@vantaloom/cli 0.1.2 → 0.1.5

package/README.md

@@ -9,4 +9,4 @@ vantaloom status
 vantaloom update
 ```
 
-The CLI downloads platform-specific runtime packages produced by the Vantaloom GitHub CI pipeline.
+The CLI downloads the current platform runtime from public npm packages such as `@vantaloom/runtime-win32-x64`, `@vantaloom/runtime-linux-x64`, and `@vantaloom/runtime-darwin-arm64`. No GitHub token is required for install or update.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantaloom/cli",
-  "version": "0.1.2",
+  "version": "0.1.5",
   "private": false,
   "type": "module",
   "description": "Vantaloom local runtime manager.",

package/src/cli.mjs

@@ -2,12 +2,10 @@ import { execFileSync, spawnSync } from "node:child_process"
 import {
   chmodSync,
   existsSync,
-  lstatSync,
   mkdirSync,
   mkdtempSync,
   readdirSync,
   readFileSync,
-  readlinkSync,
   rmSync,
   writeFileSync,
 } from "node:fs"
@@ -21,19 +19,7 @@ const repoCandidate = path.resolve(cliRoot, "..", "..")
 const installedConfigPath = path.join(cliRoot, "config.json")
 const defaultReleaseTag = "runtime-latest"
 const defaultRepo = "Timefiles404/Vantaloom-next"
-
-const runtimePackages = [
-  "@next/env",
-  "@swc/helpers",
-  "baseline-browser-mapping",
-  "caniuse-lite",
-  "client-only",
-  "postcss",
-  "react",
-  "react-dom",
-  "scheduler",
-  "styled-jsx",
-]
+const defaultNpmRegistry = "https://registry.npmjs.org"
 
 export async function main(argv) {
   const command = argv[0] ?? "help"
@@ -43,19 +29,23 @@ export async function main(argv) {
     case "install":
       if (options.package) {
         await installFromPackage({ ...options, update: false })
-      } else if (shouldUseDistSync(options)) {
+      } else if (shouldUseSourceInstall(options)) {
+        await installFromSource(options)
+      } else if (shouldUseReleaseSync(options)) {
         await syncFromRelease(options, "install")
       } else {
-        await installFromSource(options)
+        await syncFromNpmRegistry(options, "install")
       }
       return
     case "update":
       if (options.package) {
         await installFromPackage({ ...options, update: true })
-      } else if (shouldUseDistSync(options)) {
+      } else if (shouldUseSourceInstall(options)) {
+        await installFromSource({ ...options, update: true })
+      } else if (shouldUseReleaseSync(options)) {
         await syncFromRelease(options, "update")
       } else {
-        await installFromSource({ ...options, update: true })
+        await syncFromNpmRegistry(options, "update")
       }
       return
     case "package":
@@ -126,6 +116,10 @@ async function packageRuntime(options) {
     buildWeb: options.buildWeb,
   })
 
+  if (options.npmPackage) {
+    writeRuntimePackageMetadata(packageRoot, sourceRoot, builtPlatform)
+  }
+
   if (options.archive) {
     const archivePath = `${packageRoot}.tar.gz`
     removeKnownPath(archivePath, path.dirname(archivePath))
@@ -161,7 +155,7 @@ async function buildRuntimePackage(sourceRoot, packageRoot, options) {
     runPnpm(["--filter", "vantaloom-app", "build"], { cwd: sourceRoot })
   }
 
-  await copyStandaloneWeb(sourceRoot, buildWeb)
+  await copyStaticWeb(sourceRoot, buildWeb)
   await copyCliDirectory(path.join(packageRoot, "cli"), sourceRoot, runtimeConfigFromSource(sourceRoot))
   writeBuildManifest(packageRoot, version, platform)
 
@@ -219,6 +213,46 @@ async function applyPackage(packageRoot, prefix, options) {
   return version
 }
 
+async function syncFromNpmRegistry(options, action) {
+  const prefix = safeDirectory(options.prefix ?? defaultPrefix())
+  const installedConfig = readInstalledConfig(prefix)
+  const runtimePackage = options.runtimePackage || installedConfig.runtimePackage || runtimePackageName(platformId())
+  const runtimeVersion = options.runtimeVersion || installedConfig.runtimeVersion || "latest"
+  const registry = normalizeRegistry(options.npmRegistry || installedConfig.npmRegistry || defaultNpmRegistry)
+  const tempRoot = mkdtempSync(path.join(os.tmpdir(), "vantaloom-npm-"))
+
+  try {
+    const extractRoot = path.join(tempRoot, "extract")
+    const archive = path.join(tempRoot, `${packageBasename(runtimePackage)}-${runtimeVersion}.tgz`)
+    mkdirSync(extractRoot, { recursive: true })
+
+    const resolved = await resolveNpmPackage({ registry, name: runtimePackage, version: runtimeVersion })
+    await downloadNpmTarball({
+      tarballUrl: resolved.tarball,
+      target: archive,
+      packageName: runtimePackage,
+      version: resolved.version,
+    })
+    run("tar", ["-xzf", archive, "-C", extractRoot])
+
+    const packageRoot = findExtractedNpmPackage(extractRoot)
+    const version = await applyPackage(packageRoot, prefix, {
+      noStart: options.noStart,
+      runtimePackage,
+      runtimeVersion: options.runtimeVersion ? resolved.version : "latest",
+      npmRegistry: registry,
+      update: action === "update",
+    })
+
+    console.log(`${action === "update" ? "updated" : "installed"} Vantaloom: ${prefix}`)
+    console.log(`version: ${version}`)
+    console.log(`source: ${runtimePackage}@${resolved.version}`)
+    console.log(`run: ${displayCommand(prefix)} status`)
+  } finally {
+    removeKnownPath(tempRoot, os.tmpdir())
+  }
+}
+
 async function syncFromRelease(options, action) {
   const prefix = safeDirectory(options.prefix ?? defaultPrefix())
   const installedConfig = readInstalledConfig(prefix)
@@ -261,7 +295,7 @@ async function syncFromRelease(options, action) {
 }
 
 async function downloadReleaseAsset({ repo, releaseTag, assetName, target, token }) {
-  const url = `https://github.com/${repo}/releases/download/${releaseTag}/${assetName}`
+  const releaseUrl = `https://api.github.com/repos/${repo}/releases/tags/${releaseTag}`
   const headers = {
     "User-Agent": "vantaloom-cli",
   }
@@ -270,7 +304,28 @@ async function downloadReleaseAsset({ repo, releaseTag, assetName, target, token
     headers.Authorization = `Bearer ${githubToken}`
   }
 
-  const response = await fetch(url, { headers })
+  const releaseResponse = await fetch(releaseUrl, { headers })
+  if (!releaseResponse.ok) {
+    const detail = await releaseResponse.text().catch(() => "")
+    const authHint = releaseResponse.status === 404 || releaseResponse.status === 403
+      ? " If the repository is private, set VANTALOOM_GITHUB_TOKEN to a GitHub token that can read releases."
+      : ""
+    throw new Error(`failed to inspect ${repo}@${releaseTag}: HTTP ${releaseResponse.status}.${authHint}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
+  }
+
+  const release = await releaseResponse.json()
+  const asset = release.assets?.find((asset) => asset.name === assetName)
+  if (!asset) {
+    const names = release.assets?.map((asset) => asset.name).join(", ") || "none"
+    throw new Error(`missing release asset ${assetName} in ${repo}@${releaseTag}; available assets: ${names}`)
+  }
+
+  const response = await fetch(asset.url, {
+    headers: {
+      ...headers,
+      Accept: "application/octet-stream",
+    },
+  })
   if (!response.ok) {
     const detail = await response.text().catch(() => "")
     const authHint = response.status === 404 || response.status === 403
@@ -283,8 +338,53 @@ async function downloadReleaseAsset({ repo, releaseTag, assetName, target, token
   await writeFile(target, buffer)
 }
 
-function shouldUseDistSync(options) {
-  return !options.local && !options.source && !options.buildWeb
+async function resolveNpmPackage({ registry, name, version }) {
+  const metadataUrl = `${registry}/${encodeURIComponent(name).replace("%2F", "%2f")}`
+  const response = await fetch(metadataUrl, {
+    headers: {
+      Accept: "application/vnd.npm.install-v1+json",
+      "User-Agent": "vantaloom-cli",
+    },
+  })
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "")
+    throw new Error(`failed to inspect npm package ${name}: HTTP ${response.status}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
+  }
+
+  const metadata = await response.json()
+  const selectedVersion = metadata["dist-tags"]?.[version] ?? version
+  const packageVersion = metadata.versions?.[selectedVersion]
+  if (!packageVersion?.dist?.tarball) {
+    const available = Object.keys(metadata.versions ?? {}).slice(-8).join(", ") || "none"
+    throw new Error(`missing npm package ${name}@${version}; available versions: ${available}`)
+  }
+  return {
+    version: selectedVersion,
+    tarball: packageVersion.dist.tarball,
+  }
+}
+
+async function downloadNpmTarball({ tarballUrl, target, packageName, version }) {
+  const response = await fetch(tarballUrl, {
+    headers: {
+      "User-Agent": "vantaloom-cli",
+    },
+  })
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "")
+    throw new Error(`failed to download ${packageName}@${version}: HTTP ${response.status}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
+  }
+
+  const buffer = Buffer.from(await response.arrayBuffer())
+  await writeFile(target, buffer)
+}
+
+function shouldUseSourceInstall(options) {
+  return Boolean(options.local || options.source || options.buildWeb)
+}
+
+function shouldUseReleaseSync(options) {
+  return Boolean(options.repo || options.remote || options.releaseTag || options.githubToken)
 }
 
 function assertRuntimePackage(packageRoot) {
@@ -317,7 +417,7 @@ function readJSONIfExists(filePath) {
 
 function mergeRuntimeConfig(packageConfig, existingConfig, overrides) {
   const merged = { ...packageConfig }
-  for (const key of ["sourceRoot", "remote", "repo", "releaseTag"]) {
+  for (const key of ["sourceRoot", "remote", "repo", "releaseTag", "runtimePackage", "runtimeVersion", "npmRegistry"]) {
     if (!merged[key] && existingConfig[key]) {
       merged[key] = existingConfig[key]
     }
@@ -325,12 +425,30 @@ function mergeRuntimeConfig(packageConfig, existingConfig, overrides) {
   if (overrides.sourceRoot) {
     merged.sourceRoot = overrides.sourceRoot
   }
+  if (overrides.runtimePackage) {
+    merged.runtimePackage = overrides.runtimePackage
+  }
+  if (overrides.runtimeVersion) {
+    merged.runtimeVersion = overrides.runtimeVersion
+  }
+  if (overrides.npmRegistry) {
+    merged.npmRegistry = overrides.npmRegistry
+  }
   if (!merged.repo) {
     merged.repo = defaultRepo
   }
   if (!merged.releaseTag) {
     merged.releaseTag = defaultReleaseTag
   }
+  if (!merged.runtimePackage) {
+    merged.runtimePackage = runtimePackageName(platformId())
+  }
+  if (!merged.runtimeVersion) {
+    merged.runtimeVersion = "latest"
+  }
+  if (!merged.npmRegistry) {
+    merged.npmRegistry = defaultNpmRegistry
+  }
   return merged
 }
 
@@ -342,6 +460,9 @@ function runtimeConfigFromSource(sourceRoot) {
     ...(remote ? { remote } : {}),
     repo,
     releaseTag: defaultReleaseTag,
+    runtimePackage: runtimePackageName(platformId()),
+    runtimeVersion: "latest",
+    npmRegistry: defaultNpmRegistry,
   }
 }
 
@@ -361,6 +482,22 @@ function findExtractedPackage(extractRoot, platform) {
   throw new Error(`could not find extracted Vantaloom package in ${extractRoot}`)
 }
 
+function findExtractedNpmPackage(extractRoot) {
+  const expected = path.join(extractRoot, "package")
+  if (existsSync(expected)) {
+    return expected
+  }
+
+  const directories = readdirSync(extractRoot, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => path.join(extractRoot, entry.name))
+  if (directories.length === 1) {
+    return directories[0]
+  }
+
+  throw new Error(`could not find extracted npm package in ${extractRoot}`)
+}
+
 function tryFindSourceRoot() {
   try {
     return findSourceRoot()
@@ -401,29 +538,16 @@ function inferGitHubRepo(remote) {
   return sshMatch?.[1] ?? ""
 }
 
-async function copyStandaloneWeb(sourceRoot, buildWeb) {
-  const standalone = path.join(sourceRoot, "apps", "vantaloom", ".next", "standalone")
-  const staticSource = path.join(sourceRoot, "apps", "vantaloom", ".next", "static")
-  const publicSource = path.join(sourceRoot, "apps", "vantaloom", "public")
-  if (!existsSync(standalone)) {
+async function copyStaticWeb(sourceRoot, buildWeb) {
+  const exportRoot = path.join(sourceRoot, "apps", "vantaloom", "out")
+  if (!existsSync(exportRoot)) {
     throw new Error(
-      "missing Next standalone output; let GitHub CI run production build, or pass --build-web for a local one-off build"
+      "missing Next static export output; let GitHub CI run production build, or pass --build-web for a local one-off build"
     )
   }
 
   removeKnownPath(buildWeb, path.dirname(buildWeb))
-  const preserveStandaloneLinks = process.platform !== "win32"
-  await copyDir(standalone, buildWeb, { dereference: !preserveStandaloneLinks })
-  if (preserveStandaloneLinks) {
-    await copyStandaloneHoistedTargets(sourceRoot, buildWeb)
-  }
-  await copyDir(staticSource, path.join(buildWeb, "apps", "vantaloom", ".next", "static"))
-  await copyDir(publicSource, path.join(buildWeb, "apps", "vantaloom", "public"))
-
-  const appNodeModules = path.join(buildWeb, "apps", "vantaloom", "node_modules")
-  for (const packageName of runtimePackages) {
-    await copyPnpmRuntimePackage(sourceRoot, packageName, appNodeModules)
-  }
+  await copyDir(exportRoot, buildWeb)
 }
 
 async function copyCliDirectory(target, sourceRoot, config) {
@@ -483,81 +607,6 @@ function buildGo(sourceRoot, buildBin, name) {
   ], { cwd: sourceRoot })
 }
 
-async function copyPnpmRuntimePackage(sourceRoot, packageName, destinationNodeModules) {
-  const pnpmRoot = path.join(sourceRoot, "node_modules", ".pnpm")
-  const storeName = packageName.replace("/", "+")
-  const packageRoot = readdirSync(pnpmRoot, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory() && entry.name.startsWith(`${storeName}@`))
-    .map((entry) => path.join(pnpmRoot, entry.name))
-    .sort()
-    .reverse()[0]
-  if (!packageRoot) {
-    throw new Error(`missing pnpm runtime package: ${packageName}`)
-  }
-
-  const source = path.join(packageRoot, "node_modules", ...packageName.split("/"))
-  if (!existsSync(source)) {
-    throw new Error(`missing pnpm runtime package source: ${source}`)
-  }
-
-  await copyDir(source, path.join(destinationNodeModules, ...packageName.split("/")))
-}
-
-async function copyStandaloneHoistedTargets(sourceRoot, buildWeb) {
-  const sourceHoisted = path.join(sourceRoot, "node_modules", ".pnpm", "node_modules")
-  const buildHoisted = path.join(buildWeb, "node_modules", ".pnpm", "node_modules")
-  const packageNames = findHoistedSymlinkPackages(path.join(buildWeb, "node_modules"))
-
-  for (const packageName of packageNames) {
-    const source = path.join(sourceHoisted, ...packageName.split("/"))
-    if (existsSync(source)) {
-      await copyDir(source, path.join(buildHoisted, ...packageName.split("/")))
-    }
-  }
-}
-
-function findHoistedSymlinkPackages(nodeModules) {
-  const packages = new Set()
-  if (!existsSync(nodeModules)) {
-    return packages
-  }
-
-  for (const entry of readdirSync(nodeModules, { withFileTypes: true })) {
-    if (entry.name === ".pnpm" || entry.name.startsWith(".")) {
-      continue
-    }
-
-    const entryPath = path.join(nodeModules, entry.name)
-    if (entry.name.startsWith("@") && entry.isDirectory()) {
-      for (const scopedEntry of readdirSync(entryPath, { withFileTypes: true })) {
-        addHoistedSymlinkPackage(packages, path.join(entryPath, scopedEntry.name), `${entry.name}/${scopedEntry.name}`)
-      }
-      continue
-    }
-
-    addHoistedSymlinkPackage(packages, entryPath, entry.name)
-  }
-
-  return packages
-}
-
-function addHoistedSymlinkPackage(packages, packagePath, packageName) {
-  let stat
-  try {
-    stat = lstatSync(packagePath)
-  } catch {
-    return
-  }
-  if (!stat.isSymbolicLink()) {
-    return
-  }
-
-  const target = readlinkSync(packagePath).replaceAll("\\", "/")
-  if (target.includes(".pnpm/node_modules/")) {
-    packages.add(packageName)
-  }
-}
-
 async function copyDir(source, destination, options = {}) {
   if (!existsSync(source)) {
     throw new Error(`missing source directory: ${source}`)
@@ -589,6 +638,39 @@ function writeBuildManifest(buildRoot, version, platform) {
   )
 }
 
+function writeRuntimePackageMetadata(packageRoot, sourceRoot, platform) {
+  const version = npmPackageVersion(sourceRoot)
+  const { os: runtimeOS, cpu } = parsePlatformId(platform)
+  const name = runtimePackageName(platform)
+  writeFileSync(
+    path.join(packageRoot, "package.json"),
+    `${JSON.stringify(
+      {
+        name,
+        version,
+        private: false,
+        description: `Vantaloom local runtime for ${platform}.`,
+        type: "module",
+        os: [runtimeOS],
+        cpu: [cpu],
+        files: ["bin", "web", "cli", "manifest.json", "VERSION", "README.md"],
+        publishConfig: {
+          access: "public",
+        },
+        engines: {
+          node: ">=20",
+        },
+      },
+      null,
+      2
+    )}\n`
+  )
+  writeFileSync(
+    path.join(packageRoot, "README.md"),
+    `# ${name}\n\nPlatform runtime package for Vantaloom ${platform}. Install @vantaloom/cli instead of this package directly.\n`
+  )
+}
+
 function findSourceRoot(sourceOption) {
   if (sourceOption) {
     return assertSourceRoot(path.resolve(sourceOption))
@@ -605,6 +687,11 @@ function findSourceRoot(sourceOption) {
   return assertSourceRoot(repoCandidate)
 }
 
+function npmPackageVersion(sourceRoot) {
+  const packageJSON = readJSONIfExists(path.join(sourceRoot, "packages", "cli", "package.json"))
+  return packageJSON.version ?? "0.0.0"
+}
+
 function assertSourceRoot(sourceRoot) {
   if (!existsSync(path.join(sourceRoot, "apps", "api", "go.mod"))) {
     throw new Error(`not a Vantaloom source root: ${sourceRoot}`)
@@ -641,6 +728,9 @@ function parseOptions(args) {
       case "remote":
       case "release-tag":
       case "github-token":
+      case "runtime-package":
+      case "runtime-version":
+      case "npm-registry":
         options[toCamel(key)] = inlineValue ?? args[++index]
         if (!options[toCamel(key)]) {
           throw new Error(`missing value for --${key}`)
@@ -655,6 +745,9 @@ function parseOptions(args) {
       case "archive":
         options.archive = true
         break
+      case "npm-package":
+        options.npmPackage = true
+        break
       case "local":
         options.local = true
         break
@@ -714,6 +807,28 @@ function platformId() {
   return `${process.platform}-${process.arch}`
 }
 
+function runtimePackageName(platform) {
+  return `@vantaloom/runtime-${platform}`
+}
+
+function parsePlatformId(platform) {
+  const parts = platform.split("-")
+  const cpu = parts.pop()
+  const runtimeOS = parts.join("-")
+  if (!runtimeOS || !cpu) {
+    throw new Error(`invalid platform id: ${platform}`)
+  }
+  return { os: runtimeOS, cpu }
+}
+
+function packageBasename(name) {
+  return name.split("/").pop() ?? name
+}
+
+function normalizeRegistry(value) {
+  return value.replace(/\/+$/, "")
+}
+
 function defaultPrefix() {
   if (process.env.VANTALOOM_HOME) {
     return process.env.VANTALOOM_HOME
@@ -747,11 +862,11 @@ function printHelp() {
   console.log(`Vantaloom CLI
 
 Usage:
-  vantaloom install  [--prefix <dir>] [--repo <owner/name>] [--release-tag <tag>] [--github-token <token>] [--package <dir>] [--no-start]
+  vantaloom install  [--prefix <dir>] [--runtime-version <version>] [--npm-registry <url>] [--package <dir>] [--no-start]
   vantaloom install  --local [--prefix <dir>] [--source <repo>] [--build-web] [--no-start]
-  vantaloom update   [--prefix <dir>] [--repo <owner/name>] [--release-tag <tag>] [--github-token <token>] [--no-start]
+  vantaloom update   [--prefix <dir>] [--runtime-version <version>] [--npm-registry <url>] [--no-start]
   vantaloom update   --local [--prefix <dir>] [--source <repo>] [--build-web] [--no-start]
-  vantaloom package  [--source <repo>] [--output <dir>] [--build-web] [--archive]
+  vantaloom package  [--source <repo>] [--output <dir>] [--build-web] [--archive] [--npm-package]
   vantaloom start    [--prefix <dir>] [--component all|api|agent|web]
   vantaloom stop     [--prefix <dir>] [--component all|api|agent|web]
   vantaloom restart  [--prefix <dir>] [--component all|api|agent|web]