create-wxl 0.0.0-stage → 3.1.0

package/LICENSE

@@ -0,0 +1,127 @@
+Educational Community License, Version 2.0 (ECL-2.0)
+Educational Community License
+
+Version 2.0, April 2007
+
+The Educational Community License version 2.0 ("ECL") consists of the Apache 2.0 license, modified to change the 
+scope of the patent grant in section 3 to be specific to the needs of the education communities using this license. 
+The original Apache 2.0 license can be found at: http://www.apache.org/licenses/LICENSE-2.0
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1
+through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or
+are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct
+or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership
+of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source
+code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including
+but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as
+indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the
+Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable
+from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions
+to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright
+owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this
+definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives,
+including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems
+that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding
+communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by
+Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License.
+
+Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly
+perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License.
+
+Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell,
+sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such
+Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with
+the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct
+or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate
+as of the date such litigation is filed. Any patent license granted hereby with respect to contributions by an individual employed
+by an institution or organization is limited to patent claims where the individual that is the author of the Work is also the
+inventor of the patent claims licensed, and where the organization or institution has the right to grant such license under
+applicable grant and research funding agreements. No other express or implied licenses are granted.
+
+4. Redistribution.
+
+You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications,
+and in Source or Object form, provided that You meet the following conditions:
+
+You must give any other recipients of the Work or Derivative Works a copy of this License; and
+You must cause any modified files to carry prominent notices stating that You changed the files; and
+You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution
+notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include
+a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any
+part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative
+Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the
+Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational
+purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute,
+alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed
+as modifying the License.
+You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions
+for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use,
+reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions.
+
+Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor
+shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above,
+nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding
+such Contributions.
+
+6. Trademarks.
+
+This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except
+as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty.
+
+Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions)
+on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any
+warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible
+for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of
+permissions under this License.
+
+8. Limitation of Liability.
+
+In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable
+law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages,
+including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or
+out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure
+or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of
+such damages.
+
+9. Accepting Warranty or Additional Liability.
+
+While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support,
+warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations,
+You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to
+indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by
+reason of your accepting any such warranty or additional liability.

package/bin/create-wxl.mjs

@@ -0,0 +1,155 @@
+#!/usr/bin/env node
+// create-wxl's real entry point (0005-S1, traceability.md "Step order" row 1 and "Signals"):
+// `npm create wxl` / `pnpm create wxl` runs this file. Checks `process.versions.node` BEFORE
+// importing anything else (a too-old Node must not crash trying to parse a later module instead
+// of reporting CW-E01 cleanly); everything else is imported dynamically only after that check.
+//
+// Step 2's package source record check (`dist/source.json`'s fields and the engine's hash) lives
+// entirely inside `run()`'s own step 2 (`src/run.mjs`), not here: this file's own `try`/`catch`
+// below only covers LOADING `dist/` -- a missing file, invalid JSON, or an engine that fails to
+// import at all (a syntax error) -- and turns any of those into `source: null`, `engine:
+// undefined`. `run()` then does argv parsing, the `--no-setup` conflict check and
+// `CREATE_WXL_COMMIT`'s grammar BEFORE it ever looks at `source` (Command grammar: "Argument
+// errors are checked before the package source record"), so an argument error still wins over a
+// broken package (AC-2); when `source` is null, `run()`'s own step 2 fails closed and prints
+// CW-E13 itself, in the environment's language -- this file never prints CW-E13 on its own.
+
+// Used only for the pre-import version gate below (step 1 must run before any project-local
+// module loads); once that gate passes, the REAL minimum (`src/node-version.mjs`) is what every
+// later check uses. Kept distinct so this literal is never mistaken for the one source of truth.
+const MINIMUM_NODE_VERSION_FALLBACK = [22, 6, 0]
+
+function isNodeVersionOkInline(version, minimum = MINIMUM_NODE_VERSION_FALLBACK) {
+  if (!/^\d+(\.\d+)*$/.test(version)) return false
+  const parts = version.split('.').map(Number)
+  for (let i = 0; i < minimum.length; i++) {
+    const have = parts[i] ?? 0
+    const want = minimum[i]
+    if (have > want) return true
+    if (have < want) return false
+  }
+  return true
+}
+
+/** The too-old-Node report (step 1's own failure): reuses `node-version.mjs`'s real minimum and
+ * `messages.mjs`'s real CW-E01 text through `language.mjs`'s real language rule, instead of
+ * hand-duplicating any of the three (S-03: one place for the minimum and the text; S-04: the
+ * same LC_ALL/LC_MESSAGES/LANG-then-Intl fallback `language.mjs` uses, not a shorter hand-rolled
+ * one that stops at `'en'`). Importing these three now is safe: the version decision itself is
+ * already made; this import is only to report it correctly. A Node so old even these tiny,
+ * dependency-free modules fail to load falls back to a hand-written, best-effort English line. */
+async function reportNodeTooOld(version) {
+  let text
+  try {
+    const [{ MINIMUM_NODE_VERSION }, { selectLanguage }, { messages }] = await Promise.all([
+      import('../src/node-version.mjs'),
+      import('../src/language.mjs'),
+      import('../src/messages.mjs'),
+    ])
+    const lang = selectLanguage({ env: process.env })
+    text = messages[lang]['CW-E01']({ running: version, minimum: MINIMUM_NODE_VERSION })
+  } catch {
+    const minimum = MINIMUM_NODE_VERSION_FALLBACK.join('.')
+    text = `CW-E01: the running Node.js "${version}" is older than the minimum "${minimum}"; install a newer Node.js from https://nodejs.org/.`
+  }
+  process.stderr.write(text + '\n')
+}
+
+async function main() {
+  // Step 1: before importing anything else.
+  if (!isNodeVersionOkInline(process.versions.node)) {
+    await reportNodeTooOld(process.versions.node)
+    process.exitCode = 1
+    return
+  }
+
+  const { pathToFileURL, fileURLToPath } = await import('node:url')
+  const { dirname, join } = await import('node:path')
+  const fsp = await import('node:fs/promises')
+  const { readFile } = fsp
+  const { tmpdir } = await import('node:os')
+
+  const { run } = await import('../src/run.mjs')
+  const { createSpawnGitRunner } = await import('../src/git-runner.mjs')
+
+  const here = dirname(fileURLToPath(import.meta.url))
+  const packageRoot = dirname(here)
+
+  // Step 2's load (this file's own catch, traceability.md "Step order" row 2): a missing
+  // `dist/source.json`, invalid JSON, a missing `dist/fork-init.mjs`, or an engine that fails to
+  // import (a syntax error) -- any of these leaves `source` null and `engine` undefined, so
+  // `run()`'s own step 2 (`validateSourceRecord`) fails closed without ever touching `engine`.
+  let source = null
+  let engine
+  try {
+    const sourceText = await readFile(join(packageRoot, 'dist', 'source.json'), 'utf8')
+    source = JSON.parse(sourceText)
+    engine = await import(pathToFileURL(join(packageRoot, 'dist', 'fork-init.mjs')).href)
+  } catch {
+    source = null
+    engine = undefined
+  }
+
+  const packageJson = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'))
+
+  const deps = {
+    env: process.env,
+    cwd: process.cwd(),
+    nodeVersion: process.versions.node,
+    locale: Intl.DateTimeFormat().resolvedOptions().locale,
+    packageVersion: packageJson.version,
+    source,
+    engine,
+    engineFile: join(packageRoot, 'dist', 'fork-init.mjs'),
+    fetchArchive: async (repository, ref, { signal } = {}) => {
+      const response = await fetch(`https://codeload.github.com/${repository}/tar.gz/${ref}`, { signal })
+      const body = new Uint8Array(await response.arrayBuffer())
+      return { status: response.status, body }
+    },
+    downloadTimeoutMs: 120000,
+    tmpRoot: tmpdir(),
+    runGit: createSpawnGitRunner(),
+    fs: fsp,
+    // `process` itself is `deps.signals` (the seam's own dependency list, traceability.md
+    // 0005-S1): `createSignalGuard` (run.mjs, from step 3 on) registers its own listeners
+    // directly on it and removes them once `run` returns, so Node's default SIGINT/SIGTERM/SIGHUP
+    // termination holds before step 3 and after `run` returns -- this file never registers a
+    // listener of its own to re-emit from (that used to suppress the default termination for the
+    // whole run, including steps 1-2, and leave it suppressed after `run` returned). The readline
+    // forwarder (`questions.mjs`) already does `deps.signals.emit('SIGINT')`, which is a real
+    // `process.emit('SIGINT')` here, reaching the guard's own listener the same way an actual
+    // signal would.
+    signals: process,
+    checkpoint: () => {},
+  }
+
+  const io = {
+    stdin: process.stdin,
+    stdout: process.stdout,
+    stderr: process.stderr,
+    interactive: Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY),
+  }
+
+  const argv = process.argv.slice(2)
+  // `process.exitCode` (not `process.exit`): the latter can truncate output still buffered on a
+  // piped stdout/stderr.
+  process.exitCode = await run(argv, io, deps)
+}
+
+// traceability.md "Signals": "An error that is none of the CW codes (a bug) ... is printed as
+// CW-E14 ... and exits 1" -- `run()` already does this for everything inside its own body; this
+// is the same rule for everything OUTSIDE it (reading `package.json`, `process.cwd()`, the
+// dynamic imports above, ...), which used to become an unhandled rejection printing Node's own
+// raw stack trace instead.
+main().catch(async (err) => {
+  let text
+  try {
+    const [{ selectLanguage }, { messages }] = await Promise.all([import('../src/language.mjs'), import('../src/messages.mjs')])
+    const lang = selectLanguage({ env: process.env })
+    text = messages[lang]['CW-E14']({ message: err?.message ?? String(err) })
+  } catch {
+    text = `CW-E14: an unexpected error happened: ${JSON.stringify(err?.message ?? String(err))}.`
+  }
+  process.stderr.write(text + '\n')
+  process.exitCode = 1
+})