zyrk 0.4.8 → 0.4.9

package/README.md

@@ -141,8 +141,11 @@ zyrk add package-name                # edit this importer, preserve other select
 
 Frozen/offline installs, live peers, patches, mutable registry packages, inspection,
 and repair have workspace fixtures. Builds that reach live workspace sources are
-blocked before execution. Workspace npm-lock adoption and portable workspace
-export still need adapters and fail explicitly. Recursive execution supports
+blocked before execution. Existing npm v2/v3 workspace `package-lock.json` selections can be adopted with
+`zyrk import --from npm`, preserving exact versions, aliases and live members.
+Adoption validates the complete graph before project changes; npm shrinkwrap
+precedence and unsupported bundled/external links fail explicitly. Portable
+workspace export still needs its adapter. Recursive execution supports
 member scripts; filters are exact names or paths, not arbitrary glob expressions.
 
 ### Run a one-off tool

package/VERSION

@@ -1 +1 @@
-v0.4.8
+v0.4.9

package/dist/install/import-npm-workspace.d.ts

@@ -0,0 +1,5 @@
+import type { NpmLockDoc } from "../lockfile/types.ts";
+import type { WorkspaceProject } from "./workspaces.ts";
+import type { WorkspaceGraph } from "./workspace-graph.ts";
+export declare function importNpmWorkspaceLock(doc: NpmLockDoc, project: WorkspaceProject, origin: string): WorkspaceGraph;
+//# sourceMappingURL=import-npm-workspace.d.ts.map

package/dist/install/import-npm-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-npm-workspace.d.ts","sourceRoot":"","sources":["../../src/install/import-npm-workspace.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,GACb,cAAc,CAyThB"}

package/dist/install/import-npm-workspace.js

@@ -0,0 +1,283 @@
+/** Translate npm's physical virtual tree without selecting new registry versions. */
+import * as path from "node:path";
+import { satisfies } from "semver";
+import { validateLockDoc } from "../lockfile/read.js";
+import { sha512Hex } from "../util/hash.js";
+import { canonicalJson } from "../util/json.js";
+import { importNpmLock } from "./import-npm.js";
+import { lockMismatch, cleanUrl } from "./lock.js";
+import { ZyrkError } from "../errors.js";
+import { assertWorkspacePlatform } from "./workspace-graph.js";
+export function importNpmWorkspaceLock(doc, project, origin) {
+    if (!doc ||
+        typeof doc !== "object" ||
+        Array.isArray(doc) ||
+        !doc.packages ||
+        typeof doc.packages !== "object" ||
+        Array.isArray(doc.packages) ||
+        Object.values(doc.packages).some((e) => !e || typeof e !== "object" || Array.isArray(e)))
+        throw lockMismatch("npm workspace lock has malformed package entries");
+    const portable = structuredClone(doc);
+    // Relative file declarations are representable only when they name a
+    // discovered live importer. Validate their targets before URL validation.
+    const importerIds = new Set(project.importers.map((i) => (i.id === "." ? "" : i.id)));
+    for (const [location, entry] of Object.entries(portable.packages ?? {}))
+        for (const group of [
+            "dependencies",
+            "devDependencies",
+            "optionalDependencies",
+            "peerDependencies",
+        ])
+            if (entry[group] && typeof entry[group] === "object")
+                for (const [name, spec] of Object.entries(entry[group]))
+                    if (typeof spec === "string" && spec.startsWith("file:")) {
+                        const relative = spec.slice(5);
+                        if (!importerIds.has(location) ||
+                            relative.startsWith("/") ||
+                            relative.includes("\\") ||
+                            /^[A-Za-z]:/.test(relative) ||
+                            !importerIds.has(path.posix.normalize(path.posix.join(location, relative))))
+                            throw lockMismatch("npm file declaration is not a declared workspace");
+                        entry[group][name] = "workspace:*";
+                    }
+    // npm v2 also has a redundant legacy dependency view. Do not adopt a
+    // second authority; it is still scanned for unsafe metadata.
+    const sanitizeLegacyLinks = (value) => {
+        if (typeof value === "string" &&
+            value.startsWith("file:") &&
+            importerIds.has(value.slice(5)))
+            return "workspace:*";
+        if (Array.isArray(value))
+            return value.map(sanitizeLegacyLinks);
+        if (value && typeof value === "object")
+            return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+                key,
+                sanitizeLegacyLinks(child),
+            ]));
+        return value;
+    };
+    if (portable.dependencies)
+        portable.dependencies = sanitizeLegacyLinks(portable.dependencies);
+    validateLockDoc(portable, "package-lock.json");
+    if (doc.zyrk ||
+        ![2, 3].includes(doc.lockfileVersion ?? 0) ||
+        !doc.packages ||
+        !cleanUrl(origin))
+        throw lockMismatch("workspace adoption needs an unannotated npm v2/v3 lock");
+    const packages = doc.packages;
+    const graph = { nodes: [], importers: {}, omissions: [] };
+    const locations = new Map();
+    const local = new Map(project.importers.map((i) => [i.id === "." ? "" : i.id, i]));
+    for (const [location, entry] of Object.entries(packages)) {
+        if (location.includes("\\") ||
+            location.startsWith("/") ||
+            location.split("/").some((s) => s === ".." || s === ".") ||
+            location.includes("\0"))
+            throw lockMismatch("unsafe npm package location");
+        if (entry.link === true &&
+            (typeof entry.resolved !== "string" ||
+                !local.has(entry.resolved) ||
+                entry.resolved === ""))
+            throw lockMismatch("npm link does not select a declared workspace");
+        if (entry.inBundle === true)
+            throw lockMismatch("bundled npm selections are unsupported");
+    }
+    for (const [location, importer] of local) {
+        const entry = packages[location];
+        if (!entry || entry.link)
+            throw lockMismatch("npm lock lacks a workspace importer");
+        for (const field of [
+            "dependencies",
+            "devDependencies",
+            "optionalDependencies",
+            "peerDependencies",
+            "peerDependenciesMeta",
+            "workspaces",
+        ])
+            if (canonicalJson(entry[field] ?? {}) !==
+                canonicalJson(importer.manifest[field] ?? {}))
+                throw lockMismatch("npm workspace manifest declarations differ");
+        if (location &&
+            ((entry.name !== undefined && entry.name !== importer.manifest.name) ||
+                entry.version !== importer.manifest.version))
+            throw lockMismatch("npm workspace identity differs");
+        const node = {
+            kind: "local",
+            key: `workspace:${importer.id}`,
+            name: importer.manifest.name ?? "workspace-root",
+            version: importer.manifest.version ?? "0.0.0",
+            importer: importer.id,
+            edges: [],
+            peers: {},
+            optionalPeers: [],
+        };
+        graph.importers[importer.id] = node.key;
+        graph.nodes.push(node);
+        locations.set(location, node);
+    }
+    const find = (from, name) => {
+        let current = from;
+        for (;;) {
+            if (!current.endsWith("node_modules")) {
+                const slot = `${current ? current + "/" : ""}node_modules/${name}`;
+                if (Object.hasOwn(packages, slot))
+                    return slot;
+            }
+            if (!current)
+                return undefined;
+            current = current.includes("/")
+                ? current.slice(0, current.lastIndexOf("/"))
+                : "";
+        }
+    };
+    const populated = new Set();
+    const load = (location, name, spec, from) => {
+        const entry = packages[location];
+        if (entry.link === true) {
+            const target = locations.get(entry.resolved);
+            const range = spec.startsWith("workspace:") ? spec.slice(10) : spec;
+            if (spec.startsWith("file:")
+                ? path.posix.normalize(path.posix.join(from, spec.slice(5))) !==
+                    (target.kind === "local" ? target.importer : "")
+                : name !== target.name ||
+                    (!["*", "^", "~"].includes(range) &&
+                        !satisfies(target.version, range)))
+                throw lockMismatch("npm workspace link disagrees with requirement");
+            return target;
+        }
+        // Reuse the strict single-selection adapter's archive, alias, source and
+        // platform validation. Dependencies are wired below using npm locations.
+        const shallow = { ...entry };
+        delete shallow.dependencies;
+        delete shallow.optionalDependencies;
+        delete shallow.peerDependencies;
+        const selected = importNpmLock({
+            lockfileVersion: 3,
+            packages: { "": {}, [`node_modules/${name}`]: shallow },
+        }, { [name]: spec }, origin).nodes[0];
+        let node = locations.get(location);
+        if (!node) {
+            const { peerBindings: _bindings, ...source } = selected;
+            node = {
+                ...source,
+                key: `${selected.name}@${selected.version}#${sha512Hex(location).slice(0, 16)}`,
+                kind: "registry",
+                edges: [],
+                peers: {},
+                optionalPeers: [],
+            };
+            assertWorkspacePlatform({ nodes: [node], importers: {}, omissions: [] });
+            graph.nodes.push(node);
+            locations.set(location, node);
+        }
+        try {
+            populate(location, node);
+        }
+        catch (cause) {
+            populated.delete(location);
+            locations.delete(location);
+            graph.nodes = graph.nodes.filter((n) => n !== node);
+            throw cause;
+        }
+        return node;
+    };
+    const populate = (location, node) => {
+        if (populated.has(location))
+            return;
+        if (populated.size >= 10000)
+            throw lockMismatch("npm import resource limit exceeded");
+        populated.add(location);
+        const entry = packages[location];
+        const requirements = new Map();
+        for (const [field, kind] of [
+            ["dependencies", "prod"],
+            ["devDependencies", "dev"],
+            ["optionalDependencies", "optional"],
+            ["peerDependencies", "peer"],
+        ]) {
+            if (kind === "dev" && node.kind !== "local")
+                continue;
+            const values = entry[field];
+            if (values === undefined)
+                continue;
+            if (!values || typeof values !== "object" || Array.isArray(values))
+                throw lockMismatch("invalid npm dependency declarations");
+            for (const [name, spec] of Object.entries(values)) {
+                if (typeof spec !== "string")
+                    throw lockMismatch("invalid npm dependency requirement");
+                // A peer declaration does not replace an existing regular dependency.
+                if (kind !== "peer" || !requirements.has(name))
+                    requirements.set(name, { spec, kind });
+            }
+        }
+        for (const [name, requirement] of requirements) {
+            const meta = entry.peerDependenciesMeta;
+            const optionalPeer = requirement.kind === "peer" && meta?.[name]?.optional === true;
+            if (optionalPeer)
+                node.optionalPeers.push(name);
+            const targetLocation = find(location, name);
+            if (targetLocation === undefined) {
+                if (optionalPeer) {
+                    node.peers[name] = null;
+                    continue;
+                }
+                if (requirement.kind === "optional")
+                    continue;
+                throw lockMismatch("npm workspace lock is missing a required selection");
+            }
+            let target;
+            try {
+                target = load(targetLocation, name, requirement.spec, location);
+            }
+            catch (cause) {
+                if (requirement.kind === "optional" &&
+                    cause instanceof ZyrkError &&
+                    cause.code === "ZYRK_PLATFORM_UNSUPPORTED") {
+                    graph.omissions.push({ name, parent: node.key, reason: "platform" });
+                    continue;
+                }
+                throw cause;
+            }
+            node.edges.push({ name, target: target.key, ...requirement });
+            if (requirement.kind === "peer")
+                node.peers[name] = target.key;
+        }
+        // npm allows the same name in dependencies and peerDependencies. Its
+        // ordinary edge keeps its kind, but the peer range and binding still apply.
+        const peers = entry.peerDependencies;
+        const meta = entry.peerDependenciesMeta;
+        for (const [name, spec] of Object.entries(peers ?? {})) {
+            if (Object.hasOwn(node.peers, name))
+                continue;
+            const optional = meta?.[name]?.optional === true;
+            if (optional)
+                node.optionalPeers.push(name);
+            const targetLocation = find(location, name);
+            if (targetLocation === undefined) {
+                if (!optional)
+                    throw lockMismatch("npm workspace lock is missing a required peer");
+                node.peers[name] = null;
+                continue;
+            }
+            const target = load(targetLocation, name, spec, location);
+            node.peers[name] = target.key;
+            if (!node.edges.some((edge) => edge.name === name))
+                node.edges.push({ name, target: target.key, kind: "peer", spec });
+        }
+    };
+    for (const [location] of local)
+        populate(location, locations.get(location));
+    const reachable = new Set(), pending = Object.values(graph.importers), byKey = new Map(graph.nodes.map((n) => [n.key, n]));
+    while (pending.length) {
+        const key = pending.pop();
+        if (reachable.has(key))
+            continue;
+        reachable.add(key);
+        for (const edge of byKey.get(key).edges)
+            pending.push(edge.target);
+    }
+    graph.nodes = graph.nodes.filter((n) => reachable.has(n.key));
+    graph.omissions = graph.omissions.filter((o) => reachable.has(o.parent));
+    graph.nodes.sort((a, b) => a.key.localeCompare(b.key));
+    return graph;
+}

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA8E9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAmpBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAopBxB"}

package/dist/install/workspace-install.js

@@ -4,6 +4,7 @@ import { constants } from "node:fs";
 import * as path from "node:path";
 import { discoverWorkspaces, findWorkspaceRoot, assertNoLiveSourceBuilds, } from "./workspaces.js";
 import { resolveWorkspaceGraph, workspaceRegistryOccurrences, workspaceContextId, assertWorkspacePlatform, } from "./workspace-graph.js";
+import { importNpmWorkspaceLock } from "./import-npm-workspace.js";
 import { readWorkspaceLock, workspaceLockDoc } from "./workspace-lock.js";
 import { publishWorkspaceProjection, recoverWorkspaceProjection, workspaceProjectionPaths, } from "./workspace-transaction.js";
 import { ZyrkError } from "../errors.js";
@@ -48,10 +49,40 @@ async function realDirectory(directory) {
     if (!st.isDirectory() || st.isSymbolicLink())
         throw lockMismatch("workspace control parent must be a real directory");
 }
+async function readNpmWorkspaceImport(root, project, options) {
+    if (options.frozen || options.offline)
+        throw lockMismatch("npm workspace adoption needs a non-frozen online install");
+    if (await pathExists(path.join(root, "npm-shrinkwrap.json")))
+        throw lockMismatch("npm-shrinkwrap.json takes npm precedence; workspace adoption currently supports package-lock.json only");
+    let npmDoc;
+    try {
+        npmDoc = JSON.parse(await readFile(path.join(root, "package-lock.json"), "utf8"));
+    }
+    catch {
+        throw lockMismatch("npm workspace adoption needs an existing readable JSON lock");
+    }
+    const graph = importNpmWorkspaceLock(npmDoc, project, options.registry.origin);
+    // Prove the complete graph and ordinary npm projection are representable
+    // before any project state is created. Actual policy fingerprints are added
+    // under the install lock after policy validation.
+    workspaceLockDoc(project, graph, {
+        manifest: project.manifestFingerprint,
+        scripts: scriptPolicyFingerprint(undefined),
+        config: configFingerprint({
+            registry: options.registry.origin,
+            linker: "shared",
+        }),
+    });
+    return graph;
+}
 export async function installWorkspaceProject(options) {
     const root = await findWorkspaceRoot(options.projectDir);
     if (!root)
         throw lockMismatch("no authoritative workspace root");
+    // Refuse untranslatable locks before creating control directories or
+    // recovering a previous generation. Revalidate under the project lock below.
+    if (options.importNpm)
+        await readNpmWorkspaceImport(root, await discoverWorkspaces(root), options);
     await realDirectory(path.join(root, ".zyrk-local"));
     const held = await acquireLock(path.join(root, ".zyrk-local/project.lock"), {
         name: "workspace install",
@@ -66,8 +97,6 @@ export async function installWorkspaceProject(options) {
             i.id,
             await readFile(path.join(i.directory, "package.json"), "utf8"),
         ])));
-        if (options.importNpm)
-            unsupported("Workspace npm-lock adoption needs its multi-importer adapter.");
         const mutation = await prepareWorkspaceMutation(project, options);
         if (manifest.overrides !== undefined ||
             manifest.bundledDependencies !== undefined ||
@@ -110,7 +139,12 @@ export async function installWorkspaceProject(options) {
                 ...(patchDigest ? { patches: patchDigest } : {}),
             }),
         };
-        let existing = await readWorkspaceLock(root, project, options.registry.origin), graph;
+        const imported = options.importNpm
+            ? await readNpmWorkspaceImport(root, project, options)
+            : undefined;
+        let existing = options.importNpm
+            ? null
+            : await readWorkspaceLock(root, project, options.registry.origin), graph = imported;
         if (existing) {
             const ext = existing.doc.zyrk;
             if (!mutation.changed &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,7 @@
   },
   "devDependencies": {
     "@npmcli/arborist": "10.0.3",
-    "@types/node": "^24.19.2",
+    "@types/node": "^26.6.5",
     "@types/semver": "^7.8.0",
     "prettier": "3.9.10",
     "typescript": "^7.0.2",