC,CACzC,CAAA;QACH,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAA;QAC3G,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,kBAAkB,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QACxE,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,4CAA4C,QAAQ,CAAC,IAAI,4BAA4B,CAAC,CAAA;QACvG,CAAC;IACH,CAAC;IAED,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAA;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAE,KAAwB;IAChE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,cAAc,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,iDAAiD;UAC9F,iBAAiB,CAAA;AACvB,CAAC"}

package/dist/services/embedded-packages/lockfile-filter.d.ts

@@ -0,0 +1,20 @@
+import type { PlannedTarball } from './materializer.js';
+export interface TarballLockfileFilterResult {
+    kept: PlannedTarball[];
+    dropped: PlannedTarball[];
+}
+/**
+ * Splits a planned tarball set by `name@version` presence in a lockfile.
+ *
+ * Used after the bundled lockfile has been pruned to the code bundle's
+ * contents: a pruned lockfile's resolutions are verified to be a subset of
+ * the original's (no new entries, no version changes), so filtering the
+ * originally planned set by presence is exactly equivalent to re-running
+ * spec matching against the pruned lockfile.
+ *
+ * Fail-safe: if the lockfile content cannot be parsed — unexpected, since
+ * a pruned lockfile has already passed the pruner's own parse and
+ * verification — every tarball is kept (the pre-filter superset is the
+ * previous behavior) and the failure is debug-logged.
+ */
+export declare function filterTarballsByLockfile(tarballs: PlannedTarball[], lockfileContent: string, lockfileName: string): TarballLockfileFilterResult;

package/dist/services/embedded-packages/lockfile-filter.js

@@ -0,0 +1,40 @@
+import Debug from 'debug';
+import { parseLockfilePackagesContent } from './lockfile-packages.js';
+const debug = Debug('checkly:cli:services:embedded-packages:lockfile-filter');
+/**
+ * Splits a planned tarball set by `name@version` presence in a lockfile.
+ *
+ * Used after the bundled lockfile has been pruned to the code bundle's
+ * contents: a pruned lockfile's resolutions are verified to be a subset of
+ * the original's (no new entries, no version changes), so filtering the
+ * originally planned set by presence is exactly equivalent to re-running
+ * spec matching against the pruned lockfile.
+ *
+ * Fail-safe: if the lockfile content cannot be parsed — unexpected, since
+ * a pruned lockfile has already passed the pruner's own parse and
+ * verification — every tarball is kept (the pre-filter superset is the
+ * previous behavior) and the failure is debug-logged.
+ */
+export function filterTarballsByLockfile(tarballs, lockfileContent, lockfileName) {
+    let present;
+    try {
+        const packages = parseLockfilePackagesContent(lockfileContent, lockfileName);
+        present = new Set(packages.registry.map(pkg => `${pkg.name}@${pkg.version}`));
+    }
+    catch (err) {
+        debug(`Could not parse '${lockfileName}' for tarball filtering, keeping all tarballs: ${err}`);
+        return { kept: [...tarballs], dropped: [] };
+    }
+    const kept = [];
+    const dropped = [];
+    for (const tarball of tarballs) {
+        if (present.has(`${tarball.name}@${tarball.version}`)) {
+            kept.push(tarball);
+        }
+        else {
+            dropped.push(tarball);
+        }
+    }
+    return { kept, dropped };
+}
+//# sourceMappingURL=lockfile-filter.js.map

package/dist/services/embedded-packages/lockfile-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile-filter.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/lockfile-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAGrE,MAAM,KAAK,GAAG,KAAK,CAAC,wDAAwD,CAAC,CAAA;AAO7E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA0B,EAC1B,eAAuB,EACvB,YAAoB;IAEpB,IAAI,OAAoB,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,4BAA4B,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;QAC5E,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,oBAAoB,YAAY,kDAAkD,GAAG,EAAE,CAAC,CAAA;QAC9F,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,MAAM,IAAI,GAAqB,EAAE,CAAA;IACjC,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC"}