@synopackageland/cli 0.3.9 → 0.4.0

package/dist/publish/file-build-ledger.d.ts

@@ -1,18 +0,0 @@
-import type { BuildLedger, BuildLedgerSnapshot } from "./build-ledger.js";
-export declare const BUILD_LEDGER_FILENAME = "package-build-ledger.jsonl";
-export declare const BUILD_LEDGER_PATH_ENV = "SYNOPKGLAND_BUILD_LEDGER_PATH";
-export interface ResolveBuildLedgerPathOptions {
-    env?: NodeJS.Dict<string>;
-    cwd?: string;
-    communityAppsRoot?: string;
-}
-export declare function defaultBuildLedgerPath(communityAppsRoot: string): string;
-export declare function resolveBuildLedgerPath(options?: ResolveBuildLedgerPathOptions): string;
-export declare class FileBuildLedger implements BuildLedger {
-    readonly ledgerPath: string;
-    constructor(ledgerPath: string);
-    allocate(packageIdentity: string): number;
-    markPublishFailed(packageIdentity: string, build: number): void;
-    snapshot(packageIdentity: string): BuildLedgerSnapshot;
-}
-export declare function runFileBuildLedgerCli(argv: string[], env?: NodeJS.Dict<string>): void;

package/dist/publish/file-build-ledger.js

@@ -1,268 +0,0 @@
-/**
- * Durable append-only Package Build ledger for protected-main merge CI.
- *
- * Default path: synopkgland-community-apps/ci/package-build-ledger.jsonl
- * (override with SYNOPKGLAND_BUILD_LEDGER_PATH). Concurrent allocate() is
- * serialized with an exclusive lockfile next to the ledger. Do not commit live
- * numbers; Git history / release artifacts remain disaster recovery.
- *
- * This module does not sign, upload artifacts, or mutate Package Source index.
- */
-import { randomUUID } from "node:crypto";
-import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeSync, } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { resolveCommunityAppsRoot } from "./community-path.js";
-export const BUILD_LEDGER_FILENAME = "package-build-ledger.jsonl";
-export const BUILD_LEDGER_PATH_ENV = "SYNOPKGLAND_BUILD_LEDGER_PATH";
-const LOCK_RETRY_MS = 15;
-const LOCK_TIMEOUT_MS = 30_000;
-const LOCK_FRESH_MS = 2_000;
-export function defaultBuildLedgerPath(communityAppsRoot) {
-    return join(communityAppsRoot, "ci", BUILD_LEDGER_FILENAME);
-}
-export function resolveBuildLedgerPath(options = {}) {
-    const env = options.env ?? process.env;
-    const fromEnv = env[BUILD_LEDGER_PATH_ENV]?.trim();
-    if (fromEnv) {
-        return resolve(fromEnv);
-    }
-    const cwd = options.cwd ?? process.cwd();
-    const communityRoot = options.communityAppsRoot ?? resolveCommunityAppsRoot(cwd);
-    if (communityRoot) {
-        return defaultBuildLedgerPath(communityRoot);
-    }
-    return resolve(cwd, "synopkgland-community-apps", "ci", BUILD_LEDGER_FILENAME);
-}
-export class FileBuildLedger {
-    ledgerPath;
-    constructor(ledgerPath) {
-        this.ledgerPath = ledgerPath;
-    }
-    allocate(packageIdentity) {
-        requirePackageIdentity(packageIdentity);
-        return withLedgerLock(this.ledgerPath, () => {
-            const records = readRecords(this.ledgerPath);
-            const build = lastAllocated(records, packageIdentity) + 1;
-            appendRecord(this.ledgerPath, {
-                packageIdentity,
-                build,
-                event: "allocated",
-                at: new Date().toISOString(),
-            });
-            return build;
-        });
-    }
-    markPublishFailed(packageIdentity, build) {
-        requirePackageIdentity(packageIdentity);
-        withLedgerLock(this.ledgerPath, () => {
-            appendRecord(this.ledgerPath, {
-                packageIdentity,
-                build,
-                event: "publish-failed",
-                at: new Date().toISOString(),
-            });
-        });
-    }
-    snapshot(packageIdentity) {
-        requirePackageIdentity(packageIdentity);
-        return withLedgerLock(this.ledgerPath, () => snapshotFromRecords(readRecords(this.ledgerPath), packageIdentity));
-    }
-}
-export function runFileBuildLedgerCli(argv, env = process.env) {
-    const command = argv[2];
-    const ledger = new FileBuildLedger(resolveBuildLedgerPath({ env }));
-    if (command === "allocate") {
-        const packageIdentity = requirePackageIdentity(argv[3]);
-        const build = ledger.allocate(packageIdentity);
-        process.stdout.write(`${JSON.stringify({ packageIdentity, build })}\n`);
-        return;
-    }
-    if (command === "mark-failed") {
-        const packageIdentity = requirePackageIdentity(argv[3]);
-        const build = Number(argv[4]);
-        if (!Number.isInteger(build) || build < 1) {
-            throw new Error("usage: file-build-ledger mark-failed <packageIdentity> <build>");
-        }
-        ledger.markPublishFailed(packageIdentity, build);
-        process.stdout.write(`${JSON.stringify({ packageIdentity, build, event: "publish-failed" })}\n`);
-        return;
-    }
-    if (command === "snapshot") {
-        const packageIdentity = requirePackageIdentity(argv[3]);
-        process.stdout.write(`${JSON.stringify({ packageIdentity, ...ledger.snapshot(packageIdentity) })}\n`);
-        return;
-    }
-    throw new Error("usage: file-build-ledger <allocate|mark-failed|snapshot> <packageIdentity> [build]");
-}
-function requirePackageIdentity(packageIdentity) {
-    if (typeof packageIdentity !== "string" || packageIdentity.trim().length === 0) {
-        throw new Error("package identity is required");
-    }
-    return packageIdentity;
-}
-function snapshotFromRecords(records, packageIdentity) {
-    const consumed = records
-        .filter((record) => record.packageIdentity === packageIdentity && record.event === "allocated")
-        .map((record) => record.build);
-    return {
-        nextBuild: lastAllocated(records, packageIdentity),
-        consumed,
-    };
-}
-function lastAllocated(records, packageIdentity) {
-    let max = 0;
-    for (const record of records) {
-        if (record.packageIdentity === packageIdentity && record.event === "allocated" && record.build > max) {
-            max = record.build;
-        }
-    }
-    return max;
-}
-function readRecords(ledgerPath) {
-    if (!existsSync(ledgerPath)) {
-        return [];
-    }
-    const text = readFileSync(ledgerPath, "utf8");
-    const records = [];
-    for (const [index, line] of text.split("\n").entries()) {
-        if (line.trim().length === 0) {
-            continue;
-        }
-        try {
-            records.push(JSON.parse(line));
-        }
-        catch (error) {
-            throw new Error(`invalid ledger record at ${ledgerPath}:${index + 1}: ${String(error)}`);
-        }
-    }
-    return records;
-}
-function appendRecord(ledgerPath, record) {
-    mkdirSync(dirname(ledgerPath), { recursive: true });
-    const fd = openSync(ledgerPath, "a");
-    try {
-        writeSync(fd, `${JSON.stringify(record)}\n`);
-        fsyncSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-function withLedgerLock(ledgerPath, fn) {
-    const lockPath = `${ledgerPath}.lock`;
-    mkdirSync(dirname(ledgerPath), { recursive: true });
-    const held = acquireExclusiveLock(lockPath);
-    try {
-        return fn();
-    }
-    finally {
-        releaseLock(held.fd, lockPath, held.token);
-    }
-}
-function acquireExclusiveLock(lockPath) {
-    const started = Date.now();
-    for (;;) {
-        const token = randomUUID();
-        try {
-            const fd = openSync(lockPath, "wx");
-            writeSync(fd, `${process.pid} ${token}\n`);
-            fsyncSync(fd);
-            return { fd, token };
-        }
-        catch (error) {
-            if (!isAlreadyExists(error)) {
-                throw error;
-            }
-            if (Date.now() - started > LOCK_TIMEOUT_MS) {
-                throw new Error(`timed out acquiring ledger lock: ${lockPath}`);
-            }
-            stealIfStale(lockPath);
-            sleepSync(LOCK_RETRY_MS);
-        }
-    }
-}
-function stealIfStale(lockPath) {
-    try {
-        const ageMs = Date.now() - statSync(lockPath).mtimeMs;
-        if (ageMs < LOCK_FRESH_MS) {
-            return;
-        }
-        const parsed = parseLockOwner(readFileSync(lockPath, "utf8"));
-        if (parsed && pidIsAlive(parsed.pid) && ageMs < LOCK_TIMEOUT_MS) {
-            return;
-        }
-        unlinkSync(lockPath);
-    }
-    catch (error) {
-        if (!isNotFound(error)) {
-            return;
-        }
-    }
-}
-function parseLockOwner(raw) {
-    const match = raw.trim().match(/^(\d+)\s+(\S+)$/);
-    if (!match) {
-        return null;
-    }
-    const pid = Number(match[1]);
-    if (!Number.isInteger(pid) || pid <= 0) {
-        return null;
-    }
-    return { pid, token: match[2] };
-}
-function releaseLock(fd, lockPath, token) {
-    try {
-        closeSync(fd);
-    }
-    finally {
-        try {
-            const parsed = parseLockOwner(readFileSync(lockPath, "utf8"));
-            if (parsed?.token === token) {
-                unlinkSync(lockPath);
-            }
-        }
-        catch {
-            // Best effort; a leftover lock is stolen if the holder is gone.
-        }
-    }
-}
-function pidIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function sleepSync(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function isAlreadyExists(error) {
-    return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
-}
-function isNotFound(error) {
-    return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-function invokedAsCli() {
-    const entry = process.argv[1];
-    if (!entry) {
-        return false;
-    }
-    try {
-        return resolve(fileURLToPath(import.meta.url)) === resolve(entry);
-    }
-    catch {
-        return pathToFileURL(resolve(entry)).href === import.meta.url;
-    }
-}
-if (invokedAsCli()) {
-    try {
-        runFileBuildLedgerCli(process.argv);
-    }
-    catch (error) {
-        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
-        process.exit(1);
-    }
-}

package/dist/publish/github-pr.d.ts

@@ -1,25 +0,0 @@
-export interface CreatePullRequestOptions {
-    title: string;
-    body: string;
-    base: string;
-    head: string;
-    draft?: boolean;
-}
-export interface PullRequestRef {
-    url: string;
-    number: number;
-}
-export interface GitHubCli {
-    createPullRequest(options: CreatePullRequestOptions): Promise<PullRequestRef>;
-}
-export interface GitOps {
-    currentBranch(): string;
-    checkoutNewBranch(branchName: string): void;
-    checkoutExisting(branchName: string): void;
-    add(paths: string[]): void;
-    commit(message: string, paths: string[]): void;
-    push(branchName: string, setUpstream: boolean): void;
-    hasChanges(paths: string[]): boolean;
-}
-export declare function createExecGitOps(cwd: string): GitOps;
-export declare function createExecGitHubCli(cwd: string, repo?: string): GitHubCli;

package/dist/publish/github-pr.js

@@ -1,85 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { communityAppsGitHubRepo, githubToken } from "./github-repo.js";
-export function createExecGitOps(cwd) {
-    const run = (args) => execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-    return {
-        currentBranch() {
-            return run(["rev-parse", "--abbrev-ref", "HEAD"]);
-        },
-        checkoutNewBranch(branchName) {
-            run(["checkout", "-b", branchName]);
-        },
-        checkoutExisting(branchName) {
-            run(["checkout", branchName]);
-        },
-        add(paths) {
-            if (paths.length === 0) {
-                return;
-            }
-            run(["add", "--", ...paths]);
-        },
-        commit(message, paths) {
-            if (paths.length === 0) {
-                throw new Error("git commit requires a pathspec");
-            }
-            run(["commit", "-m", message, "--", ...paths]);
-        },
-        push(branchName, setUpstream) {
-            const args = ["push"];
-            if (setUpstream) {
-                args.push("-u", "origin", branchName);
-            }
-            else {
-                args.push("origin", branchName);
-            }
-            run(args);
-        },
-        hasChanges(paths) {
-            if (paths.length === 0) {
-                return false;
-            }
-            const status = run(["status", "--porcelain", "--", ...paths]);
-            return status.length > 0;
-        },
-    };
-}
-export function createExecGitHubCli(cwd, repo) {
-    const targetRepo = repo ?? communityAppsGitHubRepo();
-    return {
-        async createPullRequest(options) {
-            const token = githubToken();
-            const args = [
-                "pr",
-                "create",
-                "--repo",
-                targetRepo,
-                "--title",
-                options.title,
-                "--body",
-                options.body,
-                "--base",
-                options.base,
-                "--head",
-                options.head,
-            ];
-            if (options.draft) {
-                args.push("--draft");
-            }
-            const stdout = execFileSync("gh", args, {
-                cwd,
-                encoding: "utf8",
-                stdio: ["ignore", "pipe", "pipe"],
-                env: {
-                    ...process.env,
-                    ...(token ? { GH_TOKEN: token, GITHUB_TOKEN: token } : {}),
-                },
-            }).trim();
-            const url = stdout.split(/\s+/).pop() ?? stdout;
-            const match = url.match(/\/pull\/(\d+)\/?$/);
-            return {
-                url,
-                number: match ? Number(match[1]) : 0,
-            };
-        },
-    };
-}

package/dist/publish/github-repo.d.ts

@@ -1,8 +0,0 @@
-export declare const DEFAULT_GITHUB_OWNER = "synopackageland";
-export declare const COMMUNITY_APPS_GITHUB_REPO = "synopkgland-community-apps";
-export declare const PLATFORM_GITHUB_REPO = "syno-package-land";
-export declare function githubOwner(env?: NodeJS.ProcessEnv): string;
-export declare function communityAppsGitHubRepo(env?: NodeJS.ProcessEnv): string;
-export declare function communityAppsGitHubUrl(env?: NodeJS.ProcessEnv): string;
-export declare function platformGitHubUrl(env?: NodeJS.ProcessEnv): string;
-export declare function githubToken(env?: NodeJS.ProcessEnv): string | undefined;

package/dist/publish/github-repo.js

@@ -1,21 +0,0 @@
-export const DEFAULT_GITHUB_OWNER = "synopackageland";
-export const COMMUNITY_APPS_GITHUB_REPO = "synopkgland-community-apps";
-export const PLATFORM_GITHUB_REPO = "syno-package-land";
-export function githubOwner(env = process.env) {
-    const fromEnv = env.GITHUB_OWNER?.trim();
-    return fromEnv && fromEnv.length > 0 ? fromEnv : DEFAULT_GITHUB_OWNER;
-}
-export function communityAppsGitHubRepo(env = process.env) {
-    const repo = env.GITHUB_COMMUNITY_APPS_REPO?.trim() || COMMUNITY_APPS_GITHUB_REPO;
-    return `${githubOwner(env)}/${repo}`;
-}
-export function communityAppsGitHubUrl(env = process.env) {
-    return `https://github.com/${communityAppsGitHubRepo(env)}`;
-}
-export function platformGitHubUrl(env = process.env) {
-    return `https://github.com/${githubOwner(env)}/${PLATFORM_GITHUB_REPO}`;
-}
-export function githubToken(env = process.env) {
-    const token = env.GH_TOKEN?.trim() || env.GITHUB_TOKEN?.trim();
-    return token && token.length > 0 ? token : undefined;
-}

package/dist/publish/platform-service-release.d.ts

@@ -1,60 +0,0 @@
-import { type CuratedReleasePublisher } from "@synopackageland/package-source/publish-spk";
-import { type PlatformServiceReleaseErrorCode, type PlatformAttestationSigner } from "../attestation/platform-service.js";
-export declare const SYNOPKGLAND_SOURCE_REVISION_ENV = "SYNOPKGLAND_SOURCE_REVISION";
-export declare const PLATFORM_SERVICE_OS_MIN_VER = "7.2-69057";
-export type PlatformReleaseErrorCode = "PLATFORM_RELEASE_USAGE" | "PLATFORM_BROKER_DIR_INVALID" | "PLATFORM_APP_PROJECT_FORBIDDEN" | "PLATFORM_ARTIFACT_INPUT_FORBIDDEN" | "PLATFORM_BUILD_INVALID" | "PLATFORM_SOURCE_REVISION_MISSING" | "PLATFORM_BUILDER_UNAVAILABLE" | "PLATFORM_BUILD_FAILED" | "PLATFORM_RELEASE_FAILED" | PlatformServiceReleaseErrorCode;
-/** Errors owned by the platform release entry point, separate from signer errors. */
-export declare class PlatformReleaseError extends Error {
-    readonly code: PlatformReleaseErrorCode;
-    constructor(code: PlatformReleaseErrorCode, detail?: string);
-}
-export interface PlatformServiceReleaseBaseline {
-    sourceVersion: string;
-    baselineBuild: number;
-}
-export interface PlatformServiceBuildOptions {
-    outputPath: string;
-    releaseVersion: string;
-}
-/** The broker-side module contract used by production and by release tests. */
-export interface PlatformServiceBuilder {
-    buildBrokerSpk(options: PlatformServiceBuildOptions): unknown | Promise<unknown>;
-    brokerReleaseBaseline(): PlatformServiceReleaseBaseline;
-}
-export interface PlatformServiceReleaseOptions {
-    brokerDir: string;
-    build: number;
-    sourceRevision: string;
-    signer: PlatformAttestationSigner;
-    publisher: CuratedReleasePublisher;
-    /** Tests may inject a builder; production loads the broker-side module. */
-    builder?: PlatformServiceBuilder;
-}
-export interface PlatformServiceReleaseResult {
-    packageIdentity: string;
-    packageBuild: number;
-    version: string;
-    artifactKey: string;
-    artifactDigest: string;
-    attestationKey: string;
-    attestationDigest: string;
-}
-export interface PlatformServiceReleaseCliDependencies {
-    /** Test seams; production creates these from the environment and R2 target. */
-    signer?: PlatformAttestationSigner;
-    publisher?: CuratedReleasePublisher;
-    builder?: PlatformServiceBuilder;
-    /** Optional output seams keep CLI tests independent of process-global streams. */
-    writeStdout?: (line: string) => void;
-    writeStderr?: (line: string) => void;
-}
-/**
- * Build, attest and publish one immutable Broker SPK release.
- *
- * All cheap input gates run before the broker builder is loaded or invoked.
- * Publication is delegated to the package-source three-phase boundary, which
- * enforces artifact -> attestation -> index ordering.
- */
-export declare function releasePlatformService(options: PlatformServiceReleaseOptions): Promise<PlatformServiceReleaseResult>;
-/** Run the trusted platform release verb and emit exactly one line. */
-export declare function runPlatformServiceReleaseCli(argv?: string[], env?: NodeJS.Dict<string>, dependencies?: PlatformServiceReleaseCliDependencies): Promise<number>;