@goldziher/voom 0.0.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Na'aman Hirschfeld
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 # @goldziher/voom
 
-Fast, safe, parallel build-artifact pruning across 20+ language ecosystems.
+Fast, safe, parallel build-artifact pruning across every major language ecosystem.
 
 ```bash
 npm install -g @goldziher/voom

package/bin/voom

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+// The `voom` command. Resolves the binary — fetching it on first run — and hands over to it.
+//
+// A committed launcher rather than the binary itself, because npm links `bin` at install time
+// and the binary does not exist yet at that point. See download.js for why the download is not
+// a postinstall script.
+
+const { spawn } = require("node:child_process");
+const { ensureBinary } = require("../download.js");
+
+ensureBinary()
+  .then((binaryPath) => {
+    const child = spawn(binaryPath, process.argv.slice(2), { stdio: "inherit" });
+    // Exit the way the binary did. A signal death has no exit status, and reporting 0 for one
+    // would tell a hook or a CI job that a sweep interrupted halfway through had succeeded.
+    child.on("exit", (code, signal) => {
+      if (signal) {
+        process.kill(process.pid, signal);
+        return;
+      }
+      process.exit(code ?? 1);
+    });
+    child.on("error", (error) => {
+      process.stderr.write(`voom: could not run ${binaryPath}: ${error.message}\n`);
+      process.exit(1);
+    });
+  })
+  .catch((error) => {
+    process.stderr.write(`voom: ${error.message}\n`);
+    process.exit(1);
+  });

package/download.js

@@ -0,0 +1,171 @@
+// Resolves the voom binary, fetching it from the GitHub release on first use.
+//
+// This is deliberately *not* a postinstall script. npm 11.19 blocks install scripts by default
+// (`allow-scripts`), and a blocked postinstall does not merely skip the download — npm declines
+// to create the bin link at all, so `npm i -g @goldziher/voom` produced `voom: command not
+// found` and `npx -y @goldziher/voom` silently did nothing. Fetching lazily from `bin/voom`
+// instead means the package works with scripts disabled, which is now the default and will only
+// get stricter. It is also what the PyPI wrapper has always done (pip-package/voom/downloader.py),
+// so the two channels now behave the same way.
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const https = require("node:https");
+const http = require("node:http");
+const tar = require("tar");
+const AdmZip = require("adm-zip");
+
+const { version } = require("./package.json");
+
+const REPO = "Goldziher/voom";
+const BINARY = "voom";
+
+function getPlatformTriple() {
+  const type = os.type();
+  const arch = os.arch();
+
+  if (type === "Windows_NT") {
+    if (arch === "x64") return "x86_64-pc-windows-gnu";
+    throw new Error(`Unsupported Windows architecture: ${arch}`);
+  }
+
+  if (type === "Linux") {
+    if (arch === "x64") return "x86_64-unknown-linux-gnu";
+    if (arch === "arm64") return "aarch64-unknown-linux-gnu";
+    throw new Error(`Unsupported Linux architecture: ${arch}`);
+  }
+
+  if (type === "Darwin") {
+    if (arch === "x64") return "x86_64-apple-darwin";
+    if (arch === "arm64") return "aarch64-apple-darwin";
+    throw new Error(`Unsupported macOS architecture: ${arch}`);
+  }
+
+  throw new Error(`Unsupported platform: ${type} ${arch}`);
+}
+
+// npm keeps the `-rc.N` form that git tags use, so no normalization is needed here.
+// The PyPI wrapper does need it — see pip-package/voom/downloader.py.
+function getBinaryUrl() {
+  const platform = getPlatformTriple();
+  const ext = platform.includes("windows") ? "zip" : "tar.gz";
+  return `https://github.com/${REPO}/releases/download/v${version}/${BINARY}-${platform}.${ext}`;
+}
+
+// Per-user rather than inside the package directory: a global install often lands in a
+// root-owned prefix that the running user cannot write to, which is exactly when the first run
+// would need to write. Keyed by version so an upgrade fetches rather than reusing the old one.
+function cacheDir() {
+  if (os.type() === "Windows_NT" && process.env.LOCALAPPDATA) {
+    return path.join(process.env.LOCALAPPDATA, BINARY, version);
+  }
+  return path.join(os.homedir(), ".cache", BINARY, version);
+}
+
+function binaryName() {
+  return os.type() === "Windows_NT" ? `${BINARY}.exe` : BINARY;
+}
+
+function downloadWithRedirects(url, dest, maxRedirects = 5) {
+  return new Promise((resolve, reject) => {
+    if (maxRedirects <= 0) {
+      return reject(new Error("Too many redirects"));
+    }
+
+    const urlObj = new URL(url);
+    const client = urlObj.protocol === "https:" ? https : http;
+
+    const req = client.get(url, { headers: { "User-Agent": "voom-npm-wrapper" } }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        return downloadWithRedirects(res.headers.location, dest, maxRedirects - 1)
+          .then(resolve)
+          .catch(reject);
+      }
+
+      if (res.statusCode !== 200) {
+        return reject(new Error(`HTTP ${res.statusCode}: ${res.statusMessage}`));
+      }
+
+      const file = fs.createWriteStream(dest);
+      res.pipe(file);
+
+      file.on("finish", () => {
+        file.close();
+        resolve();
+      });
+
+      file.on("error", (err) => {
+        fs.unlink(dest, () => {});
+        reject(err);
+      });
+    });
+
+    req.on("error", reject);
+    req.setTimeout(30000, () => {
+      req.destroy();
+      reject(new Error("Download timeout"));
+    });
+  });
+}
+
+/// Returns a path to the voom binary, downloading it on first use.
+async function ensureBinary() {
+  const override = process.env.VOOM_BINARY;
+  if (override) {
+    return override;
+  }
+
+  const dir = cacheDir();
+  const name = binaryName();
+  const binaryPath = path.join(dir, name);
+  if (fs.existsSync(binaryPath)) {
+    return binaryPath;
+  }
+
+  const url = getBinaryUrl();
+  const isZip = url.endsWith(".zip");
+  fs.mkdirSync(dir, { recursive: true });
+
+  // Two concurrent invocations would otherwise race on the same target. Each unpacks into its
+  // own staging directory and renames, which is atomic within a filesystem — the loser's rename
+  // simply replaces an identical file.
+  const staging = fs.mkdtempSync(path.join(dir, ".staging-"));
+  const archivePath = path.join(staging, isZip ? `${BINARY}.zip` : `${BINARY}.tar.gz`);
+
+  process.stderr.write(`Downloading voom binary v${version}...\n`);
+  try {
+    await downloadWithRedirects(url, archivePath);
+
+    if (isZip) {
+      const zip = new AdmZip(archivePath);
+      const entry = zip.getEntries().find((e) => e.entryName.endsWith(name));
+      if (!entry) {
+        throw new Error("Binary not found in downloaded archive");
+      }
+      zip.extractEntryTo(entry, staging, false, true);
+    } else {
+      await tar.extract({
+        file: archivePath,
+        cwd: staging,
+        filter: (entryPath) => entryPath.endsWith(name),
+      });
+    }
+
+    const staged = path.join(staging, name);
+    if (!fs.existsSync(staged)) {
+      throw new Error("Binary not found in downloaded archive");
+    }
+    if (os.type() !== "Windows_NT") {
+      fs.chmodSync(staged, 0o755);
+    }
+    fs.renameSync(staged, binaryPath);
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+  }
+
+  process.stderr.write("Binary downloaded successfully.\n");
+  return binaryPath;
+}
+
+module.exports = { ensureBinary, getBinaryUrl, getPlatformTriple };

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@goldziher/voom",
-  "version": "0.0.0",
-  "description": "Placeholder release reserving the package name. Install 0.1.0 or later for the actual CLI.",
-  "keywords": ["cleanup", "build", "artifacts", "disk-space", "cli", "prune", "rust", "monorepo"],
+  "version": "0.2.0",
+  "description": "Fast, safe, parallel build-artifact pruning across every major language ecosystem",
+  "bin": {
+    "voom": "bin/voom"
+  },
+  "keywords": ["clean", "cleanup", "build-artifacts", "disk-space", "monorepo", "cli", "prune", "rust"],
   "author": "Na'aman Hirschfeld <nhirschfeld@gmail.com>",
   "license": "MIT",
   "repository": {
@@ -16,8 +19,12 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["README.md"],
+  "dependencies": {
+    "adm-zip": "^0.6.0",
+    "tar": "^7.0.0"
+  },
+  "files": ["bin/", "download.js", "LICENSE", "README.md"],
   "engines": {
-    "node": ">=14"
+    "node": ">=18"
   }
 }