dew 0.0.52 → 0.7.30

package/bin/dew

@@ -1,10 +1,215 @@
 #!/usr/bin/env node
-
 "use strict";
-var path = require( 'path' );
-var fs = require( 'fs' );
-var lib = path.join( path.dirname( fs.realpathSync( __filename ) ), '../lib' );
 
-var dew = require( lib + '/dew.js' );
+// Thin dispatcher for @solcreek/dew.
+//
+// First run downloads the matching native binary from the GitHub Release
+// for this package version, verifies SHA256 against checksums.txt, and
+// caches in DEW_CACHE_DIR. Subsequent runs spawn the cached binary directly.
+//
+// We don't ship the binary inside the npm package — it lives in
+// goreleaser-produced tarballs on GH Releases. This keeps the npm tarball
+// tiny (no binary bytes touched by npm install), avoids per-platform
+// publish setups, and lets brew/install.sh/direct download all consume
+// the same exact bytes from one canonical source.
+//
+// Override: DEW_BINARY=/path/to/dew for local builds and testing.
+// Override: DEW_CACHE_DIR=/path overrides the cache location.
+// Set DEW_VERIFY_COSIGN=1 to hard-require cosign signature verification.
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const https = require("https");
+const crypto = require("crypto");
+const zlib = require("zlib");
+const { spawnSync } = require("child_process");
+const { pipeline } = require("stream/promises");
+const { createWriteStream, createReadStream } = require("fs");
+
+const pkg = require("../package.json");
+const VERSION = pkg.version;
+const REPO = "solcreek/dew";
+
+const SUPPORTED = {
+  "darwin-arm64": { goos: "darwin",  goarch: "arm64", binName: "dew" },
+  "darwin-x64":   { goos: "darwin",  goarch: "amd64", binName: "dew" },
+  "linux-x64":    { goos: "linux",   goarch: "amd64", binName: "dew" },
+  "linux-arm64":  { goos: "linux",   goarch: "arm64", binName: "dew" },
+  "win32-x64":    { goos: "windows", goarch: "amd64", binName: "dew.exe" },
+};
+
+function fatal(msg) {
+  process.stderr.write(`dew: ${msg}\n`);
+  process.exit(1);
+}
+
+function cacheDir() {
+  if (process.env.DEW_CACHE_DIR) return process.env.DEW_CACHE_DIR;
+  const xdg = process.env.XDG_DATA_HOME;
+  const base = xdg || path.join(os.homedir(), ".local", "share");
+  return path.join(base, "dew", "bin", VERSION);
+}
+
+function get(url) {
+  return new Promise((resolve, reject) => {
+    https.get(url, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        return resolve(get(res.headers.location));
+      }
+      if (res.statusCode !== 200) {
+        return reject(new Error(`HTTP ${res.statusCode} ${url}`));
+      }
+      resolve(res);
+    }).on("error", reject);
+  });
+}
+
+async function downloadTo(url, destPath) {
+  const res = await get(url);
+  await pipeline(res, createWriteStream(destPath));
+}
+
+async function fetchText(url) {
+  const res = await get(url);
+  let body = "";
+  for await (const chunk of res) body += chunk;
+  return body;
+}
+
+function sha256OfFile(p) {
+  const h = crypto.createHash("sha256");
+  return new Promise((resolve, reject) => {
+    const s = createReadStream(p);
+    s.on("data", (d) => h.update(d));
+    s.on("end", () => resolve(h.digest("hex")));
+    s.on("error", reject);
+  });
+}
+
+// Extract a single named file from a tar.gz with no native deps.
+// Tar layout: 512-byte header, payload padded to 512.
+function extractTarGz(archivePath, outDir, binName) {
+  const buf = zlib.gunzipSync(fs.readFileSync(archivePath));
+  let off = 0;
+  while (off + 512 <= buf.length) {
+    const header = buf.subarray(off, off + 512);
+    const nameRaw = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+    if (!nameRaw) { off += 512; continue; }
+    const sizeOctal = header.subarray(124, 136).toString("utf8").replace(/[\0 ]+$/, "");
+    const size = parseInt(sizeOctal, 8) || 0;
+    const typeflag = String.fromCharCode(header[156]) || "0";
+    const dataStart = off + 512;
+    const dataEnd = dataStart + size;
+    if ((typeflag === "0" || typeflag === "") && path.basename(nameRaw) === binName) {
+      const dest = path.join(outDir, binName);
+      fs.writeFileSync(dest, buf.subarray(dataStart, dataEnd));
+      fs.chmodSync(dest, 0o755);
+      return true;
+    }
+    off = dataEnd + (size % 512 === 0 ? 0 : 512 - (size % 512));
+  }
+  return false;
+}
+
+async function maybeVerifyCosign(dir, sumsBody) {
+  const verifyMode = process.env.DEW_VERIFY_COSIGN || "";
+  const cosignAvailable = spawnSync("cosign", ["version"], { stdio: "ignore" }).status === 0;
+  if (verifyMode !== "1" && !cosignAvailable) return;
+
+  const base = `https://github.com/${REPO}/releases/download/v${VERSION}`;
+  const sumsPath = path.join(dir, "checksums.txt");
+  const sigPath  = path.join(dir, "checksums.txt.sig");
+  const pemPath  = path.join(dir, "checksums.txt.pem");
+  fs.writeFileSync(sumsPath, sumsBody);
+  try {
+    await downloadTo(`${base}/checksums.txt.sig`, sigPath);
+    await downloadTo(`${base}/checksums.txt.pem`, pemPath);
+  } catch (e) {
+    if (verifyMode === "1") fatal(`cosign sig fetch failed: ${e.message}`);
+    process.stderr.write("dew: cosign verification skipped (signature absent)\n");
+    return;
+  }
+  const r = spawnSync("cosign", [
+    "verify-blob",
+    "--certificate", pemPath,
+    "--signature",   sigPath,
+    "--certificate-identity-regexp",
+      `^https://github.com/${REPO}/\\.github/workflows/release\\.yml@refs/tags/v[0-9]+\\.[0-9]+\\.[0-9]+`,
+    "--certificate-oidc-issuer", "https://token.actions.githubusercontent.com",
+    sumsPath,
+  ], { stdio: verifyMode === "1" ? "inherit" : "pipe" });
+  if (r.status !== 0) {
+    if (verifyMode === "1") fatal("cosign verification failed");
+    process.stderr.write("dew: cosign verification failed (continuing — set DEW_VERIFY_COSIGN=1 to enforce)\n");
+    return;
+  }
+  process.stderr.write("dew: cosign verified\n");
+}
+
+async function ensureBinary() {
+  const triple = `${process.platform}-${process.arch}`;
+  const spec = SUPPORTED[triple];
+  if (!spec) {
+    fatal(
+      `${process.platform}/${process.arch} is not a supported platform.\n` +
+      `Supported: ${Object.keys(SUPPORTED).join(", ")}.\n` +
+      `If you have built dew from source, set DEW_BINARY=/path/to/dew.`,
+    );
+  }
+
+  const dir = cacheDir();
+  const binPath = path.join(dir, spec.binName);
+  if (fs.existsSync(binPath)) return binPath;
+
+  fs.mkdirSync(dir, { recursive: true });
+  const tarName = `dew_${VERSION}_${spec.goos}_${spec.goarch}.tar.gz`;
+  const base    = `https://github.com/${REPO}/releases/download/v${VERSION}`;
+  const tarUrl  = `${base}/${tarName}`;
+  const sumUrl  = `${base}/checksums.txt`;
+  const tarPath = path.join(dir, tarName);
+
+  process.stderr.write(`dew: downloading ${tarName}\n`);
+  try {
+    await downloadTo(tarUrl, tarPath);
+  } catch (e) {
+    fatal(`download failed: ${e.message}\n  Set DEW_BINARY=/path/to/dew to bypass.`);
+  }
+
+  process.stderr.write(`dew: verifying checksum\n`);
+  let sums;
+  try { sums = await fetchText(sumUrl); }
+  catch (e) { fatal(`could not fetch checksums.txt: ${e.message}`); }
+  const line = sums.split("\n").find((l) => l.endsWith(`  ${tarName}`));
+  if (!line) fatal(`checksums.txt has no entry for ${tarName}`);
+  const expected = line.split(/\s+/)[0];
+  const actual = await sha256OfFile(tarPath);
+  if (actual !== expected) {
+    fs.unlinkSync(tarPath);
+    fatal(`checksum mismatch for ${tarName}\n  expected ${expected}\n  got      ${actual}`);
+  }
+
+  await maybeVerifyCosign(dir, sums);
+
+  process.stderr.write(`dew: extracting\n`);
+  if (!extractTarGz(tarPath, dir, spec.binName)) {
+    fatal(`tarball missing ${spec.binName}`);
+  }
+  fs.unlinkSync(tarPath);
+  return binPath;
+}
 
-dew();
+(async () => {
+  const override = process.env.DEW_BINARY;
+  let bin;
+  if (override) {
+    if (!fs.existsSync(override)) fatal(`DEW_BINARY=${override} does not exist`);
+    bin = override;
+  } else {
+    bin = await ensureBinary();
+  }
+  const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+  if (result.error) fatal(result.error.message);
+  process.exit(result.status === null ? 1 : result.status);
+})().catch((e) => fatal(e.message));

package/package.json

@@ -1,34 +1,23 @@
 {
   "name": "dew",
-  "author": "Will LaBranche",
-  "version": "0.0.52",
-  "description": "a tool to quickly build files and tests",
+  "version": "0.7.30",
+  "description": "Sandboxed Linux compute, agent-native and human-friendly.",
+  "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/wlabranche/dew.git"
-  },
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/wlabranche/dew/issues"
+    "url": "git+https://github.com/solcreek/dew.git"
   },
-  "scripts": {
-    "test": "echo yay"
+  "bin": {
+    "dew": "bin/dew"
   },
-  "homepage": "https://github.com/wlabranche/dew",
-  "main": "./lib/dew",
-  "keywords": [
-    "make",
-    "tests",
-    "magic"
+  "files": [
+    "bin/dew",
+    "README.md"
   ],
-  "bin": {
-    "dew": "./bin/dew",
-    "undew": "./bin/undew",
-    "detest": "./bin/detest"
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
   },
-  "preferGlobal": true,
-  "dependencies": {},
   "engines": {
-    "node": "*"
+    "node": ">=18"
   }
 }

package/.npmignore

@@ -1,27 +0,0 @@
-# Logs
-logs
-*.log
-
-# Runtime data
-pids
-*.pid
-*.seed
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-
-# gulp intermediate storage
-.gulp
-
-# Compiled binary addons (http://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directory
-# Deployed apps should consider commenting this line out:
-# see https://npmjs.org/doc/faq.html#Should-I-check-my-node_modules-folder-into-git
-node_modules
-
-test

package/.travis.yml

@@ -1,3 +0,0 @@
-language: node_js
-node_js:
-  - "0.10"

package/LICENSE

@@ -1,21 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2014 Will LaBranche
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/README.md

@@ -1,19 +0,0 @@
-dew [![NPM](https://nodei.co/npm/dew.png?mini=true)](https://nodei.co/npm/dew/) [![Build Status](http://img.shields.io/travis-ci/wlabranche/dew.svg?branch=master&style=flat)](https://travis-ci.org/wlabranche/dew)
-====
-
-```
-npm install dew -g
-```
-`dew` creates a file, tests for that file, and add it to other files dependencies (when specified, not yet impletemented).
-
-This is super alpha, I hope to get it doing more soon.
-
-As of now, this only works on javascript and coffeescript files, it defaults to javascript.
-To use make and remove coffeescript files use the full path name.
-
-
-`dew <filename>` will generate a file and a test file for you, basically it's an optimized touch.
-
-`undew <filename>` will remove the file and any tests associated with it.
-
-`detest <filename>` removes test file for specified file, currently assumes '-test'.

package/bin/detest

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-
-"use strict";
-var path = require( 'path' );
-var fs = require( 'fs' );
-var lib = path.join( path.dirname( fs.realpathSync( __filename ) ), '../lib' );
-
-var detest = require( lib + '/detest.js' );
-
-detest();

package/bin/undew

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-
-"use strict";
-var path = require( 'path' );
-var fs = require( 'fs' );
-var lib = path.join( path.dirname( fs.realpathSync( __filename ) ), '../lib' );
-
-var undew = require( lib + '/undew.js' );
-
-undew();

package/lib/detest.js

@@ -1,23 +0,0 @@
-'use strict';
-
-var fs = require( 'fs' );
-var path = require( 'path' );
-
-module.exports = function() {
-  var file, suffix, full;
-
-  if ( process.argv.length > 2 ) {
-    file = process.argv[2].split( '.' )[0];
-    suffix = process.argv[2].split( '.' )[1] || 'js';
-    full = file + '-file' + '.' + suffix;
-    if (fs.existsSync( file + '-test' + '.' + suffix ) ) {
-      fs.unlinkSync(file + '-test' + '.' + suffix);
-      console.log( 'the test shoudld be gone' );
-    } else {
-      console.log( 'there isn\'t a test for that...' );
-    }
-  } else {
-    // in the future this may want to ask about removing all tests from dir
-    console.log( 'you need to want to destroy something...' );
-  }
-};

package/lib/dew.js

@@ -1,35 +0,0 @@
-'use strict';
-
-var fs = require( 'fs' );
-var makeFile = require( './makeFile.js' );
-var makeTest = require( './makeTest.js' );
-
-module.exports = function() {
-  var file, suffix, output, testFile;
-  if ( process.argv.length > 2 ){
-    file = process.argv[2].split( '.' )[0];
-    suffix = process.argv[2].split( '.' )[1] || 'js';
-    if ( suffix !== 'js' && suffix !== 'coffee' ){
-      console.log( 'this only works on javscript and coffeescript' );
-    } else {
-      if ( fs.existsSync( file + '.' + suffix ) ){
-        console.log( 'file already exists...' );
-        if ( fs.existsSync( file + '-test.' + suffix ) ){
-          console.log( 'so does the test, there is nothing for me to d...' );
-        } else {
-          testFile = makeTest( file, suffix );
-          fs.writeFileSync( file + '-test.' + suffix, testFile );
-          console.log( 'so I made you a test!' );
-        }
-      } else {
-        output = makeFile( file, suffix );
-        testFile = makeTest( file, suffix );
-        fs.writeFileSync( file + '.' + suffix, output );
-        fs.writeFileSync( file + '-test.' + suffix, testFile );
-        console.log( 'sorcery!' );
-      }
-    }
-  }else{
-    console.log( 'specify a file to build' );
-  }
-};

package/lib/helpFunctions.js

@@ -1,43 +0,0 @@
-'use strict';
-
-var path = require( 'path' );
-var fs = require( 'fs' );
-var helpers = {};
-
-helpers.coffeeTest = function( name ){
-  var file = name + ' = require "./' + name + '.coffee"\n' +
-  'expect = require chai.expect\n' +
-  '\n' +
-  'describe "' + name + '", ->\n' +
-  '  it "should exist", ->\n' +
-  '    expect( ' + name + ' ).to.exist';
-
-  return file;
-};
-
-helpers.makeCoffee = function( name ){
-  var file = 'module.exports = {}';
-
-  return file;
-};
-
-helpers.jsTest = function( name ){
-  var file = 'var ' + name + ' = require( "./' + name + '.js" );\n' +
-  'var expect = require("chai").expect;\n' +
-  '\n' +
-  'describe( "' + name + '", function() {\n' +
-  '  it( "should exist", function() {\n' +
-  '    return expect( ' + name + ' ).to.exist;\n' +
-  '  } );' +
-  '} );';
-
-  return file;
-};
-
-helpers.makeJS = function( name ){
-  var file = 'module.exports = {}';
-
-  return file;
-};
-
-module.exports = helpers;

package/lib/makeFile.js

@@ -1,16 +0,0 @@
-'use strict';
-
-var fs = require( 'fs' );
-var path = require( 'path' );
-var helpers = require( './helpFunctions.js' );
-
-// make file
-module.exports = function( name, suffix ) {
-  if ( suffix === 'js' ){
-    return helpers.makeJS( name );
-  }else if( suffix === 'coffee' ){
-    return helpers.makeCoffee( name );
-  }else{
-    console.log( 'not sure how you did it, but you broke everything. Great job...' );
-  }
-};

package/lib/makeTest.js

@@ -1,16 +0,0 @@
-'use strict';
-
-var fs = require( 'fs' );
-var path = require( 'path' );
-var helpers = require( './helpFunctions.js' );
-
-// make test
-module.exports = function( name, suffix ) {
-  if ( suffix === 'js' ){
-    return helpers.jsTest( name );
-  } else if ( suffix === 'coffee' ){
-    return helpers.coffeeTest( name );
-  } else {
-    console.log( 'something has gone horribly wrong' );
-  }
-};

package/lib/undew.js

@@ -1,22 +0,0 @@
-'use strict';
-
-var fs = require( 'fs' );
-
-module.exports = function() {
-  var file, suffix;
-  if ( process.argv.length > 2 ){
-    file = process.argv[2].split( '.' )[0];
-    suffix = process.argv[2].split( '.' )[1] || 'js';
-    if ( fs.existsSync(file + '.' + suffix )){
-      fs.unlinkSync( file + '.' + suffix );
-      if ( fs.existsSync( file + '-test' + '.' + suffix ) ){
-        fs.unlinkSync( file + '-test' + '.' + suffix );
-      };
-      console.log( 'they should be gone forever' );
-    }else{
-      console.log( 'that doesn\'t exist... so... DONE!' );
-    }
-  }else{
-    console.log( 'input something for me to banish, please' );
-  }
-};