@accio-ai/ecommerce-cli 0.0.1-rc.1 → 0.0.2-rc.1

package/CHANGELOG.md

@@ -6,6 +6,11 @@
 
 ### Added
 
+- 新增多 Plugin SQLite 初始化 Go 接口：每份构建期内置 `init_config` 统一声明 Plugin、物理表、DDL 与 DML，Assets Loader 提供领域 Config，Storage Adapter 为 07 Core 生成内部同名表注册；使用库内初始化状态、Plugin 级 checksum、只读快速路径和 `BEGIN IMMEDIATE` 实现重复调用、并发调用与失败重试幂等，并通过 `setup`、`doctor`、业务命令兜底和 npm postinstall 接入。
+- 新增 CLI 声明式参数关系，支持 `at_least_one`、`exactly_one` 和 `mutually_exclusive`；同一份 metadata 驱动注册校验、运行时校验、Help 和 Schema。
+- 强化跨平台发布与 SQLite 恢复：统一兼容 JSON UTF-8 BOM/CRLF、避免 Windows npm shell 转义、拒绝 SQLite UNC/设备路径，并验证异常退出后的 WAL 恢复。
+- 新增 SQLite Core：统一多 Plugin 数据库路径与表绑定、连接池、访问模式、事务、参数化 SQL、缓存、资源释放和稳定错误边界；上层无需直接依赖 `database/sql`。
+- 将 CGo-free SQLite 引擎直接链接进 `ecomctl`，并增加真实内存数据库验证；用户无需额外安装系统 `sqlite3`，数据库由 `setup`、npm postinstall 或首次业务命令按需初始化。
 - 新增相互隔离的正式版与 RC 发布入口；RC 自动使用 `-rc.N` 版本和 npm `rc` dist-tag，正式版固定使用 `latest`，两条通道共享完整 Windows 签名和安装验证门禁。
 - 将根目录 `VERSION` 设为唯一发布版本源；npm staging 和 Go release build 自动注入版本，不再要求同步修改 `package.json` 与 Go 源码。
 - 简化 Windows 签名交接：默认强制验证 Authenticode 与原始 payload，signer 证书 SHA-256 指纹改为可选加强项，不再要求每次发布手工输入。
@@ -13,6 +18,28 @@
 - 将公网 npm 包名统一为 `@accio-ai/ecommerce-cli`，固定使用 `accio-ai` scope、public access 和 npmjs registry。
 - 将 npm 分发改为 1 个主包加 6 个按 `os`/`cpu` 限制的平台包；安装时只下载当前平台二进制，发布时平台包先于主包。
 
+### Changed
+
+- 将 Source Import 统一为 append-only insert；每次 Excel/JSON 导入生成带自增 ID 的独立事实记录，不按业务字段覆盖历史数据。
+- 将查数导出统一为 raw `scopes` 协议；按节点时返回 `scopes[].nodes[].dataset[]`，按指标时返回 `scopes[].dataset[]`，每条数据保留原始事实行字段。
+- 将查数导出命令的共享 flag 和输入转换上提到 `dataquery/cli`，消除叶子 CLI Adapter 之间的横向依赖。
+- 新增叶子 CLI、Assets 和 Storage 依赖方向门禁，防止分层在后续扩展中回退。
+- 将六平台矩阵收敛到单一 manifest，launcher、staging、publish 和测试共享同一份目标定义。
+- 将 GoReleaser 流程收敛为 raw binary build；npm publish 只提交已经完成隔离安装 smoke 的精确 tarball。
+- 为五个非 Linux amd64 目标增加条件式原生 GitLab runner job，并在 tag pipeline 强制要求完整 runner 配置。
+
+### Fixed
+
+- 修复 npm smoke 忽略 `ECOMCTL_DIST_DIR`、可能误用旧产物的问题。
+- Windows 签名替换改为整批事务；任一文件或 receipt 失败时回滚已经替换的二进制。
+- npm 发布支持按 tarball integrity 安全续跑，避免部分平台包发布成功后无法继续同一版本。
+- registry 在注册时冻结 adapter metadata，避免装配完成后命令描述发生漂移。
+
+### Removed
+
+- 下线未注册的 Dashboard Render Service、CLI Adapter、DTO、测试和文档，统一使用按节点或指标导出。
+- 删除没有外部分发目标的 GoReleaser archive、archive checksum、GPG checksum 签名和 Windows zip 重写路径。
+
 ## [0.0.1] - 2026-08-31
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@ This is the platform-independent launcher package for `ecomctl`.
 
 It declares six exact-version optional dependencies. npm uses each dependency's `os` and `cpu` fields to install only the matching platform package, so users do not download binaries for other operating systems or architectures.
 
-The platform package contains one statically compiled binary; this main package contains only the Node.js launcher, install checksum verification, README, and changelog. Installation does not read or write account state, credentials, user configuration, Agent skills, telemetry, or remote services.
+The platform package contains one statically compiled binary; this main package contains only the Node.js launcher, the shared target manifest, install checksum verification, README, and changelog. After checksum verification, `postinstall` best-effort initializes the local SQLite databases for a normal user. It does not read or write account state, credentials, user configuration, Agent skills, telemetry, or remote services.
 
 Supported targets:
 
@@ -12,4 +12,6 @@ Supported targets:
 - Linux: arm64 and x64
 - Windows: arm64 and x64
 
-Run `ecomctl --help` after installation.
+Database setup is best-effort. Installs that disable lifecycle scripts, use an unsafe service identity, or encounter a database warning can initialize later with `ecomctl setup`; database-backed domain commands also perform the same idempotent initialization before their leaf operation. Run `ecomctl doctor` after installation to verify the local environment.
+
+The launcher invokes the platform binary with an argument array and no command shell. Release scripts invoke npm on Windows through `node.exe` and `npm-cli.js`. Package JSON readers accept a UTF-8 BOM and CRLF, while the executable launcher itself is packaged only with an LF shebang and no BOM.

package/bin/ecomctl.cjs

@@ -5,15 +5,16 @@
 const childProcess = require("node:child_process");
 const fs = require("node:fs");
 const path = require("node:path");
+const { readJSONFile } = require("../json-file.cjs");
 
-const TARGETS = Object.freeze({
-  "darwin-arm64": { binary: "ecomctl" },
-  "darwin-x64": { binary: "ecomctl" },
-  "linux-arm64": { binary: "ecomctl" },
-  "linux-x64": { binary: "ecomctl" },
-  "win32-arm64": { binary: "ecomctl.exe" },
-  "win32-x64": { binary: "ecomctl.exe" },
-});
+const TARGETS = Object.freeze(
+  Object.fromEntries(
+    readJSONFile(path.join(__dirname, "..", "targets.json")).map((target) => [
+      target.key,
+      Object.freeze({ binary: target.binary }),
+    ]),
+  ),
+);
 
 const SIGNAL_EXIT_CODES = Object.freeze({
   SIGHUP: 129,
@@ -31,7 +32,7 @@ function platformKey(platform = process.platform, architecture = process.arch) {
 }
 
 function basePackageName(packageRoot) {
-  const manifest = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+  const manifest = readJSONFile(path.join(packageRoot, "package.json"));
   return manifest.name;
 }
 
@@ -70,6 +71,16 @@ function resolveBinaryPath(
   );
 }
 
+function childSignalFor(platform, signal, childMissedOriginalSignal = false) {
+  if (platform !== "win32") {
+    return signal;
+  }
+  if (signal === "SIGTERM" || childMissedOriginalSignal) {
+    return "SIGTERM";
+  }
+  return null;
+}
+
 function run(args = process.argv.slice(2)) {
   const packageRoot = path.resolve(__dirname, "..");
   let key;
@@ -109,7 +120,7 @@ function run(args = process.argv.slice(2)) {
       ? ["SIGINT", "SIGTERM", "SIGBREAK"]
       : ["SIGHUP", "SIGINT", "SIGTERM"];
 
-  function forwardSignal(signal) {
+  function forwardSignal(signal, childMissedOriginalSignal = false) {
     forwardedSignal = signal;
     if (child === null) {
       pendingSignal = signal;
@@ -118,8 +129,16 @@ function run(args = process.argv.slice(2)) {
     if (child.exitCode !== null || child.signalCode !== null) {
       return;
     }
+    const childSignal = childSignalFor(
+      process.platform,
+      signal,
+      childMissedOriginalSignal,
+    );
+    if (childSignal === null) {
+      return;
+    }
     try {
-      child.kill(process.platform === "win32" ? "SIGTERM" : signal);
+      child.kill(childSignal);
     } catch (error) {
       console.error(`ecomctl: failed to forward ${signal}: ${error.message}`);
     }
@@ -142,7 +161,7 @@ function run(args = process.argv.slice(2)) {
   if (pendingSignal !== null) {
     const signal = pendingSignal;
     pendingSignal = null;
-    forwardSignal(signal);
+    forwardSignal(signal, true);
   }
 
   child.on("error", (error) => {
@@ -171,6 +190,7 @@ module.exports = {
   SIGNAL_EXIT_CODES,
   TARGETS,
   basePackageName,
+  childSignalFor,
   platformKey,
   platformPackageName,
   resolveBinaryPath,

package/checksums.json

@@ -1,35 +1,35 @@
 {
-  "version": "0.0.1-rc.1",
+  "version": "0.0.2-rc.1",
   "binaries": {
     "darwin-arm64": {
       "package": "@accio-ai/ecommerce-cli-darwin-arm64",
       "file": "ecomctl",
-      "sha256": "cfc3e6221f67764d07dc203267aa007be903261fcdad3af4e7d518e226cc485d"
+      "sha256": "d0807e36731b60e03a842fb2f8c3357b4f6d0fad88d8473ef84d2cf935e12e62"
     },
     "darwin-x64": {
       "package": "@accio-ai/ecommerce-cli-darwin-x64",
       "file": "ecomctl",
-      "sha256": "a6c784bcf6e43450343df2c48d9cdb673b1e6579201b83490e5c800835e5abbf"
+      "sha256": "009b17424ea301e2db01c957b075f686a3b4426c66f4cddc9b99dc7ae857ef64"
     },
     "linux-arm64": {
       "package": "@accio-ai/ecommerce-cli-linux-arm64",
       "file": "ecomctl",
-      "sha256": "b268f1d5f0d6379aecb748d353067f8f9ec1d229cd8894da4118003db5314ffb"
+      "sha256": "ee53210dfddc8aa70e48232091f72515aeae0fed53f2d9992e03771a13d394a2"
     },
     "linux-x64": {
       "package": "@accio-ai/ecommerce-cli-linux-x64",
       "file": "ecomctl",
-      "sha256": "66d64ea6c11245c495f7aaa83b43fb29f1b1a358e968861df6a383178c6b305d"
+      "sha256": "8eb6a2569d72d98912335ec3b8535eed5ce254d0e4f6edd7b9379462c5f6ca0e"
     },
     "win32-arm64": {
       "package": "@accio-ai/ecommerce-cli-win32-arm64",
       "file": "ecomctl.exe",
-      "sha256": "55e05ab72048f4ddd3c978b2e3195f382d1bb76ed9c86ac8e0eada0871d68a17"
+      "sha256": "e953a631f1f0f55d6f7cfaf05e819770a97f1909d336443e3beb7b2203bf5538"
     },
     "win32-x64": {
       "package": "@accio-ai/ecommerce-cli-win32-x64",
       "file": "ecomctl.exe",
-      "sha256": "0f6f3e265d7ec61210e93c047b8e95276eee8d55832a1ff8a16f82da676dd965"
+      "sha256": "98ba2b83588a8cf07eb34de1812c658e322186e0d2e5c5b07a89e65fe9612d2e"
     }
   }
 }

package/json-file.cjs

@@ -0,0 +1,21 @@
+"use strict";
+
+const fs = require("node:fs");
+
+function stripUTF8BOM(content) {
+  return content.charCodeAt(0) === 0xfeff ? content.slice(1) : content;
+}
+
+function parseJSON(content, source = "JSON input") {
+  try {
+    return JSON.parse(stripUTF8BOM(content));
+  } catch (error) {
+    throw new Error(`invalid JSON in ${source}: ${error.message}`, { cause: error });
+  }
+}
+
+function readJSONFile(filePath) {
+  return parseJSON(fs.readFileSync(filePath, "utf8"), String(filePath));
+}
+
+module.exports = { parseJSON, readJSONFile, stripUTF8BOM };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@accio-ai/ecommerce-cli",
-  "version": "0.0.1-rc.1",
+  "version": "0.0.2-rc.1",
   "description": "Local, statically compiled ecommerce automation toolkit",
   "license": "UNLICENSED",
   "repository": {
@@ -18,16 +18,18 @@
     "postinstall": "node postinstall.cjs"
   },
   "optionalDependencies": {
-    "@accio-ai/ecommerce-cli-darwin-arm64": "0.0.1-rc.1",
-    "@accio-ai/ecommerce-cli-darwin-x64": "0.0.1-rc.1",
-    "@accio-ai/ecommerce-cli-linux-arm64": "0.0.1-rc.1",
-    "@accio-ai/ecommerce-cli-linux-x64": "0.0.1-rc.1",
-    "@accio-ai/ecommerce-cli-win32-arm64": "0.0.1-rc.1",
-    "@accio-ai/ecommerce-cli-win32-x64": "0.0.1-rc.1"
+    "@accio-ai/ecommerce-cli-darwin-arm64": "0.0.2-rc.1",
+    "@accio-ai/ecommerce-cli-darwin-x64": "0.0.2-rc.1",
+    "@accio-ai/ecommerce-cli-linux-arm64": "0.0.2-rc.1",
+    "@accio-ai/ecommerce-cli-linux-x64": "0.0.2-rc.1",
+    "@accio-ai/ecommerce-cli-win32-arm64": "0.0.2-rc.1",
+    "@accio-ai/ecommerce-cli-win32-x64": "0.0.2-rc.1"
   },
   "files": [
     "bin",
+    "json-file.cjs",
     "postinstall.cjs",
+    "targets.json",
     "checksums.json",
     "README.md",
     "CHANGELOG.md"

package/postinstall.cjs

@@ -3,7 +3,9 @@
 "use strict";
 
 const crypto = require("node:crypto");
+const childProcess = require("node:child_process");
 const fs = require("node:fs");
+const os = require("node:os");
 const path = require("node:path");
 const {
   basePackageName,
@@ -11,49 +13,309 @@ const {
   platformPackageName,
   resolveBinaryPath,
 } = require("./bin/ecomctl.cjs");
+const { readJSONFile } = require("./json-file.cjs");
 
-const packageRoot = __dirname;
-let binaryPath;
-let key;
-let packageName;
-let platformPackage;
-try {
-  key = platformKey();
-  packageName = basePackageName(packageRoot);
-  platformPackage = platformPackageName(packageName);
-  binaryPath = resolveBinaryPath(packageRoot);
-} catch (error) {
-  if (!key) {
-    fail(error.message);
+const DATA_HOME_ENVIRONMENT = "ECOMCTL_DATA_HOME";
+const INIT_ARGS = Object.freeze(["setup", "--output", "json"]);
+const INIT_TIMEOUT_MS = 30_000;
+const INIT_MAX_BUFFER_BYTES = 1 << 20;
+const MANUAL_INIT_COMMAND = "ecomctl setup";
+
+function main() {
+  const packageRoot = __dirname;
+  let binaryPath;
+  let key;
+  let packageName;
+  let platformPackage;
+  try {
+    key = platformKey();
+    packageName = basePackageName(packageRoot);
+    platformPackage = platformPackageName(packageName);
+    binaryPath = resolveBinaryPath(packageRoot);
+  } catch (error) {
+    if (!key) {
+      fail(error.message);
+    }
+    fail(`platform package ${platformPackage || key} is missing; reinstall ${packageName || "the CLI package"}`);
+  }
+
+  if (!fs.existsSync(binaryPath)) {
+    fail(`binary is missing from ${platformPackage}`);
+  }
+
+  const checksums = readJSONFile(path.join(packageRoot, "checksums.json"));
+  const expected = checksums.binaries[key]?.sha256;
+  if (!expected) {
+    fail(`checksum is missing for ${key}`);
+  }
+  if (checksums.binaries[key]?.package !== platformPackage) {
+    fail(`checksum package does not match ${platformPackage}`);
+  }
+  const actual = crypto.createHash("sha256").update(fs.readFileSync(binaryPath)).digest("hex");
+  if (actual !== expected) {
+    fail(`binary checksum mismatch for ${key}`);
+  }
+  if (process.platform !== "win32") {
+    fs.chmodSync(binaryPath, 0o755);
+  }
+
+  console.log(`ecomctl ${checksums.version} installed from ${platformPackage}`);
+  initializeDatabase(binaryPath);
+}
+
+function initializeDatabase(binaryPath, options = {}) {
+  const emitWarning = options.warn || warning;
+  const decision = initializationDecision(options);
+  if (!decision.run) {
+    emitWarning(`database initialization skipped (code=${decision.reason}); ${recoveryInstruction(decision.reason)}`);
+    return { status: "skipped", reason: decision.reason };
+  }
+
+  const spawnSync = options.spawnSync || childProcess.spawnSync;
+  const childEnvironment = { ...decision.environment };
+  if (decision.dataRoot !== undefined) {
+    childEnvironment[DATA_HOME_ENVIRONMENT] = decision.dataRoot;
+  }
+  let result;
+  try {
+    result = spawnSync(binaryPath, INIT_ARGS, {
+      encoding: "utf8",
+      env: childEnvironment,
+      killSignal: "SIGKILL",
+      maxBuffer: INIT_MAX_BUFFER_BYTES,
+      shell: false,
+      timeout: INIT_TIMEOUT_MS,
+      windowsHide: true,
+    });
+  } catch {
+    emitWarning(`database initialization failed (code=execution_failed); run "${MANUAL_INIT_COMMAND}" after installation`);
+    return { status: "failed", reason: "execution_failed" };
+  }
+  if (result.error) {
+    const reason = result.error.code === "ETIMEDOUT" ? "timeout" : "execution_failed";
+    emitWarning(`database initialization failed (code=${reason}); run "${MANUAL_INIT_COMMAND}" after installation`);
+    return { status: "failed", reason };
+  }
+
+  if (result.status !== 0) {
+    const failure = initializationFailure(result.stderr);
+    emitWarning(`database initialization failed (${failure}); run "${MANUAL_INIT_COMMAND}" after installation`);
+    return { status: "failed", reason: failure };
+  }
+
+  const response = parseJSON(result.stdout);
+  const domains = response?.data?.domains;
+  if (
+    result.stderr !== "" ||
+    response?.success !== true ||
+    !Array.isArray(domains) ||
+    domains.length === 0 ||
+    !validInitializationDomains(domains)
+  ) {
+    emitWarning(`database initialization failed (code=invalid_response); ${recoveryInstruction("invalid_response")}`);
+    return { status: "failed", reason: "invalid_response" };
+  }
+  return { status: "initialized", domains };
+}
+
+function validInitializationDomains(domains) {
+  const domainKeys = new Set();
+  for (const domain of domains) {
+    const tableNames = Array.isArray(domain?.tables) ? new Set(domain.tables) : null;
+    if (
+      domain === null ||
+      typeof domain !== "object" ||
+      !isDomainKey(domain.domain) ||
+      (domain.status !== "created" && domain.status !== "already_initialized") ||
+      !Array.isArray(domain.tables) ||
+      domain.tables.length === 0 ||
+      domain.tables.some((table) => typeof table !== "string" || !/^[a-z][a-z0-9_]{0,62}$/.test(table)) ||
+      tableNames.size !== domain.tables.length ||
+      domainKeys.has(domain.domain)
+    ) {
+      return false;
+    }
+    domainKeys.add(domain.domain);
+  }
+  return true;
+}
+
+function isDomainKey(value) {
+  return typeof value === "string" && /^[a-z][a-z0-9-]*$/.test(value);
+}
+
+function initializationDecision(options = {}) {
+  const environment = options.env || process.env;
+  const platform = options.platform || process.platform;
+  const configuredRoot = environment[DATA_HOME_ENVIRONMENT];
+  if (configuredRoot) {
+    if (!isAbsoluteLocalPath(configuredRoot, platform)) {
+      return { run: false, reason: "invalid_data_home" };
+    }
+    return { run: true, dataRoot: normalizePath(configuredRoot, platform), environment };
+  }
+
+  if (platform === "win32") {
+    const username = hasOwn(options, "username") ? options.username : currentUsername();
+    const home = hasOwn(options, "home") ? options.home : currentHome();
+    if (isWindowsServiceAccount(username) || isWindowsServiceProfile(home)) {
+      return { run: false, reason: "service_account" };
+    }
+    if (!isAbsoluteLocalPath(home, platform)) {
+      return { run: false, reason: "unreliable_user_home" };
+    }
+    return { run: true, environment };
+  }
+
+  const uid = hasOwn(options, "uid") ? options.uid : currentID("getuid");
+  const euid = hasOwn(options, "euid") ? options.euid : currentID("geteuid");
+  if (uid === 0 || euid === 0) {
+    return { run: false, reason: "privileged_account" };
+  }
+  if (environment.SUDO_UID || environment.SUDO_USER || environment.SUDO_GID) {
+    return { run: false, reason: "sudo_identity" };
+  }
+  const home = hasOwn(options, "home") ? options.home : currentHome();
+  if (!Number.isInteger(uid) || !Number.isInteger(euid) || !isAbsoluteLocalPath(home, platform)) {
+    return { run: false, reason: "unreliable_user_home" };
   }
-  fail(`platform package ${platformPackage || key} is missing; reinstall ${packageName || "the CLI package"}`);
+  return { run: true, environment };
 }
 
-if (!fs.existsSync(binaryPath)) {
-  fail(`binary is missing from ${platformPackage}`);
+function hasOwn(object, property) {
+  return Object.prototype.hasOwnProperty.call(object, property);
 }
 
-const checksums = JSON.parse(
-  fs.readFileSync(path.join(packageRoot, "checksums.json"), "utf8"),
-);
-const expected = checksums.binaries[key]?.sha256;
-if (!expected) {
-  fail(`checksum is missing for ${key}`);
+function isAbsoluteLocalPath(value, platform) {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
+    return false;
+  }
+  if (platform === "win32") {
+    return path.win32.isAbsolute(value) && !isWindowsNetworkOrDevicePath(value);
+  }
+  return path.posix.isAbsolute(value);
+}
+
+function normalizePath(value, platform) {
+  return platform === "win32" ? path.win32.normalize(value) : path.posix.normalize(value);
+}
+
+function isWindowsNetworkOrDevicePath(value) {
+  const normalized = value.replaceAll("/", "\\");
+  const lower = normalized.toLowerCase();
+  return (
+    normalized.startsWith("\\\\") ||
+    lower.startsWith("\\??\\") ||
+    lower.startsWith("\\device\\") ||
+    lower.startsWith("\\global??\\")
+  );
+}
+
+function isWindowsServiceAccount(username) {
+  if (typeof username !== "string") {
+    return true;
+  }
+  const account = username.replaceAll("/", "\\").split("\\").at(-1).trim().toLowerCase();
+  return new Set(["system", "local service", "localservice", "network service", "networkservice"]).has(account);
+}
+
+function isWindowsServiceProfile(home) {
+  if (typeof home !== "string") {
+    return true;
+  }
+  const normalized = home.replaceAll("\\", "/").toLowerCase().replace(/\/+$/, "");
+  return normalized.endsWith("/windows/system32/config/systemprofile") || normalized.includes("/windows/serviceprofiles/");
+}
+
+function currentID(method) {
+  try {
+    return typeof process[method] === "function" ? process[method]() : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function currentHome() {
+  try {
+    return os.homedir();
+  } catch {
+    return "";
+  }
 }
-if (checksums.binaries[key]?.package !== platformPackage) {
-  fail(`checksum package does not match ${platformPackage}`);
+
+function currentUsername() {
+  try {
+    return os.userInfo().username;
+  } catch {
+    return "";
+  }
 }
-const actual = crypto.createHash("sha256").update(fs.readFileSync(binaryPath)).digest("hex");
-if (actual !== expected) {
-  fail(`binary checksum mismatch for ${key}`);
+
+function initializationFailure(stderr) {
+  const response = parseJSON(stderr);
+  const code = safeToken(response?.error?.reason) || safeToken(response?.error?.code) || "initialization_failed";
+  const failures = Array.isArray(response?.data?.domains)
+    ? response.data.domains
+        .filter((domain) => domain?.error_code)
+        .slice(0, 10)
+        .map((domain) => {
+          const domainKey = safeToken(domain?.domain) || "unknown";
+          const itemCode = safeToken(domain?.error_code) || "initialization_failed";
+          return `${domainKey}:${itemCode}`;
+        })
+    : [];
+  return failures.length === 0 ? `code=${code}` : `code=${code}, domains=${failures.join(",")}`;
 }
-if (process.platform !== "win32") {
-  fs.chmodSync(binaryPath, 0o755);
+
+function recoveryInstruction(reason) {
+  if (reason === "invalid_data_home") {
+    return `set ${DATA_HOME_ENVIRONMENT} to an absolute local path or unset it, then run "${MANUAL_INIT_COMMAND}"`;
+  }
+  if (["privileged_account", "sudo_identity", "service_account", "unreliable_user_home"].includes(reason)) {
+    return `run "${MANUAL_INIT_COMMAND}" after installation from the intended user account`;
+  }
+  return `run "${MANUAL_INIT_COMMAND}" after installation`;
 }
 
-console.log(`ecomctl ${checksums.version} installed from ${platformPackage}`);
+function safeToken(value) {
+  return typeof value === "string" && /^[a-z][a-z0-9_-]{0,127}$/.test(value) ? value : "";
+}
+
+function parseJSON(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    return null;
+  }
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+
+function warning(message) {
+  console.error(`ecomctl: warning: ${message}`);
+}
 
 function fail(message) {
   console.error(`ecomctl: ${message}`);
   process.exit(1);
 }
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  DATA_HOME_ENVIRONMENT,
+  INIT_ARGS,
+  INIT_MAX_BUFFER_BYTES,
+  INIT_TIMEOUT_MS,
+  initializeDatabase,
+  initializationDecision,
+  initializationFailure,
+  isAbsoluteLocalPath,
+  isWindowsNetworkOrDevicePath,
+  isWindowsServiceAccount,
+  isWindowsServiceProfile,
+  main,
+};

package/targets.json

@@ -0,0 +1,8 @@
+[
+  { "goos": "darwin", "goarch": "arm64", "key": "darwin-arm64", "os": "darwin", "cpu": "arm64", "binary": "ecomctl" },
+  { "goos": "darwin", "goarch": "amd64", "key": "darwin-x64", "os": "darwin", "cpu": "x64", "binary": "ecomctl" },
+  { "goos": "linux", "goarch": "arm64", "key": "linux-arm64", "os": "linux", "cpu": "arm64", "binary": "ecomctl" },
+  { "goos": "linux", "goarch": "amd64", "key": "linux-x64", "os": "linux", "cpu": "x64", "binary": "ecomctl" },
+  { "goos": "windows", "goarch": "arm64", "key": "win32-arm64", "os": "win32", "cpu": "arm64", "binary": "ecomctl.exe" },
+  { "goos": "windows", "goarch": "amd64", "key": "win32-x64", "os": "win32", "cpu": "x64", "binary": "ecomctl.exe" }
+]