@mevdragon/vidfarm-devcli 0.2.7 → 0.2.9

package/dist/src/services/template-sources.js

@@ -1,4 +1,6 @@
-import { existsSync, mkdirSync } from "node:fs";
+import { createHash, createHmac } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -9,7 +11,9 @@ import { defaultSkillPathForTemplateModule, deriveTemplateRootDirFromModulePath
 import { nowIso } from "../lib/time.js";
 import { loadTemplateFromModule } from "./template-loader.js";
 import { TemplateCertificationService } from "./template-certification.js";
+import { StorageService } from "./storage.js";
 const execFileAsync = promisify(execFile);
+const storage = new StorageService();
 export class TemplateSourceAlreadyRegisteredError extends Error {
     existingSource;
     conflictField;
@@ -22,8 +26,8 @@ export class TemplateSourceAlreadyRegisteredError extends Error {
 }
 export class TemplateSourceService {
     certification = new TemplateCertificationService();
-    listSources(status) {
-        return database.listTemplateSources(status);
+    listSources(input) {
+        return database.listTemplateSources(input);
     }
     listReleases(input) {
         return database.listTemplateReleases(input);
@@ -127,14 +131,26 @@ export class TemplateSourceService {
         if (!source) {
             throw new Error("Template source not found.");
         }
-        const commitSha = input.commitSha ?? await this.resolveBranchHead(source.repoUrl, source.branch);
+        const artifactManifest = input.artifactManifestKey
+            ? await this.loadAndVerifyArtifactManifest(input.artifactManifestKey, source)
+            : null;
+        const commitSha = artifactManifest?.commit_sha ?? input.commitSha ?? await this.resolveBranchHead(source.repoUrl, source.branch);
         const checkoutPath = path.join(config.TEMPLATE_SOURCE_ROOT, source.templateId, commitSha);
-        const skillPath = path.join(checkoutPath, source.skillPath);
+        const skillPath = path.join(checkoutPath, artifactManifest?.skill_path ?? source.skillPath);
         const authRepoUrl = this.resolveGitRemoteUrl(source.repoUrl);
         if (!existsSync(checkoutPath)) {
             mkdirSync(path.dirname(checkoutPath), { recursive: true });
-            await this.runShell(["git", "clone", "--branch", source.branch, authRepoUrl, checkoutPath], process.cwd());
-            await this.runShell(["git", "checkout", commitSha], checkoutPath);
+            if (artifactManifest) {
+                await this.extractArtifactToCheckout({
+                    checkoutPath,
+                    artifactKey: artifactManifest.artifact_key,
+                    expectedSha256: artifactManifest.artifact_sha256
+                });
+            }
+            else {
+                await this.runShell(["git", "clone", "--branch", source.branch, authRepoUrl, checkoutPath], process.cwd());
+                await this.runShell(["git", "checkout", commitSha], checkoutPath);
+            }
             if (source.installCommand.trim()) {
                 await this.runCommandString(source.installCommand, checkoutPath);
             }
@@ -161,11 +177,112 @@ export class TemplateSourceService {
             checkoutPath,
             skillPath,
             modulePath,
+            artifactManifestKey: input.artifactManifestKey ?? null,
+            artifactKey: artifactManifest?.artifact_key ?? null,
             status,
             certificationReport,
             activatedAt: null
         });
     }
+    async publishRelease(input) {
+        const source = database.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        if (source.status !== "approved") {
+            throw new Error("Template source must be approved before a developer can publish an update.");
+        }
+        const trimmedCommitSha = input.commitSha.trim();
+        if (!trimmedCommitSha) {
+            throw new Error("commit_sha is required.");
+        }
+        const existingRelease = database.getTemplateReleaseBySourceAndCommit(source.id, trimmedCommitSha);
+        if (existingRelease &&
+            (existingRelease.status === "pending_approval"
+                || existingRelease.status === "approved"
+                || existingRelease.status === "active")) {
+            return {
+                source,
+                release: existingRelease,
+                publishAction: "updated"
+            };
+        }
+        const release = await this.importRelease({
+            sourceId: source.id,
+            commitSha: trimmedCommitSha
+        });
+        return {
+            source,
+            release,
+            publishAction: existingRelease ? "updated" : "created"
+        };
+    }
+    async publishArtifactRelease(input) {
+        const source = database.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        if (source.status !== "approved") {
+            throw new Error("Template source must be approved before a developer can publish an update.");
+        }
+        const trimmedCommitSha = input.commitSha.trim();
+        const trimmedArtifactSha256 = input.artifactSha256.trim().toLowerCase();
+        if (!trimmedCommitSha) {
+            throw new Error("commit_sha is required.");
+        }
+        if (!/^[0-9a-f]{64}$/i.test(trimmedArtifactSha256)) {
+            throw new Error("artifact_sha256 must be a 64-character hexadecimal SHA-256 hash.");
+        }
+        const existingRelease = database.getTemplateReleaseBySourceAndCommit(source.id, trimmedCommitSha);
+        if (existingRelease &&
+            (existingRelease.status === "pending_approval"
+                || existingRelease.status === "approved"
+                || existingRelease.status === "active")) {
+            return {
+                source,
+                release: existingRelease,
+                publishAction: "updated"
+            };
+        }
+        const { manifestKey } = await this.createSignedArtifactManifest({
+            source,
+            commitSha: trimmedCommitSha,
+            artifactSha256: trimmedArtifactSha256,
+            signedBy: input.signedBy
+        });
+        const release = await this.importRelease({
+            sourceId: source.id,
+            artifactManifestKey: manifestKey
+        });
+        return {
+            source,
+            release,
+            publishAction: existingRelease ? "updated" : "created"
+        };
+    }
+    async createDeveloperArtifactUpload(input) {
+        const source = database.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        if (source.status !== "approved") {
+            throw new Error("Template source must be approved before a developer can publish an update.");
+        }
+        const trimmedCommitSha = input.commitSha.trim();
+        if (!trimmedCommitSha) {
+            throw new Error("commit_sha is required.");
+        }
+        const artifact = this.buildArtifactKeys(source, trimmedCommitSha);
+        const upload = await storage.createWriteUrl(artifact.artifactKey, {
+            contentType: "application/gzip",
+            publicRead: false,
+            expiresIn: 3600
+        });
+        return {
+            ...artifact,
+            upload
+        };
+    }
     approveSource(input) {
         const source = database.getTemplateSource(input.sourceId);
         if (!source) {
@@ -251,6 +368,7 @@ export class TemplateSourceService {
             });
             throw new Error("Template release failed certification and cannot be activated.");
         }
+        await this.syncTemplateAboutAssets({ release, template });
         database.clearActiveTemplateReleases(release.templateId);
         database.updateTemplateReleaseStatus({
             id: release.id,
@@ -315,6 +433,174 @@ export class TemplateSourceService {
             }
         });
     }
+    async syncTemplateAboutAssets(input) {
+        const entries = Array.from(new Set(input.template.about.preview_media
+            .filter((entry) => !/^https?:\/\//i.test(entry))
+            .filter((entry) => !entry.replace(/^\/+/, "").startsWith("templates/"))));
+        for (const entry of entries) {
+            const asset = this.resolveTemplateAboutAsset(input.release, entry);
+            if (!asset) {
+                throw new Error(`Template about asset not found in release checkout: ${entry}`);
+            }
+            await storage.putBuffer(storage.templateAboutKey(input.template.id, asset.storageAssetPath), readFileSync(asset.sourcePath), inferContentType(asset.sourcePath));
+        }
+    }
+    resolveTemplateAboutAsset(release, entry) {
+        const normalizedEntry = entry.replace(/^\/+/, "");
+        const sourceRelativePath = normalizedEntry.startsWith("about/")
+            ? normalizedEntry
+            : path.posix.join("about", normalizedEntry);
+        const storageAssetPath = normalizedEntry.startsWith("about/")
+            ? normalizedEntry.slice("about/".length)
+            : normalizedEntry;
+        const checkoutRoot = path.resolve(release.checkoutPath);
+        let currentDir = path.dirname(release.modulePath);
+        while (true) {
+            const candidatePath = path.join(currentDir, sourceRelativePath);
+            if (existsSync(candidatePath)) {
+                return {
+                    sourcePath: candidatePath,
+                    storageAssetPath
+                };
+            }
+            if (path.resolve(currentDir) === checkoutRoot) {
+                break;
+            }
+            const parentDir = path.dirname(currentDir);
+            if (parentDir === currentDir) {
+                break;
+            }
+            currentDir = parentDir;
+        }
+        return null;
+    }
+    async loadAndVerifyArtifactManifest(manifestKey, source) {
+        const raw = await storage.readText(manifestKey);
+        if (!raw) {
+            throw new Error(`Artifact manifest not found: ${manifestKey}`);
+        }
+        const manifest = JSON.parse(raw);
+        if (manifest.version !== 1 || manifest.algorithm !== "hmac-sha256") {
+            throw new Error("Unsupported template artifact manifest version or algorithm.");
+        }
+        if (!config.ARTIFACT_SIGNING_SECRET) {
+            throw new Error("ARTIFACT_SIGNING_SECRET or SUPERAGENCY_KEY is required to verify artifact manifests.");
+        }
+        const expectedSignature = createHmac("sha256", config.ARTIFACT_SIGNING_SECRET)
+            .update(this.serializeArtifactManifestPayload({
+            version: 1,
+            algorithm: "hmac-sha256",
+            template_id: String(manifest.template_id ?? ""),
+            slug_id: String(manifest.slug_id ?? ""),
+            repo_url: String(manifest.repo_url ?? ""),
+            branch: String(manifest.branch ?? ""),
+            commit_sha: String(manifest.commit_sha ?? ""),
+            template_module_path: String(manifest.template_module_path ?? ""),
+            skill_path: String(manifest.skill_path ?? ""),
+            install_command: String(manifest.install_command ?? ""),
+            build_command: String(manifest.build_command ?? ""),
+            artifact_key: String(manifest.artifact_key ?? ""),
+            artifact_sha256: String(manifest.artifact_sha256 ?? ""),
+            created_at: String(manifest.created_at ?? ""),
+            signed_by: String(manifest.signed_by ?? "")
+        }))
+            .digest("hex");
+        if (manifest.signature !== expectedSignature) {
+            throw new Error("Template artifact manifest signature verification failed.");
+        }
+        if (manifest.template_id !== source.templateId || manifest.slug_id !== source.slugId) {
+            throw new Error("Template artifact manifest does not match the registered template identity.");
+        }
+        if (manifest.repo_url !== source.repoUrl || manifest.branch !== source.branch) {
+            throw new Error("Template artifact manifest does not match the registered repo URL or branch.");
+        }
+        if (manifest.template_module_path !== source.templateModulePath) {
+            throw new Error("Template artifact manifest does not match the registered template module path.");
+        }
+        if (manifest.skill_path !== source.skillPath) {
+            throw new Error("Template artifact manifest does not match the registered skill path.");
+        }
+        if (manifest.install_command !== source.installCommand || manifest.build_command !== source.buildCommand) {
+            throw new Error("Template artifact manifest does not match the registered install or build command.");
+        }
+        return manifest;
+    }
+    async extractArtifactToCheckout(input) {
+        const archive = await storage.readBuffer(input.artifactKey);
+        if (!archive) {
+            throw new Error(`Template artifact not found: ${input.artifactKey}`);
+        }
+        const actualSha256 = createHash("sha256").update(archive).digest("hex");
+        if (actualSha256 !== input.expectedSha256) {
+            throw new Error(`Template artifact hash mismatch for ${input.artifactKey}.`);
+        }
+        mkdirSync(input.checkoutPath, { recursive: true });
+        const tempArchivePath = path.join(os.tmpdir(), `vidfarm-template-${createId("tmp")}.tar.gz`);
+        writeFileSync(tempArchivePath, archive);
+        try {
+            await execFileAsync("tar", ["-xzf", tempArchivePath, "-C", input.checkoutPath], { cwd: process.cwd() });
+        }
+        finally {
+            rmSync(tempArchivePath, { force: true });
+        }
+    }
+    serializeArtifactManifestPayload(input) {
+        return JSON.stringify({
+            version: input.version,
+            algorithm: input.algorithm,
+            template_id: input.template_id,
+            slug_id: input.slug_id,
+            repo_url: input.repo_url,
+            branch: input.branch,
+            commit_sha: input.commit_sha,
+            template_module_path: input.template_module_path,
+            skill_path: input.skill_path,
+            install_command: input.install_command,
+            build_command: input.build_command,
+            artifact_key: input.artifact_key,
+            artifact_sha256: input.artifact_sha256,
+            created_at: input.created_at,
+            signed_by: input.signed_by
+        });
+    }
+    buildArtifactKeys(source, commitSha) {
+        return {
+            artifactKey: `template-artifacts/${source.templateId}/${commitSha}/source.tar.gz`,
+            manifestKey: `template-artifacts/${source.templateId}/${commitSha}/manifest.json`
+        };
+    }
+    async createSignedArtifactManifest(input) {
+        const artifact = this.buildArtifactKeys(input.source, input.commitSha);
+        const createdAt = nowIso();
+        const payload = {
+            version: 1,
+            algorithm: "hmac-sha256",
+            template_id: input.source.templateId,
+            slug_id: input.source.slugId,
+            repo_url: input.source.repoUrl,
+            branch: input.source.branch,
+            commit_sha: input.commitSha,
+            template_module_path: input.source.templateModulePath,
+            skill_path: input.source.skillPath,
+            install_command: input.source.installCommand,
+            build_command: input.source.buildCommand,
+            artifact_key: artifact.artifactKey,
+            artifact_sha256: input.artifactSha256,
+            created_at: createdAt,
+            signed_by: input.signedBy
+        };
+        const signature = createHmac("sha256", config.ARTIFACT_SIGNING_SECRET)
+            .update(this.serializeArtifactManifestPayload(payload))
+            .digest("hex");
+        await storage.putText(artifact.manifestKey, JSON.stringify({
+            ...payload,
+            signature
+        }, null, 2), "application/json");
+        return {
+            ...artifact,
+            signature
+        };
+    }
     resolveGitRemoteUrl(repoUrl) {
         const githubToken = config.VIDFARM_GITHUB_TOKEN || config.GITHUB_TOKEN;
         if (!githubToken) {
@@ -341,3 +627,26 @@ export class TemplateSourceService {
         throw new Error(`Template module path ${declaredModulePath} was not found in the imported release.`);
     }
 }
+function inferContentType(filePath) {
+    switch (path.extname(filePath).toLowerCase()) {
+        case ".png":
+            return "image/png";
+        case ".gif":
+            return "image/gif";
+        case ".jpg":
+        case ".jpeg":
+            return "image/jpeg";
+        case ".webp":
+            return "image/webp";
+        case ".svg":
+            return "image/svg+xml";
+        case ".mp4":
+            return "video/mp4";
+        case ".webm":
+            return "video/webm";
+        case ".mov":
+            return "video/quicktime";
+        default:
+            return "application/octet-stream";
+    }
+}