scripts/rust/publish-cli.mjs - maka - Git at Google


            
            /*

            
             * Licensed to the Apache Software Foundation (ASF) under one

            
             * or more contributor license agreements.  See the NOTICE file

            
             * distributed with this work for additional information

            
             * regarding copyright ownership.  The ASF licenses this file

            
             * to you under the Apache License, Version 2.0 (the

            
             * "License"); you may not use this file except in compliance

            
             * with the License.  You may obtain a copy of the License at

            
             *

            
             *     http://www.apache.org/licenses/LICENSE-2.0

            
             *

            
             * Unless required by applicable law or agreed to in writing,

            
             * software distributed under the License is distributed on an

            
             * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

            
             * KIND, either express or implied.  See the License for the

            
             * specific language governing permissions and limitations

            
             * under the License.

            
             */


            import { createHash } from 'node:crypto';

            
            import { execFileSync } from 'node:child_process';

            
            import { createReadStream } from 'node:fs';

            
            import { readFile } from 'node:fs/promises';

            
            import { basename, dirname, join, resolve } from 'node:path';

            
            import { pathToFileURL } from 'node:url';

            
            import { parseArgs } from 'node:util';

            
            import { compareProductReleaseVersions, parseProductReleaseVersion } from '../release-version.mjs';

            
            import { npmSpawnOptions } from '../npm-spawn.mjs';

            
            import { execTar } from '../asf-source-release.mjs';


            // Publish the Windows component before Linux can expose it to WSL users.

            
            export const previewTargets = ['win32-x64', 'darwin-arm64', 'linux-x64-gnu'];


            /** Validate the complete set before the first external write; npm has no multi-package transaction. */

            
            export async function readNativePreviewRelease(directory) {

            
              const packages = [];

            
              for (const target of previewTargets) {

            
                const receipt = JSON.parse(await readFile(join(directory, target + '.json'), 'utf8'));

            
                const { name, version, integrity } = receipt;

            
                if (

            
                  name !== '@maka-agent/cli-' + target ||

            
                  receipt.target !== target ||

            
                  !parseProductReleaseVersion(version).prerelease.join('.').startsWith('rust-preview.')

            
                ) {

            
                  throw new Error('Invalid native preview receipt');

            
                }

            
                const filename = 'maka-agent-cli-' + target + '-' + version + '.tgz';

            
                if (basename(receipt.archive) !== filename) throw new Error('Native archive name differs');

            
                const archive = resolve(directory, filename);

            
                const hash = createHash('sha512');

            
                for await (const chunk of createReadStream(archive)) hash.update(chunk);

            
                if (integrity !== 'sha512-' + hash.digest('base64'))

            
                  throw new Error('Native archive integrity differs');

            
                const manifest = JSON.parse(

            
                  execTar(archive, ['-xOf', 'package/package.json'], {

            
                    encoding: 'utf8',

            
                    maxBuffer: 64 * 1024,

            
                    timeout: 30_000,

            
                  }),

            
                );

            
                if (

            
                  manifest.name !== name ||

            
                  manifest.version !== version ||

            
                  !/^[a-f0-9]{128}$/.test(manifest.makaSource?.sha512 ?? '') ||

            
                  manifest.publishConfig?.tag !== 'rust-preview'

            
                )

            
                  throw new Error('Native package provenance differs');

            
                if (

            
                  packages.length &&

            
                  (version !== packages[0].version ||

            
                    JSON.stringify(manifest.makaSource) !== JSON.stringify(packages[0].source))

            
                ) {

            
                  throw new Error('All platforms must come from the same source archive and build identifier');

            
                }

            
                packages.push({ name, version, archive, integrity, source: manifest.makaSource });

            
              }

            
              return packages;

            
            }


            export async function readPreviewRelease(directory) {

            
              directory = resolve(directory);

            
              const packages = await readNativePreviewRelease(directory);

            
              const receipt = JSON.parse(await readFile(join(directory, 'launcher.json'), 'utf8'));

            
              const version = packages[0].version;

            
              const filename = `maka-agent-cli-${version}.tgz`;

            
              if (

            
                receipt.name !== '@maka-agent/cli' ||

            
                receipt.version !== version ||

            
                receipt.archive !== filename

            
              ) {

            
                throw new Error('Invalid native launcher receipt');

            
              }

            
              const archive = join(directory, filename);

            
              const hash = createHash('sha512');

            
              for await (const chunk of createReadStream(archive)) hash.update(chunk);

            
              if (receipt.integrity !== 'sha512-' + hash.digest('base64')) {

            
                throw new Error('Launcher archive integrity differs');

            
              }

            
              const manifest = JSON.parse(

            
                execTar(archive, ['-xOf', 'package/package.json'], {

            
                  encoding: 'utf8',

            
                  maxBuffer: 64 * 1024,

            
                  timeout: 30_000,

            
                }),

            
              );

            
              const expected = Object.fromEntries(packages.map(({ name }) => [name, version]));

            
              const entries = (value) => Object.entries(value ?? {}).sort(([a], [b]) => a.localeCompare(b));

            
              if (

            
                manifest.name !== '@maka-agent/cli' ||

            
                manifest.version !== version ||

            
                manifest.bin?.maka !== 'bin/maka.mjs' ||

            
                manifest.publishConfig?.tag !== 'rust-preview' ||

            
                JSON.stringify(entries(manifest.optionalDependencies)) !== JSON.stringify(entries(expected)) ||

            
                JSON.stringify(manifest.makaSource) !== JSON.stringify(packages[0].source)

            
              ) {

            
                throw new Error('Launcher does not match its native platform set');

            
              }

            
              return [...packages, { ...receipt, archive, source: packages[0].source }];

            
            }


            async function metadata(path) {

            
              const response = await fetch('https://registry.npmjs.org/' + path, {

            
                redirect: 'error',

            
                signal: AbortSignal.timeout(30_000),

            
              });

            
              if (response.status === 404) return null;

            
              if (!response.ok) throw new Error('npm registry query failed: ' + response.status);

            
              const text = await response.text();

            
              if (text.length > 1024 * 1024) throw new Error('npm metadata exceeds limit');

            
              return JSON.parse(text);

            
            }


            export async function publishPreviewRelease(directory, { provenance = false } = {}) {

            
              const packages = await readPreviewRelease(directory);

            
              // Preflight every platform before publishing any. Existing matching immutable

            
              // versions are a successful retry, never grounds to upload different bytes.

            
              for (const pkg of packages) {

            
                const existing = await metadata(pkg.name + '/' + pkg.version);

            
                if (existing && existing.dist?.integrity !== pkg.integrity)

            
                  throw new Error('Published version has different bytes: ' + pkg.name);

            
                pkg.published = Boolean(existing);

            
                const tags = await metadata('-/package/' + pkg.name.replace('/', '%2f') + '/dist-tags');

            
                if (

            
                  tags?.['rust-preview'] &&

            
                  compareProductReleaseVersions(tags['rust-preview'], pkg.version) > 0

            
                ) {

            
                  throw new Error('Refusing to move rust-preview backwards: ' + pkg.name);

            
                }

            
              }

            
              for (const pkg of packages) {

            
                // Re-read immediately before moving a tag: another publisher may have

            
                // advanced it since preflight. Immutable versions alone are not discovery.

            
                const tagsPath = '-/package/' + pkg.name.replace('/', '%2f') + '/dist-tags';

            
                const tags = await metadata(tagsPath);

            
                if (

            
                  tags?.['rust-preview'] &&

            
                  compareProductReleaseVersions(tags['rust-preview'], pkg.version) > 0

            
                ) {

            
                  throw new Error('Refusing to move rust-preview backwards: ' + pkg.name);

            
                }

            
                if (!pkg.published) {

            
                  execFileSync(

            
                    'npm',

            
                    [

            
                      'publish',

            
                      basename(pkg.archive),

            
                      '--tag',

            
                      'rust-preview',

            
                      '--access',

            
                      'public',

            
                      '--ignore-scripts',

            
                      ...(provenance ? ['--provenance'] : []),

            
                    ],

            
                    npmSpawnOptions({ cwd: dirname(pkg.archive), stdio: 'inherit', timeout: 180_000 }),

            
                  );

            
                }

            
                if (tags?.['rust-preview'] !== pkg.version) {

            
                  execFileSync(

            
                    'npm',

            
                    [

            
                      'dist-tag',

            
                      'add',

            
                      pkg.name + '@' + pkg.version,

            
                      'rust-preview',

            
                      '--registry',

            
                      'https://registry.npmjs.org/',

            
                    ],

            
                    npmSpawnOptions({ stdio: 'inherit', timeout: 180_000 }),

            
                  );

            
                }

            
                let verified = false;

            
                // npm acknowledges uploads before asynchronous processing exposes versions

            
                // and tags. Allow about ten minutes without re-uploading accepted bytes.

            
                const confirmationAttempts = 25;

            
                for (let attempt = 0; attempt < confirmationAttempts; attempt++) {

            
                  const [observed, tags] = await Promise.all([

            
                    metadata(pkg.name + '/' + pkg.version),

            
                    metadata(tagsPath),

            
                  ]);

            
                  if (observed?.dist?.integrity === pkg.integrity && tags?.['rust-preview'] === pkg.version) {

            
                    verified = true;

            
                    break;

            
                  }

            
                  if (attempt + 1 < confirmationAttempts) {

            
                    await new Promise((resolveDelay) =>

            
                      setTimeout(resolveDelay, Math.min(30_000, 1000 * 2 ** attempt)),

            
                    );

            
                  }

            
                }

            
                if (!verified)

            
                  throw new Error('Publication is unconfirmed; retry this same artifact set: ' + pkg.name);

            
                console.log(pkg.name + '@' + pkg.version + ' verified');

            
              }

            
            }


            if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {

            
              const { values, positionals } = parseArgs({

            
                allowPositionals: true,

            
                options: {

            
                  publish: { type: 'boolean', default: false },

            
                  provenance: { type: 'boolean', default: false },

            
                },

            
              });

            
              if (positionals.length !== 1)

            
                throw new Error('Usage: publish-cli.mjs <artifact-directory> [--publish] [--provenance]');

            
              if (values.publish) await publishPreviewRelease(positionals[0], values);

            
              else console.log(JSON.stringify(await readPreviewRelease(positionals[0])));

            
            }
	/*
	* Licensed to the Apache Software Foundation (ASF) under one
	* or more contributor license agreements. See the NOTICE file
	* distributed with this work for additional information
	* regarding copyright ownership. The ASF licenses this file
	* to you under the Apache License, Version 2.0 (the
	* "License"); you may not use this file except in compliance
	* with the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing,
	* software distributed under the License is distributed on an
	* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
	* KIND, either express or implied. See the License for the
	* specific language governing permissions and limitations
	* under the License.
	*/

	import { createHash } from 'node:crypto';
	import { execFileSync } from 'node:child_process';
	import { createReadStream } from 'node:fs';
	import { readFile } from 'node:fs/promises';
	import { basename, dirname, join, resolve } from 'node:path';
	import { pathToFileURL } from 'node:url';
	import { parseArgs } from 'node:util';
	import { compareProductReleaseVersions, parseProductReleaseVersion } from '../release-version.mjs';
	import { npmSpawnOptions } from '../npm-spawn.mjs';
	import { execTar } from '../asf-source-release.mjs';

	// Publish the Windows component before Linux can expose it to WSL users.
	export const previewTargets = ['win32-x64', 'darwin-arm64', 'linux-x64-gnu'];

	/** Validate the complete set before the first external write; npm has no multi-package transaction. */
	export async function readNativePreviewRelease(directory) {
	const packages = [];
	for (const target of previewTargets) {
	const receipt = JSON.parse(await readFile(join(directory, target + '.json'), 'utf8'));
	const { name, version, integrity } = receipt;
	if (
	name !== '@maka-agent/cli-' + target \|\|
	receipt.target !== target \|\|
	!parseProductReleaseVersion(version).prerelease.join('.').startsWith('rust-preview.')
	) {
	throw new Error('Invalid native preview receipt');
	}
	const filename = 'maka-agent-cli-' + target + '-' + version + '.tgz';
	if (basename(receipt.archive) !== filename) throw new Error('Native archive name differs');
	const archive = resolve(directory, filename);
	const hash = createHash('sha512');
	for await (const chunk of createReadStream(archive)) hash.update(chunk);
	if (integrity !== 'sha512-' + hash.digest('base64'))
	throw new Error('Native archive integrity differs');
	const manifest = JSON.parse(
	execTar(archive, ['-xOf', 'package/package.json'], {
	encoding: 'utf8',
	maxBuffer: 64 * 1024,
	timeout: 30_000,
	}),
	);
	if (
	manifest.name !== name \|\|
	manifest.version !== version \|\|
	!/^[a-f0-9]{128}$/.test(manifest.makaSource?.sha512 ?? '') \|\|
	manifest.publishConfig?.tag !== 'rust-preview'
	)
	throw new Error('Native package provenance differs');
	if (
	packages.length &&
	(version !== packages[0].version \|\|
	JSON.stringify(manifest.makaSource) !== JSON.stringify(packages[0].source))
	) {
	throw new Error('All platforms must come from the same source archive and build identifier');
	}
	packages.push({ name, version, archive, integrity, source: manifest.makaSource });
	}
	return packages;
	}

	export async function readPreviewRelease(directory) {
	directory = resolve(directory);
	const packages = await readNativePreviewRelease(directory);
	const receipt = JSON.parse(await readFile(join(directory, 'launcher.json'), 'utf8'));
	const version = packages[0].version;
	const filename = `maka-agent-cli-${version}.tgz`;
	if (
	receipt.name !== '@maka-agent/cli' \|\|
	receipt.version !== version \|\|
	receipt.archive !== filename
	) {
	throw new Error('Invalid native launcher receipt');
	}
	const archive = join(directory, filename);
	const hash = createHash('sha512');
	for await (const chunk of createReadStream(archive)) hash.update(chunk);
	if (receipt.integrity !== 'sha512-' + hash.digest('base64')) {
	throw new Error('Launcher archive integrity differs');
	}
	const manifest = JSON.parse(
	execTar(archive, ['-xOf', 'package/package.json'], {
	encoding: 'utf8',
	maxBuffer: 64 * 1024,
	timeout: 30_000,
	}),
	);
	const expected = Object.fromEntries(packages.map(({ name }) => [name, version]));
	const entries = (value) => Object.entries(value ?? {}).sort(([a], [b]) => a.localeCompare(b));
	if (
	manifest.name !== '@maka-agent/cli' \|\|
	manifest.version !== version \|\|
	manifest.bin?.maka !== 'bin/maka.mjs' \|\|
	manifest.publishConfig?.tag !== 'rust-preview' \|\|
	JSON.stringify(entries(manifest.optionalDependencies)) !== JSON.stringify(entries(expected)) \|\|
	JSON.stringify(manifest.makaSource) !== JSON.stringify(packages[0].source)
	) {
	throw new Error('Launcher does not match its native platform set');
	}
	return [...packages, { ...receipt, archive, source: packages[0].source }];
	}

	async function metadata(path) {
	const response = await fetch('https://registry.npmjs.org/' + path, {
	redirect: 'error',
	signal: AbortSignal.timeout(30_000),
	});
	if (response.status === 404) return null;
	if (!response.ok) throw new Error('npm registry query failed: ' + response.status);
	const text = await response.text();
	if (text.length > 1024 * 1024) throw new Error('npm metadata exceeds limit');
	return JSON.parse(text);
	}

	export async function publishPreviewRelease(directory, { provenance = false } = {}) {
	const packages = await readPreviewRelease(directory);
	// Preflight every platform before publishing any. Existing matching immutable
	// versions are a successful retry, never grounds to upload different bytes.
	for (const pkg of packages) {
	const existing = await metadata(pkg.name + '/' + pkg.version);
	if (existing && existing.dist?.integrity !== pkg.integrity)
	throw new Error('Published version has different bytes: ' + pkg.name);
	pkg.published = Boolean(existing);
	const tags = await metadata('-/package/' + pkg.name.replace('/', '%2f') + '/dist-tags');
	if (
	tags?.['rust-preview'] &&
	compareProductReleaseVersions(tags['rust-preview'], pkg.version) > 0
	) {
	throw new Error('Refusing to move rust-preview backwards: ' + pkg.name);
	}
	}
	for (const pkg of packages) {
	// Re-read immediately before moving a tag: another publisher may have
	// advanced it since preflight. Immutable versions alone are not discovery.
	const tagsPath = '-/package/' + pkg.name.replace('/', '%2f') + '/dist-tags';
	const tags = await metadata(tagsPath);
	if (
	tags?.['rust-preview'] &&
	compareProductReleaseVersions(tags['rust-preview'], pkg.version) > 0
	) {
	throw new Error('Refusing to move rust-preview backwards: ' + pkg.name);
	}
	if (!pkg.published) {
	execFileSync(
	'npm',
	[
	'publish',
	basename(pkg.archive),
	'--tag',
	'rust-preview',
	'--access',
	'public',
	'--ignore-scripts',
	...(provenance ? ['--provenance'] : []),
	],
	npmSpawnOptions({ cwd: dirname(pkg.archive), stdio: 'inherit', timeout: 180_000 }),
	);
	}
	if (tags?.['rust-preview'] !== pkg.version) {
	execFileSync(
	'npm',
	[
	'dist-tag',
	'add',
	pkg.name + '@' + pkg.version,
	'rust-preview',
	'--registry',
	'https://registry.npmjs.org/',
	],
	npmSpawnOptions({ stdio: 'inherit', timeout: 180_000 }),
	);
	}
	let verified = false;
	// npm acknowledges uploads before asynchronous processing exposes versions
	// and tags. Allow about ten minutes without re-uploading accepted bytes.
	const confirmationAttempts = 25;
	for (let attempt = 0; attempt < confirmationAttempts; attempt++) {
	const [observed, tags] = await Promise.all([
	metadata(pkg.name + '/' + pkg.version),
	metadata(tagsPath),
	]);
	if (observed?.dist?.integrity === pkg.integrity && tags?.['rust-preview'] === pkg.version) {
	verified = true;
	break;
	}
	if (attempt + 1 < confirmationAttempts) {
	await new Promise((resolveDelay) =>
	setTimeout(resolveDelay, Math.min(30_000, 1000 * 2 ** attempt)),
	);
	}
	}
	if (!verified)
	throw new Error('Publication is unconfirmed; retry this same artifact set: ' + pkg.name);
	console.log(pkg.name + '@' + pkg.version + ' verified');
	}
	}

	if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
	const { values, positionals } = parseArgs({
	allowPositionals: true,
	options: {
	publish: { type: 'boolean', default: false },
	provenance: { type: 'boolean', default: false },
	},
	});
	if (positionals.length !== 1)
	throw new Error('Usage: publish-cli.mjs <artifact-directory> [--publish] [--provenance]');
	if (values.publish) await publishPreviewRelease(positionals[0], values);
	else console.log(JSON.stringify(await readPreviewRelease(positionals[0])));
	}