wyvrnpm 2.10.2 → 2.12.2

package/src/commands/show.js

@@ -1,252 +1,252 @@
-'use strict';
-
-const { getProvider }  = require('../providers');
-const { buildContext } = require('../context');
-const log              = require('../logger');
-
-/**
- * `wyvrnpm show <pkg>` — surface registry metadata for a package.
- *
- * Accepts:
- *   name                         → list every published version + profile.
- *   name@version                 → list every profile for that version,
- *                                  fetch full metadata for each, highlight
- *                                  consumer (`uploadedBy`) vs author builds.
- *   name@version@profileHash     → dump full metadata for one build.
- *
- * Sources: CLI `--source` overrides config.installSources. First source
- * that returns data wins (same first-match policy as `install`).
- *
- * Added for PLAN-UPLOAD-BUILT phase 3 so maintainers can spot-check which
- * profileHashes were uploaded by consumers vs published by an author. The
- * `uploadedBy` block is the signal; its absence means "author publish"
- * by convention.
- *
- * @param {object} argv
- * @param {string} argv.pkg                         e.g. "zlib", "zlib@1.3.0.0", "zlib@1.3.0.0@a1b2..."
- * @param {string[]} [argv.source]                  source URLs
- * @param {string} [argv.awsProfile]
- * @param {string} [argv.token]
- * @returns {Promise<void>}
- */
-async function show(argv) {
-  const { name, version, profileHash } = parseSpec(argv.pkg);
-  if (!name) {
-    log.error('Usage: wyvrnpm show <name>[@<version>[@<profileHash>]]');
-    process.exit(1);
-  }
-
-  // Shared per-invocation state (config, auth, JSON-mode toggle). `show`
-  // never reads the manifest, which is why ctx.manifest is lazy. See
-  // src/context.js + claude/PLAN-COMMAND-CONTEXT.md.
-  let ctx;
-  try {
-    ctx = buildContext(argv);
-  } catch (err) {
-    log.error(err.message);
-    process.exit(1);
-  }
-  const jsonOut = ctx.flags.format === 'json';
-
-  const { sources, awsProfile, token } = resolveSources(argv, ctx);
-  if (sources.length === 0) {
-    log.error(
-      'no sources configured. ' +
-      'Pass --source <url> or run: wyvrnpm configure add-source --kind install ...',
-    );
-    process.exit(1);
-  }
-
-  for (const source of sources) {
-    let provider;
-    try { provider = getProvider(source); } catch { continue; }
-
-    const idx = await provider.v2GetVersionsIndex({ source, name, awsProfile, token });
-    if (!idx?.versions) continue;
-
-    const versionKeys = version
-      ? (idx.versions[version] ? [version] : [])
-      : Object.keys(idx.versions).sort();
-
-    if (version && versionKeys.length === 0) {
-      log.error(`Version ${version} not found on ${source}`);
-      process.exit(1);
-    }
-
-    // Collect a single structured result as we walk. Text rendering happens
-    // inline in the legacy path; JSON mode emits the whole object at the
-    // end of the first source that answered.
-    const result = {
-      command:        'show',
-      wyvrnpmVersion: require('../../package.json').version,
-      source,
-      package:        name,
-      latest:         idx.latest ?? null,
-      versions:       {},
-    };
-
-    if (!jsonOut) {
-      console.log(`${name}  (source: ${source})`);
-      if (idx.latest) console.log(`  latest: ${idx.latest}`);
-    }
-
-    for (const v of versionKeys) {
-      const ventry = idx.versions[v];
-      const profiles = ventry?.profiles ?? {};
-      const profileKeys = profileHash
-        ? (profiles[profileHash] ? [profileHash] : [])
-        : Object.keys(profiles).sort();
-
-      if (profileHash && profileKeys.length === 0) {
-        log.error(`ProfileHash ${profileHash} not found for ${name}@${v}`);
-        process.exit(1);
-      }
-
-      if (!jsonOut) {
-        console.log(`\n  ${name}@${v}  (${profileKeys.length} profile${profileKeys.length === 1 ? '' : 's'})`);
-        if (ventry.source?.gitSha) {
-          console.log(`    git: ${ventry.source.gitRepo ?? '?'} @ ${ventry.source.gitSha}`);
-        }
-      }
-
-      // For bare `name` queries we'd fetch O(M×N) manifests (versions ×
-      // profiles) — too noisy. Only deep-fetch when the user has narrowed
-      // to a specific version.
-      const deepFetch = Boolean(version);
-
-      const profileArr = [];
-      for (const hash of profileKeys) {
-        const entry = profiles[hash];
-        if (!jsonOut) {
-          console.log(`\n    [${hash}]`);
-          if (entry.buildSettings) {
-            console.log(`      profile : ${formatBuildSettings(entry.buildSettings)}`);
-            if (entry.buildSettings.options && Object.keys(entry.buildSettings.options).length > 0) {
-              console.log(`      options : ${formatOptions(entry.buildSettings.options)}`);
-            }
-          }
-          console.log(`      sha256  : ${entry.contentSha256 ?? '?'}`);
-          if (entry.publishedAt) console.log(`      published: ${entry.publishedAt}`);
-        }
-
-        let meta = null;
-        if (deepFetch) {
-          meta = await provider.v2GetMeta({
-            source, name, version: v, profileHash: hash, awsProfile, token,
-          });
-          if (!jsonOut) {
-            if (meta?.uploadedBy) {
-              console.log(`      origin  : consumer upload (${meta.uploadedBy.kind})`);
-              console.log(`                uploadedAt     : ${meta.uploadedBy.uploadedAt}`);
-              console.log(`                wyvrnpmVersion : ${meta.uploadedBy.wyvrnpmVersion ?? '?'}`);
-              if (meta.uploadedBy.builtFromGit) {
-                console.log(`                builtFromGit   : ${meta.uploadedBy.builtFromGit}`);
-              }
-              if (meta.uploadedBy.builtFromSha) {
-                console.log(`                builtFromSha   : ${meta.uploadedBy.builtFromSha}`);
-              }
-            } else if (meta) {
-              console.log(`      origin  : author publish`);
-            }
-            if (meta?.compatibility) {
-              console.log(`      compat  : ${JSON.stringify(meta.compatibility)}`);
-            }
-            if (meta?.options && Object.keys(meta.options).length > 0) {
-              console.log(`      declared: ${formatDeclaredOptions(meta.options)}`);
-            }
-            // PLAN-CONF.md §4.6 — surface publisher's publishedConf.
-            // Informational only; absent for pre-2.6.0 author publishes.
-            if (meta?.publishedConf && Object.keys(meta.publishedConf).length > 0) {
-              console.log(`      conf    : ${JSON.stringify(meta.publishedConf)}`);
-            }
-          }
-        }
-
-        profileArr.push({
-          profileHash:     hash,
-          contentSha256:   entry.contentSha256 ?? null,
-          publishedAt:     entry.publishedAt   ?? null,
-          buildSettings:   entry.buildSettings ?? null,
-          origin:          meta?.uploadedBy ? 'consumer-source-build' : (meta ? 'author-publish' : null),
-          uploadedBy:      meta?.uploadedBy    ?? null,
-          compatibility:   meta?.compatibility ?? null,
-          declaredOptions: meta?.options       ?? null,
-          publishedConf:   meta?.publishedConf ?? null,
-        });
-      }
-
-      result.versions[v] = {
-        source:   ventry.source ?? null,
-        profiles: profileArr,
-      };
-    }
-
-    if (jsonOut) {
-      process.stdout.write(JSON.stringify(result, null, 2) + '\n');
-    }
-    return;
-  }
-
-  log.error(`Package ${name} not found in any configured source`);
-  process.exit(1);
-}
-
-/**
- * Parse a package spec "name[@version[@profileHash]]".
- * @param {string} spec
- * @returns {{ name?: string, version?: string, profileHash?: string }}
- */
-function parseSpec(spec) {
-  if (!spec || typeof spec !== 'string') return {};
-  const parts = spec.split('@');
-  const [name, version, profileHash] = parts;
-  return {
-    name:        name || undefined,
-    version:     version || undefined,
-    profileHash: profileHash || undefined,
-  };
-}
-
-function resolveSources(argv, ctx) {
-  const { config } = ctx;
-  const sources = (argv.source && argv.source.length > 0)
-    ? argv.source
-    : config.installSources.map((s) => s.url);
-
-  const firstConfig = config.installSources?.[0];
-  return {
-    sources,
-    awsProfile: argv.awsProfile ?? firstConfig?.profile,
-    token:      ctx.auth.for(firstConfig).token,
-  };
-}
-
-function formatBuildSettings(bs) {
-  const parts = [
-    `${bs.os}/${bs.arch}`,
-    `${bs.compiler} ${bs['compiler.version']}`,
-    `C++${bs['compiler.cppstd']}`,
-  ];
-  if (bs['compiler.runtime']) parts.push(`[${bs['compiler.runtime']}]`);
-  return parts.join('  ');
-}
-
-function formatOptions(options) {
-  return Object.entries(options)
-    .sort(([a], [b]) => a.localeCompare(b))
-    .map(([k, v]) => `${k}=${typeof v === 'string' ? v : String(v)}`)
-    .join(', ');
-}
-
-function formatDeclaredOptions(declared) {
-  return Object.entries(declared)
-    .sort(([a], [b]) => a.localeCompare(b))
-    .map(([name, spec]) => {
-      const allowed = Array.isArray(spec?.allowed) ? spec.allowed : [];
-      return `${name} (default=${String(spec?.default)}, allowed=${allowed.map(String).join('|')})`;
-    })
-    .join('; ');
-}
-
-module.exports = show;
-module.exports.parseSpec = parseSpec;
+'use strict';
+
+const { getProvider }  = require('../providers');
+const { buildContext } = require('../context');
+const log              = require('../logger');
+
+/**
+ * `wyvrnpm show <pkg>` — surface registry metadata for a package.
+ *
+ * Accepts:
+ *   name                         → list every published version + profile.
+ *   name@version                 → list every profile for that version,
+ *                                  fetch full metadata for each, highlight
+ *                                  consumer (`uploadedBy`) vs author builds.
+ *   name@version@profileHash     → dump full metadata for one build.
+ *
+ * Sources: CLI `--source` overrides config.installSources. First source
+ * that returns data wins (same first-match policy as `install`).
+ *
+ * Added for PLAN-UPLOAD-BUILT phase 3 so maintainers can spot-check which
+ * profileHashes were uploaded by consumers vs published by an author. The
+ * `uploadedBy` block is the signal; its absence means "author publish"
+ * by convention.
+ *
+ * @param {object} argv
+ * @param {string} argv.pkg                         e.g. "zlib", "zlib@1.3.0.0", "zlib@1.3.0.0@a1b2..."
+ * @param {string[]} [argv.source]                  source URLs
+ * @param {string} [argv.awsProfile]
+ * @param {string} [argv.token]
+ * @returns {Promise<void>}
+ */
+async function show(argv) {
+  const { name, version, profileHash } = parseSpec(argv.pkg);
+  if (!name) {
+    log.error('Usage: wyvrnpm show <name>[@<version>[@<profileHash>]]');
+    process.exit(1);
+  }
+
+  // Shared per-invocation state (config, auth, JSON-mode toggle). `show`
+  // never reads the manifest, which is why ctx.manifest is lazy. See
+  // src/context.js + claude/PLAN-COMMAND-CONTEXT.md.
+  let ctx;
+  try {
+    ctx = buildContext(argv);
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
+  }
+  const jsonOut = ctx.flags.format === 'json';
+
+  const { sources, awsProfile, token } = resolveSources(argv, ctx);
+  if (sources.length === 0) {
+    log.error(
+      'no sources configured. ' +
+      'Pass --source <url> or run: wyvrnpm configure add-source --kind install ...',
+    );
+    process.exit(1);
+  }
+
+  for (const source of sources) {
+    let provider;
+    try { provider = getProvider(source); } catch { continue; }
+
+    const idx = await provider.v2GetVersionsIndex({ source, name, awsProfile, token });
+    if (!idx?.versions) continue;
+
+    const versionKeys = version
+      ? (idx.versions[version] ? [version] : [])
+      : Object.keys(idx.versions).sort();
+
+    if (version && versionKeys.length === 0) {
+      log.error(`Version ${version} not found on ${source}`);
+      process.exit(1);
+    }
+
+    // Collect a single structured result as we walk. Text rendering happens
+    // inline in the legacy path; JSON mode emits the whole object at the
+    // end of the first source that answered.
+    const result = {
+      command:        'show',
+      wyvrnpmVersion: require('../../package.json').version,
+      source,
+      package:        name,
+      latest:         idx.latest ?? null,
+      versions:       {},
+    };
+
+    if (!jsonOut) {
+      console.log(`${name}  (source: ${source})`);
+      if (idx.latest) console.log(`  latest: ${idx.latest}`);
+    }
+
+    for (const v of versionKeys) {
+      const ventry = idx.versions[v];
+      const profiles = ventry?.profiles ?? {};
+      const profileKeys = profileHash
+        ? (profiles[profileHash] ? [profileHash] : [])
+        : Object.keys(profiles).sort();
+
+      if (profileHash && profileKeys.length === 0) {
+        log.error(`ProfileHash ${profileHash} not found for ${name}@${v}`);
+        process.exit(1);
+      }
+
+      if (!jsonOut) {
+        console.log(`\n  ${name}@${v}  (${profileKeys.length} profile${profileKeys.length === 1 ? '' : 's'})`);
+        if (ventry.source?.gitSha) {
+          console.log(`    git: ${ventry.source.gitRepo ?? '?'} @ ${ventry.source.gitSha}`);
+        }
+      }
+
+      // For bare `name` queries we'd fetch O(M×N) manifests (versions ×
+      // profiles) — too noisy. Only deep-fetch when the user has narrowed
+      // to a specific version.
+      const deepFetch = Boolean(version);
+
+      const profileArr = [];
+      for (const hash of profileKeys) {
+        const entry = profiles[hash];
+        if (!jsonOut) {
+          console.log(`\n    [${hash}]`);
+          if (entry.buildSettings) {
+            console.log(`      profile : ${formatBuildSettings(entry.buildSettings)}`);
+            if (entry.buildSettings.options && Object.keys(entry.buildSettings.options).length > 0) {
+              console.log(`      options : ${formatOptions(entry.buildSettings.options)}`);
+            }
+          }
+          console.log(`      sha256  : ${entry.contentSha256 ?? '?'}`);
+          if (entry.publishedAt) console.log(`      published: ${entry.publishedAt}`);
+        }
+
+        let meta = null;
+        if (deepFetch) {
+          meta = await provider.v2GetMeta({
+            source, name, version: v, profileHash: hash, awsProfile, token,
+          });
+          if (!jsonOut) {
+            if (meta?.uploadedBy) {
+              console.log(`      origin  : consumer upload (${meta.uploadedBy.kind})`);
+              console.log(`                uploadedAt     : ${meta.uploadedBy.uploadedAt}`);
+              console.log(`                wyvrnpmVersion : ${meta.uploadedBy.wyvrnpmVersion ?? '?'}`);
+              if (meta.uploadedBy.builtFromGit) {
+                console.log(`                builtFromGit   : ${meta.uploadedBy.builtFromGit}`);
+              }
+              if (meta.uploadedBy.builtFromSha) {
+                console.log(`                builtFromSha   : ${meta.uploadedBy.builtFromSha}`);
+              }
+            } else if (meta) {
+              console.log(`      origin  : author publish`);
+            }
+            if (meta?.compatibility) {
+              console.log(`      compat  : ${JSON.stringify(meta.compatibility)}`);
+            }
+            if (meta?.options && Object.keys(meta.options).length > 0) {
+              console.log(`      declared: ${formatDeclaredOptions(meta.options)}`);
+            }
+            // PLAN-CONF.md §4.6 — surface publisher's publishedConf.
+            // Informational only; absent for pre-2.6.0 author publishes.
+            if (meta?.publishedConf && Object.keys(meta.publishedConf).length > 0) {
+              console.log(`      conf    : ${JSON.stringify(meta.publishedConf)}`);
+            }
+          }
+        }
+
+        profileArr.push({
+          profileHash:     hash,
+          contentSha256:   entry.contentSha256 ?? null,
+          publishedAt:     entry.publishedAt   ?? null,
+          buildSettings:   entry.buildSettings ?? null,
+          origin:          meta?.uploadedBy ? 'consumer-source-build' : (meta ? 'author-publish' : null),
+          uploadedBy:      meta?.uploadedBy    ?? null,
+          compatibility:   meta?.compatibility ?? null,
+          declaredOptions: meta?.options       ?? null,
+          publishedConf:   meta?.publishedConf ?? null,
+        });
+      }
+
+      result.versions[v] = {
+        source:   ventry.source ?? null,
+        profiles: profileArr,
+      };
+    }
+
+    if (jsonOut) {
+      process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+    }
+    return;
+  }
+
+  log.error(`Package ${name} not found in any configured source`);
+  process.exit(1);
+}
+
+/**
+ * Parse a package spec "name[@version[@profileHash]]".
+ * @param {string} spec
+ * @returns {{ name?: string, version?: string, profileHash?: string }}
+ */
+function parseSpec(spec) {
+  if (!spec || typeof spec !== 'string') return {};
+  const parts = spec.split('@');
+  const [name, version, profileHash] = parts;
+  return {
+    name:        name || undefined,
+    version:     version || undefined,
+    profileHash: profileHash || undefined,
+  };
+}
+
+function resolveSources(argv, ctx) {
+  const { config } = ctx;
+  const sources = (argv.source && argv.source.length > 0)
+    ? argv.source
+    : config.installSources.map((s) => s.url);
+
+  const firstConfig = config.installSources?.[0];
+  return {
+    sources,
+    awsProfile: argv.awsProfile ?? firstConfig?.profile,
+    token:      ctx.auth.for(firstConfig).token,
+  };
+}
+
+function formatBuildSettings(bs) {
+  const parts = [
+    `${bs.os}/${bs.arch}`,
+    `${bs.compiler} ${bs['compiler.version']}`,
+    `C++${bs['compiler.cppstd']}`,
+  ];
+  if (bs['compiler.runtime']) parts.push(`[${bs['compiler.runtime']}]`);
+  return parts.join('  ');
+}
+
+function formatOptions(options) {
+  return Object.entries(options)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([k, v]) => `${k}=${typeof v === 'string' ? v : String(v)}`)
+    .join(', ');
+}
+
+function formatDeclaredOptions(declared) {
+  return Object.entries(declared)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([name, spec]) => {
+      const allowed = Array.isArray(spec?.allowed) ? spec.allowed : [];
+      return `${name} (default=${String(spec?.default)}, allowed=${allowed.map(String).join('|')})`;
+    })
+    .join('; ');
+}
+
+module.exports = show;
+module.exports.parseSpec = parseSpec;