zyrk 0.2.3 → 0.3.7

package/src/install/import-npm.ts

@@ -0,0 +1,177 @@
+/** Adopt npm v2/v3 exact selections without asking the registry to pick versions. */
+import { valid, satisfies } from "semver";
+import type { NpmLockDoc } from "../lockfile/types.ts";
+import type {
+  FinalizedGraph,
+  ResolvedOccurrence,
+} from "../resolve/resolver.ts";
+import { parseRequirement } from "../resolve/spec.ts";
+import { sourceIdOf, sha512Hex } from "../util/hash.ts";
+import { cleanUrl, lockMismatch, packageName } from "./lock.ts";
+
+export function importNpmLock(
+  doc: NpmLockDoc,
+  requirements: Record<string, string>,
+  origin: string,
+): FinalizedGraph {
+  const packages = doc.packages;
+  if (!packages || !packages[""])
+    throw lockMismatch("npm lockfile lacks an importer manifest");
+  const locations = new Map<string, ResolvedOccurrence>();
+  const find = (from: string, name: string): string | undefined => {
+    let current = from;
+    for (;;) {
+      if (!current.endsWith("node_modules")) {
+        const candidate = `${current ? `${current}/` : ""}node_modules/${name}`;
+        if (packages[candidate]) return candidate;
+      }
+      if (!current) return undefined;
+      current = current.includes("/")
+        ? current.slice(0, current.lastIndexOf("/"))
+        : "";
+    }
+  };
+  const load = (
+    location: string,
+    edgeName: string,
+    spec: string,
+  ): ResolvedOccurrence => {
+    const existing = locations.get(location);
+    const entry = packages[location];
+    if (!entry || entry.link === true || entry.inBundle === true)
+      throw lockMismatch(
+        "npm lock contains an unsupported linked or bundled selection",
+      );
+    const request = parseRequirement(edgeName, spec);
+    const name = typeof entry.name === "string" ? entry.name : request.realName;
+    if (
+      !packageName(name) ||
+      name !== request.realName ||
+      typeof entry.version !== "string" ||
+      valid(entry.version) === null ||
+      typeof entry.resolved !== "string" ||
+      !cleanUrl(entry.resolved) ||
+      typeof entry.integrity !== "string" ||
+      !/^sha512-[A-Za-z0-9+/]{86}==$/.test(entry.integrity)
+    )
+      throw lockMismatch(
+        "npm selection lacks a valid name, version, archive, or SHA-512 integrity",
+      );
+    if (
+      request.targetKind !== "tag" &&
+      !satisfies(entry.version, request.targetSpec)
+    )
+      throw lockMismatch("npm selection disagrees with a manifest requirement");
+    // Every incoming edge must satisfy its requirement, including a cycle or
+    // a location already selected by a different dependency.
+    if (existing) return existing;
+    const node: ResolvedOccurrence = {
+      key: `${name}@${entry.version}#${sha512Hex(location).slice(0, 16)}`,
+      name,
+      version: entry.version,
+      origin,
+      integrity: entry.integrity,
+      sourceId: sourceIdOf({
+        sourceType: "registry",
+        name,
+        version: entry.version,
+        origin,
+        integrity: entry.integrity,
+      }),
+      tarballUrl: entry.resolved,
+      bin: {},
+      platform: {},
+      edges: [],
+      peerBindings: [],
+    };
+    if (entry.engines !== undefined) {
+      if (
+        typeof entry.engines !== "object" ||
+        entry.engines === null ||
+        Array.isArray(entry.engines) ||
+        Object.values(entry.engines).some((value) => typeof value !== "string")
+      )
+        throw lockMismatch("invalid npm engine constraint");
+      node.engines = entry.engines as Record<string, string>;
+    }
+    if (
+      typeof entry.bin === "object" &&
+      entry.bin !== null &&
+      !Array.isArray(entry.bin)
+    ) {
+      for (const [key, value] of Object.entries(entry.bin)) {
+        if (typeof value !== "string")
+          throw lockMismatch("invalid npm binary entry");
+        node.bin[key] = value;
+      }
+    }
+    for (const field of ["os", "cpu", "libc"] as const) {
+      const value = entry[field];
+      if (value !== undefined) {
+        if (!Array.isArray(value) || !value.every((v) => typeof v === "string"))
+          throw lockMismatch("invalid npm platform constraint");
+        node.platform[field] = value as string[];
+      }
+    }
+    locations.set(location, node);
+    const dependencies: Record<
+      string,
+      { spec: string; kind: "prod" | "optional" | "peer" }
+    > = Object.create(null) as Record<
+      string,
+      { spec: string; kind: "prod" | "optional" | "peer" }
+    >;
+    for (const [group, kind] of [
+      ["dependencies", "prod"],
+      ["optionalDependencies", "optional"],
+      ["peerDependencies", "peer"],
+    ] as const) {
+      const entries = entry[group];
+      if (entries === undefined) continue;
+      if (
+        typeof entries !== "object" ||
+        entries === null ||
+        Array.isArray(entries)
+      )
+        throw lockMismatch("invalid npm dependency declarations");
+      for (const [dep, range] of Object.entries(entries)) {
+        if (!packageName(dep) || typeof range !== "string")
+          throw lockMismatch("invalid npm dependency requirement");
+        dependencies[dep] = { spec: range, kind };
+      }
+    }
+    for (const [dep, requirement] of Object.entries(dependencies)) {
+      const targetLocation = find(location, dep);
+      const meta = entry.peerDependenciesMeta as
+        Record<string, { optional?: boolean }> | undefined;
+      const optionalPeer =
+        requirement.kind === "peer" && meta?.[dep]?.optional === true;
+      if (!targetLocation) {
+        if (requirement.kind === "optional" || optionalPeer) {
+          if (optionalPeer) node.peerBindings.push({ name: dep, target: null });
+          continue;
+        }
+        throw lockMismatch("npm lock is missing a required dependency");
+      }
+      const target = load(targetLocation, dep, requirement.spec);
+      node.edges.push({
+        name: dep,
+        target: target.key,
+        kind: requirement.kind,
+        spec: requirement.spec,
+      });
+      if (requirement.kind === "peer")
+        node.peerBindings.push({ name: dep, target: target.key });
+    }
+    return node;
+  };
+  const roots = Object.entries(requirements).map(([name, spec]) => {
+    const location = find("", name);
+    if (!location) throw lockMismatch("npm lock is missing a direct selection");
+    return { name, target: load(location, name, spec).key };
+  });
+  return {
+    nodes: [...locations.values()].sort((a, b) => a.key.localeCompare(b.key)),
+    roots,
+  };
+}

package/src/install/lock.ts

@@ -0,0 +1,176 @@
+/** Validate locked graph data before it can address any store/project paths. */
+import { valid } from "semver";
+import { ZyrkError } from "../errors.ts";
+import type { NpmLockDoc } from "../lockfile/types.ts";
+import { ZYRK_RESOLVER_POLICY } from "../lockfile/types.ts";
+import type {
+  FinalizedGraph,
+  ResolvedOccurrence,
+} from "../resolve/resolver.ts";
+import { sourceIdOf } from "../util/hash.ts";
+import { CONTEXT_CANONICALIZATION_VERSION } from "../version.ts";
+import { createGraphDoc } from "../store/graph.ts";
+
+export function packageName(name: string): boolean {
+  return (
+    /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(name) &&
+    !["node_modules", "__proto__", "constructor", "prototype"].includes(name) &&
+    name.length <= 214
+  );
+}
+export function cleanUrl(value: string): boolean {
+  try {
+    const url = new URL(value);
+    return (
+      ["https:", "http:"].includes(url.protocol) &&
+      !url.username &&
+      !url.password &&
+      !url.search &&
+      !url.hash
+    );
+  } catch {
+    return false;
+  }
+}
+export function lockMismatch(why: string): ZyrkError {
+  return new ZyrkError(
+    "ZYRK_LOCK_MISMATCH",
+    `cannot install the locked graph (${why}).`,
+    {
+      remedy:
+        "Restore a compatible package-lock.json, or refresh it intentionally with zyrk install after reviewing dependency changes.",
+    },
+  );
+}
+function record(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function lockedGraph(doc: NpmLockDoc): FinalizedGraph {
+  const ext = doc.zyrk;
+  if (
+    !ext ||
+    ext.resolver !== ZYRK_RESOLVER_POLICY ||
+    ext.contextCanonicalization !== CONTEXT_CANONICALIZATION_VERSION ||
+    !record(ext.nodes) ||
+    !record(ext.roots) ||
+    !record(ext.roots["."])
+  )
+    throw lockMismatch("unsupported graph metadata");
+  const nodes: ResolvedOccurrence[] = [];
+  for (const [key, raw] of Object.entries(ext.nodes)) {
+    if (
+      !record(raw) ||
+      typeof raw.name !== "string" ||
+      !packageName(raw.name) ||
+      typeof raw.version !== "string" ||
+      valid(raw.version) === null ||
+      typeof raw.integrity !== "string" ||
+      !/^sha512-[A-Za-z0-9+/]{86}==$/.test(raw.integrity) ||
+      typeof raw.origin !== "string" ||
+      !cleanUrl(raw.origin) ||
+      typeof raw.tarball !== "string" ||
+      !cleanUrl(raw.tarball) ||
+      !record(raw.edges) ||
+      !record(raw.edgeKinds) ||
+      !record(raw.peers) ||
+      !record(raw.bin) ||
+      !record(raw.platform)
+    )
+      throw lockMismatch("invalid node record");
+    const identity = {
+      sourceType: "registry" as const,
+      name: raw.name,
+      version: raw.version,
+      origin: raw.origin,
+      integrity: raw.integrity,
+    };
+    if (sourceIdOf(identity) !== raw.source)
+      throw lockMismatch("source identity disagrees with locked inputs");
+    const edges: ResolvedOccurrence["edges"] = [];
+    for (const [name, target] of Object.entries(raw.edges)) {
+      const kind = raw.edgeKinds[name];
+      if (
+        !packageName(name) ||
+        typeof target !== "string" ||
+        !["prod", "optional", "peer"].includes(String(kind))
+      )
+        throw lockMismatch("invalid dependency edge");
+      edges.push({
+        name,
+        target,
+        kind: kind as "prod" | "optional" | "peer",
+        spec: "",
+      });
+    }
+    const peers: ResolvedOccurrence["peerBindings"] = [];
+    for (const [name, target] of Object.entries(raw.peers)) {
+      if (
+        !packageName(name) ||
+        (target !== null && typeof target !== "string") ||
+        (target !== null && raw.edges[name] !== target)
+      )
+        throw lockMismatch("invalid peer binding");
+      peers.push({ name, target });
+    }
+    const bin: Record<string, string> = Object.create(null) as Record<
+      string,
+      string
+    >;
+    for (const [name, target] of Object.entries(raw.bin)) {
+      if (
+        !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name) ||
+        typeof target !== "string"
+      )
+        throw lockMismatch("invalid binary entry");
+      bin[name] = target;
+    }
+    const platform: ResolvedOccurrence["platform"] = {};
+    for (const field of ["os", "cpu", "libc"] as const) {
+      const list = raw.platform[field];
+      if (list !== undefined) {
+        if (
+          !Array.isArray(list) ||
+          !list.every((item: unknown) => typeof item === "string")
+        )
+          throw lockMismatch("invalid platform constraints");
+        platform[field] = list as string[];
+      }
+    }
+    const engines: Record<string, string> = {};
+    if (raw.engines !== undefined) {
+      if (!record(raw.engines))
+        throw lockMismatch("invalid engine constraints");
+      for (const [name, value] of Object.entries(raw.engines)) {
+        if (typeof value !== "string")
+          throw lockMismatch("invalid engine constraint");
+        engines[name] = value;
+      }
+    }
+    nodes.push({
+      key,
+      ...identity,
+      sourceId: raw.source as string,
+      tarballUrl: raw.tarball,
+      bin,
+      engines,
+      platform,
+      edges,
+      peerBindings: peers,
+    });
+  }
+  const roots = Object.entries(ext.roots["."]).map(([name, target]) => {
+    if (
+      !packageName(name) ||
+      typeof target !== "string" ||
+      !nodes.some((node) => node.key === target)
+    )
+      throw lockMismatch("invalid importer root");
+    return { name, target: target as string };
+  });
+  try {
+    createGraphDoc(nodes.map((n) => ({ ...n, deps: n.edges })));
+  } catch {
+    throw lockMismatch("invalid dependency graph");
+  }
+  return { nodes, roots };
+}

package/src/install/metadata.ts

@@ -0,0 +1,122 @@
+/** Durable project roots and exact physical instances (SPEC 14.4, 18, 30). */
+import { stat } from "node:fs/promises";
+import * as path from "node:path";
+import {
+  openStoreDb,
+  recordSource,
+  recordObject,
+  withTransaction,
+} from "../store/db.ts";
+import { Store } from "../store/layout.ts";
+import { readSourceManifest } from "../store/manifests.ts";
+import { contextIdFor, graphHash, type GraphDoc } from "../store/graph.ts";
+import type { RealizeResult } from "../store/realize.ts";
+import { sha512Hex } from "../util/hash.ts";
+import { STORE_FORMAT_VERSION } from "../version.ts";
+
+export async function registerGeneration(options: {
+  store: Store;
+  project: string;
+  projectId: string;
+  generationId: string;
+  graph: GraphDoc;
+  realized: RealizeResult;
+  roots: readonly string[];
+  readiness: "ready" | "intentionally-unbuilt";
+}): Promise<{
+  instances: string[];
+  contexts: string[];
+  activate(): void;
+  close(): void;
+}> {
+  const { store, project, projectId, generationId, graph, realized } = options;
+  const db = openStoreDb(store.paths.dbFile);
+  try {
+    for (const node of graph.nodes) {
+      const doc = await readSourceManifest(store, node.sourceId);
+      const m = doc.manifest;
+      recordSource(db, {
+        sourceId: m.sourceId,
+        sourceType: "registry",
+        name: m.name,
+        version: m.version,
+        origin: m.origin,
+        integrity: m.integrity,
+        manifestHash: doc.manifestHash,
+        extractionPolicyVersion: m.extractionPolicyVersion,
+        logicalBytes: m.totals.logicalBytes,
+        fileCount: m.totals.files,
+        entryCount: m.entries.length,
+        verifiedAt: doc.provenance.verifiedAt,
+      });
+      for (const entry of m.entries)
+        if (entry.type === "file")
+          recordObject(db, {
+            objectId: entry.objectId,
+            innerDigest: entry.innerDigest,
+            modeClass: entry.mode,
+            bytes: entry.size,
+            committedAt: doc.provenance.verifiedAt,
+          });
+    }
+    const now = new Date().toISOString();
+    const fs = await stat(project);
+    const contexts: string[] = [];
+    const instances: string[] = [];
+    withTransaction(db, () => {
+      db.prepare(
+        "INSERT INTO projects(project_id,canonical_path,fs_dev,fs_ino,created_at,last_seen_at) VALUES(?,?,?,?,?,?) ON CONFLICT(project_id) DO UPDATE SET last_seen_at=excluded.last_seen_at",
+      ).run(projectId, project, String(fs.dev), String(fs.ino), now, now);
+      db.prepare(
+        "INSERT INTO generations(generation_id,project_id,graph_digest,readiness,state,created_at) VALUES(?,?,?,?,'pending',?)",
+      ).run(generationId, projectId, graphHash(graph), options.readiness, now);
+      for (const node of graph.nodes) {
+        const context = contextIdFor(graph, node.key);
+        const directory = realized.realizationDirByKey.get(node.key)!;
+        const instance = `inst1_${sha512Hex(directory).slice(0, 32)}`;
+        contexts.push(context);
+        instances.push(instance);
+        db.prepare(
+          "INSERT INTO realizations(context_id,descriptor_hash,source_id,readiness,store_format,created_at) VALUES(?,?,?,'ready',?,?) ON CONFLICT(context_id) DO NOTHING",
+        ).run(context, context, node.sourceId, STORE_FORMAT_VERSION, now);
+        db.prepare(
+          "INSERT INTO realization_instances(instance_id,context_id,path,verification_state,created_at) VALUES(?,?,?,'verified',?) ON CONFLICT(instance_id) DO NOTHING",
+        ).run(instance, context, directory, now);
+        db.prepare(
+          "INSERT INTO generation_instances(generation_id,context_id,instance_id,direct_link) VALUES(?,?,?,?) ON CONFLICT(generation_id,context_id) DO NOTHING",
+        ).run(
+          generationId,
+          context,
+          instance,
+          options.roots.includes(node.key) ? 1 : 0,
+        );
+      }
+      db.prepare(
+        "INSERT INTO roots(root_id,project_id,generation_id,kind,state,created_at) VALUES(?,?,?,'pending','active',?)",
+      ).run(`root1_${generationId}`, projectId, generationId, now);
+    });
+    return {
+      contexts,
+      instances,
+      activate() {
+        withTransaction(db, () => {
+          db.prepare(
+            "UPDATE generations SET state='rollback' WHERE project_id=? AND state='active' AND generation_id<>?",
+          ).run(projectId, generationId);
+          db.prepare(
+            "UPDATE generations SET state='active',activated_at=? WHERE generation_id=?",
+          ).run(new Date().toISOString(), generationId);
+          db.prepare(
+            "UPDATE roots SET kind='generation' WHERE generation_id=?",
+          ).run(generationId);
+        });
+      },
+      close() {
+        db.close();
+      },
+    };
+  } catch (cause) {
+    db.close();
+    throw cause;
+  }
+}

package/src/install/registry.ts

@@ -0,0 +1,88 @@
+/** Fail closed on registry settings the current single-registry adapter cannot honor. */
+import { readFile } from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import { ZyrkError } from "../errors.ts";
+import { RegistryClient, DEFAULT_REGISTRY } from "../fetch/registry.ts";
+import { isErrno } from "../util/fsx.ts";
+import { cleanUrl } from "./lock.ts";
+
+export async function installRegistry(options: {
+  cwd: string;
+  env: NodeJS.ProcessEnv;
+  version: string;
+  registry?: string;
+}): Promise<RegistryClient> {
+  let registry = DEFAULT_REGISTRY;
+  const home = options.env.HOME ?? os.homedir();
+  const files = [
+    options.env.npm_config_userconfig ?? path.join(home, ".npmrc"),
+    path.join(options.cwd, ".npmrc"),
+  ];
+  for (const file of files) {
+    let text: string;
+    try {
+      text = await readFile(file, "utf8");
+    } catch (cause) {
+      if (isErrno(cause, "ENOENT")) continue;
+      throw new ZyrkError(
+        "ZYRK_POLICY_DENIED",
+        "Cannot read npm registry configuration.",
+        {
+          remedy: "Make the user and project .npmrc readable before retrying.",
+        },
+      );
+    }
+    for (const line of text.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";"))
+        continue;
+      const index = trimmed.indexOf("=");
+      const key = trimmed.slice(0, index).trim();
+      const value = trimmed.slice(index + 1).trim();
+      if (key === "registry") registry = value;
+      if (/^@.+:registry$/.test(key))
+        throw new ZyrkError(
+          "ZYRK_POLICY_DENIED",
+          "Scoped registry routing is not supported by project install yet.",
+          {
+            remedy:
+              "Use npm for mixed-registry projects; zyrk will not silently fetch a private scope from a public registry.",
+          },
+        );
+      if (key === "strict-ssl" && value === "false")
+        throw new ZyrkError(
+          "ZYRK_POLICY_DENIED",
+          "Disabling registry TLS verification is not supported.",
+          {
+            remedy:
+              "Configure a trusted HTTPS registry with valid TLS certificates.",
+          },
+        );
+    }
+  }
+  registry = options.registry ?? options.env.npm_config_registry ?? registry;
+  if (!cleanUrl(registry))
+    throw new ZyrkError(
+      "ZYRK_POLICY_DENIED",
+      "Registry URL must be HTTP(S) without credentials, query parameters, or fragments.",
+      {
+        remedy:
+          "Use a credential-free registry URL. Authenticated private registries are not supported by project install yet.",
+      },
+    );
+  const url = new URL(registry);
+  if (
+    url.protocol !== "https:" &&
+    !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+  )
+    throw new ZyrkError(
+      "ZYRK_POLICY_DENIED",
+      "Remote registries require HTTPS.",
+      {
+        remedy:
+          "Select an HTTPS registry; HTTP is limited to loopback development registries.",
+      },
+    );
+  return new RegistryClient({ registry, userAgent: `zyrk/${options.version}` });
+}