nestweaver 9.0.5

package/README.md

@@ -0,0 +1,50 @@
+# nestweaver
+
+Code knowledge graph for AI agents — 42 MCP tools, 32 languages, graph
+visualization.
+
+This package is a thin wrapper. Its `postinstall` downloads the NestWeaver
+binary matching this package's version from the project's GitHub Releases,
+verifies it against the SHA-256 published alongside the archive, and puts a
+`nestweaver` executable on your PATH.
+
+## Platforms
+
+macOS and Linux, on x86_64 and arm64. On any other platform the install step
+exits without failing and prints the supported targets; use a release archive
+or a source build instead.
+
+Linux builds target **glibc 2.35**, which covers Ubuntu 22.04 LTS and newer and
+Debian 12. The archive includes the GCC 13 runtime LadybugDB needs and the npm
+installer preserves it beside the binary. Check your glibc with `ldd --version`;
+on anything older the binary will not start and the error names a missing
+`GLIBC_` symbol. macOS builds target **13.3**.
+
+## Upgrading an existing graph
+
+NestWeaver 9.0.0 raised the resolver generation, so a graph built by an earlier
+release has stale rankings and is missing C/C++ `MEMBER_OF` and C++ `IMPORTS`
+edges. Check with:
+
+```sh
+nestweaver stale-check
+```
+
+It exits `2` and reports `outdated_resolver` when a re-index is needed. The
+remedy needs `--force`, because a generation-stale repo is at HEAD with nothing
+modified and a plain re-index takes the incremental path and writes nothing:
+
+```sh
+nestweaver index --repo <path> --force
+```
+
+## Other installation paths
+
+Verified GitHub Release archives, and building from a source checkout with Rust
+1.85+, are documented in [INSTALL.md](https://github.com/Kehl-io/nestweaver/blob/main/INSTALL.md).
+
+## Links
+
+- [Repository and documentation](https://github.com/Kehl-io/nestweaver)
+- [Issue tracker](https://github.com/Kehl-io/nestweaver/issues)
+- MIT licensed

package/bin/nestweaver

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -e
+DIR="$(cd "$(dirname "$0")/.." && pwd)"
+BINARY="$DIR/.nestweaver-bin/nestweaver"
+
+if [ ! -x "$BINARY" ]; then
+  echo "NestWeaver binary not found. Install a verified GitHub Release archive, or from a source checkout run: cargo install --locked --path ." >&2
+  exit 1
+fi
+
+exec "$BINARY" "$@"

package/install.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+
+const { execSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const PLATFORM_MAP = {
+  "darwin-x64": "x86_64-apple-darwin",
+  "darwin-arm64": "aarch64-apple-darwin",
+  "linux-x64": "x86_64-unknown-linux-gnu",
+  "linux-arm64": "aarch64-unknown-linux-gnu",
+};
+
+const key = `${process.platform}-${process.arch}`;
+const target = PLATFORM_MAP[key];
+
+if (!target) {
+  console.warn(`Unsupported platform: ${key}`);
+  console.warn("Supported: darwin-x64, darwin-arm64, linux-x64, linux-arm64");
+  console.warn(
+    "Unsupported platform. Install a verified GitHub Release archive for a supported target, or from a source checkout: cargo install --locked --path .",
+  );
+  process.exit(0); // Don't break npm install
+}
+
+const version = require("./package.json").version;
+const repo = "Kehl-io/nestweaver";
+// Release tags are `v<version>` (release-please config: include-component-in-tag
+// false) and assets are `nestweaver-v<version>-<target>.tar.gz` (see the
+// `build` job in .github/workflows/release-please.yml). Keep these in sync.
+const tag = `v${version}`;
+const archive = `nestweaver-${tag}-${target}.tar.gz`;
+const base = `https://github.com/${repo}/releases/download/${tag}`;
+const url = `${base}/${archive}`;
+
+const binDir = path.join(__dirname, ".nestweaver-bin");
+fs.mkdirSync(binDir, { recursive: true });
+const archivePath = path.join(binDir, archive);
+
+console.log(`Downloading NestWeaver v${version} for ${target}...`);
+
+try {
+  execSync(`curl -fsSL "${url}" -o "${archivePath}"`, { stdio: "inherit" });
+
+  // Verify the SHA-256 the release ships alongside the archive — a mismatch
+  // means a corrupted or tampered download, which must fail loudly.
+  try {
+    const expected = execSync(`curl -fsSL "${url}.sha256"`)
+      .toString()
+      .trim()
+      .split(/\s+/)[0];
+    const actual = execSync(`shasum -a 256 "${archivePath}"`)
+      .toString()
+      .trim()
+      .split(/\s+/)[0];
+    if (expected && actual && expected !== actual) {
+      throw new Error(
+        `checksum mismatch: expected ${expected}, got ${actual}`,
+      );
+    }
+  } catch (checksumErr) {
+    if (String(checksumErr.message || "").includes("checksum mismatch")) {
+      throw checksumErr; // integrity failure — do not install
+    }
+    // Missing/unreadable .sha256 is not fatal; proceed with the download.
+  }
+
+  execSync(`tar xz -C "${binDir}" -f "${archivePath}"`, { stdio: "inherit" });
+  fs.rmSync(archivePath, { force: true });
+  fs.chmodSync(path.join(binDir, "nestweaver"), 0o755);
+  console.log("NestWeaver installed successfully.");
+  console.log(
+    "Upgrading an existing pre-publication brain? Stop its daemon and run `nestweaver publication rebuild --config /path/to/instance.toml`; the incumbent remains recoverable until validated cutover.",
+  );
+} catch (err) {
+  console.warn(`Failed to install NestWeaver binary: ${err.message}`);
+  console.warn(`  URL: ${url}`);
+  console.warn(
+    "Download a verified GitHub Release archive, or build from a source checkout: cargo install --locked --path .",
+  );
+  process.exit(0); // Don't break npm install on transient/network failures
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "nestweaver",
+  "version": "9.0.5",
+  "description": "Code knowledge graph for AI agents — 42 MCP tools, 32 languages, graph visualization",
+  "bin": {
+    "nestweaver": "bin/nestweaver"
+  },
+  "files": [
+    "bin/",
+    "install.js",
+    "README.md"
+  ],
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "keywords": [
+    "mcp",
+    "code-graph",
+    "tree-sitter",
+    "code-intelligence",
+    "knowledge-graph",
+    "code-analysis"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Kehl-io/nestweaver.git"
+  },
+  "license": "MIT",
+  "homepage": "https://github.com/Kehl-io/nestweaver"
+}