create-windy 0.6.6 → 0.6.8

package/template/packages/delivery/src/checksums.ts

@@ -0,0 +1,83 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { sha256File } from "./digest.js";
+import { assertRelativePortablePath } from "./paths.js";
+
+export const releaseChecksumFile = "CHECKSUMS.sha256";
+
+export async function writeReleaseChecksums(
+  root: string,
+  paths: readonly string[],
+): Promise<void> {
+  const normalized = normalizePaths(paths);
+  const lines: string[] = [];
+  for (const path of normalized) {
+    const digest = await sha256File(join(resolve(root), path));
+    lines.push(`${digest.slice("sha256:".length)}  ${path}`);
+  }
+  await writeFile(
+    join(resolve(root), releaseChecksumFile),
+    `${lines.join("\n")}\n`,
+    {
+      flag: "wx",
+      mode: 0o644,
+    },
+  );
+}
+
+export async function verifyReleaseChecksums(
+  root: string,
+  expectedPaths: readonly string[],
+): Promise<void> {
+  const expected = normalizePaths(
+    expectedPaths.filter((path) => path !== releaseChecksumFile),
+  );
+  const records = parseChecksums(
+    await readFile(join(resolve(root), releaseChecksumFile), "utf8"),
+  );
+  if (
+    records.length !== expected.length ||
+    records.some((record, index) => record.path !== expected[index])
+  ) {
+    throw new Error("release CHECKSUMS 文件集合不匹配");
+  }
+  for (const record of records) {
+    if (
+      (await sha256File(join(resolve(root), record.path))) !== record.digest
+    ) {
+      throw new Error(`release CHECKSUMS digest 不匹配：${record.path}`);
+    }
+  }
+}
+
+function parseChecksums(
+  value: string,
+): { path: string; digest: `sha256:${string}` }[] {
+  const records = value
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((line) => {
+      const match = /^([a-f0-9]{64}) {2}(.+)$/.exec(line);
+      if (!match) throw new Error("release CHECKSUMS 格式无效");
+      return {
+        digest: `sha256:${match[1]}` as const,
+        path: assertRelativePortablePath(match[2]!),
+      };
+    })
+    .sort((left, right) => left.path.localeCompare(right.path));
+  if (new Set(records.map(({ path }) => path)).size !== records.length) {
+    throw new Error("release CHECKSUMS 路径重复");
+  }
+  return records;
+}
+
+function normalizePaths(paths: readonly string[]): string[] {
+  const normalized = paths
+    .map(assertRelativePortablePath)
+    .filter((path) => path !== releaseChecksumFile)
+    .sort();
+  if (new Set(normalized).size !== normalized.length) {
+    throw new Error("release 文件路径重复");
+  }
+  return normalized;
+}

package/template/packages/delivery/src/cli.ts

@@ -0,0 +1,331 @@
+#!/usr/bin/env bun
+import { randomBytes } from "node:crypto";
+import {
+  mkdir,
+  mkdtemp,
+  readFile,
+  rename,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { extractPortableTar } from "./archive.js";
+import {
+  inventoryBlobs,
+  partialBlobSize,
+  receiveBlobStream,
+} from "./blob-store.js";
+import {
+  buildDeliveryManifest,
+  createFullBundleFallback,
+  prepareDeterministicRelease,
+} from "./builder.js";
+import { assertSha256Digest } from "./digest.js";
+import {
+  manifestDigest,
+  readManifest,
+  validateManifest,
+  writeManifest,
+} from "./manifest.js";
+import { SshProcessTransport } from "./ssh-process.js";
+import { syncReleaseOverSsh } from "./ssh-sync.js";
+import { pullRegistryRelease } from "./registry.js";
+import {
+  acquireDeliveryLock,
+  preflightReleaseSpace,
+  releaseDeliveryLock,
+  stageRelease,
+  type DeliveryLock,
+  verifyDeliveryLock,
+} from "./staging.js";
+import type { ContentBlob, ReleaseImageV2, ReleasePlatform } from "./types.js";
+
+const capabilities = {
+  schemaVersions: [1, 2],
+  registryByDigest: true,
+  blobDelta: true,
+  resumableBlobTransfer: true,
+} as const;
+
+const [command, ...argv] = process.argv.slice(2);
+
+if (command === "pack") {
+  const options = parseOptions(argv);
+  const releaseRoot = requiredPath(options, "release-dir");
+  const outputDirectory = requiredPath(options, "output-dir");
+  await mkdir(dirname(outputDirectory), { recursive: true });
+  const staging = await mkdtemp(`${outputDirectory}.tmp-`);
+  try {
+    const extractedArchive = join(staging, ".docker-archive");
+    await extractPortableTar(join(releaseRoot, "images.tar"), extractedArchive);
+    const preparedRelease = join(staging, ".prepared-release");
+    await prepareDeterministicRelease(
+      releaseRoot,
+      extractedArchive,
+      preparedRelease,
+    );
+    const fallback = await createFullBundleFallback(
+      preparedRelease,
+      join(staging, "full-bundle.tar.gz"),
+    );
+    const manifest = await buildDeliveryManifest({
+      archiveRoot: extractedArchive,
+      releaseRoot: preparedRelease,
+      storeRoot: staging,
+      product: required(options, "product"),
+      releaseId: required(options, "release-id"),
+      gitSha: required(options, "git-sha"),
+      platform: parsePlatform(required(options, "platform")),
+      createdAt: required(options, "created-at"),
+      images: await readImages(requiredPath(options, "images-json")),
+      fullBundle: { ...fallback, file: "full-bundle.tar.gz" },
+    });
+    await Promise.all([
+      rm(extractedArchive, { recursive: true, force: true }),
+      rm(preparedRelease, { recursive: true, force: true }),
+    ]);
+    const digest = await writeManifest(
+      join(staging, "delivery-manifest.v2.json"),
+      manifest,
+    );
+    await writeFile(join(staging, "DELIVERY-MANIFEST.sha256"), `${digest}\n`, {
+      flag: "wx",
+      mode: 0o644,
+    });
+    await rename(staging, outputDirectory);
+    output({
+      outputDirectory,
+      manifestDigest: digest,
+      fullBundle: manifest.compatibility.fullBundle,
+      totalBytes: manifest.blobs.reduce((total, blob) => total + blob.size, 0),
+      totalBlobs: manifest.blobs.length,
+    });
+  } catch (error) {
+    await rm(staging, { recursive: true, force: true });
+    throw error;
+  }
+} else if (command === "sync-ssh") {
+  const options = parseOptions(argv);
+  const manifest = await readManifest(
+    requiredPath(options, "manifest"),
+    assertSha256Digest(required(options, "manifest-digest")),
+  );
+  const preference = parsePreference(options.get("mode"));
+  const result = await syncReleaseOverSsh({
+    manifest,
+    localStoreRoot: requiredPath(options, "store"),
+    transport: new SshProcessTransport({
+      target: required(options, "target"),
+      remoteBinary: required(options, "remote-binary"),
+      remoteStore: required(options, "remote-store"),
+      remoteInstallRoot: required(options, "remote-install-root"),
+      remoteFallbackRoot: required(options, "remote-fallback-root"),
+    }),
+    ownerToken: randomBytes(24).toString("hex"),
+    preference,
+    fallbackPath: options.has("fallback")
+      ? requiredPath(options, "fallback")
+      : undefined,
+  });
+  output(result);
+} else if (command === "capabilities") {
+  output(capabilities);
+} else if (command === "pull-registry") {
+  const options = parseOptions(argv);
+  const manifest = validateManifest(await readJsonStdin());
+  const digest = assertSha256Digest(required(options, "manifest-digest"));
+  if (manifestDigest(manifest) !== digest) {
+    throw new Error("registry pull 前 manifest digest 不匹配");
+  }
+  output(await pullRegistryRelease(manifest));
+} else if (command === "lock") {
+  const options = parseOptions(argv);
+  const lock = await acquireDeliveryLock(
+    requiredPath(options, "install-root"),
+    required(options, "owner-token"),
+  );
+  output({ locked: true, directory: lock.directory });
+} else if (command === "unlock") {
+  const options = parseOptions(argv);
+  await releaseDeliveryLock(lockFromOptions(options));
+  output({ unlocked: true });
+} else if (command === "inventory") {
+  const options = parseOptions(argv);
+  const blobs = parseBlobs(await readJsonStdin());
+  const present = await inventoryBlobs(requiredPath(options, "store"), blobs);
+  output({ present: [...present].sort() });
+} else if (command === "preflight") {
+  const options = parseOptions(argv);
+  const manifest = validateManifest(await readJsonStdin());
+  const lock = lockFromOptions(options);
+  await verifyDeliveryLock(lock, requiredPath(options, "install-root"));
+  const present = await inventoryBlobs(
+    requiredPath(options, "store"),
+    manifest.blobs,
+  );
+  output(
+    await preflightReleaseSpace(
+      requiredPath(options, "install-root"),
+      requiredPath(options, "store"),
+      manifest,
+      present,
+      optionalInteger(options, "reserve-bytes"),
+    ),
+  );
+} else if (command === "partial") {
+  const options = parseOptions(argv);
+  const blob = blobFromOptions(options);
+  output({
+    offset: await partialBlobSize(requiredPath(options, "store"), blob),
+  });
+} else if (command === "receive") {
+  const options = parseOptions(argv);
+  const result = await receiveBlobStream({
+    storeRoot: requiredPath(options, "store"),
+    blob: blobFromOptions(options),
+    offset: integer(options, "offset"),
+    chunks: stdinChunks(),
+  });
+  output(result);
+} else if (command === "stage") {
+  const options = parseOptions(argv);
+  const manifest = validateManifest(await readJsonStdin());
+  const directory = await stageRelease({
+    installRoot: requiredPath(options, "install-root"),
+    storeRoot: requiredPath(options, "store"),
+    manifest,
+    expectedManifestDigest: assertSha256Digest(
+      required(options, "manifest-digest"),
+    ),
+    lock: lockFromOptions(options),
+    reserveBytes: optionalInteger(options, "reserve-bytes"),
+  });
+  output({ staged: true, directory });
+} else {
+  throw new Error(
+    "用法：windy-delivery pack|sync-ssh|capabilities|pull-registry|lock|unlock|inventory|preflight|partial|receive|stage",
+  );
+}
+
+function parseOptions(argv: readonly string[]): Map<string, string> {
+  const output = new Map<string, string>();
+  for (let index = 0; index < argv.length; index += 2) {
+    const key = argv[index];
+    const value = argv[index + 1];
+    if (
+      !key?.startsWith("--") ||
+      value === undefined ||
+      value.startsWith("--")
+    ) {
+      throw new Error("命令参数必须使用 --name value");
+    }
+    const name = key.slice(2);
+    if (output.has(name)) throw new Error(`参数重复：--${name}`);
+    output.set(name, value);
+  }
+  return output;
+}
+
+function required(options: ReadonlyMap<string, string>, name: string): string {
+  const value = options.get(name);
+  if (!value) throw new Error(`缺少 --${name}`);
+  return value;
+}
+
+function requiredPath(
+  options: ReadonlyMap<string, string>,
+  name: string,
+): string {
+  return resolve(required(options, name));
+}
+
+function integer(options: ReadonlyMap<string, string>, name: string): number {
+  const value = Number(required(options, name));
+  if (!Number.isSafeInteger(value) || value < 0)
+    throw new Error(`--${name} 必须是非负整数`);
+  return value;
+}
+
+function optionalInteger(
+  options: ReadonlyMap<string, string>,
+  name: string,
+): number | undefined {
+  return options.has(name) ? integer(options, name) : undefined;
+}
+
+function blobFromOptions(options: ReadonlyMap<string, string>): ContentBlob {
+  return {
+    digest: assertSha256Digest(required(options, "digest")),
+    size: integer(options, "size"),
+  };
+}
+
+function parsePreference(
+  value: string | undefined,
+): "auto" | "blob-delta" | "full-bundle" {
+  if (value === undefined || value === "auto") return "auto";
+  if (value === "blob-delta" || value === "full-bundle") return value;
+  throw new Error("--mode 仅支持 auto、blob-delta 或 full-bundle");
+}
+
+function parsePlatform(value: string): ReleasePlatform {
+  if (value === "linux/amd64" || value === "linux/arm64") return value;
+  throw new Error("--platform 仅支持 linux/amd64 或 linux/arm64");
+}
+
+async function readImages(path: string): Promise<ReleaseImageV2[]> {
+  const value = JSON.parse(await readFile(path, "utf8"));
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new Error("--images-json 必须是非空数组");
+  }
+  return value as ReleaseImageV2[];
+}
+
+function lockFromOptions(options: ReadonlyMap<string, string>): DeliveryLock {
+  const installRoot = requiredPath(options, "install-root");
+  return {
+    directory: resolve(installRoot, ".delivery-lock"),
+    ownerToken: required(options, "owner-token"),
+  };
+}
+
+function parseBlobs(value: unknown): ContentBlob[] {
+  if (!Array.isArray(value)) throw new Error("stdin 必须是 blob 数组");
+  return value.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw new Error("blob 必须是对象");
+    }
+    const record = item as Record<string, unknown>;
+    if (
+      typeof record.size !== "number" ||
+      !Number.isSafeInteger(record.size) ||
+      record.size < 0
+    ) {
+      throw new Error("blob size 无效");
+    }
+    return { digest: assertSha256Digest(record.digest), size: record.size };
+  });
+}
+
+async function readJsonStdin(): Promise<unknown> {
+  const text = await Bun.stdin.text();
+  if (!text.trim()) throw new Error("stdin 缺少 JSON");
+  return JSON.parse(text);
+}
+
+async function* stdinChunks(): AsyncIterable<Uint8Array> {
+  const reader = Bun.stdin.stream().getReader();
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) return;
+      yield result.value;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+function output(value: unknown): void {
+  console.info(JSON.stringify(value));
+}