audrey 1.1.3 → 1.2.1

package/scripts/finalize-release.mjs

@@ -1,601 +0,0 @@
-#!/usr/bin/env node
-
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const DEFAULT_VERSION = '1.1.1';
-const DEFAULT_ARTIFACT_DIR = '.tmp/release-artifacts';
-const NPM_REGISTRY = 'https://registry.npmjs.org/';
-const RELEASE_COMMANDS = new Set(['git', 'node', 'npm', 'python']);
-const RELEASE_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
-const INHERITED_ENV_KEYS = [
-  'PATH',
-  'Path',
-  'PATHEXT',
-  'SystemRoot',
-  'SYSTEMROOT',
-  'WINDIR',
-  'HOME',
-  'USERPROFILE',
-  'APPDATA',
-  'LOCALAPPDATA',
-  'TEMP',
-  'TMP',
-  'NPM_CONFIG_USERCONFIG',
-  'NPM_TOKEN',
-  'TWINE_USERNAME',
-  'TWINE_PASSWORD',
-];
-
-function fromRoot(path) {
-  return resolve(ROOT, path);
-}
-
-function readJson(path) {
-  return JSON.parse(readFileSync(fromRoot(path), 'utf-8'));
-}
-
-function safeString(value, label) {
-  if (typeof value !== 'string' || value.length === 0 || value.includes('\0')) {
-    throw new Error(`${label} must be a non-empty string without NUL bytes`);
-  }
-  return value;
-}
-
-function safeVersion(value) {
-  const version = safeString(value, '--version');
-  if (!RELEASE_VERSION_PATTERN.test(version)) {
-    throw new Error(`Invalid release version: ${version}`);
-  }
-  return version;
-}
-
-function safeRepoRelativePath(value, label) {
-  const raw = safeString(value, label);
-  const resolved = fromRoot(raw);
-  const rel = relative(ROOT, resolved);
-  if (!rel || rel.startsWith('..') || isAbsolute(rel)) {
-    throw new Error(`${label} must stay inside the Audrey repository`);
-  }
-  return rel.replaceAll('\\', '/');
-}
-
-function normalizeArgs(args) {
-  args.version = safeVersion(args.version);
-  args.artifactDir = safeRepoRelativePath(args.artifactDir, '--artifact-dir');
-  if (args.commitMessage !== null)
-    args.commitMessage = safeString(args.commitMessage, '--commit-message');
-  if (args.npmOtp !== null) args.npmOtp = safeString(args.npmOtp, '--npm-otp');
-  return args;
-}
-
-function releaseEnv(extra = {}) {
-  const env = {};
-  for (const key of INHERITED_ENV_KEYS) {
-    if (process.env[key]) env[key] = process.env[key];
-  }
-  for (const [key, value] of Object.entries(extra)) {
-    env[key] = safeString(String(value), `environment ${key}`);
-  }
-  return {
-    ...env,
-    GIT_TERMINAL_PROMPT: '0',
-    GCM_INTERACTIVE: 'never',
-    GIT_ASKPASS: '',
-    SSH_ASKPASS: '',
-    TWINE_NON_INTERACTIVE: '1',
-  };
-}
-
-function parseArgs(argv = process.argv.slice(2)) {
-  const args = {
-    version: DEFAULT_VERSION,
-    artifactDir: DEFAULT_ARTIFACT_DIR,
-    apply: false,
-    json: false,
-    commit: false,
-    tag: false,
-    push: false,
-    pack: false,
-    sourceBundle: false,
-    publishNpm: false,
-    publishPypi: false,
-    npmOtp: null,
-    commitMessage: null,
-  };
-
-  for (let i = 0; i < argv.length; i++) {
-    const token = argv[i];
-    if ((token === '--version' || token === '--target-version') && argv[i + 1])
-      args.version = argv[++i];
-    else if (token === '--artifact-dir' && argv[i + 1]) args.artifactDir = argv[++i];
-    else if (token === '--commit-message' && argv[i + 1]) args.commitMessage = argv[++i];
-    else if (token === '--npm-otp' && argv[i + 1]) args.npmOtp = argv[++i];
-    else if (token === '--apply') args.apply = true;
-    else if (token === '--json') args.json = true;
-    else if (token === '--commit') args.commit = true;
-    else if (token === '--tag') args.tag = true;
-    else if (token === '--push') args.push = true;
-    else if (token === '--pack') args.pack = true;
-    else if (token === '--source-bundle') args.sourceBundle = true;
-    else if (token === '--publish-npm') args.publishNpm = true;
-    else if (token === '--publish-pypi') args.publishPypi = true;
-    else if (token === '--all') {
-      args.commit = true;
-      args.tag = true;
-      args.push = true;
-      args.pack = true;
-      args.sourceBundle = true;
-      args.publishNpm = true;
-      args.publishPypi = true;
-    } else if (token === '--help' || token === '-h') args.help = true;
-    else throw new Error(`Unknown argument: ${token}`);
-  }
-
-  return normalizeArgs(args);
-}
-
-function usage() {
-  return `Usage: node scripts/finalize-release.mjs [options]
-
-Options:
-  --apply                         Execute selected release actions. Dry-run by default.
-  --version <version>             Release version. Default: ${DEFAULT_VERSION}.
-  --artifact-dir <path>           Local ignored artifact directory. Default: ${DEFAULT_ARTIFACT_DIR}.
-  --commit                        git add + commit the release candidate.
-  --tag                           Create annotated v<version> tag.
-  --push                          Push HEAD and tags to origin/master.
-  --pack                          Create npm tarball and artifact manifest.
-  --source-bundle                 Create ignored Git bundle for external source publication.
-  --publish-npm                   Publish the packaged npm tarball.
-  --publish-pypi                  Upload Python wheel/sdist with twine.
-  --npm-otp <code>                Optional npm one-time password.
-  --commit-message <message>      Override the default release commit message.
-  --all                           Commit, tag, push, pack, and publish npm/PyPI.
-  --json                          Print the machine-readable plan/report.
-`;
-}
-
-function commandFor(command, args) {
-  if (!RELEASE_COMMANDS.has(command)) {
-    throw new Error(`Unsupported release command: ${command}`);
-  }
-  const safeArgs = args.map((arg, index) =>
-    safeString(String(arg), `${command} argument ${index + 1}`),
-  );
-  if (process.platform === 'win32' && command === 'npm') {
-    return { command: 'cmd.exe', args: ['/d', '/c', 'npm', ...safeArgs] };
-  }
-  return { command, args: safeArgs };
-}
-
-function run(command, args, options = {}) {
-  const prepared = commandFor(command, args);
-  const result = spawnSync(prepared.command, prepared.args, {
-    cwd: ROOT,
-    encoding: 'utf-8',
-    stdio: options.stdio ?? 'pipe',
-    timeout: options.timeout ?? 120_000,
-    env: releaseEnv(options.env),
-  });
-  return {
-    command: [command, ...args].join(' '),
-    ok: result.status === 0,
-    status: result.status,
-    stdout: result.stdout?.trim() ?? '',
-    stderr: result.stderr?.trim() ?? '',
-    error: result.error?.message ?? null,
-  };
-}
-
-function commandFailure(result) {
-  return result.error || result.stderr || result.stdout || `exited ${result.status}`;
-}
-
-function assertOk(result) {
-  if (!result.ok) throw new Error(`${result.command} failed: ${commandFailure(result)}`);
-  return result;
-}
-
-function sha256(path) {
-  return createHash('sha256').update(readFileSync(path)).digest('hex');
-}
-
-function listArtifacts(artifactDir, version) {
-  const files = [];
-  const npmTarball = join(artifactDir, `audrey-${version}.tgz`);
-  const gitBundle = join(artifactDir, `audrey-${version}.git.bundle`);
-  if (existsSync(npmTarball)) files.push(npmTarball);
-  if (existsSync(gitBundle)) files.push(gitBundle);
-
-  const pythonDist = fromRoot('python/dist');
-  if (existsSync(pythonDist)) {
-    for (const name of readdirSync(pythonDist)) {
-      if (name.includes(version) && (name.endsWith('.whl') || name.endsWith('.tar.gz'))) {
-        files.push(join(pythonDist, name));
-      }
-    }
-  }
-
-  return files.map(path => ({
-    path: path.startsWith(ROOT)
-      ? path.slice(ROOT.length + 1).replaceAll('\\', '/')
-      : path.replaceAll('\\', '/'),
-    sha256: sha256(path),
-    bytes: readFileSync(path).byteLength,
-  }));
-}
-
-function npmTarballPath(artifactDir, version) {
-  return join(artifactDir, `audrey-${version}.tgz`);
-}
-
-function pythonArtifactPaths(version) {
-  const dist = fromRoot('python/dist');
-  if (!existsSync(dist)) return [];
-  return readdirSync(dist)
-    .filter(name => name.includes(version) && (name.endsWith('.whl') || name.endsWith('.tar.gz')))
-    .map(name => join('python/dist', name));
-}
-
-function pypiCredentialEnv() {
-  if (process.env.TWINE_PASSWORD) return {};
-  const token = process.env.PYPI_API_TOKEN ?? process.env.UV_PUBLISH_TOKEN;
-  if (!token) return null;
-  return {
-    TWINE_USERNAME: process.env.TWINE_USERNAME ?? '__token__',
-    TWINE_PASSWORD: token,
-  };
-}
-
-function selectedActions(args) {
-  return [
-    args.commit && 'commit',
-    args.tag && 'tag',
-    args.push && 'push',
-    args.pack && 'pack',
-    args.sourceBundle && 'source-bundle',
-    args.publishNpm && 'publish-npm',
-    args.publishPypi && 'publish-pypi',
-  ].filter(Boolean);
-}
-
-function ensurePackageVersion(version) {
-  const pkg = readJson('package.json');
-  if (pkg.version !== version) {
-    throw new Error(`package.json version is ${pkg.version}, expected ${version}`);
-  }
-  return pkg;
-}
-
-function buildPlan(args) {
-  const pkg = ensurePackageVersion(args.version);
-  const tagName = `v${args.version}`;
-  const artifactDir = fromRoot(args.artifactDir);
-  const commitMessage = args.commitMessage ?? `Release Audrey ${args.version}`;
-  const actions = selectedActions(args);
-  const commands = [];
-  const blockers = [];
-
-  commands.push('node scripts/verify-release-readiness.mjs --allow-pending --json');
-  if (args.commit) commands.push('git add --all', `git commit -m "${commitMessage}"`);
-  if (args.tag) commands.push(`git tag -a ${tagName} -m "Audrey ${args.version}"`);
-  if (args.push) commands.push(`git push origin HEAD:master --follow-tags`);
-  if (args.pack) commands.push(`npm pack --pack-destination ${args.artifactDir}`);
-  if (args.sourceBundle)
-    commands.push(
-      `git bundle create ${args.artifactDir}/audrey-${args.version}.git.bundle refs/heads/master refs/tags/v${args.version}`,
-    );
-  if (args.publishNpm) {
-    const otp = args.npmOtp ? ' --otp <provided>' : '';
-    commands.push(
-      `npm publish ${args.artifactDir}/audrey-${args.version}.tgz --access public --registry ${NPM_REGISTRY}${otp}`,
-    );
-  }
-  if (args.publishPypi)
-    commands.push(`python -m twine upload python/dist/audrey_memory-${args.version}*`);
-
-  if (actions.length === 0) {
-    blockers.push(
-      'Select at least one action such as --pack, --source-bundle, --commit, --tag, --push, --publish-npm, or --publish-pypi',
-    );
-  }
-  if (args.publishPypi && !pypiCredentialEnv()) {
-    blockers.push('Set TWINE_PASSWORD, PYPI_API_TOKEN, or UV_PUBLISH_TOKEN before --publish-pypi');
-  }
-
-  return {
-    schemaVersion: '1.0.0',
-    suite: 'Audrey release finalization',
-    generatedAt: new Date().toISOString(),
-    apply: args.apply,
-    version: args.version,
-    packageName: pkg.name,
-    tagName,
-    artifactDir: args.artifactDir,
-    actions,
-    commands,
-    blockers,
-    results: [],
-    artifacts: listArtifacts(artifactDir, args.version),
-  };
-}
-
-function runReadiness(plan) {
-  const readiness = run(
-    'node',
-    ['scripts/verify-release-readiness.mjs', '--allow-pending', '--json'],
-    { timeout: 180_000 },
-  );
-  plan.results.push(readiness);
-  assertOk(readiness);
-  const report = JSON.parse(readiness.stdout);
-  if (!report.ok) {
-    throw new Error(
-      `release readiness failed: ${report.failures?.join('; ') || 'unknown failure'}`,
-    );
-  }
-  plan.readiness = {
-    ok: report.ok,
-    ready: report.ready,
-    blockers: report.blockers ?? [],
-  };
-}
-
-function gitObjectEnv(timestamp) {
-  const objectDir = fromRoot('.tmp/git-object-store');
-  const indexFile = fromRoot('.tmp/release.index');
-  return {
-    GIT_OBJECT_DIRECTORY: objectDir,
-    GIT_ALTERNATE_OBJECT_DIRECTORIES: fromRoot('.git/objects'),
-    GIT_INDEX_FILE: indexFile,
-    GIT_AUTHOR_NAME: 'Tyler Eveland',
-    GIT_AUTHOR_EMAIL: 'j.tyler.eveland@gmail.com',
-    GIT_COMMITTER_NAME: 'Tyler Eveland',
-    GIT_COMMITTER_EMAIL: 'j.tyler.eveland@gmail.com',
-    GIT_AUTHOR_DATE: `${timestamp} -0500`,
-    GIT_COMMITTER_DATE: `${timestamp} -0500`,
-  };
-}
-
-function createSourceBundle(args, plan) {
-  const objectDir = fromRoot('.tmp/git-object-store');
-  const indexFile = fromRoot('.tmp/release.index');
-  const gitDir = fromRoot('.tmp/release-gitdir');
-  const artifactDir = fromRoot(args.artifactDir);
-  const bundlePath = join(artifactDir, `audrey-${args.version}.git.bundle`);
-  const headTime = assertOk(run('git', ['show', '-s', '--format=%ct', 'HEAD'])).stdout;
-  const timestamp = Number.parseInt(headTime, 10) + 1;
-  const env = gitObjectEnv(timestamp);
-
-  rmSync(objectDir, { recursive: true, force: true });
-  rmSync(indexFile, { force: true });
-  rmSync(gitDir, { recursive: true, force: true });
-  mkdirSync(objectDir, { recursive: true });
-  mkdirSync(artifactDir, { recursive: true });
-
-  for (const result of [
-    run('git', ['read-tree', 'HEAD'], { env }),
-    run('git', ['add', '--all'], { env }),
-  ]) {
-    plan.results.push(result);
-    assertOk(result);
-  }
-
-  const tree = assertOk(run('git', ['write-tree'], { env })).stdout;
-  const commit = assertOk(
-    run(
-      'git',
-      [
-        'commit-tree',
-        tree,
-        '-p',
-        'HEAD',
-        '-m',
-        args.commitMessage ?? `Release Audrey ${args.version}`,
-      ],
-      { env },
-    ),
-  ).stdout;
-  const tagContent = [
-    `object ${commit}`,
-    'type commit',
-    `tag v${args.version}`,
-    `tagger Tyler Eveland <j.tyler.eveland@gmail.com> ${timestamp + 1} -0500`,
-    '',
-    `Audrey ${args.version}`,
-    '',
-  ].join('\n');
-  const tagFile = fromRoot('.tmp/release-tag.txt');
-  writeFileSync(tagFile, tagContent, 'utf-8');
-  const tag = assertOk(run('git', ['hash-object', '-t', 'tag', '-w', tagFile], { env })).stdout;
-
-  mkdirSync(join(gitDir, 'refs', 'heads'), { recursive: true });
-  mkdirSync(join(gitDir, 'refs', 'tags'), { recursive: true });
-  writeFileSync(join(gitDir, 'HEAD'), 'ref: refs/heads/master\n', 'utf-8');
-  writeFileSync(
-    join(gitDir, 'config'),
-    '[core]\n\trepositoryformatversion = 0\n\tfilemode = false\n\tbare = true\n',
-    'utf-8',
-  );
-  writeFileSync(join(gitDir, 'refs', 'heads', 'master'), `${commit}\n`, 'utf-8');
-  writeFileSync(join(gitDir, 'refs', 'tags', `v${args.version}`), `${tag}\n`, 'utf-8');
-
-  const bundle = run(
-    'git',
-    [
-      '--git-dir',
-      gitDir,
-      'bundle',
-      'create',
-      bundlePath,
-      'refs/heads/master',
-      `refs/tags/v${args.version}`,
-    ],
-    {
-      env: {
-        GIT_OBJECT_DIRECTORY: objectDir,
-        GIT_ALTERNATE_OBJECT_DIRECTORIES: fromRoot('.git/objects'),
-      },
-      timeout: 180_000,
-    },
-  );
-  plan.results.push(bundle);
-  assertOk(bundle);
-
-  const verify = run('git', ['bundle', 'verify', bundlePath], { timeout: 60_000 });
-  plan.results.push(verify);
-  assertOk(verify);
-
-  const objectReport = {
-    tree,
-    commit,
-    tag,
-    objectDir: '.tmp/git-object-store',
-    indexFile: '.tmp/release.index',
-    bundle: args.artifactDir.replaceAll('\\', '/') + `/audrey-${args.version}.git.bundle`,
-  };
-  writeFileSync(
-    fromRoot('.tmp/release-git-object-report.json'),
-    `${JSON.stringify(objectReport, null, 2)}\n`,
-    'utf-8',
-  );
-  plan.sourceControl = objectReport;
-}
-
-function execute(args, plan) {
-  const artifactDir = fromRoot(args.artifactDir);
-  mkdirSync(artifactDir, { recursive: true });
-  runReadiness(plan);
-
-  if (args.commit) {
-    assertOk(run('git', ['add', '--all']));
-    const commitMessage = args.commitMessage ?? `Release Audrey ${args.version}`;
-    const commit = run('git', ['commit', '-m', commitMessage]);
-    plan.results.push(commit);
-    assertOk(commit);
-  }
-
-  if (args.tag) {
-    const tag = run('git', ['tag', '-a', `v${args.version}`, '-m', `Audrey ${args.version}`]);
-    plan.results.push(tag);
-    assertOk(tag);
-  }
-
-  if (args.push) {
-    const push = run(
-      'git',
-      [
-        '-c',
-        'http.sslBackend=openssl',
-        '-c',
-        'credential.helper=',
-        '-c',
-        'core.askPass=',
-        'push',
-        'origin',
-        'HEAD:master',
-        '--follow-tags',
-      ],
-      { timeout: 45_000 },
-    );
-    plan.results.push(push);
-    assertOk(push);
-  }
-
-  if (args.pack || args.publishNpm) {
-    const pack = run('npm', ['pack', '--pack-destination', args.artifactDir], { timeout: 180_000 });
-    plan.results.push(pack);
-    assertOk(pack);
-  }
-
-  if (args.sourceBundle) {
-    createSourceBundle(args, plan);
-  }
-
-  if (args.publishNpm) {
-    const whoami = run('npm', ['whoami', '--registry', NPM_REGISTRY]);
-    plan.results.push(whoami);
-    assertOk(whoami);
-    const publishArgs = [
-      'publish',
-      npmTarballPath(args.artifactDir, args.version),
-      '--access',
-      'public',
-      '--registry',
-      NPM_REGISTRY,
-    ];
-    if (args.npmOtp) publishArgs.push('--otp', args.npmOtp);
-    const publish = run('npm', publishArgs, { timeout: 180_000 });
-    plan.results.push(publish);
-    assertOk(publish);
-  }
-
-  if (args.publishPypi) {
-    const uploadEnv = pypiCredentialEnv();
-    if (!uploadEnv)
-      throw new Error(
-        'Missing PyPI credentials: set TWINE_PASSWORD, PYPI_API_TOKEN, or UV_PUBLISH_TOKEN',
-      );
-    const build = run('npm', ['run', 'python:release:check'], { timeout: 180_000 });
-    plan.results.push(build);
-    assertOk(build);
-    const artifacts = pythonArtifactPaths(args.version);
-    if (artifacts.length === 0) throw new Error(`No Python artifacts found for ${args.version}`);
-    const upload = run('python', ['-m', 'twine', 'upload', ...artifacts], {
-      timeout: 180_000,
-      env: uploadEnv,
-    });
-    plan.results.push(upload);
-    assertOk(upload);
-  }
-
-  plan.artifacts = listArtifacts(artifactDir, args.version);
-  writeFileSync(
-    join(artifactDir, 'release-finalize-report.json'),
-    `${JSON.stringify(plan, null, 2)}\n`,
-    'utf-8',
-  );
-}
-
-function printPlan(plan, json) {
-  if (json) {
-    console.log(JSON.stringify(plan, null, 2));
-    return;
-  }
-
-  console.log(`${plan.apply ? 'Ran' : 'Planned'} Audrey ${plan.version} release finalization`);
-  console.log(`Actions: ${plan.actions.length ? plan.actions.join(', ') : 'none selected'}`);
-  for (const command of plan.commands) console.log(`- ${command}`);
-  if (plan.blockers.length) {
-    console.log('Blockers:');
-    for (const blocker of plan.blockers) console.log(`- ${blocker}`);
-  }
-  if (plan.artifacts.length) {
-    console.log('Artifacts:');
-    for (const artifact of plan.artifacts)
-      console.log(`- ${artifact.path} sha256=${artifact.sha256}`);
-  }
-}
-
-async function main() {
-  const args = parseArgs();
-  if (args.help) {
-    console.log(usage());
-    return;
-  }
-
-  const plan = buildPlan(args);
-  if (args.apply && plan.blockers.length === 0) execute(args, plan);
-  printPlan(plan, args.json);
-  if (plan.blockers.length) process.exit(1);
-}
-
-main().catch(error => {
-  console.error(error.message);
-  process.exit(1);
-});