dsh-coding-subscription-oauth 0.6.4 → 0.6.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (144) hide show
  1. package/CHANGELOG.md +280 -255
  2. package/CONTRIBUTING.md +138 -129
  3. package/INSTALL.md +256 -255
  4. package/LICENSE +19 -19
  5. package/NOTICE +11 -11
  6. package/README.de.md +303 -303
  7. package/README.es.md +304 -304
  8. package/README.fr.md +304 -304
  9. package/README.ja.md +304 -304
  10. package/README.ko.md +304 -304
  11. package/README.md +320 -320
  12. package/README.pt-BR.md +304 -304
  13. package/README.ru.md +304 -304
  14. package/README.zh-CN.md +318 -318
  15. package/compatibility/dsh-bom.json +30 -30
  16. package/cordis.patch.yml +13 -13
  17. package/docs/00-project-rules.md +212 -212
  18. package/docs/02-architecture.md +141 -137
  19. package/docs/02-architecture.zh-CN.md +141 -137
  20. package/lib/bin.js.map +1 -1
  21. package/lib/client.js +1 -1
  22. package/lib/client.js.map +1 -1
  23. package/lib/gateway-protocol.d.ts +3 -46
  24. package/lib/gateway-protocol.d.ts.map +1 -1
  25. package/lib/gateway-routes.d.ts.map +1 -1
  26. package/lib/grok-errors.d.ts +2 -12
  27. package/lib/grok-errors.d.ts.map +1 -1
  28. package/lib/grok-imagine/client.d.ts +73 -0
  29. package/lib/grok-imagine/client.d.ts.map +1 -0
  30. package/lib/grok-imagine/index.d.ts +8 -0
  31. package/lib/grok-imagine/index.d.ts.map +1 -0
  32. package/lib/grok-imagine/net.d.ts +10 -0
  33. package/lib/grok-imagine/net.d.ts.map +1 -0
  34. package/lib/grok-imagine/parse.d.ts +20 -0
  35. package/lib/grok-imagine/parse.d.ts.map +1 -0
  36. package/lib/grok-imagine/types.d.ts +191 -0
  37. package/lib/grok-imagine/types.d.ts.map +1 -0
  38. package/lib/grok-imagine.d.ts +3 -263
  39. package/lib/grok-imagine.d.ts.map +1 -1
  40. package/lib/http-json.d.ts +2 -9
  41. package/lib/http-json.d.ts.map +1 -1
  42. package/lib/index.js +57 -37
  43. package/lib/index.js.map +4 -4
  44. package/lib/invariant.js.map +1 -1
  45. package/lib/kimi-errors.d.ts +2 -12
  46. package/lib/kimi-errors.d.ts.map +1 -1
  47. package/lib/runtime/gateway-protocol.d.ts +47 -0
  48. package/lib/runtime/gateway-protocol.d.ts.map +1 -0
  49. package/lib/runtime/grok-errors.d.ts +13 -0
  50. package/lib/runtime/grok-errors.d.ts.map +1 -0
  51. package/lib/runtime/http-json.d.ts +10 -0
  52. package/lib/runtime/http-json.d.ts.map +1 -0
  53. package/lib/runtime/kimi-errors.d.ts +13 -0
  54. package/lib/runtime/kimi-errors.d.ts.map +1 -0
  55. package/media/en/settings_accounts.png +0 -0
  56. package/media/en/settings_capabilities.png +0 -0
  57. package/media/en/settings_gateway.png +0 -0
  58. package/media/settings_accounts.png +0 -0
  59. package/media/settings_capabilities.png +0 -0
  60. package/media/settings_gateway.png +0 -0
  61. package/media/settings_overview.png +0 -0
  62. package/media/zh-CN/settings_accounts.png +0 -0
  63. package/media/zh-CN/settings_capabilities.png +0 -0
  64. package/media/zh-CN/settings_gateway.png +0 -0
  65. package/package.json +225 -220
  66. package/patches/dsh-agy@0.1.2.patch +25 -25
  67. package/scripts/release.mjs +187 -186
  68. package/scripts/smoke-deployed-routes.mjs +146 -146
  69. package/scripts/verify-deployed-catalog.mjs +87 -87
  70. package/src/adapter.ts +0 -348
  71. package/src/alias-adapter.ts +0 -147
  72. package/src/auth-routes.ts +0 -921
  73. package/src/auth.ts +0 -67
  74. package/src/bin.ts +0 -350
  75. package/src/capability-routes.ts +0 -279
  76. package/src/capability-runtime.ts +0 -314
  77. package/src/capability-settings.ts +0 -671
  78. package/src/capability-tools.ts +0 -685
  79. package/src/catalog.ts +0 -271
  80. package/src/client/GrokBuildSettings.tsx +0 -771
  81. package/src/client/api.ts +0 -88
  82. package/src/client/components/AboutTab.tsx +0 -30
  83. package/src/client/components/AccountsTab.tsx +0 -241
  84. package/src/client/components/Badge.tsx +0 -33
  85. package/src/client/components/CapabilitiesTab.tsx +0 -265
  86. package/src/client/components/CliPullPreview.tsx +0 -116
  87. package/src/client/components/CopyButton.tsx +0 -57
  88. package/src/client/components/GatewayTab.tsx +0 -469
  89. package/src/client/components/NoticeBanner.tsx +0 -46
  90. package/src/client/components/ProgressBar.tsx +0 -53
  91. package/src/client/components/ProviderCard.tsx +0 -606
  92. package/src/client/components/SettingsTabs.tsx +0 -75
  93. package/src/client/components/ToggleSwitch.tsx +0 -71
  94. package/src/client/constants.ts +0 -230
  95. package/src/client/display.ts +0 -61
  96. package/src/client/dshClientAdapter.ts +0 -127
  97. package/src/client/gatewaySnippets.ts +0 -37
  98. package/src/client/index.tsx +0 -156
  99. package/src/client/locales.ts +0 -540
  100. package/src/client/microStyles.ts +0 -52
  101. package/src/client/parsers.ts +0 -398
  102. package/src/client/styles.ts +0 -325
  103. package/src/client/types.ts +0 -199
  104. package/src/codex-http.ts +0 -447
  105. package/src/codex-images.ts +0 -503
  106. package/src/codex-model-capabilities.ts +0 -320
  107. package/src/codex-search.ts +0 -245
  108. package/src/codex-usage.ts +0 -263
  109. package/src/compatibility.ts +0 -55
  110. package/src/dsh-host-adapter.ts +0 -173
  111. package/src/gateway-anthropic-messages.ts +0 -84
  112. package/src/gateway-auth.ts +0 -102
  113. package/src/gateway-backend.ts +0 -274
  114. package/src/gateway-body.ts +0 -49
  115. package/src/gateway-config.ts +0 -76
  116. package/src/gateway-http.ts +0 -104
  117. package/src/gateway-openai-chat.ts +0 -124
  118. package/src/gateway-openai-responses.ts +0 -53
  119. package/src/gateway-parse.ts +0 -224
  120. package/src/gateway-protocol.ts +0 -52
  121. package/src/gateway-routes.ts +0 -158
  122. package/src/gateway.ts +0 -258
  123. package/src/grok-errors.ts +0 -24
  124. package/src/grok-imagine.ts +0 -1627
  125. package/src/grok-import.ts +0 -151
  126. package/src/http-json.ts +0 -82
  127. package/src/ids.ts +0 -59
  128. package/src/imagine-routes.ts +0 -463
  129. package/src/index.ts +0 -735
  130. package/src/invariant.ts +0 -17
  131. package/src/kimi-errors.ts +0 -26
  132. package/src/media-store.ts +0 -927
  133. package/src/oauth-import-routes.ts +0 -324
  134. package/src/oauth-providers.ts +0 -152
  135. package/src/oauth-session.ts +0 -183
  136. package/src/oauth-sources.ts +0 -1104
  137. package/src/oauth.ts +0 -620
  138. package/src/provider.ts +0 -128
  139. package/src/proxy.ts +0 -11
  140. package/src/redact.ts +0 -72
  141. package/src/session.ts +0 -218
  142. package/src/store.ts +0 -217
  143. package/src/web-origin.ts +0 -296
  144. package/src/web-routes.ts +0 -38
@@ -1,25 +1,25 @@
1
- diff --git a/lib/plugin-common-YSDKp1DG.mjs b/lib/plugin-common-YSDKp1DG.mjs
2
- index 3bd4405d9010705cdbfb675e62538645c4af5321..aeb9dd8375ac4dfc0376b525f44e4cf8eba67719 100644
3
- --- a/lib/plugin-common-YSDKp1DG.mjs
4
- +++ b/lib/plugin-common-YSDKp1DG.mjs
5
- @@ -135,12 +135,17 @@ var AgyAdapter = class extends LlmAdapter {
6
- providerInfo(_provider) {
7
- return {
8
- id: "agy",
9
- - name: "Antigravity (agy)"
10
- + name: "Google Antigravity (OAuth)"
11
- };
12
- }
13
- async listModels(_provider) {
14
- - const session = await this.options.getSession();
15
- - return listAgyModels(session?.auth.access, session?.account.projectId);
16
- + try {
17
- + const session = await this.options.getSession();
18
- + if (!session) return [];
19
- + return listAgyModels(session.auth.access, session.account.projectId);
20
- + } catch {
21
- + return [];
22
- + }
23
- }
24
- async resolveModel(provider, model) {
25
- return resolveAgyModel(provider, model);
1
+ diff --git a/lib/plugin-common-YSDKp1DG.mjs b/lib/plugin-common-YSDKp1DG.mjs
2
+ index 3bd4405d9010705cdbfb675e62538645c4af5321..aeb9dd8375ac4dfc0376b525f44e4cf8eba67719 100644
3
+ --- a/lib/plugin-common-YSDKp1DG.mjs
4
+ +++ b/lib/plugin-common-YSDKp1DG.mjs
5
+ @@ -135,12 +135,17 @@ var AgyAdapter = class extends LlmAdapter {
6
+ providerInfo(_provider) {
7
+ return {
8
+ id: "agy",
9
+ - name: "Antigravity (agy)"
10
+ + name: "Google Antigravity (OAuth)"
11
+ };
12
+ }
13
+ async listModels(_provider) {
14
+ - const session = await this.options.getSession();
15
+ - return listAgyModels(session?.auth.access, session?.account.projectId);
16
+ + try {
17
+ + const session = await this.options.getSession();
18
+ + if (!session) return [];
19
+ + return listAgyModels(session.auth.access, session.account.projectId);
20
+ + } catch {
21
+ + return [];
22
+ + }
23
+ }
24
+ async resolveModel(provider, model) {
25
+ return resolveAgyModel(provider, model);
@@ -1,186 +1,187 @@
1
- #!/usr/bin/env node
2
- /**
3
- * Local release verifier/packer.
4
- *
5
- * This helper never bumps versions, commits, tags, pushes, or publishes. Those
6
- * operations require an explicit human decision outside this script.
7
- */
8
- import { spawnSync } from "node:child_process";
9
- import { access, mkdir, readFile, rename, rm } from "node:fs/promises";
10
- import { dirname, join, resolve } from "node:path";
11
- import { fileURLToPath } from "node:url";
12
-
13
- const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
14
- const output = join(root, "output");
15
- const knownFlags = new Set(["--dry-run", "--pack", "--help"]);
16
- const args = new Set(process.argv.slice(2));
17
- for (const argument of args) {
18
- if (!knownFlags.has(argument)) {
19
- console.error(`Unknown option: ${argument}`);
20
- process.exit(2);
21
- }
22
- }
23
- if (args.has("--dry-run") && args.has("--pack")) {
24
- console.error("Choose either --dry-run or --pack, not both.");
25
- process.exit(2);
26
- }
27
- if (args.has("--help")) {
28
- console.log(`dsh-coding-subscription-oauth release helper
29
-
30
- Usage:
31
- node scripts/release.mjs --dry-run Verify current release artifacts and packed file list
32
- node scripts/release.mjs --pack Rebuild, verify, and write a local tarball under output/
33
-
34
- This command never changes versions, commits, tags, pushes, or publishes.`);
35
- process.exit(0);
36
- }
37
-
38
- const mode = args.has("--pack") ? "pack" : "dry-run";
39
- const manifest = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
40
- const changelog = await readFile(join(root, "CHANGELOG.md"), "utf8");
41
- const readme = await readFile(join(root, "README.md"), "utf8");
42
- const expectedName = "dsh-coding-subscription-oauth";
43
- const semver = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u;
44
-
45
- function fail(message) {
46
- throw new Error(message);
47
- }
48
-
49
- function run(command, commandArgs, options = {}) {
50
- let executable = command;
51
- let args = commandArgs;
52
- if (process.platform === "win32" && command === "pnpm") {
53
- const pnpmCli =
54
- process.env.npm_execpath ??
55
- (process.env.APPDATA === undefined
56
- ? undefined
57
- : resolve(process.env.APPDATA, "npm/node_modules/pnpm/bin/pnpm.cjs"));
58
- if (pnpmCli === undefined) fail("pnpm CLI path is unavailable on Windows");
59
- executable = process.execPath;
60
- args = [pnpmCli, ...commandArgs];
61
- } else if (process.platform === "win32" && command === "npm") {
62
- executable = process.execPath;
63
- args = [resolve(dirname(process.execPath), "node_modules/npm/bin/npm-cli.js"), ...commandArgs];
64
- }
65
- const result = spawnSync(executable, args, {
66
- cwd: root,
67
- encoding: "utf8",
68
- stdio: options.capture === true ? ["ignore", "pipe", "pipe"] : "inherit",
69
- });
70
- if (result.error !== undefined) throw result.error;
71
- if (result.status !== 0) {
72
- const details = options.capture === true ? `${result.stderr ?? ""}${result.stdout ?? ""}`.trim() : "";
73
- fail(`${command} ${commandArgs.join(" ")} failed${details === "" ? "" : `:\n${details}`}`);
74
- }
75
- return result.stdout ?? "";
76
- }
77
-
78
- if (manifest.name !== expectedName) fail(`package name must be ${expectedName}; found ${String(manifest.name)}`);
79
- if (typeof manifest.version !== "string" || !semver.test(manifest.version)) {
80
- fail(`package version is not valid semver: ${String(manifest.version)}`);
81
- }
82
- if (manifest.private === true) fail("release package must not be private");
83
-
84
- const releaseVersions = [
85
- ...changelog.matchAll(/^##\s+v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)(?:\s+-\s+\d{4}-\d{2}-\d{2})?\s*$/gmu),
86
- ].map((match) => match[1]);
87
- if (releaseVersions[0] !== manifest.version) {
88
- fail(`top CHANGELOG release (${releaseVersions[0] ?? "missing"}) does not match package version ${manifest.version}`);
89
- }
90
- if (!readme.includes(manifest.version)) fail(`README.md does not mention ${manifest.version}`);
91
- const installDoc = await readFile(join(root, "INSTALL.md"), "utf8");
92
- if (!installDoc.includes(manifest.version)) fail(`INSTALL.md does not mention ${manifest.version}`);
93
- const readmeZh = await readFile(join(root, "README.zh-CN.md"), "utf8");
94
- if (!readmeZh.includes(manifest.version)) fail(`README.zh-CN.md does not mention ${manifest.version}`);
95
-
96
- if (mode === "pack") run("pnpm", ["run", "release:build"]);
97
- else run("pnpm", ["run", "release:verify"]);
98
-
99
- const packOutput = run("npm", ["pack", "--dry-run", "--json", "--ignore-scripts"], { capture: true });
100
- let packReport;
101
- try {
102
- packReport = JSON.parse(packOutput);
103
- } catch (error) {
104
- throw new Error("npm pack --dry-run returned invalid JSON", { cause: error });
105
- }
106
- const report = Array.isArray(packReport) ? packReport[0] : undefined;
107
- if (report === undefined || !Array.isArray(report.files)) fail("npm pack did not return a file manifest");
108
- const packedFiles = report.files.map((entry) => entry.path).sort();
109
- const packed = new Set(packedFiles);
110
- const missingModes = report.files.filter((entry) => typeof entry.mode !== "number").map((entry) => entry.path);
111
- if (missingModes.length > 0) fail(`npm pack omitted file modes:\n${missingModes.sort().join("\n")}`);
112
- const privateModes = report.files
113
- .filter((entry) => typeof entry.mode === "number" && (entry.mode & 0o044) !== 0o044)
114
- .map((entry) => `${entry.path} (${entry.mode.toString(8)})`)
115
- .sort();
116
- if (privateModes.length > 0)
117
- fail(`packed release contains files unreadable outside their owner:\n${privateModes.join("\n")}`);
118
- const writableModes = report.files
119
- .filter((entry) => typeof entry.mode === "number" && (entry.mode & 0o022) !== 0)
120
- .map((entry) => `${entry.path} (${entry.mode.toString(8)})`)
121
- .sort();
122
- if (writableModes.length > 0) fail(`packed release contains group/world-writable files:\n${writableModes.join("\n")}`);
123
- for (const required of [
124
- "package.json",
125
- "README.md",
126
- "LICENSE",
127
- "cordis.patch.yml",
128
- "lib/index.js",
129
- "lib/index.d.ts",
130
- "lib/client.js",
131
- "lib/bin.js",
132
- "lib/invariant.js",
133
- "compatibility/dsh-bom.json",
134
- ]) {
135
- if (!packed.has(required)) fail(`packed release is missing ${required}`);
136
- }
137
- const packedBin = report.files.find((entry) => entry.path === "lib/bin.js");
138
- if (process.platform !== "win32" && typeof packedBin?.mode === "number" && (packedBin.mode & 0o111) === 0) {
139
- fail(`packed CLI is not executable: lib/bin.js (${packedBin.mode.toString(8)})`);
140
- }
141
- const forbiddenFragments = [
142
- "docs/local",
143
- "reference/",
144
- ".env",
145
- ".secrets",
146
- "package-lock.json",
147
- "tsdown.config",
148
- "lib/client.cjs",
149
- "docs/MIGRATION.md",
150
- ];
151
- const leaked = packedFiles.filter((path) => forbiddenFragments.some((fragment) => path.includes(fragment)));
152
- if (leaked.length > 0) fail(`packed release contains forbidden files:\n${leaked.join("\n")}`);
153
-
154
- console.log(`Verified ${manifest.name}@${manifest.version}`);
155
- console.log(`Packed files: ${packedFiles.length}`);
156
-
157
- if (mode === "dry-run") {
158
- console.log("Dry-run complete. No version, Git, registry, or tarball changes were made.");
159
- process.exit(0);
160
- }
161
-
162
- const staging = join(output, `.pack-${process.pid}`);
163
- await rm(staging, { recursive: true, force: true });
164
- await mkdir(staging, { recursive: true });
165
- try {
166
- const actualOutput = run("npm", ["pack", "--json", "--ignore-scripts", "--pack-destination", staging], {
167
- capture: true,
168
- });
169
- let actualReport;
170
- try {
171
- actualReport = JSON.parse(actualOutput);
172
- } catch (error) {
173
- throw new Error("npm pack returned invalid JSON", { cause: error });
174
- }
175
- const filename = Array.isArray(actualReport) ? actualReport[0]?.filename : undefined;
176
- if (typeof filename !== "string" || filename.length === 0) fail("npm pack did not report a tarball filename");
177
- const source = join(staging, filename);
178
- await access(source);
179
- await mkdir(output, { recursive: true });
180
- const target = join(output, `${manifest.name}-${manifest.version}.tgz`);
181
- await rm(target, { force: true });
182
- await rename(source, target);
183
- console.log(`Wrote ${target}`);
184
- } finally {
185
- await rm(staging, { recursive: true, force: true });
186
- }
1
+ #!/usr/bin/env node
2
+ /**
3
+ * Local release verifier/packer.
4
+ *
5
+ * This helper never bumps versions, commits, tags, pushes, or publishes. Those
6
+ * operations require an explicit human decision outside this script.
7
+ */
8
+ import { spawnSync } from "node:child_process";
9
+ import { access, mkdir, readFile, rename, rm } from "node:fs/promises";
10
+ import { dirname, join, resolve } from "node:path";
11
+ import { fileURLToPath } from "node:url";
12
+
13
+ const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
14
+ const output = join(root, "output");
15
+ const knownFlags = new Set(["--dry-run", "--pack", "--help"]);
16
+ const args = new Set(process.argv.slice(2));
17
+ for (const argument of args) {
18
+ if (!knownFlags.has(argument)) {
19
+ console.error(`Unknown option: ${argument}`);
20
+ process.exit(2);
21
+ }
22
+ }
23
+ if (args.has("--dry-run") && args.has("--pack")) {
24
+ console.error("Choose either --dry-run or --pack, not both.");
25
+ process.exit(2);
26
+ }
27
+ if (args.has("--help")) {
28
+ console.log(`dsh-coding-subscription-oauth release helper
29
+
30
+ Usage:
31
+ node scripts/release.mjs --dry-run Verify current release artifacts and packed file list
32
+ node scripts/release.mjs --pack Rebuild, verify, and write a local tarball under output/
33
+
34
+ This command never changes versions, commits, tags, pushes, or publishes.`);
35
+ process.exit(0);
36
+ }
37
+
38
+ const mode = args.has("--pack") ? "pack" : "dry-run";
39
+ const manifest = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
40
+ const changelog = await readFile(join(root, "CHANGELOG.md"), "utf8");
41
+ const readme = await readFile(join(root, "README.md"), "utf8");
42
+ const expectedName = "dsh-coding-subscription-oauth";
43
+ const semver = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u;
44
+
45
+ function fail(message) {
46
+ throw new Error(message);
47
+ }
48
+
49
+ function run(command, commandArgs, options = {}) {
50
+ let executable = command;
51
+ let args = commandArgs;
52
+ if (process.platform === "win32" && command === "pnpm") {
53
+ const pnpmCli =
54
+ process.env.npm_execpath ??
55
+ (process.env.APPDATA === undefined
56
+ ? undefined
57
+ : resolve(process.env.APPDATA, "npm/node_modules/pnpm/bin/pnpm.cjs"));
58
+ if (pnpmCli === undefined) fail("pnpm CLI path is unavailable on Windows");
59
+ executable = process.execPath;
60
+ args = [pnpmCli, ...commandArgs];
61
+ } else if (process.platform === "win32" && command === "npm") {
62
+ executable = process.execPath;
63
+ args = [resolve(dirname(process.execPath), "node_modules/npm/bin/npm-cli.js"), ...commandArgs];
64
+ }
65
+ const result = spawnSync(executable, args, {
66
+ cwd: root,
67
+ encoding: "utf8",
68
+ stdio: options.capture === true ? ["ignore", "pipe", "pipe"] : "inherit",
69
+ });
70
+ if (result.error !== undefined) throw result.error;
71
+ if (result.status !== 0) {
72
+ const details = options.capture === true ? `${result.stderr ?? ""}${result.stdout ?? ""}`.trim() : "";
73
+ fail(`${command} ${commandArgs.join(" ")} failed${details === "" ? "" : `:\n${details}`}`);
74
+ }
75
+ return result.stdout ?? "";
76
+ }
77
+
78
+ if (manifest.name !== expectedName) fail(`package name must be ${expectedName}; found ${String(manifest.name)}`);
79
+ if (typeof manifest.version !== "string" || !semver.test(manifest.version)) {
80
+ fail(`package version is not valid semver: ${String(manifest.version)}`);
81
+ }
82
+ if (manifest.private === true) fail("release package must not be private");
83
+
84
+ const releaseVersions = [
85
+ ...changelog.matchAll(/^##\s+v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)(?:\s+-\s+\d{4}-\d{2}-\d{2})?\s*$/gmu),
86
+ ].map((match) => match[1]);
87
+ if (releaseVersions[0] !== manifest.version) {
88
+ fail(`top CHANGELOG release (${releaseVersions[0] ?? "missing"}) does not match package version ${manifest.version}`);
89
+ }
90
+ if (!readme.includes(manifest.version)) fail(`README.md does not mention ${manifest.version}`);
91
+ const installDoc = await readFile(join(root, "INSTALL.md"), "utf8");
92
+ if (!installDoc.includes(manifest.version)) fail(`INSTALL.md does not mention ${manifest.version}`);
93
+ const readmeZh = await readFile(join(root, "README.zh-CN.md"), "utf8");
94
+ if (!readmeZh.includes(manifest.version)) fail(`README.zh-CN.md does not mention ${manifest.version}`);
95
+
96
+ if (mode === "pack") run("pnpm", ["run", "release:build"]);
97
+ else run("pnpm", ["run", "release:verify"]);
98
+
99
+ const packOutput = run("npm", ["pack", "--dry-run", "--json", "--ignore-scripts"], { capture: true });
100
+ let packReport;
101
+ try {
102
+ packReport = JSON.parse(packOutput);
103
+ } catch (error) {
104
+ throw new Error("npm pack --dry-run returned invalid JSON", { cause: error });
105
+ }
106
+ const report = Array.isArray(packReport) ? packReport[0] : undefined;
107
+ if (report === undefined || !Array.isArray(report.files)) fail("npm pack did not return a file manifest");
108
+ const packedFiles = report.files.map((entry) => entry.path).sort();
109
+ const packed = new Set(packedFiles);
110
+ const missingModes = report.files.filter((entry) => typeof entry.mode !== "number").map((entry) => entry.path);
111
+ if (missingModes.length > 0) fail(`npm pack omitted file modes:\n${missingModes.sort().join("\n")}`);
112
+ const privateModes = report.files
113
+ .filter((entry) => typeof entry.mode === "number" && (entry.mode & 0o044) !== 0o044)
114
+ .map((entry) => `${entry.path} (${entry.mode.toString(8)})`)
115
+ .sort();
116
+ if (privateModes.length > 0)
117
+ fail(`packed release contains files unreadable outside their owner:\n${privateModes.join("\n")}`);
118
+ const writableModes = report.files
119
+ .filter((entry) => typeof entry.mode === "number" && (entry.mode & 0o022) !== 0)
120
+ .map((entry) => `${entry.path} (${entry.mode.toString(8)})`)
121
+ .sort();
122
+ if (writableModes.length > 0) fail(`packed release contains group/world-writable files:\n${writableModes.join("\n")}`);
123
+ for (const required of [
124
+ "package.json",
125
+ "README.md",
126
+ "LICENSE",
127
+ "cordis.patch.yml",
128
+ "lib/index.js",
129
+ "lib/index.d.ts",
130
+ "lib/client.js",
131
+ "lib/bin.js",
132
+ "lib/invariant.js",
133
+ "compatibility/dsh-bom.json",
134
+ ]) {
135
+ if (!packed.has(required)) fail(`packed release is missing ${required}`);
136
+ }
137
+ const packedBin = report.files.find((entry) => entry.path === "lib/bin.js");
138
+ if (process.platform !== "win32" && typeof packedBin?.mode === "number" && (packedBin.mode & 0o111) === 0) {
139
+ fail(`packed CLI is not executable: lib/bin.js (${packedBin.mode.toString(8)})`);
140
+ }
141
+ const forbiddenFragments = [
142
+ "docs/local",
143
+ "reference/",
144
+ "src/",
145
+ ".env",
146
+ ".secrets",
147
+ "package-lock.json",
148
+ "tsdown.config",
149
+ "lib/client.cjs",
150
+ "docs/MIGRATION.md",
151
+ ];
152
+ const leaked = packedFiles.filter((path) => forbiddenFragments.some((fragment) => path.includes(fragment)));
153
+ if (leaked.length > 0) fail(`packed release contains forbidden files:\n${leaked.join("\n")}`);
154
+
155
+ console.log(`Verified ${manifest.name}@${manifest.version}`);
156
+ console.log(`Packed files: ${packedFiles.length}`);
157
+
158
+ if (mode === "dry-run") {
159
+ console.log("Dry-run complete. No version, Git, registry, or tarball changes were made.");
160
+ process.exit(0);
161
+ }
162
+
163
+ const staging = join(output, `.pack-${process.pid}`);
164
+ await rm(staging, { recursive: true, force: true });
165
+ await mkdir(staging, { recursive: true });
166
+ try {
167
+ const actualOutput = run("npm", ["pack", "--json", "--ignore-scripts", "--pack-destination", staging], {
168
+ capture: true,
169
+ });
170
+ let actualReport;
171
+ try {
172
+ actualReport = JSON.parse(actualOutput);
173
+ } catch (error) {
174
+ throw new Error("npm pack returned invalid JSON", { cause: error });
175
+ }
176
+ const filename = Array.isArray(actualReport) ? actualReport[0]?.filename : undefined;
177
+ if (typeof filename !== "string" || filename.length === 0) fail("npm pack did not report a tarball filename");
178
+ const source = join(staging, filename);
179
+ await access(source);
180
+ await mkdir(output, { recursive: true });
181
+ const target = join(output, `${manifest.name}-${manifest.version}.tgz`);
182
+ await rm(target, { force: true });
183
+ await rename(source, target);
184
+ console.log(`Wrote ${target}`);
185
+ } finally {
186
+ await rm(staging, { recursive: true, force: true });
187
+ }