@coreframe/scripts 0.0.0 → 0.1.0

package/deploy/migrations.ts

@@ -0,0 +1,317 @@
+import { access, readFile, readdir } from "node:fs/promises"
+import { basename, join, relative, resolve } from "node:path"
+
+import { HELD_MIGRATIONS_FOLDER, MIGRATIONS_FOLDER } from "../db/config.ts"
+
+export type MigrationFile = {
+  id: string
+  path: string
+  relativePath: string
+}
+
+export type MigrationRisk = {
+  code: string
+  line: number
+  match: string
+  reason: string
+}
+
+export type MigrationScanResult = {
+  migration: MigrationFile
+  risks: MigrationRisk[]
+}
+
+type StaticPattern = {
+  code: string
+  pattern: RegExp
+  reason: string
+}
+
+const staticBlockedPatterns: StaticPattern[] = [
+  {
+    code: "drop-schema-object",
+    pattern:
+      /\bdrop\s+(?:table|view|materialized\s+view|index|sequence|type|schema|function|trigger|policy)\b/giu,
+    reason: "drops schema that the currently deployed app may still depend on",
+  },
+  {
+    code: "drop-column",
+    pattern: /\balter\s+table\b[^;]*?\bdrop\s+column\b/giu,
+    reason: "removes a column that the currently deployed app may still read or write",
+  },
+  {
+    code: "drop-constraint",
+    pattern: /\balter\s+table\b[^;]*?\bdrop\s+constraint\b/giu,
+    reason: "removes a constraint outside the staged contract phase",
+  },
+  {
+    code: "truncate",
+    pattern: /\btruncate\b/giu,
+    reason: "removes data outside the deploy-safe migration path",
+  },
+  {
+    code: "rename-table-or-column",
+    pattern: /\balter\s+table\b[^;]*?\brename(?:\s+column)?\b/giu,
+    reason: "renames schema in a way old and new app versions cannot both address",
+  },
+  {
+    code: "rewrite-column-type",
+    pattern: /\balter\s+table\b[^;]*?\balter\s+column\b[^;]*?\btype\b/giu,
+    reason: "rewrites a column type outside a staged expand/contract rollout",
+  },
+  {
+    code: "set-not-null",
+    pattern: /\balter\s+table\b[^;]*?\balter\s+column\b[^;]*?\bset\s+not\s+null\b/giu,
+    reason: "enforces NOT NULL before a separate backfill and verification step",
+  },
+  {
+    code: "set-default",
+    pattern: /\balter\s+table\b[^;]*?\balter\s+column\b[^;]*?\bset\s+default\b/giu,
+    reason: "changes default write behavior while old app code may still be running",
+  },
+  {
+    code: "broad-update",
+    pattern: /\bupdate\b/giu,
+    reason: "changes data outside a separately reviewed backfill or held migration",
+  },
+  {
+    code: "broad-delete",
+    pattern: /\bdelete\s+from\b/giu,
+    reason: "removes data outside a held migration",
+  },
+]
+
+export async function collectDeployMigrationFiles(cwd = process.cwd()): Promise<MigrationFile[]> {
+  return collectDrizzleMigrationFiles(resolve(cwd, MIGRATIONS_FOLDER), cwd)
+}
+
+export async function collectHeldMigrationFiles(cwd = process.cwd()): Promise<MigrationFile[]> {
+  return collectFlatSqlFiles(resolve(cwd, HELD_MIGRATIONS_FOLDER), cwd)
+}
+
+export async function scanDeployMigrationFiles(
+  migrations: MigrationFile[],
+): Promise<MigrationScanResult[]> {
+  const results = await Promise.all(
+    migrations.map(async (migration) => {
+      const sql = await readFile(migration.path, "utf8")
+
+      return {
+        migration,
+        risks: scanMigrationSql(sql),
+      }
+    }),
+  )
+
+  return results.filter((result) => result.risks.length > 0)
+}
+
+export function scanMigrationSql(sql: string): MigrationRisk[] {
+  const maskedSql = maskSql(sql)
+  const createdTables = collectCreatedTables(maskedSql)
+  const risks: MigrationRisk[] = []
+
+  for (const blocked of staticBlockedPatterns) {
+    for (const match of maskedSql.matchAll(blocked.pattern)) {
+      risks.push(riskForMatch(sql, match, blocked.code, blocked.reason))
+    }
+  }
+
+  for (const match of maskedSql.matchAll(
+    /\balter\s+table\s+(?:if\s+exists\s+|only\s+)?(?<table>(?:"[^"]+"|\w+)(?:\s*\.\s*(?:"[^"]+"|\w+))?)\s+add\s+column\b[^;]*?\bnot\s+null\b/giu,
+  )) {
+    if (!createdTables.has(normalizeIdentifier(match.groups?.table))) {
+      risks.push(
+        riskForMatch(
+          sql,
+          match,
+          "add-not-null-column",
+          "adds a required column to an existing table before a separate compatibility rollout",
+        ),
+      )
+    }
+  }
+
+  for (const match of maskedSql.matchAll(
+    /\balter\s+table\s+(?:if\s+exists\s+|only\s+)?(?<table>(?:"[^"]+"|\w+)(?:\s*\.\s*(?:"[^"]+"|\w+))?)\s+add\s+constraint\b[^;]*?\b(?:foreign\s+key|unique|primary\s+key|check)\b/giu,
+  )) {
+    if (!createdTables.has(normalizeIdentifier(match.groups?.table))) {
+      risks.push(
+        riskForMatch(
+          sql,
+          match,
+          "add-constraint",
+          "enforces a constraint on an existing table before a separate validation step",
+        ),
+      )
+    }
+  }
+
+  for (const match of maskedSql.matchAll(
+    /\bcreate\s+unique\s+index(?:\s+concurrently)?(?:\s+if\s+not\s+exists)?\s+(?:"[^"]+"|\w+)\s+on\s+(?<table>(?:"[^"]+"|\w+)(?:\s*\.\s*(?:"[^"]+"|\w+))?)/giu,
+  )) {
+    if (!createdTables.has(normalizeIdentifier(match.groups?.table))) {
+      risks.push(
+        riskForMatch(
+          sql,
+          match,
+          "create-unique-index",
+          "adds uniqueness to existing data before a separate dedupe and validation step",
+        ),
+      )
+    }
+  }
+
+  return risks.sort((left, right) => left.line - right.line || left.code.localeCompare(right.code))
+}
+
+export function formatMigrationScanFailures(results: MigrationScanResult[]) {
+  return results
+    .flatMap((result) =>
+      result.risks.map(
+        (risk) =>
+          `${result.migration.relativePath}:${risk.line} ${risk.code}: ${risk.reason} (${risk.match.trim()})`,
+      ),
+    )
+    .join("\n")
+}
+
+export function formatMigrationList(migrations: MigrationFile[]) {
+  if (migrations.length === 0) {
+    return "No migration files found."
+  }
+
+  return migrations.map((migration) => `- ${migration.relativePath}`).join("\n")
+}
+
+function collectCreatedTables(sql: string) {
+  const tables = new Set<string>()
+
+  for (const match of sql.matchAll(
+    /\bcreate\s+(?:temporary\s+|temp\s+)?table\s+(?:if\s+not\s+exists\s+)?(?<table>(?:"[^"]+"|\w+)(?:\s*\.\s*(?:"[^"]+"|\w+))?)/giu,
+  )) {
+    tables.add(normalizeIdentifier(match.groups?.table))
+  }
+
+  return tables
+}
+
+async function collectDrizzleMigrationFiles(migrationsPath: string, cwd: string) {
+  const entries = await readDirectoryOrEmpty(migrationsPath)
+  const migrations: MigrationFile[] = []
+
+  for (const entry of entries) {
+    const entryPath = join(migrationsPath, entry.name)
+
+    if (entry.isDirectory()) {
+      const migrationPath = join(entryPath, "migration.sql")
+
+      if (await fileExists(migrationPath)) {
+        migrations.push(migrationFileFromPath(migrationPath, cwd, entry.name))
+      }
+
+      continue
+    }
+
+    if (entry.isFile() && entry.name.endsWith(".sql")) {
+      migrations.push(migrationFileFromPath(entryPath, cwd, entry.name.replace(/\.sql$/u, "")))
+    }
+  }
+
+  return migrations.sort((left, right) => left.id.localeCompare(right.id))
+}
+
+async function collectFlatSqlFiles(directory: string, cwd: string) {
+  const entries = await readDirectoryOrEmpty(directory)
+  const migrations = entries
+    .filter((entry) => entry.isFile() && entry.name.endsWith(".sql"))
+    .map((entry) =>
+      migrationFileFromPath(join(directory, entry.name), cwd, entry.name.replace(/\.sql$/u, "")),
+    )
+
+  return migrations.sort((left, right) => left.id.localeCompare(right.id))
+}
+
+async function readDirectoryOrEmpty(directory: string) {
+  try {
+    return await readdir(directory, { withFileTypes: true })
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return []
+    }
+
+    throw error
+  }
+}
+
+async function fileExists(path: string) {
+  try {
+    await access(path)
+    return true
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false
+    }
+
+    throw error
+  }
+}
+
+function migrationFileFromPath(
+  path: string,
+  cwd: string,
+  id = basename(path, ".sql"),
+): MigrationFile {
+  return {
+    id,
+    path,
+    relativePath: relative(cwd, path),
+  }
+}
+
+function maskSql(sql: string) {
+  return sql
+    .replace(/--[^\n\r]*/gu, blank)
+    .replace(/\/\*[\s\S]*?\*\//gu, blank)
+    .replace(/\$([A-Za-z_][A-Za-z0-9_]*)?\$[\s\S]*?\$\1\$/gu, blank)
+    .replace(/'(?:''|[^'])*'/gu, blank)
+}
+
+function blank(match: string) {
+  return match.replace(/[^\n\r]/gu, " ")
+}
+
+function normalizeIdentifier(identifier: string | undefined) {
+  return (
+    (identifier ?? "")
+      .split(".")
+      .map((part) => part.trim().replace(/^"|"$/gu, "").toLowerCase())
+      .at(-1) ?? ""
+  )
+}
+
+function riskForMatch(
+  sql: string,
+  match: RegExpMatchArray,
+  code: string,
+  reason: string,
+): MigrationRisk {
+  return {
+    code,
+    line: lineForIndex(sql, match.index ?? 0),
+    match: sql.slice(match.index ?? 0, (match.index ?? 0) + match[0].length),
+    reason,
+  }
+}
+
+function lineForIndex(value: string, index: number) {
+  let line = 1
+
+  for (let offset = 0; offset < index; offset += 1) {
+    if (value[offset] === "\n") {
+      line += 1
+    }
+  }
+
+  return line
+}

package/deploy/pending-migrations.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, it } from "vitest"
+
+import type { CoreframeDatabaseClient, CoreframeDatabaseDialect } from "../db/client.ts"
+import type { MigrationFile } from "./migrations.ts"
+import {
+  appliedMigrationsQuery,
+  filterPendingMigrations,
+  readAppliedMigrationNames,
+} from "./pending-migrations.ts"
+
+describe("filterPendingMigrations", () => {
+  it("keeps local migrations that are absent from the database journal", () => {
+    const migrations: MigrationFile[] = [
+      {
+        id: "20260703120000_first",
+        path: "/repo/drizzle/20260703120000_first/migration.sql",
+        relativePath: "drizzle/20260703120000_first/migration.sql",
+      },
+      {
+        id: "20260703130000_second",
+        path: "/repo/drizzle/20260703130000_second/migration.sql",
+        relativePath: "drizzle/20260703130000_second/migration.sql",
+      },
+    ]
+
+    expect(filterPendingMigrations(migrations, ["20260703120000_first"])).toEqual([migrations[1]])
+  })
+})
+
+describe("readAppliedMigrationNames", () => {
+  it("reads the Postgres Drizzle journal", async () => {
+    const database = createTestDatabase("postgres", [{ name: "20260703120000_first" }])
+
+    await expect(readAppliedMigrationNames(database)).resolves.toEqual(
+      new Set(["20260703120000_first"]),
+    )
+    expect(database.statements).toEqual([
+      "select name from drizzle.__drizzle_migrations where name is not null",
+    ])
+  })
+
+  it("reads the SQLite Drizzle journal", async () => {
+    const database = createTestDatabase("sqlite", [{ name: "20260703120000_first" }])
+
+    await expect(readAppliedMigrationNames(database)).resolves.toEqual(
+      new Set(["20260703120000_first"]),
+    )
+    expect(database.statements).toEqual([
+      "select name from __drizzle_migrations where name is not null",
+    ])
+  })
+
+  it("treats a missing journal table as no applied migrations", async () => {
+    const database = createTestDatabase("sqlite", [], new Error("SQLITE_ERROR: no such table"))
+
+    await expect(readAppliedMigrationNames(database)).resolves.toEqual(new Set())
+  })
+})
+
+describe("appliedMigrationsQuery", () => {
+  it("uses dialect-specific Drizzle journal tables", () => {
+    expect(appliedMigrationsQuery("postgres")).toBe(
+      "select name from drizzle.__drizzle_migrations where name is not null",
+    )
+    expect(appliedMigrationsQuery("sqlite")).toBe(
+      "select name from __drizzle_migrations where name is not null",
+    )
+  })
+})
+
+function createTestDatabase(
+  dialect: CoreframeDatabaseDialect,
+  rows: Array<{ name: string | null }>,
+  error?: Error,
+): CoreframeDatabaseClient & { statements: string[] } {
+  const statements: string[] = []
+
+  return {
+    dialect,
+    statements,
+    async execute<Row extends Record<string, unknown> = Record<string, unknown>>(
+      statement: string,
+    ) {
+      statements.push(statement)
+
+      if (error) {
+        throw error
+      }
+
+      return { rows: rows as unknown as Row[] }
+    },
+  }
+}

package/deploy/pending-migrations.ts

@@ -0,0 +1,45 @@
+import type { CoreframeDatabaseClient, CoreframeDatabaseDialect } from "../db/client.ts"
+import type { MigrationFile } from "./migrations.ts"
+
+export function filterPendingMigrations(
+  migrations: MigrationFile[],
+  appliedNames: Iterable<string>,
+) {
+  const applied = new Set(appliedNames)
+
+  return migrations.filter((migration) => !applied.has(migration.id))
+}
+
+export async function readAppliedMigrationNames(database: CoreframeDatabaseClient) {
+  try {
+    const result = await database.execute<{ name: string | null }>(
+      appliedMigrationsQuery(database.dialect),
+    )
+
+    return new Set(result.rows.flatMap((row) => (row.name ? [row.name] : [])))
+  } catch (error) {
+    if (isMissingMigrationTableError(error)) {
+      return new Set<string>()
+    }
+
+    throw error
+  }
+}
+
+export function appliedMigrationsQuery(dialect: CoreframeDatabaseDialect) {
+  switch (dialect) {
+    case "postgres":
+      return "select name from drizzle.__drizzle_migrations where name is not null"
+    case "sqlite":
+      return "select name from __drizzle_migrations where name is not null"
+  }
+}
+
+function isMissingMigrationTableError(error: unknown) {
+  return (
+    error instanceof Error &&
+    (("code" in error && (error.code === "42P01" || error.code === "3F000")) ||
+      error.message.includes("no such table") ||
+      error.message.includes("no such schema"))
+  )
+}

package/deploy/tauri-release.test.ts

@@ -0,0 +1,196 @@
+import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+
+import { describe, expect, it } from "vitest"
+
+import {
+  createTauriReleaseUpload,
+  createTauriUpdateManifest,
+  resolveTauriReleasePlan,
+  restoreTauriReleaseMetadata,
+  writeTauriReleaseMetadata,
+} from "./tauri-release.ts"
+
+describe("resolveTauriReleasePlan", () => {
+  it("disables all Tauri platforms by default", () => {
+    const plan = resolveTauriReleasePlan({
+      args: {
+        tauriLocalPlatforms: [],
+        tauriWorkflowPlatforms: [],
+      },
+      env: {},
+    })
+
+    expect(plan.enabled).toBe(false)
+    expect(plan.localPlatforms).toEqual([])
+    expect(plan.workflowPlatforms).toEqual([])
+  })
+
+  it("combines CLI and env platform selections", () => {
+    const plan = resolveTauriReleasePlan({
+      args: {
+        tauriLocalPlatforms: ["macos"],
+        tauriWorkflowPlatforms: ["windows"],
+      },
+      config: {
+        localPlatforms: ["android"],
+        workflowPlatforms: ["linux"],
+      },
+      env: {
+        B2_APPLICATION_KEY: "key",
+        B2_APPLICATION_KEY_ID: "key-id",
+        B2_BUCKET: "bucket",
+        TAURI_RELEASE_LOCAL_PLATFORMS: "ios",
+        TAURI_RELEASE_PUBLIC_BASE_URL: "https://downloads.example.com",
+        TAURI_SIGNING_PRIVATE_KEY: "private-key",
+      },
+    })
+
+    expect(plan.enabled).toBe(true)
+    expect(plan.localPlatforms).toEqual(["android", "ios", "macos"])
+    expect(plan.workflowPlatforms).toEqual(["linux", "windows"])
+    expect(plan.publicBaseUrl).toBe("https://downloads.example.com")
+  })
+
+  it("rejects selecting the same platform locally and through workflow", () => {
+    expect(() =>
+      resolveTauriReleasePlan({
+        args: {
+          tauriLocalPlatforms: ["linux"],
+          tauriWorkflowPlatforms: ["linux"],
+        },
+        env: {},
+      }),
+    ).toThrow("either locally or through the workflow")
+  })
+})
+
+describe("writeTauriReleaseMetadata", () => {
+  it("updates and restores Tauri release metadata", async () => {
+    const root = await mkdtemp(join(tmpdir(), "coreframe-tauri-metadata-"))
+    await mkdir(join(root, "tauri/src-tauri"), { recursive: true })
+    const tauriConfigPath = join(root, "tauri/src-tauri/tauri.conf.json")
+    const cargoManifestPath = join(root, "tauri/src-tauri/Cargo.toml")
+    const cargoLockPath = join(root, "tauri/src-tauri/Cargo.lock")
+
+    await writeFile(
+      tauriConfigPath,
+      `${JSON.stringify({ bundle: { active: true }, version: "0.0.0" }, null, 2)}\n`,
+    )
+    await writeFile(
+      cargoManifestPath,
+      '[package]\nname = "coreframe-tauri"\nversion = "0.0.0"\nedition = "2024"\n',
+    )
+    await writeFile(cargoLockPath, '[[package]]\nname = "coreframe-tauri"\nversion = "0.0.0"\n')
+
+    const plan = resolveTauriReleasePlan({
+      args: {
+        tauriLocalPlatforms: ["macos"],
+        tauriWorkflowPlatforms: [],
+      },
+      env: {},
+    })
+    const snapshot = await writeTauriReleaseMetadata(plan, "0.20260705.0", root)
+
+    expect(JSON.parse(await readFile(tauriConfigPath, "utf8"))).toMatchObject({
+      bundle: { active: true, createUpdaterArtifacts: true },
+      version: "0.20260705.0",
+    })
+    expect(await readFile(cargoManifestPath, "utf8")).toContain('version = "0.20260705.0"')
+    expect(await readFile(cargoLockPath, "utf8")).toContain('version = "0.20260705.0"')
+
+    await restoreTauriReleaseMetadata(snapshot)
+
+    expect(JSON.parse(await readFile(tauriConfigPath, "utf8")).version).toBe("0.0.0")
+    expect(await readFile(cargoManifestPath, "utf8")).toContain('version = "0.0.0"')
+    expect(await readFile(cargoLockPath, "utf8")).toContain('version = "0.0.0"')
+  })
+})
+
+describe("createTauriReleaseUpload", () => {
+  it("creates a latest manifest and upload tree from updater artifact pairs", async () => {
+    const root = await mkdtemp(join(tmpdir(), "coreframe-tauri-upload-"))
+    const originalCwd = process.cwd()
+    const artifactDir = join(
+      root,
+      "tauri/src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage",
+    )
+
+    await mkdir(artifactDir, { recursive: true })
+    await writeFile(join(artifactDir, "coreframe_0.20260705.0.AppImage.tar.gz"), "artifact")
+    await writeFile(join(artifactDir, "coreframe_0.20260705.0.AppImage.tar.gz.sig"), "signature\n")
+
+    try {
+      process.chdir(root)
+      const plan = resolveTauriReleasePlan({
+        args: {
+          tauriLocalPlatforms: ["linux"],
+          tauriWorkflowPlatforms: [],
+        },
+        env: {
+          B2_APPLICATION_KEY: "key",
+          B2_APPLICATION_KEY_ID: "key-id",
+          B2_BUCKET: "bucket",
+          TAURI_RELEASE_PUBLIC_BASE_URL: "https://downloads.example.com",
+          TAURI_SIGNING_PRIVATE_KEY: "private-key",
+        },
+      })
+      const release = await createTauriReleaseUpload({ plan, version: "0.20260705.0" })
+      const manifest = JSON.parse(
+        await readFile(join(release.uploadDir, release.manifestPath), "utf8"),
+      )
+
+      expect(release.manifestPath).toBe("latest.json")
+      expect(manifest).toMatchObject({
+        platforms: {
+          "linux-x86_64": {
+            signature: "signature",
+            url: "https://downloads.example.com/releases/0.20260705.0/linux-x86_64/coreframe_0.20260705.0.AppImage.tar.gz",
+          },
+        },
+        version: "0.20260705.0",
+      })
+      await expect(
+        readFile(
+          join(
+            release.uploadDir,
+            "releases/0.20260705.0/linux-x86_64/coreframe_0.20260705.0.AppImage.tar.gz",
+          ),
+          "utf8",
+        ),
+      ).resolves.toBe("artifact")
+    } finally {
+      process.chdir(originalCwd)
+    }
+  })
+})
+
+describe("createTauriUpdateManifest", () => {
+  it("uses Tauri static updater manifest keys", () => {
+    expect(
+      createTauriUpdateManifest({
+        artifacts: [
+          {
+            signature: "signed",
+            updatePlatform: "darwin-aarch64",
+            url: "https://downloads.example.com/app.tar.gz",
+          },
+        ],
+        notes: "Release notes",
+        pubDate: new Date("2026-07-05T12:00:00.000Z"),
+        version: "0.20260705.0",
+      }),
+    ).toEqual({
+      notes: "Release notes",
+      platforms: {
+        "darwin-aarch64": {
+          signature: "signed",
+          url: "https://downloads.example.com/app.tar.gz",
+        },
+      },
+      pub_date: "2026-07-05T12:00:00.000Z",
+      version: "0.20260705.0",
+    })
+  })
+})