@ticatec/omniflow-aliyun 1.0.0

package/src/generic/AliyunGenericPublisher.ts

@@ -0,0 +1,273 @@
+import { promises as fs } from 'fs'
+import path from 'path'
+import crypto from 'crypto'
+import { BasePublisher } from '@ticatec/omniflow-artifact'
+import type { ArtifactPayload, DownloadOptions, DownloadResult, PublishOptions, RegistryConfig } from '@ticatec/omniflow-artifact'
+import { safeFetch, extractErrorMessage, maskSecrets } from '../client/AliyunClient.js'
+
+/**
+ * Aliyun Generic Packages & Object Storage Archive Publisher.
+ *
+ * Supports publishing tar.gz/zip frontend builds or binary packages to Aliyun Packages.
+ *
+ * Endpoint format: https://packages.aliyun.com/generic/repository/<repoId>/
+ * Or direct custom console URL: https://packages.aliyun.com/<orgId>/generic/<repoId>/
+ */
+export class AliyunGenericPublisher extends BasePublisher {
+  readonly id = 'aliyun-generic'
+  readonly name = 'Aliyun Generic Archive'
+  readonly platform = 'aliyun-generic'
+  readonly artifactType = 'generic'
+  override readonly priority = 20
+
+  override detect(registry: RegistryConfig): boolean {
+    if (registry.type !== 'generic' && registry.type !== 'archive') {
+      return false
+    }
+
+    const regName = (registry.name || '').toLowerCase()
+    if (regName === 'aliyun' || regName.startsWith('aliyun-')) {
+      return true
+    }
+
+    const server = (registry.server || '').toLowerCase()
+    try {
+      const parsed = new URL(server.includes('://') ? server : `https://${server}`)
+      const host = parsed.hostname.toLowerCase()
+      const isAliyun =
+        host === 'aliyun.com' ||
+        host.endsWith('.aliyun.com') ||
+        host === 'aliyuncs.com' ||
+        host.endsWith('.aliyuncs.com')
+      return isAliyun
+    } catch {
+      return false
+    }
+  }
+
+  async login(registry: RegistryConfig, _options?: PublishOptions): Promise<void> {
+    const creds = this.resolveCredentials(registry)
+    if (!creds.token && !creds.username) {
+      this.log(`  ℹ No credentials configured for Aliyun Generic storage ${registry.server}`)
+    }
+  }
+
+  /**
+   * Resolve the base repository URL.
+   * If server already contains path segments (e.g. console URL), respect it directly (M6 fix).
+   * If bare host, requires a valid namespace/repoId (M4 fix).
+   */
+  protected resolveBaseRepoUrl(registry: RegistryConfig): string {
+    let serverUrl = registry.server.trim()
+    if (!/^https?:\/\//i.test(serverUrl)) {
+      serverUrl = `https://${serverUrl}`
+    }
+
+    const parsed = new URL(serverUrl)
+    const cleanServer = serverUrl.replace(/\/+$/, '')
+
+    // M6 Escape hatch: if server contains path segments beyond '/', use it as-is
+    if (parsed.pathname !== '/' && parsed.pathname !== '') {
+      return cleanServer
+    }
+
+    const reg = registry as RegistryConfig & { metadata?: Record<string, unknown> }
+    const repoId =
+      reg.namespace?.trim() ||
+      (reg.options?.repoId as string | undefined)?.trim() ||
+      (reg.metadata?.repoId as string | undefined)?.trim()
+    if (!repoId) {
+      throw new Error(
+        `Aliyun Generic publisher requires a valid repository ID (specify via registry.namespace or full server URL)`
+      )
+    }
+
+    return `${cleanServer}/generic/repository/${encodeURIComponent(repoId)}`
+  }
+
+  protected buildAuthHeaders(
+    username?: string,
+    token?: string,
+    secrets: string[] = []
+  ): Record<string, string> {
+    const headers: Record<string, string> = {}
+    if (username && token) {
+      const basic = Buffer.from(`${username}:${token}`).toString('base64')
+      if (basic.length >= 3) {
+        secrets.push(basic)
+      }
+      headers['Authorization'] = `Basic ${basic}`
+    } else if (token) {
+      if (token.includes(':')) {
+        const basic = Buffer.from(token).toString('base64')
+        if (basic.length >= 3) {
+          secrets.push(basic)
+        }
+        headers['Authorization'] = `Basic ${basic}`
+      } else {
+        headers['Authorization'] = `Bearer ${token}`
+      }
+    }
+    return headers
+  }
+
+  override buildTargetRef(artifact: ArtifactPayload, _registry: RegistryConfig): string {
+    const version = artifact.tags && artifact.tags.length > 0 ? artifact.tags[0] : 'latest'
+    const filename = artifact.source ? path.basename(artifact.source) : 'artifact'
+    return `${artifact.name}/${version}/${filename}`
+  }
+
+  override async exists(
+    artifact: ArtifactPayload,
+    registry: RegistryConfig,
+    options?: PublishOptions
+  ): Promise<boolean> {
+    const creds = this.resolveCredentials(registry)
+    const token = creds.token || creds.password
+    const username = creds.username
+    const secrets = [token, creds.password].filter(
+      (s): s is string => typeof s === 'string' && s.length >= 3
+    )
+
+    const version = artifact.tags && artifact.tags.length > 0 ? artifact.tags[0] : 'latest'
+    const packageName = artifact.name
+    const filename = artifact.source ? path.basename(artifact.source) : `${packageName}.tar.gz`
+
+    const baseRepoUrl = this.resolveBaseRepoUrl(registry)
+    const probeUrl = `${baseRepoUrl}/${encodeURIComponent(packageName)}/${encodeURIComponent(version)}/${encodeURIComponent(filename)}`
+
+    const headers = this.buildAuthHeaders(username, token, secrets)
+    const timeoutMs = options?.timeoutMs ?? 10000
+
+    try {
+      const res = await safeFetch(probeUrl, {
+        method: 'HEAD',
+        headers,
+        timeoutMs,
+        secrets
+      })
+
+      if (res.ok || res.status === 200 || res.status === 204) {
+        return true
+      }
+      if (res.status === 404) {
+        return false
+      }
+
+      const errText = await extractErrorMessage(res, secrets)
+      throw new Error(`Failed to check Generic artifact existence (${res.status}): ${errText}`)
+    } catch (err: any) {
+      if (err?.message?.includes('Failed to check Generic artifact existence')) {
+        throw err
+      }
+      throw new Error(`Failed to check Generic artifact existence: ${maskSecrets(err?.message || String(err), secrets)}`)
+    }
+  }
+
+  override async download(
+    artifact: ArtifactPayload,
+    registry: RegistryConfig,
+    dest: string,
+    options?: DownloadOptions
+  ): Promise<DownloadResult> {
+    const creds = this.resolveCredentials(registry)
+    const token = creds.token || creds.password
+    const secrets = [token, creds.password].filter(
+      (s): s is string => typeof s === 'string' && s.length >= 3
+    )
+
+    const version = artifact.tags?.[0] || 'latest'
+    const filename = artifact.source ? path.basename(artifact.source) : `${artifact.name}.tar.gz`
+    const baseRepoUrl = this.resolveBaseRepoUrl(registry)
+    const targetUrl = `${baseRepoUrl}/${encodeURIComponent(artifact.name)}/${encodeURIComponent(version)}/${encodeURIComponent(filename)}`
+    const masked = maskSecrets(targetUrl, secrets)
+
+    this.log(`  📥 Downloading ${artifact.name} ${version} from Aliyun: ${masked}`)
+    const res = await safeFetch(targetUrl, {
+      method: 'GET',
+      headers: this.buildAuthHeaders(creds.username, token, secrets),
+      timeoutMs: options?.timeoutMs ?? 30000,
+      secrets
+    })
+    if (!res.ok) {
+      throw await this.downloadError(res, `${artifact.name} ${version} (${filename})`, masked)
+    }
+    return this.saveResponse(res, dest, masked)
+  }
+
+  protected async doPublish(
+    artifact: ArtifactPayload,
+    registry: RegistryConfig,
+    options?: PublishOptions
+  ): Promise<{
+    ref: string
+    digest?: string
+    metadata?: Record<string, unknown>
+  }> {
+    const creds = this.resolveCredentials(registry)
+    const token = creds.token || creds.password
+    const username = creds.username
+    const secrets = [token, creds.password].filter(
+      (s): s is string => typeof s === 'string' && s.length >= 3
+    )
+
+    const version = artifact.tags && artifact.tags.length > 0 ? artifact.tags[0] : 'latest'
+    const packageName = artifact.name
+
+    let filePath = artifact.source
+    const stat = await fs.stat(filePath).catch(() => null)
+    if (!stat || !stat.isFile()) {
+      throw new Error(`Generic artifact source must be an existing file: ${filePath}`)
+    }
+
+    const filename = path.basename(filePath)
+    const fileBuffer = await fs.readFile(filePath)
+    const digest = `sha256:${crypto.createHash('sha256').update(fileBuffer).digest('hex')}`
+
+    const baseRepoUrl = this.resolveBaseRepoUrl(registry)
+    const targetUrl = `${baseRepoUrl}/${encodeURIComponent(packageName)}/${encodeURIComponent(version)}/${encodeURIComponent(filename)}`
+
+    this.log(`  📤 Uploading Generic package to Aliyun: ${targetUrl}`)
+
+    if (options?.dryRun) {
+      this.log(`  [dryRun] Would PUT ${filename} (${fileBuffer.length} bytes) to ${targetUrl}`)
+      return {
+        ref: `${packageName}/${version}/${filename}`,
+        digest,
+        metadata: { targetUrl, size: fileBuffer.length }
+      }
+    }
+
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/octet-stream',
+      ...this.buildAuthHeaders(username, token, secrets)
+    }
+
+    const timeoutMs = options?.timeoutMs ?? 30000
+
+    const res = await safeFetch(targetUrl, {
+      method: 'PUT',
+      headers,
+      body: fileBuffer,
+      timeoutMs,
+      secrets
+    })
+
+    if (!res.ok && res.status !== 201 && res.status !== 200) {
+      const errText = await extractErrorMessage(res, secrets)
+      throw new Error(`Failed to upload Generic package to Aliyun (${res.status}): ${errText}`)
+    }
+
+    return {
+      ref: `${packageName}/${version}/${filename}`,
+      digest,
+      metadata: {
+        packageName,
+        version,
+        filename,
+        targetUrl,
+        size: fileBuffer.length
+      }
+    }
+  }
+}

package/src/index.ts

@@ -0,0 +1,56 @@
+import type { PluginContext } from '@ticatec/omniflow-core'
+import type { ArtifactPublisherRegistry } from '@ticatec/omniflow-artifact'
+import { AliyunAcrPublisher } from './docker/AliyunAcrPublisher.js'
+import { AliyunNpmPublisher } from './npm/AliyunNpmPublisher.js'
+import { AliyunMavenPublisher } from './maven/AliyunMavenPublisher.js'
+import { AliyunGenericPublisher } from './generic/AliyunGenericPublisher.js'
+
+export * from './docker/AliyunAcrPublisher.js'
+export * from './npm/AliyunNpmPublisher.js'
+export * from './maven/AliyunMavenPublisher.js'
+export * from './generic/AliyunGenericPublisher.js'
+export * from './client/AliyunClient.js'
+
+export interface RegisterAliyunOptions {
+  artifactRegistry?: ArtifactPublisherRegistry
+}
+
+/**
+ * Standard OmniFlow Plugin SPI entry point.
+ */
+export function register(ctx: PluginContext, options: Record<string, unknown> = {}): void {
+  const artifactsEnabled = options.artifacts !== false
+  registerAliyun({ artifactRegistry: artifactsEnabled ? ctx.artifactRegistry : undefined })
+}
+
+export default register
+
+/**
+ * Register all official Aliyun artifact publishers (ACR, NPM, Maven, Generic) into the target registry.
+ */
+export function registerAliyun(options: RegisterAliyunOptions = {}): {
+  acrPublisher: AliyunAcrPublisher
+  npmPublisher: AliyunNpmPublisher
+  mavenPublisher: AliyunMavenPublisher
+  genericPublisher: AliyunGenericPublisher
+} {
+  const acrPublisher = new AliyunAcrPublisher()
+  const npmPublisher = new AliyunNpmPublisher()
+  const mavenPublisher = new AliyunMavenPublisher()
+  const genericPublisher = new AliyunGenericPublisher()
+
+  if (options.artifactRegistry) {
+    options.artifactRegistry.register(acrPublisher)
+    options.artifactRegistry.register(npmPublisher)
+    options.artifactRegistry.register(mavenPublisher)
+    options.artifactRegistry.register(genericPublisher)
+  }
+
+  return {
+    acrPublisher,
+    npmPublisher,
+    mavenPublisher,
+    genericPublisher
+  }
+}
+

package/src/maven/AliyunMavenPublisher.ts

@@ -0,0 +1,330 @@
+import { promises as fs } from 'fs'
+import path from 'path'
+import crypto from 'crypto'
+import { BasePublisher, resolveMavenArtifactFilenames, mavenPomPathFor, isMavenArtifactFile } from '@ticatec/omniflow-artifact'
+import type { ArtifactPayload, PublishOptions, RegistryConfig } from '@ticatec/omniflow-artifact'
+import { safeFetch, extractErrorMessage, maskSecrets } from '../client/AliyunClient.js'
+
+/**
+ * Aliyun Apsara DevOps (云效) Maven Package Registry Publisher.
+ *
+ * Endpoint format: https://packages.aliyun.com/maven/repository/<repoId>/
+ * Or direct custom console URL: https://packages.aliyun.com/<orgId>/maven/<repoId>/
+ */
+export class AliyunMavenPublisher extends BasePublisher {
+  readonly id = 'aliyun-maven'
+  readonly name = 'Aliyun Packages Maven'
+  readonly platform = 'aliyun-maven'
+  readonly artifactType = 'maven'
+  override readonly priority = 20
+
+  override detect(registry: RegistryConfig): boolean {
+    if (registry.type !== 'maven' && registry.type !== 'jar') {
+      return false
+    }
+
+    const regName = (registry.name || '').toLowerCase()
+    if (regName === 'aliyun' || regName.startsWith('aliyun-')) {
+      return true
+    }
+
+    const server = (registry.server || '').toLowerCase()
+    try {
+      const parsed = new URL(server.includes('://') ? server : `https://${server}`)
+      const host = parsed.hostname.toLowerCase()
+      const segments = host.split('.')
+      const isAliyun = host === 'aliyun.com' || host.endsWith('.aliyun.com')
+      const isPackages = segments.includes('packages') || host === 'packages.aliyun.com'
+      return isAliyun && isPackages
+    } catch {
+      return false
+    }
+  }
+
+  async login(registry: RegistryConfig, _options?: PublishOptions): Promise<void> {
+    const creds = this.resolveCredentials(registry)
+    if (!creds.token && !creds.username) {
+      this.log(`  ℹ No credentials configured for Aliyun Maven repository ${registry.server}`)
+    } else if (creds.token && !creds.username && !creds.token.includes(':')) {
+      this.warn(`  ⚠ Aliyun Maven repository typically requires username + password/token for Basic authentication`)
+    }
+  }
+
+  /**
+   * Resolve Maven coordinates (groupId, artifactId, version) from artifact.
+   * Throws an error if groupId is missing rather than guessing 'com.aliyun' (M4 fix).
+   */
+  protected resolveCoordinates(artifact: ArtifactPayload): {
+    groupId: string
+    artifactId: string
+    version: string
+  } {
+    let groupId = (artifact.metadata?.groupId as string | undefined)?.trim()
+    let artifactId = (artifact.metadata?.artifactId as string | undefined)?.trim()
+
+    if (!groupId && artifact.name.includes(':')) {
+      const parts = artifact.name.split(':')
+      groupId = parts[0].trim()
+      artifactId = artifactId || parts[1].trim()
+    }
+
+    if (!groupId) {
+      throw new Error(
+        `Aliyun Maven publisher requires a valid 'groupId' (specify via artifact.metadata.groupId or 'groupId:artifactId' name)`
+      )
+    }
+
+    if (!artifactId) {
+      artifactId = artifact.name.trim()
+    }
+
+    const version =
+      artifact.tags && artifact.tags.length > 0 ? artifact.tags[0] : (artifact.metadata?.version as string) || '1.0.0'
+
+    return { groupId, artifactId, version }
+  }
+
+  /**
+   * Resolve the base repository URL.
+   * If server already contains path segments (e.g. console URL), respect it directly (M6 fix).
+   * If bare host, requires a valid namespace/repoId (M4 fix).
+   */
+  protected resolveBaseRepoUrl(registry: RegistryConfig): string {
+    let serverUrl = registry.server.trim()
+    if (!/^https?:\/\//i.test(serverUrl)) {
+      serverUrl = `https://${serverUrl}`
+    }
+
+    const parsed = new URL(serverUrl)
+    const cleanServer = serverUrl.replace(/\/+$/, '')
+
+    // M6 Escape hatch: if server contains path segments beyond '/', use it as-is
+    if (parsed.pathname !== '/' && parsed.pathname !== '') {
+      return cleanServer
+    }
+
+    const reg = registry as RegistryConfig & { metadata?: Record<string, unknown> }
+    const repoId =
+      reg.namespace?.trim() ||
+      (reg.options?.repoId as string | undefined)?.trim() ||
+      (reg.metadata?.repoId as string | undefined)?.trim()
+    if (!repoId) {
+      throw new Error(
+        `Aliyun Maven publisher requires a valid repository ID (specify via registry.namespace or full server URL)`
+      )
+    }
+
+    return `${cleanServer}/maven/repository/${encodeURIComponent(repoId)}`
+  }
+
+  protected buildAuthHeaders(
+    username?: string,
+    token?: string,
+    secrets: string[] = []
+  ): Record<string, string> {
+    const headers: Record<string, string> = {}
+    if (username && token) {
+      const basic = Buffer.from(`${username}:${token}`).toString('base64')
+      if (basic.length >= 3) {
+        secrets.push(basic)
+      }
+      headers['Authorization'] = `Basic ${basic}`
+    } else if (token) {
+      if (token.includes(':')) {
+        const basic = Buffer.from(token).toString('base64')
+        if (basic.length >= 3) {
+          secrets.push(basic)
+        }
+        headers['Authorization'] = `Basic ${basic}`
+      } else {
+        headers['Authorization'] = `Bearer ${token}`
+      }
+    }
+    return headers
+  }
+
+  override buildTargetRef(artifact: ArtifactPayload, _registry: RegistryConfig): string {
+    try {
+      const { groupId, artifactId, version } = this.resolveCoordinates(artifact)
+      return `${groupId}:${artifactId}:${version}`
+    } catch {
+      const version = artifact.tags && artifact.tags.length > 0 ? artifact.tags[0] : '1.0.0'
+      return `${artifact.name}:${version}`
+    }
+  }
+
+  override async exists(
+    artifact: ArtifactPayload,
+    registry: RegistryConfig,
+    options?: PublishOptions
+  ): Promise<boolean> {
+    const creds = this.resolveCredentials(registry)
+    const token = creds.token || creds.password
+    const username = creds.username
+    const secrets = [token, creds.password].filter(
+      (s): s is string => typeof s === 'string' && s.length >= 3
+    )
+
+    let jarPath = artifact.source
+    if (jarPath) {
+      const stat = await fs.stat(jarPath).catch(() => null)
+      if (stat?.isDirectory()) {
+        const files = await fs.readdir(jarPath).catch(() => [] as string[])
+        const jarFile = files.find(
+          f => isMavenArtifactFile(f)
+        )
+        if (jarFile) {
+          jarPath = path.join(jarPath, jarFile)
+        }
+      }
+    }
+
+    const { groupId, artifactId, version, groupPath, jarFilename } = resolveMavenArtifactFilenames(artifact, jarPath, undefined, 'Aliyun')
+
+    const baseRepoUrl = this.resolveBaseRepoUrl(registry)
+    const probeUrl = `${baseRepoUrl}/${groupPath}/${artifactId}/${version}/${jarFilename}`
+
+    const headers = this.buildAuthHeaders(username, token, secrets)
+    const timeoutMs = options?.timeoutMs ?? 10000
+
+    try {
+      const res = await safeFetch(probeUrl, {
+        method: 'HEAD',
+        headers,
+        timeoutMs,
+        secrets
+      })
+
+      if (res.ok || res.status === 200 || res.status === 204) {
+        return true
+      }
+      if (res.status === 404) {
+        return false
+      }
+
+      // Fail-close on authorization or server errors
+      const errText = await extractErrorMessage(res, secrets)
+      throw new Error(`Failed to check Maven artifact existence (${res.status}): ${errText}`)
+    } catch (err: any) {
+      if (err?.message?.includes('Failed to check Maven artifact existence')) {
+        throw err
+      }
+      throw new Error(`Failed to check Maven artifact existence: ${maskSecrets(err?.message || String(err), secrets)}`)
+    }
+  }
+
+  protected async doPublish(
+    artifact: ArtifactPayload,
+    registry: RegistryConfig,
+    options?: PublishOptions
+  ): Promise<{
+    ref: string
+    digest?: string
+    metadata?: Record<string, unknown>
+  }> {
+    const creds = this.resolveCredentials(registry)
+    const token = creds.token || creds.password
+    const username = creds.username
+    const secrets = [token, creds.password].filter(
+      (s): s is string => typeof s === 'string' && s.length >= 3
+    )
+
+    // Locate jar file
+    let jarPath = artifact.source
+    const stat = await fs.stat(jarPath).catch(() => null)
+    if (stat?.isDirectory()) {
+      const files = await fs.readdir(jarPath)
+      const jarFile = files.find(
+        f => isMavenArtifactFile(f)
+      )
+      if (!jarFile) {
+        throw new Error(`No jar/war artifact found in directory: ${jarPath}`)
+      }
+      jarPath = path.join(jarPath, jarFile)
+    }
+
+    const { groupId, artifactId, version, groupPath, jarFilename, pomFilename } = resolveMavenArtifactFilenames(artifact, jarPath, undefined, 'Aliyun')
+
+    const jarBuffer = await fs.readFile(jarPath)
+    const digest = `sha256:${crypto.createHash('sha256').update(jarBuffer).digest('hex')}`
+
+    const baseRepoUrl = this.resolveBaseRepoUrl(registry)
+    const targetUrl = `${baseRepoUrl}/${groupPath}/${artifactId}/${version}/${jarFilename}`
+
+    this.log(`  📤 Uploading Maven JAR to Aliyun Packages: ${targetUrl}`)
+
+    if (options?.dryRun) {
+      this.log(`  [dryRun] Would PUT ${jarFilename} (${jarBuffer.length} bytes) to ${targetUrl}`)
+      return {
+        ref: `${groupId}:${artifactId}:${version}`,
+        digest,
+        metadata: { targetUrl, size: jarBuffer.length }
+      }
+    }
+
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/java-archive',
+      ...this.buildAuthHeaders(username, token, secrets)
+    }
+
+    const timeoutMs = options?.timeoutMs ?? 30000
+
+    // The POM goes up first, deliberately.
+    //
+    // The existence probe checks for the jar/war, so uploading that last is what
+    // makes the probe mean "this artifact is complete". With the artifact first, a
+    // run that uploaded it and then failed on the POM would leave a coordinate that
+    // probes as present: the retry skips it as already published, and the POM never
+    // arrives — a jar in the repository forever, with no dependency information.
+    // Check if matching .pom exists and upload it as well (M2 verification)
+    const pomPath = mavenPomPathFor(jarPath)
+    const pomStat = await fs.stat(pomPath).catch(() => null)
+    if (pomStat?.isFile()) {
+      const pomBuffer = await fs.readFile(pomPath)
+      const pomFilename = `${artifactId}-${version}.pom`
+      const pomTargetUrl = `${baseRepoUrl}/${groupPath}/${artifactId}/${version}/${pomFilename}`
+      this.log(`  📤 Uploading Maven POM to Aliyun Packages: ${pomTargetUrl}`)
+
+      const pomRes = await safeFetch(pomTargetUrl, {
+        method: 'PUT',
+        headers: {
+          ...headers,
+          'Content-Type': 'application/xml'
+        },
+        body: pomBuffer,
+        timeoutMs,
+        secrets
+      })
+
+      if (!pomRes.ok && pomRes.status !== 201 && pomRes.status !== 200) {
+        const errText = await extractErrorMessage(pomRes, secrets)
+        throw new Error(`Failed to upload Maven POM to Aliyun Packages (${pomRes.status}): ${errText}`)
+      }
+    }
+
+    const res = await safeFetch(targetUrl, {
+      method: 'PUT',
+      headers,
+      body: jarBuffer,
+      timeoutMs,
+      secrets
+    })
+
+    if (!res.ok && res.status !== 201 && res.status !== 200) {
+      const errText = await extractErrorMessage(res, secrets)
+      throw new Error(`Failed to upload Maven JAR to Aliyun Packages (${res.status}): ${errText}`)
+    }
+
+    return {
+      ref: `${groupId}:${artifactId}:${version}`,
+      digest,
+      metadata: {
+        groupId,
+        artifactId,
+        version,
+        targetUrl,
+        size: jarBuffer.length
+      }
+    }
+  }
+}