wyvrnpm 1.2.1 → 2.0.1

package/src/providers/http.js

@@ -1,118 +1,268 @@
-'use strict';
-
-const fs = require('fs');
-const http = require('http');
-const https = require('https');
-const BaseProvider = require('./base');
-
-class HttpProvider extends BaseProvider {
-  static canHandle(source) {
-    return /^https?:\/\//.test(source);
-  }
-
-  static get providerName() {
-    return 'HTTP';
-  }
-
-  async exists(options) {
-    const { source, platform, name, version } = options;
-    const base = source.replace(/\/$/, '');
-    const url = `${base}/${platform}/${name}/${version}/wyvrn.json`;
-    return new Promise((resolve, reject) => {
-      const parsed = new URL(url);
-      const lib = parsed.protocol === 'https:' ? https : http;
-      const req = lib.request(
-        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'HEAD' },
-        (res) => { res.resume(); resolve(res.statusCode >= 200 && res.statusCode < 300); },
-      );
-      req.on('error', reject);
-      req.end();
-    });
-  }
-
-  async publish(files, options) {
-    const { source, platform, name, version, token } = options;
-    const base = source.replace(/\/$/, '');
-    const urlBase = `${base}/${platform}/${name}/${version}`;
-    const packageBase = `${base}/${platform}/${name}`;
-
-    await this._put(`${urlBase}/wyvrn.json`, files.manifest, 'application/json', token);
-    await this._put(`${urlBase}/wyvrn.zip`, files.zip, 'application/zip', token);
-
-    // Write latest.json at the package root so consumers can resolve "latest"
-    await this._putBuffer(`${packageBase}/latest.json`, Buffer.from(JSON.stringify({ version })), 'application/json', token);
-  }
-
-  _put(url, filePath, contentType, token) {
-    return new Promise((resolve, reject) => {
-      const body = fs.readFileSync(filePath);
-      const parsed = new URL(url);
-      const lib = parsed.protocol === 'https:' ? https : http;
-
-      const headers = {
-        'Content-Type': contentType,
-        'Content-Length': body.length,
-      };
-      if (token) headers['Authorization'] = `Bearer ${token}`;
-
-      console.log(`[wyvrn]   → PUT ${url}`);
-      const req = lib.request(
-        {
-          hostname: parsed.hostname,
-          port: parsed.port || undefined,
-          path: parsed.pathname,
-          method: 'PUT',
-          headers,
-        },
-        (res) => {
-          res.resume(); // drain the response
-          if (res.statusCode >= 200 && res.statusCode < 300) {
-            resolve();
-          } else {
-            reject(new Error(`HTTP PUT ${url} failed: ${res.statusCode} ${res.statusMessage}`));
-          }
-        },
-      );
-      req.on('error', reject);
-      req.write(body);
-      req.end();
-    });
-  }
-
-  _putBuffer(url, buffer, contentType, token) {
-    return new Promise((resolve, reject) => {
-      const parsed = new URL(url);
-      const lib = parsed.protocol === 'https:' ? https : http;
-
-      const headers = {
-        'Content-Type': contentType,
-        'Content-Length': buffer.length,
-      };
-      if (token) headers['Authorization'] = `Bearer ${token}`;
-
-      console.log(`[wyvrn]   → PUT ${url}`);
-      const req = lib.request(
-        {
-          hostname: parsed.hostname,
-          port: parsed.port || undefined,
-          path: parsed.pathname,
-          method: 'PUT',
-          headers,
-        },
-        (res) => {
-          res.resume();
-          if (res.statusCode >= 200 && res.statusCode < 300) {
-            resolve();
-          } else {
-            reject(new Error(`HTTP PUT ${url} failed: ${res.statusCode} ${res.statusMessage}`));
-          }
-        },
-      );
-      req.on('error', reject);
-      req.write(buffer);
-      req.end();
-    });
-  }
-}
-
-module.exports = HttpProvider;
+'use strict';
+
+const fs = require('fs');
+const http = require('http');
+const https = require('https');
+const { pipeline } = require('stream/promises');
+const { Readable } = require('stream');
+const BaseProvider = require('./base');
+
+function pinDependencies(rawDeps, lockedDeps) {
+  if (!rawDeps || !lockedDeps || Object.keys(lockedDeps).length === 0) return rawDeps;
+  const result = {};
+  for (const [pkgName, value] of Object.entries(rawDeps)) {
+    const locked = lockedDeps[pkgName];
+    if (locked) {
+      result[pkgName] = typeof value === 'object' && value !== null
+        ? { ...value, version: locked }
+        : locked;
+    } else {
+      result[pkgName] = value;
+    }
+  }
+  return result;
+}
+
+class HttpProvider extends BaseProvider {
+  static canHandle(source) {
+    return /^https?:\/\//.test(source);
+  }
+
+  static get providerName() {
+    return 'HTTP';
+  }
+
+  // ── helpers ──────────────────────────────────────────────────────────────
+
+  _lib(url) {
+    return url.startsWith('https') ? https : http;
+  }
+
+  /** PUT a file from disk to url. */
+  _put(url, filePath, contentType, token) {
+    return new Promise((resolve, reject) => {
+      const body = fs.readFileSync(filePath);
+      const parsed = new URL(url);
+      const headers = { 'Content-Type': contentType, 'Content-Length': body.length };
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      console.log(`[wyvrn]   → PUT ${url}`);
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'PUT', headers },
+        (res) => {
+          res.resume();
+          if (res.statusCode >= 200 && res.statusCode < 300) resolve();
+          else reject(new Error(`HTTP PUT ${url} failed: ${res.statusCode}`));
+        },
+      );
+      req.on('error', reject);
+      req.write(body);
+      req.end();
+    });
+  }
+
+  /** PUT a Buffer to url. */
+  _putBuffer(url, buffer, contentType, token) {
+    return new Promise((resolve, reject) => {
+      const parsed = new URL(url);
+      const headers = { 'Content-Type': contentType, 'Content-Length': buffer.length };
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      console.log(`[wyvrn]   → PUT ${url}`);
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'PUT', headers },
+        (res) => {
+          res.resume();
+          if (res.statusCode >= 200 && res.statusCode < 300) resolve();
+          else reject(new Error(`HTTP PUT ${url} failed: ${res.statusCode}`));
+        },
+      );
+      req.on('error', reject);
+      req.write(buffer);
+      req.end();
+    });
+  }
+
+  /** HEAD check — returns true on 2xx. */
+  _head(url, token) {
+    return new Promise((resolve, reject) => {
+      const parsed = new URL(url);
+      const headers = {};
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'HEAD', headers },
+        (res) => { res.resume(); resolve(res.statusCode >= 200 && res.statusCode < 300); },
+      );
+      req.on('error', reject);
+      req.end();
+    });
+  }
+
+  /**
+   * GET url → parsed JSON, or null on 404 / error.
+   * @returns {Promise<object|null>}
+   */
+  _getJson(url, token) {
+    return new Promise((resolve) => {
+      const parsed = new URL(url);
+      const headers = { Accept: 'application/json' };
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'GET', headers },
+        (res) => {
+          if (res.statusCode === 404) { res.resume(); resolve(null); return; }
+          if (res.statusCode < 200 || res.statusCode >= 300) { res.resume(); resolve(null); return; }
+          const chunks = [];
+          res.on('data', (c) => chunks.push(c));
+          res.on('end', () => {
+            try { resolve(JSON.parse(Buffer.concat(chunks).toString('utf8'))); }
+            catch { resolve(null); }
+          });
+        },
+      );
+      req.on('error', () => resolve(null));
+      req.end();
+    });
+  }
+
+  /** GET url → stream download to destPath. Returns true on success. */
+  async _download(url, destPath, token, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs ?? 300_000);
+    try {
+      const headers = {};
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      const response = await fetch(url, { signal: controller.signal, headers });
+      if (!response.ok) return false;
+      const fileStream = fs.createWriteStream(destPath);
+      await pipeline(Readable.fromWeb(response.body), fileStream);
+      return true;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  // ── v1 (legacy) API ───────────────────────────────────────────────────────
+
+  async exists({ source, platform, name, version, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._head(`${base}/${platform}/${name}/${version}/wyvrn.json`, token);
+  }
+
+  async publish(files, { source, platform, name, version, token }) {
+    const base = source.replace(/\/$/, '');
+    const urlBase    = `${base}/${platform}/${name}/${version}`;
+    const packageBase = `${base}/${platform}/${name}`;
+
+    await this._put(`${urlBase}/wyvrn.json`, files.manifest, 'application/json', token);
+    await this._put(`${urlBase}/wyvrn.zip`,  files.zip,      'application/zip',  token);
+    await this._putBuffer(
+      `${packageBase}/latest.json`,
+      Buffer.from(JSON.stringify({ version })),
+      'application/json',
+      token,
+    );
+  }
+
+  // ── v2 API ────────────────────────────────────────────────────────────────
+
+  async v2Exists({ source, name, version, profileHash, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._head(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.json`, token);
+  }
+
+  async v2Publish(files, options) {
+    const {
+      source, name, version, profileHash, buildSettings,
+      contentSha256, gitSha, gitRepo, lockedDependencies, token,
+    } = options;
+    const base   = source.replace(/\/$/, '');
+    const v2root = `${base}/v2/${name}`;
+    const buildRoot = `${v2root}/${version}/${profileHash}`;
+
+    // 1) Upload the binary zip
+    await this._put(`${buildRoot}/wyvrn.zip`, files.zip, 'application/zip', token);
+
+    // 2) Upload enriched wyvrn.json (original manifest + v2 metadata)
+    //    buildSettings is stored for debugging purposes only — not for configuration.
+    //    Dependencies are replaced with locked versions so the server never sees "latest".
+    const rawManifest = JSON.parse(fs.readFileSync(files.manifest, 'utf8'));
+    const pinnedDeps = pinDependencies(rawManifest.dependencies, lockedDependencies);
+    const v2Meta = {
+      ...rawManifest,
+      ...(pinnedDeps !== undefined ? { dependencies: pinnedDeps } : {}),
+      schemaVersion: 2,
+      profileHash,
+      buildSettings,     // copy of the profile used — for debugging
+      contentSha256,
+      gitSha:      gitSha  ?? null,
+      gitRepo:     gitRepo ?? null,
+      publishedAt: new Date().toISOString(),
+    };
+    await this._putBuffer(
+      `${buildRoot}/wyvrn.json`,
+      Buffer.from(JSON.stringify(v2Meta, null, 2)),
+      'application/json',
+      token,
+    );
+
+    // 3) Upload source.json (git metadata for build-from-source)
+    if (gitSha || gitRepo) {
+      const srcMeta = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
+      await this._putBuffer(
+        `${v2root}/${version}/source.json`,
+        Buffer.from(JSON.stringify(srcMeta, null, 2)),
+        'application/json',
+        token,
+      );
+    }
+
+    // 4) Read-modify-write versions.json index (non-atomic, best-effort)
+    let versionsIdx = await this._getJson(`${v2root}/versions.json`, token) ?? {
+      name, latest: version, versions: {},
+    };
+    if (!versionsIdx.versions) versionsIdx.versions = {};
+    if (!versionsIdx.versions[version]) versionsIdx.versions[version] = { profiles: {} };
+    versionsIdx.versions[version].profiles[profileHash] = {
+      contentSha256,
+      publishedAt: new Date().toISOString(),
+      buildSettings,
+    };
+    if (gitSha || gitRepo) {
+      versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
+    }
+    versionsIdx.latest = version;
+    await this._putBuffer(
+      `${v2root}/versions.json`,
+      Buffer.from(JSON.stringify(versionsIdx, null, 2)),
+      'application/json',
+      token,
+    );
+
+    // 5) Update v2 latest.json
+    await this._putBuffer(
+      `${v2root}/latest.json`,
+      Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+      'application/json',
+      token,
+    );
+  }
+
+  async v2GetMeta({ source, name, version, profileHash, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._getJson(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.json`, token);
+  }
+
+  async v2GetVersionsIndex({ source, name, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._getJson(`${base}/v2/${name}/versions.json`, token);
+  }
+
+  async v2DownloadZip({ source, name, version, profileHash, token }, destPath, timeoutMs) {
+    const base = source.replace(/\/$/, '');
+    const url  = `${base}/v2/${name}/${version}/${profileHash}/wyvrn.zip`;
+    return this._download(url, destPath, token, timeoutMs);
+  }
+}
+
+module.exports = HttpProvider;