@omega.js/manager 0.1.0

package/dist/vendor/devkit/attach-log-file.js

@@ -0,0 +1,262 @@
+// attachLogFile(filePath, options) — tee process.stdout + process.stderr to a log file.
+//
+// Every chunk reaches BOTH sinks: the terminal exactly as written (colors intact) and the
+// file with ANSI escapes stripped, so `grep`/`tail -f` reads clean. The file opens
+// truncated — a new launch clears the previous run's log (no history kept).
+//
+// Writes go to an open fd SYNCHRONOUSLY. A stream's buffer dies with the process, which
+// dropped exactly the lines describing a crash; the per-write syscall buys the crash tail.
+//
+// `append: true` opens the file for APPEND instead, for a log MORE THAN ONE process writes
+// (the signing box's runner log: a `runner start` parent, then every `sign-windows` its
+// listener spawns). Default is unchanged — one launch, one log.
+//
+// attach(filePath, { env, attachInCI, append }) — `env` is the environment the CI check
+// reads (the test seam), `attachInCI` keeps the tee on a runner, `append` keeps what the
+// last process wrote.
+//
+// The default export is a process-wide SINGLETON (the common case: one CLI verb tees its
+// whole run to one file). `createTee()` returns an INDEPENDENT tee. Tees STACK: an attach
+// captures the CURRENT writers — the raw stream, or an outer tee's patched writer — so
+// writes fan out through every layer and each detach restores the exact writers it found.
+// That is what keeps an inner tee's detach from stealing (and truncating) the outer tee's
+// file, the way a shared singleton did.
+//
+// Skipped in CI: a runner has its own log capture and wants no logs/ left in the workspace.
+// `attachInCI: true` opts out of that skip, for a sink whose file is the POINT rather than
+// workspace debris (the signing box's own runner log, which a CI job is exactly when it
+// matters). Default is unchanged: every other caller still skips.
+//
+// `createChildLog()` is the sibling sink for output that never passes through this
+// process' writers at all — a SPAWNED child's piped stdout/stderr. See below.
+
+// Libraries
+const fs = require('fs');
+const path = require('path');
+const Logger = require('./logger');
+
+// Variables
+const logger = new Logger('attach-log-file');
+const ANSI_PATTERN = /\x1B\[[0-9;]*[a-zA-Z]/g;
+const NOOP_DETACH = function () {};
+
+function stripAnsi(value) {
+  return String(value).replace(ANSI_PATTERN, '');
+}
+
+// Same predicate the rest of the repo uses for "a runner is driving this".
+function isCI(env) {
+  return env.GITHUB_ACTIONS === 'true' || env.CI === 'true';
+}
+
+// Factory — each call returns an independent tee with its own closure state.
+function createTee() {
+  let activePath = null;
+  let activeDetach = null;
+  let warned = false;
+
+  function attach(filePath, options) {
+    const env = (options && options.env) || process.env;
+    const attachInCI = Boolean(options && options.attachInCI);
+
+    if (!filePath || (isCI(env) && !attachInCI)) { return NOOP_DETACH; }
+
+    const abs = path.resolve(filePath);
+
+    // Already teeing this exact file — do not patch a second time (that would write
+    // every line twice).
+    if (activePath === abs) { return activeDetach; }
+    if (activeDetach) { activeDetach(); }
+
+    let fd;
+    try {
+      fs.mkdirSync(path.dirname(abs), { recursive: true });
+      fd = fs.openSync(abs, options && options.append ? 'a' : 'w');
+      fs.writeSync(fd, `# omega log — ${new Date().toISOString()} — pid=${process.pid}\n`);
+    } catch (e) {
+      // A log file we cannot open is a lost log, never a lost process — the tee exists to
+      // observe the run, so it declines and the run continues untouched.
+      if (!warned) {
+        warned = true;
+        logger.warn(`Could not open log file ${abs} — continuing without one (${e.message})`);
+      }
+      return NOOP_DETACH;
+    }
+
+    // Whatever is installed right now, captured by reference so detach restores it exactly.
+    const priorStdoutWrite = process.stdout.write;
+    const priorStderrWrite = process.stderr.write;
+
+    function writeToFile(chunk) {
+      try {
+        fs.writeSync(fd, stripAnsi(chunk));
+      } catch (e) {
+        // A broken log sink never breaks the writer it wraps.
+      }
+    }
+
+    process.stdout.write = function (chunk, ...rest) {
+      writeToFile(chunk);
+      return priorStdoutWrite.call(process.stdout, chunk, ...rest);
+    };
+    process.stderr.write = function (chunk, ...rest) {
+      writeToFile(chunk);
+      return priorStderrWrite.call(process.stderr, chunk, ...rest);
+    };
+
+    function closeFd() {
+      try {
+        fs.closeSync(fd);
+      } catch (e) {
+        // Already closed, or the process is tearing down.
+      }
+    }
+
+    // The fd outlives a crash otherwise — the writes already landed, this is the handle.
+    process.on('exit', closeFd);
+
+    let detached = false;
+    function detach() {
+      if (detached) { return; }
+      detached = true;
+
+      process.stdout.write = priorStdoutWrite;
+      process.stderr.write = priorStderrWrite;
+      process.off('exit', closeFd);
+      closeFd();
+
+      if (activeDetach === detach) {
+        activePath = null;
+        activeDetach = null;
+      }
+    }
+
+    activePath = abs;
+    activeDetach = detach;
+
+    return detach;
+  }
+
+  return {
+    attach,
+    detach: () => { if (activeDetach) { activeDetach(); } },
+  };
+}
+
+// createChildLog(options) — the sink for a SPAWNED process' output.
+//
+// The tee above patches this process' writers; a child's stdout/stderr never
+// pass through them — they arrive as buffers on a pipe. The caller mirrors each
+// buffer to the terminal untouched and hands it here, where it lands
+// ANSI-stripped in a file that opens truncated, same as the tee's.
+//
+// The roll is what the tee has no need for: a child that stays up for days (a
+// Firebase emulator) has to be truncatable MID-RUN, so a sibling process asks
+// for a fresh log by touching `resetPath` and the poll below honors it within
+// `pollMs`. Ported from BEM's emulator/serve commands, which carried a copy each.
+//
+// Writes go to an open fd synchronously, for the same reason the tee's do: the
+// lines describing a crash are the ones a buffered stream drops.
+//
+// Every operation is best-effort — a broken log sink must never break the
+// process it observes. It does say so ONCE though: a file that would not open
+// warns on the first write it drops, so a silently empty log is never a
+// surprise, and stays quiet after that.
+//
+// @param {object} options
+// @param {string} options.logPath - File the child's output lands in (truncated on open)
+// @param {string} [options.resetPath] - Sentinel another process touches to request a fresh log
+// @param {number} [options.pollMs=500] - Sentinel poll interval
+// @returns {{ path: string, write: Function, roll: Function, close: Function }}
+function createChildLog(options) {
+  const logPath = path.resolve(options.logPath);
+  const resetPath = options.resetPath ? path.resolve(options.resetPath) : null;
+  const pollMs = options.pollMs || 500;
+
+  let fd = null;
+  let openError = null;
+  let warned = false;
+
+  function removeSentinel() {
+    if (!resetPath) { return; }
+    try {
+      fs.unlinkSync(resetPath);
+    } catch (e) {
+      // Not there — the normal case.
+    }
+  }
+
+  function closeFd() {
+    if (fd === null) { return; }
+    try {
+      fs.closeSync(fd);
+    } catch (e) {
+      // Already closed, or the process is tearing down.
+    }
+    fd = null;
+  }
+
+  // Reopen with 'w' rather than truncating in place: an external truncate leaves
+  // the writer's offset where it was, so the file comes back sparse.
+  function roll() {
+    closeFd();
+    try {
+      fs.mkdirSync(path.dirname(logPath), { recursive: true });
+      fd = fs.openSync(logPath, 'w');
+      openError = null;
+    } catch (e) {
+      // A log we cannot open is a lost log, never a lost process — but a
+      // SILENT one is a run whose output nobody knows went nowhere, so the
+      // first dropped write says so (once), same as the tee's own warn.
+      fd = null;
+      openError = e;
+    }
+  }
+
+  function write(chunk) {
+    if (fd === null) {
+      if (openError && !warned) {
+        warned = true;
+        logger.warn(`Could not open log file ${logPath} — child output is not being recorded (${openError.message})`);
+      }
+      return;
+    }
+    try {
+      fs.writeSync(fd, stripAnsi(chunk));
+    } catch (e) {
+      // A broken log sink never breaks the stream it mirrors.
+    }
+  }
+
+  roll();
+
+  // A sentinel a crashed run left behind would roll the fresh log on the first poll.
+  removeSentinel();
+
+  const timer = resetPath ? setInterval(() => {
+    if (!fs.existsSync(resetPath)) { return; }
+    roll();
+    removeSentinel();
+  }, pollMs) : null;
+
+  function close() {
+    if (timer) { clearInterval(timer); }
+    closeFd();
+    removeSentinel();
+  }
+
+  return { path: logPath, write, roll, close };
+}
+
+// Process-wide singleton — the production entry point.
+const singleton = createTee();
+
+function attachLogFile(filePath, options) {
+  return singleton.attach(filePath, options);
+}
+
+module.exports = attachLogFile;
+module.exports.detach         = singleton.detach;
+module.exports.stripAnsi      = stripAnsi;
+module.exports.createTee      = createTee;
+module.exports.createChildLog = createChildLog;

package/dist/vendor/devkit/certs.js

@@ -0,0 +1,199 @@
+/**
+ * Signing-artifact delivery — the copy layer of the ONE delivery step (#678).
+ *
+ * Sources are the certificates service's outputs under a signing tree,
+ * `<sourceRoot>/.omega/certificates/apple/` (the company workspace's root for
+ * a company-managed brand, the brand root otherwise); destinations are the
+ * target's own certs dir (desktop: config/certs/ per EM v1.4.1+, mobile:
+ * build/certs/). Copies are byte-compared first, so a converged run rewrites
+ * nothing, and every certs dir gets a self-protecting .gitignore (`*`) — signing
+ * material can never be committed, even in a target the framework's setup
+ * hasn't touched yet.
+ *
+ * Delivery is WARN-ONLY on a miss: a rule with no source reports `missing` and
+ * leaves the dest alone. The dests are documented HUMAN drop points (desktop's
+ * signing docs tell an operator to copy their .p12/.p8 straight into
+ * config/certs/), and `omega company init` scaffolds the signing tree EMPTY —
+ * so a delete-on-missing pass would eat hand-placed signing material on the
+ * next build.
+ *
+ * This module DELIVERS and reports; it logs nothing and classifies nothing.
+ * Which misses are tolerable (`optional`) is on the rules, which callers read
+ * through resolveCertRules — the manager's disperse writer turns them into its
+ * per-rule lines, a desktop build into whatever its own voice is.
+ */
+const { join, dirname } = require('node:path');
+const jetpack = require('fs-jetpack');
+
+// Paths: source relative to .omega/certificates/apple/, dest relative to the
+// target dir. `{env.VAR}` and `{brand.id}` placeholders supported on both sides.
+const CERT_FILE_MAP = {
+  desktop: [
+    // macOS code signing — Developer ID Application (.p12 with private key)
+    {
+      source: 'certificates/DEVELOPER_ID_APPLICATION_G2.p12',
+      dest: 'config/certs/developer-id-application.p12',
+    },
+    // macOS installer signing (only used if shipping a .pkg installer)
+    {
+      source: 'certificates/DEVELOPER_ID_INSTALLER_G2.p12',
+      dest: 'config/certs/developer-id-installer.p12',
+      optional: true,
+    },
+    // Notarization API key — App Store Connect .p8
+    {
+      source: 'AuthKey_{env.APPLE_API_KEY_ID}.p8',
+      dest: 'config/certs/AuthKey_{env.APPLE_API_KEY_ID}.p8',
+    },
+    // Per-brand provisioning profile (only present if cert generation produced one)
+    {
+      source: 'profiles/{brand.id}/DEVELOPER_ID_APPLICATION_G2/MACOS.mobileprovision',
+      dest: 'config/certs/{brand.id}.provisionprofile',
+      optional: true,
+    },
+  ],
+  mobile: [
+    // iOS App Store distribution — used by xcodebuild
+    {
+      source: 'certificates/IOS_DISTRIBUTION.p12',
+      dest: 'build/certs/ios-distribution.p12',
+    },
+    // Notarization / API access from CI
+    {
+      source: 'AuthKey_{env.APPLE_API_KEY_ID}.p8',
+      dest: 'build/certs/AuthKey_{env.APPLE_API_KEY_ID}.p8',
+    },
+    // Per-brand iOS provisioning profile
+    {
+      source: 'profiles/{brand.id}/IOS_DISTRIBUTION/IOS.mobileprovision',
+      dest: 'build/certs/{brand.id}.mobileprovision',
+      optional: true,
+    },
+  ],
+};
+
+/**
+ * Resolve `{env.VAR}` and `{brand.key}` placeholders. Returns null when an
+ * env placeholder is unset — the rule can't produce a real path, and a
+ * literal `AuthKey_.p8` miss would only confuse.
+ */
+function resolveTemplate(template, brand) {
+  let missing = false;
+
+  const resolved = template.replace(/\{([^}]+)\}/g, (match, path) => {
+    const [source, ...keyParts] = path.split('.');
+    const key = keyParts.join('.');
+    if (source === 'env') {
+      const value = process.env[key] || '';
+      if (!value) missing = true;
+      return value;
+    }
+    if (source === 'brand') return brand?.[key] || '';
+    return match;
+  });
+
+  return missing ? null : resolved;
+}
+
+/**
+ * Ensure the certs dir ignores everything it holds — signing material must
+ * never land in git, regardless of whether the framework's own .gitignore
+ * exists yet.
+ */
+function ensureCertsIgnore(destDir) {
+  const ignorePath = join(destDir, '.gitignore');
+  if (!jetpack.exists(ignorePath)) {
+    jetpack.write(ignorePath, '*\n!.gitignore\n');
+  }
+}
+
+/**
+ * The signing tree a source root holds — the ONE home of that path.
+ *
+ * @param {string} sourceRoot - Company root (company-managed brands) or brand root.
+ * @returns {string} Absolute path to .omega/certificates/apple/.
+ */
+function certsSourceDir(sourceRoot) {
+  return join(sourceRoot, '.omega', 'certificates', 'apple');
+}
+
+/**
+ * A target's signing rules with their placeholders resolved.
+ *
+ * @param {object} input
+ * @param {string} input.target - Target type ('desktop'/'mobile'); anything
+ *   else has no signing rules and returns [].
+ * @param {object} [input.brand] - Brand config block (`{brand.id}` resolves from it).
+ * @returns {Array<{ source, dest, optional, sourceRel, destRel }>} `sourceRel`/
+ *   `destRel` are null when an env placeholder is unset; `dest` is the template.
+ */
+function resolveCertRules({ target, brand = null }) {
+  return (CERT_FILE_MAP[target] || []).map((rule) => {
+    const sourceRel = resolveTemplate(rule.source, brand);
+    const destRel = sourceRel === null ? null : resolveTemplate(rule.dest, brand);
+
+    return {
+      source: rule.source,
+      dest: rule.dest,
+      optional: !!rule.optional,
+      sourceRel,
+      destRel,
+    };
+  });
+}
+
+/**
+ * Copy a target's signing artifacts out of the signing tree.
+ *
+ * @param {object} input
+ * @param {string} input.sourceRoot - Company root or brand root holding .omega/certificates/apple/.
+ * @param {string} input.targetDir - The target's own directory (destinations resolve inside it).
+ * @param {string} input.target - Target type ('desktop'/'mobile').
+ * @param {object} [input.brand] - Brand config block, for `{brand.id}` rules.
+ * @param {boolean} [input.dryRun] - Plan only: `copied` says what WOULD be
+ *   written, nothing is written.
+ * @returns {{ copied: string[], current: string[], missing: string[] }}
+ *   Target-relative paths — copied (written this pass), current (already
+ *   byte-identical), missing (no source, or an unresolved placeholder: that rule
+ *   reports its dest TEMPLATE).
+ */
+function deliverCerts({ sourceRoot, targetDir, target, brand = null, dryRun = false }) {
+  const appleDir = certsSourceDir(sourceRoot);
+  const copied = [];
+  const current = [];
+  const missing = [];
+
+  for (const rule of resolveCertRules({ target, brand })) {
+    // An unset env placeholder (e.g. APPLE_API_KEY_ID) means the rule has no
+    // real path to resolve to — it reports its template, which names the gap
+    if (rule.destRel === null) {
+      missing.push(rule.dest);
+      continue;
+    }
+
+    const destPath = join(targetDir, rule.destRel);
+    const sourcePath = join(appleDir, rule.sourceRel);
+    if (!jetpack.exists(sourcePath)) {
+      missing.push(rule.destRel);
+      continue;
+    }
+
+    const sourceBytes = jetpack.read(sourcePath, 'buffer');
+    const destBytes = jetpack.exists(destPath) ? jetpack.read(destPath, 'buffer') : null;
+
+    if (destBytes && sourceBytes.equals(destBytes)) {
+      current.push(rule.destRel);
+      continue;
+    }
+
+    copied.push(rule.destRel);
+    if (dryRun) continue;
+
+    jetpack.copy(sourcePath, destPath, { overwrite: true });
+    ensureCertsIgnore(dirname(destPath));
+  }
+
+  return { copied, current, missing };
+}
+
+module.exports = { deliverCerts, resolveCertRules, certsSourceDir, CERT_FILE_MAP };