wyvrnpm 2.11.0 → 2.12.2

package/src/upload-built.js

@@ -1,265 +1,265 @@
-'use strict';
-
-const fs   = require('fs');
-const os   = require('os');
-const path = require('path');
-
-const { getProvider }        = require('./providers');
-const { defaultCompatBlock } = require('./compat');
-const { getBuildPaths }      = require('./build/cache');
-const { resolveSourceAuth }  = require('./auth');
-const log                    = require('./logger');
-
-const WYVRNPM_VERSION = require('../package.json').version;
-
-const UPLOAD_SIDECAR = '.uploaded-to.json';
-
-/**
- * Record a successful upload in a sidecar file alongside the build-cache
- * entry. Append-only so repeated uploads to different destinations all
- * leave a trail. Purely informational — nothing in the install/build flow
- * branches on these files. Wiped by `wyvrnpm clean --uploaded-built`.
- *
- * @param {{ name: string, version: string, profileHash: string, source: string, contentSha256: string }} args
- */
-function recordUploadSidecar({ name, version, profileHash, source, contentSha256 }) {
-  try {
-    const paths = getBuildPaths({ name, version, profileHash });
-    if (!fs.existsSync(paths.root)) return;
-    const sidecarPath = path.join(paths.root, UPLOAD_SIDECAR);
-    let doc = { uploads: [] };
-    if (fs.existsSync(sidecarPath)) {
-      try {
-        const raw = JSON.parse(fs.readFileSync(sidecarPath, 'utf8'));
-        if (Array.isArray(raw?.uploads)) doc = raw;
-      } catch { /* corrupt sidecar — overwrite with fresh doc */ }
-    }
-    doc.uploads.push({
-      uploadedAt: new Date().toISOString(),
-      source,
-      profileHash,
-      contentSha256,
-    });
-    fs.writeFileSync(sidecarPath, JSON.stringify(doc, null, 2) + '\n', 'utf8');
-  } catch {
-    // Sidecar bookkeeping is best-effort — never break an install over it.
-  }
-}
-
-/**
- * Upload a freshly source-built artefact back to the v2 registry under the
- * consumer's profileHash, so subsequent consumers with the same profile get
- * a direct download instead of re-cloning and re-compiling.
- *
- * See PLAN-UPLOAD-BUILT.md for the full design. Key properties:
- *
- *   - Opt-in. Only called when the user passes `--upload-built` at install.
- *   - Skips silently if the registry already has this (name, version,
- *     profileHash) — the common case once the first teammate has uploaded.
- *   - Never overwrites. A consumer with write credentials cannot clobber an
- *     existing artefact; that still requires `publish --force` from the
- *     source repo.
- *   - Leaves `latest.json` and the `latest` pointer in `versions.json`
- *     alone. A consumer upload is a new profileHash of an existing version,
- *     not a new version release. Honoured via `updateLatest: false`.
- *   - Records provenance in the uploaded manifest's `uploadedBy` block.
- *     Absence of this block implies author-publish by convention.
- *
- * @param {object} args
- * @param {string} args.name
- * @param {string} args.version
- * @param {import('./profile').WyvrnProfile} args.profile
- * @param {string} args.profileHash
- * @param {string} args.artefactPath       Absolute path to the built zip in %LOCALAPPDATA%\wyvrnpm\bc\.
- * @param {string} args.clonedManifestPath Absolute path to the cloned-source wyvrn.json.
- * @param {string} args.contentSha256      SHA256 of the built zip.
- * @param {string} args.gitRepo            Source repo URL recorded at publish.
- * @param {string} args.gitSha             Source commit recorded at publish.
- * @param {string} args.uploadSource       Destination URL (resolved from --upload-source or config).
- * @param {object} [args.uploadAuth]       { awsProfile?, token? }
- * @param {Record<string, any>|null} [args.options]  Effective options for this build (fed through to buildSettings.options).
- * @param {string} [args.toolchainHash]    Optional SHA of the generated wyvrn_toolchain.cmake.
- * @returns {Promise<{ uploaded: boolean, reason: string }>}
- */
-async function uploadSourceBuiltArtefact(args) {
-  const {
-    name, version, profile, profileHash,
-    artefactPath, clonedManifestPath,
-    contentSha256, gitRepo, gitSha,
-    uploadSource, uploadAuth = {},
-    options = null,
-    toolchainHash,
-  } = args;
-
-  if (!uploadSource) {
-    return { uploaded: false, reason: 'no upload source resolved' };
-  }
-  if (!fs.existsSync(artefactPath)) {
-    return { uploaded: false, reason: `artefact zip missing at ${artefactPath}` };
-  }
-  if (!fs.existsSync(clonedManifestPath)) {
-    // Cache-hit path on a previously-trimmed cache, or the source dir was
-    // manually deleted. We have the binary but not the manifest we would
-    // have uploaded alongside it. Surface it — nothing silent.
-    return { uploaded: false, reason: `cloned manifest missing at ${clonedManifestPath}` };
-  }
-
-  let provider;
-  try {
-    provider = getProvider(uploadSource);
-  } catch (err) {
-    return { uploaded: false, reason: `no provider for ${uploadSource}: ${err.message}` };
-  }
-
-  const { awsProfile, token } = uploadAuth;
-
-  // ── Skip-if-exists ────────────────────────────────────────────────────────
-  const exists = await provider.v2Exists({
-    source: uploadSource, name, version, profileHash, awsProfile, token,
-  });
-  if (exists) {
-    log.info(`upload-built: ${name}@${version} [${profileHash}] already on ${uploadSource} — skipping`);
-    return { uploaded: false, reason: 'already exists on registry' };
-  }
-
-  // ── Prepare manifest: cloned wyvrn.json + compat block + uploadedBy ──────
-  const rawManifest = JSON.parse(fs.readFileSync(clonedManifestPath, 'utf8'));
-  const manifestForUpload = {
-    ...rawManifest,
-    compatibility: rawManifest.compatibility ?? defaultCompatBlock(),
-    uploadedBy: {
-      kind:           'source-build',
-      profileHash,
-      builtFromGit:   gitRepo ?? null,
-      builtFromSha:   gitSha  ?? null,
-      ...(toolchainHash ? { toolchainHash } : {}),
-      uploadedAt:     new Date().toISOString(),
-      wyvrnpmVersion: WYVRNPM_VERSION,
-    },
-  };
-
-  const tmpManifestPath = path.join(
-    os.tmpdir(),
-    `wyvrnpm-upload-${name}-${version}-${profileHash}-${Date.now()}.json`,
-  );
-  fs.writeFileSync(tmpManifestPath, JSON.stringify(manifestForUpload, null, 2), 'utf8');
-
-  try {
-    log.info(`upload-built: ${name}@${version} [${profileHash}] → ${uploadSource}`);
-    await provider.v2Publish(
-      { manifest: tmpManifestPath, zip: artefactPath },
-      {
-        source:        uploadSource,
-        name, version, profileHash,
-        buildSettings: options ? { ...profile, options } : profile,
-        contentSha256,
-        gitSha:  gitSha  ?? null,
-        gitRepo: gitRepo ?? null,
-        // Consumer uploads must not reshape the "latest" pointer — see
-        // PLAN-UPLOAD-BUILT §3.3.
-        updateLatest: false,
-        uploadedBy:   manifestForUpload.uploadedBy,
-        awsProfile,
-        token,
-      },
-    );
-    log.success(`upload-built: ${name}@${version} [${profileHash}] uploaded`);
-    recordUploadSidecar({ name, version, profileHash, source: uploadSource, contentSha256 });
-    return { uploaded: true, reason: 'ok' };
-  } catch (err) {
-    // The caller wraps us in try/catch too, but returning {uploaded:false}
-    // here keeps the happy path type-stable.
-    return { uploaded: false, reason: `upload failed: ${err.message}` };
-  } finally {
-    try { fs.unlinkSync(tmpManifestPath); } catch { /* ignore */ }
-  }
-}
-
-/**
- * Resolve `--upload-source` (URL or configured-publish-source name) + auth
- * into an object the orchestrator understands. Mirrors the resolution
- * pattern in src/commands/publish.js so the two flows behave identically.
- *
- * Returns null if no destination can be resolved — caller decides whether
- * that is fatal (it is, if --upload-built was passed) or just skip-worthy.
- *
- * @param {object} argv
- * @param {string|undefined} argv.uploadSource
- * @param {string|undefined} argv.awsProfile
- * @param {string|undefined} argv.token
- * @param {{ publishSources: Array<{name:string, url:string, profile?:string, token?:string}> }} config
- * @returns {{ uploadSource: string, uploadAuth: { awsProfile?: string, token?: string } } | null}
- */
-function resolveUploadDestination(argv, config) {
-  let src = argv.uploadSource;
-  let awsProfile = argv.awsProfile;
-  let token      = argv.token;
-  let sourceEntry = null;
-
-  const publishSources = config.publishSources ?? [];
-
-  if (src) {
-    // Check if it matches a configured publish source by name.
-    const named = publishSources.find((s) => s.name === src);
-    if (named) {
-      src        = named.url;
-      awsProfile = awsProfile ?? named.profile;
-      sourceEntry = named;
-      log.info(`upload-built: using publish source "${named.name}" from config`);
-    }
-  } else if (publishSources.length > 0) {
-    const first = publishSources[0];
-    src        = first.url;
-    awsProfile = awsProfile ?? first.profile;
-    sourceEntry = first;
-    log.info(`upload-built: using first configured publish source "${first.name}"`);
-  }
-
-  // Fall back to the matched source entry's own token / tokenEnv only if
-  // the caller didn't pass one already (argv.token wins). resolveSourceAuth
-  // handles the literal-vs-env-backed precedence per side.
-  if (token === undefined || token === null) {
-    token = resolveSourceAuth({}, sourceEntry).token;
-  }
-
-  if (!src) return null;
-  return { uploadSource: src, uploadAuth: { awsProfile, token } };
-}
-
-/**
- * Create an empty accumulator for aggregated upload outcomes. Pass the
- * returned object as `options.uploadStats` to `downloadDependencies`, then
- * feed it to `formatUploadSummary()` at the end of the install.
- *
- * @returns {{ uploaded: Array<object>, skipped: Array<object>, failed: Array<object> }}
- */
-function createUploadStats() {
-  return { uploaded: [], skipped: [], failed: [] };
-}
-
-/**
- * Produce the one-line aggregated summary shown at the end of an install
- * when `--upload-built` was passed. Returns null when nothing was attempted
- * (so the caller can skip printing).
- *
- * @param {{ uploaded: Array, skipped: Array, failed: Array }} stats
- * @returns {string|null}
- */
-function formatUploadSummary(stats) {
-  if (!stats) return null;
-  const total = stats.uploaded.length + stats.skipped.length + stats.failed.length;
-  if (total === 0) return null;
-  const n = (arr, singular) => `${arr.length} ${singular}${arr.length === 1 ? '' : 's'}`;
-  return (
-    `upload-built summary: ${n(stats.uploaded, 'artefact')} uploaded, ` +
-    `${stats.skipped.length} skipped (already existed), ` +
-    `${stats.failed.length} failed`
-  );
-}
-
-module.exports = {
-  uploadSourceBuiltArtefact,
-  resolveUploadDestination,
-  createUploadStats,
-  formatUploadSummary,
-};
+'use strict';
+
+const fs   = require('fs');
+const os   = require('os');
+const path = require('path');
+
+const { getProvider }        = require('./providers');
+const { defaultCompatBlock } = require('./compat');
+const { getBuildPaths }      = require('./build/cache');
+const { resolveSourceAuth }  = require('./auth');
+const log                    = require('./logger');
+
+const WYVRNPM_VERSION = require('../package.json').version;
+
+const UPLOAD_SIDECAR = '.uploaded-to.json';
+
+/**
+ * Record a successful upload in a sidecar file alongside the build-cache
+ * entry. Append-only so repeated uploads to different destinations all
+ * leave a trail. Purely informational — nothing in the install/build flow
+ * branches on these files. Wiped by `wyvrnpm clean --uploaded-built`.
+ *
+ * @param {{ name: string, version: string, profileHash: string, source: string, contentSha256: string }} args
+ */
+function recordUploadSidecar({ name, version, profileHash, source, contentSha256 }) {
+  try {
+    const paths = getBuildPaths({ name, version, profileHash });
+    if (!fs.existsSync(paths.root)) return;
+    const sidecarPath = path.join(paths.root, UPLOAD_SIDECAR);
+    let doc = { uploads: [] };
+    if (fs.existsSync(sidecarPath)) {
+      try {
+        const raw = JSON.parse(fs.readFileSync(sidecarPath, 'utf8'));
+        if (Array.isArray(raw?.uploads)) doc = raw;
+      } catch { /* corrupt sidecar — overwrite with fresh doc */ }
+    }
+    doc.uploads.push({
+      uploadedAt: new Date().toISOString(),
+      source,
+      profileHash,
+      contentSha256,
+    });
+    fs.writeFileSync(sidecarPath, JSON.stringify(doc, null, 2) + '\n', 'utf8');
+  } catch {
+    // Sidecar bookkeeping is best-effort — never break an install over it.
+  }
+}
+
+/**
+ * Upload a freshly source-built artefact back to the v2 registry under the
+ * consumer's profileHash, so subsequent consumers with the same profile get
+ * a direct download instead of re-cloning and re-compiling.
+ *
+ * See PLAN-UPLOAD-BUILT.md for the full design. Key properties:
+ *
+ *   - Opt-in. Only called when the user passes `--upload-built` at install.
+ *   - Skips silently if the registry already has this (name, version,
+ *     profileHash) — the common case once the first teammate has uploaded.
+ *   - Never overwrites. A consumer with write credentials cannot clobber an
+ *     existing artefact; that still requires `publish --force` from the
+ *     source repo.
+ *   - Leaves `latest.json` and the `latest` pointer in `versions.json`
+ *     alone. A consumer upload is a new profileHash of an existing version,
+ *     not a new version release. Honoured via `updateLatest: false`.
+ *   - Records provenance in the uploaded manifest's `uploadedBy` block.
+ *     Absence of this block implies author-publish by convention.
+ *
+ * @param {object} args
+ * @param {string} args.name
+ * @param {string} args.version
+ * @param {import('./profile').WyvrnProfile} args.profile
+ * @param {string} args.profileHash
+ * @param {string} args.artefactPath       Absolute path to the built zip in %LOCALAPPDATA%\wyvrnpm\bc\.
+ * @param {string} args.clonedManifestPath Absolute path to the cloned-source wyvrn.json.
+ * @param {string} args.contentSha256      SHA256 of the built zip.
+ * @param {string} args.gitRepo            Source repo URL recorded at publish.
+ * @param {string} args.gitSha             Source commit recorded at publish.
+ * @param {string} args.uploadSource       Destination URL (resolved from --upload-source or config).
+ * @param {object} [args.uploadAuth]       { awsProfile?, token? }
+ * @param {Record<string, any>|null} [args.options]  Effective options for this build (fed through to buildSettings.options).
+ * @param {string} [args.toolchainHash]    Optional SHA of the generated wyvrn_toolchain.cmake.
+ * @returns {Promise<{ uploaded: boolean, reason: string }>}
+ */
+async function uploadSourceBuiltArtefact(args) {
+  const {
+    name, version, profile, profileHash,
+    artefactPath, clonedManifestPath,
+    contentSha256, gitRepo, gitSha,
+    uploadSource, uploadAuth = {},
+    options = null,
+    toolchainHash,
+  } = args;
+
+  if (!uploadSource) {
+    return { uploaded: false, reason: 'no upload source resolved' };
+  }
+  if (!fs.existsSync(artefactPath)) {
+    return { uploaded: false, reason: `artefact zip missing at ${artefactPath}` };
+  }
+  if (!fs.existsSync(clonedManifestPath)) {
+    // Cache-hit path on a previously-trimmed cache, or the source dir was
+    // manually deleted. We have the binary but not the manifest we would
+    // have uploaded alongside it. Surface it — nothing silent.
+    return { uploaded: false, reason: `cloned manifest missing at ${clonedManifestPath}` };
+  }
+
+  let provider;
+  try {
+    provider = getProvider(uploadSource);
+  } catch (err) {
+    return { uploaded: false, reason: `no provider for ${uploadSource}: ${err.message}` };
+  }
+
+  const { awsProfile, token } = uploadAuth;
+
+  // ── Skip-if-exists ────────────────────────────────────────────────────────
+  const exists = await provider.v2Exists({
+    source: uploadSource, name, version, profileHash, awsProfile, token,
+  });
+  if (exists) {
+    log.info(`upload-built: ${name}@${version} [${profileHash}] already on ${uploadSource} — skipping`);
+    return { uploaded: false, reason: 'already exists on registry' };
+  }
+
+  // ── Prepare manifest: cloned wyvrn.json + compat block + uploadedBy ──────
+  const rawManifest = JSON.parse(fs.readFileSync(clonedManifestPath, 'utf8'));
+  const manifestForUpload = {
+    ...rawManifest,
+    compatibility: rawManifest.compatibility ?? defaultCompatBlock(),
+    uploadedBy: {
+      kind:           'source-build',
+      profileHash,
+      builtFromGit:   gitRepo ?? null,
+      builtFromSha:   gitSha  ?? null,
+      ...(toolchainHash ? { toolchainHash } : {}),
+      uploadedAt:     new Date().toISOString(),
+      wyvrnpmVersion: WYVRNPM_VERSION,
+    },
+  };
+
+  const tmpManifestPath = path.join(
+    os.tmpdir(),
+    `wyvrnpm-upload-${name}-${version}-${profileHash}-${Date.now()}.json`,
+  );
+  fs.writeFileSync(tmpManifestPath, JSON.stringify(manifestForUpload, null, 2), 'utf8');
+
+  try {
+    log.info(`upload-built: ${name}@${version} [${profileHash}] → ${uploadSource}`);
+    await provider.v2Publish(
+      { manifest: tmpManifestPath, zip: artefactPath },
+      {
+        source:        uploadSource,
+        name, version, profileHash,
+        buildSettings: options ? { ...profile, options } : profile,
+        contentSha256,
+        gitSha:  gitSha  ?? null,
+        gitRepo: gitRepo ?? null,
+        // Consumer uploads must not reshape the "latest" pointer — see
+        // PLAN-UPLOAD-BUILT §3.3.
+        updateLatest: false,
+        uploadedBy:   manifestForUpload.uploadedBy,
+        awsProfile,
+        token,
+      },
+    );
+    log.success(`upload-built: ${name}@${version} [${profileHash}] uploaded`);
+    recordUploadSidecar({ name, version, profileHash, source: uploadSource, contentSha256 });
+    return { uploaded: true, reason: 'ok' };
+  } catch (err) {
+    // The caller wraps us in try/catch too, but returning {uploaded:false}
+    // here keeps the happy path type-stable.
+    return { uploaded: false, reason: `upload failed: ${err.message}` };
+  } finally {
+    try { fs.unlinkSync(tmpManifestPath); } catch { /* ignore */ }
+  }
+}
+
+/**
+ * Resolve `--upload-source` (URL or configured-publish-source name) + auth
+ * into an object the orchestrator understands. Mirrors the resolution
+ * pattern in src/commands/publish.js so the two flows behave identically.
+ *
+ * Returns null if no destination can be resolved — caller decides whether
+ * that is fatal (it is, if --upload-built was passed) or just skip-worthy.
+ *
+ * @param {object} argv
+ * @param {string|undefined} argv.uploadSource
+ * @param {string|undefined} argv.awsProfile
+ * @param {string|undefined} argv.token
+ * @param {{ publishSources: Array<{name:string, url:string, profile?:string, token?:string}> }} config
+ * @returns {{ uploadSource: string, uploadAuth: { awsProfile?: string, token?: string } } | null}
+ */
+function resolveUploadDestination(argv, config) {
+  let src = argv.uploadSource;
+  let awsProfile = argv.awsProfile;
+  let token      = argv.token;
+  let sourceEntry = null;
+
+  const publishSources = config.publishSources ?? [];
+
+  if (src) {
+    // Check if it matches a configured publish source by name.
+    const named = publishSources.find((s) => s.name === src);
+    if (named) {
+      src        = named.url;
+      awsProfile = awsProfile ?? named.profile;
+      sourceEntry = named;
+      log.info(`upload-built: using publish source "${named.name}" from config`);
+    }
+  } else if (publishSources.length > 0) {
+    const first = publishSources[0];
+    src        = first.url;
+    awsProfile = awsProfile ?? first.profile;
+    sourceEntry = first;
+    log.info(`upload-built: using first configured publish source "${first.name}"`);
+  }
+
+  // Fall back to the matched source entry's own token / tokenEnv only if
+  // the caller didn't pass one already (argv.token wins). resolveSourceAuth
+  // handles the literal-vs-env-backed precedence per side.
+  if (token === undefined || token === null) {
+    token = resolveSourceAuth({}, sourceEntry).token;
+  }
+
+  if (!src) return null;
+  return { uploadSource: src, uploadAuth: { awsProfile, token } };
+}
+
+/**
+ * Create an empty accumulator for aggregated upload outcomes. Pass the
+ * returned object as `options.uploadStats` to `downloadDependencies`, then
+ * feed it to `formatUploadSummary()` at the end of the install.
+ *
+ * @returns {{ uploaded: Array<object>, skipped: Array<object>, failed: Array<object> }}
+ */
+function createUploadStats() {
+  return { uploaded: [], skipped: [], failed: [] };
+}
+
+/**
+ * Produce the one-line aggregated summary shown at the end of an install
+ * when `--upload-built` was passed. Returns null when nothing was attempted
+ * (so the caller can skip printing).
+ *
+ * @param {{ uploaded: Array, skipped: Array, failed: Array }} stats
+ * @returns {string|null}
+ */
+function formatUploadSummary(stats) {
+  if (!stats) return null;
+  const total = stats.uploaded.length + stats.skipped.length + stats.failed.length;
+  if (total === 0) return null;
+  const n = (arr, singular) => `${arr.length} ${singular}${arr.length === 1 ? '' : 's'}`;
+  return (
+    `upload-built summary: ${n(stats.uploaded, 'artefact')} uploaded, ` +
+    `${stats.skipped.length} skipped (already existed), ` +
+    `${stats.failed.length} failed`
+  );
+}
+
+module.exports = {
+  uploadSourceBuiltArtefact,
+  resolveUploadDestination,
+  createUploadStats,
+  formatUploadSummary,
+};