Phase 60: lpm add source delivery from any registry

[tolgaergin]

Summary

lpm add <pkg> now works for any package on any registry the rust client can reach (lpm.dev worker, npmjs.org direct, .npmrc-declared private registries) — not just @lpm.dev/owner.name. Two paths inside the command, decided after extraction:

• Rich path (lpm.config.json present): existing behavior — schema prompts, conditional file filtering, conditional dependency installation, importAlias-aware rewrite.
• Simple path (no lpm.config.json): "download manager" — copy source files verbatim under --path, rewrite imports, NO automatic dep install. Surfaces external/bare imports the user needs to add to their own package.json.

What changed

Identity model — new AddTarget { Lpm(PackageName) | Npm { spec } } enum decouples lpm add from the LPM-only PackageName validator. Bare/dotted/non-@lpm.dev/ inputs flow to AddTarget::Npm verbatim.

Correctness fix — drops the dotted-name auto-prepend. Pre-Phase-60, lodash.merge / lodash.debounce / tolga.foo were silently rewritten to @lpm.dev/<name> (which doesn't exist on lpm.dev). Per the firm naming rule "only @lpm.dev/owner.name identifies an lpm.dev-hosted package," dotted bare names now flow through npm routing.

.npmrc setup parity with install — RouteTable::from_env_and_filesystem builds early; npmrc warnings + the strict-ssl=false security warning surface unconditionally; clone_with_config().with_tls_overrides(...) ensures cafile= / strict-ssl=false take effect on add's metadata + tarball fetches.

Routed metadata + file-spool tarball — client.download_tarball_routed (D2 promoted helper) + lpm_extractor::extract_tarball_from_file. Bounded memory (MAX_COMPRESSED_TARBALL_SIZE 500 MB) for free; lpm add typescript (~22 MB) and worst-case @scope/giant-fixture no longer load whole tarballs into RAM.

Version-spec resolution — new PackageMetadata::resolve_version_spec covers dist-tag (react@beta, next@canary), exact, and semver-range (lodash@^4). Pre-Phase-60 these all failed because metadata.version() was a pure HashMap lookup. Helper landed in lpm-registry; add consumes it; install/install_global/update_global/global migration deferred to Phase 60.1 to avoid behavior drift.

Destination-side path containment — new resolve_safe_dest rejects absolute paths, .. components, existing-symlink destinations, and intermediate symlinks pointing outside target_dir. Wired into the file-copy loop. Includes an audit fix (commit 5b90507) reordering the helper so all rejects run BEFORE any create_dir_all — pre-fix, ../absolute attacks left stray external directories on disk even though file writes were blocked.

Dep gate + bare-imports notice — dep auto-install now requires lpm.config.json to be present. Simple path is download-manager: copy bytes, surface external imports via the new import_rewriter::collect_bare_specifiers (sibling to rewrite_imports, sharing a SpecifierKind classifier so "bare" never drifts between them).

Non-interactive simple-path guard — --yes / --json / non-TTY without --path errors before any file write. Heuristically defaulting to components/ for arbitrary 3rd-party source under non-interactive use is a CI/automation footgun.

D2 prep refactor (behavior-preserving) — promotes download_tarball_routed and download_tarball_streaming_routed from private install.rs helpers to public methods on RegistryClient. Both install and add consume the same Custom-route auth-attachment logic. 602/602 install + npmrc tests still pass after the switch.

Test plan

• cargo clippy --workspace -- -D warnings clean
• cargo fmt --check clean
• cargo build --workspace clean
• cargo nextest run --workspace --exclude lpm-integration-tests --no-fail-fast — 4926/4926 pass (was 4882 pre-phase-60; +44 new tests)
• No fancy-regex introduced
• Behavior-preserving on D2: 602/602 install + npmrc tests still green after promoting routed helpers
• Phase 60 install regression sanity check: greedy-fusion median 919 ms on n=10 vs Phase 56 W4 baseline 938 ms — well within the 850-1050 ms acceptance band; all fusion gates PASS (hard ≤1500 ms, stretch ≤1000 ms, stdev 174 ms ≤ 500 ms). Phase 60 doesn't touch the resolver, so this confirms the expected null result.

Phase 60.1 follow-ups (queued, not blocking merge)

• Land 5 deferred integration tests (Phase 35 — Lazy auth + SessionManager #1 LPM rich, fix(install): dedupe Phase 40 P4 split-context packages (unblocks Phase 41) #2 npm rich, fix(registry): honor --insecure end-to-end on tarball paths + Phase 43 gate #6 npmrc auth, Phase 46.0 — tiered script-policy gate (v0.23.0 released) #7 strict-ssl, feat(phase-49): client-side streaming BFS resolver #8 missing-var fatal) — the underlying machinery is already covered by Phase 58.x install tests, but worth having in add's own test surface
• Migrate install_global / install / update_global / global version-spec resolution to call the new PackageMetadata::resolve_version_spec helper
• Audit user-facing lpm add owner.thing examples (README/marketing/blog/vision docs) — owner-task

Out of scope (recommended as a separate PR)

Flipping the global install resolver default from PubGrub → greedy-fusion. Today's logic at install.rs:3825-3826 is LPM_RESOLVER == "greedy" && LPM_GREEDY_FUSION != "0" — fusion is the default for the greedy arm, not globally. Phase 56 W4 made greedy-fusion the default for that arm (and it's the default in our bench harness). Flipping it as the global install default touches every user who today runs lpm install without env vars — that's its own ship-gate (n=20+ bench, edge-case resolution audit on currently-PubGrub-default users) and shouldn't be bundled with lpm add source-anywhere. Strongly recommend a follow-up PR.

🤖 Generated with Claude Code