@riducms/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Haniel Ubogu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,42 @@
+# `@riducms/cli`
+
+This package runs the native Go CLI for the matching Ridu release:
+
+```sh
+npx @riducms/cli new my-content
+bunx @riducms/cli new my-content
+pnpm dlx @riducms/cli new my-content
+yarn dlx @riducms/cli new my-content
+```
+
+For the conventional project-creation entry point, use `npm create ridu@latest my-app`. The
+`create-ridu` initializer delegates to this package with the `new` command; this package remains
+the launcher for `ridu version`, `dev`, `generate`, migrations, and every other CLI command.
+
+The launcher downloads and caches the matching native command for macOS, Linux, or Windows. It
+forwards arguments, signals, and exit status to that command.
+
+New scaffolds pin this package at the exact coordinated version. From a generated project, use:
+
+```sh
+npm install
+npm run dev
+```
+
+Use the non-writing form separately in CI to verify committed contracts:
+
+```sh
+npm run ridu -- generate --check
+```
+
+The scaffold records npm, Bun, pnpm, or Yarn in `ridu.toml`, and the native CLI uses it for frontend
+installs and admin/plugin commands. The package-local command avoids global version drift while
+still using the ordinary npm registry.
+
+Go users can install the same command directly:
+
+```sh
+go install github.com/riducms/ridu/cmd/ridu@v0.1.0
+```
+
+Set `RIDU_BINARY` to an already-installed binary path when downloads are managed centrally.

package/package.json

@@ -0,0 +1,39 @@
+{
+	"bin": {
+		"ridu": "./src/cli.js"
+	},
+	"bugs": {
+		"url": "https://github.com/riducms/ridu/issues"
+	},
+	"description": "Cross-platform npm launcher for Ridu's native Go CLI.",
+	"engines": {
+		"node": ">=20"
+	},
+	"exports": {
+		"./run": "./src/run.js"
+	},
+	"files": [
+		"src/cli.js",
+		"src/launcher.js",
+		"src/run.js",
+		"LICENSE"
+	],
+	"homepage": "https://riducms.com",
+	"license": "MIT",
+	"name": "@riducms/cli",
+	"publishConfig": {
+		"access": "public",
+		"provenance": true
+	},
+	"repository": {
+		"directory": "packages/cli",
+		"type": "git",
+		"url": "git+https://github.com/riducms/ridu.git"
+	},
+	"scripts": {
+		"check": "bun test",
+		"test": "bun test"
+	},
+	"type": "module",
+	"version": "0.1.0"
+}

package/src/cli.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { runRidu } from "./run.js";
+
+try {
+	process.exitCode = await runRidu(process.argv.slice(2));
+} catch (error) {
+	console.error(`ridu: ${error instanceof Error ? error.message : String(error)}`);
+	process.exitCode = 1;
+}

package/src/launcher.js

@@ -0,0 +1,147 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { gunzipSync } from "node:zlib";
+
+const repository = "https://github.com/riducms/ridu";
+
+export function releaseTarget(platform = process.platform, architecture = process.arch) {
+	const operatingSystems = { darwin: "darwin", linux: "linux", win32: "windows" };
+	const architectures = { arm64: "arm64", x64: "amd64" };
+	const goos = operatingSystems[platform];
+	const goarch = architectures[architecture];
+	if (goos === undefined || goarch === undefined) {
+		throw new Error(
+			`Ridu has no prebuilt CLI for ${platform}/${architecture}; install it with Go instead`
+		);
+	}
+	return { goarch, goos, windows: goos === "windows" };
+}
+
+export function archiveName(version, target) {
+	const extension = target.windows ? "zip" : "tar.gz";
+	return `ridu_${version}_${target.goos}_${target.goarch}.${extension}`;
+}
+
+export function expectedChecksum(checksums, filename) {
+	for (const line of checksums.split(/\r?\n/u)) {
+		const match = line.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/u);
+		if (match !== null && basename(match[2]) === filename) {
+			return match[1].toLowerCase();
+		}
+	}
+	throw new Error(`Ridu release checksums do not contain ${filename}`);
+}
+
+export function verifyChecksum(bytes, expected, filename) {
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (actual !== expected) {
+		throw new Error(
+			`Ridu CLI checksum mismatch for ${filename}: expected ${expected}, got ${actual}`
+		);
+	}
+}
+
+export function extractTarGzipBinary(archive, binaryName = "ridu") {
+	const tar = gunzipSync(archive);
+	for (let offset = 0; offset + 512 <= tar.length;) {
+		const header = tar.subarray(offset, offset + 512);
+		if (header.every((byte) => byte === 0)) break;
+		const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/u, "");
+		const encodedSize = header.subarray(124, 136).toString("ascii").replace(/\0.*$/u, "").trim();
+		const size = Number.parseInt(encodedSize || "0", 8);
+		if (!Number.isSafeInteger(size) || size < 0) {
+			throw new Error(`invalid tar member size for ${name}`);
+		}
+		const contentOffset = offset + 512;
+		if (basename(name) === binaryName) {
+			return tar.subarray(contentOffset, contentOffset + size);
+		}
+		offset = contentOffset + Math.ceil(size / 512) * 512;
+	}
+	throw new Error(`Ridu release archive does not contain ${binaryName}`);
+}
+
+function cacheRoot() {
+	if (process.env.RIDU_CLI_CACHE_DIR) return process.env.RIDU_CLI_CACHE_DIR;
+	if (process.platform === "win32" && process.env.LOCALAPPDATA) {
+		return join(process.env.LOCALAPPDATA, "ridu", "cli");
+	}
+	if (process.env.XDG_CACHE_HOME) return join(process.env.XDG_CACHE_HOME, "ridu", "cli");
+	return join(homedir(), ".cache", "ridu", "cli");
+}
+
+async function download(url) {
+	const response = await fetch(url, {
+		headers: { "user-agent": "@riducms/cli" },
+		redirect: "follow",
+	});
+	if (!response.ok) {
+		throw new Error(`download ${url}: ${response.status} ${response.statusText}`);
+	}
+	return Buffer.from(await response.arrayBuffer());
+}
+
+function installWindowsArchive(archive, destination) {
+	const stage = join(tmpdir(), `ridu-cli-${process.pid}-${Date.now()}`);
+	const archivePath = `${stage}.zip`;
+	mkdirSync(stage, { recursive: true });
+	try {
+		writeFileSync(archivePath, archive, { mode: 0o600 });
+		const result = spawnSync(
+			"powershell.exe",
+			[
+				"-NoProfile",
+				"-NonInteractive",
+				"-Command",
+				`Expand-Archive -LiteralPath '${archivePath.replaceAll("'", "''")}' -DestinationPath '${stage.replaceAll("'", "''")}' -Force`,
+			],
+			{ encoding: "utf8" }
+		);
+		if (result.status !== 0) {
+			const detail = result.error?.message ?? String(result.stderr ?? "").trim();
+			throw new Error(`extract Ridu CLI archive: ${detail || "PowerShell exited unsuccessfully"}`);
+		}
+		writeFileSync(destination, readFileSync(join(stage, "ridu.exe")), { mode: 0o755 });
+	} finally {
+		rmSync(stage, { force: true, recursive: true });
+		rmSync(archivePath, { force: true });
+	}
+}
+
+export async function ensureBinary(version) {
+	if (process.env.RIDU_BINARY) return process.env.RIDU_BINARY;
+	const target = releaseTarget();
+	const binaryName = target.windows ? "ridu.exe" : "ridu";
+	const destination = join(cacheRoot(), version, `${target.goos}-${target.goarch}`, binaryName);
+	if (existsSync(destination)) return destination;
+
+	mkdirSync(dirname(destination), { recursive: true });
+	const filename = archiveName(version, target);
+	const releaseBase =
+		process.env.RIDU_CLI_RELEASE_BASE_URL ?? `${repository}/releases/download/v${version}`;
+	const [archive, checksums] = await Promise.all([
+		download(`${releaseBase}/${filename}`),
+		download(`${releaseBase}/SHA256SUMS`),
+	]);
+	verifyChecksum(archive, expectedChecksum(checksums.toString("utf8"), filename), filename);
+
+	const temporary = `${destination}.${process.pid}.tmp`;
+	try {
+		if (target.windows) {
+			installWindowsArchive(archive, temporary);
+		} else {
+			writeFileSync(temporary, extractTarGzipBinary(archive), { mode: 0o755 });
+		}
+		try {
+			renameSync(temporary, destination);
+		} catch (error) {
+			if (!existsSync(destination)) throw error;
+		}
+	} finally {
+		rmSync(temporary, { force: true });
+	}
+	return destination;
+}

package/src/run.js

@@ -0,0 +1,28 @@
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { ensureBinary } from "./launcher.js";
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const { version } = JSON.parse(readFileSync(resolve(packageRoot, "package.json"), "utf8"));
+
+export async function runRidu(arguments_) {
+	const binary = await ensureBinary(version);
+	const child = spawn(binary, arguments_, { stdio: "inherit" });
+	const signalHandlers = new Map();
+	for (const signal of ["SIGINT", "SIGTERM"]) {
+		const handler = () => child.kill(signal);
+		signalHandlers.set(signal, handler);
+		process.once(signal, handler);
+	}
+	try {
+		return await new Promise((resolvePromise, reject) => {
+			child.once("error", reject);
+			child.once("exit", (code) => resolvePromise(code ?? 1));
+		});
+	} finally {
+		for (const [signal, handler] of signalHandlers) process.off(signal, handler);
+	}
+}