Add zvelte-check-bin 0.2.0 (#509)

* Add zvelte-check-bin 0.2.0

A fast Svelte diagnostic tool written in Zig, from the ampcode/homebrew-tap
Homebrew formula. First package produced by `pkgmgr import homebrew`.

Prebuilt per-arch binaries from upstream's own GitHub releases. Both
sha256 values were RECOMPUTED from the downloaded bytes rather than
copied out of the formula, so the tap is a cross-check and not the root
of trust for the only value anchoring this package's integrity.

`strip_prefix` is absent because the archives are genuinely flat — read
off the real tarball (`tar -tzf` lists one entry, `zvelte-check`), not
guessed. Homebrew auto-strips a single leading directory before
`def install` and minimal does not, so this is unknowable from the
formula text.

Provenance is derived from the ARTIFACT URLs, which are literally
github.com/ampcode/zvelte-check/releases/..., and cross-checked against
the homepage. That buys real CPE identity (not a dark package) and free
version checking via the GitHub tier.

NOT a source build, and worth stating plainly: `zig` IS packaged, and
pkgs CLAUDE.md prefers building from source when the toolchain exists.
Prebuilt was chosen only because pkgmgr has no Zig BuildFlavor yet — not
because the toolchain is missing. Mitigating: these are upstream's own
release binaries, not a third-party redistribution, and we verify their
hashes ourselves. A source-built `zvelte-check` can take the bare name
later, which is why this one carries the `-bin` suffix.

No reviewer TODOs: licence, provenance, outputs and deps were all
resolved mechanically.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* zvelte-check-bin: drop glibc — the binary is statically linked

Refined against the real built tree with
`pkgmgr import homebrew … --from-build`, which reads the installed ELF
instead of guessing.

The binary is statically linked (`file`: "ELF 64-bit LSB executable,
ARM aarch64 … statically linked"), so it needs no runtime_deps at all.
The discovery-mode `[glibc]` was a template default, not an observation.

Verified by rebuilding: the package produces a new content-addressed
tree and a real 5 MB aarch64 binary at usr/bin/zvelte-check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* zvelte-check-bin: say it is a binary fetch — `binary_from` (review: @twitchyliquid64)

Tom's read is right: this installs upstream's release binaries, and nothing
in the spec said so. Without `binary_from` the package reads as source-built
from `source_provenance`, which is the same conflation that let chromium-bin
look like a build of microsoft/playwright.

Two halves of the comment, answered separately after checking the source
rather than the formula:

* `binary_from` — added, per arch, naming the exact artifacts we fetch.
* `closed_source` — deliberately NOT set. ampcode/zvelte-check is a public
  MIT repo with the Zig source in-tree (LICENSE, build.zig, src/), so
  declaring it closed would be false. The formula's silence is not evidence.

`source_provenance` is kept alongside `binary_from`, as chromium-bin does.
Here the two name the SAME project — ampcode builds these artifacts in its
own release workflow — so the repo is the honest identity of the bytes.
Dropping it would cost the CPE identity and the GitHub version-check tier,
i.e. turn a covered package into a dark one.

Verified: `mip check --packages zvelte-check-bin` all Pass, and
`mip dump --packages` resolves binary_from to a real per-arch URL.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: bryan-minimal

packages/zvelte-check-bin/build.ncl

@@ -0,0 +1,65 @@
+let { Attrs, BuildSpec, Local, OutputBin, Source, .. } = import "minimal.ncl" in
+let { target, .. } = import "config.ncl" in
+let base = import "../base/build.ncl" in
+
+# Imported from the Homebrew formula `ampcode/homebrew-tap/zvelte-check` by `pkgmgr import homebrew`.
+#
+# PREBUILT vendor binary — there is no source build. The pinned sha256
+# per architecture is the ONLY integrity anchor for this package.
+let version = "0.2.0" in
+let target_suffix = match { { arch = 'Amd64, .. } => "x86_64", { arch = 'Arm64, .. } => "aarch64" } target in
+{
+  name = "zvelte-check-bin",
+  build_deps = [
+    { file = "build.sh" } | Local,
+    match {
+      { arch = 'Amd64, .. } =>
+        {
+          url = "https://github.com/ampcode/zvelte-check/releases/download/v%{version}/zvelte-check-linux-x86_64.tar.gz",
+          sha256 = "f3326fe48a0a2bc056b16ce424abd705ca7864d3632fd8f02ace1ea8ecfc8b9b",
+        } | Source,
+      { arch = 'Arm64, .. } =>
+        {
+          url = "https://github.com/ampcode/zvelte-check/releases/download/v%{version}/zvelte-check-linux-aarch64.tar.gz",
+          sha256 = "05a2661648952ba12b2da618242698c3065d2db375340cb605288a38f59c4105",
+        } | Source,
+    } target,
+    base,
+  ],
+  # No runtime_deps: the installed binary is statically linked
+  # (verified against the built tree, not assumed).
+
+  cmd = "./build.sh",
+  build_args = { include version, arch = target_suffix },
+
+  outputs = {
+    zvelte-check = { glob = "usr/bin/zvelte-check" } | OutputBin,
+  },
+
+  attrs =
+    {
+      upstream_version = version,
+      license_spdx = "MIT",
+      # We install upstream's release BINARIES, not a build of the tree below.
+      # `binary_from` is what says so; without it the package reads as
+      # source-built from source_provenance, which is the exact conflation that
+      # let chromium-bin look like a build of microsoft/playwright.
+      binary_from =
+        match {
+          { arch = 'Amd64, .. } => "https://github.com/ampcode/zvelte-check/releases/download/v%{version}/zvelte-check-linux-x86_64.tar.gz",
+          { arch = 'Arm64, .. } => "https://github.com/ampcode/zvelte-check/releases/download/v%{version}/zvelte-check-linux-aarch64.tar.gz",
+        } target,
+      # Kept alongside `binary_from`, as chromium-bin does. Here the two are the
+      # SAME project — ampcode/zvelte-check builds these artifacts in its own
+      # release workflow — so the repo is the honest identity of the bytes, and
+      # dropping it would cost the CPE identity and the GitHub version-check
+      # tier, i.e. make this a dark package. `closed_source` deliberately absent:
+      # the repo is public and MIT with the Zig source in-tree (verified, not
+      # inferred from the formula).
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "ampcode",
+        repo = "zvelte-check",
+      },
+    } | Attrs,
+} | BuildSpec

packages/zvelte-check-bin/build.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+# Imported from the Homebrew formula `ampcode/homebrew-tap/zvelte-check` by `pkgmgr import homebrew`.
+# Prebuilt vendor binary: unpacked and installed, never compiled.
+set -ex
+
+tar -xof "zvelte-check-linux-${MINIMAL_ARG_ARCH}.tar.gz"
+install -D -m 755 "zvelte-check" "$OUTPUT_DIR/usr/bin/zvelte-check"