@accio-ai/ecommerce-cli 0.0.1-rc.1

package/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+本文件记录 `@accio-ai/ecommerce-cli` 的版本变更，格式遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，版本号遵循 [Semantic Versioning](https://semver.org/lang/zh-CN/)。
+
+## [Unreleased]
+
+### Added
+
+- 新增相互隔离的正式版与 RC 发布入口；RC 自动使用 `-rc.N` 版本和 npm `rc` dist-tag，正式版固定使用 `latest`，两条通道共享完整 Windows 签名和安装验证门禁。
+- 将根目录 `VERSION` 设为唯一发布版本源；npm staging 和 Go release build 自动注入版本，不再要求同步修改 `package.json` 与 Go 源码。
+- 简化 Windows 签名交接：默认强制验证 Authenticode 与原始 payload，signer 证书 SHA-256 指纹改为可选加强项，不再要求每次发布手工输入。
+- 将 Windows 替换与最终验签合并为单一 finalize 入口；正式版和 RC publish 自动执行完整门禁并固定发布到 npmjs，dry-run 降为可选步骤。
+- 将公网 npm 包名统一为 `@accio-ai/ecommerce-cli`，固定使用 `accio-ai` scope、public access 和 npmjs registry。
+- 将 npm 分发改为 1 个主包加 6 个按 `os`/`cpu` 限制的平台包；安装时只下载当前平台二进制，发布时平台包先于主包。
+
+## [0.0.1] - 2026-08-31
+
+### Added
+
+- 新增 `ecomctl` Go CLI，提供 help、version、shell completion、text/JSON 输出及稳定的错误分类、标准流和退出码契约。
+- 新增编译期静态 adapter registry、显式 composition root 和强类型 application 边界；第一版不公开尚未确定业务语义的命令。
+- 新增 registry、adapter、输出、help/version、stdout/stderr、退出码、context 取消和依赖方向自动化测试。
+- 新增 GoReleaser 跨平台归档、macOS 原生 CGO/Code Trust 构建约束、SHA-256 checksums、本地 GPG checksum 签名入口和版本一致性门禁。
+- 新增 Windows amd64/arm64 Authenticode 离线交接、证书 SHA-256 指纹固定、signed/unsigned payload 绑定、双平台验签、raw/zip 原子替换、artifact/checksum 刷新和签名回执；正式 npm 发布必须通过 signed distribution 门禁。
+- 新增包含平台二进制的 `@accio-ai/ecommerce-cli` npm 包、`ecomctl` launcher、安装校验、本地 pack、隔离安装 smoke 与受保护的 publish 流程。
+- 新增调用完整源码、打包与安装门禁的 GitLab CI，并将 npm packaging 源码与 Windows signing 工具整理到职责明确的目录。
+- 新增架构、CLI、扩展新业务能力和发布流程文档。

package/README.md

@@ -0,0 +1,15 @@
+# @accio-ai/ecommerce-cli npm package
+
+This is the platform-independent launcher package for `ecomctl`.
+
+It declares six exact-version optional dependencies. npm uses each dependency's `os` and `cpu` fields to install only the matching platform package, so users do not download binaries for other operating systems or architectures.
+
+The platform package contains one statically compiled binary; this main package contains only the Node.js launcher, install checksum verification, README, and changelog. Installation does not read or write account state, credentials, user configuration, Agent skills, telemetry, or remote services.
+
+Supported targets:
+
+- macOS: arm64 and x64
+- Linux: arm64 and x64
+- Windows: arm64 and x64
+
+Run `ecomctl --help` after installation.

package/bin/ecomctl.cjs

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const childProcess = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const TARGETS = Object.freeze({
+  "darwin-arm64": { binary: "ecomctl" },
+  "darwin-x64": { binary: "ecomctl" },
+  "linux-arm64": { binary: "ecomctl" },
+  "linux-x64": { binary: "ecomctl" },
+  "win32-arm64": { binary: "ecomctl.exe" },
+  "win32-x64": { binary: "ecomctl.exe" },
+});
+
+const SIGNAL_EXIT_CODES = Object.freeze({
+  SIGHUP: 129,
+  SIGINT: 130,
+  SIGTERM: 143,
+  SIGBREAK: 149,
+});
+
+function platformKey(platform = process.platform, architecture = process.arch) {
+  const key = `${platform}-${architecture}`;
+  if (!TARGETS[key]) {
+    throw new Error(`unsupported platform ${key}`);
+  }
+  return key;
+}
+
+function basePackageName(packageRoot) {
+  const manifest = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+  return manifest.name;
+}
+
+function platformPackageName(
+  packageName,
+  platform = process.platform,
+  architecture = process.arch,
+) {
+  return `${packageName}-${platformKey(platform, architecture)}`;
+}
+
+function resolveBinaryPathForPackage(
+  packageName,
+  platform = process.platform,
+  architecture = process.arch,
+  resolveModule = require.resolve,
+) {
+  const key = platformKey(platform, architecture);
+  const manifestPath = resolveModule(
+    `${platformPackageName(packageName, platform, architecture)}/package.json`,
+  );
+  return path.join(path.dirname(manifestPath), TARGETS[key].binary);
+}
+
+function resolveBinaryPath(
+  packageRoot,
+  platform = process.platform,
+  architecture = process.arch,
+  resolveModule = require.resolve,
+) {
+  return resolveBinaryPathForPackage(
+    basePackageName(packageRoot),
+    platform,
+    architecture,
+    (specifier) => resolveModule(specifier, { paths: [packageRoot] }),
+  );
+}
+
+function run(args = process.argv.slice(2)) {
+  const packageRoot = path.resolve(__dirname, "..");
+  let key;
+  let packageName;
+  let platformPackage;
+  let binaryPath;
+  try {
+    key = platformKey();
+    packageName = basePackageName(packageRoot);
+    platformPackage = platformPackageName(packageName);
+    binaryPath = resolveBinaryPath(packageRoot);
+  } catch (error) {
+    if (!key) {
+      console.error(`ecomctl: ${error.message}`);
+    } else {
+      console.error(
+        `ecomctl: platform package ${platformPackage || key} is missing; reinstall ${packageName || "@accio-ai/ecommerce-cli"}`,
+      );
+    }
+    process.exitCode = 1;
+    return;
+  }
+  if (!fs.existsSync(binaryPath)) {
+    console.error(
+      `ecomctl: binary is missing from ${platformPackage}; reinstall ${packageName}`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  let child = null;
+  let pendingSignal = null;
+  let forwardedSignal = null;
+  let spawnFailed = false;
+  const signals =
+    process.platform === "win32"
+      ? ["SIGINT", "SIGTERM", "SIGBREAK"]
+      : ["SIGHUP", "SIGINT", "SIGTERM"];
+
+  function forwardSignal(signal) {
+    forwardedSignal = signal;
+    if (child === null) {
+      pendingSignal = signal;
+      return;
+    }
+    if (child.exitCode !== null || child.signalCode !== null) {
+      return;
+    }
+    try {
+      child.kill(process.platform === "win32" ? "SIGTERM" : signal);
+    } catch (error) {
+      console.error(`ecomctl: failed to forward ${signal}: ${error.message}`);
+    }
+  }
+
+  function removeSignalHandlers() {
+    for (const signal of signals) {
+      process.removeAllListeners(signal);
+    }
+  }
+
+  for (const signal of signals) {
+    process.on(signal, () => forwardSignal(signal));
+  }
+
+  child = childProcess.spawn(binaryPath, args, {
+    env: process.env,
+    stdio: "inherit",
+  });
+  if (pendingSignal !== null) {
+    const signal = pendingSignal;
+    pendingSignal = null;
+    forwardSignal(signal);
+  }
+
+  child.on("error", (error) => {
+    spawnFailed = true;
+    console.error(`ecomctl: failed to start binary: ${error.message}`);
+  });
+  child.on("close", (code, signal) => {
+    removeSignalHandlers();
+    if (spawnFailed) {
+      process.exitCode = 1;
+      return;
+    }
+    if (Number.isInteger(code)) {
+      process.exitCode = code;
+      return;
+    }
+    process.exitCode = SIGNAL_EXIT_CODES[signal || forwardedSignal] || 1;
+  });
+}
+
+if (require.main === module) {
+  run();
+}
+
+module.exports = {
+  SIGNAL_EXIT_CODES,
+  TARGETS,
+  basePackageName,
+  platformKey,
+  platformPackageName,
+  resolveBinaryPath,
+  resolveBinaryPathForPackage,
+  run,
+};

package/checksums.json

@@ -0,0 +1,35 @@
+{
+  "version": "0.0.1-rc.1",
+  "binaries": {
+    "darwin-arm64": {
+      "package": "@accio-ai/ecommerce-cli-darwin-arm64",
+      "file": "ecomctl",
+      "sha256": "cfc3e6221f67764d07dc203267aa007be903261fcdad3af4e7d518e226cc485d"
+    },
+    "darwin-x64": {
+      "package": "@accio-ai/ecommerce-cli-darwin-x64",
+      "file": "ecomctl",
+      "sha256": "a6c784bcf6e43450343df2c48d9cdb673b1e6579201b83490e5c800835e5abbf"
+    },
+    "linux-arm64": {
+      "package": "@accio-ai/ecommerce-cli-linux-arm64",
+      "file": "ecomctl",
+      "sha256": "b268f1d5f0d6379aecb748d353067f8f9ec1d229cd8894da4118003db5314ffb"
+    },
+    "linux-x64": {
+      "package": "@accio-ai/ecommerce-cli-linux-x64",
+      "file": "ecomctl",
+      "sha256": "66d64ea6c11245c495f7aaa83b43fb29f1b1a358e968861df6a383178c6b305d"
+    },
+    "win32-arm64": {
+      "package": "@accio-ai/ecommerce-cli-win32-arm64",
+      "file": "ecomctl.exe",
+      "sha256": "55e05ab72048f4ddd3c978b2e3195f382d1bb76ed9c86ac8e0eada0871d68a17"
+    },
+    "win32-x64": {
+      "package": "@accio-ai/ecommerce-cli-win32-x64",
+      "file": "ecomctl.exe",
+      "sha256": "0f6f3e265d7ec61210e93c047b8e95276eee8d55832a1ff8a16f82da676dd965"
+    }
+  }
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@accio-ai/ecommerce-cli",
+  "version": "0.0.1-rc.1",
+  "description": "Local, statically compiled ecommerce automation toolkit",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@gitlab.alibaba-inc.com/accio-core/ecommerce-cli.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "bin": {
+    "ecomctl": "bin/ecomctl.cjs"
+  },
+  "scripts": {
+    "postinstall": "node postinstall.cjs"
+  },
+  "optionalDependencies": {
+    "@accio-ai/ecommerce-cli-darwin-arm64": "0.0.1-rc.1",
+    "@accio-ai/ecommerce-cli-darwin-x64": "0.0.1-rc.1",
+    "@accio-ai/ecommerce-cli-linux-arm64": "0.0.1-rc.1",
+    "@accio-ai/ecommerce-cli-linux-x64": "0.0.1-rc.1",
+    "@accio-ai/ecommerce-cli-win32-arm64": "0.0.1-rc.1",
+    "@accio-ai/ecommerce-cli-win32-x64": "0.0.1-rc.1"
+  },
+  "files": [
+    "bin",
+    "postinstall.cjs",
+    "checksums.json",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  }
+}

package/postinstall.cjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const {
+  basePackageName,
+  platformKey,
+  platformPackageName,
+  resolveBinaryPath,
+} = require("./bin/ecomctl.cjs");
+
+const packageRoot = __dirname;
+let binaryPath;
+let key;
+let packageName;
+let platformPackage;
+try {
+  key = platformKey();
+  packageName = basePackageName(packageRoot);
+  platformPackage = platformPackageName(packageName);
+  binaryPath = resolveBinaryPath(packageRoot);
+} catch (error) {
+  if (!key) {
+    fail(error.message);
+  }
+  fail(`platform package ${platformPackage || key} is missing; reinstall ${packageName || "the CLI package"}`);
+}
+
+if (!fs.existsSync(binaryPath)) {
+  fail(`binary is missing from ${platformPackage}`);
+}
+
+const checksums = JSON.parse(
+  fs.readFileSync(path.join(packageRoot, "checksums.json"), "utf8"),
+);
+const expected = checksums.binaries[key]?.sha256;
+if (!expected) {
+  fail(`checksum is missing for ${key}`);
+}
+if (checksums.binaries[key]?.package !== platformPackage) {
+  fail(`checksum package does not match ${platformPackage}`);
+}
+const actual = crypto.createHash("sha256").update(fs.readFileSync(binaryPath)).digest("hex");
+if (actual !== expected) {
+  fail(`binary checksum mismatch for ${key}`);
+}
+if (process.platform !== "win32") {
+  fs.chmodSync(binaryPath, 0o755);
+}
+
+console.log(`ecomctl ${checksums.version} installed from ${platformPackage}`);
+
+function fail(message) {
+  console.error(`ecomctl: ${message}`);
+  process.exit(1);
+}