@waxhq/wax 0.1.0-alpha.3

package/README.md

@@ -0,0 +1,36 @@
+# @waxhq/wax
+
+Optional alpha npm wrapper for the wax design-system analysis CLI.
+
+```bash
+npm install -g @waxhq/wax@alpha
+wax --help
+```
+
+```bash
+npx @waxhq/wax@alpha --help
+```
+
+During `postinstall`, this package downloads the host `wax` binary from the matching GitHub Release, verifies its `sha256`, validates the archive shape, and exposes `wax` through npm.
+
+Supported hosts:
+
+- macOS arm64 and x64
+- Linux arm64 and x64
+
+The curl installer remains the primary alpha install path while the npm wrapper is validated across supported hosts:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/Daio-io/wax/main/scripts/install.sh | bash
+```
+
+Release maintainers must publish prereleases under the `alpha` dist-tag and configure npm trusted publishing for `Daio-io/wax` + `release.yml` before relying on CI publish. The checked-in package version stays on a snapshot placeholder; release CI rewrites it from the Git tag before publishing.
+
+For local smoke tests, set `WAX_CLI_VERSION` to the release you want to install; otherwise the wrapper resolves the checked-in snapshot placeholder.
+
+Local/test environment variables:
+
+- `WAX_CLI_RELEASE_BASE_URL`: override the release asset base URL, primarily for `file://` test mirrors.
+- `WAX_CLI_VERSION`: override the package version used to select release assets.
+- `WAX_CLI_REPO`: override the GitHub repository used for release downloads.
+- `WAX_CLI_SKIP_DOWNLOAD=1`: skip the postinstall binary download.

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@waxhq/wax",
+  "version": "0.1.0-alpha.3",
+  "description": "npm wrapper for the wax design-system analysis CLI",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Daio-io/wax.git",
+    "directory": "packages/cli"
+  },
+  "bin": {
+    "wax": "./run.js"
+  },
+  "scripts": {
+    "postinstall": "node postinstall.js",
+    "test": "node --test *.test.js"
+  },
+  "files": [
+    "README.md",
+    "postinstall.js",
+    "run.js"
+  ],
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}

package/postinstall.js

@@ -0,0 +1,266 @@
+#!/usr/bin/env node
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const https = require("node:https");
+const os = require("node:os");
+const path = require("node:path");
+const { pipeline } = require("node:stream");
+const { spawnSync } = require("node:child_process");
+
+const PACKAGE_ROOT = __dirname;
+const PACKAGE_JSON = require("./package.json");
+const DEFAULT_REPO = "Daio-io/wax";
+const MAX_REDIRECTS = 5;
+const DOWNLOAD_TIMEOUT_MS = 60_000;
+
+function fail(message) {
+  console.error(`wax postinstall error: ${message}`);
+  console.error("");
+  console.error("Try reinstalling with:");
+  console.error("  npm install -g @waxhq/wax");
+  console.error("");
+  console.error("Or install via curl:");
+  console.error("  curl -fsSL https://raw.githubusercontent.com/Daio-io/wax/main/scripts/install.sh | bash");
+  process.exit(1);
+}
+
+function targetTriple() {
+  const osPart = {
+    darwin: "apple-darwin",
+    linux: "unknown-linux-gnu",
+  }[process.platform];
+
+  const archPart = {
+    arm64: "aarch64",
+    x64: "x86_64",
+  }[process.arch];
+
+  if (!osPart || !archPart) {
+    fail(
+      `unsupported host ${process.platform}/${process.arch}. Supported hosts: darwin/linux on x64 or arm64.`
+    );
+  }
+
+  return `${archPart}-${osPart}`;
+}
+
+function versionTag() {
+  const version = process.env.WAX_CLI_VERSION || PACKAGE_JSON.version;
+  return `v${version.replace(/^v/, "")}`;
+}
+
+function releaseBaseUrl(repo, tag) {
+  if (process.env.WAX_CLI_RELEASE_BASE_URL) {
+    return process.env.WAX_CLI_RELEASE_BASE_URL.replace(/\/+$/, "");
+  }
+  return `https://github.com/${repo}/releases/download/${tag}`;
+}
+
+function download(url, destination, redirectsLeft = MAX_REDIRECTS) {
+  return new Promise((resolve, reject) => {
+    const parsedUrl = new URL(url);
+
+    if (parsedUrl.protocol === "file:") {
+      fs.copyFile(parsedUrl, destination, (error) => {
+        if (error) {
+          reject(error);
+        } else {
+          resolve();
+        }
+      });
+      return;
+    }
+
+    if (parsedUrl.protocol !== "https:") {
+      reject(new Error(`unsupported download URL protocol: ${parsedUrl.protocol}`));
+      return;
+    }
+
+    const request = https.get(
+      url,
+      {
+        headers: {
+          "user-agent": `@waxhq/wax/${PACKAGE_JSON.version}`,
+        },
+      },
+      (response) => {
+        const status = response.statusCode || 0;
+        const location = response.headers.location;
+
+        if (status >= 300 && status < 400 && location) {
+          response.resume();
+          if (redirectsLeft <= 0) {
+            reject(new Error(`too many redirects while downloading ${url}`));
+            return;
+          }
+          const redirectedUrl = new URL(location, url).toString();
+          download(redirectedUrl, destination, redirectsLeft - 1).then(resolve, reject);
+          return;
+        }
+
+        if (status < 200 || status >= 300) {
+          response.resume();
+          reject(new Error(`download failed (${status}) for ${url}`));
+          return;
+        }
+
+        const file = fs.createWriteStream(destination, { mode: 0o600 });
+        pipeline(response, file, (error) => {
+          if (error) {
+            reject(new Error(`download stream failed for ${url}: ${error.message}`));
+          } else {
+            resolve();
+          }
+        });
+      }
+    );
+
+    request.setTimeout(DOWNLOAD_TIMEOUT_MS, () => {
+      request.destroy(new Error(`download timed out after ${DOWNLOAD_TIMEOUT_MS / 1000}s for ${url}`));
+    });
+    request.on("error", reject);
+  });
+}
+
+function sha256(filePath) {
+  const hash = crypto.createHash("sha256");
+  const file = fs.readFileSync(filePath);
+  hash.update(file);
+  return hash.digest("hex");
+}
+
+function expectedSha256(checksumText, archiveName) {
+  for (const line of checksumText.split(/\r?\n/)) {
+    const match = line.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+    if (match && path.basename(match[2].trim()) === archiveName) {
+      return match[1].toLowerCase();
+    }
+  }
+
+  throw new Error(`checksum file did not contain a sha256 for ${archiveName}`);
+}
+
+function runTar(args, cwd) {
+  const result = spawnSync("tar", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+
+  if (result.error && result.error.code === "ENOENT") {
+    fail("required command not found: tar");
+  }
+  if (result.status !== 0) {
+    const detail = result.stderr.trim() || (result.error && result.error.message) || `exit status ${result.status}`;
+    fail(`tar ${args.join(" ")} failed: ${detail}`);
+  }
+
+  return result.stdout;
+}
+
+function archiveEntries(archivePath, cwd) {
+  return runTar(["-tzf", archivePath], cwd)
+    .trim()
+    .split("\n")
+    .filter(Boolean);
+}
+
+function archiveListing(archivePath, cwd) {
+  return runTar(["-tvzf", archivePath], cwd)
+    .trim()
+    .split("\n")
+    .filter(Boolean);
+}
+
+function validateArchive(archivePath, cwd, expectedDir, expectedMember) {
+  const entries = archiveEntries(archivePath, cwd);
+  if (!entries.includes(expectedMember)) {
+    throw new Error(`archive is missing expected entry: ${expectedMember}`);
+  }
+
+  const unexpected = entries.filter((entry) => entry !== `${expectedDir}/` && entry !== expectedMember);
+  if (unexpected.length > 0) {
+    throw new Error(`archive contains unexpected entries: ${unexpected.join(", ")}`);
+  }
+
+  const listing = archiveListing(archivePath, cwd);
+  if (listing.length !== entries.length) {
+    throw new Error("archive listing did not match archive entries");
+  }
+
+  for (const [index, entry] of entries.entries()) {
+    const type = listing[index][0];
+    if (entry === `${expectedDir}/` && type !== "d") {
+      throw new Error(`archive entry is not a directory: ${entry}`);
+    }
+    if (entry === expectedMember && type !== "-") {
+      throw new Error(`archive entry is not a regular file: ${entry}`);
+    }
+  }
+}
+
+async function install() {
+  if (process.env.WAX_CLI_SKIP_DOWNLOAD === "1") {
+    console.log("Skipping wax binary download because WAX_CLI_SKIP_DOWNLOAD=1");
+    return;
+  }
+
+  const repo = process.env.WAX_CLI_REPO || DEFAULT_REPO;
+  const tag = versionTag();
+  const version = tag.replace(/^v/, "");
+  const target = targetTriple();
+  const archiveName = `wax-${version}-${target}.tar.gz`;
+  const archiveUrl = `${releaseBaseUrl(repo, tag)}/${archiveName}`;
+  const checksumUrl = `${archiveUrl}.sha256`;
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "wax-cli-"));
+  const archivePath = path.join(tmpDir, archiveName);
+  const checksumPath = `${archivePath}.sha256`;
+  const extractDir = path.join(tmpDir, "extract");
+  const expectedDir = `wax-${version}-${target}`;
+  const expectedMember = `${expectedDir}/wax`;
+  const installDir = path.join(PACKAGE_ROOT, "bin");
+  const installPath = path.join(installDir, "wax");
+
+  try {
+    console.log(`Installing wax ${version} for ${target}`);
+    console.log(`Download: ${archiveUrl}`);
+
+    await download(archiveUrl, archivePath);
+    await download(checksumUrl, checksumPath);
+
+    const expected = expectedSha256(fs.readFileSync(checksumPath, "utf8"), archiveName);
+    const actual = sha256(archivePath);
+    if (actual !== expected) {
+      fail(`checksum mismatch for ${archiveName}; expected ${expected}, got ${actual}`);
+    }
+
+    validateArchive(archivePath, tmpDir, expectedDir, expectedMember);
+
+    fs.mkdirSync(extractDir, { recursive: true });
+    runTar(["-xzf", archivePath, "-C", extractDir, expectedMember], tmpDir);
+    const extractedBinary = path.join(extractDir, expectedMember);
+    const extractedStat = fs.lstatSync(extractedBinary);
+    if (!extractedStat.isFile()) {
+      fail(`archive entry is not a regular file: ${expectedMember}`);
+    }
+    fs.rmSync(installDir, { recursive: true, force: true });
+    fs.mkdirSync(installDir, { recursive: true });
+    fs.copyFileSync(extractedBinary, installPath);
+    fs.chmodSync(installPath, 0o755);
+
+    console.log(`Installed wax to ${installPath}`);
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+if (require.main === module) {
+  install().catch((error) => fail(error.message));
+}
+
+module.exports = {
+  download,
+  expectedSha256,
+  validateArchive,
+};

package/run.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const binaryPath = path.join(__dirname, "bin", process.platform === "win32" ? "wax.exe" : "wax");
+
+if (!fs.existsSync(binaryPath)) {
+  console.error("wax binary is missing from this @waxhq/wax installation.");
+  console.error("");
+  console.error("Reinstall the package to download the host binary:");
+  console.error("  npm install -g @waxhq/wax");
+  console.error("");
+  console.error("If npm lifecycle scripts were disabled, reinstall without --ignore-scripts.");
+  console.error("If WAX_CLI_SKIP_DOWNLOAD=1 was intentional, provide packages/cli/bin/wax before running.");
+  process.exit(1);
+}
+
+const result = spawnSync(binaryPath, process.argv.slice(2), {
+  stdio: "inherit",
+});
+
+if (result.error) {
+  console.error(`failed to run wax: ${result.error.message}`);
+  process.exit(1);
+}
+
+if (result.signal) {
+  process.kill(process.pid, result.signal);
+} else {
+  process.exit(result.status === null ? 1 : result.status);
+}