@open-flow/workbench-engine 0.5.0

package/LICENSE

@@ -0,0 +1,10 @@
+© Ecorona LLC — Todos los derechos reservados.
+
+Este software se distribuye únicamente en forma compilada. Se autoriza su
+instalación y uso; queda prohibida la redistribución, la descompilación y la
+ingeniería inversa del binario o del código publicado.
+
+El código fuente es propiedad de Ecorona LLC y no forma parte de esta
+distribución.
+
+[BORRADOR — pendiente de revisión legal por Ecorona LLC.]

package/bin/workbench.mjs

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+/**
+ * Find the platform binary and hand it the arguments.
+ *
+ * The scanner is a compiled binary published as one optional dependency per
+ * platform — the pattern esbuild and swc use. npm installs only the one that
+ * matches, so a Mac does not download a Linux executable.
+ *
+ * There is deliberately **no JavaScript fallback**. A second implementation of
+ * the scan is exactly the duplication this whole tool exists to remove, and one
+ * that only ran when the binary was missing would be the least-tested code in
+ * the repository. A missing platform is an error with instructions, not a
+ * silent downgrade to a different answer.
+ */
+import { spawnSync } from "node:child_process";
+import { accessSync, chmodSync, constants, existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const require = createRequire(import.meta.url);
+
+/**
+ * npm's own platform vocabulary, which is what the package names encode.
+ *
+ * No libc suffix on the Linux entries, and this shim does not detect one. The
+ * Linux binaries are statically linked against musl, so they carry no libc
+ * dependency and run on glibc and musl systems alike.
+ *
+ * That is not cosmetic. The first Linux build was dynamically linked against the
+ * glibc of the image that produced it, and Vercel refused it outright:
+ * `/lib64/libc.so.6: version GLIBC_2.39 not found`. A binary published for
+ * "linux x64" has to run on whatever "linux x64" turns out to mean.
+ */
+const PACKAGES = {
+	"darwin arm64": "@open-flow/workbench-darwin-arm64",
+	"darwin x64": "@open-flow/workbench-darwin-x64",
+	"linux arm64": "@open-flow/workbench-linux-arm64",
+	"linux x64": "@open-flow/workbench-linux-x64",
+	"win32 x64": "@open-flow/workbench-win32-x64-msvc",
+};
+
+const key = `${process.platform} ${process.arch}`;
+const packageName = PACKAGES[key];
+
+if (!packageName) {
+	console.error(
+		`workbench: no hay binario para ${key}.\n` +
+			`  Plataformas publicadas: ${Object.keys(PACKAGES).join(", ")}.\n` +
+			`  Puedes compilarlo tú: cargo build --release -p workbench-cli`,
+	);
+	process.exit(1);
+}
+
+const executable = process.platform === "win32" ? "workbench.exe" : "workbench";
+
+/**
+ * A cargo build in an ancestor directory.
+ *
+ * Only reachable when this repository *is* the checkout — inside a consumer's
+ * `node_modules` there is no `crates/` above us, so this cannot silently
+ * shadow a published binary with a stale local one. It exists so that
+ * developing the package does not require publishing it first.
+ */
+function locallyBuilt() {
+	let directory = dirname(fileURLToPath(import.meta.url));
+	for (let depth = 0; depth < 6; depth++) {
+		const candidate = join(directory, "target", "release", executable);
+		if (existsSync(candidate) && existsSync(join(directory, "crates"))) return candidate;
+		const parent = dirname(directory);
+		if (parent === directory) break;
+		directory = parent;
+	}
+	return null;
+}
+
+// The cargo build wins over an installed package, not the other way around:
+// inside this checkout the published binary is by definition at least one
+// release old, and it once silently shadowed the local build for days — the
+// example's manifest said `workbench 0.1.3` while Cargo.toml said 0.1.4.
+// `locallyBuilt()` only resolves when `crates/` is an ancestor, so consumers
+// never take this branch.
+let binary = locallyBuilt();
+if (!binary) {
+	try {
+		// Resolving the package's own manifest rather than a path inside it: the
+		// package exports nothing importable, so `require.resolve(name)` would
+		// throw even when it is installed.
+		//
+		// `manifest` is already a filesystem path — round-tripping it through
+		// `new URL("file://…")` truncated at `#` and broke on Windows.
+		const manifest = require.resolve(`${packageName}/package.json`);
+		binary = join(dirname(manifest), "bin", executable);
+	} catch {
+		binary = null;
+	}
+}
+
+if (!binary || !existsSync(binary)) {
+	console.error(
+		`workbench: falta ${packageName}.\n` +
+			`  Suele significar que la instalación se hizo con --no-optional.\n` +
+			`  Reinstala las dependencias y vuelve a intentarlo.`,
+	);
+	process.exit(1);
+}
+
+/**
+ * Make sure the binary is executable, because the tarball may say otherwise.
+ *
+ * The file is written 0755 by `scripts/release/prepare.mjs`, but that mode does
+ * not reliably survive being packed and unpacked: measured with `pnpm pack`, the
+ * entry comes back 0644, and the only symptom is `spawnSync … EACCES` from a
+ * package that installed without a single warning. A `postinstall` script cannot
+ * be the fix — this is an OPTIONAL dependency, and `--ignore-scripts` is common
+ * in CI — so the check belongs at the one place that is guaranteed to run.
+ *
+ * Cheap and idempotent: one `access` call on the happy path, and the `chmod` is
+ * attempted only when it would otherwise fail. If the chmod is refused too (a
+ * read-only store, a different owner), the spawn below reports the real error
+ * rather than this one, which is the more useful of the two.
+ */
+try {
+	accessSync(binary, constants.X_OK);
+} catch {
+	try {
+		chmodSync(binary, 0o755);
+	} catch {
+		// Fall through: let the spawn produce the authoritative failure.
+	}
+}
+
+// `stdio: inherit` so stdin reaches `workbench ticket --json`, and so the
+// scanner's progress and warnings appear as they happen rather than at the end.
+const result = spawnSync(binary, process.argv.slice(2), { stdio: "inherit" });
+
+if (result.error) {
+	console.error(`workbench: no se pudo ejecutar ${binary} — ${result.error.message}`);
+	process.exit(1);
+}
+// A signal has no exit code; report it as a shell would.
+process.exit(result.status ?? (result.signal ? 1 : 0));

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@open-flow/workbench-engine",
+  "version": "0.5.0",
+  "description": "El motor de workbench: el escáner compilado. El binario es público; el código fuente en Rust no lo es — lo que gobierna el uso es la licencia, no la descarga.",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ecorona-LLC/workbench.git"
+  },
+  "type": "module",
+  "bin": {
+    "workbench": "./bin/workbench.mjs"
+  },
+  "files": [
+    "bin",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "optionalDependencies": {
+    "@open-flow/workbench-darwin-arm64": "0.5.0",
+    "@open-flow/workbench-darwin-x64": "0.5.0",
+    "@open-flow/workbench-linux-arm64": "0.5.0",
+    "@open-flow/workbench-linux-x64": "0.5.0",
+    "@open-flow/workbench-win32-x64-msvc": "0.5.0"
+  }
+}