feat: package atomic reversible nginx releases

scripts/deploy/prepare-release.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { pathToFileURL } from 'node:url';
+import { resolve } from 'node:path';
+import { cleanupOrphanStages, prepareRelease } from './lib/release-transaction.mjs';
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.length === 2 && args[1] === '--cleanup-orphans') {
+    const removed = await cleanupOrphanStages(resolve(args[0]));
+    process.stdout.write(`${JSON.stringify({ removed })}\n`); return;
+  }
+  if (args.length !== 9) throw new Error('Usage: prepare-release.mjs <root> <archive> <transaction-id> <verifier-module> <trust-policy> <smoke-command> <uid> <gid> <trusted-now>');
+  const [root, archivePath, transactionId, verifierModulePath, trustPolicyPath, smokeCommand, uid, gid, now] = args;
+  const result = await prepareRelease({ root: resolve(root), archivePath: resolve(archivePath), transactionId,
+    verifierModulePath: resolve(verifierModulePath), trustPolicyPath: resolve(trustPolicyPath), smokeCommand: resolve(smokeCommand),
+    uid: Number(uid), gid: Number(gid), now });
+  process.stdout.write(`${JSON.stringify({ manifestDigest: result.receipt.manifestDigest, releaseId: result.receipt.releaseId })}\n`);
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main().catch((error) => { process.stderr.write(`Release preparation failed: ${error instanceof Error ? error.message : 'unknown error'}\n`); process.exitCode = 1; });