@orchard-ai/cli 0.2.4

package/README.md

@@ -0,0 +1,64 @@
+# @orchard-ai/cli
+
+Public npm installer for the Orchard CLI native binary.
+
+```bash
+npm install -g @orchard-ai/cli
+orchard --help
+```
+
+This package does not contain Orchard CLI source code. During `postinstall`, it
+downloads the platform-specific `orchard` binary from the latest `cli/v*`
+release, verifies it against `SHA256SUMS`, and stores it under `vendor/`.
+
+## Configuration
+
+- `ORCHARD_CLI_RELEASE_REPO`: GitHub repo that hosts public binary releases.
+  Defaults to `Orchard-Development/CLI`.
+- `ORCHARD_CLI_RELEASES_URL`: full GitHub-compatible releases API URL override.
+- `ORCHARD_CLI_RELEASE_TOKEN` or `GITHUB_TOKEN`: optional token for non-public
+  release assets.
+- `ORCHARD_CLI_SKIP_DOWNLOAD=1`: skip download, useful for package inspection.
+
+## Source Privacy
+
+The published package is intentionally limited to:
+
+- `bin/orchard.js`
+- `scripts/install.js`
+- `scripts/verify-package.js`
+- `vendor/.gitkeep`
+- package metadata and this README
+
+`npm run test` and `npm pack --dry-run` should be run before publishing to verify
+that no Python source, source maps, repository metadata, or build artifacts are
+included.
+
+## GitHub Actions Publishing
+
+The `cli/v*` release workflow publishes this package when the GitHub Actions
+secret `NPM_TOKEN` is available.
+
+Recommended setup:
+
+1. Create an npm granular automation token with publish access to
+   `@orchard-ai/cli`.
+2. In GitHub, add an organization Actions secret:
+   `Orchard-Development` -> `Settings` -> `Secrets and variables` ->
+   `Actions` -> `New organization secret`.
+3. Name the secret `NPM_TOKEN`.
+4. Grant repository access to the private `CLI` repo, or set visibility to all
+   private repositories if Orchard intentionally shares the token across release
+   workflows.
+
+CLI equivalent for an org admin:
+
+```bash
+gh secret set NPM_TOKEN \
+  --org Orchard-Development \
+  --app actions \
+  --repos CLI
+```
+
+The package is public by design, but the npm tarball contains only this installer
+wrapper. Orchard CLI source remains private.

package/bin/orchard.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const root = path.resolve(__dirname, '..');
+const exe = process.platform === 'win32' ? 'orchard.exe' : 'orchard';
+const binary = path.join(root, 'vendor', exe);
+
+if (!fs.existsSync(binary)) {
+  console.error(
+    'Orchard CLI binary is not installed. Run `npm rebuild @orchard-ai/cli` ' +
+    'or reinstall with `npm install -g @orchard-ai/cli`.'
+  );
+  process.exit(127);
+}
+
+const result = spawnSync(binary, process.argv.slice(2), {
+  stdio: 'inherit',
+  windowsHide: false,
+});
+
+if (result.error) {
+  console.error(result.error.message);
+  process.exit(1);
+}
+
+process.exit(result.status === null ? 1 : result.status);

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@orchard-ai/cli",
+  "version": "0.2.4",
+  "description": "Installer and launcher for the Orchard CLI native binary.",
+  "license": "UNLICENSED",
+  "homepage": "https://orchard.dev",
+  "bin": {
+    "orchard": "bin/orchard.js"
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js",
+    "prepack": "node scripts/verify-package.js",
+    "test": "node --check bin/orchard.js && node --check scripts/install.js && node --check scripts/verify-package.js && node scripts/verify-package.js"
+  },
+  "files": [
+    "bin/",
+    "scripts/",
+    "vendor/.gitkeep",
+    "README.md",
+    "package.json"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/install.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const https = require('https');
+const path = require('path');
+
+const root = path.resolve(__dirname, '..');
+const vendorDir = path.join(root, 'vendor');
+const releasesRepo = process.env.ORCHARD_CLI_RELEASE_REPO || 'Orchard-Development/CLI';
+const releasesUrl =
+  process.env.ORCHARD_CLI_RELEASES_URL ||
+  `https://api.github.com/repos/${releasesRepo}/releases?per_page=20`;
+const token = process.env.ORCHARD_CLI_RELEASE_TOKEN || process.env.GITHUB_TOKEN || '';
+
+function log(message) {
+  console.log(`[orchard-cli] ${message}`);
+}
+
+function request(url, binary = false) {
+  return new Promise((resolve, reject) => {
+    const headers = {
+      'User-Agent': '@orchard-ai/cli installer',
+      Accept: 'application/vnd.github+json, application/octet-stream',
+    };
+    if (token) headers.Authorization = `Bearer ${token}`;
+
+    https
+      .get(url, { headers }, (res) => {
+        if ([301, 302, 303, 307, 308].includes(res.statusCode)) {
+          res.resume();
+          request(res.headers.location, binary).then(resolve, reject);
+          return;
+        }
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          res.resume();
+          reject(new Error(`GET ${url} failed with HTTP ${res.statusCode}`));
+          return;
+        }
+
+        const chunks = [];
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => {
+          const body = Buffer.concat(chunks);
+          resolve(binary ? body : body.toString('utf8'));
+        });
+      })
+      .on('error', reject);
+  });
+}
+
+function targetAssetName() {
+  const platform = process.platform;
+  const arch = process.arch;
+
+  if (platform === 'darwin' && arch === 'arm64') return 'orchard-macos-arm64';
+  if (platform === 'darwin' && arch === 'x64') return 'orchard-macos-x64';
+  if (platform === 'linux' && arch === 'x64') return 'orchard-linux-x64';
+  if (platform === 'win32' && arch === 'x64') return 'orchard-windows-x64.exe';
+
+  throw new Error(`Unsupported platform/arch: ${platform}/${arch}`);
+}
+
+function parseSha256Sums(text) {
+  const sums = new Map();
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const parts = trimmed.split(/\s+/);
+    if (parts.length < 2) continue;
+    sums.set(path.basename(parts[parts.length - 1].replace(/^\*/, '')), parts[0].toLowerCase());
+  }
+  return sums;
+}
+
+function sha256(buffer) {
+  return crypto.createHash('sha256').update(buffer).digest('hex');
+}
+
+function findRelease(releases) {
+  if (!Array.isArray(releases)) throw new Error('Release API response was not an array');
+  const release = releases.find((item) => typeof item.tag_name === 'string' && item.tag_name.startsWith('cli/v'));
+  if (!release) throw new Error('No cli/v* Orchard CLI release found');
+  return release;
+}
+
+function findAsset(release, name) {
+  const asset = (release.assets || []).find((item) => item.name === name);
+  if (!asset || !asset.browser_download_url) {
+    throw new Error(`Release ${release.tag_name} has no asset named ${name}`);
+  }
+  return asset;
+}
+
+async function install() {
+  if (process.env.ORCHARD_CLI_SKIP_DOWNLOAD === '1') {
+    log('skipping binary download because ORCHARD_CLI_SKIP_DOWNLOAD=1');
+    return;
+  }
+
+  const wanted = targetAssetName();
+  const exe = process.platform === 'win32' ? 'orchard.exe' : 'orchard';
+  const target = path.join(vendorDir, exe);
+
+  fs.mkdirSync(vendorDir, { recursive: true });
+
+  log(`resolving latest cli/v* release from ${releasesRepo}`);
+  const releases = JSON.parse(await request(releasesUrl));
+  const release = findRelease(releases);
+  const binaryAsset = findAsset(release, wanted);
+  const sumsAsset = findAsset(release, 'SHA256SUMS');
+
+  log(`downloading ${binaryAsset.name} from ${release.tag_name}`);
+  const [binary, sumsText] = await Promise.all([
+    request(binaryAsset.browser_download_url, true),
+    request(sumsAsset.browser_download_url, false),
+  ]);
+
+  const expected = parseSha256Sums(sumsText).get(binaryAsset.name);
+  if (!expected) throw new Error(`SHA256SUMS has no entry for ${binaryAsset.name}`);
+
+  const actual = sha256(binary);
+  if (actual !== expected) {
+    throw new Error(`SHA256 mismatch for ${binaryAsset.name}: expected ${expected} got ${actual}`);
+  }
+
+  fs.writeFileSync(target, binary);
+  if (process.platform !== 'win32') fs.chmodSync(target, 0o755);
+  log(`installed ${target}`);
+}
+
+install().catch((error) => {
+  console.error(`[orchard-cli] install failed: ${error.message}`);
+  console.error('[orchard-cli] Set ORCHARD_CLI_RELEASE_REPO, ORCHARD_CLI_RELEASES_URL, or ORCHARD_CLI_RELEASE_TOKEN if the release assets are not public.');
+  process.exit(1);
+});

package/scripts/verify-package.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const root = path.resolve(__dirname, '..');
+const allowedTopLevel = new Set(['bin', 'scripts', 'vendor', 'README.md', 'package.json']);
+const forbiddenExtensions = new Set(['.py', '.pyc', '.map', '.ts', '.tsx']);
+const forbiddenNames = new Set(['.git', '.github', '.venv', '__pycache__', 'orchard', 'tests']);
+
+function fail(message) {
+  console.error(`[verify-package] ${message}`);
+  process.exit(1);
+}
+
+function walk(dir) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    const rel = path.relative(root, full);
+    const top = rel.split(path.sep)[0];
+
+    if (!allowedTopLevel.has(top)) fail(`unexpected top-level package path: ${rel}`);
+    if (forbiddenNames.has(entry.name)) fail(`forbidden package path: ${rel}`);
+    if (entry.isFile() && forbiddenExtensions.has(path.extname(entry.name))) {
+      fail(`forbidden source-like file in package: ${rel}`);
+    }
+    if (entry.isDirectory()) walk(full);
+  }
+}
+
+walk(root);
+console.log('[verify-package] package allowlist ok');

package/vendor/.gitkeep

@@ -0,0 +1 @@
+