no-mistakes 0.55.0 → 0.56.0

package/README.md

@@ -8,6 +8,10 @@ coverage gate. See [why it exists](../../docs/why.md).
 The async N-API facade avoids subprocess parsing and reuses one prepared
 analysis for related reports.
 
+Published installs select a platform-specific optional package containing both
+the CLI and N-API addon. Repository contributors build and stage the local
+native package explicitly with `pnpm run build:native` before running the CLI.
+
 ```bash
 npm install --save-dev no-mistakes
 npx no-mistakes dependencies src/main.mts --json

package/bin/no-mistakes.js

@@ -2,8 +2,8 @@
 "use strict";
 
 const { spawn } = require("node:child_process");
-const { join } = require("node:path");
 const { boundedDiagnostic } = require("../planning-impact-cli");
+const { resolveNativePackage } = require("../scripts/native-package");
 
 const VALUE_OPTIONS = new Set(["--timeout", "--lock-timeout", "--jobs", "--profile", "-j"]);
 const FLAG_OPTIONS = new Set(["--fail-on-lock"]);
@@ -35,8 +35,22 @@ function planningImpactArgs(argv) {
   return [...argv.slice(0, index), ...argv.slice(index + 1)];
 }
 
-function launchNative(argv, spawnFn = spawn, io = process, kill = process.kill) {
-  const child = spawnFn(join(__dirname, "no-mistakes"), argv, { stdio: "inherit" });
+function launchNative(
+  argv,
+  spawnFn = spawn,
+  io = process,
+  kill = process.kill,
+  resolve = resolveNativePackage,
+) {
+  let cliPath;
+  try {
+    cliPath = resolve().cliPath;
+  } catch (error) {
+    io.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    io.exitCode = 1;
+    return undefined;
+  }
+  const child = spawnFn(cliPath, argv, { stdio: "inherit" });
   child.on("error", (error) => {
     io.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
     io.exitCode = 1;

package/index.js

@@ -1,8 +1,8 @@
 "use strict";
 
-// CI real-addon tests point this at the freshly compiled cdylib without
-// overwriting the package's checked-in install placeholder.
-const native = require(process.env.NO_MISTAKES_TEST_NAPI_ADDON_PATH || "./bin/no-mistakes.node");
+const { resolveNativePackage } = require("./scripts/native-package");
+const addonPath = process.env.NO_MISTAKES_TEST_NAPI_ADDON_PATH || resolveNativePackage().addonPath;
+const native = require(addonPath);
 const planning = require("./planning");
 const { writePlanningImpactArtifacts: writeArtifacts } = require("./planning-impact-artifacts");
 const { createPlanningArtifactLock } = require("./planning-impact-artifacts-lock");
@@ -150,9 +150,7 @@ async function ciTopology(options) {
   return pending.then((value) => structuredClone(value));
 }
 
-async function version() {
-  return native.version();
-}
+const version = () => native.version();
 
 module.exports.createWorkflowTopologyIndex = createWorkflowTopologyIndex;
 module.exports.version = version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "no-mistakes",
-  "version": "0.55.0",
+  "version": "0.56.0",
   "description": "Deterministic impact maps, test plans, Playwright coverage, and repository checks for coding agents",
   "license": "MIT",
   "repository": {
@@ -26,8 +26,7 @@
     "planning.js",
     "workflow-topology-index.js",
     "workflow-topology-index-helpers.js",
-    "scripts/install.js",
-    "scripts/install/",
+    "scripts/native-package.js",
     "README.md",
     "LICENSE"
   ],
@@ -45,7 +44,11 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "postinstall": "node scripts/install.js"
+  "optionalDependencies": {
+    "no-mistakes-darwin-arm64": "0.56.0",
+    "no-mistakes-darwin-x64": "0.56.0",
+    "no-mistakes-linux-arm64-gnu": "0.56.0",
+    "no-mistakes-linux-x64-gnu": "0.56.0",
+    "no-mistakes-win32-x64-msvc": "0.56.0"
   }
-}
+}

package/planning.js

@@ -3,7 +3,10 @@
 const fs = require("node:fs/promises");
 const os = require("node:os");
 const path = require("node:path");
-const native = require(process.env.NO_MISTAKES_TEST_NAPI_ADDON_PATH || "./bin/no-mistakes.node");
+const { resolveNativePackage } = require("./scripts/native-package");
+const native = require(
+  process.env.NO_MISTAKES_TEST_NAPI_ADDON_PATH || resolveNativePackage().addonPath,
+);
 
 async function callJson(fn, options) {
   const input = Buffer.from(JSON.stringify(options || {}));

package/scripts/native-package.js

@@ -0,0 +1,129 @@
+"use strict";
+
+const { constants, existsSync, accessSync, statSync } = require("node:fs");
+const { join } = require("node:path");
+
+const MIN_GLIBC = [2, 35];
+
+const PACKAGE_NAMES = new Map([
+  ["darwin/arm64", "no-mistakes-darwin-arm64"],
+  ["darwin/x64", "no-mistakes-darwin-x64"],
+  ["linux/arm64", "no-mistakes-linux-arm64-gnu"],
+  ["linux/x64", "no-mistakes-linux-x64-gnu"],
+  ["win32/x64", "no-mistakes-win32-x64-msvc"],
+]);
+
+function nativePackageName(platform = process.platform, arch = process.arch) {
+  return PACKAGE_NAMES.get(`${platform}/${arch}`);
+}
+
+function unsupportedPlatformMessage(platform = process.platform, arch = process.arch) {
+  return `Unsupported platform ${platform}/${arch}. Install with \`cargo install no-mistakes\` instead.`;
+}
+
+function glibcVersion(report = process.report) {
+  try {
+    const header = report?.getReport?.().header;
+    return header?.glibcVersionRuntime || header?.glibcVersionCompiler || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function supportedGlibc(report = process.report) {
+  const version = glibcVersion(report);
+  if (!version) return false;
+  const [major, minor] = version.split(".").map((part) => Number.parseInt(part, 10));
+  return (
+    Number.isInteger(major) &&
+    Number.isInteger(minor) &&
+    (major > MIN_GLIBC[0] || (major === MIN_GLIBC[0] && minor >= MIN_GLIBC[1]))
+  );
+}
+
+function unsupportedGlibcMessage(report = process.report) {
+  const version = glibcVersion(report);
+  const detected = version
+    ? `Detected glibc ${version}.`
+    : "Could not detect a supported glibc runtime.";
+  return `Linux native packages require glibc 2.35 or newer. ${detected} Install with \`cargo install no-mistakes\` instead.`;
+}
+
+function missingPackageMessage(name, { staged, unusableCli = false }) {
+  if (staged) {
+    return `The native package ${name} has ${unusableCli ? "an unusable CLI artifact" : "no staged artifacts"}. From the no-mistakes repository run \`pnpm run build:native\`.`;
+  }
+  return `The optional native package ${name} is ${unusableCli ? "not executable" : "unavailable"}. Run \`npm install no-mistakes\` or \`pnpm install\` to repair optional dependencies.`;
+}
+
+function localPackagePath(name) {
+  const path = join(__dirname, "..", "..", name);
+  return existsSync(join(path, "package.json")) ? path : undefined;
+}
+
+function usableCli(path, platform = process.platform) {
+  try {
+    if (!statSync(path).isFile()) return false;
+    if (platform === "win32") return true;
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function resolveNativePackage({
+  platform = process.platform,
+  arch = process.arch,
+  resolve = require.resolve,
+  resolveLocalPackage = localPackagePath,
+  localArtifactExists = existsSync,
+  isUsableCli = usableCli,
+  report = process.report,
+} = {}) {
+  const name = nativePackageName(platform, arch);
+  if (!name) throw new Error(unsupportedPlatformMessage(platform, arch));
+  if (platform === "linux" && !supportedGlibc(report)) {
+    throw new Error(unsupportedGlibcMessage(report));
+  }
+  let unusableCli = false;
+  try {
+    const cliPath = resolve(`${name}/bin/no-mistakes${platform === "win32" ? ".exe" : ""}`);
+    const addonPath = resolve(name);
+    if (isUsableCli(cliPath, platform)) return { name, cliPath, addonPath };
+    unusableCli = true;
+  } catch {
+    // The package may still be available as the repository's sibling staging package.
+  }
+  const local = resolveLocalPackage(name);
+  if (local) {
+    const cliPath = join(local, "bin", `no-mistakes${platform === "win32" ? ".exe" : ""}`);
+    const addonPath = join(local, "bin", "no-mistakes.node");
+    if (!localArtifactExists(cliPath) || !localArtifactExists(addonPath)) {
+      throw new Error(missingPackageMessage(name, { staged: true }));
+    }
+    if (!isUsableCli(cliPath, platform)) {
+      throw new Error(missingPackageMessage(name, { staged: true, unusableCli: true }));
+    }
+    return { name, cliPath, addonPath };
+  }
+  let installed = false;
+  try {
+    resolve(`${name}/package.json`);
+    installed = true;
+  } catch {}
+  throw new Error(
+    missingPackageMessage(name, { staged: false, unusableCli: installed && unusableCli }),
+  );
+}
+
+module.exports = {
+  glibcVersion,
+  nativePackageName,
+  localPackagePath,
+  resolveNativePackage,
+  supportedGlibc,
+  unsupportedGlibcMessage,
+  unsupportedPlatformMessage,
+  usableCli,
+};

package/bin/no-mistakes

@@ -1 +0,0 @@
-Native binary placeholder. Replaced by scripts/install.js during npm postinstall.

package/bin/no-mistakes.node

@@ -1 +0,0 @@
-Native binary placeholder. Replaced by scripts/install.js during npm postinstall.

package/scripts/install/assets.js

@@ -1,60 +0,0 @@
-"use strict";
-
-const { basename } = require("node:path");
-
-function assetName(binNameOrOptions, version, target, assetExtension) {
-  if (
-    typeof binNameOrOptions === "object" &&
-    binNameOrOptions !== null &&
-    !Array.isArray(binNameOrOptions)
-  ) {
-    return assetNameFromOptions(binNameOrOptions);
-  }
-  return assetNameFromLegacyArgs(binNameOrOptions, version, target, assetExtension);
-}
-
-function assetNameFromLegacyArgs(binName, version, target, assetExtension) {
-  return assetNameFromOptions({ binName, version, target, assetExtension });
-}
-
-function assetNameFromOptions({ binName, version, target, assetExtension }) {
-  if (typeof binName !== "string" || typeof version !== "string" || typeof target !== "string") {
-    throw new TypeError(
-      "assetName requires (binName, version, target) or an equivalent options object.",
-    );
-  }
-
-  const ext = assetExtension ?? (target.endsWith("windows-msvc") ? ".exe" : "");
-  return `${binName}-v${version}-${target}${ext}`;
-}
-
-function releaseBaseUrl(repository, version, envVar) {
-  return (
-    (envVar && process.env[envVar]) ||
-    `https://github.com/${repository}/releases/download/v${version}`
-  );
-}
-
-function parseChecksum(text, expectedAsset) {
-  for (const line of text.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      continue;
-    }
-    const [hash, file] = trimmed.split(/\s+/, 2);
-    if (!/^[a-fA-F0-9]{64}$/.test(hash)) {
-      continue;
-    }
-    const normalizedFile = file?.replace(/^\*/, "");
-    if (!file || normalizedFile === expectedAsset || basename(normalizedFile) === expectedAsset) {
-      return hash.toLowerCase();
-    }
-  }
-  throw new Error(`No SHA-256 checksum found for ${expectedAsset}`);
-}
-
-module.exports = {
-  assetName,
-  parseChecksum,
-  releaseBaseUrl,
-};

package/scripts/install/download.js

@@ -1,167 +0,0 @@
-"use strict";
-
-const { copyFile, readFile } = require("node:fs/promises");
-const { createWriteStream } = require("node:fs");
-const http = require("node:http");
-const https = require("node:https");
-const { pipeline } = require("node:stream/promises");
-const { fileURLToPath } = require("node:url");
-
-const { HttpError, withRetry } = require("./retry");
-
-const DOWNLOAD_TIMEOUT_MS = 30_000;
-
-function download(url, destination, redirects = 0, validateUrl = () => {}, retryOptions) {
-  validateUrl(url);
-  if (isFileUrl(url)) {
-    return copyFile(fileURLToPath(url), destination);
-  }
-
-  return withRetry(
-    () =>
-      request(
-        url,
-        async (response) => {
-          await pipeline(response, createWriteStream(destination));
-        },
-        redirects,
-        { http, https },
-        DOWNLOAD_TIMEOUT_MS,
-        validateUrl,
-      ),
-    { ...retryOptions, describe: () => `download of ${url}` },
-  );
-}
-
-function request(
-  url,
-  handleResponse,
-  redirects = 0,
-  clients = { http, https },
-  timeoutMs = DOWNLOAD_TIMEOUT_MS,
-  validateUrl = () => {},
-) {
-  return new Promise((resolve, reject) => {
-    try {
-      validateUrl(url);
-    } catch (error) {
-      reject(error);
-      return;
-    }
-    const client = url.startsWith("http://") ? clients.http : clients.https;
-    const req = client.get(url, (response) => {
-      if (isRedirectStatus(response.statusCode)) {
-        response.resume();
-        if (redirects >= 5) {
-          reject(new Error(`Too many redirects while downloading ${url}`));
-          return;
-        }
-        if (!response.headers.location) {
-          reject(new Error(`Redirect missing Location header while downloading ${url}`));
-          return;
-        }
-
-        let redirectedUrl;
-        try {
-          redirectedUrl = new URL(response.headers.location, url);
-        } catch {
-          reject(
-            new Error(
-              `Invalid redirect Location header while downloading ${url}: ${response.headers.location}`,
-            ),
-          );
-          return;
-        }
-
-        if (redirectedUrl.protocol !== "http:" && redirectedUrl.protocol !== "https:") {
-          reject(new Error(`Unsupported redirect protocol: ${redirectedUrl.protocol}`));
-          return;
-        }
-
-        try {
-          validateUrl(redirectedUrl.toString());
-        } catch (error) {
-          reject(error);
-          return;
-        }
-
-        request(
-          redirectedUrl.toString(),
-          handleResponse,
-          redirects + 1,
-          clients,
-          timeoutMs,
-          validateUrl,
-        ).then(resolve, reject);
-        return;
-      }
-
-      if (response.statusCode !== 200) {
-        response.resume();
-        reject(new HttpError(url, response.statusCode));
-        return;
-      }
-
-      Promise.resolve(handleResponse(response)).then(resolve, reject);
-    });
-
-    req.setTimeout(timeoutMs, () => {
-      const timeoutError = new Error(`Download timed out after ${timeoutMs}ms: ${url}`);
-      timeoutError.retryable = true;
-      req.destroy(timeoutError);
-    });
-    req.on("error", reject);
-  });
-}
-
-function isRedirectStatus(statusCode) {
-  return [301, 302, 303, 307, 308].includes(statusCode);
-}
-
-async function fetchText(url, validateUrl = () => {}, retryOptions) {
-  validateUrl(url);
-
-  if (isFileUrl(url)) {
-    return readFile(fileURLToPath(url), "utf8");
-  }
-  const MAX_LENGTH = 1024 * 1024;
-  return withRetry(
-    async () => {
-      const chunks = [];
-      let totalLength = 0;
-      await request(
-        url,
-        async (response) => {
-          for await (const chunk of response) {
-            totalLength += chunk.length;
-            if (totalLength > MAX_LENGTH) {
-              throw new Error(`Response exceeded maximum size of ${MAX_LENGTH} bytes`);
-            }
-            chunks.push(chunk);
-          }
-        },
-        0,
-        { http, https },
-        DOWNLOAD_TIMEOUT_MS,
-        validateUrl,
-      );
-      return Buffer.concat(chunks).toString("utf8");
-    },
-    { ...retryOptions, describe: () => `fetch of ${url}` },
-  );
-}
-
-function isFileUrl(url) {
-  try {
-    return new URL(url).protocol === "file:";
-  } catch {
-    return false;
-  }
-}
-
-module.exports = {
-  download,
-  fetchText,
-  isRedirectStatus,
-  request,
-};

package/scripts/install/index.js

@@ -1,15 +0,0 @@
-"use strict";
-
-const assets = require("./assets");
-const download = require("./download");
-const installer = require("./installer");
-const platform = require("./platform");
-const retry = require("./retry");
-
-module.exports = {
-  ...assets,
-  ...download,
-  ...installer,
-  ...platform,
-  ...retry,
-};

package/scripts/install/installer.js

@@ -1,218 +0,0 @@
-"use strict";
-
-const { createHash, randomBytes } = require("node:crypto");
-const { closeSync, createReadStream, existsSync, openSync, readSync } = require("node:fs");
-const { chmod, mkdir, rename, rm, writeFile } = require("node:fs/promises");
-const { join } = require("node:path");
-
-const { assetName, parseChecksum, releaseBaseUrl } = require("./assets");
-const { download, fetchText } = require("./download");
-const { platformTarget, supportedGlibc } = require("./platform");
-const { installedVersion, versionMarkerPath } = require("./version-marker");
-
-const PLACEHOLDER_TEXT = "Native binary placeholder.";
-const PLACEHOLDER_READ_BYTES = 256;
-
-async function sha256(path) {
-  const hash = createHash("sha256");
-  for await (const chunk of createReadStream(path)) {
-    hash.update(chunk);
-  }
-  return hash.digest("hex");
-}
-
-async function install(binName, repository, options = {}) {
-  const version = options.version;
-  if (!version) {
-    throw new Error("version is required for install()");
-  }
-  const target = Object.hasOwn(options, "target") ? options.target : platformTarget();
-  if (!target) {
-    throw new Error(unsupportedPlatformMessage(binName));
-  }
-
-  const vendorDir = options.vendorDir;
-  if (!vendorDir) {
-    throw new Error("vendorDir is required for install()");
-  }
-  const executable = options.destinationName || binName;
-  const destination = join(vendorDir, executable);
-  const destinationExists = existsSync(destination);
-  const destinationIsPlaceholder = destinationExists && isPlaceholder(destination);
-
-  if (process.env.SKIP_BINARY_DOWNLOAD) {
-    if (destinationExists && !destinationIsPlaceholder) {
-      return destination;
-    }
-    throw new Error(
-      `SKIP_BINARY_DOWNLOAD is set but ${destination} is missing or still a placeholder; unset SKIP_BINARY_DOWNLOAD to install ${binName}.`,
-    );
-  }
-
-  if (
-    options.checkExisting &&
-    destinationExists &&
-    !destinationIsPlaceholder &&
-    installedVersion(destination) === version
-  ) {
-    return destination;
-  }
-
-  const asset = assetName({ binName, version, target, assetExtension: options.assetExtension });
-  const baseUrl = normalizeBaseUrl(
-    options.baseUrl || releaseBaseUrl(repository, version, options.envVar),
-  );
-  validateReleaseBaseUrl(baseUrl, repository, { enforcePath: true });
-  const validateReleaseDownloadUrl = (url) =>
-    validateReleaseBaseUrl(url, repository, { enforcePath: false });
-
-  const temp = `${destination}.tmp-${randomBytes(8).toString("hex")}`;
-
-  await mkdir(vendorDir, { recursive: true });
-
-  try {
-    console.log(`Downloading ${binName} v${version} for ${target}...`);
-    await download(`${baseUrl}/${asset}`, temp, 0, validateReleaseDownloadUrl);
-
-    let checksumText;
-    try {
-      checksumText = await fetchText(`${baseUrl}/${asset}.sha256`, validateReleaseDownloadUrl);
-    } catch (e) {
-      throw new Error(`Failed to fetch checksum for ${asset}: ${e.message}`);
-    }
-
-    const expected = parseChecksum(checksumText, asset);
-    const actual = await sha256(temp);
-    if (actual !== expected) {
-      throw new Error(`Checksum mismatch for ${asset}: expected ${expected}, got ${actual}`);
-    }
-    if (!target.endsWith("windows-msvc")) {
-      await chmod(temp, 0o755);
-    }
-    await rename(temp, destination);
-    await writeFile(versionMarkerPath(destination), version);
-    return destination;
-  } catch (error) {
-    await rm(temp, { force: true });
-    throw new Error(`Failed to install ${binName}: ${error.message}`);
-  }
-}
-
-function normalizeBaseUrl(baseUrl) {
-  const url = String(baseUrl);
-  if (url.endsWith("://")) {
-    return url;
-  }
-  return url.replace(/\/+$/, "");
-}
-
-function validateReleaseBaseUrl(baseUrl, repository, options = {}) {
-  const enforcePath = options.enforcePath ?? true;
-  const allowedPublicHost = "github.com";
-  const allowedRedirectHostSuffixes = ["githubusercontent.com"];
-  const allowedLocalHosts = ["127.0.0.1", "example.test"];
-  const publicPathPrefix = `/${repository.toLowerCase()}/releases/download`;
-
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(baseUrl);
-  } catch {
-    throw new Error(`Invalid release base URL: ${baseUrl}. It must be a valid absolute URL.`);
-  }
-
-  if (parsedUrl.protocol === "file:") {
-    if (
-      parsedUrl.username ||
-      parsedUrl.password ||
-      parsedUrl.pathname.startsWith("//") ||
-      !String(baseUrl).toLowerCase().startsWith("file:///")
-    ) {
-      throw new Error(
-        `Untrusted base URL: ${baseUrl}. File URLs must use canonical 'file:///path/to/asset' form and must not include credentials.`,
-      );
-    }
-    return;
-  }
-  if (parsedUrl.username || parsedUrl.password) {
-    throw new Error(`Untrusted base URL: ${baseUrl}. Credentials are not allowed in URLs.`);
-  }
-
-  const hostname = parsedUrl.hostname.toLowerCase();
-  const isLocalHost = allowedLocalHosts.includes(hostname);
-  if (isLocalHost) {
-    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
-      throw new Error(`Untrusted base URL: ${baseUrl}. Expected http: or https: protocol.`);
-    }
-  } else if (parsedUrl.protocol !== "https:") {
-    throw new Error(`Untrusted base URL: ${baseUrl}. Expected https: protocol.`);
-  }
-
-  if (enforcePath && hostname !== allowedPublicHost && !isLocalHost) {
-    throw new Error(
-      `Untrusted base URL: ${baseUrl}. When enforcePath is enabled, expected base URL host ${allowedPublicHost} unless host is a local testing host.`,
-    );
-  }
-
-  const isAllowedHost =
-    hostname === allowedPublicHost ||
-    allowedLocalHosts.includes(hostname) ||
-    allowedRedirectHostSuffixes.some(
-      (suffix) => hostname === suffix || hostname.endsWith(`.${suffix}`),
-    );
-  if (!isAllowedHost) {
-    throw new Error(
-      `Untrusted base URL: ${baseUrl}. Allowed hosts are: ${[allowedPublicHost, ...allowedLocalHosts, ...allowedRedirectHostSuffixes.map((suffix) => `*.${suffix}`)].join(", ")}.`,
-    );
-  }
-
-  if (
-    enforcePath &&
-    !isLocalHost &&
-    !parsedUrl.pathname.toLowerCase().startsWith(`${publicPathPrefix}/`)
-  ) {
-    throw new Error(
-      `Untrusted GitHub repository in base URL: ${baseUrl}. For github.com, expected base URL prefix ${publicPathPrefix}.`,
-    );
-  }
-}
-
-function isPlaceholder(path) {
-  let fd;
-  try {
-    fd = openSync(path, "r");
-    const buffer = Buffer.alloc(PLACEHOLDER_READ_BYTES);
-    const bytesRead = readSync(fd, buffer, 0, buffer.length, 0);
-    return buffer.subarray(0, bytesRead).toString("utf8").includes(PLACEHOLDER_TEXT);
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return false;
-    }
-    throw new Error(`Failed to inspect native binary placeholder ${path}: ${error.message}`);
-  } finally {
-    if (fd !== undefined) {
-      closeSync(fd);
-    }
-  }
-}
-
-function unsupportedPlatformMessage(
-  binName,
-  platform = process.platform,
-  arch = process.arch,
-  report = process.report,
-) {
-  if (platform === "linux" && (arch === "x64" || arch === "arm64") && !supportedGlibc(report)) {
-    return `Linux npm installs require glibc 2.35 or newer. Install with \`cargo install ${binName}\` instead.`;
-  }
-  return `Unsupported platform ${platform}/${arch}. Install with \`cargo install ${binName}\` instead.`;
-}
-
-module.exports = {
-  install,
-  installedVersion,
-  isPlaceholder,
-  sha256,
-  unsupportedPlatformMessage,
-  validateReleaseBaseUrl,
-  versionMarkerPath,
-};

package/scripts/install/platform.js

@@ -1,50 +0,0 @@
-"use strict";
-
-const MIN_GLIBC = [2, 35];
-
-function platformTarget(platform = process.platform, arch = process.arch, report = process.report) {
-  if (platform === "darwin" && arch === "x64") {
-    return "x86_64-apple-darwin";
-  }
-  if (platform === "darwin" && arch === "arm64") {
-    return "aarch64-apple-darwin";
-  }
-  if (platform === "win32" && arch === "x64") {
-    return "x86_64-pc-windows-msvc";
-  }
-  if (platform === "linux" && (arch === "x64" || arch === "arm64")) {
-    if (!supportedGlibc(report)) {
-      return null;
-    }
-    return arch === "x64" ? "x86_64-unknown-linux-gnu" : "aarch64-unknown-linux-gnu";
-  }
-  return null;
-}
-
-function isGlibc(report = process.report) {
-  return glibcVersion(report) !== null;
-}
-
-function glibcVersion(report = process.report) {
-  const header = typeof report?.getReport === "function" ? report.getReport().header : {};
-  return header?.glibcVersionRuntime || header?.glibcVersionCompiler || null;
-}
-
-function supportedGlibc(report = process.report) {
-  const version = glibcVersion(report);
-  if (!version) {
-    return false;
-  }
-  const [major, minor] = version.split(".").map((part) => Number.parseInt(part, 10));
-  if (!Number.isInteger(major) || !Number.isInteger(minor)) {
-    return false;
-  }
-  return major > MIN_GLIBC[0] || (major === MIN_GLIBC[0] && minor >= MIN_GLIBC[1]);
-}
-
-module.exports = {
-  glibcVersion,
-  isGlibc,
-  platformTarget,
-  supportedGlibc,
-};

package/scripts/install/retry.js

@@ -1,100 +0,0 @@
-"use strict";
-
-// A GitHub Releases asset download or its separate .sha256 checksum fetch can
-// hit a short-lived CDN 5xx, timeout, or connection reset. These defaults give
-// each network operation a bounded multi-attempt window (~15s avg / ~31s worst
-// case total sleep) to ride that out, rather than exhausting a tiny budget in a
-// few seconds. Override via NO_MISTAKES_DOWNLOAD_MAX_ATTEMPTS /
-// NO_MISTAKES_DOWNLOAD_RETRY_BASE_MS.
-const DEFAULT_MAX_ATTEMPTS = 6;
-const DEFAULT_RETRY_BASE_MS = 1_000;
-const RETRY_MAX_DELAY_MS = 30_000;
-const RETRYABLE_NETWORK_CODES = new Set([
-  "ECONNRESET",
-  "ECONNREFUSED",
-  "ETIMEDOUT",
-  "EAI_AGAIN",
-  "ENETUNREACH",
-  "EPIPE",
-  "ERR_STREAM_PREMATURE_CLOSE",
-]);
-
-class HttpError extends Error {
-  constructor(url, statusCode) {
-    super(`Download failed for ${url}: HTTP ${statusCode}`);
-    this.name = "HttpError";
-    this.statusCode = statusCode;
-    this.retryable = isRetryableStatus(statusCode);
-  }
-}
-
-function isRetryableStatus(statusCode) {
-  if (typeof statusCode !== "number") return false;
-  if (statusCode >= 500 && statusCode < 600) return true;
-  return statusCode === 408 || statusCode === 429;
-}
-
-function isRetryableError(error) {
-  if (!error) return false;
-  if (error.retryable === true) return true;
-  if (error.code && RETRYABLE_NETWORK_CODES.has(error.code)) return true;
-  return false;
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-function parsePositiveInt(value, fallback) {
-  if (value === undefined || value === null || value === "") return fallback;
-  const n = Number(value);
-  if (!Number.isFinite(n) || !Number.isInteger(n) || n < 1) return fallback;
-  return n;
-}
-
-function computeBackoffMs(attempt, baseDelayMs, random = Math.random) {
-  const exponential = baseDelayMs * 2 ** (attempt - 1);
-  const capped = Math.min(exponential, RETRY_MAX_DELAY_MS);
-  return Math.floor(random() * capped);
-}
-
-async function withRetry(fn, options = {}) {
-  const maxAttempts = parsePositiveInt(
-    options.maxAttempts ?? process.env.NO_MISTAKES_DOWNLOAD_MAX_ATTEMPTS,
-    DEFAULT_MAX_ATTEMPTS,
-  );
-  const baseDelayMs = parsePositiveInt(
-    options.baseDelayMs ?? process.env.NO_MISTAKES_DOWNLOAD_RETRY_BASE_MS,
-    DEFAULT_RETRY_BASE_MS,
-  );
-  const delay = options.delay ?? sleep;
-  const random = options.random ?? Math.random;
-  const logger = options.logger ?? console;
-  const describe = options.describe ?? (() => "download");
-
-  let attempt = 0;
-  for (;;) {
-    attempt += 1;
-    try {
-      return await fn();
-    } catch (error) {
-      if (attempt >= maxAttempts || !isRetryableError(error)) {
-        throw error;
-      }
-      const waitMs = computeBackoffMs(attempt, baseDelayMs, random);
-      logger.warn(
-        `no-mistakes: retrying ${describe()} after ${error.message} (attempt ${attempt + 1}/${maxAttempts}, waiting ~${waitMs}ms)`,
-      );
-      await delay(waitMs);
-    }
-  }
-}
-
-module.exports = {
-  HttpError,
-  computeBackoffMs,
-  isRetryableError,
-  isRetryableStatus,
-  parsePositiveInt,
-  withRetry,
-};

package/scripts/install/version-marker.js

@@ -1,30 +0,0 @@
-"use strict";
-
-const { readFileSync } = require("node:fs");
-
-function versionMarkerPath(destination) {
-  return `${destination}.version`;
-}
-
-// The destination binary alone can't tell us which version it is (the CLI's
-// own --version requires spawning a process, and the N-API .node addon isn't
-// executable at all), so track the installed version in a small sidecar file
-// written right after a successful install. A missing or mismatched marker
-// means we can't prove the existing file matches the requested version, so
-// checkExisting must fall through to a real (re)download rather than trust
-// stale bytes left behind by an earlier install of a different version.
-function installedVersion(destination) {
-  try {
-    return readFileSync(versionMarkerPath(destination), "utf8").trim();
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return null;
-    }
-    throw error;
-  }
-}
-
-module.exports = {
-  installedVersion,
-  versionMarkerPath,
-};

package/scripts/install.js

@@ -1,38 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-
-const { join } = require("node:path");
-const { install } = require("./install/index");
-
-const PACKAGE_ROOT = join(__dirname, "..");
-
-async function main(installFn = install, io = process, logger = console) {
-  try {
-    const pkg = require(join(PACKAGE_ROOT, "package.json"));
-    const binDir = join(PACKAGE_ROOT, "bin");
-    const binaryDestination = await installFn("no-mistakes", "jonathanong/no-mistakes", {
-      version: pkg.version,
-      vendorDir: binDir,
-      destinationName: "no-mistakes",
-      envVar: "NO_MISTAKES_RELEASE_BASE_URL",
-      checkExisting: true,
-    });
-    const addonDestination = await installFn("no-mistakes-napi", "jonathanong/no-mistakes", {
-      version: pkg.version,
-      vendorDir: binDir,
-      destinationName: "no-mistakes.node",
-      assetExtension: ".node",
-      envVar: "NO_MISTAKES_RELEASE_BASE_URL",
-      checkExisting: true,
-    });
-    logger.log(`Installed no-mistakes native binary to ${binaryDestination}`);
-    logger.log(`Installed no-mistakes N-API addon to ${addonDestination}`);
-  } catch (error) {
-    logger.error(error instanceof Error ? error.message : String(error));
-    io.exit(1);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = { main };