@uzooai/anime-ai-cli 0.5.0 → 0.6.0

package/scripts/check-package-resources.mjs

@@ -1,56 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs/promises'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { spawn } from 'node:child_process'
-import {releasePolicy} from './release-policy.mjs'
-const repository = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-assert(process.env.npm_execpath, '通过 npm run check:resources 执行')
-const output = await new Promise((resolve, reject) => {
-  const child = spawn(process.execPath, [process.env.npm_execpath, 'pack', '--dry-run', '--json', '--offline', '--ignore-scripts'],
-    { cwd: repository, windowsHide: true, stdio: ['ignore','pipe','pipe'] })
-  let out = '', err = ''
-  child.stdout.on('data', b => { out += b }); child.stderr.on('data', b => { err += b })
-  child.on('error', reject)
-  child.on('close', code => code === 0 ? resolve(out) : reject(new Error('资源清单检查失败：' + err.slice(-1000))))
-})
-const [packed] = JSON.parse(output), names = new Set(packed.files.map(f => f.path))
-const metadata = JSON.parse(await fs.readFile(path.join(repository, 'package.json'), 'utf8'))
-const release=releasePolicy(metadata)
-const lock=JSON.parse(await fs.readFile(path.join(repository,'package-lock.json'),'utf8'))
-assert.equal(metadata.name,lock.name);assert.equal(metadata.version,lock.version)
-assert.equal(metadata.name,lock.packages[''].name);assert.equal(metadata.version,lock.packages[''].version)
-assert.equal(metadata.license,'MIT')
-assert((await fs.readFile(path.join(repository,'CHANGELOG.md'),'utf8')).includes(metadata.version),'更新记录缺少当前版本')
-assert(names.has('LICENSE')&&names.has('CHANGELOG.md')&&names.has('src/package-info.js'),'版本／许可证资源缺失')
-assert(Array.isArray(metadata.files) && metadata.files.includes('src/') && metadata.files.includes('.agents/skills/uzoo-anime-cli/'), '缺少显式运行资源白名单')
-for (const file of ['scripts/release-policy.mjs','scripts/check-release.mjs','src/download-name.js','src/cli.js','src/draft-finalize.js','src/media-copy.js','src/group-edit.js','src/group-layout.js',
-  'src/agreement-page.js','src/callback-page.js','assets/logo-uzoo.svg','assets/favicon-uzoo.png','.agents/skills/uzoo-anime-cli/SKILL.md'])
-  assert(names.has(file), '包内缺少运行资源：' + file)
-let imports = 0
-for (const file of [...names].filter(f => /^(?:src\/.*\.js|scripts\/.*\.mjs)$/.test(f))) {
-  const source = await fs.readFile(path.join(repository, file), 'utf8')
-  for (const match of source.matchAll(/(?:from\s*|import\s*\(|new URL\(\s*)['"](\.[^'"]+)['"]/g)) {
-    const target = path.posix.normalize(path.posix.join(path.posix.dirname(file), match[1]))
-    assert(names.has(target), '运行模块相对资源遗漏：' + file + ' → ' + target); imports++
-  }
-}
-let links=0,externalWorkspaceReferences=0
-for(const file of [...names].filter(f=>f.endsWith('.md'))){
- const source=await fs.readFile(path.join(repository,file),'utf8')
- for(const match of source.matchAll(/\]\(([^\s)]+)\)/g)){
-  const value=match[1].split('#')[0].replace(/^<|>$/g,'')
-  if(!value || /^[a-z][a-z0-9+.-]*:/i.test(value))continue
-  const target=path.posix.normalize(path.posix.join(path.posix.dirname(file),decodeURIComponent(value)))
-  // Historical maintainer documents may cite sibling repositories. Those links
-  // are evidence pointers, never installed runtime or skill dependencies.
-  if(file.startsWith('docs/')&&target.startsWith('../')){externalWorkspaceReferences++;continue}
-  assert(names.has(target)||[...names].some(n=>n.startsWith(target+'/')),'包内文档引用遗漏：'+file+' → '+target);links++
- }
-}
-const references = [...names].filter(f => f.startsWith('.agents/skills/uzoo-anime-cli/references/'))
-assert.equal(references.length, 13)
-assert(![...names].some(f => /(^|\/)(\.local|outputs|node_modules|\.git)(\/|$)|\.dpapi$|(^|\/)(credentials[^/]*\.json|\.env[^/]*)$/.test(f)), '包内包含本地产物或敏感配置')
-assert(![...names].some(f=>/^test\//.test(f)||f==='AGENTS.md'||f==='scripts/verify-package.mjs'||f==='docs/阶段3B远程后端联调记录.md'||/\.tgz$/.test(f)), '包内包含测试、宿主规则、内部联调记录、安装专项或历史归档')
-console.log(JSON.stringify({ files: names.size, relative_runtime_resources: imports, package_document_links:links, external_workspace_references:externalWorkspaceReferences, skill_references: references.length,...release,
-  install_performed: false, upgrade_tested: false, published: false }))

package/scripts/check-release.mjs

@@ -1,19 +0,0 @@
-import assert from 'node:assert/strict'
-import fs from 'node:fs/promises'
-import path from 'node:path'
-import {fileURLToPath} from 'node:url'
-import {releasePolicy} from './release-policy.mjs'
-
-const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..')
-const read=name=>fs.readFile(path.join(root,name),'utf8')
-const metadata=JSON.parse(await read('package.json')),lock=JSON.parse(await read('package-lock.json'))
-const policy=releasePolicy(metadata,{requirePublic:true})
-assert.equal(metadata.version,lock.version);assert.equal(metadata.name,lock.name)
-assert.equal(metadata.version,lock.packages[''].version);assert.equal(metadata.name,lock.packages[''].name)
-const heading='## '+metadata.version
-assert((await read('CHANGELOG.md')).split(/\r?\n/).some(line=>line===heading||line.startsWith(heading+' ')),'缺少本版本独立更新记录')
-assert((await read('LICENSE')).startsWith('MIT License'),'MIT授权文件缺失')
-assert((await read('README.md')).includes('npm install --global @uzooai/anime-ai-cli@latest'),'缺少安装用户入口')
-console.log(JSON.stringify({name:metadata.name,version:metadata.version,...policy,local_release_check:'passed',
- registry_account_checked:false,two_factor_checked:false,publication_authorized:false,published:false,
- next:'本命令仅检查本地产物；发布前另核对scope权限、2FA及当次明确授权'}))

package/scripts/pack-local.mjs

@@ -1,33 +0,0 @@
-import fs from 'node:fs/promises'
-import path from 'node:path'
-import crypto from 'node:crypto'
-import assert from 'node:assert/strict'
-import {fileURLToPath} from 'node:url'
-import {spawn} from 'node:child_process'
-import {releasePolicy} from './release-policy.mjs'
-
-const repository=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..')
-assert(process.env.npm_execpath,'通过 npm run pack:local 执行')
-async function npm(args,capture=false){
- return new Promise((resolve,reject)=>{
-  const child=spawn(process.execPath,[process.env.npm_execpath,...args],{cwd:repository,windowsHide:true,stdio:capture?['ignore','pipe','pipe']:'inherit'})
-  let out='',err=''
-  if(capture){child.stdout.on('data',b=>out+=b);child.stderr.on('data',b=>err+=b)}
-  child.on('error',reject)
-  child.on('close',code=>code===0?resolve(out):reject(Error('本地打包检查失败（exit '+code+'）'+(capture?': '+err.slice(-1500):''))))
- })
-}
-// Build validates native ESM and package resources; there is no transpilation.
-await npm(['run','build'])
-const destination=path.join(repository,'outputs','npm',new Date().toISOString().replace(/[:.]/g,'-')+'-'+crypto.randomUUID().slice(0,8))
-await fs.mkdir(destination,{recursive:true})
-// prepack's build has just run. Suppress it here to keep the manifest pure JSON.
-const [packed]=JSON.parse(await npm(['pack','--offline','--ignore-scripts','--json','--pack-destination',destination],true))
-assert(packed && packed.filename===path.basename(packed.filename),'打包未返回安全产物文件名')
-const archive=path.join(destination,packed.filename),bytes=await fs.readFile(archive)
-assert.equal(crypto.createHash('sha1').update(bytes).digest('hex'),packed.shasum,'归档摘要不匹配')
-assert.equal('sha512-'+crypto.createHash('sha512').update(bytes).digest('base64'),packed.integrity,'归档integrity不匹配')
-assert.equal(bytes.length,packed.size,'归档长度不匹配')
-await fs.writeFile(path.join(destination,'manifest.json'),JSON.stringify(packed,null,2)+'\n',{flag:'wx'})
-const metadata=JSON.parse(await fs.readFile(path.join(repository,'package.json'),'utf8'))
-console.log(JSON.stringify({archive,manifest:path.join(destination,'manifest.json'),bytes:bytes.length,files:packed.files.length,integrity:packed.integrity,...releasePolicy(metadata),publication_authorized:false,installed:false,published:false},null,2))

package/scripts/release-policy.mjs

@@ -1,22 +0,0 @@
-import assert from 'node:assert/strict'
-
-// This product's explicit release policy. Validation never logs in, changes
-// access, or publishes; the registry account and action authorization are separate.
-export function releasePolicy(metadata,{requirePublic=false}={}){
- assert.equal(metadata.name,'@uzooai/anime-ai-cli','正式包名不匹配')
- assert.equal(typeof metadata.private,'boolean','必须显式声明private，不能意外开放发布')
- if(metadata.private){
-  assert(!requirePublic,'当前为private内部包，不能作为公开发布产物')
-  return {private:true,public_package:false,registry:null,tag:null}
- }
- assert.equal(metadata.license,'MIT','发布许可证须保持已确认的MIT')
- assert.equal(metadata.bin?.['uzoo-anime'],'src/cli.js','发布命令入口不匹配')
- assert.match(metadata.version,/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-rc\.(0|[1-9]\d*))?$/,'发布版本须为x.y.z或x.y.z-rc.N')
- const config=metadata.publishConfig
- assert(config&&typeof config==='object'&&!Array.isArray(config),'公开包缺少publishConfig')
- assert.equal(config.access,'public','scoped公开包必须明确access=public')
- assert.equal(config.registry,'https://registry.npmjs.org/','发布registry必须明确为npm官方HTTPS地址')
- const tag=metadata.version.includes('-')?'next':'latest'
- assert.equal(config.tag,tag,'稳定版须latest，RC须next，不能串用通道')
- return {private:false,public_package:true,registry:config.registry,tag}
-}