package manager: resolve `git:` and `archive:` sources

orion commented

2026-10-05 21:07:11 +00:00

Collaborator

Context

std/project reads git:, archive: and path: sources, but only registry and path dependencies resolve; torb refuses the others with "is not resolved yet" (compiler/src/cli/packages.trb, resolved). This issue resolves archive: sources and lays the shared groundwork (lock rows, resolver and cache plumbing); git: follows in a linked issue.

Source

ROADMAP.md, the package manager
PROJECT.md sections 7 and 11 (archive: row of the lock table: the URL and the content hash)
RELEASE.md section 7.5 (content-addressed cache, --offline)

Acceptance criteria

An archive: source is downloaded, unpacked with the registry's safety checks (unpacked) and checked against its manifest hash: (the tree hash, sha256:...); a mismatch is an error naming both hashes
The package's own project.trb is read from the unpacked tree; its name must equal the source name; its dependencies join the resolution like those of a path: package
The lock gets a row package "<name>", archive: "<canonical Uri text>", hash: "sha256:..."; readLock and renderLock round-trip it, ordering stays deterministic, existing locks are read unchanged
The unpacked tree is installed in the content-addressed cache under its tree hash; with --offline (or a warm cache) no network is touched, a cold cache gives the "would have to be fetched" error
torb install, build, check, lock --check, vendor accept the source; a lock row that no longer matches the manifest hash: is reported as a mismatch
Tests with a local archive served through a file: URL (no network): success, wrong hash, wrong package name, offline from cache
docs/tooling/project-lock-trb.md, project-trb.md and PROJECT.md "As built" updated; skills/ regenerated

Seed impact

None: ordinary compiler code on existing language features, no syntax change, no new native, no driver flag, no std name looked up by string. Lock format change is additive (new row kind), so no lock language bump.

Dependencies

#26 (project: read sources as Uri) is closed and landed; nothing else blocks.
Followed by the git: issue, which reuses the lock and cache plumbing of this one.

## Context `std/project` reads `git:`, `archive:` and `path:` sources, but only registry and path dependencies resolve; `torb` refuses the others with "is not resolved yet" (`compiler/src/cli/packages.trb`, `resolved`). This issue resolves **`archive:`** sources and lays the shared groundwork (lock rows, resolver and cache plumbing); `git:` follows in a linked issue. ## Source - [ROADMAP.md, the package manager](https://git.torb.dev/torbscript/language/src/branch/main/docs/ROADMAP.md) - [PROJECT.md sections 7 and 11](https://git.torb.dev/torbscript/language/src/branch/main/docs/design/PROJECT.md) (`archive:` row of the lock table: the URL and the content hash) - [RELEASE.md section 7.5](https://git.torb.dev/torbscript/language/src/branch/main/docs/design/RELEASE.md) (content-addressed cache, `--offline`) ## Acceptance criteria - [ ] An `archive:` source is downloaded, unpacked with the registry's safety checks (`unpacked`) and checked against its manifest `hash:` (the tree hash, `sha256:...`); a mismatch is an error naming both hashes - [ ] The package's own `project.trb` is read from the unpacked tree; its name must equal the `source` name; its dependencies join the resolution like those of a `path:` package - [ ] The lock gets a row `package "<name>", archive: "<canonical Uri text>", hash: "sha256:..."`; `readLock` and `renderLock` round-trip it, ordering stays deterministic, existing locks are read unchanged - [ ] The unpacked tree is installed in the content-addressed cache under its tree hash; with `--offline` (or a warm cache) no network is touched, a cold cache gives the "would have to be fetched" error - [ ] `torb install`, `build`, `check`, `lock --check`, `vendor` accept the source; a lock row that no longer matches the manifest `hash:` is reported as a mismatch - [ ] Tests with a local archive served through a `file:` URL (no network): success, wrong hash, wrong package name, offline from cache - [ ] `docs/tooling/project-lock-trb.md`, `project-trb.md` and PROJECT.md "As built" updated; `skills/` regenerated ## Seed impact None: ordinary compiler code on existing language features, no syntax change, no new native, no driver flag, no std name looked up by string. Lock format change is additive (new row kind), so no lock `language` bump. ## Dependencies - #26 (project: read sources as `Uri`) is closed and landed; nothing else blocks. - Followed by the `git:` issue, which reuses the lock and cache plumbing of this one.

orion added this to the Milestone 8: formatter, linter, language server, package manager milestone

2026-10-05 21:07:11 +00:00

orion added the

loop

label

2026-10-05 21:07:11 +00:00

orion commented

2026-10-06 16:46:12 +00:00

Author

Collaborator

[loop:torbscript] intake: in scope (author orion, label loop). Resolution of git: and archive: sources; declares a dependency on #2 (to be checked in refine, the stated link looks off: #2 is the lint manifest setting). Touches the lock and fetching, seed impact to settle in refine. Release freeze for 0.1.0 (2026-10-06) holds new PRs, next: waiting (dependency on #2, confirm in refine)

[loop:torbscript] intake: in scope (author orion, label loop). Resolution of `git:` and `archive:` sources; declares a dependency on #2 (to be checked in refine, the stated link looks off: #2 is the lint manifest setting). Touches the lock and fetching, seed impact to settle in refine. Release freeze for 0.1.0 (2026-10-06) holds new PRs, next: waiting (dependency on #2, confirm in refine)

orion commented

2026-10-10 12:12:17 +00:00

Author

Collaborator

Orion (orion/infra#1391): the dependency named in the intake note, #2, is closed (lint: choose the rules in the manifest) and unrelated to package sources, as the note itself suspected. Nothing blocks refine; the loop picks this up again.

orion commented

2026-10-12 08:23:47 +00:00

Author

Collaborator

[loop:torbscript] claim refine by session:loop-torbscript-20261012 until 2026-10-12T10:23Z

orion referenced this issue

2026-10-12 08:24:42 +00:00

package manager: resolve git: sources #322

orion commented

2026-10-12 08:24:50 +00:00

Author

Collaborator

[loop:torbscript] decided by the loop: (1) Size: archive and git together are too large for one PR (resolver, lock rows, fetch, cache, two fetch paths, tests, docs), so #27 is rescoped to archive: plus the shared plumbing, and git: is split into #322 (depends on #27). (2) Manifest hash: is the tree hash (sha256: form, same as registry archives), so the existing unpacked checks and the content-addressed cache are reused and a mirror may recompress. (3) Lock row for archives: archive: "<canonical Uri text>", hash:, additive, no lock language bump, old locks read unchanged. (4) Fetching uses the existing curl/wget path of fetch.trb; tests use a file: URL, no network. (5) Seed impact: none. (6) The stated dependency #26 is closed and landed; nothing blocks.

[loop:torbscript] decided by the loop: (1) Size: archive and git together are too large for one PR (resolver, lock rows, fetch, cache, two fetch paths, tests, docs), so #27 is rescoped to `archive:` plus the shared plumbing, and `git:` is split into #322 (depends on #27). (2) Manifest `hash:` is the tree hash (`sha256:` form, same as registry archives), so the existing `unpacked` checks and the content-addressed cache are reused and a mirror may recompress. (3) Lock row for archives: `archive: "<canonical Uri text>", hash:`, additive, no lock `language` bump, old locks read unchanged. (4) Fetching uses the existing curl/wget path of `fetch.trb`; tests use a `file:` URL, no network. (5) Seed impact: none. (6) The stated dependency #26 is closed and landed; nothing blocks.

orion referenced this issue

2026-10-12 08:24:50 +00:00

package manager: resolve git: sources #322

orion added the

ready

label

2026-10-12 08:24:50 +00:00

orion commented

2026-10-12 08:24:50 +00:00

Author

Collaborator

[loop:torbscript] refine: ready (rescoped to archive: and the shared plumbing, git: split to #322, tokens used ~60k), next: implement

[loop:torbscript] refine: ready (rescoped to `archive:` and the shared plumbing, `git:` split to #322, tokens used ~60k), next: implement

orion commented

2026-10-12 08:25:57 +00:00

Author

Collaborator

[loop:torbscript] claim implement by session:loop-torbscript-20261012 until 2026-10-12T14:25Z

orion commented

2026-10-12 11:04:03 +00:00

Author

Collaborator

[loop:torbscript] release: implement worker died on the account session limit before pushing a branch (resets 13:00 Berlin); respawning

orion commented

2026-10-12 11:04:04 +00:00

Author

Collaborator

[loop:torbscript] claim implement by session:loop-torbscript-20261012 until 2026-10-12T17:04Z

orion referenced this issue from a commit

2026-10-12 11:23:52 +00:00

feat(package): resolve archive: sources

orion referenced this issue from a pull request that will close it,

2026-10-12 11:24:01 +00:00

feat(package): resolve archive: sources #329

argus closed this issue

2026-10-12 12:05:46 +00:00

orion commented

2026-10-12 12:06:00 +00:00

Author

Collaborator

[loop:torbscript] implement: PR #329 open, CI green, next: review (merge gate)

PR: #329 (branch loop/27-archive-sources, 2 commits on main 7c1fcba3). CI run 895 green: bootstrap, tier A (incl. the package-manager transcript gate with the new archive-app section, and torb vendor), tier B, tools, same-C, playground, VS Code extension, pdisc.

Token usage: not metered exactly; about 0.4M since the last context compaction plus one full earlier context window.

[loop:torbscript] implement: PR #329 open, CI green, next: review (merge gate) PR: https://git.torb.dev/torbscript/language/pulls/329 (branch `loop/27-archive-sources`, 2 commits on main 7c1fcba3). CI run 895 green: bootstrap, tier A (incl. the package-manager transcript gate with the new archive-app section, and `torb vendor`), tier B, tools, same-C, playground, VS Code extension, pdisc. Token usage: not metered exactly; about 0.4M since the last context compaction plus one full earlier context window.

orion referenced this issue

2026-10-12 12:09:11 +00:00

package manager: resolve git: sources #322

orion referenced this issue

2026-10-12 12:44:28 +00:00

feat(package): resolve git: sources #330