@tomasko/mb 0.1.1 → 0.1.3

package/README.md

@@ -12,10 +12,14 @@ mb tool install bobzhang/zip
 
 ## How it works
 
-The package itself contains only a small launcher. On install,
-`install.js` downloads the prebuilt `mb` binary for the current platform from
-GitHub Releases and writes it to `bin/mb`. The published `bin` entry
-(`bin/mb.js`) then spawns it, forwarding arguments and standard IO.
+The package itself contains only a small launcher. On install, `install.js`
+downloads the prebuilt `mb` binary for the current platform from GitHub
+Releases and writes it to `bin/mb`. The published `bin` entry (`bin/mb.js`)
+then spawns it, forwarding arguments, standard IO and the exit code.
+
+The postinstall download is best-effort, and the launcher downloads the
+binary on first run if it is missing (for example when installing with
+`--ignore-scripts`, or when the release was not available yet).
 
 Supported targets:
 
@@ -31,6 +35,34 @@ ships a `darwin-x86_64` target, so no such build can be produced.
 Assets are produced by `.github/workflows/release.yml` when a `v*` tag is
 pushed.
 
+## Install scripts are blocked by default
+
+Recent npm (12+) and pnpm (10+) versions do **not** run a dependency's install
+scripts unless the package is approved, so `postinstall` is skipped and
+`bin/mb` is missing right after install:
+
+```
+npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
+npm warn install-scripts   @tomasko/mb@0.1.3 (postinstall: node install.js)
+mb: native binary not found at .../node_modules/@tomasko/mb/bin/mb
+```
+
+Nothing is broken: `bin/mb.js` downloads the binary on first run. To have it
+downloaded at install time instead, approve the build once:
+
+```bash
+npm install-scripts approve @tomasko/mb   # npm 12+ (writes `allowScripts`)
+pnpm approve-builds                       # pnpm 10+
+```
+
+Either way, re-run the download manually with:
+
+```bash
+npm rebuild @tomasko/mb
+# or
+pnpm rebuild @tomasko/mb
+```
+
 ## Overrides
 
 | Variable             | Purpose                                          |
@@ -47,7 +79,10 @@ From this directory:
 
 ```bash
 npm publish --access public
+# or
+pnpm publish --access public
 ```
 
+`--access public` is required for scoped packages such as `@tomasko/mb`.
 Change `name`, `repository` and `homepage` in `package.json` first if you
 publish under a different scope or repository.

package/bin/mb.js

@@ -1,27 +1,35 @@
 #!/usr/bin/env node
-// Thin launcher for the downloaded native `mb` binary.
+// Launcher for the native `mb` binary. Downloads it on first run if the
+// postinstall step did not (e.g. `--ignore-scripts`), then forwards all
+// arguments, stdio and the exit code.
 "use strict";
 
 const { spawnSync } = require("child_process");
-const fs = require("fs");
-const path = require("path");
+const { ensureBinary, pkg } = require("../lib");
 
-const ext = process.platform === "win32" ? ".exe" : "";
-const binary = path.join(__dirname, "mb" + ext);
+async function main() {
+  let binary;
+  try {
+    binary = await ensureBinary({
+      log: (line) => process.stderr.write(line + "\n"),
+    });
+  } catch (err) {
+    console.error(`mb: ${err.message}`);
+    console.error(
+      `mb: run \`npm rebuild ${pkg.name}\` to retry, or set MB_DOWNLOAD_BASE ` +
+        `(or MB_REPO/MB_VERSION) to a mirror.`
+    );
+    process.exit(1);
+  }
 
-if (!fs.existsSync(binary)) {
-  console.error(
-    `mb: native binary not found at ${binary}\n` +
-      "mb: reinstall it with `npm rebuild mb` (or `npm install -g mb --force`)."
-  );
-  process.exit(1);
-}
+  const result = spawnSync(binary, process.argv.slice(2), { stdio: "inherit" });
 
-const result = spawnSync(binary, process.argv.slice(2), { stdio: "inherit" });
+  if (result.error) {
+    console.error(`mb: failed to launch ${binary}: ${result.error.message}`);
+    process.exit(1);
+  }
 
-if (result.error) {
-  console.error(`mb: failed to launch ${binary}: ${result.error.message}`);
-  process.exit(1);
+  process.exit(typeof result.status === "number" ? result.status : 1);
 }
 
-process.exit(typeof result.status === "number" ? result.status : 1);
+main();

package/install.js

@@ -1,117 +1,25 @@
 #!/usr/bin/env node
-// Downloads the prebuilt `mb` binary for the current platform from GitHub
-// Releases and drops it next to this package's launcher (`bin/mb.js`).
+// Postinstall hook: download the prebuilt `mb` binary for this platform.
 //
-// Overridable for forks / private mirrors:
-//   MB_REPO            owner/repo            (default: parsed from package.json)
-//   MB_VERSION         release version       (default: package.json version)
-//   MB_DOWNLOAD_BASE   full base URL         (overrides MB_REPO/MB_VERSION)
-//   MB_SKIP_DOWNLOAD   set to skip fetching
+// This is best-effort: if the download fails the install still succeeds, and
+// `bin/mb.js` retries on first run. Set MB_SKIP_DOWNLOAD=1 to opt out.
 "use strict";
 
-const fs = require("fs");
-const path = require("path");
-const https = require("https");
-const http = require("http");
+const { ensureBinary, pkg } = require("./lib");
 
-const pkg = require("./package.json");
-
-const TARGETS = {
-  "linux-x64": "linux-x86_64",
-  "linux-arm64": "linux-aarch64",
-  "darwin-arm64": "darwin-aarch64",
-};
-
-function repoSlug(repo) {
-  if (!repo) return null;
-  const url = typeof repo === "string" ? repo : repo.url || "";
-  const m = url.match(/github\.com[/:]([^/]+)\/([^/.]+)/);
-  return m ? `${m[1]}/${m[2]}` : null;
-}
-
-function target() {
-  return TARGETS[`${process.platform}-${process.arch}`];
-}
-
-function downloadUrl(targetName) {
-  if (process.env.MB_DOWNLOAD_BASE) {
-    return `${process.env.MB_DOWNLOAD_BASE.replace(/\/$/, "")}/mb-${targetName}`;
-  }
-  const repo = process.env.MB_REPO || repoSlug(pkg.repository) || "tomasky/mb";
-  const version = process.env.MB_VERSION || pkg.version;
-  return `https://github.com/${repo}/releases/download/v${version}/mb-${targetName}`;
-}
-
-function fetch(url, redirects) {
-  return new Promise((resolve, reject) => {
-    if (redirects > 10) return reject(new Error("too many redirects"));
-    const client = url.startsWith("http:") ? http : https;
-    const req = client.get(
-      url,
-      { headers: { "user-agent": `mb-npm/${pkg.version}` } },
-      (res) => {
-        const { statusCode, headers } = res;
-        if (statusCode >= 300 && statusCode < 400 && headers.location) {
-          res.resume();
-          const next = new URL(headers.location, url).toString();
-          resolve(fetch(next, (redirects || 0) + 1));
-          return;
-        }
-        if (statusCode !== 200) {
-          res.resume();
-          reject(new Error(`GET ${url} -> HTTP ${statusCode}`));
-          return;
-        }
-        resolve(res);
-      }
-    );
-    req.on("error", reject);
-  });
+if (process.env.MB_SKIP_DOWNLOAD) {
+  console.log("mb: MB_SKIP_DOWNLOAD set, skipping binary download");
+  process.exit(0);
 }
 
-async function main() {
-  if (process.env.MB_SKIP_DOWNLOAD) {
-    console.log("mb: MB_SKIP_DOWNLOAD set, skipping binary download");
-    return;
-  }
-
-  const targetName = target();
-  if (!targetName) {
-    throw new Error(
-      `unsupported platform ${process.platform}-${process.arch}; mb ` +
-        `supports linux-x64, linux-arm64 and darwin-arm64 (the MoonBit ` +
-        `toolchain no longer ships a darwin-x64 target)`
+ensureBinary({ log: console.log })
+  .then(() => process.exit(0))
+  .catch((err) => {
+    console.warn(`mb: could not download the native binary: ${err.message}`);
+    console.warn(
+      `mb: it will be downloaded on first run instead. If that also fails, ` +
+        `set MB_DOWNLOAD_BASE (or MB_REPO/MB_VERSION) to a mirror and run ` +
+        `\`npm rebuild ${pkg.name}\`.`
     );
-  }
-
-  const ext = process.platform === "win32" ? ".exe" : "";
-  const dest = path.join(__dirname, "bin", "mb" + ext);
-  fs.mkdirSync(path.dirname(dest), { recursive: true });
-
-  if (fs.existsSync(dest) && !process.env.MB_FORCE_DOWNLOAD) {
-    console.log(`mb: ${dest} already present, skipping download`);
-    return;
-  }
-
-  const url = downloadUrl(targetName);
-  console.log(`mb: downloading ${url}`);
-  const res = await fetch(url, 0);
-  await new Promise((resolve, reject) => {
-    const out = fs.createWriteStream(dest);
-    res.pipe(out);
-    out.on("finish", () => out.close(resolve));
-    out.on("error", reject);
-    res.on("error", reject);
+    process.exit(0);
   });
-  fs.chmodSync(dest, 0o755);
-  console.log(`mb: installed ${dest}`);
-}
-
-main().catch((err) => {
-  console.error(`mb: failed to install the native binary: ${err.message}`);
-  console.error(
-    "mb: set MB_DOWNLOAD_BASE (or MB_REPO/MB_VERSION) to point at a mirror, " +
-      "or set MB_SKIP_DOWNLOAD=1 to skip."
-  );
-  process.exit(1);
-});

package/lib.js

@@ -0,0 +1,143 @@
+"use strict";
+
+// Shared install logic for the npm wrapper: works out which prebuilt `mb`
+// binary to use and downloads it from GitHub Releases on demand.
+//
+// Overridable for forks / private mirrors:
+//   MB_REPO            owner/repo            (default: parsed from package.json)
+//   MB_VERSION         release version       (default: package.json version)
+//   MB_DOWNLOAD_BASE   full base URL         (overrides MB_REPO/MB_VERSION)
+//   MB_FORCE_DOWNLOAD  re-download even if the binary is present
+//   MB_SKIP_DOWNLOAD   never download
+
+const fs = require("fs");
+const path = require("path");
+const https = require("https");
+const http = require("http");
+
+const pkg = require("./package.json");
+
+// Node `platform-arch` -> MoonBit release target. Intel macOS is absent on
+// purpose: the MoonBit toolchain no longer ships a darwin-x86_64 target.
+const TARGETS = {
+  "linux-x64": "linux-x86_64",
+  "linux-arm64": "linux-aarch64",
+  "darwin-arm64": "darwin-aarch64",
+};
+
+function repoSlug(repo) {
+  if (!repo) return null;
+  const url = typeof repo === "string" ? repo : repo.url || "";
+  const m = url.match(/github\.com[/:]([^/]+)\/([^/.]+)/);
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+
+function targetName() {
+  return TARGETS[`${process.platform}-${process.arch}`];
+}
+
+function downloadUrl(target) {
+  if (process.env.MB_DOWNLOAD_BASE) {
+    return `${process.env.MB_DOWNLOAD_BASE.replace(/\/$/, "")}/mb-${target}`;
+  }
+  const repo = process.env.MB_REPO || repoSlug(pkg.repository) || "tomasky/mb";
+  const version = process.env.MB_VERSION || pkg.version;
+  return `https://github.com/${repo}/releases/download/v${version}/mb-${target}`;
+}
+
+function binaryPath() {
+  return path.join(
+    __dirname,
+    "bin",
+    process.platform === "win32" ? "mb.exe" : "mb"
+  );
+}
+
+function isInstalled() {
+  try {
+    fs.accessSync(binaryPath(), fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function fetch(url, redirects) {
+  return new Promise((resolve, reject) => {
+    if (redirects > 10) return reject(new Error("too many redirects"));
+    const client = url.startsWith("http:") ? http : https;
+    const req = client.get(
+      url,
+      { headers: { "user-agent": `mb-npm/${pkg.version}` } },
+      (res) => {
+        const { statusCode, headers } = res;
+        if (statusCode >= 300 && statusCode < 400 && headers.location) {
+          res.resume();
+          const next = new URL(headers.location, url).toString();
+          resolve(fetch(next, (redirects || 0) + 1));
+          return;
+        }
+        if (statusCode !== 200) {
+          res.resume();
+          reject(new Error(`GET ${url} -> HTTP ${statusCode}`));
+          return;
+        }
+        resolve(res);
+      }
+    );
+    req.on("error", reject);
+  });
+}
+
+async function download(target, dest) {
+  const url = downloadUrl(target);
+  const res = await fetch(url, 0);
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  await new Promise((resolve, reject) => {
+    const out = fs.createWriteStream(dest);
+    res.pipe(out);
+    out.on("finish", () => out.close(resolve));
+    out.on("error", reject);
+    res.on("error", reject);
+  });
+  fs.chmodSync(dest, 0o755);
+  return url;
+}
+
+// Resolves to a ready-to-run binary path, downloading it when missing.
+async function ensureBinary({ force = false, log = () => {} } = {}) {
+  const dest = binaryPath();
+
+  if (!force && !process.env.MB_FORCE_DOWNLOAD && isInstalled()) {
+    return dest;
+  }
+
+  if (process.env.MB_SKIP_DOWNLOAD) {
+    if (isInstalled()) return dest;
+    throw new Error("MB_SKIP_DOWNLOAD is set but no binary is installed");
+  }
+
+  const target = targetName();
+  if (!target) {
+    throw new Error(
+      `unsupported platform ${process.platform}-${process.arch}; mb ` +
+        `supports linux-x64, linux-arm64 and darwin-arm64 (the MoonBit ` +
+        `toolchain no longer ships a darwin-x64 target)`
+    );
+  }
+
+  log(`mb: downloading ${downloadUrl(target)}`);
+  await download(target, dest);
+  log(`mb: installed ${dest}`);
+  return dest;
+}
+
+module.exports = {
+  pkg,
+  TARGETS,
+  targetName,
+  downloadUrl,
+  binaryPath,
+  isInstalled,
+  ensureBinary,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomasko/mb",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "A MoonBit-native, uv-style toolchain and package manager: manage MoonBit toolchains and install tools from mooncakes.io.",
   "license": "Apache-2.0",
   "bin": {
@@ -12,6 +12,7 @@
   "files": [
     "bin/mb.js",
     "install.js",
+    "lib.js",
     "README.md"
   ],
   "engines": {