@twinsearth/dsh-2xray 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.2.10 — 2026-10-29
+
+### 更新
+
+- 设置页新增「检测更新 / 立即更新 / 自动更新」。
+- 检测：读取 npm registry 的 `latest` 并做 semver 比较。
+- 立即更新：下载 tarball、校验 sha512（或 sha1）、解压并以 rename + 回滚方式替换插件目录；返回「重启 DSH 生效」。
+- 自动更新：`updates.auto` 开启后，启动 5 秒检查并安装；默认关闭，不自动重启应用。
+- 新增鉴权接口 `GET/POST /api/xray/update`，状态同时出现在 `xray_status.update`。
+
+## 0.2.9 — 2026-10-29
+
+### 内核分发
+
+- 新增按平台拆分的可选内核包（`@twinsearth/dsh-2xray-core-<os>-<arch>`），主包通过 `optionalDependencies` 引用，npm 只装当前平台。
+- `resolveBinary()` 新增 `core-package` 来源；未安装时继续回退到插件 `bin/`、数据目录、v2rayN 发现与 PATH。
+- 新增 `tools/build-core-packages.mjs`（官方 zip → npm 包）与 `.github/workflows/core-packages.yml`（下载、`.dgst` 校验、发布；无 `NPM_TOKEN` 时只上传 artifact）。
+
+### 验证
+
+- 真机 xray 26.9.30 对 global / cn-direct / whitelist 三种配置执行 `run -test` 全部通过（含 geodata 与 IPIfNonMatch）。
+
 ## 0.2.8 — 2026-10-29
 
 ### 修复

package/README.md

@@ -328,6 +328,22 @@ v0.2.0 提供两个入口，互不替代：
 | 状态一直 `degraded` + `route-install-failed` | 查日志里的模块解析诊断；必要时确认 DSH 安装目录结构 |
 | `xray_switch_node` 报 `unknown service ... RoutingService` | xray 版本早于 2024-09；升级二进制，或关闭 `control.enabled` 只用 `activeNode` |
 
+### 平台内核包
+
+`@twinsearth/dsh-2xray` 通过 `optionalDependencies` 引用按平台拆分的核心包（例如 `@twinsearth/dsh-2xray-core-win32-x64`），npm 只安装当前平台那一个。本地没有可用内核包时，仍按 `插件 bin/ → 数据目录 → v2rayN 发现 → PATH` 回退，或用 `tools/install-xray-core.mjs` 安装。
+
+维护者用 `tools/build-core-packages.mjs` 从官方 zip 生成平台包；`.github/workflows/core-packages.yml` 会在具备 `NPM_TOKEN` secret 时自动下载、校验并发布各平台包。
+
+## 更新
+
+设置页 2Xray 里有三个入口：
+
+- **检测更新**：查询 npm 上的 `latest`，显示当前/最新版本。
+- **立即更新**：下载并校验 npm tarball（sha512），原子替换插件目录；**重启 DSH 后生效**。
+- **自动更新**：启动 5 秒后检查并安装新版本（默认关闭；同样需要重启）。
+
+Host API：`GET/POST /api/xray/update`（走 `ctx.connection.fetch` 鉴权围栏）。
+
 ## 路由模式与黑白名单
 
 - `global`（默认）：全部流量走 2Xray。

package/index.js

@@ -8,6 +8,7 @@ import { ControlClient } from './lib/control/client.js'
 import { installTools } from './lib/tools.js'
 import { LogBuffer } from './lib/logbuf.js'
 import { Monitor } from './lib/monitor.js'
+import { checkForUpdate, installUpdate, ownVersion } from './lib/update.js'
 
 export const name = 'dsh-2xray'
 
@@ -120,6 +121,29 @@ export function apply(ctx, rawConfig) {
     logger,
   })
 
+  const updateState = {
+    current: ownVersion(),
+    latest: null,
+    available: false,
+    checkedAt: null,
+    auto: config.updates?.auto === true,
+    restartRequired: false,
+    error: null,
+  }
+  let updateFlight = null
+  const checkUpdate = async () => {
+    if (updateFlight) return updateFlight
+    updateFlight = checkForUpdate({ current: updateState.current })
+      .then((info) => {
+        Object.assign(updateState, info, { auto: config.updates?.auto === true, error: info.error ?? null })
+        return info
+      })
+      .finally(() => {
+        updateFlight = null
+      })
+    return updateFlight
+  }
+
   // Authenticated status/log feed for the browser panel. Optional service: a
   // profile without `connection` keeps the proxy and the tools, it only loses
   // the live panel data.
@@ -147,6 +171,7 @@ export function apply(ctx, rawConfig) {
                     proxied,
                     vpnName: node?.id ?? snapshot.activeNode ?? null,
                     probe: monitor.snapshot(),
+                    update: updateState,
                   },
                   logs: page.items,
                   cursor: page.cursor,
@@ -176,12 +201,60 @@ export function apply(ctx, rawConfig) {
             }),
           'dsh-2xray: switch api',
         )
+        child.effect(
+          () =>
+            child.connection.fetch.register({
+              path: '/api/xray/update',
+              methods: ['GET', 'POST'],
+              requestBody: 'buffered',
+              fetch: async (request) => {
+                try {
+                  if (request.method === 'GET') {
+                    const url = new URL(request.url)
+                    const stale = !updateState.checkedAt || Date.now() - updateState.checkedAt > 600_000
+                    if (stale || url.searchParams.get('refresh') === '1') await checkUpdate()
+                    return Response.json({ ok: true, update: updateState })
+                  }
+                  const body = await request.json().catch(() => ({}))
+                  if (body.action === 'install') {
+                    const info = updateState.available ? updateState : await checkUpdate()
+                    if (!info.available) return Response.json({ ok: false, error: '已是最新版本', update: updateState }, { status: 409 })
+                    const result = await installUpdate(info, { logger })
+                    updateState.restartRequired = result.ok === true
+                    updateState.latest = info.latest
+                    return Response.json({ ok: result.ok, update: updateState, result })
+                  }
+                  await checkUpdate()
+                  return Response.json({ ok: true, update: updateState })
+                } catch (error) {
+                  return Response.json({ ok: false, error: String(error?.message ?? error) }, { status: 400 })
+                }
+              },
+            }),
+          'dsh-2xray: update api',
+        )
       } catch (error) {
         logger.warn(`状态 API 注册失败：${String(error)}`)
       }
     })
   }
 
+  // Opt-in auto-update: check once per start and install a newer tarball.
+  // Loading the new code still requires a DSH restart, so this never restarts
+  // the app behind the user's back.
+  if (config.updates?.auto) {
+    const timer = setTimeout(() => {
+      ;(async () => {
+        const info = await checkUpdate()
+        if (!info.available) return
+        const result = await installUpdate(info, { logger })
+        updateState.restartRequired = result.ok === true
+        if (result.ok) logger.info(`自动更新完成：${info.latest}；重启 DSH 后生效`)
+      })().catch((error) => logger.warn(`自动更新检查失败：${String(error)}`))
+    }, 5000)
+    timer.unref?.()
+  }
+
   const dispose = ctx.effect(
     () => async () => {
       await supervisor.stop()

package/lib/binary.js

@@ -1,5 +1,6 @@
 import { accessSync, constants, existsSync, readdirSync } from 'node:fs'
-import { delimiter, join } from 'node:path'
+import { createRequire } from 'node:module'
+import { delimiter, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 /** Package root, so a bundle that ships its own `bin/xray(.exe)` is found first. */
@@ -29,6 +30,23 @@ function executableName() {
   return process.platform === 'win32' ? 'xray.exe' : 'xray'
 }
 
+/**
+ * Platform cores are published as separate optional packages so the main
+ * package stays small. npm installs only the matching os/cpu one.
+ */
+export function optionalCorePaths({ platform = process.platform, arch = process.arch, resolvePackage } = {}) {
+  const name = `@twinsearth/dsh-2xray-core-${platform}-${arch}`
+  const resolver = resolvePackage ?? ((specifier) => createRequire(import.meta.url).resolve(specifier))
+  try {
+    const manifest = resolver(`${name}/package.json`)
+    const base = dirname(manifest)
+    const executable = platform === 'win32' ? 'xray.exe' : 'xray'
+    return [...new Set([join(base, 'bin', executable), join(base, 'bin', 'xray')])]
+  } catch {
+    return []
+  }
+}
+
 function isExecutable(file) {
   try {
     accessSync(file, constants.X_OK)
@@ -56,12 +74,16 @@ export async function resolveBinary({
   packageRoot = PACKAGE_ROOT,
   discoveryRoots,
   discoveryOptions = {},
+  resolvePackage,
 }) {
   const candidates = []
   const explicit = config.binary.path?.trim()
   if (explicit) candidates.push({ path: explicit, source: 'config' })
   const fromEnv = process.env.DSH_XRAY_BIN?.trim()
   if (fromEnv) candidates.push({ path: fromEnv, source: 'env' })
+  for (const path of optionalCorePaths({ resolvePackage })) {
+    candidates.push({ path, source: 'core-package' })
+  }
   candidates.push({ path: join(packageRoot, 'bin', executableName()), source: 'bundled' })
   candidates.push({ path: join(packageRoot, 'bin', 'xray'), source: 'bundled' })
   candidates.push({ path: join(dataDir, 'bin', executableName()), source: 'managed' })

package/lib/client.js

@@ -316,6 +316,9 @@ window.__ModuleLoader__.load({
       const [routingMode, setRoutingMode] = React.useState(value.routing?.mode ?? 'global')
       const [whitelist, setWhitelist] = React.useState((value.routing?.whitelist ?? []).join('\n'))
       const [blacklist, setBlacklist] = React.useState((value.routing?.blacklist ?? []).join('\n'))
+      const [autoUpdate, setAutoUpdate] = React.useState(value.updates?.auto === true)
+      const [updateInfo, setUpdateInfo] = React.useState(null)
+      const [updateBusy, setUpdateBusy] = React.useState('')
       const [message, setMessage] = React.useState('')
       const [kind, setKind] = React.useState('')
       const [busy, setBusy] = React.useState(false)
@@ -329,6 +332,47 @@ window.__ModuleLoader__.load({
         setKind(tone || '')
       }
 
+      const loadUpdate = async (refresh = false) => {
+        try {
+          const response = await fetch(new URL(`api/xray/update${refresh ? '?refresh=1' : ''}`, document.baseURI), {
+            credentials: 'same-origin',
+            headers: { accept: 'application/json' },
+          })
+          const data = await response.json()
+          if (data.update) setUpdateInfo(data.update)
+          return data
+        } catch (error) {
+          say('检查更新失败：' + (error.message || error), 'error')
+          return null
+        }
+      }
+
+      const installNow = async () => {
+        setUpdateBusy('install')
+        try {
+          const response = await fetch(new URL('api/xray/update', document.baseURI), {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ action: 'install' }),
+          })
+          const data = await response.json()
+          if (data.update) setUpdateInfo(data.update)
+          say(
+            data.ok ? `已下载 ${data.update?.latest ?? '新版本'}，重启 DSH 后生效。` : '更新失败：' + (data.error || '未知错误'),
+            data.ok ? 'ok' : 'error',
+          )
+        } catch (error) {
+          say('更新失败：' + (error.message || error), 'error')
+        } finally {
+          setUpdateBusy('')
+        }
+      }
+
+      React.useEffect(() => {
+        loadUpdate(false)
+      }, [])
+
       const applyDecoded = (text) => {
         const trimmed = String(text || '').trim()
         if (!trimmed) return
@@ -426,6 +470,7 @@ window.__ModuleLoader__.load({
             { path: ['routing', 'mode'], value: routingMode },
             { path: ['routing', 'whitelist'], value: splitList(whitelist) },
             { path: ['routing', 'blacklist'], value: splitList(blacklist) },
+            { path: ['updates', 'auto'], value: autoUpdate },
           ]
           if (binaryPath.trim()) fields.push({ path: ['binary', 'path'], value: binaryPath.trim() })
           const numericPort = Number(port)
@@ -483,6 +528,26 @@ window.__ModuleLoader__.load({
             placeholder: 'deepseek.com\napi.deepseek.com',
             onChange: (event) => setBlacklist(event.target.value),
           })),
+        h('div', { style: { ...C.cardHead, marginTop: 14 } }, '更新'),
+        h('div', { style: { display: 'flex', gap: 8, flexWrap: 'wrap', alignItems: 'center' } },
+          h('button', {
+            type: 'button',
+            style: C.btn,
+            onClick: () => loadUpdate(true),
+          }, '检测更新'),
+          h('button', {
+            type: 'button',
+            style: C.primaryBtn,
+            disabled: updateBusy === 'install' || !updateInfo?.available,
+            onClick: installNow,
+          }, updateBusy === 'install' ? '更新中…' : '立即更新'),
+          h('label', { style: { fontSize: 12.5, display: 'flex', alignItems: 'center', gap: 6 } },
+            h('input', { type: 'checkbox', checked: autoUpdate, onChange: (event) => setAutoUpdate(event.target.checked) }), '自动更新')),
+        h('div', { style: { ...C.muted, fontSize: 12, marginTop: 6 } },
+          updateInfo
+            ? `当前 ${updateInfo.current} · 最新 ${updateInfo.latest ?? '未知'}${updateInfo.available ? '（可更新）' : '（已是最新）'}` +
+              (updateInfo.restartRequired ? ' · 已下载，重启 DSH 生效' : '')
+            : '点击「检测更新」查询 npm 上的最新版本'),
         h(Field, { label: 'xray 可执行文件路径（留空自动查找）' },
           h('input', { style: { ...C.input, fontFamily: 'ui-monospace, Consolas, monospace' }, value: binaryPath, placeholder: '例如 D:\\v2rayN\\...\\bin\\xray\\xray.exe', onChange: (event) => setBinaryPath(event.target.value) })),
         h(Field, { label: '本地 HTTP 入站端口' },

package/lib/config.js

@@ -69,6 +69,7 @@ export const DEFAULT_CONFIG = {
     balancerTag: 'active',
     timeoutMs: 3000,
   },
+  updates: { auto: false },
   binary: { path: '', dataDir: '' },
   lifecycle: {
     startTimeoutMs: 15000,
@@ -350,6 +351,9 @@ export function normalizeConfig(raw) {
     merged.noProxy = [...new Set([...existing, ...merged.routing.blacklist])].join(',')
   }
 
+  merged.updates = merged.updates ?? {}
+  merged.updates.auto = asBool(merged.updates.auto, false)
+
   const control = merged.control
   control.enabled = asBool(control.enabled, false)
   control.host = asString(control.host, '127.0.0.1')

package/lib/schema.js

@@ -107,4 +107,10 @@ export const Config = Schema.object({
       .description('强制直连的域名（优先于白名单与分流）。')
       .volatile(),
   }),
+  updates: Schema.object({
+    auto: Schema.boolean()
+      .default(false)
+      .description('启动时检查 npm 上的新版本并自动安装；重启 DSH 后生效。')
+      .volatile(),
+  }),
 })

package/lib/update.js

@@ -0,0 +1,144 @@
+import { createHash } from 'node:crypto'
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const PACKAGE_ROOT = fileURLToPath(new URL('../', import.meta.url))
+const PACKAGE_NAME = '@twinsearth/dsh-2xray'
+const REGISTRY = 'https://registry.npmjs.org'
+
+function readOwnVersion() {
+  try {
+    return JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')).version
+  } catch {
+    return '0.0.0'
+  }
+}
+
+/** Numeric semver comparison; a prerelease sorts before the release. */
+export function compareVersions(left, right) {
+  const parse = (value) => {
+    const [core, pre] = String(value).replace(/^v/, '').split('-', 2)
+    const parts = core.split('.').map((part) => Number.parseInt(part, 10) || 0)
+    return { parts, pre: pre ?? '' }
+  }
+  const a = parse(left)
+  const b = parse(right)
+  for (let index = 0; index < 3; index++) {
+    if (a.parts[index] !== b.parts[index]) return a.parts[index] > b.parts[index] ? 1 : -1
+  }
+  if (a.pre === b.pre) return 0
+  if (a.pre === '') return 1
+  if (b.pre === '') return -1
+  return a.pre > b.pre ? 1 : -1
+}
+
+export function checkForUpdate({ current = readOwnVersion(), registry = REGISTRY, packageName = PACKAGE_NAME } = {}) {
+  return fetch(`${registry}/${encodeURIComponent(packageName)}/latest`, {
+    headers: { accept: 'application/json', 'cache-control': 'no-cache' },
+    signal: AbortSignal.timeout(15000),
+  })
+    .then(async (response) => {
+      if (!response.ok) throw new Error(`registry HTTP ${response.status}`)
+      const meta = await response.json()
+      const latest = String(meta.version ?? '')
+      if (!latest) throw new Error('registry response has no version')
+      return {
+        current,
+        latest,
+        available: compareVersions(latest, current) > 0,
+        checkedAt: Date.now(),
+        tarball: meta.dist?.tarball,
+        integrity: meta.dist?.integrity,
+        shasum: meta.dist?.shasum,
+      }
+    })
+    .catch((error) => ({ current, latest: null, available: false, error: String(error.message ?? error), checkedAt: Date.now() }))
+}
+
+function verify(bytes, { integrity, shasum }) {
+  if (integrity?.startsWith('sha512-')) {
+    const actual = 'sha512-' + createHash('sha512').update(bytes).digest('base64')
+    return actual === integrity
+  }
+  if (shasum) {
+    return createHash('sha1').update(bytes).digest('hex') === shasum
+  }
+  return false
+}
+
+function extractTarball(file, destination) {
+  const attempts = [
+    ['tar', ['-xzf', file, '-C', destination]],
+    ['tar', ['-xf', file, '-C', destination]],
+  ]
+  for (const [command, argv] of attempts) {
+    if (spawnSync(command, argv, { stdio: 'ignore' }).status === 0) return true
+  }
+  return false
+}
+
+function copyTree(source, target) {
+  mkdirSync(target, { recursive: true })
+  for (const entry of readdirSync(source, { withFileTypes: true })) {
+    const from = join(source, entry.name)
+    const to = join(target, entry.name)
+    if (entry.isDirectory()) copyTree(from, to)
+    else if (entry.isFile()) copyFileSync(from, to)
+  }
+}
+
+/**
+ * Install a newer tarball over the running package directory. The swap is
+ * rename-based with a rollback copy, and the caller must restart DSH: the
+ * already-loaded modules keep running the old code.
+ */
+export async function installUpdate(info, { packageRoot = PACKAGE_ROOT, logger } = {}) {
+  if (!info?.available || !info.tarball) return { ok: false, error: 'no update available' }
+  const workspace = mkdtempSync(join(tmpdir(), 'dsh-2xray-update-'))
+  const target = packageRoot
+  const backup = `${target}.bak-${Date.now()}`
+  try {
+    const response = await fetch(info.tarball, { redirect: 'follow', signal: AbortSignal.timeout(180000) })
+    if (!response.ok) throw new Error(`tarball HTTP ${response.status}`)
+    const bytes = Buffer.from(await response.arrayBuffer())
+    if (!verify(bytes, info)) throw new Error('tarball integrity check failed')
+    const archive = join(workspace, 'package.tgz')
+    writeFileSync(archive, bytes)
+    const extracted = join(workspace, 'out')
+    mkdirSync(extracted, { recursive: true })
+    if (!extractTarball(archive, extracted)) throw new Error('could not extract tarball')
+    const packageDir = join(extracted, 'package')
+    if (!existsSync(join(packageDir, 'package.json'))) throw new Error('tarball has no package/ directory')
+    renameSync(target, backup)
+    try {
+      copyTree(packageDir, target)
+    } catch (error) {
+      rmSync(target, { recursive: true, force: true })
+      renameSync(backup, target)
+      throw error
+    }
+    rmSync(backup, { recursive: true, force: true })
+    logger?.info?.(`已更新到 ${info.latest}，重启 DSH 后生效`)
+    return { ok: true, version: info.latest, restartRequired: true }
+  } catch (error) {
+    logger?.error?.(`更新失败：${String(error.message ?? error)}`)
+    return { ok: false, error: String(error.message ?? error) }
+  } finally {
+    rmSync(workspace, { recursive: true, force: true })
+  }
+}
+
+export function ownVersion() {
+  return readOwnVersion()
+}
+
+export function packageSize(path) {
+  try {
+    return statSync(path).size
+  } catch {
+    return 0
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/dsh-2xray",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "private": false,
   "description": "DSH-2Xray: supervises xray-core and routes DSH process-wide HTTP(S) traffic through its local inbound, with optional multi-node gRPC control plane",
   "type": "module",
@@ -48,5 +48,8 @@
       ],
       "platform": "web"
     }
+  },
+  "optionalDependencies": {
+    "@twinsearth/dsh-2xray-core-win32-x64": "0.2.9"
   }
 }

package/test/binary.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { BinaryError, resolveBinary } from '../lib/binary.js'
+import { BinaryError, optionalCorePaths, resolveBinary } from '../lib/binary.js'
 import { normalizeConfig } from '../lib/config.js'
 
 const packageRoot = join('C:', 'plugins', 'dsh-2xray')
@@ -129,3 +129,14 @@ test('discovers a v2rayN layout when nothing else resolves', async () => {
     rmSync(dir, { recursive: true, force: true })
   }
 })
+
+test('optional platform core packages resolve on their own platform', () => {
+  const manifest = join('C:', 'profile', 'node_modules', '@twinsearth', 'dsh-2xray-core-darwin-arm64', 'package.json')
+  const paths = optionalCorePaths({
+    platform: 'darwin',
+    arch: 'arm64',
+    resolvePackage: () => manifest,
+  })
+  assert.deepEqual(paths, [join('C:', 'profile', 'node_modules', '@twinsearth', 'dsh-2xray-core-darwin-arm64', 'bin', 'xray')])
+  assert.deepEqual(optionalCorePaths({ platform: 'darwin', arch: 'arm64', resolvePackage: () => { throw new Error('missing') } }), [])
+})

package/test/update.test.js

@@ -0,0 +1,41 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { checkForUpdate, compareVersions } from '../lib/update.js'
+
+test('compareVersions orders releases and prereleases', () => {
+  assert.equal(compareVersions('0.2.9', '0.2.8'), 1)
+  assert.equal(compareVersions('0.2.8', '0.2.9'), -1)
+  assert.equal(compareVersions('0.2.9', '0.2.9'), 0)
+  assert.equal(compareVersions('0.2.10', '0.2.9'), 1)
+  assert.equal(compareVersions('0.3.0-rc.1', '0.3.0'), -1)
+})
+
+test('checkForUpdate reads the registry latest and flags an update', async () => {
+  const original = globalThis.fetch
+  globalThis.fetch = async (url) => ({
+    ok: true,
+    async json() {
+      return { version: '9.9.9', dist: { tarball: 'https://example.test/pkg.tgz', integrity: 'sha512-abc', shasum: 'abc' } }
+    },
+  })
+  try {
+    const info = await checkForUpdate({ current: '0.2.9' })
+    assert.equal(info.latest, '9.9.9')
+    assert.equal(info.available, true)
+    assert.equal(info.tarball, 'https://example.test/pkg.tgz')
+  } finally {
+    globalThis.fetch = original
+  }
+})
+
+test('checkForUpdate fails closed on a registry error', async () => {
+  const original = globalThis.fetch
+  globalThis.fetch = async () => ({ ok: false, status: 503 })
+  try {
+    const info = await checkForUpdate({ current: '0.2.9' })
+    assert.equal(info.available, false)
+    assert.match(info.error, /503/)
+  } finally {
+    globalThis.fetch = original
+  }
+})

package/tools/build-core-packages.mjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+/**
+ * Turn official Xray-core zips into per-platform npm packages.
+ *
+ * npm installs only the package whose `os`/`cpu` matches, so the main package
+ * can depend on all of them without downloading five cores. CI can run this on
+ * each runner (where GitHub release downloads work); locally it also accepts a
+ * directory of already-downloaded zips.
+ *
+ * Usage:
+ *   node tools/build-core-packages.mjs --zips ./vendor/zips --out ./dist-core --version 0.2.9
+ *
+ * Expected zip names (official release assets):
+ *   Xray-windows-64.zip, Xray-windows-arm64-v8a.zip
+ *   Xray-macos-64.zip, Xray-macos-arm64-v8a.zip
+ *   Xray-linux-64.zip, Xray-linux-arm64-v8a.zip
+ */
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const TARGETS = [
+  { zip: 'Xray-windows-64.zip', pkg: 'win32-x64', os: 'win32', cpu: 'x64', exe: 'xray.exe' },
+  { zip: 'Xray-windows-arm64-v8a.zip', pkg: 'win32-arm64', os: 'win32', cpu: 'arm64', exe: 'xray.exe' },
+  { zip: 'Xray-macos-64.zip', pkg: 'darwin-x64', os: 'darwin', cpu: 'x64', exe: 'xray' },
+  { zip: 'Xray-macos-arm64-v8a.zip', pkg: 'darwin-arm64', os: 'darwin', cpu: 'arm64', exe: 'xray' },
+  { zip: 'Xray-linux-64.zip', pkg: 'linux-x64', os: 'linux', cpu: 'x64', exe: 'xray' },
+  { zip: 'Xray-linux-arm64-v8a.zip', pkg: 'linux-arm64', os: 'linux', cpu: 'arm64', exe: 'xray' },
+]
+
+function args() {
+  const parsed = {}
+  for (let index = 2; index < process.argv.length; index += 2) {
+    const key = process.argv[index].replace(/^--/, '')
+    parsed[key] = process.argv[index + 1]
+  }
+  return {
+    zips: parsed.zips ?? './vendor/zips',
+    out: parsed.out ?? './dist-core',
+    version: parsed.version ?? JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version,
+  }
+}
+
+function extract(zip, destination) {
+  const attempts =
+    process.platform === 'win32'
+      ? [['tar', ['-xf', zip, '-C', destination]], ['powershell', ['-NoProfile', '-Command', `Expand-Archive -LiteralPath '${zip}' -DestinationPath '${destination}' -Force`]]]
+      : [['unzip', ['-o', zip, '-d', destination]], ['tar', ['-xf', zip, '-C', destination]]]
+  for (const [command, argv] of attempts) {
+    if (spawnSync(command, argv, { stdio: 'ignore' }).status === 0) return
+  }
+  throw new Error(`could not extract ${zip}`)
+}
+
+function findBinary(dir, name) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name)
+    if (entry.isFile() && entry.name === name) return full
+    if (entry.isDirectory()) {
+      const nested = findBinary(full, name)
+      if (nested) return nested
+    }
+  }
+  return undefined
+}
+
+const options = args()
+mkdirSync(options.out, { recursive: true })
+const built = []
+for (const target of TARGETS) {
+  const zip = join(options.zips, target.zip)
+  if (!existsSync(zip)) {
+    console.log(`skip ${target.pkg}: ${target.zip} not present`)
+    continue
+  }
+  const workspace = mkdtempSync(join(tmpdir(), `dsh-core-${target.pkg}-`))
+  try {
+    extract(zip, workspace)
+    const binary = findBinary(workspace, target.exe)
+    if (!binary) throw new Error(`${target.exe} not found in ${target.zip}`)
+    const packageName = `@twinsearth/dsh-2xray-core-${target.pkg}`
+    const dir = join(options.out, `dsh-2xray-core-${target.pkg}`)
+    mkdirSync(join(dir, 'bin'), { recursive: true })
+    copyFileSync(binary, join(dir, 'bin', target.exe))
+    writeFileSync(
+      join(dir, 'package.json'),
+      JSON.stringify(
+        {
+          name: packageName,
+          version: options.version,
+          description: `Xray-core binary for ${target.pkg} (DSH-2Xray optional dependency)`,
+          license: 'MPL-2.0',
+          os: [target.os],
+          cpu: [target.cpu],
+          files: ['bin'],
+        },
+        null,
+        2,
+      ) + '\n',
+    )
+    built.push({ name: packageName, dir, size: statSync(join(dir, 'bin', target.exe)).size })
+  } finally {
+    rmSync(workspace, { recursive: true, force: true })
+  }
+}
+
+for (const entry of built) {
+  console.log(`built ${entry.name} (${Math.round(entry.size / 1048576)} MB) -> ${entry.dir}`)
+}
+if (built.length === 0) {
+  console.log(`no zips found in ${options.zips}`)
+  process.exitCode = 1
+}