wyvrnpm 1.3.2 → 2.0.1

package/src/download.js

@@ -1,63 +1,34 @@
 'use strict';
 
-const fs = require('fs');
+const fs   = require('fs');
 const path = require('path');
 const { pipeline } = require('stream/promises');
 const { Readable } = require('stream');
 const StreamZip = require('node-stream-zip');
+
 const { isLink, getLinkTarget } = require('./link-utils');
+const { sha256Of }              = require('./profile');
+const { getProvider }           = require('./providers');
+
+// ---------------------------------------------------------------------------
+// v1 (legacy) download helpers
+// ---------------------------------------------------------------------------
 
-/**
- * Downloads a single URL to a local file path, respecting the given timeout.
- *
- * @param {string} url - Remote URL to download.
- * @param {string} destPath - Local path to write the response body to.
- * @param {Function} httpClient - fetch-compatible function.
- * @param {number} timeoutMs - Abort timeout in milliseconds.
- * @returns {Promise<void>}
- * @throws {Error} On non-OK HTTP status or network / timeout error.
- */
 async function downloadFile(url, destPath, httpClient, timeoutMs) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-
   let response;
   try {
     response = await httpClient(url, { signal: controller.signal });
   } finally {
     clearTimeout(timer);
   }
-
-  if (!response.ok) {
-    throw new Error(`HTTP ${response.status} for ${url}`);
-  }
-
-  // Stream the response body directly to disk — avoids loading large files into RAM.
+  if (!response.ok) throw new Error(`HTTP ${response.status} for ${url}`);
   const fileStream = fs.createWriteStream(destPath);
   await pipeline(Readable.fromWeb(response.body), fileStream);
 }
 
-/**
- * Resolves which source URL contains a given package by probing each one in order.
- *
- * @param {string} name
- * @param {string} version
- * @param {string[]} packageSources
- * @param {string} platform
- * @param {Function} httpClient
- * @param {number} timeoutMs
- * @param {string} destZipPath - Where to save the downloaded zip.
- * @returns {Promise<boolean>} True if successfully downloaded, false otherwise.
- */
-async function tryDownloadFromSources(
-  name,
-  version,
-  packageSources,
-  platform,
-  httpClient,
-  timeoutMs,
-  destZipPath,
-) {
+async function tryDownloadFromSources(name, version, packageSources, platform, httpClient, timeoutMs, destZipPath) {
   for (const source of packageSources) {
     const base = source.replace(/\/$/, '');
     const candidates = [
@@ -78,95 +49,277 @@ async function tryDownloadFromSources(
   return false;
 }
 
+// ---------------------------------------------------------------------------
+// v2 download helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Try to download a v2 prebuilt binary for a package.
+ *
+ * Resolution order:
+ *   1. Exact profile hash match
+ *   2. Compatible build from versions.json (same OS + arch, any compiler)
+ *   3. Return null (caller should fall back to v1)
+ *
+ * @param {{
+ *   name:         string,
+ *   version:      string,
+ *   profileHash:  string,
+ *   profile:      import('./profile').WyvrnProfile,
+ * }} dep
+ * @param {string[]}  packageSources
+ * @param {string}    destZipPath
+ * @param {number}    timeoutMs
+ * @param {object}    authOptions  - { awsProfile?, token? }
+ * @returns {Promise<{
+ *   found:         boolean,
+ *   contentSha256: string|null,
+ *   gitSha:        string|null,
+ *   gitRepo:       string|null,
+ *   profileHash:   string,
+ *   source:        string,       // which source URL was used
+ * }|null>}  null = not found in v2
+ */
+async function tryDownloadV2(dep, packageSources, destZipPath, timeoutMs, authOptions = {}) {
+  const { name, version, profileHash, profile } = dep;
+  const { awsProfile, token } = authOptions;
+
+  for (const source of packageSources) {
+    let provider;
+    try { provider = getProvider(source); } catch { continue; }
+
+    // 1) Exact profile hash
+    const exactMeta = await provider.v2GetMeta({ source, name, version, profileHash, awsProfile, token });
+    if (exactMeta) {
+      const ok = await provider.v2DownloadZip({ source, name, version, profileHash, awsProfile, token }, destZipPath, timeoutMs);
+      if (ok) {
+        return {
+          found:         true,
+          contentSha256: exactMeta.contentSha256 ?? null,
+          gitSha:        exactMeta.gitSha        ?? null,
+          gitRepo:       exactMeta.gitRepo       ?? null,
+          profileHash,
+          source,
+        };
+      }
+    }
+
+    // 2) Fallback: scan versions.json for a compatible build (same OS + arch)
+    const idx = await provider.v2GetVersionsIndex({ source, name, awsProfile, token });
+    if (!idx?.versions?.[version]?.profiles) continue;
+
+    const versionEntry = idx.versions[version];
+    for (const [ph, buildEntry] of Object.entries(versionEntry.profiles)) {
+      // buildSettings is the copy of the profile stored for debugging at publish time
+      const bp = buildEntry.buildSettings ?? buildEntry.profile;
+      if (!bp) continue;
+      if (bp.os !== profile.os) continue;
+      if (bp.arch !== profile.arch) continue;
+      // Same OS + arch — accept as a compatible fallback
+      console.warn(
+        `[wyvrn] No exact profile match for ${name}@${version}; using compatible build [${ph}]` +
+        ` (${bp.compiler} ${bp['compiler.version']})`,
+      );
+      const ok = await provider.v2DownloadZip({ source, name, version, profileHash: ph, awsProfile, token }, destZipPath, timeoutMs);
+      if (ok) {
+        return {
+          found:         true,
+          contentSha256: buildEntry.contentSha256 ?? null,
+          gitSha:        versionEntry.source?.gitSha  ?? null,
+          gitRepo:       versionEntry.source?.gitRepo ?? null,
+          profileHash:   ph,
+          source,
+        };
+      }
+    }
+  }
+
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Extraction helper
+// ---------------------------------------------------------------------------
+
+async function extractZip(destZipPath, extractDir) {
+  const zip = new StreamZip.async({ file: destZipPath });
+  await zip.extract(null, extractDir);
+  await zip.close();
+}
+
+// ---------------------------------------------------------------------------
+// Main downloadDependencies (v2-aware)
+// ---------------------------------------------------------------------------
+
 /**
- * Downloads and extracts all resolved dependencies that are not already present on disk.
+ * Downloads and extracts all resolved dependencies.
+ * Tries v2 first (profile-aware + SHA256 verification), falls back to v1.
  *
- * @param {Map<string, string>} resolvedDeps - Map of package name -> version string.
- * @param {string[]} packageSources - Ordered list of base URLs to try.
- * @param {string} platform - Target platform string (e.g. "win_x64").
- * @param {string} razerDir - Local directory used for extraction (e.g. "wyvrn_internal").
- * @param {Function} httpClient - fetch-compatible function.
- * @param {number} timeout - HTTP timeout in seconds.
- * @returns {Promise<void>}
+ * @param {Map<string, string | {version:string, profileHash:string|null, profile:import('./profile').WyvrnProfile|null}>} deps
+ *   Either a plain `Map<name, version>` (legacy callers / tests) or the enriched map
+ *   produced by install.js: `Map<name, { version, profileHash, profile }>`.
+ * @param {string[]}  packageSources
+ * @param {string}    platform        - v1 legacy platform string
+ * @param {string}    razerDir
+ * @param {Function}  httpClient      - fetch-compatible
+ * @param {number}    timeout         - seconds
+ * @param {object}    [authOptions]   - { awsProfile?, token? }
+ * @returns {Promise<Map<string, {version:string, profileHash?:string, contentSha256?:string, gitSha?:string, resolvedFrom:string}>>}
  */
-async function downloadDependencies(
-  resolvedDeps,
-  packageSources,
-  platform,
-  razerDir,
-  httpClient,
-  timeout,
-) {
+async function downloadDependencies(deps, packageSources, platform, razerDir, httpClient, timeout, authOptions = {}) {
   const timeoutMs = timeout * 1000;
+  const { awsProfile, token } = authOptions;
 
   if (!fs.existsSync(razerDir)) {
     fs.mkdirSync(razerDir, { recursive: true });
   }
 
-  for (const [name, version] of resolvedDeps) {
-    const extractDir = path.join(razerDir, name);
+  /** @type {Map<string, object>} */
+  const lockEntries = new Map();
+
+  for (const [name, depInfoOrVersion] of deps) {
+    // Normalise: accept both plain version string (legacy) and enriched object
+    const isLegacyEntry = typeof depInfoOrVersion === 'string';
+    const version     = isLegacyEntry ? depInfoOrVersion : depInfoOrVersion.version;
+    const profileHash = isLegacyEntry ? null : (depInfoOrVersion.profileHash ?? null);
+    const profile     = isLegacyEntry ? null : (depInfoOrVersion.profile     ?? null);
+
+    const extractDir  = path.join(razerDir, name);
     const versionFile = path.join(extractDir, '.wyvrn-version');
+    const metaFile    = path.join(extractDir, '.wyvrn-meta.json');
 
-    // Skip linked packages - don't overwrite symlinks/junctions
+    // Skip linked packages
     if (isLink(extractDir)) {
       const linkTarget = getLinkTarget(extractDir);
       console.log(`[wyvrn] Linked: ${name} → ${linkTarget} (skipping download)`);
+      lockEntries.set(name, { version, resolvedFrom: 'link' });
       continue;
     }
 
+    // Skip if already at correct version + profile hash
     if (fs.existsSync(extractDir)) {
       const installedVersion = fs.existsSync(versionFile)
         ? fs.readFileSync(versionFile, 'utf8').trim()
         : null;
-      if (installedVersion === version) {
-        console.log(`[wyvrn] Already present: ${name}@${version} — skipping`);
+      const installedMeta = fs.existsSync(metaFile)
+        ? JSON.parse(fs.readFileSync(metaFile, 'utf8'))
+        : null;
+
+      const sameVersion = installedVersion === version;
+      const sameProfile = !profileHash || installedMeta?.profileHash === profileHash;
+
+      if (sameVersion && sameProfile) {
+        console.log(`[wyvrn] Already present: ${name}@${version}${profileHash ? ` [${installedMeta?.profileHash}]` : ''} — skipping`);
+        lockEntries.set(name, {
+          version,
+          profileHash:   installedMeta?.profileHash   ?? null,
+          contentSha256: installedMeta?.contentSha256 ?? null,
+          gitSha:        installedMeta?.gitSha        ?? null,
+          resolvedFrom:  installedMeta?.resolvedFrom  ?? 'cached',
+        });
         continue;
       }
-      console.log(`[wyvrn] Version changed: ${name} ${installedVersion} → ${version}, re-downloading`);
+      if (!sameVersion) {
+        console.log(`[wyvrn] Version changed: ${name} ${installedVersion} → ${version}, re-downloading`);
+      } else {
+        console.log(`[wyvrn] Profile changed for ${name}@${version}, re-downloading`);
+      }
       fs.rmSync(extractDir, { recursive: true, force: true });
     }
 
     console.log(`[wyvrn] Downloading: ${name}@${version}`);
-
     const destZipPath = path.join(razerDir, `${name}.zip`);
 
-    const ok = await tryDownloadFromSources(
-      name,
-      version,
-      packageSources,
-      platform,
-      httpClient,
-      timeoutMs,
-      destZipPath,
-    );
-
-    if (!ok) {
-      console.warn(
-        `[wyvrn] Warning: package ${name}@${version} was not found in any configured source`,
+    let downloadResult = null;
+    let resolvedFrom   = 'v1';
+
+    // ── Try v2 first ────────────────────────────────────────────────────────
+    if (profileHash && profile) {
+      downloadResult = await tryDownloadV2(
+        { name, version, profileHash, profile },
+        packageSources,
+        destZipPath,
+        timeoutMs,
+        { awsProfile, token },
       );
-      continue;
+      if (downloadResult) resolvedFrom = 'v2';
+    }
+
+    // ── Fall back to v1 ─────────────────────────────────────────────────────
+    if (!downloadResult) {
+      const ok = await tryDownloadFromSources(name, version, packageSources, platform, httpClient, timeoutMs, destZipPath);
+      if (!ok) {
+        console.warn(`[wyvrn] Warning: package ${name}@${version} was not found in any configured source`);
+        lockEntries.set(name, { version, resolvedFrom: 'not-found' });
+        continue;
+      }
+    }
+
+    // ── SHA256 integrity check (v2 only) ────────────────────────────────────
+    if (downloadResult?.contentSha256) {
+      const actual = sha256Of(destZipPath);
+      if (actual !== downloadResult.contentSha256) {
+        console.error(
+          `[wyvrn] Error: SHA256 mismatch for ${name}@${version}\n` +
+          `  expected: ${downloadResult.contentSha256}\n` +
+          `  actual:   ${actual}`,
+        );
+        try { fs.unlinkSync(destZipPath); } catch { /* ignore */ }
+        lockEntries.set(name, { version, resolvedFrom: 'sha256-mismatch' });
+        continue;
+      }
+      console.log(`[wyvrn] SHA256 verified: ${actual.slice(0, 16)}...`);
     }
 
+    // ── Extract ─────────────────────────────────────────────────────────────
     try {
       fs.mkdirSync(extractDir, { recursive: true });
-      const zip = new StreamZip.async({ file: destZipPath });
-      await zip.extract(null, extractDir);
-      await zip.close();
+      await extractZip(destZipPath, extractDir);
+
+      // Write .wyvrn-version (v1 compat)
       fs.writeFileSync(versionFile, version, 'utf8');
-      console.log(`[wyvrn] Extracted: ${name}@${version} → ${extractDir}`);
+
+      // Write .wyvrn-meta.json (v2 extended metadata)
+      const meta = {
+        version,
+        resolvedFrom,
+        profileHash:   downloadResult?.profileHash   ?? null,
+        contentSha256: downloadResult?.contentSha256 ?? null,
+        gitSha:        downloadResult?.gitSha        ?? null,
+        gitRepo:       downloadResult?.gitRepo       ?? null,
+        installedAt:   new Date().toISOString(),
+      };
+      fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2) + '\n', 'utf8');
+
+      console.log(
+        `[wyvrn] Extracted: ${name}@${version}` +
+        (downloadResult?.profileHash ? ` [${downloadResult.profileHash}]` : '') +
+        ` (${resolvedFrom}) → ${extractDir}`,
+      );
+
+      if (downloadResult?.gitSha) {
+        console.log(`[wyvrn]   Source commit : ${downloadResult.gitSha}`);
+        if (downloadResult?.gitRepo) {
+          console.log(`[wyvrn]   Source repo   : ${downloadResult.gitRepo}`);
+        }
+      }
+
+      lockEntries.set(name, {
+        version,
+        resolvedFrom,
+        profileHash:   downloadResult?.profileHash   ?? null,
+        contentSha256: downloadResult?.contentSha256 ?? null,
+        gitSha:        downloadResult?.gitSha        ?? null,
+      });
     } catch (err) {
       console.warn(`[wyvrn] Failed to extract ${name}@${version}: ${err.message}`);
+      lockEntries.set(name, { version, resolvedFrom: 'extract-failed' });
     } finally {
-      // Always remove the zip, even if extraction failed.
-      try {
-        fs.unlinkSync(destZipPath);
-      } catch {
-        // Ignore cleanup errors.
-      }
+      try { fs.unlinkSync(destZipPath); } catch { /* ignore */ }
     }
   }
+
+  return lockEntries;
 }
 
-module.exports = {
-  downloadDependencies,
-};
+module.exports = { downloadDependencies };

package/src/index.js

@@ -1,9 +1,10 @@
 'use strict';
 
 module.exports = {
-  init: require('./commands/init'),
-  install: require('./commands/install'),
-  clean: require('./commands/clean'),
-  publish: require('./commands/publish'),
+  init:      require('./commands/init'),
+  install:   require('./commands/install'),
+  clean:     require('./commands/clean'),
+  publish:   require('./commands/publish'),
   configure: require('./commands/configure'),
+  profile:   require('./commands/profile'),
 };

package/src/link-utils.js

@@ -1,95 +1,95 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-
-/**
- * Creates a symlink/junction from linkPath pointing to targetPath.
- * Uses junctions on Windows (no admin rights required), symlinks on Unix.
- *
- * @param {string} targetPath - The actual directory to link to.
- * @param {string} linkPath - The path where the link will be created.
- */
-function createLink(targetPath, linkPath) {
-  const absoluteTarget = path.resolve(targetPath);
-  const absoluteLink = path.resolve(linkPath);
-
-  // Ensure parent directory exists
-  const parentDir = path.dirname(absoluteLink);
-  if (!fs.existsSync(parentDir)) {
-    fs.mkdirSync(parentDir, { recursive: true });
-  }
-
-  // Remove existing link/directory if present
-  if (fs.existsSync(absoluteLink)) {
-    const stats = fs.lstatSync(absoluteLink);
-    if (stats.isSymbolicLink()) {
-      fs.unlinkSync(absoluteLink);
-    } else {
-      fs.rmSync(absoluteLink, { recursive: true, force: true });
-    }
-  }
-
-  // Use 'junction' on Windows (no admin required), 'dir' on Unix
-  const linkType = process.platform === 'win32' ? 'junction' : 'dir';
-  fs.symlinkSync(absoluteTarget, absoluteLink, linkType);
-}
-
-/**
- * Checks if a path is a symlink or junction.
- *
- * @param {string} linkPath - Path to check.
- * @returns {boolean} True if it's a symlink/junction.
- */
-function isLink(linkPath) {
-  try {
-    const stats = fs.lstatSync(linkPath);
-    return stats.isSymbolicLink();
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Removes a symlink/junction without affecting the target directory.
- *
- * @param {string} linkPath - Path to the symlink/junction to remove.
- * @returns {boolean} True if removed, false if it didn't exist or wasn't a link.
- */
-function removeLink(linkPath) {
-  try {
-    const stats = fs.lstatSync(linkPath);
-    if (stats.isSymbolicLink()) {
-      fs.unlinkSync(linkPath);
-      return true;
-    }
-    return false;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Gets the target path of a symlink/junction.
- *
- * @param {string} linkPath - Path to the symlink/junction.
- * @returns {string|null} The target path, or null if not a link.
- */
-function getLinkTarget(linkPath) {
-  try {
-    const stats = fs.lstatSync(linkPath);
-    if (stats.isSymbolicLink()) {
-      return fs.readlinkSync(linkPath);
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-
-module.exports = {
-  createLink,
-  isLink,
-  removeLink,
-  getLinkTarget,
-};
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Creates a symlink/junction from linkPath pointing to targetPath.
+ * Uses junctions on Windows (no admin rights required), symlinks on Unix.
+ *
+ * @param {string} targetPath - The actual directory to link to.
+ * @param {string} linkPath - The path where the link will be created.
+ */
+function createLink(targetPath, linkPath) {
+  const absoluteTarget = path.resolve(targetPath);
+  const absoluteLink = path.resolve(linkPath);
+
+  // Ensure parent directory exists
+  const parentDir = path.dirname(absoluteLink);
+  if (!fs.existsSync(parentDir)) {
+    fs.mkdirSync(parentDir, { recursive: true });
+  }
+
+  // Remove existing link/directory if present
+  if (fs.existsSync(absoluteLink)) {
+    const stats = fs.lstatSync(absoluteLink);
+    if (stats.isSymbolicLink()) {
+      fs.unlinkSync(absoluteLink);
+    } else {
+      fs.rmSync(absoluteLink, { recursive: true, force: true });
+    }
+  }
+
+  // Use 'junction' on Windows (no admin required), 'dir' on Unix
+  const linkType = process.platform === 'win32' ? 'junction' : 'dir';
+  fs.symlinkSync(absoluteTarget, absoluteLink, linkType);
+}
+
+/**
+ * Checks if a path is a symlink or junction.
+ *
+ * @param {string} linkPath - Path to check.
+ * @returns {boolean} True if it's a symlink/junction.
+ */
+function isLink(linkPath) {
+  try {
+    const stats = fs.lstatSync(linkPath);
+    return stats.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Removes a symlink/junction without affecting the target directory.
+ *
+ * @param {string} linkPath - Path to the symlink/junction to remove.
+ * @returns {boolean} True if removed, false if it didn't exist or wasn't a link.
+ */
+function removeLink(linkPath) {
+  try {
+    const stats = fs.lstatSync(linkPath);
+    if (stats.isSymbolicLink()) {
+      fs.unlinkSync(linkPath);
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Gets the target path of a symlink/junction.
+ *
+ * @param {string} linkPath - Path to the symlink/junction.
+ * @returns {string|null} The target path, or null if not a link.
+ */
+function getLinkTarget(linkPath) {
+  try {
+    const stats = fs.lstatSync(linkPath);
+    if (stats.isSymbolicLink()) {
+      return fs.readlinkSync(linkPath);
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+module.exports = {
+  createLink,
+  isLink,
+  removeLink,
+  getLinkTarget,
+};