sdkproof 0.1.0

package/dist/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAoC,MAAM,eAAe,CAAC;AA2CjG,kFAAkF;AAClF,SAAS,cAAc,CAAC,GAAwB;IAC9C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE;QAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;iBACrD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,CAAC,GAAG,CAAC,EAAQ,EAAE;QACvC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO;QACxB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAW,CAAC;gBAAE,IAAI,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,CAAC,IAAI,CACN,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EACrE,uBAAuB,EAAE,6BAA6B,EAAE,4BAA4B,EACpF,sBAAsB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,aAAa,EAC7E,mBAAmB,EAAE,qBAAqB,EAAE,kBAAkB,CAC/D,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,oCAAoC,CAAC,EAAE,CAAC;QACnE,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,EAAG,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAC1B,2HAA2H,CAC5H;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAC1B,8FAA8F,CAC/F;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,OAAiB,EAAE,GAAW;IACzD,MAAM,IAAI,GAAG,IAAI,MAAM,CACrB,8GAA8G,GAAG,KAAK,CACvH,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACnC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,uEAAuE;YACvE,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;YAC7F,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAA+B,CAAC;AAE5D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAY,EAAE,OAAe;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,IAAI,GAA4B,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,iCAAiC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,cAAc,CAC1B,MAAM,YAAY,CAAC,GAAG,CAAC,EACvB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,cAAc,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CACjG,CAAC;IACF,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAY,EAAE,OAAe;IAC1D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK;QAAE,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACjF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,OAAe,EAAE,UAAU,GAAG,IAAI;IAC9E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAE7C,IAAI,GAAG,GAAwB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,GAAG,CAAC,CAAC;YACV,QAAQ,GAAG,GAAG,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,CAAC,IAAI,IAAI,OAAO,qFAAqF,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAE9E,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACzE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;gBACpC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IACtC,CAAC;IACD,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,CAAC;YACb,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAwB,EAAE,IAAY;IACvE,MAAM,KAAK,GACT,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,6EAA6E;IAC7E,yCAAyC;IACzC,OAAO,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,MAAM,YAAY,GAAG,2CAA2C,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,KAA0B,EAC1B,KAAa,EACb,QAAQ,GAAG,EAAE;IAEb,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC9C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO;QAC9B,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACxE,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;;gBAC/B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACf,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,KAA0B,EAAE,GAAW,EAAE,IAAY;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnF,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI;QACd,IAAI;QACJ,GAAG,IAAI,OAAO,EAAE,GAAG,IAAI,QAAQ,EAAE,GAAG,IAAI,QAAQ;QAChD,GAAG,IAAI,aAAa,EAAE,GAAG,IAAI,cAAc,EAAE,GAAG,IAAI,cAAc;KACnE,EAAE,CAAC;QACF,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,OAAiB,EAAE,GAAW;IAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,gFAAgF,OAAO,KAAK,CAC7F,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC"}

package/dist/tarball.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Extract the files of a gzipped tar whose (prefix-stripped) path passes
+ * `keep`. npm puts everything under `package/`, which is stripped here so
+ * callers see the paths as they appear in the installed package.
+ */
+export declare function extractTarball(gz: Buffer, keep: (p: string) => boolean): Map<string, string>;
+export declare function fetchTarball(url: string): Promise<Buffer>;

package/dist/tarball.js

@@ -0,0 +1,66 @@
+import { gunzipSync } from "node:zlib";
+/**
+ * Read an npm tarball in memory.
+ *
+ * The alternative was `npm pack` plus the `tar` binary, which is what the
+ * research sweep shelled out to. Doing it here instead keeps the published CLI
+ * to one dependency, works the same on Windows, and skips two subprocesses and
+ * a disk round-trip per package — which matters because drift mode reads two
+ * versions of every package it looks at.
+ */
+const BLOCK = 512;
+function readString(buf, offset, length) {
+    const raw = buf.subarray(offset, offset + length);
+    const end = raw.indexOf(0);
+    return raw.subarray(0, end === -1 ? raw.length : end).toString("utf8");
+}
+function readOctal(buf, offset, length) {
+    const s = readString(buf, offset, length).trim();
+    return s ? parseInt(s, 8) || 0 : 0;
+}
+/**
+ * Extract the files of a gzipped tar whose (prefix-stripped) path passes
+ * `keep`. npm puts everything under `package/`, which is stripped here so
+ * callers see the paths as they appear in the installed package.
+ */
+export function extractTarball(gz, keep) {
+    const tar = gunzipSync(gz);
+    const files = new Map();
+    let longName = null;
+    for (let off = 0; off + BLOCK <= tar.length;) {
+        const header = tar.subarray(off, off + BLOCK);
+        // Two consecutive zero blocks end the archive.
+        if (header.every((b) => b === 0))
+            break;
+        let name = readString(header, 0, 100);
+        const size = readOctal(header, 124, 12);
+        const type = String.fromCharCode(header[156] || 0x30);
+        const prefix = readString(header, 345, 155);
+        if (prefix)
+            name = `${prefix}/${name}`;
+        if (longName !== null) {
+            name = longName;
+            longName = null;
+        }
+        const dataStart = off + BLOCK;
+        const dataEnd = dataStart + size;
+        // GNU long-name entry: the next header's real path is this entry's body.
+        if (type === "L") {
+            longName = tar.subarray(dataStart, dataEnd).toString("utf8").replace(/\0+$/, "");
+        }
+        else if (type === "0" || type === "\0") {
+            const rel = name.replace(/^[^/]+\//, "");
+            if (keep(rel))
+                files.set(rel, tar.subarray(dataStart, dataEnd).toString("utf8"));
+        }
+        off = dataStart + Math.ceil(size / BLOCK) * BLOCK;
+    }
+    return files;
+}
+export async function fetchTarball(url) {
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`tarball fetch failed: ${res.status} ${url}`);
+    return Buffer.from(await res.arrayBuffer());
+}
+//# sourceMappingURL=tarball.js.map

package/dist/tarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.js","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC;;;;;;;;GAQG;AAEH,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB,SAAS,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,MAAc,EAAE,MAAc;IAC5D,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,IAA4B;IACrE,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAEnC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,GAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;QAC9C,+CAA+C;QAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM;QAExC,IAAI,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM;YAAE,IAAI,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,GAAG,QAAQ,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;QACjC,yEAAyE;QACzE,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC"}

package/dist/tasks.d.ts

@@ -0,0 +1,41 @@
+import type { ModelAdapter } from "./core/model.ts";
+import type { Task } from "./core/types.ts";
+export interface SynthesisInput {
+    packageName: string;
+    version: string;
+    description: string;
+    readme: string;
+    count: number;
+}
+export interface TaskSet {
+    packageName: string;
+    version: string;
+    /** the one-line steer handed to the model under test, alongside each task */
+    docsHint: string;
+    tasks: Task[];
+    /** tasks the model wrote that had to be dropped, and why */
+    rejected: {
+        id: string;
+        reason: string;
+    }[];
+    /** "synthesized" or the path a --tasks file came from */
+    source: string;
+}
+/** Does this source import from the package under test, or any subpath of it? */
+export declare function importsPackage(code: string, packageName: string): boolean;
+export declare function validateTasks(raw: unknown, packageName: string): {
+    docsHint: string;
+    tasks: Task[];
+    rejected: {
+        id: string;
+        reason: string;
+    }[];
+};
+export declare function loadTaskFile(file: string, packageName: string): Promise<TaskSet>;
+export interface SynthesizeOptions extends SynthesisInput {
+    model: ModelAdapter;
+    /** reuse a cached task set for this exact package@version */
+    cache?: boolean;
+    log?: (line: string) => void;
+}
+export declare function synthesizeTasks(opts: SynthesizeOptions): Promise<TaskSet>;

package/dist/tasks.js

@@ -0,0 +1,199 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { cacheRoot } from "./workspace.js";
+/**
+ * Where the tasks come from when nobody hand-wrote them.
+ *
+ * The bench's ten libraries have hand-authored task sets. For a package nobody
+ * has scored before, a model writes them from the package's own README at the
+ * version being scored — which is the only description of the library that is
+ * guaranteed current for that version.
+ *
+ * Two rules make the result a measurement rather than a quiz the model sets
+ * itself, and both are enforced below rather than merely requested:
+ *
+ *  1. a skeleton may not import from the package under test. If the skeleton
+ *     hands over the import line, the hardest half of the drift — which symbol
+ *     to reach for, and from which entrypoint — is answered before the model
+ *     starts. TanStack Table v9's whole finding is that the model still writes
+ *     `useReactTable`; a skeleton containing `import { useTable }` erases it.
+ *  2. neither the prompt nor the skeleton may name an export of the package.
+ *     The task says what to build; remembering the API is the thing being
+ *     measured.
+ */
+const SYNTHESIS_SYSTEM = "You write evaluation tasks for a TypeScript benchmark. " +
+    "You respond with ONLY a single JSON array inside one ```json code block — no prose before or after.";
+function buildSynthesisPrompt(input) {
+    return [
+        `Package: ${input.packageName}@${input.version}`,
+        input.description ? `Description: ${input.description}` : "",
+        "",
+        "README (may be truncated):",
+        "---",
+        input.readme.slice(0, 18_000),
+        "---",
+        "",
+        `Write exactly ${input.count} small, realistic coding tasks that a working developer would use this library for.`,
+        "Spread them across the library's main feature areas and across difficulty: roughly a third easy, a third medium, a third hard.",
+        "",
+        "Each task is an object with these fields:",
+        '  "id"        kebab-case, unique, 2-4 words, describes the job',
+        '  "area"      one lowercase word for the feature area, e.g. "queries", "auth", "streaming"',
+        '  "difficulty" one of "easy", "medium", "hard"',
+        '  "prompt"    one or two sentences telling the developer what to build, and what to export',
+        '  "skeleton"  the TypeScript file to complete',
+        "",
+        "HARD RULES — a task breaking any of these is thrown away:",
+        `  - The skeleton MUST NOT import from "${input.packageName}" or any of its subpaths. The solver writes its own imports.`,
+        `  - Neither the prompt nor the skeleton may name any export, function, class, hook, option or method of ${input.packageName}. Describe the capability instead: say "the library's typed column-definition helper", never the helper's name.`,
+        "  - The skeleton may declare local types, local constants and the comment describing what to write. It may import from node builtins or from other libraries, but not from the package under test.",
+        "  - The prompt must name the exported symbol the solution has to provide, and that name must be the solver's own, not the library's.",
+        "  - Every task must be solvable in one file of under 40 lines, and must actually require the library — not something plain TypeScript could do.",
+        "",
+        `The array has ${input.count + 1} elements: one docsHint object first, then the ${input.count} tasks. The docsHint is EXTRA — it does not count as one of the ${input.count}.`,
+        "",
+        "The first element is an object of the form",
+        '  { "docsHint": "..." }',
+        `where docsHint is two or three sentences describing what ${input.packageName} is and the domain the tasks operate over (the data model, the resources, the shape of the problem).`,
+        "The docsHint MUST NOT name any export, method or option of the library either.",
+        "",
+        "Respond with one ```json block containing the array.",
+    ]
+        .filter(Boolean)
+        .join("\n");
+}
+function extractJson(text) {
+    const fenced = [...text.matchAll(/```(?:json)?[^\S\r\n]*\r?\n([\s\S]*?)```/g)].map((m) => m[1].trim());
+    const candidates = fenced.length ? fenced : [text.trim()];
+    for (const c of candidates) {
+        try {
+            return JSON.parse(c);
+        }
+        catch {
+            // try the next block; a model sometimes emits an explanation block first
+        }
+    }
+    // last resort: the outermost array in the text
+    const start = text.indexOf("[");
+    const end = text.lastIndexOf("]");
+    if (start >= 0 && end > start) {
+        try {
+            return JSON.parse(text.slice(start, end + 1));
+        }
+        catch {
+            // fall through to the throw below
+        }
+    }
+    throw new Error("task synthesis did not return parseable JSON");
+}
+const DIFFICULTIES = new Set(["easy", "medium", "hard"]);
+/** Does this source import from the package under test, or any subpath of it? */
+export function importsPackage(code, packageName) {
+    const pkg = packageName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const spec = `["'\`]${pkg}(?:/[^"'\`]*)?["'\`]`;
+    return (new RegExp(`\\bfrom\\s+${spec}`).test(code) ||
+        new RegExp(`\\bimport\\s*\\(\\s*${spec}`).test(code) ||
+        new RegExp(`\\bimport\\s+${spec}`).test(code) ||
+        new RegExp(`\\brequire\\s*\\(\\s*${spec}`).test(code));
+}
+export function validateTasks(raw, packageName) {
+    if (!Array.isArray(raw))
+        throw new Error("task synthesis returned something that is not an array");
+    let docsHint = "";
+    const tasks = [];
+    const rejected = [];
+    const seen = new Set();
+    for (const item of raw) {
+        if (!item || typeof item !== "object")
+            continue;
+        const o = item;
+        if (typeof o.docsHint === "string" && !o.prompt) {
+            docsHint = o.docsHint.trim();
+            continue;
+        }
+        const id = String(o.id ?? "").trim();
+        const prompt = String(o.prompt ?? "").trim();
+        const skeleton = String(o.skeleton ?? "");
+        const reject = (reason) => rejected.push({ id: id || "(unnamed)", reason });
+        if (!id || !prompt) {
+            reject("missing id or prompt");
+            continue;
+        }
+        if (seen.has(id)) {
+            reject("duplicate id");
+            continue;
+        }
+        // Rule 1, enforced rather than trusted: a skeleton that imports the package
+        // hands over the answer to the half of the problem that carries the drift.
+        if (importsPackage(skeleton, packageName) || importsPackage(prompt, packageName)) {
+            reject(`names "${packageName}" in an import — that gives away the entrypoint`);
+            continue;
+        }
+        if (!/export/i.test(`${prompt}\n${skeleton}`)) {
+            reject("does not ask for an export, so a passing answer cannot be told from an empty file");
+            continue;
+        }
+        const difficulty = DIFFICULTIES.has(o.difficulty)
+            ? o.difficulty
+            : "medium";
+        seen.add(id);
+        tasks.push({
+            id,
+            area: String(o.area ?? "general").trim().toLowerCase() || "general",
+            difficulty,
+            prompt,
+            skeleton,
+        });
+    }
+    return { docsHint, tasks, rejected };
+}
+function taskCachePath(packageName, version) {
+    return path.join(cacheRoot(), "tasks", `${packageName.replace(/[@/]/g, "_")}@${version}.json`);
+}
+export async function loadTaskFile(file, packageName) {
+    const parsed = JSON.parse(await readFile(file, "utf8"));
+    // Accept both a bare Task[] (the bench's data/*.tasks.json shape) and a
+    // full TaskSet written by an earlier run.
+    if (Array.isArray(parsed)) {
+        const { docsHint, tasks, rejected } = validateTasks(parsed, packageName);
+        return { packageName, version: "", docsHint, tasks, rejected, source: file };
+    }
+    return { ...parsed, source: file };
+}
+export async function synthesizeTasks(opts) {
+    const log = opts.log ?? (() => { });
+    const cacheFile = taskCachePath(opts.packageName, opts.version);
+    if (opts.cache !== false) {
+        try {
+            const cached = JSON.parse(await readFile(cacheFile, "utf8"));
+            if (cached.tasks?.length) {
+                log(`Tasks: reusing ${cached.tasks.length} cached task(s) — ${cacheFile}`);
+                return { ...cached, source: cacheFile };
+            }
+        }
+        catch {
+            // no cache yet
+        }
+    }
+    log(`Tasks: writing ${opts.count} from the ${opts.packageName}@${opts.version} README`);
+    const raw = await opts.model.generate({
+        system: SYNTHESIS_SYSTEM,
+        user: buildSynthesisPrompt(opts),
+        maxTokens: 16000,
+    });
+    const { docsHint, tasks, rejected } = validateTasks(extractJson(raw), opts.packageName);
+    if (!tasks.length)
+        throw new Error("task synthesis produced no usable tasks");
+    const set = {
+        packageName: opts.packageName,
+        version: opts.version,
+        docsHint: docsHint || opts.description,
+        tasks,
+        rejected,
+        source: "synthesized",
+    };
+    await mkdir(path.dirname(cacheFile), { recursive: true });
+    await writeFile(cacheFile, JSON.stringify(set, null, 2));
+    return set;
+}
+//# sourceMappingURL=tasks.js.map

package/dist/tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tasks.js","sourceRoot":"","sources":["../src/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,gBAAgB,GACpB,yDAAyD;IACzD,qGAAqG,CAAC;AAsBxG,SAAS,oBAAoB,CAAC,KAAqB;IACjD,OAAO;QACL,YAAY,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,EAAE;QAChD,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;QAC5D,EAAE;QACF,4BAA4B;QAC5B,KAAK;QACL,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;QAC7B,KAAK;QACL,EAAE;QACF,iBAAiB,KAAK,CAAC,KAAK,qFAAqF;QACjH,gIAAgI;QAChI,EAAE;QACF,2CAA2C;QAC3C,gEAAgE;QAChE,4FAA4F;QAC5F,gDAAgD;QAChD,4FAA4F;QAC5F,+CAA+C;QAC/C,EAAE;QACF,2DAA2D;QAC3D,0CAA0C,KAAK,CAAC,WAAW,8DAA8D;QACzH,2GAA2G,KAAK,CAAC,WAAW,iHAAiH;QAC7O,oMAAoM;QACpM,sIAAsI;QACtI,iJAAiJ;QACjJ,EAAE;QACF,iBAAiB,KAAK,CAAC,KAAK,GAAG,CAAC,kDAAkD,KAAK,CAAC,KAAK,mEAAmE,KAAK,CAAC,KAAK,GAAG;QAC9K,EAAE;QACF,4CAA4C;QAC5C,yBAAyB;QACzB,4DAA4D,KAAK,CAAC,WAAW,sGAAsG;QACnL,gFAAgF;QAChF,EAAE;QACF,sDAAsD;KACvD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvG,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IACD,+CAA+C;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAErE,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,WAAmB;IAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,SAAS,GAAG,sBAAsB,CAAC;IAChD,OAAO,CACL,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3C,IAAI,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,IAAI,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7C,IAAI,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACnG,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAqC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAChD,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAEpF,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,cAAc,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACjF,MAAM,CAAC,UAAU,WAAW,iDAAiD,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,mFAAmF,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,UAAwB,CAAC;YAC7D,CAAC,CAAE,CAAC,CAAC,UAAyB;YAC9B,CAAC,CAAC,QAAQ,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,EAAE;YACF,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS;YACnE,UAAU;YACV,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB,EAAE,OAAe;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,WAAmB;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,wEAAwE;IACxE,0CAA0C;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,GAAI,MAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAuB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAY,CAAC;YACxE,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACzB,GAAG,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,qBAAqB,SAAS,EAAE,CAAC,CAAC;gBAC3E,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,kBAAkB,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpC,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC;QAChC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE9E,MAAM,GAAG,GAAY;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW;QACtC,KAAK;QACL,QAAQ;QACR,MAAM,EAAE,aAAa;KACtB,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/workspace.d.ts

@@ -0,0 +1,42 @@
+import { type VersionMeta } from "./registry.ts";
+export declare function cacheRoot(): string;
+/** The tsc JS entrypoint shipped with this package's own typescript dependency. */
+export declare function resolveTsc(override?: string): string;
+export interface Workspace {
+    /** absolute path holding node_modules, tsconfig.json and (transiently) candidate.ts */
+    dir: string;
+    packageName: string;
+    version: string;
+    /** modules that had to be installed on top of the target for it to type-check */
+    extraInstalls: string[];
+    /** `candidate.tsx` for a React-facing package, `candidate.ts` otherwise */
+    candidateFile: string;
+    /** true when the workspace was reused from cache rather than installed */
+    cached: boolean;
+}
+export interface WorkspaceOptions {
+    packageName: string;
+    version: string;
+    meta: VersionMeta;
+    /** run npm lifecycle scripts; off by default because we only type-check */
+    allowScripts?: boolean;
+    /** ignore any cached workspace and install fresh */
+    fresh?: boolean;
+    /** tsc entrypoint to probe with; defaults to this package's own typescript */
+    tscEntry?: string;
+    log?: (line: string) => void;
+}
+/** `@scope/name` -> `@types/scope__name`, the DefinitelyTyped convention. */
+export declare function typesPackageFor(name: string): string;
+/**
+ * Build (or reuse) a throwaway npm project with the target package installed,
+ * ready for candidate.ts to be dropped in and type-checked.
+ *
+ * The interesting part is the self-heal: a package's own types often need peers
+ * the package does not depend on, and DefinitelyTyped types for those peers on
+ * top. Rather than guess, the probe compiles `import * as m from "<pkg>"` and
+ * installs whatever tsc says it cannot find, up to twice. That is what turns
+ * "works for the ten libraries on the bench" into "works for a package nobody
+ * has scored before".
+ */
+export declare function prepareWorkspace(opts: WorkspaceOptions): Promise<Workspace>;

package/dist/workspace.js

@@ -0,0 +1,251 @@
+import { execFile } from "node:child_process";
+import { createRequire } from "node:module";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { requiredPeers } from "./registry.js";
+const execFileAsync = promisify(execFile);
+const require_ = createRequire(import.meta.url);
+export function cacheRoot() {
+    return (process.env.SDKPROOF_CACHE ??
+        path.join(process.env.XDG_CACHE_HOME ?? path.join(os.homedir(), ".cache"), "sdkproof"));
+}
+/** The tsc JS entrypoint shipped with this package's own typescript dependency. */
+export function resolveTsc(override) {
+    if (override)
+        return path.resolve(override);
+    // Resolved through package.json rather than "typescript/bin/tsc": the bin
+    // path is not in every typescript release's exports map, but "./package.json"
+    // always is.
+    const pkgJson = require_.resolve("typescript/package.json");
+    return path.join(path.dirname(pkgJson), "bin", "tsc");
+}
+function slug(name, version) {
+    return `${name.replace(/[@/]/g, "_")}@${version}`;
+}
+async function npm(args, cwd, allowScripts) {
+    await execFileAsync(process.platform === "win32" ? "npm.cmd" : "npm", [...args, "--no-audit", "--no-fund", "--loglevel=error", ...(allowScripts ? [] : ["--ignore-scripts"])], { cwd, maxBuffer: 64 * 1024 * 1024, env: { ...process.env, npm_config_update_notifier: "false" } });
+}
+/** `@scope/name` -> `@types/scope__name`, the DefinitelyTyped convention. */
+export function typesPackageFor(name) {
+    return name.startsWith("@")
+        ? `@types/${name.slice(1).replace("/", "__")}`
+        : `@types/${name}`;
+}
+function tsconfigFor(hasReact) {
+    return JSON.stringify({
+        compilerOptions: {
+            target: "ES2022",
+            module: "NodeNext",
+            moduleResolution: "NodeNext",
+            // DOM is always on: a browser-facing package fails to resolve its own
+            // types without it, and the extra globals cannot turn a wrong API call
+            // into a right one — which is the only thing being measured.
+            lib: ["ES2022", "DOM", "DOM.Iterable"],
+            types: ["node"],
+            ...(hasReact ? { jsx: "react-jsx" } : {}),
+            strict: true,
+            noEmit: true,
+            skipLibCheck: true,
+            esModuleInterop: true,
+            allowSyntheticDefaultImports: true,
+        },
+        include: [hasReact ? "candidate.tsx" : "candidate.ts"],
+    }, null, 2);
+}
+const PROBE = "sdkproof-probe.ts";
+const PROBE_TSCONFIG = "tsconfig.sdkproof-probe.json";
+/**
+ * Build (or reuse) a throwaway npm project with the target package installed,
+ * ready for candidate.ts to be dropped in and type-checked.
+ *
+ * The interesting part is the self-heal: a package's own types often need peers
+ * the package does not depend on, and DefinitelyTyped types for those peers on
+ * top. Rather than guess, the probe compiles `import * as m from "<pkg>"` and
+ * installs whatever tsc says it cannot find, up to twice. That is what turns
+ * "works for the ten libraries on the bench" into "works for a package nobody
+ * has scored before".
+ */
+export async function prepareWorkspace(opts) {
+    const { packageName, version, meta } = opts;
+    const log = opts.log ?? (() => { });
+    const dir = path.join(cacheRoot(), "workspaces", slug(packageName, version));
+    const marker = path.join(dir, ".sdkproof-ready.json");
+    if (opts.fresh)
+        await rm(dir, { recursive: true, force: true });
+    if (existsSync(marker)) {
+        try {
+            const prev = JSON.parse(await readFile(marker, "utf8"));
+            if (!prev.candidateFile)
+                throw new Error("stale marker");
+            log(`Workspace: reusing ${dir}`);
+            return { ...prev, dir, cached: true };
+        }
+        catch {
+            await rm(dir, { recursive: true, force: true });
+        }
+    }
+    await mkdir(dir, { recursive: true });
+    await writeFile(path.join(dir, "package.json"), JSON.stringify({ name: "sdkproof-sandbox", private: true, version: "0.0.0", type: "module" }, null, 2));
+    const peers = requiredPeers(meta);
+    const first = [`${packageName}@${version}`, "@types/node", ...peers];
+    log(`Installing ${first.join(" ")}${opts.allowScripts ? "" : " (lifecycle scripts off)"}`);
+    try {
+        await npm(["install", ...first], dir, Boolean(opts.allowScripts));
+    }
+    catch {
+        // A peer that will not co-install is not fatal — the target alone may still
+        // type-check, and the probe below will say so.
+        log(`  peer install failed, retrying with the target alone`);
+        await npm(["install", `${packageName}@${version}`, "@types/node"], dir, Boolean(opts.allowScripts));
+    }
+    const extraInstalls = [];
+    const hasReact = () => existsSync(path.join(dir, "node_modules", "react", "package.json"));
+    await writeFile(path.join(dir, "tsconfig.json"), tsconfigFor(hasReact()));
+    // Peers ship untyped surprisingly often; try DefinitelyTyped for each, and
+    // treat a miss as normal rather than an error.
+    for (const peer of peers) {
+        if (await hasTypes(dir, peer))
+            continue;
+        const types = typesPackageFor(peer);
+        try {
+            await npm(["install", types], dir, Boolean(opts.allowScripts));
+            extraInstalls.push(types);
+        }
+        catch {
+            // no DefinitelyTyped package for this peer; the probe will report it
+        }
+    }
+    const tsc = opts.tscEntry ?? resolveTsc();
+    const probeSource = `import * as sdkproofProbe from ${JSON.stringify(packageName)};\nexport default sdkproofProbe;\n`;
+    await writeFile(path.join(dir, PROBE), probeSource);
+    // A dedicated project file rather than files-on-the-command-line: tsc 7 makes
+    // that combination an error (TS5112) when a tsconfig.json is present, and it
+    // reports the error INSTEAD of compiling — so the probe silently passed on
+    // every package, self-heal included, until this was caught on lodash.
+    await writeFile(path.join(dir, PROBE_TSCONFIG), probeTsconfig());
+    let probeOutput = "";
+    for (let round = 0; round < 3; round++) {
+        probeOutput = await runTsc(tsc, path.join(dir, PROBE_TSCONFIG));
+        // TS2307: the module is not installed at all. TS7016: it is installed but
+        // ships no declarations, so DefinitelyTyped is the only thing that helps —
+        // which is exactly what a TypeScript user would reach for. lodash is
+        // scorable through @types/lodash and unscorable without it.
+        const missing = missingModules(probeOutput);
+        const untyped = untypedModules(probeOutput);
+        const wanted = [
+            ...new Set([...missing.flatMap((m) => [m, typesPackageFor(m)]), ...untyped.map(typesPackageFor)]),
+        ].filter((w) => !extraInstalls.includes(w));
+        if (!wanted.length)
+            break;
+        log(`  probe: installing ${wanted.join(", ")}`);
+        for (const w of wanted) {
+            try {
+                await npm(["install", w], dir, Boolean(opts.allowScripts));
+                extraInstalls.push(w);
+            }
+            catch {
+                // best effort: plenty of packages have no DefinitelyTyped entry
+            }
+        }
+        await writeFile(path.join(dir, "tsconfig.json"), tsconfigFor(hasReact()));
+    }
+    await rm(path.join(dir, PROBE), { force: true });
+    await rm(path.join(dir, PROBE_TSCONFIG), { force: true });
+    // Without type declarations there is nothing for tsc to check a candidate
+    // against: every answer would compile, and the package would score a perfect
+    // 100 for being unmeasurable. Better to stop and say so.
+    const untyped = new RegExp(`error TS7016: Could not find a declaration file for module '${packageName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}'`);
+    if (untyped.test(probeOutput)) {
+        throw new Error(`${packageName}@${version} ships no TypeScript declarations, and ${typesPackageFor(packageName)} ` +
+            `is not on npm either. There is nothing for the compiler to check an answer against, ` +
+            `so there is nothing to score.`);
+    }
+    if (missingModules(probeOutput).includes(packageName)) {
+        throw new Error(`${packageName}@${version} installed but does not resolve — tsc cannot find the module. ` +
+            `If it needs a build step, re-run with --allow-scripts.`);
+    }
+    const ws = {
+        dir,
+        packageName,
+        version,
+        extraInstalls,
+        candidateFile: hasReact() ? "candidate.tsx" : "candidate.ts",
+        cached: false,
+    };
+    await writeFile(marker, JSON.stringify(ws, null, 2));
+    return ws;
+}
+async function hasTypes(dir, name) {
+    const base = path.join(dir, "node_modules", ...name.split("/"));
+    try {
+        const pkg = JSON.parse(await readFile(path.join(base, "package.json"), "utf8"));
+        if (pkg.types || pkg.typings)
+            return true;
+    }
+    catch {
+        return false;
+    }
+    return existsSync(path.join(base, "index.d.ts"));
+}
+/**
+ * The module names tsc could not resolve. Only TS2307 counts: any other
+ * diagnostic is the package's own business, not a missing install.
+ */
+function missingModules(out) {
+    return moduleNamesFrom(out, /error TS2307: Cannot find module '([^']+)'/);
+}
+/** Modules that resolved but ship no declarations — DefinitelyTyped candidates. */
+function untypedModules(out) {
+    return moduleNamesFrom(out, /error TS7016: Could not find a declaration file for module '([^']+)'/);
+}
+function moduleNamesFrom(out, re) {
+    const found = new Set();
+    for (const line of out.split(/\r?\n/)) {
+        const m = re.exec(line);
+        if (!m)
+            continue;
+        const name = m[1];
+        if (name.startsWith(".") || name.startsWith("/"))
+            continue;
+        // Subpath imports resolve from the package root, so install the root.
+        const parts = name.split("/");
+        found.add(name.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0]);
+    }
+    return [...found];
+}
+/**
+ * The probe project. `strict` matters: TS7016 ("could not find a declaration
+ * file for module X") only fires under noImplicitAny, and that diagnostic is
+ * the whole untyped-package check. Without it, lodash sails through as scorable
+ * and would then score 100 for being unmeasurable.
+ */
+function probeTsconfig() {
+    return JSON.stringify({
+        compilerOptions: {
+            target: "ES2022",
+            module: "NodeNext",
+            moduleResolution: "NodeNext",
+            lib: ["ES2022", "DOM", "DOM.Iterable"],
+            strict: true,
+            noEmit: true,
+            skipLibCheck: true,
+            esModuleInterop: true,
+        },
+        include: [PROBE],
+    }, null, 2);
+}
+async function runTsc(tscEntry, tsconfigPath) {
+    try {
+        const { stdout } = await execFileAsync(process.execPath, [tscEntry, "-p", tsconfigPath, "--pretty", "false"], { maxBuffer: 16 * 1024 * 1024 });
+        return stdout;
+    }
+    catch (err) {
+        // tsc exits non-zero when it reports errors; diagnostics are on stdout.
+        const e = err;
+        return (e.stdout ?? "") + (e.stderr ?? "");
+    }
+}
+//# sourceMappingURL=workspace.js.map