wyvrnpm 2.10.2 → 2.12.2

package/src/http-fetch.js

@@ -1,53 +1,53 @@
-'use strict';
-
-// Shared `fetch` wrapper used by every resolver / downloader call site.
-//
-// 2.8.3 shipped with a split between the HTTP provider (which uses
-// node:https directly and sends `User-Agent: wyvrnpm/<ver>` + no
-// `Accept-Encoding`) and the resolver (which used the bare global
-// `fetch` — undici — defaulting to `Accept-Encoding: gzip, deflate,
-// br`). CloudFront caches a **separate entry per response encoding**,
-// so a `versions.json` freshly updated at origin could be stale in the
-// Brotli cache bucket for up to the full TTL while the identity bucket
-// served fresh bytes. The provider calls (show) happened to land in
-// the identity bucket (fresh); the resolver calls (install, add)
-// landed in the Brotli bucket (stale).
-//
-// Mitigation: force `Accept-Encoding: identity`. Manifest JSONs are
-// small (KB to tens of KB) so the lost compression is negligible, and
-// one encoding means one cache bucket — no split-brain. User-Agent +
-// `Accept: application/json` are included for good measure (CloudFront
-// + some WAFs 403 UA-less requests).
-//
-// Defence-in-depth: src/providers/s3.js caps every manifest-JSON PUT
-// at `CacheControl: public, max-age=300` (2.8.4), so the worst-case
-// staleness for any future publish is 5 min regardless of which
-// cache bucket a client lands in.
-//
-// See claude/PLAN-RESOLVER-HTTP-UNIFY.md for the follow-up plan to
-// route all resolver HTTP through the provider API and retire this
-// wrapper.
-
-const USER_AGENT = `wyvrnpm/${require('../package.json').version}`;
-
-/**
- * Drop-in replacement for the global `fetch`. Injects wyvrnpm's
- * `User-Agent`, an `Accept: application/json` hint, and forces
- * `Accept-Encoding: identity` to avoid CloudFront's per-encoding
- * cache-key split. Caller-supplied headers win on collision.
- *
- * @param {string | URL} url
- * @param {RequestInit} [init]
- * @returns {Promise<Response>}
- */
-function wyvrnFetch(url, init = {}) {
-  const headers = {
-    'User-Agent': USER_AGENT,
-    Accept: 'application/json',
-    'Accept-Encoding': 'identity',
-    ...(init.headers || {}),
-  };
-  return fetch(url, { ...init, headers });
-}
-
-module.exports = { wyvrnFetch, USER_AGENT };
+'use strict';
+
+// Shared `fetch` wrapper used by every resolver / downloader call site.
+//
+// 2.8.3 shipped with a split between the HTTP provider (which uses
+// node:https directly and sends `User-Agent: wyvrnpm/<ver>` + no
+// `Accept-Encoding`) and the resolver (which used the bare global
+// `fetch` — undici — defaulting to `Accept-Encoding: gzip, deflate,
+// br`). CloudFront caches a **separate entry per response encoding**,
+// so a `versions.json` freshly updated at origin could be stale in the
+// Brotli cache bucket for up to the full TTL while the identity bucket
+// served fresh bytes. The provider calls (show) happened to land in
+// the identity bucket (fresh); the resolver calls (install, add)
+// landed in the Brotli bucket (stale).
+//
+// Mitigation: force `Accept-Encoding: identity`. Manifest JSONs are
+// small (KB to tens of KB) so the lost compression is negligible, and
+// one encoding means one cache bucket — no split-brain. User-Agent +
+// `Accept: application/json` are included for good measure (CloudFront
+// + some WAFs 403 UA-less requests).
+//
+// Defence-in-depth: src/providers/s3.js caps every manifest-JSON PUT
+// at `CacheControl: public, max-age=300` (2.8.4), so the worst-case
+// staleness for any future publish is 5 min regardless of which
+// cache bucket a client lands in.
+//
+// See claude/PLAN-RESOLVER-HTTP-UNIFY.md for the follow-up plan to
+// route all resolver HTTP through the provider API and retire this
+// wrapper.
+
+const USER_AGENT = `wyvrnpm/${require('../package.json').version}`;
+
+/**
+ * Drop-in replacement for the global `fetch`. Injects wyvrnpm's
+ * `User-Agent`, an `Accept: application/json` hint, and forces
+ * `Accept-Encoding: identity` to avoid CloudFront's per-encoding
+ * cache-key split. Caller-supplied headers win on collision.
+ *
+ * @param {string | URL} url
+ * @param {RequestInit} [init]
+ * @returns {Promise<Response>}
+ */
+function wyvrnFetch(url, init = {}) {
+  const headers = {
+    'User-Agent': USER_AGENT,
+    Accept: 'application/json',
+    'Accept-Encoding': 'identity',
+    ...(init.headers || {}),
+  };
+  return fetch(url, { ...init, headers });
+}
+
+module.exports = { wyvrnFetch, USER_AGENT };

package/src/ignore.js

@@ -1,118 +1,118 @@
-'use strict';
-
-const fs = require('fs');
-
-// ---------------------------------------------------------------------------
-// .wyvrnignore matcher — follows .gitignore semantics as closely as is
-// practical for a static-archive filter. Supported:
-//
-//   - Blank lines and lines starting with `#` are ignored.
-//   - A leading `!` negates the match — re-includes a path a prior pattern
-//     excluded. Last matching pattern wins.
-//   - A trailing `/` makes the pattern directory-only: it matches directory
-//     entries only, never files. This is the single most common gitignore
-//     idiom (`build/`, `.git/`) so we honour it rather than treating the
-//     slash as a literal character.
-//   - A leading `/` anchors the pattern to the project root.
-//   - A `/` anywhere else in the pattern (excluding the trailing one) also
-//     anchors it to the root — same rule as gitignore.
-//   - Otherwise the pattern floats: it matches at any directory depth.
-//   - Globs: `*` is single-segment, `**` crosses segments, `?` is one char.
-//   - Literal leading `!` or `#` can be escaped with `\!` / `\#`.
-//
-// Not supported (unlike gitignore): pattern re-evaluation after a parent
-// directory has been excluded (gitignore can't re-include a file whose
-// parent directory was excluded — we don't recurse into excluded dirs
-// either, so the behaviour lines up in practice).
-// ---------------------------------------------------------------------------
-
-function parsePattern(raw) {
-  let p = raw;
-  if (p == null) return null;
-  p = p.replace(/\s+$/, ''); // trim trailing whitespace (gitignore rule)
-  if (p.length === 0) return null;
-  if (p.startsWith('#')) return null;
-
-  let negate = false;
-  if (p.startsWith('!')) {
-    negate = true;
-    p = p.slice(1);
-  } else if (p.startsWith('\\!') || p.startsWith('\\#')) {
-    // escaped literal leading ! or #
-    p = p.slice(1);
-  }
-
-  let dirOnly = false;
-  if (p.length > 1 && p.endsWith('/')) {
-    dirOnly = true;
-    p = p.slice(0, -1);
-  }
-
-  const leadingSlash = p.startsWith('/');
-  if (leadingSlash) p = p.slice(1);
-
-  // A `/` anywhere in the (remaining) pattern anchors it to the root.
-  // Bare names like `build` or `*.log` float — they match at any depth.
-  const anchored = leadingSlash || p.includes('/');
-
-  const re = p
-    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-    .replace(/\*\*/g, '\x00')
-    .replace(/\*/g, '[^/]*')
-    .replace(/\?/g, '[^/]')
-    .replace(/\x00/g, '.*');
-
-  const regex = anchored
-    ? new RegExp(`^${re}(/|$)`)
-    : new RegExp(`(^|/)${re}(/|$)`);
-
-  return { raw, regex, negate, dirOnly };
-}
-
-function loadIgnorePatterns(ignoreFile) {
-  if (!fs.existsSync(ignoreFile)) return [];
-  return fs
-    .readFileSync(ignoreFile, 'utf8')
-    .split(/\r?\n/)
-    .map(parsePattern)
-    .filter(Boolean);
-}
-
-/**
- * Determine whether a path should be excluded.
- * @param {string}  relPath  Forward-slash-separated path relative to the root.
- * @param {boolean} isDir    True if the path is a directory.
- * @param {Array}   patterns Parsed patterns (from loadIgnorePatterns).
- * @returns {boolean}
- *
- * Semantics follow gitignore: a dir-only pattern (`build/`) matches the
- * directory itself AND every descendant. We honour this by testing each
- * ancestor-prefix of the path against dir-only patterns — matters for
- * callers who probe arbitrary paths (tests, library users) rather than
- * walking the tree top-down (where the walker naturally stops recursing
- * once it sees the excluded parent).
- */
-function isIgnored(relPath, isDir, patterns) {
-  let ignored = false;
-  for (const { regex, negate, dirOnly } of patterns) {
-    let matched;
-    if (dirOnly) {
-      // Check the path itself (if it's a directory) and every ancestor dir.
-      matched = isDir && regex.test(relPath);
-      if (!matched) {
-        const parts = relPath.split('/');
-        let prefix = '';
-        for (let i = 0; i < parts.length - 1; i++) {
-          prefix = prefix ? `${prefix}/${parts[i]}` : parts[i];
-          if (regex.test(prefix)) { matched = true; break; }
-        }
-      }
-    } else {
-      matched = regex.test(relPath);
-    }
-    if (matched) ignored = !negate;
-  }
-  return ignored;
-}
-
-module.exports = { parsePattern, loadIgnorePatterns, isIgnored };
+'use strict';
+
+const fs = require('fs');
+
+// ---------------------------------------------------------------------------
+// .wyvrnignore matcher — follows .gitignore semantics as closely as is
+// practical for a static-archive filter. Supported:
+//
+//   - Blank lines and lines starting with `#` are ignored.
+//   - A leading `!` negates the match — re-includes a path a prior pattern
+//     excluded. Last matching pattern wins.
+//   - A trailing `/` makes the pattern directory-only: it matches directory
+//     entries only, never files. This is the single most common gitignore
+//     idiom (`build/`, `.git/`) so we honour it rather than treating the
+//     slash as a literal character.
+//   - A leading `/` anchors the pattern to the project root.
+//   - A `/` anywhere else in the pattern (excluding the trailing one) also
+//     anchors it to the root — same rule as gitignore.
+//   - Otherwise the pattern floats: it matches at any directory depth.
+//   - Globs: `*` is single-segment, `**` crosses segments, `?` is one char.
+//   - Literal leading `!` or `#` can be escaped with `\!` / `\#`.
+//
+// Not supported (unlike gitignore): pattern re-evaluation after a parent
+// directory has been excluded (gitignore can't re-include a file whose
+// parent directory was excluded — we don't recurse into excluded dirs
+// either, so the behaviour lines up in practice).
+// ---------------------------------------------------------------------------
+
+function parsePattern(raw) {
+  let p = raw;
+  if (p == null) return null;
+  p = p.replace(/\s+$/, ''); // trim trailing whitespace (gitignore rule)
+  if (p.length === 0) return null;
+  if (p.startsWith('#')) return null;
+
+  let negate = false;
+  if (p.startsWith('!')) {
+    negate = true;
+    p = p.slice(1);
+  } else if (p.startsWith('\\!') || p.startsWith('\\#')) {
+    // escaped literal leading ! or #
+    p = p.slice(1);
+  }
+
+  let dirOnly = false;
+  if (p.length > 1 && p.endsWith('/')) {
+    dirOnly = true;
+    p = p.slice(0, -1);
+  }
+
+  const leadingSlash = p.startsWith('/');
+  if (leadingSlash) p = p.slice(1);
+
+  // A `/` anywhere in the (remaining) pattern anchors it to the root.
+  // Bare names like `build` or `*.log` float — they match at any depth.
+  const anchored = leadingSlash || p.includes('/');
+
+  const re = p
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*/g, '\x00')
+    .replace(/\*/g, '[^/]*')
+    .replace(/\?/g, '[^/]')
+    .replace(/\x00/g, '.*');
+
+  const regex = anchored
+    ? new RegExp(`^${re}(/|$)`)
+    : new RegExp(`(^|/)${re}(/|$)`);
+
+  return { raw, regex, negate, dirOnly };
+}
+
+function loadIgnorePatterns(ignoreFile) {
+  if (!fs.existsSync(ignoreFile)) return [];
+  return fs
+    .readFileSync(ignoreFile, 'utf8')
+    .split(/\r?\n/)
+    .map(parsePattern)
+    .filter(Boolean);
+}
+
+/**
+ * Determine whether a path should be excluded.
+ * @param {string}  relPath  Forward-slash-separated path relative to the root.
+ * @param {boolean} isDir    True if the path is a directory.
+ * @param {Array}   patterns Parsed patterns (from loadIgnorePatterns).
+ * @returns {boolean}
+ *
+ * Semantics follow gitignore: a dir-only pattern (`build/`) matches the
+ * directory itself AND every descendant. We honour this by testing each
+ * ancestor-prefix of the path against dir-only patterns — matters for
+ * callers who probe arbitrary paths (tests, library users) rather than
+ * walking the tree top-down (where the walker naturally stops recursing
+ * once it sees the excluded parent).
+ */
+function isIgnored(relPath, isDir, patterns) {
+  let ignored = false;
+  for (const { regex, negate, dirOnly } of patterns) {
+    let matched;
+    if (dirOnly) {
+      // Check the path itself (if it's a directory) and every ancestor dir.
+      matched = isDir && regex.test(relPath);
+      if (!matched) {
+        const parts = relPath.split('/');
+        let prefix = '';
+        for (let i = 0; i < parts.length - 1; i++) {
+          prefix = prefix ? `${prefix}/${parts[i]}` : parts[i];
+          if (regex.test(prefix)) { matched = true; break; }
+        }
+      }
+    } else {
+      matched = regex.test(relPath);
+    }
+    if (matched) ignored = !negate;
+  }
+  return ignored;
+}
+
+module.exports = { parsePattern, loadIgnorePatterns, isIgnored };

package/src/logger.js

@@ -1,122 +1,122 @@
-'use strict';
-
-// ANSI-coloured, level-tagged logger for wyvrnpm CLI output.
-//
-// All user-facing lines go through this module so the `[wyvrn]` prefix and
-// level markers are applied consistently. Callers pass the message content
-// only — the prefix is never written at call sites.
-//
-// Colour is emitted when the target stream is a TTY, unless overridden by
-// the NO_COLOR or FORCE_COLOR environment variables (see https://no-color.org).
-
-const PREFIX = '[wyvrn]';
-
-// ── Sensitive-value redaction (EVALUATION.md S8) ──────────────────────────────
-// Defense-in-depth against a token leaking into logs or error traces. Nothing
-// in wyvrnpm deliberately logs tokens today, but callers sometimes paste full
-// commands + error output into bug reports, and some future error path might
-// stringify argv. Two narrow patterns cover every format we handle:
-//
-//   `--token <value>`                    — CLI leak
-//   `Authorization: Bearer <value>`      — HTTP header leak
-//   `Bearer <value>` (standalone)        — header fragment leak
-//
-// Redaction is a last-line mitigation — the primary fix is `--token-env` and
-// per-source `tokenEnv` so the literal value never lands in argv to begin with.
-const TOKEN_PATTERNS = [
-  [/(--token(?:-env)?[= ]+)\S+/g,                          '$1***'],
-  [/(Authorization\s*:\s*Bearer\s+)\S+/gi,                 '$1***'],
-  [/(\bBearer\s+)[A-Za-z0-9._\-+/=]{16,}/g,                '$1***'],
-];
-
-function redactSensitive(text) {
-  let out = String(text);
-  for (const [pattern, replacement] of TOKEN_PATTERNS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-
-const ANSI = {
-  reset:  '\x1b[0m',
-  bold:   '\x1b[1m',
-  dim:    '\x1b[2m',
-  red:    '\x1b[31m',
-  green:  '\x1b[32m',
-  yellow: '\x1b[33m',
-  cyan:   '\x1b[36m',
-};
-
-// When a command is emitting a JSON payload on stdout (F7 `--format=json`),
-// stdout must be reserved exclusively for that payload. In that mode we
-// route info/success to stderr too and drop colour so stderr stays
-// log-ingestion-friendly.
-let jsonMode = false;
-
-function setJsonMode(enabled) {
-  jsonMode = Boolean(enabled);
-}
-
-function isJsonMode() {
-  return jsonMode;
-}
-
-function colorEnabled(stream) {
-  if (jsonMode)                return false;
-  if (process.env.NO_COLOR)    return false;
-  if (process.env.FORCE_COLOR) return true;
-  return !!(stream && stream.isTTY);
-}
-
-function paint(text, code, stream) {
-  return colorEnabled(stream) ? `${code}${text}${ANSI.reset}` : text;
-}
-
-function emit(stream, consoleFn, coloredPrefix, message) {
-  // Every line in a multi-line message gets the prefix — so multi-line errors
-  // line up visually without the caller having to repeat `[wyvrn]` per line.
-  // Redaction runs before the prefix/colour is applied so patterns like
-  // `--token xyz` match regardless of how the caller formatted the line.
-  const out = redactSensitive(message)
-    .split('\n')
-    .map((line) => `${coloredPrefix} ${line}`)
-    .join('\n');
-  consoleFn(out);
-}
-
-function info(message) {
-  // In JSON mode stdout is reserved for the final payload — route info to stderr.
-  const stream      = jsonMode ? process.stderr : process.stdout;
-  const consoleFn   = jsonMode ? console.error  : console.log;
-  emit(stream, consoleFn, paint(PREFIX, ANSI.dim, stream), message);
-}
-
-function warn(message) {
-  const p   = paint(PREFIX, ANSI.yellow, process.stderr);
-  const tag = paint('warn', ANSI.yellow + ANSI.bold, process.stderr);
-  emit(process.stderr, console.warn, `${p} ${tag}`, message);
-}
-
-function error(message) {
-  const p   = paint(PREFIX, ANSI.red, process.stderr);
-  const tag = paint('error', ANSI.red + ANSI.bold, process.stderr);
-  emit(process.stderr, console.error, `${p} ${tag}`, message);
-}
-
-function success(message) {
-  // In JSON mode stdout is reserved for the final payload — route success to stderr.
-  const stream    = jsonMode ? process.stderr : process.stdout;
-  const consoleFn = jsonMode ? console.error  : console.log;
-  const p   = paint(PREFIX, ANSI.green, stream);
-  const tag = paint('ok', ANSI.green + ANSI.bold, stream);
-  emit(stream, consoleFn, `${p} ${tag}`, message);
-}
-
-function debug(message) {
-  if (!process.env.WYVRNPM_DEBUG) return;
-  const p   = paint(PREFIX, ANSI.dim, process.stderr);
-  const tag = paint('debug', ANSI.cyan, process.stderr);
-  emit(process.stderr, console.error, `${p} ${tag}`, message);
-}
-
-module.exports = { info, warn, error, success, debug, setJsonMode, isJsonMode, redactSensitive };
+'use strict';
+
+// ANSI-coloured, level-tagged logger for wyvrnpm CLI output.
+//
+// All user-facing lines go through this module so the `[wyvrn]` prefix and
+// level markers are applied consistently. Callers pass the message content
+// only — the prefix is never written at call sites.
+//
+// Colour is emitted when the target stream is a TTY, unless overridden by
+// the NO_COLOR or FORCE_COLOR environment variables (see https://no-color.org).
+
+const PREFIX = '[wyvrn]';
+
+// ── Sensitive-value redaction (EVALUATION.md S8) ──────────────────────────────
+// Defense-in-depth against a token leaking into logs or error traces. Nothing
+// in wyvrnpm deliberately logs tokens today, but callers sometimes paste full
+// commands + error output into bug reports, and some future error path might
+// stringify argv. Two narrow patterns cover every format we handle:
+//
+//   `--token <value>`                    — CLI leak
+//   `Authorization: Bearer <value>`      — HTTP header leak
+//   `Bearer <value>` (standalone)        — header fragment leak
+//
+// Redaction is a last-line mitigation — the primary fix is `--token-env` and
+// per-source `tokenEnv` so the literal value never lands in argv to begin with.
+const TOKEN_PATTERNS = [
+  [/(--token(?:-env)?[= ]+)\S+/g,                          '$1***'],
+  [/(Authorization\s*:\s*Bearer\s+)\S+/gi,                 '$1***'],
+  [/(\bBearer\s+)[A-Za-z0-9._\-+/=]{16,}/g,                '$1***'],
+];
+
+function redactSensitive(text) {
+  let out = String(text);
+  for (const [pattern, replacement] of TOKEN_PATTERNS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+
+const ANSI = {
+  reset:  '\x1b[0m',
+  bold:   '\x1b[1m',
+  dim:    '\x1b[2m',
+  red:    '\x1b[31m',
+  green:  '\x1b[32m',
+  yellow: '\x1b[33m',
+  cyan:   '\x1b[36m',
+};
+
+// When a command is emitting a JSON payload on stdout (F7 `--format=json`),
+// stdout must be reserved exclusively for that payload. In that mode we
+// route info/success to stderr too and drop colour so stderr stays
+// log-ingestion-friendly.
+let jsonMode = false;
+
+function setJsonMode(enabled) {
+  jsonMode = Boolean(enabled);
+}
+
+function isJsonMode() {
+  return jsonMode;
+}
+
+function colorEnabled(stream) {
+  if (jsonMode)                return false;
+  if (process.env.NO_COLOR)    return false;
+  if (process.env.FORCE_COLOR) return true;
+  return !!(stream && stream.isTTY);
+}
+
+function paint(text, code, stream) {
+  return colorEnabled(stream) ? `${code}${text}${ANSI.reset}` : text;
+}
+
+function emit(stream, consoleFn, coloredPrefix, message) {
+  // Every line in a multi-line message gets the prefix — so multi-line errors
+  // line up visually without the caller having to repeat `[wyvrn]` per line.
+  // Redaction runs before the prefix/colour is applied so patterns like
+  // `--token xyz` match regardless of how the caller formatted the line.
+  const out = redactSensitive(message)
+    .split('\n')
+    .map((line) => `${coloredPrefix} ${line}`)
+    .join('\n');
+  consoleFn(out);
+}
+
+function info(message) {
+  // In JSON mode stdout is reserved for the final payload — route info to stderr.
+  const stream      = jsonMode ? process.stderr : process.stdout;
+  const consoleFn   = jsonMode ? console.error  : console.log;
+  emit(stream, consoleFn, paint(PREFIX, ANSI.dim, stream), message);
+}
+
+function warn(message) {
+  const p   = paint(PREFIX, ANSI.yellow, process.stderr);
+  const tag = paint('warn', ANSI.yellow + ANSI.bold, process.stderr);
+  emit(process.stderr, console.warn, `${p} ${tag}`, message);
+}
+
+function error(message) {
+  const p   = paint(PREFIX, ANSI.red, process.stderr);
+  const tag = paint('error', ANSI.red + ANSI.bold, process.stderr);
+  emit(process.stderr, console.error, `${p} ${tag}`, message);
+}
+
+function success(message) {
+  // In JSON mode stdout is reserved for the final payload — route success to stderr.
+  const stream    = jsonMode ? process.stderr : process.stdout;
+  const consoleFn = jsonMode ? console.error  : console.log;
+  const p   = paint(PREFIX, ANSI.green, stream);
+  const tag = paint('ok', ANSI.green + ANSI.bold, stream);
+  emit(stream, consoleFn, `${p} ${tag}`, message);
+}
+
+function debug(message) {
+  if (!process.env.WYVRNPM_DEBUG) return;
+  const p   = paint(PREFIX, ANSI.dim, process.stderr);
+  const tag = paint('debug', ANSI.cyan, process.stderr);
+  emit(process.stderr, console.error, `${p} ${tag}`, message);
+}
+
+module.exports = { info, warn, error, success, debug, setJsonMode, isJsonMode, redactSensitive };