wellkit 0.0.0-stage → 0.2.0

package/EULA.txt

@@ -0,0 +1,33 @@
+Wellkit CLI Binary End User Licence Agreement (0.x preview)
+Copyright (c) BarretoTech. All rights reserved.
+
+1. Permission. BarretoTech grants you a non-exclusive, worldwide, royalty-free
+licence to install and use the unmodified Wellkit CLI and its launcher for any
+purpose, including commercial use. You may redistribute unmodified copies if
+you preserve this agreement and all third-party copyright and licence notices.
+No licence to the proprietary source code is granted.
+
+2. Restrictions. You may not redistribute modified versions of the proprietary
+binaries. You may not reverse engineer, decompile or disassemble proprietary
+parts of the software, except to the extent permitted by applicable law or the
+third-party licences described below. No trademark rights are granted.
+
+3. Third-party software. Third-party components remain governed by their own
+licences in notices.zip and the release SBOM. Those licences prevail over any
+conflicting provision here, including rights to source, modification,
+redistribution, relinking and reverse engineering to debug modifications.
+This agreement does not restrict those rights or decide the licence of any
+separately distributed Wellkit component library.
+
+4. Preview and warranty. This is an unsigned 0.x preview. The software is
+provided "AS IS", without warranties of any kind, including merchantability,
+fitness for a particular purpose or non-infringement. You are responsible for
+verifying results and for decisions made using them.
+
+5. Liability. To the maximum extent permitted by applicable law, BarretoTech
+is not liable for losses, damages or other liability arising from the software
+or its use. Nothing here excludes a right or liability that law cannot exclude.
+
+6. Termination. Permission to use the proprietary parts ends if you materially
+breach this agreement. Termination does not limit rights granted independently
+by third-party licences or applicable law.

package/checksums.json

@@ -0,0 +1,37 @@
+{
+  "version": "0.2.0",
+  "assets": {
+    "wellkit-linux-x64": {
+      "sha256": "50040b6e87c133a846adeacf8b1574892fa50553f8cc6e5788d61cf5e6b9b6e0",
+      "size": 163605320
+    },
+    "wellkit-linux-x64-musl": {
+      "sha256": "ec482a9b1c44e4876b3c3df1519052ba4f70369475df80b122e6210fd348cd65",
+      "size": 151224488
+    },
+    "wellkit-linux-arm64": {
+      "sha256": "a8f137031cadfc4eae7d4deaa4af43aa4fea54ad20aa6b3500ef201a290df079",
+      "size": 164417248
+    },
+    "wellkit-linux-arm64-musl": {
+      "sha256": "3db067bad699ecfd52f9451c14a96b9d94fb1fb6073df222d17a7adde121ed5f",
+      "size": 149309248
+    },
+    "wellkit-darwin-x64": {
+      "sha256": "f788d8056251f3a22f8cd05eddbc6ddaf26ce3c8a8d939dbf15250be41818d8b",
+      "size": 155570664
+    },
+    "wellkit-darwin-arm64": {
+      "sha256": "613c84436586850826d94ce1fd5ec021792383859c5c0898d7ce939f964edb01",
+      "size": 144767954
+    },
+    "wellkit-win32-x64.exe": {
+      "sha256": "62761bd5dc6c8340b75aaa62964b2d2a044e435213380498a49cfa77ed909f85",
+      "size": 171355648
+    },
+    "wellkit-win32-arm64.exe": {
+      "sha256": "613ad9418d508bc40f8dc91f220eff1a856bffa956cead37a3edfb8fe3812058",
+      "size": 154374144
+    }
+  }
+}

package/package.json

@@ -1,6 +1,23 @@
 {
+  "version": "0.2.0",
+  "license": "SEE LICENSE IN EULA.txt",
+  "description": "Wellkit CLI launcher — downloads and verifies the unsigned 0.x preview binary",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/BarretoTech/well-components"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
   "name": "wellkit",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "type": "module",
+  "bin": {
+    "wellkit": "wellkit.mjs"
+  },
+  "files": [
+    "wellkit.mjs",
+    "checksums.json",
+    "EULA.txt",
+    "notices.zip"
+  ]
+}

package/wellkit.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{spawn as G}from"node:child_process";import{createHash as P,randomBytes as J}from"node:crypto";import{closeSync as U,mkdirSync as z,openSync as M,readFileSync as I,realpathSync as D,renameSync as q,rmSync as b,statSync as L,writeSync as X}from"node:fs";import O from"node:http";import A from"node:https";import{homedir as W}from"node:os";import{dirname as Y,isAbsolute as F,join as p}from"node:path";import V from"node:tls";import{fileURLToPath as E}from"node:url";var g=[{id:"linux-x64",compile:"bun-linux-x64",os:"linux",arch:"x64",libc:"glibc"},{id:"linux-x64-musl",compile:"bun-linux-x64-musl",os:"linux",arch:"x64",libc:"musl"},{id:"linux-arm64",compile:"bun-linux-arm64",os:"linux",arch:"arm64",libc:"glibc"},{id:"linux-arm64-musl",compile:"bun-linux-arm64-musl",os:"linux",arch:"arm64",libc:"musl"},{id:"darwin-x64",compile:"bun-darwin-x64",os:"darwin",arch:"x64",libc:null},{id:"darwin-arm64",compile:"bun-darwin-arm64",os:"darwin",arch:"arm64",libc:null},{id:"win32-x64",compile:"bun-windows-x64",os:"win32",arch:"x64",libc:null},{id:"win32-arm64",compile:"bun-windows-arm64",os:"win32",arch:"arm64",libc:null}];function S(e){return e.os==="win32"?"well.exe":"well"}var B="BarretoTech/wellkit",R=`https://github.com/${B}/releases/download`,x="checksums.json",H=(e)=>`wellkit-v${e}`,C=(e)=>`wellkit-${e.id}${S(e)==="well.exe"?".exe":""}`,v=(e,t,r)=>`${e}/${H(t)}/${r}`;function T(e,t){let r=()=>Error("Invalid checksums.json"),s;try{s=JSON.parse(e)}catch{throw r()}let n=s;if(!n||typeof n!=="object"||n.version!==t||!n.assets||typeof n.assets!=="object")throw r();for(let o of Object.values(n.assets))if(!o||!/^[0-9a-f]{64}$/.test(o.sha256)||!Number.isSafeInteger(o.size)||o.size<=0)throw r();return n}class c extends Error{}function j(e,t){let r=e;if(typeof r?.header?.glibcVersionRuntime==="string"&&r.header.glibcVersionRuntime.length)return"glibc";if((Array.isArray(r?.sharedObjects)?r.sharedObjects:[]).some((n)=>typeof n==="string"&&n.includes("musl"))||/musl/i.test(t))return"musl";if(/GNU C Library|GLIBC/i.test(t))return"glibc";return}var K=g.map((e)=>e.id).join(", ");function Z(e,t,r,s){let n=(i)=>new c(`wellkit: ${i} Supported platforms: ${K}.`);if(!["linux","darwin","win32"].includes(e)||!["x64","arm64"].includes(t))throw n(`Unsupported platform ${e}/${t}.`);let o=e==="linux"?j(r,s):void 0;if(e==="linux"&&!o)throw n("Unsupported or undetectable Linux libc; glibc or musl is required.");return g.find((i)=>i.os===e&&i.arch===t&&(i.libc??void 0)===o)}function Q(e,t,r){let s=t.WELLKIT_CACHE_DIR;if(s)return s;if(e==="win32")return p(t.LOCALAPPDATA||p(r,"AppData","Local"),"wellkit","Cache");if(e==="darwin")return p(r,"Library","Caches","wellkit");let n=t.XDG_CACHE_HOME;return p(n&&F(n)?n:p(r,".cache"),"wellkit")}var k=(e)=>["127.0.0.1","localhost","[::1]"].includes(e.hostname);function ee(e,t){let r=t.HTTPS_PROXY||t.https_proxy;if(e.protocol!=="https:"||!r)return;let s=(t.NO_PROXY||t.no_proxy||"").split(",").map((i)=>i.trim().replace(/^\*?\./,"").toLowerCase()).filter(Boolean),n=e.hostname.toLowerCase();if(s.some((i)=>i==="*"||n===i||n.endsWith(`.${i}`)))return;let o;try{o=new URL(r)}catch{throw new c("wellkit: HTTPS_PROXY is not a valid URL.")}if(o.protocol!=="http:")throw new c("wellkit: HTTPS_PROXY must be an http:// URL.");return o}var te=(e)=>Number(e.port)||80;function ne(e,t){let r=new A.Agent;return r.createConnection=(s,n)=>{let o={};if(e.username)o["proxy-authorization"]=`Basic ${Buffer.from(`${decodeURIComponent(e.username)}:${decodeURIComponent(e.password)}`).toString("base64")}`;let i=O.request({host:e.hostname,port:te(e),method:"CONNECT",path:`${s.host}:${s.port}`,headers:o}),a=setTimeout(()=>i.destroy(Error("timed out")),t);i.on("close",()=>clearTimeout(a)),i.on("connect",(u,f)=>{if(u.statusCode!==200){f.destroy(),n(Error(`proxy answered ${u.statusCode}`));return}n(null,V.connect({...s,socket:f}))}),i.on("error",n),i.end()},r}function re(e,{env:t,ca:r,timeout:s=30000}){return new Promise((n,o)=>{let i=ee(e,t),a=(e.protocol==="https:"?A:O).get(e,{headers:{"user-agent":"wellkit-launcher"},...r?{ca:r}:{},...i?{agent:ne(i,s)}:{}},n);a.setTimeout(s,()=>a.destroy(Error("timed out"))),a.on("error",o)})}var oe=5;async function ie(e,t){let r=e;for(let s=0;s<=oe;s++){let n=await t(r),o=n.statusCode??0;if([301,302,303,307,308].includes(o)){n.resume();let i=n.headers.location;if(!i)throw new c(`redirect without a location from ${r.host}`);let a=new URL(i,r);if(a.protocol!=="https:"&&!(k(a)&&a.protocol==="http:"&&k(e)))throw new c(`refusing a redirect to ${a.protocol}//${a.host}`);r=a;continue}if(o!==200)throw n.resume(),new c(`${r.host} answered HTTP ${o}`);return n}throw new c("too many redirects")}var se={platform:process.platform,arch:process.arch,env:process.env,home:W(),dir:Y(E(import.meta.url)),pid:process.pid,report:process.report.getReport.bind(process.report),read:I,rename:q,get:(e)=>re(e,{env:process.env}),log:(e)=>console.error(e),spawn:(e,t,r)=>{let s=G(e,t,r),n=new Promise((o)=>{s.once("error",(i)=>o({error:i})),s.once("exit",(i,a)=>o({status:i,signal:a}))});return Object.assign(n,{kill:(o)=>s.kill(o)})},on:process.on.bind(process),off:process.off.bind(process),kill:process.kill.bind(process)},N=(e,t)=>{try{return L(e).size===t.size&&P("sha256").update(I(e)).digest("hex")===t.sha256}catch{return!1}};async function _(e,t,r,s){let n=C(e),o=s.assets[n];if(!o)throw new c(`wellkit: No checksum for ${n} is embedded in this package; refusing to download or run an unverified binary. Reinstall wellkit.`);let i=p(Q(r.platform,r.env,r.home),t),a=p(i,n);if(N(a,o))return a;b(a,{force:!0}),z(i,{recursive:!0});let u=new URL(v(r.env.WELLKIT_DOWNLOAD_BASE||R,t,n));if(u.protocol!=="https:"&&!(u.protocol==="http:"&&k(u)))throw new c("wellkit: download base must use https, or http on a loopback host.");r.log(`wellkit: downloading ${n} ${t} (first run)...`);let f=p(i,`.${n}.${r.pid}.${J(6).toString("hex")}.tmp`),d;try{let m;try{m=await ie(u,r.get)}catch(l){throw new c(`wellkit: Cannot download ${n} from ${u.host}: ${l instanceof Error?l.message:"request failed"}. The first run needs network access to github.com.`)}d=M(f,"w",493);let w=P("sha256"),h=0;try{for await(let l of m){if(h+=l.length,h>o.size)throw new c(`wellkit: ${n} is larger than expected; refusing it.`);w.update(l),X(d,l)}}catch(l){if(l instanceof c)throw l;throw new c(`wellkit: The download of ${n} was interrupted: ${l instanceof Error?l.message:"stream failed"}.`)}if(U(d),d=void 0,h!==o.size||w.digest("hex")!==o.sha256)throw new c(`wellkit: Checksum mismatch for ${n} ${t}; the download does not match the checksum embedded in this package and was discarded.`);try{r.rename(f,a)}catch(l){if(!N(a,o)){let y=!1;try{L(a),y=!0}catch{}if(b(a,{force:!0}),y)return _(e,t,r,s);throw l}}}finally{if(d!==void 0)U(d);b(f,{force:!0})}return a}async function ae(e,t=se){let r={},s="";if(t.platform==="linux"){try{r=t.report()}catch{}if(!j(r,""))for(let m of["/usr/bin/ldd","/bin/ldd"])try{s=t.read(m,"utf8");break}catch{}}let n=Z(t.platform,t.arch,r,s),o;try{o=JSON.parse(t.read(p(t.dir,"package.json"),"utf8")).version}catch{}if(typeof o!=="string")throw new c("wellkit: Invalid launcher version; reinstall wellkit.");let i;try{i=T(t.read(p(t.dir,x),"utf8"),o)}catch{throw new c(`wellkit: ${x} is missing or does not match this version; refusing to run an unverified binary. Reinstall wellkit.`)}let a=await _(n,o,t,i),u=t.spawn(a,e,{stdio:"inherit"}),f=["SIGINT","SIGTERM","SIGHUP"].map((m)=>{let w=()=>{if("kill"in u)u.kill(m)};return t.on(m,w),{signal:m,relay:w}}),d;try{d=await u}finally{for(let{signal:m,relay:w}of f)t.off(m,w)}if(d.error)throw new c("wellkit: Unable to start the downloaded well binary; remove the wellkit cache directory and retry.");if(d.signal)return t.kill(t.pid,d.signal),1;return d.status??2}async function ce(e=import.meta.url,t=process,r=console,s=ae,n=D){if(!t.argv[1])return;try{if(n(t.argv[1])!==n(E(e)))return}catch{return}try{t.exitCode=await s(t.argv.slice(2))}catch(o){r.error(o instanceof c?o.message:"wellkit: Unable to start; reinstall wellkit."),t.exitCode=2}}ce();export{Q as cacheRoot,_ as ensureBinary,re as httpGet,ce as main,ee as proxyFor,te as proxyPort,ae as runLauncher,Z as selectTarget,se as system};

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.