safeinstall-cli 0.1.0

package/dist/project-installs/shared.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isHttpUrl = isHttpUrl;
+exports.isTarballLike = isTarballLike;
+exports.extractSemverPrefix = extractSemverPrefix;
+exports.createRegistryRequestedPackage = createRegistryRequestedPackage;
+exports.createNonRegistryRequestedPackage = createNonRegistryRequestedPackage;
+exports.classifyResolvedSource = classifyResolvedSource;
+function isHttpUrl(value) {
+    return value.startsWith("http://") || value.startsWith("https://");
+}
+function isTarballLike(value) {
+    return value.endsWith(".tgz") || value.endsWith(".tar.gz");
+}
+function extractSemverPrefix(value) {
+    const match = value.match(/^(\d+\.\d+\.\d+(?:[-+][^()\s]+)?)/);
+    return match?.[1];
+}
+function createRegistryRequestedPackage(name, version) {
+    return {
+        name,
+        raw: `${name}@${version}`,
+        requested: version,
+        sourceType: "registry",
+        registrySpecKind: "version"
+    };
+}
+function createNonRegistryRequestedPackage(name, manifestSpec, sourceType, requested) {
+    return {
+        name,
+        raw: `${name}@${manifestSpec}`,
+        requested: requested ?? manifestSpec,
+        sourceType
+    };
+}
+function classifyResolvedSource(declaredSourceType, resolvedReference, hasIntegrity) {
+    if (declaredSourceType !== "unknown" && declaredSourceType !== "registry") {
+        return declaredSourceType;
+    }
+    if (!resolvedReference) {
+        return declaredSourceType === "unknown" ? "registry" : declaredSourceType;
+    }
+    if (resolvedReference.startsWith("git+") ||
+        resolvedReference.startsWith("git@") ||
+        resolvedReference.includes("github.com:")) {
+        return "git";
+    }
+    if (resolvedReference.startsWith("link:")) {
+        return "workspace";
+    }
+    if (resolvedReference.startsWith("file:")) {
+        return "file";
+    }
+    if (isHttpUrl(resolvedReference)) {
+        if (declaredSourceType === "registry" &&
+            (hasIntegrity || resolvedReference.includes("registry.npmjs.org") || resolvedReference.includes("registry.yarnpkg.com"))) {
+            return "registry";
+        }
+        return isTarballLike(resolvedReference) ? "tarball" : "url";
+    }
+    return declaredSourceType === "unknown" ? "unknown" : declaredSourceType;
+}

package/dist/project-installs/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/project-installs.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadPnpmProjectInstallTargets = exports.loadNpmProjectInstallTargets = void 0;
+exports.loadProjectInstallTargetsForManager = loadProjectInstallTargetsForManager;
+exports.inferProjectInstallTargetsForCheck = inferProjectInstallTargetsForCheck;
+const project_state_1 = require("./project-state");
+const project_discovery_1 = require("./project-discovery");
+const npm_1 = require("./project-installs/npm");
+Object.defineProperty(exports, "loadNpmProjectInstallTargets", { enumerable: true, get: function () { return npm_1.loadNpmProjectInstallTargets; } });
+const pnpm_1 = require("./project-installs/pnpm");
+Object.defineProperty(exports, "loadPnpmProjectInstallTargets", { enumerable: true, get: function () { return pnpm_1.loadPnpmProjectInstallTargets; } });
+async function loadProjectInstallTargetsForManager(effectiveCwd, packageDir, manager) {
+    const packageJson = packageDir ? await (0, project_state_1.loadPackageJson)(packageDir) : await (0, project_state_1.loadPackageJson)(effectiveCwd);
+    const declaredManager = (0, project_state_1.parseDeclaredPackageManager)(packageJson?.packageManager);
+    if (declaredManager && declaredManager !== manager) {
+        return {
+            targets: [],
+            issues: [
+                `Project install blocked: package.json declares ${declaredManager} as packageManager, but this command uses ${manager}.`
+            ]
+        };
+    }
+    if (manager === "pnpm") {
+        return (0, pnpm_1.loadPnpmProjectInstallTargets)(effectiveCwd, packageDir);
+    }
+    if (manager === "npm") {
+        return (0, npm_1.loadNpmProjectInstallTargets)(effectiveCwd, packageDir);
+    }
+    return undefined;
+}
+async function inferProjectInstallTargetsForCheck(effectiveCwd, packageDir) {
+    const packageJson = packageDir ? await (0, project_state_1.loadPackageJson)(packageDir) : await (0, project_state_1.loadPackageJson)(effectiveCwd);
+    const packageManager = (0, project_state_1.parseDeclaredPackageManager)(packageJson?.packageManager);
+    const pnpmLockPath = await (0, project_discovery_1.findNearestUpward)(effectiveCwd, "pnpm-lock.yaml");
+    const npmLockPath = (await (0, project_discovery_1.findNearestUpward)(effectiveCwd, "package-lock.json")) ??
+        (await (0, project_discovery_1.findNearestUpward)(effectiveCwd, "npm-shrinkwrap.json"));
+    const hasPnpmLock = Boolean(pnpmLockPath);
+    const hasNpmLock = Boolean(npmLockPath);
+    if (packageManager === "pnpm") {
+        return (0, pnpm_1.loadPnpmProjectInstallTargets)(effectiveCwd, packageDir);
+    }
+    if (packageManager === "npm") {
+        return (0, npm_1.loadNpmProjectInstallTargets)(effectiveCwd, packageDir);
+    }
+    if (hasPnpmLock && hasNpmLock) {
+        return {
+            targets: [],
+            issues: [
+                "Check blocked: both pnpm-lock.yaml and an npm lockfile exist. Set packageManager in package.json or remove the stale lockfile."
+            ]
+        };
+    }
+    if (hasPnpmLock) {
+        return (0, pnpm_1.loadPnpmProjectInstallTargets)(effectiveCwd, packageDir);
+    }
+    if (hasNpmLock) {
+        return (0, npm_1.loadNpmProjectInstallTargets)(effectiveCwd, packageDir);
+    }
+    return undefined;
+}

package/dist/project-state.js

@@ -0,0 +1,101 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDeclaredPackageManager = parseDeclaredPackageManager;
+exports.classifyDeclaredSource = classifyDeclaredSource;
+exports.loadPackageJson = loadPackageJson;
+exports.loadProjectDependencyState = loadProjectDependencyState;
+exports.loadManifestDependencies = loadManifestDependencies;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const npm_package_arg_1 = __importDefault(require("npm-package-arg"));
+function parseDeclaredPackageManager(packageManager) {
+    if (packageManager?.startsWith("pnpm@")) {
+        return "pnpm";
+    }
+    if (packageManager?.startsWith("npm@")) {
+        return "npm";
+    }
+    if (packageManager?.startsWith("bun@")) {
+        return "bun";
+    }
+    return undefined;
+}
+function classifyDeclaredSource(spec) {
+    if (spec.startsWith("github:") ||
+        spec.startsWith("git+ssh://") ||
+        spec.startsWith("git+https://") ||
+        spec.startsWith("git@")) {
+        return "git";
+    }
+    try {
+        const result = (0, npm_package_arg_1.default)(spec);
+        switch (result.type) {
+            case "git":
+                return "git";
+            case "remote":
+                return result.fetchSpec?.endsWith(".tgz") || result.fetchSpec?.endsWith(".tar.gz") ? "tarball" : "url";
+            case "file":
+                return "file";
+            case "directory":
+                return "directory";
+            case "tag":
+            case "range":
+            case "version":
+            case "alias":
+                return "registry";
+            default:
+                return "unknown";
+        }
+    }
+    catch {
+        if (spec.startsWith("workspace:")) {
+            return "workspace";
+        }
+        return "unknown";
+    }
+}
+async function loadPackageJson(cwd) {
+    const packageJsonPath = node_path_1.default.join(cwd, "package.json");
+    try {
+        const raw = await (0, promises_1.readFile)(packageJsonPath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function loadProjectDependencyState(cwd, packageName) {
+    const packageJson = await loadPackageJson(cwd);
+    const declaredSpec = packageJson?.dependencies?.[packageName] ??
+        packageJson?.devDependencies?.[packageName] ??
+        packageJson?.optionalDependencies?.[packageName];
+    let installedVersion;
+    try {
+        const installedPackagePath = node_path_1.default.join(cwd, "node_modules", packageName, "package.json");
+        const installedRaw = await (0, promises_1.readFile)(installedPackagePath, "utf8");
+        const installedPackage = JSON.parse(installedRaw);
+        installedVersion = installedPackage.version;
+    }
+    catch {
+        installedVersion = undefined;
+    }
+    if (!declaredSpec && !installedVersion) {
+        return undefined;
+    }
+    return {
+        declaredSpec,
+        declaredSourceType: declaredSpec ? classifyDeclaredSource(declaredSpec) : undefined,
+        installedVersion
+    };
+}
+async function loadManifestDependencies(cwd) {
+    const packageJson = await loadPackageJson(cwd);
+    return {
+        ...(packageJson?.dependencies ?? {}),
+        ...(packageJson?.devDependencies ?? {}),
+        ...(packageJson?.optionalDependencies ?? {})
+    };
+}

package/dist/registry.js

@@ -0,0 +1,239 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RegistryClient = void 0;
+const semver_1 = __importDefault(require("semver"));
+const config_1 = require("./config");
+const disk_cache_1 = require("./disk-cache");
+const signals_1 = require("./signals");
+const ABBREVIATED_METADATA_HEADER = "application/vnd.npm.install-v1+json";
+const REGISTRY_FETCH_TIMEOUT_MS = 15_000;
+const REGISTRY_DISK_CACHE_TTL_MS = 60 * 60 * 1000;
+const VERSION_MANIFEST_CACHE_NAMESPACE = "registry-version-manifests-v1";
+const PUBLISH_TIME_CACHE_NAMESPACE = "registry-publish-times-v1";
+function encodePackageName(name) {
+    return name.startsWith("@") ? name.replace("/", "%2f") : name;
+}
+function createTimeoutSignal() {
+    return AbortSignal.timeout(REGISTRY_FETCH_TIMEOUT_MS);
+}
+function cacheKey(packageName, version) {
+    return `${packageName}@${version}`;
+}
+function scopedCacheKey(registryUrl, packageName, version) {
+    return `${registryUrl}|${cacheKey(packageName, version)}`;
+}
+function parsePublishedAt(packageName, version, rawValue) {
+    const publishedAt = new Date(rawValue);
+    if (Number.isNaN(publishedAt.getTime())) {
+        throw new Error(`Registry error: invalid publish time for ${packageName}@${version}.`);
+    }
+    return publishedAt;
+}
+class RegistryClient {
+    registryUrl;
+    diskCache;
+    signal;
+    packageCache = new Map();
+    versionCache = new Map();
+    publishTimeCache = new Map();
+    fullMetadataCache = new Map();
+    constructor(options) {
+        this.registryUrl = (options?.registryUrl ?? config_1.DEFAULT_REGISTRY_URL).replace(/\/+$/, "");
+        this.diskCache = new disk_cache_1.DiskCache({
+            cacheDir: options?.cacheDir,
+            ttlMs: options?.cacheTtlMs ?? REGISTRY_DISK_CACHE_TTL_MS
+        });
+        this.signal = options?.signal;
+    }
+    async resolvePackage(requested) {
+        const resolvedVersion = requested.registrySpecKind === "version"
+            ? requested.requested
+            : this.resolveVersion(await this.fetchPackageDocument(requested.name), requested);
+        const versionDoc = await this.fetchVersionManifest(requested.name, resolvedVersion);
+        const publishedAt = await this.fetchPublishedAt(requested.name, resolvedVersion, versionDoc);
+        const lifecycleScripts = this.collectLifecycleScripts(versionDoc.scripts);
+        return {
+            requested,
+            resolvedVersion,
+            publishedAt,
+            lifecycleScripts
+        };
+    }
+    async getLifecycleScripts(packageName, version) {
+        try {
+            const versionDoc = await this.fetchVersionManifest(packageName, version);
+            return this.collectLifecycleScripts(versionDoc.scripts);
+        }
+        catch (error) {
+            if (this.isNotFoundError(error)) {
+                return [];
+            }
+            throw error;
+        }
+    }
+    async fetchPackageDocument(packageName) {
+        (0, signals_1.throwIfAborted)(this.signal);
+        const cached = this.packageCache.get(packageName);
+        if (cached) {
+            return cached;
+        }
+        const document = await this.fetchJson(`${this.registryUrl}/${encodePackageName(packageName)}`, packageName, {
+            headers: {
+                Accept: ABBREVIATED_METADATA_HEADER
+            }
+        });
+        this.packageCache.set(packageName, document);
+        return document;
+    }
+    async fetchVersionManifest(packageName, version) {
+        (0, signals_1.throwIfAborted)(this.signal);
+        const versionKey = cacheKey(packageName, version);
+        const cached = this.versionCache.get(versionKey);
+        if (cached) {
+            return cached;
+        }
+        const persistentKey = scopedCacheKey(this.registryUrl, packageName, version);
+        const cachedFromDisk = await this.diskCache.getJson(VERSION_MANIFEST_CACHE_NAMESPACE, persistentKey);
+        if (cachedFromDisk) {
+            this.versionCache.set(versionKey, cachedFromDisk);
+            return cachedFromDisk;
+        }
+        const manifest = await this.fetchJson(`${this.registryUrl}/${encodePackageName(packageName)}/${encodeURIComponent(version)}`, `${packageName}@${version}`);
+        this.versionCache.set(versionKey, manifest);
+        await this.diskCache.setJson(VERSION_MANIFEST_CACHE_NAMESPACE, persistentKey, manifest);
+        return manifest;
+    }
+    async fetchPublishedAt(packageName, version, versionDoc) {
+        (0, signals_1.throwIfAborted)(this.signal);
+        const versionKey = cacheKey(packageName, version);
+        const cached = this.publishTimeCache.get(versionKey);
+        if (cached) {
+            return cached;
+        }
+        const persistentKey = scopedCacheKey(this.registryUrl, packageName, version);
+        const cachedFromDisk = await this.diskCache.getJson(PUBLISH_TIME_CACHE_NAMESPACE, persistentKey);
+        if (cachedFromDisk) {
+            const publishedAt = parsePublishedAt(packageName, version, cachedFromDisk);
+            this.publishTimeCache.set(versionKey, publishedAt);
+            return publishedAt;
+        }
+        const tarballUrl = versionDoc.dist?.tarball;
+        if (tarballUrl) {
+            const lastModified = await this.fetchTarballLastModified(packageName, version, tarballUrl);
+            if (lastModified) {
+                const publishedAt = parsePublishedAt(packageName, version, lastModified);
+                this.publishTimeCache.set(versionKey, publishedAt);
+                await this.diskCache.setJson(PUBLISH_TIME_CACHE_NAMESPACE, persistentKey, publishedAt.toISOString());
+                return publishedAt;
+            }
+        }
+        const publishedAt = await this.fetchPublishedAtFromFullMetadata(packageName, version);
+        this.publishTimeCache.set(versionKey, publishedAt);
+        await this.diskCache.setJson(PUBLISH_TIME_CACHE_NAMESPACE, persistentKey, publishedAt.toISOString());
+        return publishedAt;
+    }
+    async fetchTarballLastModified(packageName, version, tarballUrl) {
+        try {
+            const response = await fetch(tarballUrl, {
+                method: "HEAD",
+                signal: this.fetchSignal()
+            });
+            if (!response.ok) {
+                return undefined;
+            }
+            return response.headers.get("last-modified") ?? undefined;
+        }
+        catch (error) {
+            const shutdownError = (0, signals_1.getShutdownSignalError)(this.signal);
+            if (shutdownError) {
+                throw shutdownError;
+            }
+            if (error instanceof Error && error.name === "AbortError") {
+                throw new Error(`Registry error: timed out while fetching tarball metadata for ${packageName}@${version}.`);
+            }
+            return undefined;
+        }
+    }
+    async fetchPublishedAtFromFullMetadata(packageName, version) {
+        const document = await this.fetchFullPackageDocument(packageName);
+        const publishedAtRaw = document.time?.[version];
+        if (!publishedAtRaw) {
+            throw new Error(`Registry error: missing publish time for ${packageName}@${version}.`);
+        }
+        return parsePublishedAt(packageName, version, publishedAtRaw);
+    }
+    async fetchFullPackageDocument(packageName) {
+        const cached = this.fullMetadataCache.get(packageName);
+        if (cached) {
+            return cached;
+        }
+        const document = await this.fetchJson(`${this.registryUrl}/${encodePackageName(packageName)}`, packageName);
+        this.fullMetadataCache.set(packageName, document);
+        return document;
+    }
+    async fetchJson(url, packageLabel, init) {
+        try {
+            const response = await fetch(url, {
+                ...init,
+                signal: this.fetchSignal()
+            });
+            if (!response.ok) {
+                throw new Error(`Registry error: could not fetch ${packageLabel} (${response.status}).`);
+            }
+            return (await response.json());
+        }
+        catch (error) {
+            const shutdownError = (0, signals_1.getShutdownSignalError)(this.signal);
+            if (shutdownError) {
+                throw shutdownError;
+            }
+            if (error instanceof Error && error.name === "AbortError") {
+                throw new Error(`Registry error: timed out while fetching ${packageLabel}.`);
+            }
+            throw error;
+        }
+    }
+    fetchSignal() {
+        return this.signal ? AbortSignal.any([this.signal, createTimeoutSignal()]) : createTimeoutSignal();
+    }
+    resolveVersion(document, requested) {
+        const versions = Object.keys(document.versions ?? {});
+        if (versions.length === 0) {
+            throw new Error(`Registry error: package ${requested.name} has no published versions.`);
+        }
+        if (!requested.registrySpecKind) {
+            return document["dist-tags"]?.latest ?? semver_1.default.rsort(versions)[0];
+        }
+        if (requested.registrySpecKind === "version") {
+            if (!document.versions?.[requested.requested]) {
+                throw new Error(`Package ${requested.name} does not have version ${requested.requested}.`);
+            }
+            return requested.requested;
+        }
+        if (requested.registrySpecKind === "tag") {
+            const version = document["dist-tags"]?.[requested.requested];
+            if (!version) {
+                throw new Error(`Package ${requested.name} does not have dist-tag "${requested.requested}".`);
+            }
+            return version;
+        }
+        const resolved = semver_1.default.maxSatisfying(versions, requested.requested, {
+            includePrerelease: requested.requested.includes("-")
+        });
+        if (!resolved) {
+            throw new Error(`Package ${requested.name} has no version matching "${requested.requested}".`);
+        }
+        return resolved;
+    }
+    collectLifecycleScripts(scripts) {
+        const lifecycleNames = ["preinstall", "install", "postinstall"];
+        return lifecycleNames.filter((scriptName) => Boolean(scripts?.[scriptName]));
+    }
+    isNotFoundError(error) {
+        return error instanceof Error && /\(404\)\.$/.test(error.message);
+    }
+}
+exports.RegistryClient = RegistryClient;

package/dist/signals.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShutdownSignalError = void 0;
+exports.signalExitCode = signalExitCode;
+exports.getShutdownSignalError = getShutdownSignalError;
+exports.throwIfAborted = throwIfAborted;
+exports.createShutdownController = createShutdownController;
+class ShutdownSignalError extends Error {
+    signalName;
+    constructor(signalName) {
+        super(`Interrupted by ${signalName}.`);
+        this.name = "ShutdownSignalError";
+        this.signalName = signalName;
+    }
+}
+exports.ShutdownSignalError = ShutdownSignalError;
+function signalExitCode(signalName) {
+    return signalName === "SIGINT" ? 130 : signalName === "SIGTERM" ? 143 : 1;
+}
+function getShutdownSignalError(signal) {
+    const reason = signal?.reason;
+    return reason instanceof ShutdownSignalError ? reason : undefined;
+}
+function throwIfAborted(signal) {
+    const shutdownError = getShutdownSignalError(signal);
+    if (shutdownError) {
+        throw shutdownError;
+    }
+    if (signal?.aborted) {
+        throw new Error("Operation aborted.");
+    }
+}
+function createShutdownController() {
+    const controller = new AbortController();
+    const handlers = [];
+    const register = (signalName) => {
+        const handler = () => {
+            if (!controller.signal.aborted) {
+                controller.abort(new ShutdownSignalError(signalName));
+            }
+        };
+        process.on(signalName, handler);
+        handlers.push({ signalName, handler });
+    };
+    register("SIGINT");
+    register("SIGTERM");
+    return {
+        signal: controller.signal,
+        dispose() {
+            for (const { signalName, handler } of handlers) {
+                process.off(signalName, handler);
+            }
+        }
+    };
+}