feat(cli): embed private dependency tarballs into Playwright code bundles [RED-855]

[sorccu]

Linear: RED-855

What

Adds a checks.embeddedPackages config option that embeds npm registry tarballs into the Playwright Check Suite code bundle at .checkly/embedded-packages/*.tgz, so runners can install packages they cannot fetch themselves (e.g. from a private registry that is only reachable from the customer's network). The runner half that serves the embedded tarballs through a local registry during install is a separate change (RED-856); do not cut a CLI release containing this feature before that runner support is deployed.

How

Three commits, one per layer (plus follow-ups: platform-independent npm-cache tests for Windows CI, and moving the tarball cache to node_modules/.cache/checkly):

1. Config option — checks.embeddedPackages?: string[] (package names embed every lockfile version; name@version pins an exact version), with runtime shape validation at config load and plumbing through ProjectParseOpts → Session for deploy/test/validate/pw-test/parse-project.
2. Services (src/services/embedded-packages/) — lockfile enumeration (pnpm-lock.yaml v6/v9, package-lock.json v2/v3, with precise reasons for git/file/workspace/integrity-less entries), .npmrc parsing with scope-aware registry resolution, nerf-dart auth matching and npm_config_* env layering, SRI integrity helpers, and a content-addressed per-user tarball cache with a read-only npm-cache (cacache) lookup tier.
3. Wiring — a memoized session-level materializer shared by validation and bundling; project validation resolves the configured entries against the lockfile before any bundling (grouped fatal diagnostics); Playwright bundling appends the verified tarballs at the contract path via explicit archive paths, independent of workspace layout.

Tarballs are always the verbatim registry artifact, verified against the lockfile's integrity hash, sourced through CLI cache → npm cacache → registry download (proxy-aware via the existing assignProxy helper, credentials redacted from errors). Downloads are cached under the workspace root's node_modules/.cache/checkly (persisted automatically by CI setups that cache node_modules; a per-user cache dir is the read/write fallback; CHECKLY_CACHE_DIR overrides), so nothing user-visible lands in the project outside node_modules. The pnpm store cannot serve as a source because it retains only unpacked per-file blobs, not original tarballs.

Wildcards (added after review of the initial version): entries may contain * wildcards — @acme/*, acme-*, @acme/*-utils — where each * matches any run of characters except /, so a pattern never crosses the scope separator; wildcards combine with exact version pins and resolve against the lockfile only. Matches a spec cannot embed are skipped (workspace members silently; git/file/URL and integrity-less dependencies via a non-fatal warning diagnostic, since the runner must fetch those itself), while a spec whose only matches cannot be embedded — or that matches nothing — remains an error. Each wildcard announces what it selected during bundling. Excluded lockfile entries now carry a structured kind (workspace vs unfetchable), with npm/pnpm links pointing outside the workspace classified as unfetchable.

Deliberate v1 limits (documented; follow-ups tracked in Linear): only explicitly listed packages are embedded (no auto-detection, including transitive private deps — see the stacked follow-up PR), no yarn/bun lockfiles, .npmrc proxy/cafile/strict-ssl keys not honored (proxy env vars work).

Testing

• 110+ new unit tests (spec parsing, npmrc/registry/auth, lockfile enumeration, cache, materializer against a local HTTP registry covering auth, integrity mismatch, cache tiers).
• Offline integration tests: fixtures with committed deterministic tarballs pre-seeded into a temp CHECKLY_CACHE_DIR assert the archive contains the contract paths (including subdirectory Playwright configs and version-pin filtering) and that a package missing from the lockfile fails validation.
• Full suite: 1966 passed (including 30+ wildcard parse/match/plan tests). Manual smoke test against registry.npmjs.org: bundled tarball byte-identical to the lockfile integrity; warm-cache re-run skips the download.

🤖 Generated with Claude Code