wyvrnpm 1.2.1 → 2.0.1

package/src/config.js

@@ -1,60 +1,63 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-
-/**
- * Returns the directory where wyvrnpm stores its config.
- *   Windows : %LOCALAPPDATA%\wyvrnpm
- *   Other   : ~/.config/wyvrnpm
- */
-function getConfigDir() {
-  if (process.env.LOCALAPPDATA) {
-    return path.join(process.env.LOCALAPPDATA, 'wyvrnpm');
-  }
-  return path.join(os.homedir(), '.config', 'wyvrnpm');
-}
-
-/** Full path to config.json. */
-function getConfigPath() {
-  return path.join(getConfigDir(), 'config.json');
-}
-
-/**
- * Read and parse config.json.
- * Returns a default empty config if the file doesn't exist yet.
- * @returns {{ installSources: SourceEntry[], publishSources: SourceEntry[] }}
- */
-function readConfig() {
-  const configPath = getConfigPath();
-  if (!fs.existsSync(configPath)) {
-    return { installSources: [], publishSources: [] };
-  }
-  try {
-    const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-    return {
-      installSources: raw.installSources ?? [],
-      publishSources: raw.publishSources ?? [],
-    };
-  } catch {
-    console.warn('[wyvrn] Warning: could not parse config.json — using defaults');
-    return { installSources: [], publishSources: [] };
-  }
-}
-
-/**
- * Persist a config object to disk.
- * @param {{ installSources: SourceEntry[], publishSources: SourceEntry[] }} config
- */
-function writeConfig(config) {
-  const dir = getConfigDir();
-  fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(getConfigPath(), JSON.stringify(config, null, 2) + '\n', 'utf8');
-}
-
-module.exports = { getConfigDir, getConfigPath, readConfig, writeConfig };
-
-/**
- * @typedef {{ name: string, url: string, profile?: string, token?: string }} SourceEntry
- */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+/**
+ * Returns the directory where wyvrnpm stores its config.
+ *   Windows : %LOCALAPPDATA%\wyvrnpm
+ *   Other   : ~/.config/wyvrnpm
+ */
+function getConfigDir() {
+  if (process.env.LOCALAPPDATA) {
+    return path.join(process.env.LOCALAPPDATA, 'wyvrnpm');
+  }
+  return path.join(os.homedir(), '.config', 'wyvrnpm');
+}
+
+/** Full path to config.json. */
+function getConfigPath() {
+  return path.join(getConfigDir(), 'config.json');
+}
+
+/**
+ * Read and parse config.json.
+ * Returns a default empty config if the file doesn't exist yet.
+ * @returns {{ installSources: SourceEntry[], publishSources: SourceEntry[], linkedPackages: Object<string, string>, defaultProfile: string }}
+ */
+function readConfig() {
+  const configPath = getConfigPath();
+  if (!fs.existsSync(configPath)) {
+    return { installSources: [], publishSources: [], linkedPackages: {}, defaultProfile: 'default' };
+  }
+  try {
+    const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    return {
+      installSources: raw.installSources  ?? [],
+      publishSources: raw.publishSources  ?? [],
+      linkedPackages: raw.linkedPackages  ?? {},
+      // Migrate: if old config had an inline `profile` object, drop it; use file-based profiles.
+      defaultProfile: raw.defaultProfile  ?? 'default',
+    };
+  } catch {
+    console.warn('[wyvrn] Warning: could not parse config.json — using defaults');
+    return { installSources: [], publishSources: [], linkedPackages: {}, defaultProfile: 'default' };
+  }
+}
+
+/**
+ * Persist a config object to disk.
+ * @param {{ installSources: SourceEntry[], publishSources: SourceEntry[] }} config
+ */
+function writeConfig(config) {
+  const dir = getConfigDir();
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(getConfigPath(), JSON.stringify(config, null, 2) + '\n', 'utf8');
+}
+
+module.exports = { getConfigDir, getConfigPath, readConfig, writeConfig };
+
+/**
+ * @typedef {{ name: string, url: string, profile?: string, token?: string }} SourceEntry
+ */

package/src/download.js

@@ -1,164 +1,325 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { pipeline } = require('stream/promises');
-const { Readable } = require('stream');
-const StreamZip = require('node-stream-zip');
-
-/**
- * Downloads a single URL to a local file path, respecting the given timeout.
- *
- * @param {string} url - Remote URL to download.
- * @param {string} destPath - Local path to write the response body to.
- * @param {Function} httpClient - fetch-compatible function.
- * @param {number} timeoutMs - Abort timeout in milliseconds.
- * @returns {Promise<void>}
- * @throws {Error} On non-OK HTTP status or network / timeout error.
- */
-async function downloadFile(url, destPath, httpClient, timeoutMs) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-
-  let response;
-  try {
-    response = await httpClient(url, { signal: controller.signal });
-  } finally {
-    clearTimeout(timer);
-  }
-
-  if (!response.ok) {
-    throw new Error(`HTTP ${response.status} for ${url}`);
-  }
-
-  // Stream the response body directly to disk — avoids loading large files into RAM.
-  const fileStream = fs.createWriteStream(destPath);
-  await pipeline(Readable.fromWeb(response.body), fileStream);
-}
-
-/**
- * Resolves which source URL contains a given package by probing each one in order.
- *
- * @param {string} name
- * @param {string} version
- * @param {string[]} packageSources
- * @param {string} platform
- * @param {Function} httpClient
- * @param {number} timeoutMs
- * @param {string} destZipPath - Where to save the downloaded zip.
- * @returns {Promise<boolean>} True if successfully downloaded, false otherwise.
- */
-async function tryDownloadFromSources(
-  name,
-  version,
-  packageSources,
-  platform,
-  httpClient,
-  timeoutMs,
-  destZipPath,
-) {
-  for (const source of packageSources) {
-    const base = source.replace(/\/$/, '');
-    const candidates = [
-      `${base}/${platform}/${name}/${version}/wyvrn.zip`,
-      `${base}/${platform}/${name}/${version}/razer.zip`,
-      `${base}/common/${name}/${version}/wyvrn.zip`,
-      `${base}/common/${name}/${version}/razer.zip`,
-    ];
-    for (const url of candidates) {
-      try {
-        await downloadFile(url, destZipPath, httpClient, timeoutMs);
-        return true;
-      } catch (err) {
-        console.warn(`[wyvrn] Could not download ${name}@${version} from ${url}: ${err.message}`);
-      }
-    }
-  }
-  return false;
-}
-
-/**
- * Downloads and extracts all resolved dependencies that are not already present on disk.
- *
- * @param {Map<string, string>} resolvedDeps - Map of package name -> version string.
- * @param {string[]} packageSources - Ordered list of base URLs to try.
- * @param {string} platform - Target platform string (e.g. "win_x64").
- * @param {string} razerDir - Local directory used for extraction (e.g. "wyvrn_internal").
- * @param {Function} httpClient - fetch-compatible function.
- * @param {number} timeout - HTTP timeout in seconds.
- * @returns {Promise<void>}
- */
-async function downloadDependencies(
-  resolvedDeps,
-  packageSources,
-  platform,
-  razerDir,
-  httpClient,
-  timeout,
-) {
-  const timeoutMs = timeout * 1000;
-
-  if (!fs.existsSync(razerDir)) {
-    fs.mkdirSync(razerDir, { recursive: true });
-  }
-
-  for (const [name, version] of resolvedDeps) {
-    const extractDir = path.join(razerDir, name);
-    const versionFile = path.join(extractDir, '.wyvrn-version');
-
-    if (fs.existsSync(extractDir)) {
-      const installedVersion = fs.existsSync(versionFile)
-        ? fs.readFileSync(versionFile, 'utf8').trim()
-        : null;
-      if (installedVersion === version) {
-        console.log(`[wyvrn] Already present: ${name}@${version} — skipping`);
-        continue;
-      }
-      console.log(`[wyvrn] Version changed: ${name} ${installedVersion} → ${version}, re-downloading`);
-      fs.rmSync(extractDir, { recursive: true, force: true });
-    }
-
-    console.log(`[wyvrn] Downloading: ${name}@${version}`);
-
-    const destZipPath = path.join(razerDir, `${name}.zip`);
-
-    const ok = await tryDownloadFromSources(
-      name,
-      version,
-      packageSources,
-      platform,
-      httpClient,
-      timeoutMs,
-      destZipPath,
-    );
-
-    if (!ok) {
-      console.warn(
-        `[wyvrn] Warning: package ${name}@${version} was not found in any configured source`,
-      );
-      continue;
-    }
-
-    try {
-      fs.mkdirSync(extractDir, { recursive: true });
-      const zip = new StreamZip.async({ file: destZipPath });
-      await zip.extract(null, extractDir);
-      await zip.close();
-      fs.writeFileSync(versionFile, version, 'utf8');
-      console.log(`[wyvrn] Extracted: ${name}@${version} → ${extractDir}`);
-    } catch (err) {
-      console.warn(`[wyvrn] Failed to extract ${name}@${version}: ${err.message}`);
-    } finally {
-      // Always remove the zip, even if extraction failed.
-      try {
-        fs.unlinkSync(destZipPath);
-      } catch {
-        // Ignore cleanup errors.
-      }
-    }
-  }
-}
-
-module.exports = {
-  downloadDependencies,
-};
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+const { pipeline } = require('stream/promises');
+const { Readable } = require('stream');
+const StreamZip = require('node-stream-zip');
+
+const { isLink, getLinkTarget } = require('./link-utils');
+const { sha256Of }              = require('./profile');
+const { getProvider }           = require('./providers');
+
+// ---------------------------------------------------------------------------
+// v1 (legacy) download helpers
+// ---------------------------------------------------------------------------
+
+async function downloadFile(url, destPath, httpClient, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  try {
+    response = await httpClient(url, { signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!response.ok) throw new Error(`HTTP ${response.status} for ${url}`);
+  const fileStream = fs.createWriteStream(destPath);
+  await pipeline(Readable.fromWeb(response.body), fileStream);
+}
+
+async function tryDownloadFromSources(name, version, packageSources, platform, httpClient, timeoutMs, destZipPath) {
+  for (const source of packageSources) {
+    const base = source.replace(/\/$/, '');
+    const candidates = [
+      `${base}/${platform}/${name}/${version}/wyvrn.zip`,
+      `${base}/${platform}/${name}/${version}/razer.zip`,
+      `${base}/common/${name}/${version}/wyvrn.zip`,
+      `${base}/common/${name}/${version}/razer.zip`,
+    ];
+    for (const url of candidates) {
+      try {
+        await downloadFile(url, destZipPath, httpClient, timeoutMs);
+        return true;
+      } catch (err) {
+        console.warn(`[wyvrn] Could not download ${name}@${version} from ${url}: ${err.message}`);
+      }
+    }
+  }
+  return false;
+}
+
+// ---------------------------------------------------------------------------
+// v2 download helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Try to download a v2 prebuilt binary for a package.
+ *
+ * Resolution order:
+ *   1. Exact profile hash match
+ *   2. Compatible build from versions.json (same OS + arch, any compiler)
+ *   3. Return null (caller should fall back to v1)
+ *
+ * @param {{
+ *   name:         string,
+ *   version:      string,
+ *   profileHash:  string,
+ *   profile:      import('./profile').WyvrnProfile,
+ * }} dep
+ * @param {string[]}  packageSources
+ * @param {string}    destZipPath
+ * @param {number}    timeoutMs
+ * @param {object}    authOptions  - { awsProfile?, token? }
+ * @returns {Promise<{
+ *   found:         boolean,
+ *   contentSha256: string|null,
+ *   gitSha:        string|null,
+ *   gitRepo:       string|null,
+ *   profileHash:   string,
+ *   source:        string,       // which source URL was used
+ * }|null>}  null = not found in v2
+ */
+async function tryDownloadV2(dep, packageSources, destZipPath, timeoutMs, authOptions = {}) {
+  const { name, version, profileHash, profile } = dep;
+  const { awsProfile, token } = authOptions;
+
+  for (const source of packageSources) {
+    let provider;
+    try { provider = getProvider(source); } catch { continue; }
+
+    // 1) Exact profile hash
+    const exactMeta = await provider.v2GetMeta({ source, name, version, profileHash, awsProfile, token });
+    if (exactMeta) {
+      const ok = await provider.v2DownloadZip({ source, name, version, profileHash, awsProfile, token }, destZipPath, timeoutMs);
+      if (ok) {
+        return {
+          found:         true,
+          contentSha256: exactMeta.contentSha256 ?? null,
+          gitSha:        exactMeta.gitSha        ?? null,
+          gitRepo:       exactMeta.gitRepo       ?? null,
+          profileHash,
+          source,
+        };
+      }
+    }
+
+    // 2) Fallback: scan versions.json for a compatible build (same OS + arch)
+    const idx = await provider.v2GetVersionsIndex({ source, name, awsProfile, token });
+    if (!idx?.versions?.[version]?.profiles) continue;
+
+    const versionEntry = idx.versions[version];
+    for (const [ph, buildEntry] of Object.entries(versionEntry.profiles)) {
+      // buildSettings is the copy of the profile stored for debugging at publish time
+      const bp = buildEntry.buildSettings ?? buildEntry.profile;
+      if (!bp) continue;
+      if (bp.os !== profile.os) continue;
+      if (bp.arch !== profile.arch) continue;
+      // Same OS + arch — accept as a compatible fallback
+      console.warn(
+        `[wyvrn] No exact profile match for ${name}@${version}; using compatible build [${ph}]` +
+        ` (${bp.compiler} ${bp['compiler.version']})`,
+      );
+      const ok = await provider.v2DownloadZip({ source, name, version, profileHash: ph, awsProfile, token }, destZipPath, timeoutMs);
+      if (ok) {
+        return {
+          found:         true,
+          contentSha256: buildEntry.contentSha256 ?? null,
+          gitSha:        versionEntry.source?.gitSha  ?? null,
+          gitRepo:       versionEntry.source?.gitRepo ?? null,
+          profileHash:   ph,
+          source,
+        };
+      }
+    }
+  }
+
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Extraction helper
+// ---------------------------------------------------------------------------
+
+async function extractZip(destZipPath, extractDir) {
+  const zip = new StreamZip.async({ file: destZipPath });
+  await zip.extract(null, extractDir);
+  await zip.close();
+}
+
+// ---------------------------------------------------------------------------
+// Main downloadDependencies (v2-aware)
+// ---------------------------------------------------------------------------
+
+/**
+ * Downloads and extracts all resolved dependencies.
+ * Tries v2 first (profile-aware + SHA256 verification), falls back to v1.
+ *
+ * @param {Map<string, string | {version:string, profileHash:string|null, profile:import('./profile').WyvrnProfile|null}>} deps
+ *   Either a plain `Map<name, version>` (legacy callers / tests) or the enriched map
+ *   produced by install.js: `Map<name, { version, profileHash, profile }>`.
+ * @param {string[]}  packageSources
+ * @param {string}    platform        - v1 legacy platform string
+ * @param {string}    razerDir
+ * @param {Function}  httpClient      - fetch-compatible
+ * @param {number}    timeout         - seconds
+ * @param {object}    [authOptions]   - { awsProfile?, token? }
+ * @returns {Promise<Map<string, {version:string, profileHash?:string, contentSha256?:string, gitSha?:string, resolvedFrom:string}>>}
+ */
+async function downloadDependencies(deps, packageSources, platform, razerDir, httpClient, timeout, authOptions = {}) {
+  const timeoutMs = timeout * 1000;
+  const { awsProfile, token } = authOptions;
+
+  if (!fs.existsSync(razerDir)) {
+    fs.mkdirSync(razerDir, { recursive: true });
+  }
+
+  /** @type {Map<string, object>} */
+  const lockEntries = new Map();
+
+  for (const [name, depInfoOrVersion] of deps) {
+    // Normalise: accept both plain version string (legacy) and enriched object
+    const isLegacyEntry = typeof depInfoOrVersion === 'string';
+    const version     = isLegacyEntry ? depInfoOrVersion : depInfoOrVersion.version;
+    const profileHash = isLegacyEntry ? null : (depInfoOrVersion.profileHash ?? null);
+    const profile     = isLegacyEntry ? null : (depInfoOrVersion.profile     ?? null);
+
+    const extractDir  = path.join(razerDir, name);
+    const versionFile = path.join(extractDir, '.wyvrn-version');
+    const metaFile    = path.join(extractDir, '.wyvrn-meta.json');
+
+    // Skip linked packages
+    if (isLink(extractDir)) {
+      const linkTarget = getLinkTarget(extractDir);
+      console.log(`[wyvrn] Linked: ${name} → ${linkTarget} (skipping download)`);
+      lockEntries.set(name, { version, resolvedFrom: 'link' });
+      continue;
+    }
+
+    // Skip if already at correct version + profile hash
+    if (fs.existsSync(extractDir)) {
+      const installedVersion = fs.existsSync(versionFile)
+        ? fs.readFileSync(versionFile, 'utf8').trim()
+        : null;
+      const installedMeta = fs.existsSync(metaFile)
+        ? JSON.parse(fs.readFileSync(metaFile, 'utf8'))
+        : null;
+
+      const sameVersion = installedVersion === version;
+      const sameProfile = !profileHash || installedMeta?.profileHash === profileHash;
+
+      if (sameVersion && sameProfile) {
+        console.log(`[wyvrn] Already present: ${name}@${version}${profileHash ? ` [${installedMeta?.profileHash}]` : ''} — skipping`);
+        lockEntries.set(name, {
+          version,
+          profileHash:   installedMeta?.profileHash   ?? null,
+          contentSha256: installedMeta?.contentSha256 ?? null,
+          gitSha:        installedMeta?.gitSha        ?? null,
+          resolvedFrom:  installedMeta?.resolvedFrom  ?? 'cached',
+        });
+        continue;
+      }
+      if (!sameVersion) {
+        console.log(`[wyvrn] Version changed: ${name} ${installedVersion} → ${version}, re-downloading`);
+      } else {
+        console.log(`[wyvrn] Profile changed for ${name}@${version}, re-downloading`);
+      }
+      fs.rmSync(extractDir, { recursive: true, force: true });
+    }
+
+    console.log(`[wyvrn] Downloading: ${name}@${version}`);
+    const destZipPath = path.join(razerDir, `${name}.zip`);
+
+    let downloadResult = null;
+    let resolvedFrom   = 'v1';
+
+    // ── Try v2 first ────────────────────────────────────────────────────────
+    if (profileHash && profile) {
+      downloadResult = await tryDownloadV2(
+        { name, version, profileHash, profile },
+        packageSources,
+        destZipPath,
+        timeoutMs,
+        { awsProfile, token },
+      );
+      if (downloadResult) resolvedFrom = 'v2';
+    }
+
+    // ── Fall back to v1 ─────────────────────────────────────────────────────
+    if (!downloadResult) {
+      const ok = await tryDownloadFromSources(name, version, packageSources, platform, httpClient, timeoutMs, destZipPath);
+      if (!ok) {
+        console.warn(`[wyvrn] Warning: package ${name}@${version} was not found in any configured source`);
+        lockEntries.set(name, { version, resolvedFrom: 'not-found' });
+        continue;
+      }
+    }
+
+    // ── SHA256 integrity check (v2 only) ────────────────────────────────────
+    if (downloadResult?.contentSha256) {
+      const actual = sha256Of(destZipPath);
+      if (actual !== downloadResult.contentSha256) {
+        console.error(
+          `[wyvrn] Error: SHA256 mismatch for ${name}@${version}\n` +
+          `  expected: ${downloadResult.contentSha256}\n` +
+          `  actual:   ${actual}`,
+        );
+        try { fs.unlinkSync(destZipPath); } catch { /* ignore */ }
+        lockEntries.set(name, { version, resolvedFrom: 'sha256-mismatch' });
+        continue;
+      }
+      console.log(`[wyvrn] SHA256 verified: ${actual.slice(0, 16)}...`);
+    }
+
+    // ── Extract ─────────────────────────────────────────────────────────────
+    try {
+      fs.mkdirSync(extractDir, { recursive: true });
+      await extractZip(destZipPath, extractDir);
+
+      // Write .wyvrn-version (v1 compat)
+      fs.writeFileSync(versionFile, version, 'utf8');
+
+      // Write .wyvrn-meta.json (v2 extended metadata)
+      const meta = {
+        version,
+        resolvedFrom,
+        profileHash:   downloadResult?.profileHash   ?? null,
+        contentSha256: downloadResult?.contentSha256 ?? null,
+        gitSha:        downloadResult?.gitSha        ?? null,
+        gitRepo:       downloadResult?.gitRepo       ?? null,
+        installedAt:   new Date().toISOString(),
+      };
+      fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2) + '\n', 'utf8');
+
+      console.log(
+        `[wyvrn] Extracted: ${name}@${version}` +
+        (downloadResult?.profileHash ? ` [${downloadResult.profileHash}]` : '') +
+        ` (${resolvedFrom}) → ${extractDir}`,
+      );
+
+      if (downloadResult?.gitSha) {
+        console.log(`[wyvrn]   Source commit : ${downloadResult.gitSha}`);
+        if (downloadResult?.gitRepo) {
+          console.log(`[wyvrn]   Source repo   : ${downloadResult.gitRepo}`);
+        }
+      }
+
+      lockEntries.set(name, {
+        version,
+        resolvedFrom,
+        profileHash:   downloadResult?.profileHash   ?? null,
+        contentSha256: downloadResult?.contentSha256 ?? null,
+        gitSha:        downloadResult?.gitSha        ?? null,
+      });
+    } catch (err) {
+      console.warn(`[wyvrn] Failed to extract ${name}@${version}: ${err.message}`);
+      lockEntries.set(name, { version, resolvedFrom: 'extract-failed' });
+    } finally {
+      try { fs.unlinkSync(destZipPath); } catch { /* ignore */ }
+    }
+  }
+
+  return lockEntries;
+}
+
+module.exports = { downloadDependencies };

package/src/index.js

@@ -1,9 +1,10 @@
-'use strict';
-
-module.exports = {
-  init: require('./commands/init'),
-  install: require('./commands/install'),
-  clean: require('./commands/clean'),
-  publish: require('./commands/publish'),
-  configure: require('./commands/configure'),
-};
+'use strict';
+
+module.exports = {
+  init:      require('./commands/init'),
+  install:   require('./commands/install'),
+  clean:     require('./commands/clean'),
+  publish:   require('./commands/publish'),
+  configure: require('./commands/configure'),
+  profile:   require('./commands/profile'),
+};