@niuwoai/willdeep 0.0.0-stage → 0.129.0-rc5

package/bin/willdeep.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+'use strict';
+
+const { spawn } = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const binary = path.join(__dirname, process.platform === 'win32' ? 'willdeep.exe' : 'willdeep');
+if (!fs.existsSync(binary)) {
+  process.stderr.write('willdeep 还没有安装完成。请重新执行 npm install willdeep。\n');
+  process.exit(1);
+}
+
+const child = spawn(binary, process.argv.slice(2), { stdio: 'inherit' });
+child.on('error', (error) => {
+  process.stderr.write(`无法启动 willdeep：${error.message}\n`);
+  process.exit(1);
+});
+child.on('exit', (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+  process.exit(code == null ? 1 : code);
+});

package/install-manifest.json

@@ -0,0 +1,23 @@
+{
+  "version": "0.129.0-rc5",
+  "repository": "niuwoai/willdeep-cli",
+  "tag": "v0.129.0-rc5",
+  "assets": {
+    "willdeep-macos-universal.tar.gz": {
+      "name": "willdeep-macos-universal.tar.gz",
+      "sha256": "42ed0848aedeac764f74f363d14cf175bbfee5d298e34500fa9b992ea9371aea"
+    },
+    "willdeep-linux-amd64.tar.gz": {
+      "name": "willdeep-linux-amd64.tar.gz",
+      "sha256": "72cffc665c05cc9eb4b4afc6d01663b0fc9ccea257192abffbd4c65c1ccf4125"
+    },
+    "willdeep-linux-arm64.tar.gz": {
+      "name": "willdeep-linux-arm64.tar.gz",
+      "sha256": "bb5ebbc242e90977ce1a9d9affead118ce608ad588324ef58c4d58d5ec46a26f"
+    },
+    "willdeep-windows-x64.zip": {
+      "name": "willdeep-windows-x64.zip",
+      "sha256": "d52b89972084c8074e5840bed01be2229b3c352a82a19d201594564439ac9ee0"
+    }
+  }
+}

package/lib/install.js

@@ -0,0 +1,31 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { installWilldeep } = require('./release');
+
+async function main() {
+  const packageRoot = path.resolve(__dirname, '..');
+  const manifest = JSON.parse(fs.readFileSync(path.join(packageRoot, 'install-manifest.json'), 'utf8'));
+  const destination = path.join(packageRoot, 'bin', process.platform === 'win32' ? 'willdeep.exe' : 'willdeep');
+  const installed = await installWilldeep({
+    manifest,
+    platform: process.platform,
+    arch: process.arch,
+    destination,
+    packageRoot,
+    fetchImpl: global.fetch,
+  });
+  if (!installed.reused) {
+    process.stdout.write(`已安装 WillDeep ${manifest.version}（${installed.asset.name}）。\n`);
+  }
+}
+
+if (require.main === module) {
+  main().catch((error) => {
+    process.stderr.write(`${error.stack}\n`);
+    process.exitCode = 1;
+  });
+}
+
+module.exports = { main };

package/lib/release.js

@@ -0,0 +1,146 @@
+'use strict';
+
+const { createHash } = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const PLATFORMS = Object.freeze({
+  'darwin-x64': 'willdeep-macos-universal.tar.gz',
+  'darwin-arm64': 'willdeep-macos-universal.tar.gz',
+  'linux-x64': 'willdeep-linux-amd64.tar.gz',
+  'linux-arm64': 'willdeep-linux-arm64.tar.gz',
+  'win32-x64': 'willdeep-windows-x64.zip',
+});
+const EXPECTED_ENTRIES = Object.freeze({
+  '.tar.gz': 'willdeep',
+  '.zip': 'willdeep.exe',
+});
+const MAX_ASSET_BYTES = 128 * 1024 * 1024;
+const MAX_BINARY_BYTES = 128 * 1024 * 1024;
+const RELEASE_HOSTS = new Set(['github.com', 'release-assets.githubusercontent.com']);
+
+class InstallError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'InstallError';
+  }
+}
+
+function resolveAsset(manifest, platform, arch) {
+  if (!manifest || manifest.version == null || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(manifest.repository || '') || !/^v[0-9][A-Za-z0-9.-]*$/.test(manifest.tag || '') || !manifest.assets) {
+    throw new InstallError('安装清单不完整。');
+  }
+  const name = PLATFORMS[`${platform}-${arch}`];
+  if (!name) throw new InstallError(`暂不支持 ${platform}/${arch}。`);
+  const asset = manifest.assets[name];
+  if (!asset || !/^[a-f0-9]{64}$/.test(asset.sha256 || '')) {
+    throw new InstallError(`版本 ${manifest.version} 还没有 ${name} 的校验值。`);
+  }
+  if (asset.name !== name) throw new InstallError(`安装清单里的资源名不一致：${name}。`);
+  return { ...asset, name };
+}
+
+function assetUrl(manifest, assetName) {
+  const encoded = assetName.split('/').map(encodeURIComponent).join('/');
+  return `https://github.com/${manifest.repository}/releases/download/${encodeURIComponent(manifest.tag)}/${encoded}`;
+}
+
+async function downloadAsset(url, expected, fetchImpl, redirectCount = 0, trustedHosts = RELEASE_HOSTS) {
+  if (redirectCount > 5) throw new InstallError('下载发行包时重定向次数过多。');
+  const response = await fetchImpl(url, { redirect: 'manual' });
+  if ([301, 302, 303, 307, 308].includes(response.status)) {
+    const location = response.headers.get('location');
+    if (!location) throw new InstallError('下载发行包时收到空的重定向。');
+    const target = new URL(location, url);
+    const trusted = target.protocol === 'https:' && target.port === '' && trustedHosts.has(target.hostname);
+    const localTest = target.protocol === 'http:' && target.hostname === '127.0.0.1' && target.port !== '' && trustedHosts.has('127.0.0.1');
+    if (!trusted && !localTest) throw new InstallError(`发行包重定向到不受信任的地址：${target.hostname}。`);
+    return downloadAsset(target.href, expected, fetchImpl, redirectCount + 1, trustedHosts);
+  }
+  if (!response.ok) throw new InstallError(`下载发行包失败：HTTP ${response.status}。`);
+  const declared = Number(response.headers.get('content-length'));
+  if (Number.isFinite(declared) && declared > MAX_ASSET_BYTES) throw new InstallError('发行包超过 128 MiB 上限。');
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > MAX_ASSET_BYTES) throw new InstallError('发行包超过 128 MiB 上限。');
+  const digest = createHash('sha256').update(bytes).digest('hex');
+  if (digest !== expected) throw new InstallError(`发行包 SHA256 不符：收到 ${digest}。`);
+  return bytes;
+}
+
+function extractBinary(archivePath, assetName, destination) {
+  const extension = Object.keys(EXPECTED_ENTRIES).find((item) => assetName.endsWith(item));
+  const expected = EXPECTED_ENTRIES[extension];
+  if (!expected) throw new InstallError(`不认识的发行包：${assetName}。`);
+  const output = fs.mkdtempSync(path.join(os.tmpdir(), 'willdeep-npm-'));
+  try {
+    if (extension === '.tar.gz') {
+      execFileSync('tar', ['-xzf', archivePath, '-C', output], { stdio: 'pipe' });
+    } else if (process.platform === 'win32') {
+      execFileSync('tar', ['-xf', archivePath, '-C', output], { stdio: 'pipe' });
+    } else {
+      execFileSync('unzip', ['-q', archivePath, '-d', output], { stdio: 'pipe' });
+    }
+    const extracted = fs.readdirSync(output);
+    if (extracted.length !== 1 || extracted[0] !== expected) {
+      throw new InstallError(`发行包内容异常：${extracted.join(', ') || '空包'}。`);
+    }
+    const source = path.join(output, expected);
+    const metadata = fs.lstatSync(source);
+    if (!metadata.isFile()) throw new InstallError('发行包里的程序必须是普通文件。');
+    if (metadata.size > MAX_BINARY_BYTES) throw new InstallError('发行包里的程序超过 128 MiB 上限。');
+    if (extension !== '.zip' && (metadata.mode & 0o111) === 0) {
+      throw new InstallError('发行包里的程序没有可执行权限。');
+    }
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    const temporary = path.join(path.dirname(destination), `.${path.basename(destination)}.${process.pid}.tmp`);
+    fs.copyFileSync(source, temporary);
+    fs.chmodSync(temporary, 0o755);
+    fs.renameSync(temporary, destination);
+  } finally {
+    fs.rmSync(output, { recursive: true, force: true });
+  }
+}
+
+async function installWilldeep(options) {
+  const asset = resolveAsset(options.manifest, options.platform, options.arch);
+  if (fs.existsSync(options.destination)) {
+    const marker = path.join(options.packageRoot, '.installed-asset.json');
+    if (fs.existsSync(marker)) {
+      const installed = JSON.parse(fs.readFileSync(marker, 'utf8'));
+      if (installed.version === options.manifest.version && installed.sha256 === asset.sha256) {
+        return { reused: true, asset };
+      }
+    }
+  }
+  const archive = path.join(os.tmpdir(), `willdeep-${process.pid}-${Date.now()}-${asset.name}`);
+  try {
+    const bytes = await downloadAsset(
+      assetUrl(options.manifest, asset.name),
+      asset.sha256,
+      options.fetchImpl,
+      0,
+      options.trustedHosts || RELEASE_HOSTS,
+    );
+    fs.writeFileSync(archive, bytes, { flag: 'wx', mode: 0o600 });
+    extractBinary(archive, asset.name, options.destination);
+    fs.writeFileSync(path.join(options.packageRoot, '.installed-asset.json'), `${JSON.stringify({
+      version: options.manifest.version,
+      name: asset.name,
+      sha256: asset.sha256,
+    })}\n`, { mode: 0o600 });
+  } finally {
+    fs.rmSync(archive, { force: true });
+  }
+  return { reused: false, asset };
+}
+
+module.exports = {
+  InstallError,
+  resolveAsset,
+  assetUrl,
+  downloadAsset,
+  extractBinary,
+  installWilldeep,
+};

package/package.json

@@ -1,6 +1,31 @@
 {
   "name": "@niuwoai/willdeep",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.129.0-rc5",
+  "description": "Install the WillDeep CLI from its verified GitHub Release.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/niuwoai/willdeep-cli.git",
+    "directory": "npm/willdeep"
+  },
+  "homepage": "https://github.com/niuwoai/willdeep-cli",
+  "bugs": "https://github.com/niuwoai/willdeep-cli/issues",
+  "bin": {
+    "willdeep": "bin/willdeep.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "install-manifest.json"
+  ],
+  "scripts": {
+    "postinstall": "node lib/install.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "rc"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.