Add reproducible browser dependency resolution and caching

[robinbraemer]

Outcome

Resolve and cache browser-compatible npm dependencies reproducibly for Flect authoring without executing arbitrary package installation code.

Provide:

• a provider-neutral Effect package-resolution service;
• exact version and export-condition resolution;
• an integrity-bearing lock representation;
• safe package retrieval and archive extraction;
• OPFS content-addressed caching;
• offline reuse after a successful install;
• duplicate and conflicting dependency diagnostics; and
• explicit rejection of native packages, lifecycle scripts, and unsupported conditions.

Exclusions

• Executing postinstall, arbitrary package-manager scripts, native addons, or downloaded binaries.
• Promising compatibility with every npm package.
• Making one public CDN a permanent Flect dependency.

Acceptance criteria

• Browser tests resolve a nested dependency graph with ESM and CommonJS inputs.
• Repeating a locked build offline uses only verified cached content.
• Integrity mismatches, traversal entries, archive bombs, unsupported native packages, and dependency cycles fail with typed errors.
• The provider can be changed without modifying the builder or capsule format.
• Lock changes are attributable and reviewable as part of an interface revision.

[robinbraemer]

Product-quality coverage: FQ-08.2 through FQ-08.4, FQ-09.2, FQ-11.8, FQ-15.6, FQ-17.8, FQ-24.1, and FQ-24.6.

[robinbraemer]

Implemented and verified the first reproducible browser dependency-cache slice in the active worktree:

• typed Effect resolver and cache services
• exact input digest over package.json plus optional package-lock.json
• pinned Rifty installer in a disposable VFS; integrity checks, traversal guards, and no lifecycle scripts
• npm v3 lock validation with exact semver, SHA-512 integrity, and approved-registry HTTPS tarball sources
• bounded node_modules graph with lock/file/aggregate SHA-256 digests
• object-first content-addressed OPFS persistence and validated input-to-graph binding
• failed integrity checks create no cache entry
• ProposalBuild replaces source dependency directories with the verified graph and binds its digest into the persisted build artifact

Passing evidence:

• focused resolver, cache-path, proposal integration, build-store, and compiler unit tests
• TypeScript project build
• production Chromium warms the graph, disables browser networking, reuses it with no provider call, reloads into a new runtime, and restores it from OPFS with zero provider calls

Evidence: docs/verification/2026-08-01-browser-package-verification.md

Issue remains open for user-facing lock conflict/provenance/cache-management UX, broader peer/optional/package compatibility, framework import integration, and supported packaged-WebView offline proof.

[robinbraemer]

Progress on 2026-08-01: standard Vite React import now derives an inert runtime-only manifest, resolves exact npm packages through the credential-free HTTPS broker, verifies npm v3 lock integrity, stores the content-addressed graph in OPFS, and reuses it after reload with registry requests blocked. The accepted capsule records the dependency graph digest. Remaining: reviewable generated-lock persistence in canonical Git, peer/optional/nested/cycle compatibility, conflict and migration UX, eviction/quota behavior, and packaged-host proof.

[robinbraemer]

2026-08-01 reviewability update:

Lock changes are now attributable source state. ProposalBuild resolves against the exact guarded proposal, passes an existing lock back into resolution, and reports whether the verified v3 lock differs. Flect checkpoints a new/changed lock as project/package-lock.json on flect/authoring, supersedes the candidate through the receipt-guarded Shaper transaction, and compiles only the resulting proposal commit.

Production Chromium imports and keeps React 19.2.8, exports the complete repository, and ordinary Git reads the accepted lock plus SHA-512 integrity. The same journey then blocks npm registry access and rebuilds from verified cache with zero registry requests. Focused unit/controller and Chromium proofs pass; full unit gate is 566 passed (+1 intentional skip).

Still open here: broader nested ESM/CommonJS fixtures, explicit native/condition/cycle diagnostics, cache-management UX, and provider-swap proof.