@arc-e-tect/api-only-publisher 0.0.0

package/src/changed.js

@@ -0,0 +1,100 @@
+"use strict";
+
+// Which targets a commit actually changed.
+//
+// Under repository-wide versioning this question does not arise, because
+// everything bumps together. Under per-target versioning the release job has to
+// answer it, or a change to one service's context releases every other service
+// too, and the version numbers stop meaning anything.
+
+const fs = require("fs");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+const { forTargets } = require("./closure");
+
+class ChangedError extends Error {}
+
+function git(args, cwd) {
+    try {
+        return execFileSync("git", args, { cwd, encoding: "utf8" });
+    } catch (error) {
+        throw new ChangedError(`git ${args.join(" ")} failed: ${(error.stderr || error.message).trim()}`);
+    }
+}
+
+/**
+ * Resolve symlinks before comparing paths.
+ *
+ * `git rev-parse --show-toplevel` answers with the canonical path, while the
+ * configuration's paths are whatever the caller passed. On any checkout reached
+ * through a symlink -- /var on macOS, a home directory behind one, a worktree
+ * under a linked parent -- the two spellings never match, every intersection
+ * comes out empty, and `changed` reports that nothing changed. For a command
+ * whose answer decides what gets released, being silently wrong in the direction
+ * of "release nothing" is the worst available failure.
+ */
+function real(file) {
+    try {
+        return fs.realpathSync(file);
+    } catch {
+        return path.resolve(file);
+    }
+}
+
+/**
+ * Map a staged file back to the source file it was copied from.
+ *
+ * Closures are computed over the staged tree, because a placeholder's content
+ * genuinely changes the published document and only the staged copy has it
+ * substituted. Git, however, only knows about the source.
+ */
+function toSource(config, stagedFile, kinds) {
+    for (const kind of kinds) {
+        const stagingRoot = config.stagingRoot(kind);
+        const rel = path.relative(stagingRoot, stagedFile);
+        if (!rel.startsWith("..") && !path.isAbsolute(rel)) {
+            return path.join(config.sourceRoot(), rel);
+        }
+    }
+    return null;
+}
+
+/**
+ * @returns {Array<{target, changed: boolean, files: string[], closureSha256: string}>}
+ */
+function changedSince(config, since, { kinds = ["openapi", "asyncapi"], log = () => {} } = {}) {
+    const repoRoot = real(git(["rev-parse", "--show-toplevel"], config.root).trim());
+
+    // Everything git says differs between `since` and the working tree.
+    const diff = new Set(
+        git(["diff", "--name-only", since, "--"], repoRoot)
+            .split("\n")
+            .filter(Boolean)
+            .map((rel) => real(path.resolve(repoRoot, rel)))
+    );
+
+    const closures = forTargets(config, kinds);
+    const results = [];
+
+    for (const [target, entry] of closures) {
+        const sources = entry.files
+            .map((f) => toSource(config, f, kinds))
+            .filter(Boolean)
+            .map(real);
+        // A change to the *shape* of a closure -- a bundle gaining or losing a
+        // $ref -- always means editing a file that is already in the closure, so
+        // membership changes are caught without diffing membership itself.
+        const touched = [...new Set(sources.filter((f) => diff.has(f)))].sort();
+        results.push({
+            target,
+            changed: touched.length > 0,
+            files: touched.map((f) => path.relative(repoRoot, f)),
+            closureSha256: entry.sha256,
+        });
+        log(`${target.padEnd(18)} ${touched.length > 0 ? "changed" : "unchanged"}  ${entry.sha256.slice(0, 12)}`);
+    }
+    return results;
+}
+
+module.exports = { changedSince, toSource, ChangedError };

package/src/channels.js

@@ -0,0 +1,284 @@
+"use strict";
+
+// Distribution channels.
+//
+// Every channel ships the bytes that `pack` produced, and never rebuilds them.
+// Building per channel invites the copies of one version to differ -- by a line
+// ending, by a timestamp -- which surfaces much later as an unexplainable verify
+// failure in a consumer's build.
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+const { isPrerelease, npmDistTag } = require("./version-policy");
+
+class ChannelError extends Error {}
+
+/**
+ * `file` -- publish to a local directory.
+ *
+ * Not a real distribution mechanism. It exists so the pipeline is testable end
+ * to end before any remote exists, and as a local-iteration escape hatch
+ * afterwards.
+ */
+function publishFile(archive, manifest, options, log) {
+    // Relative to the library root, not to wherever the CLI happened to be run.
+    const dir = path.resolve(options.baseDir || ".", options.directory || "publish");
+    const targetDir = path.join(dir, manifest.target, manifest.version);
+    fs.mkdirSync(targetDir, { recursive: true });
+
+    const archiveDest = path.join(targetDir, path.basename(archive));
+    fs.copyFileSync(archive, archiveDest);
+    fs.writeFileSync(path.join(targetDir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+
+    log(`-- Published ${manifest.target} ${manifest.version} to ${archiveDest}`);
+    return { location: archiveDest };
+}
+
+function pom(groupId, artifactId, version, packaging) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>${groupId}</groupId>
+  <artifactId>${artifactId}</artifactId>
+  <version>${version}</version>
+  <packaging>${packaging}</packaging>
+  <description>API description documents for ${artifactId}.</description>
+</project>
+`;
+}
+
+/**
+ * `maven` -- publish into a Maven repository layout.
+ *
+ * Writing the layout directly rather than shelling out to `mvn` keeps Maven off
+ * the list of things a specification repository has to have installed. The
+ * layout is all that a resolver reads.
+ *
+ * This is what makes the Subscriber cheap: a Gradle consumer declares the
+ * artifact in a configuration and lets Gradle's own dependency resolution do the
+ * fetching, caching and up-to-date checking, instead of the plugin carrying a
+ * hand-rolled HTTP client, cache and retry policy.
+ */
+function publishMaven(archive, manifest, options, log) {
+    const groupId = options.groupId;
+    if (!groupId) throw new ChannelError("the maven channel requires a groupId");
+
+    const configured = options.repository || path.join(os.homedir(), ".m2", "repository");
+    if (/^https?:\/\//.test(configured)) {
+        return publishMavenRemote(archive, manifest, { ...options, repository: configured }, log);
+    }
+
+    const repository = path.resolve(options.baseDir || ".", configured);
+    const artifactId = options.artifactId || manifest.target;
+    const version = manifest.version;
+    const extension = options.extension || "tgz";
+
+    const dir = path.join(repository, ...groupId.split("."), artifactId, version);
+    fs.mkdirSync(dir, { recursive: true });
+
+    const base = `${artifactId}-${version}`;
+    const artifactDest = path.join(dir, `${base}.${extension}`);
+    fs.copyFileSync(archive, artifactDest);
+    fs.writeFileSync(path.join(dir, `${base}.pom`), pom(groupId, artifactId, version, extension));
+
+    // The manifest travels beside the artifact as well as inside it, so a
+    // consumer can read provenance without unpacking anything.
+    fs.writeFileSync(path.join(dir, `${base}-manifest.json`), JSON.stringify(manifest, null, 2) + "\n");
+
+    log(`-- Published ${groupId}:${artifactId}:${version} to ${repository}`);
+    return { location: artifactDest, coordinates: `${groupId}:${artifactId}:${version}@${extension}` };
+}
+
+/**
+ * `npm` -- publish as an npm package.
+ *
+ * Real semver, integrity hashes for free, private scopes available, and the
+ * toolchain here is already Node. Its other advantage is social rather than
+ * technical: Renovate and Dependabot understand npm natively, so a contract bump
+ * arrives in an implementation repository as a pull request, without any bespoke
+ * machinery. Publishing is otherwise entirely passive -- the producer releases
+ * and nothing happens downstream until somebody looks.
+ */
+function publishNpm(archive, manifest, options, log) {
+    const scope = options.scope;
+    const name = scope ? `${scope}/${manifest.target}` : (options.namePrefix || "") + manifest.target;
+    const version = manifest.version;
+    const distTag = npmDistTag(version);
+
+    const workDir = fs.mkdtempSync(path.join(os.tmpdir(), "api-only-npm-"));
+    try {
+        // The package contains exactly what was packed, extracted -- never a
+        // rebuild. Every channel ships the same bytes.
+        execFileSync("tar", ["-xzf", archive, "-C", workDir], { encoding: "utf8" });
+
+        fs.writeFileSync(path.join(workDir, "package.json"), JSON.stringify({
+            name,
+            version,
+            description: `API description documents for ${manifest.target}.`,
+            license: options.license || "UNLICENSED",
+            files: fs.readdirSync(workDir).filter((f) => f !== "package.json").sort(),
+            // npm defaults a scoped package to restricted. A contract exists to be
+            // read by the people implementing against it, so the default here is
+            // the opposite; set access: restricted deliberately to narrow it.
+            publishConfig: scope ? { access: options.access || "public" } : undefined,
+            repository: manifest.source && manifest.source.repository
+                ? { type: "git", url: manifest.source.repository }
+                : undefined,
+        }, null, 2) + "\n");
+
+        const outDir = path.resolve(options.baseDir || ".", options.directory || "build/packages/npm");
+        fs.mkdirSync(outDir, { recursive: true });
+
+        if (options.publish === false) {
+            // `npm pack` alone is what makes this channel testable with no
+            // registry: the tarball can be installed from a path.
+            const packed = execFileSync("npm", ["pack", "--silent", "--pack-destination", outDir],
+                { cwd: workDir, encoding: "utf8" }).trim().split("\n").pop();
+            const location = path.join(outDir, packed);
+            log(`-- Packed npm ${name}@${version} (${distTag}) to ${location}`);
+            return { location, distTag, name };
+        }
+
+        const args = ["publish", "--tag", distTag];
+        if (options.registry) args.push("--registry", options.registry);
+        // A signed attestation tying this tarball to the commit and workflow run
+        // that produced it. A tool whose whole purpose is making provenance
+        // auditable should not ask to be taken on trust itself. Requires a public
+        // package and an OIDC-capable CI job; off by default because it fails
+        // outright anywhere else.
+        if (options.provenance) args.push("--provenance");
+        execFileSync("npm", args, { cwd: workDir, encoding: "utf8", stdio: "pipe" });
+        log(`-- Published npm ${name}@${version} under dist-tag '${distTag}'`);
+        return { location: name + "@" + version, distTag, name };
+    } finally {
+        fs.rmSync(workDir, { recursive: true, force: true });
+    }
+}
+
+/**
+ * `github-release` -- attach the archive to a GitHub release.
+ *
+ * The language-neutral floor: immutable per tag, works for private repositories
+ * with a token, and readable by a consumer with no JVM and no Node. It has no
+ * dependency-resolution semantics and no update notification, which is why it is
+ * the fallback rather than the default.
+ *
+ * Shells out to `gh` rather than carrying an HTTP client and a token-handling
+ * policy, because `gh` already solves authentication better than this tool would.
+ */
+function publishGithubRelease(archive, manifest, options, log) {
+    const repository = options.repository;
+    if (!repository) throw new ChannelError("the github-release channel requires a repository");
+
+    const tag = (options.tagFormat || "{target}-v{version}")
+        .replace(/\{target\}/g, manifest.target)
+        .replace(/\{version\}/g, manifest.version);
+
+    const gh = (args) => execFileSync("gh", args, { encoding: "utf8", stdio: "pipe" });
+
+    let exists = true;
+    try {
+        gh(["release", "view", tag, "--repo", repository]);
+    } catch {
+        exists = false;
+    }
+
+    if (!exists) {
+        const args = ["release", "create", tag, "--repo", repository,
+                      "--title", `${manifest.target} ${manifest.version}`,
+                      "--notes", `API description documents for ${manifest.target}.`];
+        // A pre-release is marked as one, so that "latest release" never resolves
+        // to a contract that is not finished.
+        if (isPrerelease(manifest.version)) args.push("--prerelease");
+        gh(args);
+    }
+
+    gh(["release", "upload", tag, archive, "--repo", repository, "--clobber"]);
+    log(`-- Published ${manifest.target} ${manifest.version} to ${repository} release ${tag}`);
+    return { location: `${repository}@${tag}`, tag };
+}
+
+
+/**
+ * Deploying to a remote Maven repository.
+ *
+ * Uploading the two files a resolver needs is the whole protocol, so this does
+ * it directly rather than requiring Maven to be installed in a specification
+ * repository that otherwise has no use for it.
+ *
+ * The token is read from the environment, never from configuration: a
+ * configuration file gets committed, and a credential in a committed file is a
+ * credential that has leaked.
+ */
+async function putFile(url, body, token, contentType) {
+    const response = await fetch(url, {
+        method: "PUT",
+        headers: {
+            "Authorization": `Bearer ${token}`,
+            "Content-Type": contentType,
+            "Content-Length": String(body.length),
+        },
+        body,
+    });
+    if (!response.ok) {
+        throw new ChannelError(
+            `PUT ${url} failed: ${response.status} ${response.statusText}. ` +
+            (response.status === 401 || response.status === 403
+                ? "Check the token in the environment variable named by channels.maven.tokenEnv."
+                : await response.text().catch(() => ""))
+        );
+    }
+}
+
+function publishMavenRemote(archive, manifest, options, log) {
+    const tokenEnv = options.tokenEnv || "MAVEN_TOKEN";
+    const token = process.env[tokenEnv];
+    if (!token) {
+        throw new ChannelError(
+            `no credential in $${tokenEnv}, which channels.maven.tokenEnv names. ` +
+            `Remote publication needs one; set it in the release job's environment.`
+        );
+    }
+
+    const artifactId = options.artifactId || manifest.target;
+    const version = manifest.version;
+    const extension = options.extension || "tgz";
+    const base = `${options.repository.replace(/\/+$/, "")}/` +
+        `${options.groupId.split(".").join("/")}/${artifactId}/${version}/${artifactId}-${version}`;
+
+    const work = (async () => {
+        await putFile(`${base}.${extension}`, fs.readFileSync(archive), token, "application/octet-stream");
+        await putFile(`${base}.pom`,
+            Buffer.from(pom(options.groupId, artifactId, version, extension), "utf8"),
+            token, "application/xml");
+        await putFile(`${base}-manifest.json`,
+            Buffer.from(JSON.stringify(manifest, null, 2) + "\n", "utf8"),
+            token, "application/json");
+    })();
+
+    // The CLI is synchronous throughout; surfacing the promise here would make
+    // every caller async for one channel's benefit.
+    return work.then(() => {
+        log(`-- Deployed ${options.groupId}:${artifactId}:${version} to ${options.repository}`);
+        return { location: `${base}.${extension}`, coordinates: `${options.groupId}:${artifactId}:${version}@${extension}` };
+    });
+}
+
+const CHANNELS = { file: publishFile, maven: publishMaven, npm: publishNpm, "github-release": publishGithubRelease };
+
+function publish(archive, manifest, channel, options, log = () => {}) {
+    const handler = CHANNELS[channel];
+    if (!handler) {
+        throw new ChannelError(
+            `unknown channel '${channel}'; available channels are ${Object.keys(CHANNELS).join(", ")}`
+        );
+    }
+    return handler(archive, manifest, options || {}, log);
+}
+
+module.exports = { publish, CHANNELS, ChannelError, pom };

package/src/cli.js

@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+"use strict";
+
+const path = require("path");
+
+const { loadFrom, ConfigError } = require("./config");
+const { build, prepare, BuildError } = require("./pipeline");
+const { init } = require("./init");
+const { PlaceholderError } = require("./placeholders");
+const { VersionError } = require("./version");
+const { forTargets, ClosureError } = require("./closure");
+const { pack, PackError } = require("./pack");
+const { changedSince, ChangedError } = require("./changed");
+const { split, SplitError } = require("./split");
+const { publish, ChannelError } = require("./channels");
+const { VersionError: PolicyError, describe } = require("./version-policy");
+
+const USAGE = `api-only-publisher -- build and distribute API description documents
+
+Usage:
+  api-only-publisher init [dir] [--force]
+  api-only-publisher build [--target <name>]... [--version <v>] [--openapi|--asyncapi]
+  api-only-publisher lint  [--target <name>]...
+  api-only-publisher targets
+  api-only-publisher closure [--target <name>]...
+  api-only-publisher changed --since <ref>
+  api-only-publisher pack --version <v> [--target <name>]... [--out <dir>]
+  api-only-publisher publish --version <v> [--channel <name>]... [--out <dir>]
+  api-only-publisher split --out <dir> [--by kind|target]
+
+Options:
+  --target <name>   Restrict to one target; repeat for several. Default: all.
+  --version <v>     Stamp info.version on every built document.
+  --openapi         Only build OpenAPI documents.
+  --asyncapi        Only build AsyncAPI documents.
+  --force           init only: overwrite files that already exist.
+  --since <ref>     changed only: the git ref to compare the working tree against.
+  --out <dir>       pack/publish/split: where to write.
+  --channel <name>  publish only: repeat for several. Default: every configured channel.
+  --by <kind|target>  split only: the boundary to split along. Default: kind.
+  -C <dir>          Run as if started in <dir>.
+  -q, --quiet       Only report errors.
+  -h, --help        Show this help.
+
+What gets built, and where each document goes, is declared in apionly.yaml.
+`;
+
+function parseArgs(argv) {
+    const options = {
+        targets: [], kinds: null, version: null, quiet: false, force: false,
+        dir: process.cwd(), since: null, out: null, channels: null, by: "kind",
+    };
+    const positional = [];
+
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        const next = () => {
+            if (i + 1 >= argv.length) throw new ConfigError(`${arg} requires a value`);
+            return argv[++i];
+        };
+        switch (arg) {
+            case "--target": options.targets.push(next()); break;
+            case "--version": options.version = next(); break;
+            case "--openapi": options.kinds = (options.kinds || []).concat("openapi"); break;
+            case "--asyncapi": options.kinds = (options.kinds || []).concat("asyncapi"); break;
+            case "--force": options.force = true; break;
+            case "--since": options.since = next(); break;
+            case "--out": options.out = next(); break;
+            case "--channel": options.channels = (options.channels || []).concat(next()); break;
+            case "--by": options.by = next(); break;
+            case "-C": options.dir = path.resolve(next()); break;
+            case "-q": case "--quiet": options.quiet = true; break;
+            case "-h": case "--help": options.help = true; break;
+            default:
+                if (arg.startsWith("-")) throw new ConfigError(`unrecognized option '${arg}'`);
+                positional.push(arg);
+        }
+    }
+    return { options, positional };
+}
+
+async function main(argv) {
+    const { options, positional } = parseArgs(argv);
+    const command = positional[0];
+
+    if (options.help || !command) {
+        process.stdout.write(USAGE);
+        return 0;
+    }
+
+    const log = options.quiet ? () => {} : (message) => console.log(message);
+
+    if (command === "init") {
+        const dir = path.resolve(options.dir, positional[1] || ".");
+        log(`Scaffolding a specification library in ${dir}`);
+        init(dir, { force: options.force, log });
+        log(`\nNext: api-only-publisher build -C ${dir}`);
+        return 0;
+    }
+
+    const config = loadFrom(options.dir);
+    const targets = options.targets.length > 0 ? options.targets : null;
+
+    if (targets) {
+        for (const t of targets) {
+            if (!config.targets[t]) {
+                throw new ConfigError(
+                    `unknown target '${t}'; declared targets are ${Object.keys(config.targets).join(", ")}`
+                );
+            }
+        }
+    }
+
+    switch (command) {
+        case "targets": {
+            for (const name of Object.keys(config.targets)) {
+                const kinds = ["openapi", "asyncapi"].filter((k) => config.targets[name][k]);
+                const published = config.isPublished(name) ? "" : "  (publish: false)";
+                console.log(`${name}  [${kinds.join(", ")}]${published}`);
+            }
+            return 0;
+        }
+        case "build": {
+            const results = build(config, { targets, version: options.version, kinds: options.kinds || undefined, log });
+            log(`\nBuilt ${results.length} document(s).`);
+            return 0;
+        }
+        case "lint": {
+            // Lint without rebuilding, for fast local feedback on what is already
+            // in dist/.
+            const fs = require("fs");
+            const { lint } = require("./pipeline");
+            let linted = 0;
+            for (const kind of ["openapi", "asyncapi"]) {
+                for (const target of config.targetsFor(kind)) {
+                    if (targets && !targets.includes(target)) continue;
+                    const file = path.join(config.distDir(target), config.outputName(kind));
+                    if (!fs.existsSync(file)) {
+                        throw new BuildError(`${file} does not exist; run 'build' first`);
+                    }
+                    log(`=== ${target} (${kind}) ===`);
+                    lint(config, kind, file, log);
+                    linted += 1;
+                }
+            }
+            log(`\nLinted ${linted} document(s).`);
+            return 0;
+        }
+        case "closure": {
+            // Prepared first: the closure is computed over substituted content,
+            // because a change to a Markdown snippet genuinely changes the
+            // published document.
+            prepare(config);
+            for (const [target, entry] of forTargets(config)) {
+                if (targets && !targets.includes(target)) continue;
+                console.log(`${target}  ${entry.files.length} file(s)  ${entry.sha256}`);
+            }
+            return 0;
+        }
+        case "changed": {
+            if (!options.since) throw new ConfigError("changed requires --since <ref>");
+            prepare(config);
+            const results = changedSince(config, options.since, { log });
+            const changed = results.filter((r) => r.changed);
+            if (options.quiet) for (const r of changed) console.log(r.target);
+            log(`\n${changed.length} of ${results.length} target(s) changed since ${options.since}.`);
+            return 0;
+        }
+        case "pack": {
+            if (!options.version) throw new ConfigError("pack requires --version <v>");
+            const outDir = path.resolve(options.dir, options.out || "build/packages");
+            const closures = forTargets(config);
+            let packed = 0;
+            for (const target of Object.keys(config.targets)) {
+                if (targets && !targets.includes(target)) continue;
+                if (!config.isPublished(target)) {
+                    log(`${target}: not packed (publish: false)`);
+                    continue;
+                }
+                const closure = closures.get(target);
+                pack(config, target, {
+                    version: options.version,
+                    closureSha256: closure ? closure.sha256 : null,
+                    outDir, log,
+                });
+                packed += 1;
+            }
+            log(`\nPacked ${packed} target(s) into ${outDir}.`);
+            return 0;
+        }
+        case "publish": {
+            if (!options.version) throw new ConfigError("publish requires --version <v>");
+            const outDir = path.resolve(options.dir, options.out || "build/packages");
+            const configured = config.channels || {};
+            const names = options.channels || Object.keys(configured);
+            if (names.length === 0) {
+                throw new ConfigError("no channels configured; add a `channels:` block or pass --channel");
+            }
+            const closures = forTargets(config);
+            let published = 0;
+            for (const target of Object.keys(config.targets)) {
+                if (targets && !targets.includes(target)) continue;
+                if (!config.isPublished(target)) continue;
+                const closure = closures.get(target);
+                // Packed once, then shipped unchanged to every channel.
+                const { archive, manifest } = pack(config, target, {
+                    version: options.version,
+                    closureSha256: closure ? closure.sha256 : null,
+                    outDir, log,
+                });
+                for (const name of names) {
+                    // A remote channel returns a promise; a local one does not.
+                    await publish(archive, manifest, name, { ...(configured[name] || {}), baseDir: config.root }, log);
+                    published += 1;
+                }
+            }
+            log(`\nPublished ${published} artifact(s).`);
+            return 0;
+        }
+        case "split": {
+            const outDir = path.resolve(options.dir, options.out || "build/split");
+            prepare(config);
+            const parts = split(config, { by: options.by, outDir, log });
+            const duplicated = parts.reduce((n, p) => n + p.imported.length, 0);
+            log(`\nWrote ${parts.length} part(s) to ${outDir}.`);
+            if (duplicated > 0) {
+                log(`${duplicated} shared fragment(s) were copied so each part is self-contained.`);
+                log("Each part carrying copies has an IMPORTED.adoc saying which, and what it costs.");
+            }
+            return 0;
+        }
+        default:
+            throw new ConfigError(`unrecognized command '${command}'`);
+    }
+}
+
+function report(error) {
+    if (error instanceof ConfigError || error instanceof BuildError ||
+        error instanceof PlaceholderError || error instanceof VersionError ||
+        error instanceof ClosureError || error instanceof PackError ||
+        error instanceof ChangedError || error instanceof SplitError ||
+        error instanceof ChannelError || error instanceof PolicyError) {
+        console.error(`Error: ${error.message}`);
+        process.exitCode = 1;
+    } else {
+        throw error;
+    }
+}
+
+if (require.main === module) {
+    main(process.argv.slice(2)).then(
+        (code) => { process.exitCode = code; },
+        report
+    );
+}
+
+module.exports = { main, parseArgs };