@symbiosis-lab/moss 0.11.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Symbiosis Lab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,61 @@
+# @symbiosis-lab/moss
+
+moss on your PATH. This package downloads the official [moss](https://@symbiosis-lab/moss.com)
+CLI binary from [moss-releases](https://github.com/Symbiosis-Lab/moss-releases)
+and exposes it as the `moss` command.
+
+> **Publishing note:** the package is currently marked `"private": true` in
+> `package.json` so it cannot ship by accident. Flip that (remove the field)
+> at publish time — `publishConfig` is already set up.
+
+## Install
+
+```sh
+npm install -g @symbiosis-lab/moss
+moss --version
+```
+
+The binary is fetched at install time (postinstall). With `--ignore-scripts`,
+or if the download failed (e.g. offline), the first `moss` invocation fetches
+it lazily instead.
+
+Supported platforms: macOS (Intel and Apple Silicon, one universal binary)
+and Linux x86_64.
+
+## Use
+
+```sh
+moss build ~/Sites/my-site
+```
+
+All arguments pass straight through to the moss binary; see `moss --help`.
+
+## Linux runtime dependency (temporary)
+
+The current Linux binary links against WebKitGTK even for headless CLI verbs.
+If `moss` fails with `error while loading shared libraries`, install:
+
+```sh
+sudo apt install libwebkit2gtk-4.1-0
+```
+
+This requirement is temporary — a moss CLI build without the WebKitGTK
+linkage is planned.
+
+## Checksums
+
+Downloads are verified against the `SHA256SUMS` file published with each
+release. Releases that predate checksum publishing install with a warning
+instead of verification.
+
+## Versioning and overrides
+
+The wrapper downloads the moss version matching its own package version;
+they are released in lockstep. `MOSS_VERSION_OVERRIDE=v0.11.1` forces a
+specific release (ops/testing escape hatch).
+
+## License
+
+The wrapper code in this package is MIT (see LICENSE). The moss binary it
+downloads is a separate work, distributed under its own terms via
+[moss-releases](https://github.com/Symbiosis-Lab/moss-releases).

package/bin/moss.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// Shim: run the vendored moss binary, downloading it first if it isn't
+// there yet (covers `npm install --ignore-scripts` and a postinstall that
+// failed offline).
+
+'use strict';
+
+const fs = require('node:fs');
+const { spawnSync } = require('node:child_process');
+const { fetchBinary, vendorBinary } = require('../lib/fetch.js');
+
+async function main() {
+  if (!fs.existsSync(vendorBinary)) {
+    await fetchBinary();
+  }
+
+  // stderr is piped so a loader failure can be recognized, then replayed
+  // verbatim. stdin/stdout stay inherited for interactive use.
+  const result = spawnSync(vendorBinary, process.argv.slice(2), {
+    stdio: ['inherit', 'inherit', 'pipe'],
+  });
+
+  const stderr = result.stderr ? result.stderr.toString() : '';
+  if (stderr) process.stderr.write(stderr);
+
+  if (result.error) throw result.error;
+
+  if (stderr.includes('error while loading shared libraries')) {
+    console.error(
+      '\nmoss-npm: the moss binary currently needs the WebKitGTK runtime libraries:\n' +
+        '  sudo apt install libwebkit2gtk-4.1-0\n' +
+        'This is temporary — a moss CLI build without that linkage is planned.'
+    );
+  }
+
+  process.exit(result.status === null ? 1 : result.status);
+}
+
+main().catch((err) => {
+  console.error(err.message || err);
+  process.exit(1);
+});

package/install.js

@@ -0,0 +1,15 @@
+// postinstall: download the moss binary for this platform.
+//
+// Never fails the npm install — an offline machine or a proxy hiccup should
+// not break an unrelated `npm install`. The bin shim (bin/moss.js) retries
+// the download lazily on first run, so exiting 0 here loses nothing.
+
+'use strict';
+
+const { fetchBinary } = require('./lib/fetch.js');
+
+fetchBinary().catch((err) => {
+  console.warn(`\nmoss-npm: could not download the moss binary now:\n  ${err.message}`);
+  console.warn('moss-npm: will retry automatically the first time you run `moss`.\n');
+  process.exit(0);
+});

package/lib/fetch.js

@@ -0,0 +1,98 @@
+// Downloads the moss CLI binary for this platform from moss-releases.
+//
+// No dependencies: uses the global fetch that ships with Node >= 18.
+// The version defaults to this package's own version (the wrapper is
+// released in lockstep with moss), overridable with MOSS_VERSION_OVERRIDE
+// for ops and testing.
+
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const RELEASES = 'https://github.com/Symbiosis-Lab/moss-releases/releases/download';
+
+const packageRoot = path.join(__dirname, '..');
+const vendorBinary = path.join(packageRoot, 'vendor', 'moss');
+
+function resolveVersion() {
+  const override = process.env.MOSS_VERSION_OVERRIDE;
+  if (override) return override.replace(/^v/, '');
+  return require(path.join(packageRoot, 'package.json')).version;
+}
+
+// Platform → release asset. The darwin binary is a universal (x64 + arm64)
+// build, so both Mac architectures map to the same asset.
+function resolveAsset() {
+  const { platform, arch } = process;
+  if (platform === 'darwin' && (arch === 'x64' || arch === 'arm64')) {
+    return 'moss-darwin-universal';
+  }
+  if (platform === 'linux' && arch === 'x64') {
+    return 'moss-linux-x86_64';
+  }
+  throw new Error(
+    `moss-npm: no moss binary is published for ${platform}-${arch}.\n` +
+      'Supported: macOS (x64/arm64) and Linux (x64). ' +
+      'See https://github.com/Symbiosis-Lab/moss-releases for available builds.'
+  );
+}
+
+async function download(url) {
+  const res = await fetch(url, { redirect: 'follow' });
+  if (!res.ok) {
+    throw new Error(`moss-npm: download failed (${res.status} ${res.statusText}): ${url}`);
+  }
+  return Buffer.from(await res.arrayBuffer());
+}
+
+// Verifies bytes against the release's SHA256SUMS. Releases before v0.11.2
+// published no checksums; a missing SHA256SUMS is a warning, not a failure.
+async function verifyChecksum(bytes, asset, version) {
+  let sums;
+  try {
+    const res = await fetch(`${RELEASES}/v${version}/SHA256SUMS`, { redirect: 'follow' });
+    if (!res.ok) {
+      console.warn(`moss-npm: no SHA256SUMS published for v${version}; skipping checksum verification`);
+      return;
+    }
+    sums = await res.text();
+  } catch (err) {
+    console.warn(`moss-npm: could not fetch SHA256SUMS (${err.message}); skipping checksum verification`);
+    return;
+  }
+
+  const line = sums.split('\n').find((l) => l.trim().endsWith(asset));
+  if (!line) {
+    console.warn(`moss-npm: SHA256SUMS has no entry for ${asset}; skipping checksum verification`);
+    return;
+  }
+
+  const expected = line.trim().split(/\s+/)[0];
+  const actual = crypto.createHash('sha256').update(bytes).digest('hex');
+  if (actual !== expected) {
+    throw new Error(
+      `moss-npm: checksum mismatch for ${asset} v${version}\n` +
+        `  expected ${expected}\n  got      ${actual}\n` +
+        'The download may be corrupted or tampered with. Not installing.'
+    );
+  }
+}
+
+async function fetchBinary() {
+  const version = resolveVersion();
+  const asset = resolveAsset();
+  const url = `${RELEASES}/v${version}/${asset}`;
+
+  console.log(`moss-npm: downloading moss v${version} (${asset})...`);
+  const bytes = await download(url);
+  await verifyChecksum(bytes, asset, version);
+
+  fs.mkdirSync(path.dirname(vendorBinary), { recursive: true });
+  fs.writeFileSync(vendorBinary, bytes, { mode: 0o755 });
+  console.log(`moss-npm: installed ${vendorBinary}`);
+  return vendorBinary;
+}
+
+module.exports = { fetchBinary, vendorBinary, resolveAsset, resolveVersion };

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@symbiosis-lab/moss",
+  "version": "0.11.1",
+  "description": "moss on your PATH \u2014 npm wrapper that installs the moss CLI binary from moss-releases",
+  "bin": {
+    "moss": "bin/moss.js"
+  },
+  "scripts": {
+    "postinstall": "node install.js",
+    "test:smoke": "node bin/moss.js --version"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "install.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "keywords": [
+    "moss",
+    "publishing",
+    "static-site",
+    "cli"
+  ],
+  "author": "Guo Liu",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Symbiosis-Lab/moss-releases.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Symbiosis-Lab/moss-releases/issues"
+  },
+  "homepage": "https://mosspub.com",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "provenance": false
+  }
+}