zyrk 0.3.7 → 0.3.9

package/src/install/import-npm.ts

@@ -1,177 +0,0 @@
-/** Adopt npm v2/v3 exact selections without asking the registry to pick versions. */
-import { valid, satisfies } from "semver";
-import type { NpmLockDoc } from "../lockfile/types.ts";
-import type {
-  FinalizedGraph,
-  ResolvedOccurrence,
-} from "../resolve/resolver.ts";
-import { parseRequirement } from "../resolve/spec.ts";
-import { sourceIdOf, sha512Hex } from "../util/hash.ts";
-import { cleanUrl, lockMismatch, packageName } from "./lock.ts";
-
-export function importNpmLock(
-  doc: NpmLockDoc,
-  requirements: Record<string, string>,
-  origin: string,
-): FinalizedGraph {
-  const packages = doc.packages;
-  if (!packages || !packages[""])
-    throw lockMismatch("npm lockfile lacks an importer manifest");
-  const locations = new Map<string, ResolvedOccurrence>();
-  const find = (from: string, name: string): string | undefined => {
-    let current = from;
-    for (;;) {
-      if (!current.endsWith("node_modules")) {
-        const candidate = `${current ? `${current}/` : ""}node_modules/${name}`;
-        if (packages[candidate]) return candidate;
-      }
-      if (!current) return undefined;
-      current = current.includes("/")
-        ? current.slice(0, current.lastIndexOf("/"))
-        : "";
-    }
-  };
-  const load = (
-    location: string,
-    edgeName: string,
-    spec: string,
-  ): ResolvedOccurrence => {
-    const existing = locations.get(location);
-    const entry = packages[location];
-    if (!entry || entry.link === true || entry.inBundle === true)
-      throw lockMismatch(
-        "npm lock contains an unsupported linked or bundled selection",
-      );
-    const request = parseRequirement(edgeName, spec);
-    const name = typeof entry.name === "string" ? entry.name : request.realName;
-    if (
-      !packageName(name) ||
-      name !== request.realName ||
-      typeof entry.version !== "string" ||
-      valid(entry.version) === null ||
-      typeof entry.resolved !== "string" ||
-      !cleanUrl(entry.resolved) ||
-      typeof entry.integrity !== "string" ||
-      !/^sha512-[A-Za-z0-9+/]{86}==$/.test(entry.integrity)
-    )
-      throw lockMismatch(
-        "npm selection lacks a valid name, version, archive, or SHA-512 integrity",
-      );
-    if (
-      request.targetKind !== "tag" &&
-      !satisfies(entry.version, request.targetSpec)
-    )
-      throw lockMismatch("npm selection disagrees with a manifest requirement");
-    // Every incoming edge must satisfy its requirement, including a cycle or
-    // a location already selected by a different dependency.
-    if (existing) return existing;
-    const node: ResolvedOccurrence = {
-      key: `${name}@${entry.version}#${sha512Hex(location).slice(0, 16)}`,
-      name,
-      version: entry.version,
-      origin,
-      integrity: entry.integrity,
-      sourceId: sourceIdOf({
-        sourceType: "registry",
-        name,
-        version: entry.version,
-        origin,
-        integrity: entry.integrity,
-      }),
-      tarballUrl: entry.resolved,
-      bin: {},
-      platform: {},
-      edges: [],
-      peerBindings: [],
-    };
-    if (entry.engines !== undefined) {
-      if (
-        typeof entry.engines !== "object" ||
-        entry.engines === null ||
-        Array.isArray(entry.engines) ||
-        Object.values(entry.engines).some((value) => typeof value !== "string")
-      )
-        throw lockMismatch("invalid npm engine constraint");
-      node.engines = entry.engines as Record<string, string>;
-    }
-    if (
-      typeof entry.bin === "object" &&
-      entry.bin !== null &&
-      !Array.isArray(entry.bin)
-    ) {
-      for (const [key, value] of Object.entries(entry.bin)) {
-        if (typeof value !== "string")
-          throw lockMismatch("invalid npm binary entry");
-        node.bin[key] = value;
-      }
-    }
-    for (const field of ["os", "cpu", "libc"] as const) {
-      const value = entry[field];
-      if (value !== undefined) {
-        if (!Array.isArray(value) || !value.every((v) => typeof v === "string"))
-          throw lockMismatch("invalid npm platform constraint");
-        node.platform[field] = value as string[];
-      }
-    }
-    locations.set(location, node);
-    const dependencies: Record<
-      string,
-      { spec: string; kind: "prod" | "optional" | "peer" }
-    > = Object.create(null) as Record<
-      string,
-      { spec: string; kind: "prod" | "optional" | "peer" }
-    >;
-    for (const [group, kind] of [
-      ["dependencies", "prod"],
-      ["optionalDependencies", "optional"],
-      ["peerDependencies", "peer"],
-    ] as const) {
-      const entries = entry[group];
-      if (entries === undefined) continue;
-      if (
-        typeof entries !== "object" ||
-        entries === null ||
-        Array.isArray(entries)
-      )
-        throw lockMismatch("invalid npm dependency declarations");
-      for (const [dep, range] of Object.entries(entries)) {
-        if (!packageName(dep) || typeof range !== "string")
-          throw lockMismatch("invalid npm dependency requirement");
-        dependencies[dep] = { spec: range, kind };
-      }
-    }
-    for (const [dep, requirement] of Object.entries(dependencies)) {
-      const targetLocation = find(location, dep);
-      const meta = entry.peerDependenciesMeta as
-        Record<string, { optional?: boolean }> | undefined;
-      const optionalPeer =
-        requirement.kind === "peer" && meta?.[dep]?.optional === true;
-      if (!targetLocation) {
-        if (requirement.kind === "optional" || optionalPeer) {
-          if (optionalPeer) node.peerBindings.push({ name: dep, target: null });
-          continue;
-        }
-        throw lockMismatch("npm lock is missing a required dependency");
-      }
-      const target = load(targetLocation, dep, requirement.spec);
-      node.edges.push({
-        name: dep,
-        target: target.key,
-        kind: requirement.kind,
-        spec: requirement.spec,
-      });
-      if (requirement.kind === "peer")
-        node.peerBindings.push({ name: dep, target: target.key });
-    }
-    return node;
-  };
-  const roots = Object.entries(requirements).map(([name, spec]) => {
-    const location = find("", name);
-    if (!location) throw lockMismatch("npm lock is missing a direct selection");
-    return { name, target: load(location, name, spec).key };
-  });
-  return {
-    nodes: [...locations.values()].sort((a, b) => a.key.localeCompare(b.key)),
-    roots,
-  };
-}

package/src/install/lock.ts

@@ -1,176 +0,0 @@
-/** Validate locked graph data before it can address any store/project paths. */
-import { valid } from "semver";
-import { ZyrkError } from "../errors.ts";
-import type { NpmLockDoc } from "../lockfile/types.ts";
-import { ZYRK_RESOLVER_POLICY } from "../lockfile/types.ts";
-import type {
-  FinalizedGraph,
-  ResolvedOccurrence,
-} from "../resolve/resolver.ts";
-import { sourceIdOf } from "../util/hash.ts";
-import { CONTEXT_CANONICALIZATION_VERSION } from "../version.ts";
-import { createGraphDoc } from "../store/graph.ts";
-
-export function packageName(name: string): boolean {
-  return (
-    /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(name) &&
-    !["node_modules", "__proto__", "constructor", "prototype"].includes(name) &&
-    name.length <= 214
-  );
-}
-export function cleanUrl(value: string): boolean {
-  try {
-    const url = new URL(value);
-    return (
-      ["https:", "http:"].includes(url.protocol) &&
-      !url.username &&
-      !url.password &&
-      !url.search &&
-      !url.hash
-    );
-  } catch {
-    return false;
-  }
-}
-export function lockMismatch(why: string): ZyrkError {
-  return new ZyrkError(
-    "ZYRK_LOCK_MISMATCH",
-    `cannot install the locked graph (${why}).`,
-    {
-      remedy:
-        "Restore a compatible package-lock.json, or refresh it intentionally with zyrk install after reviewing dependency changes.",
-    },
-  );
-}
-function record(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-export function lockedGraph(doc: NpmLockDoc): FinalizedGraph {
-  const ext = doc.zyrk;
-  if (
-    !ext ||
-    ext.resolver !== ZYRK_RESOLVER_POLICY ||
-    ext.contextCanonicalization !== CONTEXT_CANONICALIZATION_VERSION ||
-    !record(ext.nodes) ||
-    !record(ext.roots) ||
-    !record(ext.roots["."])
-  )
-    throw lockMismatch("unsupported graph metadata");
-  const nodes: ResolvedOccurrence[] = [];
-  for (const [key, raw] of Object.entries(ext.nodes)) {
-    if (
-      !record(raw) ||
-      typeof raw.name !== "string" ||
-      !packageName(raw.name) ||
-      typeof raw.version !== "string" ||
-      valid(raw.version) === null ||
-      typeof raw.integrity !== "string" ||
-      !/^sha512-[A-Za-z0-9+/]{86}==$/.test(raw.integrity) ||
-      typeof raw.origin !== "string" ||
-      !cleanUrl(raw.origin) ||
-      typeof raw.tarball !== "string" ||
-      !cleanUrl(raw.tarball) ||
-      !record(raw.edges) ||
-      !record(raw.edgeKinds) ||
-      !record(raw.peers) ||
-      !record(raw.bin) ||
-      !record(raw.platform)
-    )
-      throw lockMismatch("invalid node record");
-    const identity = {
-      sourceType: "registry" as const,
-      name: raw.name,
-      version: raw.version,
-      origin: raw.origin,
-      integrity: raw.integrity,
-    };
-    if (sourceIdOf(identity) !== raw.source)
-      throw lockMismatch("source identity disagrees with locked inputs");
-    const edges: ResolvedOccurrence["edges"] = [];
-    for (const [name, target] of Object.entries(raw.edges)) {
-      const kind = raw.edgeKinds[name];
-      if (
-        !packageName(name) ||
-        typeof target !== "string" ||
-        !["prod", "optional", "peer"].includes(String(kind))
-      )
-        throw lockMismatch("invalid dependency edge");
-      edges.push({
-        name,
-        target,
-        kind: kind as "prod" | "optional" | "peer",
-        spec: "",
-      });
-    }
-    const peers: ResolvedOccurrence["peerBindings"] = [];
-    for (const [name, target] of Object.entries(raw.peers)) {
-      if (
-        !packageName(name) ||
-        (target !== null && typeof target !== "string") ||
-        (target !== null && raw.edges[name] !== target)
-      )
-        throw lockMismatch("invalid peer binding");
-      peers.push({ name, target });
-    }
-    const bin: Record<string, string> = Object.create(null) as Record<
-      string,
-      string
-    >;
-    for (const [name, target] of Object.entries(raw.bin)) {
-      if (
-        !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name) ||
-        typeof target !== "string"
-      )
-        throw lockMismatch("invalid binary entry");
-      bin[name] = target;
-    }
-    const platform: ResolvedOccurrence["platform"] = {};
-    for (const field of ["os", "cpu", "libc"] as const) {
-      const list = raw.platform[field];
-      if (list !== undefined) {
-        if (
-          !Array.isArray(list) ||
-          !list.every((item: unknown) => typeof item === "string")
-        )
-          throw lockMismatch("invalid platform constraints");
-        platform[field] = list as string[];
-      }
-    }
-    const engines: Record<string, string> = {};
-    if (raw.engines !== undefined) {
-      if (!record(raw.engines))
-        throw lockMismatch("invalid engine constraints");
-      for (const [name, value] of Object.entries(raw.engines)) {
-        if (typeof value !== "string")
-          throw lockMismatch("invalid engine constraint");
-        engines[name] = value;
-      }
-    }
-    nodes.push({
-      key,
-      ...identity,
-      sourceId: raw.source as string,
-      tarballUrl: raw.tarball,
-      bin,
-      engines,
-      platform,
-      edges,
-      peerBindings: peers,
-    });
-  }
-  const roots = Object.entries(ext.roots["."]).map(([name, target]) => {
-    if (
-      !packageName(name) ||
-      typeof target !== "string" ||
-      !nodes.some((node) => node.key === target)
-    )
-      throw lockMismatch("invalid importer root");
-    return { name, target: target as string };
-  });
-  try {
-    createGraphDoc(nodes.map((n) => ({ ...n, deps: n.edges })));
-  } catch {
-    throw lockMismatch("invalid dependency graph");
-  }
-  return { nodes, roots };
-}

package/src/install/metadata.ts

@@ -1,122 +0,0 @@
-/** Durable project roots and exact physical instances (SPEC 14.4, 18, 30). */
-import { stat } from "node:fs/promises";
-import * as path from "node:path";
-import {
-  openStoreDb,
-  recordSource,
-  recordObject,
-  withTransaction,
-} from "../store/db.ts";
-import { Store } from "../store/layout.ts";
-import { readSourceManifest } from "../store/manifests.ts";
-import { contextIdFor, graphHash, type GraphDoc } from "../store/graph.ts";
-import type { RealizeResult } from "../store/realize.ts";
-import { sha512Hex } from "../util/hash.ts";
-import { STORE_FORMAT_VERSION } from "../version.ts";
-
-export async function registerGeneration(options: {
-  store: Store;
-  project: string;
-  projectId: string;
-  generationId: string;
-  graph: GraphDoc;
-  realized: RealizeResult;
-  roots: readonly string[];
-  readiness: "ready" | "intentionally-unbuilt";
-}): Promise<{
-  instances: string[];
-  contexts: string[];
-  activate(): void;
-  close(): void;
-}> {
-  const { store, project, projectId, generationId, graph, realized } = options;
-  const db = openStoreDb(store.paths.dbFile);
-  try {
-    for (const node of graph.nodes) {
-      const doc = await readSourceManifest(store, node.sourceId);
-      const m = doc.manifest;
-      recordSource(db, {
-        sourceId: m.sourceId,
-        sourceType: "registry",
-        name: m.name,
-        version: m.version,
-        origin: m.origin,
-        integrity: m.integrity,
-        manifestHash: doc.manifestHash,
-        extractionPolicyVersion: m.extractionPolicyVersion,
-        logicalBytes: m.totals.logicalBytes,
-        fileCount: m.totals.files,
-        entryCount: m.entries.length,
-        verifiedAt: doc.provenance.verifiedAt,
-      });
-      for (const entry of m.entries)
-        if (entry.type === "file")
-          recordObject(db, {
-            objectId: entry.objectId,
-            innerDigest: entry.innerDigest,
-            modeClass: entry.mode,
-            bytes: entry.size,
-            committedAt: doc.provenance.verifiedAt,
-          });
-    }
-    const now = new Date().toISOString();
-    const fs = await stat(project);
-    const contexts: string[] = [];
-    const instances: string[] = [];
-    withTransaction(db, () => {
-      db.prepare(
-        "INSERT INTO projects(project_id,canonical_path,fs_dev,fs_ino,created_at,last_seen_at) VALUES(?,?,?,?,?,?) ON CONFLICT(project_id) DO UPDATE SET last_seen_at=excluded.last_seen_at",
-      ).run(projectId, project, String(fs.dev), String(fs.ino), now, now);
-      db.prepare(
-        "INSERT INTO generations(generation_id,project_id,graph_digest,readiness,state,created_at) VALUES(?,?,?,?,'pending',?)",
-      ).run(generationId, projectId, graphHash(graph), options.readiness, now);
-      for (const node of graph.nodes) {
-        const context = contextIdFor(graph, node.key);
-        const directory = realized.realizationDirByKey.get(node.key)!;
-        const instance = `inst1_${sha512Hex(directory).slice(0, 32)}`;
-        contexts.push(context);
-        instances.push(instance);
-        db.prepare(
-          "INSERT INTO realizations(context_id,descriptor_hash,source_id,readiness,store_format,created_at) VALUES(?,?,?,'ready',?,?) ON CONFLICT(context_id) DO NOTHING",
-        ).run(context, context, node.sourceId, STORE_FORMAT_VERSION, now);
-        db.prepare(
-          "INSERT INTO realization_instances(instance_id,context_id,path,verification_state,created_at) VALUES(?,?,?,'verified',?) ON CONFLICT(instance_id) DO NOTHING",
-        ).run(instance, context, directory, now);
-        db.prepare(
-          "INSERT INTO generation_instances(generation_id,context_id,instance_id,direct_link) VALUES(?,?,?,?) ON CONFLICT(generation_id,context_id) DO NOTHING",
-        ).run(
-          generationId,
-          context,
-          instance,
-          options.roots.includes(node.key) ? 1 : 0,
-        );
-      }
-      db.prepare(
-        "INSERT INTO roots(root_id,project_id,generation_id,kind,state,created_at) VALUES(?,?,?,'pending','active',?)",
-      ).run(`root1_${generationId}`, projectId, generationId, now);
-    });
-    return {
-      contexts,
-      instances,
-      activate() {
-        withTransaction(db, () => {
-          db.prepare(
-            "UPDATE generations SET state='rollback' WHERE project_id=? AND state='active' AND generation_id<>?",
-          ).run(projectId, generationId);
-          db.prepare(
-            "UPDATE generations SET state='active',activated_at=? WHERE generation_id=?",
-          ).run(new Date().toISOString(), generationId);
-          db.prepare(
-            "UPDATE roots SET kind='generation' WHERE generation_id=?",
-          ).run(generationId);
-        });
-      },
-      close() {
-        db.close();
-      },
-    };
-  } catch (cause) {
-    db.close();
-    throw cause;
-  }
-}

package/src/install/registry.ts

@@ -1,88 +0,0 @@
-/** Fail closed on registry settings the current single-registry adapter cannot honor. */
-import { readFile } from "node:fs/promises";
-import * as path from "node:path";
-import * as os from "node:os";
-import { ZyrkError } from "../errors.ts";
-import { RegistryClient, DEFAULT_REGISTRY } from "../fetch/registry.ts";
-import { isErrno } from "../util/fsx.ts";
-import { cleanUrl } from "./lock.ts";
-
-export async function installRegistry(options: {
-  cwd: string;
-  env: NodeJS.ProcessEnv;
-  version: string;
-  registry?: string;
-}): Promise<RegistryClient> {
-  let registry = DEFAULT_REGISTRY;
-  const home = options.env.HOME ?? os.homedir();
-  const files = [
-    options.env.npm_config_userconfig ?? path.join(home, ".npmrc"),
-    path.join(options.cwd, ".npmrc"),
-  ];
-  for (const file of files) {
-    let text: string;
-    try {
-      text = await readFile(file, "utf8");
-    } catch (cause) {
-      if (isErrno(cause, "ENOENT")) continue;
-      throw new ZyrkError(
-        "ZYRK_POLICY_DENIED",
-        "Cannot read npm registry configuration.",
-        {
-          remedy: "Make the user and project .npmrc readable before retrying.",
-        },
-      );
-    }
-    for (const line of text.split(/\r?\n/)) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";"))
-        continue;
-      const index = trimmed.indexOf("=");
-      const key = trimmed.slice(0, index).trim();
-      const value = trimmed.slice(index + 1).trim();
-      if (key === "registry") registry = value;
-      if (/^@.+:registry$/.test(key))
-        throw new ZyrkError(
-          "ZYRK_POLICY_DENIED",
-          "Scoped registry routing is not supported by project install yet.",
-          {
-            remedy:
-              "Use npm for mixed-registry projects; zyrk will not silently fetch a private scope from a public registry.",
-          },
-        );
-      if (key === "strict-ssl" && value === "false")
-        throw new ZyrkError(
-          "ZYRK_POLICY_DENIED",
-          "Disabling registry TLS verification is not supported.",
-          {
-            remedy:
-              "Configure a trusted HTTPS registry with valid TLS certificates.",
-          },
-        );
-    }
-  }
-  registry = options.registry ?? options.env.npm_config_registry ?? registry;
-  if (!cleanUrl(registry))
-    throw new ZyrkError(
-      "ZYRK_POLICY_DENIED",
-      "Registry URL must be HTTP(S) without credentials, query parameters, or fragments.",
-      {
-        remedy:
-          "Use a credential-free registry URL. Authenticated private registries are not supported by project install yet.",
-      },
-    );
-  const url = new URL(registry);
-  if (
-    url.protocol !== "https:" &&
-    !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
-  )
-    throw new ZyrkError(
-      "ZYRK_POLICY_DENIED",
-      "Remote registries require HTTPS.",
-      {
-        remedy:
-          "Select an HTTPS registry; HTTP is limited to loopback development registries.",
-      },
-    );
-  return new RegistryClient({ registry, userAgent: `zyrk/${options.version}` });
-}