wyvrnpm 1.3.2 → 2.0.2

package/src/providers/file.js

@@ -15,6 +15,22 @@ const BaseProvider = require('./base');
  *   //server/share/path                 (SMB UNC — forward slash)
  *   file:///path                        (file URI)
  */
+function pinDependencies(rawDeps, lockedDeps) {
+  if (!rawDeps || !lockedDeps || Object.keys(lockedDeps).length === 0) return rawDeps;
+  const result = {};
+  for (const [pkgName, value] of Object.entries(rawDeps)) {
+    const locked = lockedDeps[pkgName];
+    if (locked) {
+      result[pkgName] = typeof value === 'object' && value !== null
+        ? { ...value, version: locked }
+        : locked;
+    } else {
+      result[pkgName] = value;
+    }
+  }
+  return result;
+}
+
 class FileProvider extends BaseProvider {
   static canHandle(source) {
     return (
@@ -24,7 +40,7 @@ class FileProvider extends BaseProvider {
       source.startsWith('/') ||
       source.startsWith('./') ||
       source.startsWith('../') ||
-      /^[a-zA-Z]:[/\\]/.test(source) // Windows drive letter
+      /^[a-zA-Z]:[/\\]/.test(source)
     );
   }
 
@@ -32,7 +48,6 @@ class FileProvider extends BaseProvider {
     return 'File';
   }
 
-  /** Normalise a source string to an absolute file system path. */
   _resolvePath(source) {
     if (source.startsWith('file://')) {
       return path.resolve(new URL(source).pathname);
@@ -40,31 +55,126 @@ class FileProvider extends BaseProvider {
     return path.resolve(source);
   }
 
-  async exists(options) {
-    const { source, platform, name, version } = options;
+  _copy(src, dest) {
+    console.log(`[wyvrn]   → ${dest}`);
+    fs.copyFileSync(src, dest);
+  }
+
+  _writeJson(filePath, data) {
+    console.log(`[wyvrn]   → ${filePath}`);
+    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf8');
+  }
+
+  _readJson(filePath) {
+    if (!fs.existsSync(filePath)) return null;
+    try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); }
+    catch { return null; }
+  }
+
+  // ── v1 (legacy) API ───────────────────────────────────────────────────────
+
+  async exists({ source, platform, name, version }) {
     const destDir = path.join(this._resolvePath(source), platform, name, version);
     return fs.existsSync(path.join(destDir, 'wyvrn.json'));
   }
 
-  async publish(files, options) {
-    const { source, platform, name, version } = options;
-
+  async publish(files, { source, platform, name, version }) {
     const packageDir = path.join(this._resolvePath(source), platform, name);
-    const destDir = path.join(packageDir, version);
+    const destDir    = path.join(packageDir, version);
     fs.mkdirSync(destDir, { recursive: true });
 
     this._copy(files.manifest, path.join(destDir, 'wyvrn.json'));
-    this._copy(files.zip, path.join(destDir, 'wyvrn.zip'));
+    this._copy(files.zip,      path.join(destDir, 'wyvrn.zip'));
 
-    // Write latest.json at the package root so consumers can resolve "latest"
     const latestPath = path.join(packageDir, 'latest.json');
     console.log(`[wyvrn]   → ${latestPath}`);
     fs.writeFileSync(latestPath, JSON.stringify({ version }), 'utf8');
   }
 
-  _copy(src, dest) {
-    console.log(`[wyvrn]   → ${dest}`);
-    fs.copyFileSync(src, dest);
+  // ── v2 API ────────────────────────────────────────────────────────────────
+
+  _v2Root(source, name) {
+    return path.join(this._resolvePath(source), 'v2', name);
+  }
+
+  async v2Exists({ source, name, version, profileHash }) {
+    const p = path.join(this._v2Root(source, name), version, profileHash, 'wyvrn.json');
+    return fs.existsSync(p);
+  }
+
+  async v2Publish(files, options) {
+    const {
+      source, name, version, profileHash, buildSettings,
+      contentSha256, gitSha, gitRepo, lockedDependencies,
+    } = options;
+
+    const v2root    = this._v2Root(source, name);
+    const buildDir  = path.join(v2root, version, profileHash);
+    fs.mkdirSync(buildDir, { recursive: true });
+
+    // 1) zip
+    this._copy(files.zip, path.join(buildDir, 'wyvrn.zip'));
+
+    // 2) enriched wyvrn.json (buildSettings stored for debugging only)
+    //    Dependencies are replaced with locked versions so the server never sees "latest".
+    const rawManifest = JSON.parse(fs.readFileSync(files.manifest, 'utf8'));
+    const pinnedDeps = pinDependencies(rawManifest.dependencies, lockedDependencies);
+    const v2Meta = {
+      ...rawManifest,
+      ...(pinnedDeps !== undefined ? { dependencies: pinnedDeps } : {}),
+      schemaVersion: 2,
+      profileHash,
+      buildSettings,
+      contentSha256,
+      gitSha:      gitSha  ?? null,
+      gitRepo:     gitRepo ?? null,
+      publishedAt: new Date().toISOString(),
+    };
+    this._writeJson(path.join(buildDir, 'wyvrn.json'), v2Meta);
+
+    // 3) source.json
+    if (gitSha || gitRepo) {
+      const versionDir = path.join(v2root, version);
+      fs.mkdirSync(versionDir, { recursive: true });
+      this._writeJson(path.join(versionDir, 'source.json'), {
+        gitRepo: gitRepo ?? null, gitSha: gitSha ?? null,
+      });
+    }
+
+    // 4) versions.json index
+    const versionsPath = path.join(v2root, 'versions.json');
+    let versionsIdx = this._readJson(versionsPath) ?? { name, latest: version, versions: {} };
+    if (!versionsIdx.versions) versionsIdx.versions = {};
+    if (!versionsIdx.versions[version]) versionsIdx.versions[version] = { profiles: {} };
+    versionsIdx.versions[version].profiles[profileHash] = {
+      contentSha256,
+      publishedAt: new Date().toISOString(),
+      buildSettings,
+    };
+    if (gitSha || gitRepo) {
+      versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
+    }
+    versionsIdx.latest = version;
+    this._writeJson(versionsPath, versionsIdx);
+
+    // 5) v2 latest.json
+    this._writeJson(path.join(v2root, 'latest.json'), { version, profileHash, contentSha256 });
+  }
+
+  async v2GetMeta({ source, name, version, profileHash }) {
+    const p = path.join(this._v2Root(source, name), version, profileHash, 'wyvrn.json');
+    return this._readJson(p);
+  }
+
+  async v2GetVersionsIndex({ source, name }) {
+    return this._readJson(path.join(this._v2Root(source, name), 'versions.json'));
+  }
+
+  async v2DownloadZip({ source, name, version, profileHash }, destPath) {
+    const src = path.join(this._v2Root(source, name), version, profileHash, 'wyvrn.zip');
+    if (!fs.existsSync(src)) return false;
+    fs.copyFileSync(src, destPath);
+    return true;
   }
 }
 

package/src/providers/http.js

@@ -3,8 +3,26 @@
 const fs = require('fs');
 const http = require('http');
 const https = require('https');
+const { pipeline } = require('stream/promises');
+const { Readable } = require('stream');
 const BaseProvider = require('./base');
 
+function pinDependencies(rawDeps, lockedDeps) {
+  if (!rawDeps || !lockedDeps || Object.keys(lockedDeps).length === 0) return rawDeps;
+  const result = {};
+  for (const [pkgName, value] of Object.entries(rawDeps)) {
+    const locked = lockedDeps[pkgName];
+    if (locked) {
+      result[pkgName] = typeof value === 'object' && value !== null
+        ? { ...value, version: locked }
+        : locked;
+    } else {
+      result[pkgName] = value;
+    }
+  }
+  return result;
+}
+
 class HttpProvider extends BaseProvider {
   static canHandle(source) {
     return /^https?:\/\//.test(source);
@@ -14,63 +32,26 @@ class HttpProvider extends BaseProvider {
     return 'HTTP';
   }
 
-  async exists(options) {
-    const { source, platform, name, version } = options;
-    const base = source.replace(/\/$/, '');
-    const url = `${base}/${platform}/${name}/${version}/wyvrn.json`;
-    return new Promise((resolve, reject) => {
-      const parsed = new URL(url);
-      const lib = parsed.protocol === 'https:' ? https : http;
-      const req = lib.request(
-        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'HEAD' },
-        (res) => { res.resume(); resolve(res.statusCode >= 200 && res.statusCode < 300); },
-      );
-      req.on('error', reject);
-      req.end();
-    });
-  }
-
-  async publish(files, options) {
-    const { source, platform, name, version, token } = options;
-    const base = source.replace(/\/$/, '');
-    const urlBase = `${base}/${platform}/${name}/${version}`;
-    const packageBase = `${base}/${platform}/${name}`;
-
-    await this._put(`${urlBase}/wyvrn.json`, files.manifest, 'application/json', token);
-    await this._put(`${urlBase}/wyvrn.zip`, files.zip, 'application/zip', token);
+  // ── helpers ──────────────────────────────────────────────────────────────
 
-    // Write latest.json at the package root so consumers can resolve "latest"
-    await this._putBuffer(`${packageBase}/latest.json`, Buffer.from(JSON.stringify({ version })), 'application/json', token);
+  _lib(url) {
+    return url.startsWith('https') ? https : http;
   }
 
+  /** PUT a file from disk to url. */
   _put(url, filePath, contentType, token) {
     return new Promise((resolve, reject) => {
       const body = fs.readFileSync(filePath);
       const parsed = new URL(url);
-      const lib = parsed.protocol === 'https:' ? https : http;
-
-      const headers = {
-        'Content-Type': contentType,
-        'Content-Length': body.length,
-      };
+      const headers = { 'Content-Type': contentType, 'Content-Length': body.length };
       if (token) headers['Authorization'] = `Bearer ${token}`;
-
       console.log(`[wyvrn]   → PUT ${url}`);
-      const req = lib.request(
-        {
-          hostname: parsed.hostname,
-          port: parsed.port || undefined,
-          path: parsed.pathname,
-          method: 'PUT',
-          headers,
-        },
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'PUT', headers },
         (res) => {
-          res.resume(); // drain the response
-          if (res.statusCode >= 200 && res.statusCode < 300) {
-            resolve();
-          } else {
-            reject(new Error(`HTTP PUT ${url} failed: ${res.statusCode} ${res.statusMessage}`));
-          }
+          res.resume();
+          if (res.statusCode >= 200 && res.statusCode < 300) resolve();
+          else reject(new Error(`HTTP PUT ${url} failed: ${res.statusCode}`));
         },
       );
       req.on('error', reject);
@@ -79,33 +60,19 @@ class HttpProvider extends BaseProvider {
     });
   }
 
+  /** PUT a Buffer to url. */
   _putBuffer(url, buffer, contentType, token) {
     return new Promise((resolve, reject) => {
       const parsed = new URL(url);
-      const lib = parsed.protocol === 'https:' ? https : http;
-
-      const headers = {
-        'Content-Type': contentType,
-        'Content-Length': buffer.length,
-      };
+      const headers = { 'Content-Type': contentType, 'Content-Length': buffer.length };
       if (token) headers['Authorization'] = `Bearer ${token}`;
-
       console.log(`[wyvrn]   → PUT ${url}`);
-      const req = lib.request(
-        {
-          hostname: parsed.hostname,
-          port: parsed.port || undefined,
-          path: parsed.pathname,
-          method: 'PUT',
-          headers,
-        },
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'PUT', headers },
         (res) => {
           res.resume();
-          if (res.statusCode >= 200 && res.statusCode < 300) {
-            resolve();
-          } else {
-            reject(new Error(`HTTP PUT ${url} failed: ${res.statusCode} ${res.statusMessage}`));
-          }
+          if (res.statusCode >= 200 && res.statusCode < 300) resolve();
+          else reject(new Error(`HTTP PUT ${url} failed: ${res.statusCode}`));
         },
       );
       req.on('error', reject);
@@ -113,6 +80,189 @@ class HttpProvider extends BaseProvider {
       req.end();
     });
   }
+
+  /** HEAD check — returns true on 2xx. */
+  _head(url, token) {
+    return new Promise((resolve, reject) => {
+      const parsed = new URL(url);
+      const headers = {};
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'HEAD', headers },
+        (res) => { res.resume(); resolve(res.statusCode >= 200 && res.statusCode < 300); },
+      );
+      req.on('error', reject);
+      req.end();
+    });
+  }
+
+  /**
+   * GET url → parsed JSON, or null on 404 / error.
+   * @returns {Promise<object|null>}
+   */
+  _getJson(url, token) {
+    return new Promise((resolve) => {
+      const parsed = new URL(url);
+      const headers = { Accept: 'application/json' };
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'GET', headers },
+        (res) => {
+          if (res.statusCode === 404) { res.resume(); resolve(null); return; }
+          if (res.statusCode < 200 || res.statusCode >= 300) { res.resume(); resolve(null); return; }
+          const chunks = [];
+          res.on('data', (c) => chunks.push(c));
+          res.on('end', () => {
+            try { resolve(JSON.parse(Buffer.concat(chunks).toString('utf8'))); }
+            catch { resolve(null); }
+          });
+        },
+      );
+      req.on('error', () => resolve(null));
+      req.end();
+    });
+  }
+
+  /** GET url → stream download to destPath. Returns true on success. */
+  async _download(url, destPath, token, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs ?? 300_000);
+    try {
+      const headers = {};
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      const response = await fetch(url, { signal: controller.signal, headers });
+      if (!response.ok) return false;
+      const fileStream = fs.createWriteStream(destPath);
+      await pipeline(Readable.fromWeb(response.body), fileStream);
+      return true;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  // ── v1 (legacy) API ───────────────────────────────────────────────────────
+
+  async exists({ source, platform, name, version, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._head(`${base}/${platform}/${name}/${version}/wyvrn.json`, token);
+  }
+
+  async publish(files, { source, platform, name, version, token }) {
+    const base = source.replace(/\/$/, '');
+    const urlBase    = `${base}/${platform}/${name}/${version}`;
+    const packageBase = `${base}/${platform}/${name}`;
+
+    await this._put(`${urlBase}/wyvrn.json`, files.manifest, 'application/json', token);
+    await this._put(`${urlBase}/wyvrn.zip`,  files.zip,      'application/zip',  token);
+    await this._putBuffer(
+      `${packageBase}/latest.json`,
+      Buffer.from(JSON.stringify({ version })),
+      'application/json',
+      token,
+    );
+  }
+
+  // ── v2 API ────────────────────────────────────────────────────────────────
+
+  async v2Exists({ source, name, version, profileHash, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._head(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.json`, token);
+  }
+
+  async v2Publish(files, options) {
+    const {
+      source, name, version, profileHash, buildSettings,
+      contentSha256, gitSha, gitRepo, lockedDependencies, token,
+    } = options;
+    const base   = source.replace(/\/$/, '');
+    const v2root = `${base}/v2/${name}`;
+    const buildRoot = `${v2root}/${version}/${profileHash}`;
+
+    // 1) Upload the binary zip
+    await this._put(`${buildRoot}/wyvrn.zip`, files.zip, 'application/zip', token);
+
+    // 2) Upload enriched wyvrn.json (original manifest + v2 metadata)
+    //    buildSettings is stored for debugging purposes only — not for configuration.
+    //    Dependencies are replaced with locked versions so the server never sees "latest".
+    const rawManifest = JSON.parse(fs.readFileSync(files.manifest, 'utf8'));
+    const pinnedDeps = pinDependencies(rawManifest.dependencies, lockedDependencies);
+    const v2Meta = {
+      ...rawManifest,
+      ...(pinnedDeps !== undefined ? { dependencies: pinnedDeps } : {}),
+      schemaVersion: 2,
+      profileHash,
+      buildSettings,     // copy of the profile used — for debugging
+      contentSha256,
+      gitSha:      gitSha  ?? null,
+      gitRepo:     gitRepo ?? null,
+      publishedAt: new Date().toISOString(),
+    };
+    await this._putBuffer(
+      `${buildRoot}/wyvrn.json`,
+      Buffer.from(JSON.stringify(v2Meta, null, 2)),
+      'application/json',
+      token,
+    );
+
+    // 3) Upload source.json (git metadata for build-from-source)
+    if (gitSha || gitRepo) {
+      const srcMeta = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
+      await this._putBuffer(
+        `${v2root}/${version}/source.json`,
+        Buffer.from(JSON.stringify(srcMeta, null, 2)),
+        'application/json',
+        token,
+      );
+    }
+
+    // 4) Read-modify-write versions.json index (non-atomic, best-effort)
+    let versionsIdx = await this._getJson(`${v2root}/versions.json`, token) ?? {
+      name, latest: version, versions: {},
+    };
+    if (!versionsIdx.versions) versionsIdx.versions = {};
+    if (!versionsIdx.versions[version]) versionsIdx.versions[version] = { profiles: {} };
+    versionsIdx.versions[version].profiles[profileHash] = {
+      contentSha256,
+      publishedAt: new Date().toISOString(),
+      buildSettings,
+    };
+    if (gitSha || gitRepo) {
+      versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
+    }
+    versionsIdx.latest = version;
+    await this._putBuffer(
+      `${v2root}/versions.json`,
+      Buffer.from(JSON.stringify(versionsIdx, null, 2)),
+      'application/json',
+      token,
+    );
+
+    // 5) Update v2 latest.json
+    await this._putBuffer(
+      `${v2root}/latest.json`,
+      Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+      'application/json',
+      token,
+    );
+  }
+
+  async v2GetMeta({ source, name, version, profileHash, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._getJson(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.json`, token);
+  }
+
+  async v2GetVersionsIndex({ source, name, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._getJson(`${base}/v2/${name}/versions.json`, token);
+  }
+
+  async v2DownloadZip({ source, name, version, profileHash, token }, destPath, timeoutMs) {
+    const base = source.replace(/\/$/, '');
+    const url  = `${base}/v2/${name}/${version}/${profileHash}/wyvrn.zip`;
+    return this._download(url, destPath, token, timeoutMs);
+  }
 }
 
 module.exports = HttpProvider;

package/src/providers/index.js

@@ -1,43 +1,43 @@
-'use strict';
-
-const S3Provider = require('./s3');
-const HttpProvider = require('./http');
-const FileProvider = require('./file');
-
-/**
- * Ordered list of providers. Detection runs top-to-bottom; first match wins.
- * Add new providers here (or call registerProvider() at runtime).
- */
-const PROVIDERS = [
-  S3Provider,   // must come before HttpProvider — S3 HTTPS URLs also match http://
-  HttpProvider,
-  FileProvider, // local paths and SMB UNC shares (\\server\share or //server/share)
-];
-
-/**
- * Return an instantiated provider that can handle the given source string.
- * @param {string} source
- * @returns {import('./base')}
- */
-function getProvider(source) {
-  for (const Provider of PROVIDERS) {
-    if (Provider.canHandle(source)) {
-      return new Provider();
-    }
-  }
-  throw new Error(
-    `No provider found for source: "${source}"\n` +
-      'Supported schemes: s3://, http://, https://, file://, local path, \\\\server\\share (SMB)',
-  );
-}
-
-/**
- * Register a custom provider at the front of the detection list
- * (giving it higher priority than built-ins).
- * @param {typeof import('./base')} Provider
- */
-function registerProvider(Provider) {
-  PROVIDERS.unshift(Provider);
-}
-
-module.exports = { getProvider, registerProvider, PROVIDERS };
+'use strict';
+
+const S3Provider = require('./s3');
+const HttpProvider = require('./http');
+const FileProvider = require('./file');
+
+/**
+ * Ordered list of providers. Detection runs top-to-bottom; first match wins.
+ * Add new providers here (or call registerProvider() at runtime).
+ */
+const PROVIDERS = [
+  S3Provider,   // must come before HttpProvider — S3 HTTPS URLs also match http://
+  HttpProvider,
+  FileProvider, // local paths and SMB UNC shares (\\server\share or //server/share)
+];
+
+/**
+ * Return an instantiated provider that can handle the given source string.
+ * @param {string} source
+ * @returns {import('./base')}
+ */
+function getProvider(source) {
+  for (const Provider of PROVIDERS) {
+    if (Provider.canHandle(source)) {
+      return new Provider();
+    }
+  }
+  throw new Error(
+    `No provider found for source: "${source}"\n` +
+      'Supported schemes: s3://, http://, https://, file://, local path, \\\\server\\share (SMB)',
+  );
+}
+
+/**
+ * Register a custom provider at the front of the detection list
+ * (giving it higher priority than built-ins).
+ * @param {typeof import('./base')} Provider
+ */
+function registerProvider(Provider) {
+  PROVIDERS.unshift(Provider);
+}
+
+module.exports = { getProvider, registerProvider, PROVIDERS };