mmwaa 0.1.0

package/bin/check-package.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+const { existsSync, statSync, readFileSync } = require("node:fs");
+const { join } = require("node:path");
+const { spawnSync } = require("node:child_process");
+const { createHash } = require("node:crypto");
+
+const packageJson = require("../package.json");
+const { targets, requiredArtifacts: required } = require("./targets");
+
+const vendorDir = join(__dirname, "..", "vendor");
+const missing = required.filter((name) => {
+  const path = join(vendorDir, name);
+  return !existsSync(path) || statSync(path).size === 0;
+});
+
+if (missing.length > 0) {
+  console.error(`waa: package is missing release artifacts: ${missing.join(", ")}`);
+  console.error("Run scripts/build-release.sh <version> and scripts/prepare-npm-package.sh <version> before npm publish.");
+  process.exit(1);
+}
+
+// Verify each vendored binary against the bundled SHA256SUMS manifest so a
+// corrupted or swapped binary is caught before publish rather than by users.
+const expectedSums = new Map(
+  readFileSync(join(vendorDir, "SHA256SUMS"), "utf8")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const [hash, name] = line.split(/\s+/);
+      return [name, hash];
+    })
+);
+
+const mismatched = required
+  .filter((name) => name !== "SHA256SUMS")
+  .flatMap((name) => {
+    const want = expectedSums.get(name);
+    if (!want) {
+      return [`${name} (no SHA256SUMS entry)`];
+    }
+    const got = createHash("sha256").update(readFileSync(join(vendorDir, name))).digest("hex");
+    return got === want ? [] : [`${name} (expected ${want}, got ${got})`];
+  });
+
+if (mismatched.length > 0) {
+  console.error(`waa: vendored binaries do not match SHA256SUMS: ${mismatched.join("; ")}`);
+  console.error("Re-run scripts/build-release.sh <version> and scripts/prepare-npm-package.sh <version>.");
+  process.exit(1);
+}
+
+// Probe the binary for THIS host against the package version so a stale or
+// mis-stamped build is caught before publish. `waa version` prints
+// "waa <version> ..." (internal/version.Summary).
+const currentTarget = targets[`${process.platform}-${process.arch}`];
+if (currentTarget) {
+  const binaryPath = join(vendorDir, currentTarget);
+  const result = spawnSync(binaryPath, ["version"], { encoding: "utf8" });
+  const output = `${result.stdout}${result.stderr}`;
+  if (result.status !== 0 || !output.includes(`waa ${packageJson.version}`)) {
+    console.error(`waa: ${currentTarget} version does not match package ${packageJson.version}`);
+    console.error(output.trim());
+    process.exit(1);
+  }
+}

package/bin/targets.js

@@ -0,0 +1,16 @@
+// Single source of truth for the platform -> bundled-binary mapping shared by
+// the launcher (waa.js) and the prepublish guard (check-package.js). Keep this
+// list in step with the GOOS/GOARCH matrix in scripts/cross-cc.sh.
+const targets = {
+  "darwin-arm64": "waa-darwin-arm64",
+  "darwin-x64": "waa-darwin-amd64",
+  "linux-arm64": "waa-linux-arm64",
+  "linux-x64": "waa-linux-amd64",
+  "win32-x64": "waa-windows-amd64.exe"
+};
+
+// The artifacts a complete package must vendor: every mapped binary plus the
+// checksum manifest used to verify them.
+const requiredArtifacts = [...new Set(Object.values(targets)), "SHA256SUMS"];
+
+module.exports = { targets, requiredArtifacts };

package/bin/waa.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+
+const { spawn } = require("node:child_process");
+const { existsSync } = require("node:fs");
+const { join } = require("node:path");
+
+const { targets } = require("./targets");
+
+const target = `${process.platform}-${process.arch}`;
+const executable = targets[target];
+
+if (!executable) {
+  console.error(`waa: unsupported platform ${target}`);
+  process.exit(1);
+}
+
+const binaryPath = join(__dirname, "..", "vendor", executable);
+if (!existsSync(binaryPath)) {
+  console.error(`waa: missing bundled binary ${executable}`);
+  console.error("Run the release packaging script before publishing this package.");
+  process.exit(1);
+}
+
+const child = spawn(binaryPath, process.argv.slice(2), {
+  stdio: "inherit",
+  env: process.env
+});
+
+child.on("error", (error) => {
+  console.error(`waa: failed to start ${binaryPath}: ${error.message}`);
+  process.exit(1);
+});
+
+child.on("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+  process.exit(code ?? 0);
+});

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "mmwaa",
+  "version": "0.1.0",
+  "description": "Zero-config launcher for the waa WhatsApp automation CLI + MCP server",
+  "bin": {
+    "waa": "bin/waa.js"
+  },
+  "scripts": {
+    "prepublishOnly": "node bin/check-package.js"
+  },
+  "files": [
+    "bin/",
+    "vendor/"
+  ],
+  "keywords": [
+    "mcp",
+    "whatsapp",
+    "claude",
+    "cli"
+  ],
+  "license": "UNLICENSED",
+  "private": false,
+  "engines": {
+    "node": ">=18"
+  }
+}

package/vendor/SHA256SUMS

@@ -0,0 +1,5 @@
+5fe0559d790896e441e95361717cfed514465bef159240e0edf2bcf933a17aa4  waa-darwin-amd64
+45b8055ce0fb069496f94608b1836e6bf6cf95a01fdfb597868b82d944355116  waa-darwin-arm64
+b3264ad34b66148e7ee0b560b0ade52bf12431d969ef0a26bdb0cf5fdac2dfca  waa-linux-amd64
+dd2e00240702340533cf2dc449bba58eb4b87751cf3c3f569ffba80859004ad4  waa-linux-arm64
+8b330d50f284f00ffd1a5f85ebd49a9dd19a2f72b54d1be65581bf24cdce86dd  waa-windows-amd64.exe