@that-company/dat 0.1.30 → 0.1.32

package/README.md

@@ -28,3 +28,26 @@ curl -fsSL https://thatcompany.ai/install.sh | sh
 - `DAT_INSTALL_BASE`: full release asset base URL
 - `DAT_CHANNEL`: release path under `/releases`, default `download/v<package version>`
 - `DAT_SKIP_INSTALL=1`: skip binary download during npm install
+
+## Release
+
+The npm package version must match an already-published `dat` GitHub Release.
+The installer intentionally downloads from `download/v<package version>` instead
+of `latest/download`, so npm installs are reproducible and the package version
+has one meaning.
+
+Release order:
+
+1. Publish the `dat` binary release to `theSalted/dat-releases`.
+2. Set this package version to the same `X.Y.Z`.
+3. Run `npm run verify:release`.
+4. Publish with `npm run release`.
+5. Verify `npm view @that-company/dat version` and a temp global install:
+
+   ```sh
+   npm install -g --prefix /tmp/dat-npm-check @that-company/dat@latest
+   /tmp/dat-npm-check/bin/dat --version
+   ```
+
+The `prepublishOnly` hook runs the same release guard if someone uses
+`npm publish --access public` directly.

package/bin/dat.js

@@ -8,7 +8,7 @@ const { join } = require("node:path");
 const binary = join(__dirname, "..", "vendor", process.platform === "win32" ? "dat.exe" : "dat");
 
 if (!existsSync(binary)) {
-  console.error("dat binary is missing. Reinstall with: npm rebuild -g @thatcompany/dat");
+  console.error("dat binary is missing. Reinstall with: npm rebuild -g @that-company/dat");
   process.exit(1);
 }
 

package/package.json

@@ -1,12 +1,15 @@
 {
   "name": "@that-company/dat",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "Installer for the D.A.T. CLI",
   "bin": {
     "dat": "bin/dat.js"
   },
   "scripts": {
-    "postinstall": "node scripts/install.js"
+    "postinstall": "node scripts/install.js",
+    "prepublishOnly": "node scripts/prepublish.js",
+    "release": "npm run verify:release && npm publish --access public",
+    "verify:release": "node scripts/prepublish.js"
   },
   "files": [
     "bin",

package/scripts/prepublish.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+"use strict";
+
+const { get, request } = require("node:https");
+const { URL } = require("node:url");
+
+const pkg = require("../package.json");
+
+const RELEASE_ASSETS = ["dat-darwin-arm64", "dat-darwin-x64", "dat-linux-arm64", "dat-linux-x64"];
+const REPO = process.env.DAT_RELEASE_REPO || "theSalted/dat-releases";
+const CHANNEL = process.env.DAT_CHANNEL || `download/v${pkg.version}`;
+const RELEASE_BASE = trimTrailingSlash(
+  process.env.DAT_INSTALL_BASE || `https://github.com/${REPO}/releases/${CHANNEL}`,
+);
+
+main().catch((error) => {
+  console.error(`dat npm release check failed: ${error instanceof Error ? error.message : String(error)}`);
+  process.exit(1);
+});
+
+async function main() {
+  if (!/^\d+\.\d+\.\d+$/.test(pkg.version)) {
+    throw new Error(`package version must be plain X.Y.Z, got ${pkg.version}`);
+  }
+
+  const version = await downloadText(`${RELEASE_BASE}/VERSION`);
+  if (version.trim() !== pkg.version) {
+    throw new Error(`release VERSION is ${version.trim()}, but package.json is ${pkg.version}`);
+  }
+
+  const sums = await downloadText(`${RELEASE_BASE}/SHA256SUMS`);
+  for (const asset of RELEASE_ASSETS) {
+    if (!hasChecksumEntry(sums, asset)) {
+      throw new Error(`SHA256SUMS has no entry for ${asset}`);
+    }
+    await assertHeadOk(`${RELEASE_BASE}/${asset}`);
+  }
+
+  console.error(`release check ok: @that-company/dat ${pkg.version} matches ${RELEASE_BASE}`);
+}
+
+function hasChecksumEntry(sums, asset) {
+  return sums
+    .split(/\r?\n/)
+    .some((line) => {
+      const parts = line.trim().split(/\s+/);
+      return parts.length === 2 && parts[1] === asset && /^[0-9a-f]{64}$/i.test(parts[0]);
+    });
+}
+
+function trimTrailingSlash(value) {
+  return value.endsWith("/") ? trimTrailingSlash(value.slice(0, -1)) : value;
+}
+
+function downloadText(url, redirects = 0) {
+  if (redirects > 5) {
+    return Promise.reject(new Error(`too many redirects while downloading ${url}`));
+  }
+
+  return new Promise((resolve, reject) => {
+    const req = get(new URL(url), (res) => {
+      const status = res.statusCode || 0;
+      const location = res.headers.location;
+      if (status >= 300 && status < 400 && location) {
+        res.resume();
+        downloadText(new URL(location, url).toString(), redirects + 1).then(resolve, reject);
+        return;
+      }
+      if (status !== 200) {
+        res.resume();
+        reject(new Error(`GET ${url} -> HTTP ${status}`));
+        return;
+      }
+      res.setEncoding("utf8");
+      let body = "";
+      res.on("data", (chunk) => {
+        body += chunk;
+      });
+      res.on("end", () => resolve(body));
+    });
+    req.on("error", reject);
+    req.setTimeout(30_000, () => {
+      req.destroy(new Error(`timeout downloading ${url}`));
+    });
+  });
+}
+
+function assertHeadOk(url, redirects = 0) {
+  if (redirects > 5) {
+    return Promise.reject(new Error(`too many redirects while checking ${url}`));
+  }
+
+  return new Promise((resolve, reject) => {
+    const req = request(new URL(url), { method: "HEAD" }, (res) => {
+      const status = res.statusCode || 0;
+      const location = res.headers.location;
+      res.resume();
+      if (status >= 300 && status < 400 && location) {
+        assertHeadOk(new URL(location, url).toString(), redirects + 1).then(resolve, reject);
+        return;
+      }
+      if (status !== 200) {
+        reject(new Error(`HEAD ${url} -> HTTP ${status}`));
+        return;
+      }
+      resolve();
+    });
+    req.on("error", reject);
+    req.setTimeout(30_000, () => {
+      req.destroy(new Error(`timeout checking ${url}`));
+    });
+    req.end();
+  });
+}