@ducking-mind/proxy-app-cli 0.1.0 → 0.1.1

package/release-runtime/release-config.mjs

@@ -0,0 +1,154 @@
+import { access, readFile } from 'node:fs/promises'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// This file deliberately contains no credentials. A developer may copy
+// release.config.example.json to release.config.json (which is gitignored)
+// and put the publish key in that local file.
+export const DEFAULT_RELEASE_CONFIG = Object.freeze({
+  product: 'duckingmind',
+  updateURL: '',
+  updateChannel: 'latest',
+  apiURL: '',
+  apiKey: '',
+  releaseNotes: '',
+  artifactBaseURL: '',
+})
+
+export function parseConfigOption(args) {
+  const rest = []
+  let configPath
+  let envOverrides = false
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index]
+    if (value === '--env-overrides') { envOverrides = true; continue }
+    if (value === '--config') {
+      const next = args[++index]
+      if (!next || next.startsWith('--')) throw new Error('Missing value for --config')
+      configPath = next
+      continue
+    }
+    if (value.startsWith('--config=')) {
+      configPath = value.slice('--config='.length)
+      if (!configPath) throw new Error('Missing value for --config')
+      continue
+    }
+    rest.push(value)
+  }
+  return { args: rest, configPath, envOverrides }
+}
+
+function stringValue(value, fallback = '') {
+  return value == null ? fallback : String(value).trim()
+}
+
+function flattenConfig(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('发布配置必须是 JSON 对象')
+  const update = value.update && typeof value.update === 'object' ? value.update : {}
+  const release = value.release && typeof value.release === 'object' ? value.release : {}
+  const build = value.build && typeof value.build === 'object' ? value.build : {}
+  return {
+    product: stringValue(value.product ?? release.product, 'duckingmind'),
+    updateURL: stringValue(value.updateURL ?? value.updateUrl ?? value.update_url ?? update.url ?? update.updateURL ?? update.update_url),
+    updateChannel: stringValue(value.updateChannel ?? value.channel ?? update.channel, 'latest'),
+    apiURL: stringValue(value.apiURL ?? value.apiUrl ?? value.api_url ?? release.apiURL ?? release.apiUrl ?? release.api_url),
+    apiKey: stringValue(value.apiKey ?? value.api_key ?? release.apiKey ?? release.api_key),
+    releaseNotes: stringValue(value.releaseNotes ?? value.release_notes ?? value.notes ?? release.releaseNotes ?? release.release_notes ?? release.notes),
+    artifactBaseURL: stringValue(value.artifactBaseURL ?? value.artifactBaseUrl ?? value.artifact_base_url ?? release.artifactBaseURL ?? release.artifactBaseUrl ?? release.artifact_base_url),
+    buildTarget: { platform: stringValue(build.platform), arch: stringValue(build.arch) },
+    releaseDirs: release.directories ?? ['release'],
+    recordPaths: release.records ?? [],
+  }
+}
+
+function envOverrides(env = process.env) {
+  const keys = {
+    product: 'PROXY_DESKTOP_PRODUCT',
+    updateURL: 'PROXY_DESKTOP_UPDATE_URL',
+    updateChannel: 'PROXY_DESKTOP_UPDATE_CHANNEL',
+    apiURL: 'PROXY_DESKTOP_RELEASE_API_URL',
+    apiKey: 'PROXY_DESKTOP_RELEASE_API_KEY',
+    releaseNotes: 'PROXY_DESKTOP_RELEASE_NOTES',
+    artifactBaseURL: 'PROXY_DESKTOP_ARTIFACT_BASE_URL',
+  }
+  return Object.fromEntries(Object.entries(keys).filter(([, key]) => env[key] != null && String(env[key]).trim() !== '').map(([name, key]) => [name, String(env[key]).trim()]))
+}
+
+async function firstExisting(paths) {
+  for (const path of paths) {
+    try {
+      await access(path)
+      return path
+    } catch {}
+  }
+  return undefined
+}
+
+export function defaultConfigPaths({ root, cwd = process.cwd() }) {
+  const candidates = [join(root, 'release.config.json'), join(root, 'release.config.local.json')]
+  if (cwd && resolve(cwd) !== resolve(root)) {
+    candidates.push(join(cwd, 'desktop', 'release.config.json'), join(cwd, 'desktop', 'release.config.local.json'))
+  }
+  return [...new Set(candidates)]
+}
+
+export function isAllowedReleaseURL(value) {
+  let parsed
+  try { parsed = new URL(String(value || '').trim()) } catch { return false }
+  const loopbackHTTP = parsed.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)
+  return (parsed.protocol === 'https:' || loopbackHTTP) && !parsed.username && !parsed.password && !parsed.search && !parsed.hash
+}
+
+export async function loadReleaseConfig({ root = releaseConfigRoot(), cwd = process.env.INIT_CWD || process.cwd(), configPath, env = process.env, envOverrides: allowEnv = false } = {}) {
+  const explicit = configPath || (allowEnv ? env.PROXY_DESKTOP_RELEASE_CONFIG : '')
+  const selected = explicit
+    ? resolve(cwd, explicit)
+    : await firstExisting(defaultConfigPaths({ root, cwd }))
+  let fileConfig = {}
+  if (selected) {
+    try {
+      fileConfig = JSON.parse(await readFile(selected, 'utf8'))
+    } catch (error) {
+      // JSON parser errors may contain excerpts from the key. Never echo them.
+      throw new Error(`无法读取发布配置 ${selected}: ${error.code || 'invalid JSON'}`)
+    }
+  } else if (explicit) {
+    throw new Error(`发布配置不存在: ${selected}`)
+  }
+  const values = { ...DEFAULT_RELEASE_CONFIG, ...flattenConfig(fileConfig), ...(allowEnv ? envOverrides(env) : {}) }
+  const configDirectory = selected ? dirname(selected) : root
+  for (const field of ['releaseDirs', 'recordPaths']) {
+    if (!Array.isArray(values[field]) || values[field].some(path => typeof path !== 'string' || !path.trim())) throw new Error(`发布配置 release.${field === 'releaseDirs' ? 'directories' : 'records'} 必须是路径数组`)
+    values[field] = values[field].map(path => resolve(configDirectory, path))
+  }
+  if (allowEnv) {
+    if (env.PROXY_DESKTOP_PLATFORM) values.buildTarget.platform = env.PROXY_DESKTOP_PLATFORM
+    if (env.PROXY_DESKTOP_ARCH) values.buildTarget.arch = env.PROXY_DESKTOP_ARCH
+  }
+  return { ...values, path: selected }
+}
+
+export function validateReleaseConfig(config, { requireUpdateURL = false, requirePublish = false } = {}) {
+  const updateURL = stringValue(config?.updateURL)
+  const channel = stringValue(config?.updateChannel || 'latest')
+  if (requireUpdateURL && !updateURL) throw new Error('发布配置缺少 update.url')
+  if (updateURL) {
+    let parsed
+    const resolved = updateURL.replaceAll('{platform}', 'darwin').replaceAll('{arch}', 'arm64')
+    try { parsed = new URL(resolved) } catch { throw new Error('发布配置 update.url 必须是 HTTPS 或本机回环 HTTP 地址') }
+    if (!isAllowedReleaseURL(resolved)) throw new Error('发布配置 update.url 必须是无凭据、无查询参数的 HTTPS 或本机回环 HTTP 地址')
+  }
+  if (!['latest', 'beta'].includes(channel)) throw new Error('发布配置 update.channel 必须是 latest 或 beta')
+  if (requirePublish) {
+    let parsed
+    const apiURL = stringValue(config?.apiURL)
+    try { parsed = new URL(apiURL) } catch { throw new Error('发布配置 release.apiUrl 必须是 HTTPS 或本机回环 HTTP 地址') }
+    if (!isAllowedReleaseURL(apiURL)) throw new Error('发布配置 release.apiUrl 必须是无凭据、无查询参数的 HTTPS 或本机回环 HTTP 地址')
+    if (!stringValue(config?.apiKey)) throw new Error('发布配置 release.apiKey 不能为空')
+  }
+  return { ...config, updateURL, updateChannel: channel }
+}
+
+export function releaseConfigRoot() {
+  return join(dirname(fileURLToPath(import.meta.url)), '..')
+}

package/release-runtime/release-target.mjs

@@ -0,0 +1,48 @@
+import { isAllowedReleaseURL } from './release-config.mjs'
+
+const platforms = new Map([
+  ['--mac', 'darwin'], ['--macos', 'darwin'], ['-m', 'darwin'],
+  ['--win', 'win32'], ['--windows', 'win32'], ['-w', 'win32'],
+  ['--linux', 'linux'], ['-l', 'linux'],
+])
+const architectures = new Set(['x64', 'arm64', 'ia32'])
+
+// An update feed is specific to one OS/CPU. Build each target separately so
+// the packaged feed and the generated release record always describe its bytes.
+export function releaseTarget(args, host = process) {
+  const requestedPlatforms = new Set()
+  const requestedArchitectures = new Set()
+  for (let i = 0; i < args.length; i += 1) {
+    const value = args[i]
+    const platformFlag = value.split('=')[0]
+    if (platforms.has(platformFlag)) requestedPlatforms.add(platforms.get(platformFlag))
+    if (value === '--armv7l') throw new Error('Unsupported release architecture: armv7l')
+    if (value === '--universal') throw new Error('Release builds require a separate arm64 or x64 package; --universal is unsupported')
+    const arch = value === '--arch' ? args[++i] : value.replace(/^--(?:arch=)?/, '')
+    if (architectures.has(arch)) requestedArchitectures.add(arch)
+    else if (value === '--arch' || value.startsWith('--arch=')) throw new Error(`Unsupported release architecture: ${arch}`)
+  }
+  if (requestedPlatforms.size > 1 || requestedArchitectures.size > 1) {
+    throw new Error('Build one platform and architecture at a time; publish their release records together')
+  }
+  const platform = [...requestedPlatforms][0] || host.platform
+  const arch = [...requestedArchitectures][0] || host.arch
+  if (!['darwin', 'win32', 'linux'].includes(platform) || !architectures.has(arch) || (platform === 'darwin' && arch === 'ia32')) {
+    throw new Error(`Unsupported release target: ${platform}/${arch}`)
+  }
+  return { platform, arch }
+}
+
+export function releaseFeedURL(value, target) {
+  const resolved = String(value || '').trim().replaceAll('{platform}', target.platform).replaceAll('{arch}', target.arch).replace(/\/+$/, '')
+  let url
+  try { url = new URL(resolved) } catch { throw new Error('发布配置 update.url 必须是 HTTPS 或本机回环 HTTP 更新目录地址') }
+  if (!isAllowedReleaseURL(resolved)) {
+    throw new Error('发布配置 update.url 必须是无凭据、无查询参数或片段的 HTTPS 或本机回环 HTTP 更新目录地址')
+  }
+  const routeTarget = /\/(darwin|win32|linux)\/(arm64|x64|ia32)$/.exec(url.pathname)
+  if (routeTarget && (routeTarget[1] !== target.platform || routeTarget[2] !== target.arch)) {
+    throw new Error(`Update URL target does not match ${target.platform}/${target.arch}; use {platform}/{arch} placeholders`)
+  }
+  return resolved
+}