@dokebi/cli 0.1.1 → 0.2.0

package/dist/required-plugins.d.ts

@@ -0,0 +1,6 @@
+export interface RequiredPlugin {
+    id: string;
+    packageName: string;
+    version: string;
+}
+export declare function readRequiredPlugins(root: string): Promise<RequiredPlugin[]>;

package/dist/required-plugins.js

@@ -0,0 +1,45 @@
+import { readFile } from 'node:fs/promises';
+import valid from 'semver/functions/valid.js';
+import { CliError } from './errors.js';
+import { object, parseObject } from './filesystem.js';
+import { PACKAGE_NAME } from './manifest.js';
+import { packageFile } from './workspace.js';
+export async function readRequiredPlugins(root) {
+    const core = parseObject(await readFile(await packageFile(root, '@dokebi/core', 'package.json'), 'utf8'), 'core');
+    if (core.name !== '@dokebi/core')
+        throw new CliError('INVALID_CORE', 'Invalid core identity');
+    const metadata = object(core.dokebi, 'core metadata');
+    const dependencies = object(core.dependencies, 'core dependencies');
+    const entries = metadata.requiredPlugins;
+    if (!Array.isArray(entries) || entries.length === 0)
+        throw new CliError('INVALID_CORE', 'Core must declare its required plugins');
+    const result = [];
+    for (const entry of entries) {
+        const item = object(entry, 'required plugin');
+        if (typeof item.id !== 'string' ||
+            !/^[a-z0-9][a-z0-9._/-]*$/.test(item.id) ||
+            typeof item.packageName !== 'string' ||
+            !PACKAGE_NAME.test(item.packageName) ||
+            typeof item.version !== 'string' ||
+            !valid(item.version) ||
+            !Object.hasOwn(dependencies, item.packageName) ||
+            dependencies[item.packageName] !== item.version ||
+            result.some((previous) => previous.id === item.id || previous.packageName === item.packageName))
+            throw new CliError('INVALID_CORE', 'Invalid required plugin metadata or mandatory dependency');
+        const path = await packageFile(root, item.packageName, 'package.json');
+        let source;
+        try {
+            source = await readFile(path, 'utf8');
+        }
+        catch (error) {
+            if (error instanceof Error && 'code' in error && error.code === 'ENOENT')
+                throw new CliError('REQUIRED_PLUGIN_MISSING', 'A core-required plugin is missing');
+            throw error;
+        }
+        const installed = parseObject(source, 'required plugin');
+        if (installed.name !== item.packageName || installed.version !== item.version)
+            throw new CliError('REQUIRED_PLUGIN_MISMATCH', 'Installed required plugin differs from core metadata');
+        result.push({ id: item.id, packageName: item.packageName, version: item.version });
+    }
+    return result;
+}

package/dist/transaction.d.ts

@@ -5,10 +5,15 @@ export declare class Transaction {
     private constructor();
     static begin(root: string): Promise<Transaction>;
     capture(path: string): Promise<void>;
+    ensureDirectory(path: string): Promise<void>;
     read(path: string): Promise<string>;
     write(path: string, content: string | Uint8Array): Promise<void>;
     replace(path: string, source?: string): Promise<void>;
     get paths(): string[];
-    commit(beforeApply?: (index: number) => void): Promise<void>;
+    /**
+     * Applies every change; `afterApply` runs once they are all in place, and when it fails the
+     * changes are rolled back like a failed apply (D-0035: the workspace npm install).
+     */
+    commit(beforeApply?: (index: number) => void, afterApply?: () => Promise<void>): Promise<void>;
     close(): Promise<void>;
 }

package/dist/transaction.js

@@ -1,5 +1,4 @@
-// [AI:수정] 변경 코드와 회귀 테스트의 import 순서·포맷을 저장소 규칙에 맞춘다.
-import { lstat, mkdir, mkdtemp, open, readdir, readFile, rename, rm, writeFile, } from 'node:fs/promises';
+import { lstat, mkdir, mkdtemp, open, readdir, readFile, rename, rm, rmdir, writeFile, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { CliError } from './errors.js';
 import { exists, fingerprint, json, securePath } from './filesystem.js';
@@ -17,7 +16,6 @@ export class Transaction {
         const control = await securePath(root, '.dokebi');
         await mkdir(control, { recursive: true });
         const lock = join(control, 'lock');
-        // [AI:수정] 타입 명시와 경로 제어 문자 검증을 유지하면서 저장소 검사 규칙을 충족한다.
         let handle;
         try {
             handle = await open(lock, 'wx');
@@ -28,7 +26,6 @@ export class Transaction {
         try {
             await handle.writeFile(json({ pid: process.pid }));
             await handle.close();
-            // [AI:수정] 잠금 확보 후 복구 잔여물이 있으면 기존 백업을 보존하고 새 작업을 차단한다.
             if ((await readdir(control)).some((name) => name.startsWith('transaction-'))) {
                 throw new CliError('RECOVERY_REQUIRED', 'Interrupted transaction found; preserve .dokebi/transaction-* for recovery', { phase: 'unknown' });
             }
@@ -44,13 +41,31 @@ export class Transaction {
         if (!this.#snapshots.has(path))
             this.#snapshots.set(path, await fingerprint(await securePath(this.root, path)));
     }
+    async ensureDirectory(path) {
+        const parts = path.split('/');
+        for (let end = 1; end <= parts.length; end++) {
+            const current = parts.slice(0, end).join('/');
+            const planned = this.#changes.find((change) => change.path === current);
+            if (planned) {
+                if (planned.kind !== 'directory')
+                    throw new CliError('DUPLICATE_CHANGE', current);
+                continue;
+            }
+            await this.capture(current);
+            const expected = this.#snapshots.get(current);
+            if (expected === null)
+                this.#changes.push({ path: current, kind: 'directory' });
+            else if (!expected?.startsWith('directory:'))
+                throw new CliError('PATH_CONFLICT', current);
+        }
+    }
     async read(path) {
         await this.capture(path);
         return readFile(await securePath(this.root, path), 'utf8');
     }
     async write(path, content) {
         const source = join(this.directory, `new-${this.#changes.length}`);
-        await writeFile(source, content);
+        await writeFile(source, content, { mode: 0o600 });
         await this.replace(path, source);
     }
     async replace(path, source) {
@@ -62,7 +77,11 @@ export class Transaction {
     get paths() {
         return this.#changes.map((change) => change.path);
     }
-    async commit(beforeApply) {
+    /**
+     * Applies every change; `afterApply` runs once they are all in place, and when it fails the
+     * changes are rolled back like a failed apply (D-0035: the workspace npm install).
+     */
+    async commit(beforeApply, afterApply) {
         for (const [path, expected] of this.#snapshots) {
             if ((await fingerprint(await securePath(this.root, path))) !== expected) {
                 throw new CliError('CONCURRENT_CHANGE', `File changed while planning: ${path}`);
@@ -80,6 +99,19 @@ export class Transaction {
             for (const [index, change] of journal.entries()) {
                 beforeApply?.(index);
                 const target = await securePath(this.root, change.path);
+                if (change.kind === 'directory') {
+                    try {
+                        await mkdir(target);
+                        change.installed = true;
+                    }
+                    catch (error) {
+                        // A file written earlier in this commit may already have created it as a parent.
+                        if (error.code !== 'EEXIST' ||
+                            !(await lstat(target)).isDirectory())
+                            throw error;
+                    }
+                    continue;
+                }
                 await mkdir(dirname(target), { recursive: true });
                 if (change.existed) {
                     await rename(target, change.backup);
@@ -90,12 +122,25 @@ export class Transaction {
                     change.installed = true;
                 }
             }
+            await afterApply?.();
         }
         catch (cause) {
             const failures = [];
             for (const change of [...journal].reverse()) {
                 try {
                     const target = await securePath(this.root, change.path);
+                    if (change.kind === 'directory') {
+                        if (change.installed) {
+                            try {
+                                await rmdir(target);
+                            }
+                            catch (error) {
+                                if (error.code !== 'ENOENT')
+                                    throw error;
+                            }
+                        }
+                        continue;
+                    }
                     if (change.installed)
                         await rm(target, { recursive: true, force: true });
                     if (change.backedUp)

package/dist/workspace.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The root of an npm workspace that lists `project` as a member, or undefined. In a member the
+ * workspace root owns node_modules and the lock; packages are hoisted or linked there (D-0035).
+ */
+export declare function workspaceRootOf(project: string): Promise<string | undefined>;
+export interface WorkspacePackage {
+    directory: string;
+    version: string;
+}
+/** The packages of the workspace at `root` by name: their real directories and versions. */
+export declare function workspacePackages(root: string): Promise<Map<string, WorkspacePackage>>;
+/**
+ * Directory of the installed package `name` as seen from `base`. A standalone project (and the
+ * CLI's staging directory) reads only its own node_modules and never follows a symlink. A
+ * workspace member resolves like Node, from its folder up to the workspace root, and follows a
+ * package symlink only when its real path stays inside the workspace root (D-0035).
+ */
+export declare function packageDirectory(base: string, name: string): Promise<string>;
+/** A file inside an installed package; files inside packages are never symlinks. */
+export declare function packageFile(base: string, name: string, file: string): Promise<string>;
+/** `node_modules/<name>/<file>` → its real location (see packageDirectory). */
+export declare function installedPath(base: string, path: string): Promise<string>;

package/dist/workspace.js

@@ -0,0 +1,97 @@
+import { glob, readFile, realpath } from 'node:fs/promises';
+import { dirname, join, relative, sep } from 'node:path';
+import { CliError } from './errors.js';
+import { exists, relativePath, securePath } from './filesystem.js';
+/** `*` matches one path segment, `**` any number; patterns are npm `workspaces` entries. */
+function matches(pattern, path) {
+    const source = pattern
+        .replace(/\/+$/, '')
+        .split('/')
+        .map((part) => part === '**' ? '.*' : part.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*'))
+        .join('/');
+    return new RegExp(`^${source}$`).test(path);
+}
+function patternsOf(pkg) {
+    const list = Array.isArray(pkg.workspaces)
+        ? pkg.workspaces
+        : pkg.workspaces?.packages;
+    return Array.isArray(list) ? list.filter((item) => typeof item === 'string') : [];
+}
+/**
+ * The root of an npm workspace that lists `project` as a member, or undefined. In a member the
+ * workspace root owns node_modules and the lock; packages are hoisted or linked there (D-0035).
+ */
+export async function workspaceRootOf(project) {
+    for (let directory = dirname(project);; directory = dirname(directory)) {
+        try {
+            const pkg = JSON.parse(await readFile(join(directory, 'package.json'), 'utf8'));
+            const member = relative(directory, project).split(sep).join('/');
+            // Like npm: hidden folders and node_modules are never workspace members.
+            const hidden = member
+                .split('/')
+                .some((part) => part.startsWith('.') || part === 'node_modules');
+            if (!hidden && patternsOf(pkg).some((item) => matches(item, member)))
+                return directory;
+        }
+        catch {
+            /* no or unreadable package.json: keep walking up */
+        }
+        if (dirname(directory) === directory)
+            return undefined;
+    }
+}
+/** The packages of the workspace at `root` by name: their real directories and versions. */
+export async function workspacePackages(root) {
+    const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+    const result = new Map();
+    for (const pattern of patternsOf(pkg)) {
+        for await (const file of glob(`${pattern.replace(/\/+$/, '')}/package.json`, {
+            cwd: root,
+            exclude: (name) => name === 'node_modules',
+        })) {
+            const member = JSON.parse(await readFile(join(root, file), 'utf8'));
+            if (typeof member.name === 'string' && typeof member.version === 'string')
+                result.set(member.name, {
+                    directory: await realpath(join(root, dirname(file))),
+                    version: member.version,
+                });
+        }
+    }
+    return result;
+}
+/**
+ * Directory of the installed package `name` as seen from `base`. A standalone project (and the
+ * CLI's staging directory) reads only its own node_modules and never follows a symlink. A
+ * workspace member resolves like Node, from its folder up to the workspace root, and follows a
+ * package symlink only when its real path stays inside the workspace root (D-0035).
+ */
+export async function packageDirectory(base, name) {
+    relativePath('node_modules/' + name);
+    const workspace = await workspaceRootOf(base);
+    if (!workspace)
+        return securePath(base, 'node_modules/' + name);
+    const boundary = await realpath(workspace);
+    for (let directory = base;; directory = dirname(directory)) {
+        const candidate = join(directory, 'node_modules', name);
+        if (await exists(candidate)) {
+            const real = await realpath(candidate);
+            if (real !== boundary && !real.startsWith(boundary + sep))
+                throw new CliError('UNSAFE_PATH', `Package link leaves the workspace: ${name}`);
+            return real;
+        }
+        if (directory === workspace || dirname(directory) === directory)
+            break;
+    }
+    return join(workspace, 'node_modules', name);
+}
+/** A file inside an installed package; files inside packages are never symlinks. */
+export async function packageFile(base, name, file) {
+    return securePath(await packageDirectory(base, name), file);
+}
+/** `node_modules/<name>/<file>` → its real location (see packageDirectory). */
+export async function installedPath(base, path) {
+    const match = /^node_modules\/((?:@[^/]+\/)?[^/]+)\/(.+)$/.exec(path);
+    if (!match?.[1] || !match[2])
+        return securePath(base, path);
+    return packageFile(base, match[1], match[2]);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dokebi/cli",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "private": false,
   "publishConfig": {
     "access": "public",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "engines": {
-    "node": "^24.21.0 || ^26.11.1"
+    "node": ">=24.0.0"
   },
   "bin": {
     "dokebi": "./dist/bin.js"
@@ -24,8 +24,9 @@
   },
   "dependencies": {
     "semver": "7.8.5",
-    "@dokebi/core": "0.1.1",
-    "ajv": "8.20.0"
+    "@dokebi/core": "0.2.0",
+    "@dokebi/config": "0.2.0",
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "@types/semver": "7.8.0"