@okuanb/fab 0.0.0-stage → 0.1.0-rc.10

package/README.md

@@ -1,3 +1,15 @@
-# Temporary Holding Version
+# FAB
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Agente y fábrica de software con runtime propio. Node instala y lanza el binario de la misma release; no hace falta instalar Bun.
+
+```sh
+npm install -g @okuanb/fab@next
+fab --version
+fab tui
+```
+
+El paquete contiene el manifest de la release con el SHA de origen y el checksum exacto de cada binario. Verifica los bytes antes de ejecutarlos, incluso si se instalaron con `--ignore-scripts`. Descarga exclusivamente desde GitHub mediante HTTPS. Binarios en `~/.cache/fab/<version>/<sha256>/`.
+
+Linux glibc y macOS: x64/arm64. Windows: WSL. El sandbox de herramientas requiere bubblewrap en Linux; macOS no tiene sandbox equivalente implementado. Git y la configuración del proveedor se preparan por separado.
+
+Código y documentación: https://github.com/DarkCodePE/sw-factory

package/bin/fab.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { ensureBinary } from '../runtime.mjs';
+import { fileURLToPath } from 'node:url';
+try {
+  const binary = await ensureBinary();
+  const child = spawn(binary, process.argv.slice(2), { stdio: 'inherit', env: { ...process.env, FAB_NPM_PACKAGE_ROOT: fileURLToPath(new URL('../', import.meta.url)) } });
+  const forward = signal => () => child.kill(signal);
+  const interrupt = forward('SIGINT'), terminate = forward('SIGTERM');
+  process.on('SIGINT', interrupt); process.on('SIGTERM', terminate);
+  child.on('error', error => { console.error(`FAB: ${error.message}`); process.exitCode = 1; });
+  child.on('exit', (code, signal) => {
+    process.removeListener('SIGINT', interrupt); process.removeListener('SIGTERM', terminate);
+    if (signal) process.kill(process.pid, signal); else process.exitCode = code ?? 1;
+  });
+} catch (error) { console.error(`FAB: ${error.message}`); process.exitCode = 1; }

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "@okuanb/fab",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-rc.10",
+  "type": "module",
+  "description": "FAB: agente y fábrica de software con runtime propio",
+  "bin": {
+    "fab": "bin/fab.mjs"
+  },
+  "scripts": {
+    "postinstall": "node postinstall.mjs"
+  },
+  "files": [
+    "bin",
+    "runtime.mjs",
+    "postinstall.mjs",
+    "release-manifest.json",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "os": [
+    "linux",
+    "darwin"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DarkCodePE/sw-factory.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/postinstall.mjs

@@ -0,0 +1,3 @@
+import { ensureBinary } from './runtime.mjs';
+try { console.log(`FAB instalado: ${await ensureBinary()}`); }
+catch (error) { console.error(`FAB: ${error.message}`); process.exitCode = 1; }

package/release-manifest.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 1,
+  "version": "0.1.0-rc.10",
+  "tag": "v0.1.0-rc.10",
+  "sourceSha": "fb93a01b44db4917c5863e3d35e34eeb7b1e7f0c",
+  "assets": {
+    "fab-linux-x64": {
+      "filename": "fab-linux-x64",
+      "sha256": "f0a73a941a870840fc5fc571dc768383ad52b2011c9855dc305af235db7db502",
+      "bytes": 95357056
+    },
+    "fab-linux-arm64": {
+      "filename": "fab-linux-arm64",
+      "sha256": "48dfd994824fb4cd7a7e0de85db7d117300a3f535926c86fa60241f8eefdd32a",
+      "bytes": 94480528
+    },
+    "fab-darwin-x64": {
+      "filename": "fab-darwin-x64",
+      "sha256": "33a6bb63a10de3c4f83d5e9093bac120dd0e67c740f94bbb0a89bba92cc03c5a",
+      "bytes": 79986768
+    },
+    "fab-darwin-arm64": {
+      "filename": "fab-darwin-arm64",
+      "sha256": "5fa0a5df3f2110d204bc7b8598b809b04d0721b02cf4a686a5ed889ea650b0a7",
+      "bytes": 69704162
+    }
+  }
+}

package/runtime.mjs

@@ -0,0 +1,68 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+export async function digest(path) {
+  const hash = createHash('sha256');
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest('hex');
+}
+export function platformAsset(platform = process.platform, arch = process.arch) {
+  if (!['linux', 'darwin'].includes(platform) || !['x64', 'arm64'].includes(arch))
+    throw new Error(`FAB no publica binarios para ${platform}/${arch}; en Windows utiliza WSL.`);
+  return `fab-${platform}-${arch}`;
+}
+export function validateManifest(manifest) {
+  if (manifest.schemaVersion !== 1 || !/^\d+\.\d+\.\d+(?:-[\da-z.-]+)?$/.test(manifest.version)
+    || manifest.tag !== `v${manifest.version}` || !/^[a-f0-9]{40}$/.test(manifest.sourceSha)) throw new Error('Manifest de release inválido');
+  for (const os of ['linux', 'darwin']) for (const arch of ['x64', 'arm64']) {
+    const name = platformAsset(os, arch), asset = manifest.assets?.[name];
+    if (!asset || asset.filename !== name || !/^[a-f0-9]{64}$/.test(asset.sha256)
+      || !Number.isSafeInteger(asset.bytes) || asset.bytes <= 0 || asset.bytes > 512 * 1024 * 1024) throw new Error(`Artefacto inválido: ${name}`);
+  }
+  return manifest;
+}
+export function binaryPath(manifest, name, home = homedir()) {
+  return join(home, '.cache', 'fab', manifest.version, manifest.assets[name].sha256, name);
+}
+async function download(url, signal, fetcher) {
+  for (let redirects = 0; redirects <= 5; redirects++) {
+    const target = new URL(url);
+    if (target.protocol !== 'https:' || !(target.hostname === 'github.com' || target.hostname.endsWith('.githubusercontent.com')))
+      throw new Error('Redirección de descarga fuera de GitHub HTTPS');
+    const response = await fetcher(target, { signal, redirect: 'manual' });
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      const location = response.headers.get('location'); await response.body?.cancel();
+      if (!location) throw new Error('Redirección sin destino');
+      url = new URL(location, target).href; continue;
+    }
+    if (!response.ok || !response.body) { await response.body?.cancel(); throw new Error(`Descarga de FAB falló: HTTP ${response.status}`); }
+    return response;
+  }
+  throw new Error('Demasiadas redirecciones');
+}
+export async function ensureBinary({ manifest, home = homedir(), platform = process.platform, arch = process.arch, fetcher = fetch } = {}) {
+  manifest ??= JSON.parse(await readFile(new URL('./release-manifest.json', import.meta.url), 'utf8'));
+  validateManifest(manifest);
+  const name = platformAsset(platform, arch), expected = manifest.assets[name], target = binaryPath(manifest, name, home);
+  // Revalidate cached bytes, including installations made with --ignore-scripts.
+  try { if ((await stat(target)).size === expected.bytes && await digest(target) === expected.sha256) return target; } catch { /* Download below. */ }
+  await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+  const temporary = `${target}.${randomUUID()}.tmp`, hash = createHash('sha256'); let size = 0;
+  try {
+    const response = await download(`https://github.com/DarkCodePE/sw-factory/releases/download/${manifest.tag}/${name}`, AbortSignal.timeout(180_000), fetcher);
+    await writeFile(temporary, '', { flag: 'wx', mode: 0o700 });
+    const { open } = await import('node:fs/promises'), file = await open(temporary, 'a');
+    try {
+      for await (const chunk of response.body) {
+        size += chunk.length;
+        if (size > expected.bytes) throw new Error('Artefacto supera el tamaño sellado');
+        hash.update(chunk); await file.writeFile(chunk);
+      }
+    } finally { await file.close(); }
+    if (size !== expected.bytes || hash.digest('hex') !== expected.sha256) throw new Error('Checksum SHA-256 incorrecto; no se ejecutó el artefacto');
+    await rename(temporary, target); return target;
+  } finally { await rm(temporary, { force: true }); }
+}