@hugojosefson/cli 0.11.0

package/esm/src/release/publish-github.js

@@ -0,0 +1,141 @@
+import { processText } from "./release-process.js";
+import { confirmPublication, } from "./confirm-publication.js";
+import { parseSemver } from "./semver.js";
+import { publisherInput, versionConfig, } from "./publisher-input.js";
+export async function publishGithub(input) {
+    const release = await publisherInput(input.environment, input.process);
+    await versionConfig(input.files, release.version);
+    const text = await readChangelog(input.process);
+    const expected = {
+        tag_name: release.tag,
+        target_commitish: release.sha,
+        name: release.version,
+        body: changelogSection(text, release.version),
+        draft: false,
+        prerelease: parseSemver(release.version).prerelease.length > 0,
+    };
+    const existing = await input.api.read(release.tag);
+    if (existing)
+        return requireExact(existing, expected);
+    try {
+        await input.api.create(expected);
+    }
+    catch { /* Confirm an uncertain write without creating another release. */ }
+    const confirmed = await confirmPublication(async () => {
+        const after = await input.api.read(release.tag);
+        if (!after)
+            return false;
+        requireExact(after, expected);
+        return true;
+    }, input.clock);
+    if (!confirmed)
+        throw new Error("GitHub Release creation was not confirmed.");
+}
+export function changelogSection(text, version) {
+    const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const matches = [...text.matchAll(new RegExp(`^## ${escaped}\\r?\\n[\\s\\S]*?(?=^## |(?![\\s\\S]))`, "gm"))];
+    if (matches.length !== 1) {
+        throw new TypeError("Applicable changelog section is missing or ambiguous.");
+    }
+    return matches[0][0];
+}
+export function githubReleaseApi(process, repository) {
+    if (!/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.test(repository)) {
+        throw new TypeError("GitHub repository is invalid.");
+    }
+    return {
+        async read(tag) {
+            const result = await process.run("gh", [
+                "api",
+                "--paginate",
+                "--slurp",
+                `repos/${repository}/releases?per_page=100`,
+            ]);
+            if (!result.success) {
+                throw new Error("GitHub Release lookup failed.");
+            }
+            // The tag endpoint omits drafts, including releases whose tag was deleted.
+            let pages;
+            try {
+                pages = JSON.parse(processText(result));
+            }
+            catch {
+                throw new TypeError("GitHub Release listing is not JSON.");
+            }
+            if (!Array.isArray(pages) || !pages.every(Array.isArray)) {
+                throw new TypeError("GitHub Release listing is invalid.");
+            }
+            const matches = pages.flat().filter((value) => {
+                if (!value || typeof value !== "object" ||
+                    !("tag_name" in value) || typeof value.tag_name !== "string")
+                    throw new TypeError("GitHub Release listing entry is invalid.");
+                return value.tag_name === tag;
+            });
+            if (matches.length > 1) {
+                throw new TypeError("Multiple GitHub Releases use this tag.");
+            }
+            return matches.length
+                ? parseRelease(JSON.stringify(matches[0]))
+                : undefined;
+        },
+        async create(input) {
+            const result = await process.run("gh", [
+                "api",
+                "--include",
+                `repos/${repository}/releases`,
+                "--method",
+                "POST",
+                "--input",
+                "-",
+            ], { stdin: JSON.stringify(input) });
+            const response = ghResponse(processText(result));
+            if (!result.success || response.status !== 201) {
+                throw new Error("GitHub Release creation failed.");
+            }
+            requireExact(parseRelease(response.body), input);
+        },
+    };
+}
+function ghResponse(text) {
+    const match = /^HTTP\/\d(?:\.\d)?\s+(\d{3})\b[^\n]*\r?\n[\s\S]*?\r?\n\r?\n([\s\S]*)$/
+        .exec(text);
+    if (!match)
+        throw new TypeError("GitHub API response lacks an HTTP status.");
+    return { status: Number(match[1]), body: match[2] };
+}
+function requireExact(actual, expected) {
+    if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+        throw new TypeError("Existing GitHub Release differs from expected release.");
+    }
+}
+function parseRelease(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new TypeError("GitHub Release response is not JSON.");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new TypeError("GitHub Release response is invalid.");
+    }
+    const x = value;
+    if (typeof x.tag_name !== "string" || typeof x.target_commitish !== "string" ||
+        typeof x.name !== "string" || typeof x.body !== "string" ||
+        typeof x.draft !== "boolean" || typeof x.prerelease !== "boolean")
+        throw new TypeError("GitHub Release response is invalid.");
+    return {
+        tag_name: x.tag_name,
+        target_commitish: x.target_commitish,
+        name: x.name,
+        body: x.body,
+        draft: x.draft,
+        prerelease: x.prerelease,
+    };
+}
+async function readChangelog(process) {
+    const result = await process.run("git", ["show", "HEAD:CHANGELOG.md"]);
+    if (!result.success)
+        throw new Error("CHANGELOG.md could not be read.");
+    return processText(result);
+}

package/esm/src/release/publish-jsr.js

@@ -0,0 +1,390 @@
+/** Idempotent JSR publication with registry and provenance verification. */
+import * as fs from "node:fs/promises";
+import { runOrThrow } from "./release-process.js";
+import { digestBytes } from "../repository/digest-bytes.js";
+import { confirmPublication, } from "./confirm-publication.js";
+import { publisherInput, versionConfig, } from "./publisher-input.js";
+/** Read-only API adapter. Management 404 is the sole absent-version result. */
+export function jsrHttpApi(fetch) {
+    return {
+        async version(name, version) {
+            const [scope, packageName] = parsePackageName(name);
+            const management = await fetch(`https://api.jsr.io/scopes/${encodeURIComponent(scope)}/packages/${encodeURIComponent(packageName)}/versions/${encodeURIComponent(version)}`);
+            if (management.status === 404)
+                return undefined;
+            if (management.status !== 200) {
+                throw new Error("JSR management lookup failed.");
+            }
+            const record = object(await management.json());
+            if (!record || record.scope !== scope || record.package !== packageName ||
+                record.version !== version || typeof record.yanked !== "boolean" ||
+                record.yanked)
+                throw new TypeError("JSR management metadata is invalid.");
+            if (record.rekorLogId === null || record.rekorLogId === undefined) {
+                throw new Error("JSR provenance metadata is unavailable.");
+            }
+            const rekorLogId = logId(record.rekorLogId);
+            if (rekorLogId === undefined) {
+                throw new TypeError("JSR provenance metadata is invalid.");
+            }
+            const registry = await fetch(`https://jsr.io/@${encodeURIComponent(scope)}/${encodeURIComponent(packageName)}/${encodeURIComponent(version)}_meta.json`);
+            if (registry.status !== 200) {
+                throw new Error("JSR registry metadata is unavailable.");
+            }
+            const metadataText = await registry.text();
+            const metadata = object(JSON.parse(metadataText));
+            if (!metadata)
+                throw new TypeError("JSR registry metadata is invalid.");
+            return {
+                manifestDigest: await digestBytes(new TextEncoder().encode(metadataText)),
+                manifest: manifest(metadata.manifest),
+                moduleGraph2: graph(metadata.moduleGraph2),
+                exports: exportMap(metadata.exports),
+                rekorLogId,
+            };
+        },
+        async verifyProvenance(input) {
+            const response = await fetch(`https://rekor.sigstore.dev/api/v1/log/entries?logIndex=${input.rekorLogId}`);
+            if (response.status !== 200)
+                throw new Error("Rekor lookup failed.");
+            const entries = object(await response.json());
+            if (!entries || Object.keys(entries).length !== 1) {
+                throw new TypeError("Rekor entry is ambiguous.");
+            }
+            const entry = object(Object.values(entries)[0]);
+            const verification = object(entry?.verification);
+            const signedEntryTimestamp = verification?.signedEntryTimestamp;
+            if (!entry || !integer(entry.logIndex) ||
+                entry.logIndex !== input.rekorLogId ||
+                !nonemptyString(entry.body) || !integer(entry.integratedTime) ||
+                entry.integratedTime === 0 ||
+                typeof entry.logID !== "string" ||
+                !/^[0-9a-f]{64}$/.test(entry.logID) ||
+                !inclusionProof(verification?.inclusionProof) ||
+                !nonemptyString(signedEntryTimestamp))
+                throw new TypeError("Rekor entry is invalid.");
+            const signedEntryTimestampBytes = base64(signedEntryTimestamp);
+            if (signedEntryTimestampBytes.length === 0) {
+                throw new TypeError("Rekor entry is invalid.");
+            }
+            const attestation = object(entry.attestation);
+            const attestationData = attestation?.data;
+            if (typeof attestationData !== "string") {
+                throw new TypeError("Rekor attestation is invalid.");
+            }
+            const data = base64(attestationData);
+            await verifyEntryBody(entry.body, data);
+            let statement;
+            try {
+                statement = JSON.parse(new TextDecoder().decode(data));
+            }
+            catch {
+                throw new TypeError("Rekor attestation is not JSON.");
+            }
+            verifyStatement(object(statement), input);
+        },
+    };
+}
+export async function publishJsr(input) {
+    const release = await publisherInput(input.environment, input.process);
+    if ((await runOrThrow(input.process, "git", [
+        "status",
+        "--porcelain=v1",
+        "--untracked-files=normal",
+    ])).trim()) {
+        throw new TypeError("JSR publication requires a clean release checkout.");
+    }
+    const config = await versionConfig(input.files, release.version);
+    const packageName = jsrPackageName(release.repository);
+    if (config.name !== packageName || config.version !== release.version) {
+        throw new TypeError("JSR package name or version differs from release.");
+    }
+    const exports = exportMap(config.exports);
+    const verify = (remote) => verifyVersion(remote, exports, input.packageFiles, input.api, release, packageName);
+    const before = await input.api.version(packageName, release.version);
+    if (before)
+        return await verify(before);
+    if (input.environment.get("GITHUB_SHA") !== release.sha) {
+        throw new TypeError("Workflow commit differs from the release. Retry the JSR workflow with --ref set to the release tag.");
+    }
+    await run(input.process, ["publish", "--dry-run"]);
+    let publishFailed = false;
+    try {
+        await run(input.process, ["publish"]);
+    }
+    catch (_error) {
+        publishFailed = true;
+    }
+    const confirmed = await confirmPublication(async () => {
+        const remote = await input.api.version(packageName, release.version);
+        if (!remote)
+            return false;
+        await verify(remote);
+        return true;
+    }, input.clock);
+    if (!confirmed) {
+        throw new Error(publishFailed
+            ? "JSR publication failed and was not confirmed."
+            : "JSR publication was not confirmed.");
+    }
+}
+export function jsrPackageName(repository) {
+    const parts = repository.split("/");
+    const normalized = parts.map((part) => part.toLowerCase());
+    if (normalized.length !== 2 ||
+        !normalized.every((part) => /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(part)))
+        throw new TypeError("Repository cannot map to a JSR package name.");
+    return `@${normalized[0]}/${normalized[1]}`;
+}
+export function localPackageFiles(root) {
+    return {
+        async read(path) {
+            if (!safeLocalPath(path)) {
+                throw new TypeError("Local JSR module path is invalid.");
+            }
+            const url = new URL(path, root);
+            const info = await fs.lstat(url);
+            if (!info.isFile()) {
+                throw new TypeError("Local JSR module is not a regular file.");
+            }
+            return await fs.readFile(url);
+        },
+    };
+}
+async function verifyVersion(remote, exports, files, api, release, name) {
+    if (!sameRecord(remote.exports, exports)) {
+        throw new TypeError("JSR exports differ from Deno config.");
+    }
+    const paths = Object.keys(remote.moduleGraph2);
+    if (paths.length === 0)
+        throw new TypeError("JSR module graph is empty.");
+    for (const path of Object.values(remote.exports)) {
+        const modulePath = `/${path.slice(2)}`;
+        if (!remote.moduleGraph2[modulePath]) {
+            throw new TypeError("JSR export is missing from the module graph.");
+        }
+    }
+    for (const path of paths) {
+        if (!safePath(path) || !remote.manifest[path]) {
+            throw new TypeError("JSR module path is invalid.");
+        }
+    }
+    for (const [path, expected] of Object.entries(remote.manifest)) {
+        let bytes;
+        try {
+            bytes = await files.read(path.slice(1));
+        }
+        catch {
+            throw new TypeError("Local JSR module cannot be read.");
+        }
+        // Deno rewrites module imports before upload. The signed manifest digest
+        // binds those transformed bytes to the exact release commit instead.
+        if (!remote.moduleGraph2[path] && (bytes.length !== expected.size ||
+            await checksum(bytes) !== expected.checksum))
+            throw new TypeError("JSR module content differs.");
+    }
+    await api.verifyProvenance({
+        packageName: name,
+        version: release.version,
+        sha: release.sha,
+        manifestDigest: remote.manifestDigest,
+        rekorLogId: remote.rekorLogId,
+        repository: release.repository,
+    });
+}
+async function checksum(bytes) {
+    return `sha256-${await digestBytes(bytes)}`;
+}
+function parsePackageName(name) {
+    const match = /^@([a-z0-9][a-z0-9._-]*)\/([a-z0-9][a-z0-9._-]*)$/.exec(name);
+    if (!match)
+        throw new TypeError("JSR package name is invalid.");
+    return [match[1], match[2]];
+}
+function manifest(value) {
+    const source = object(value);
+    if (!source)
+        throw new TypeError("JSR manifest is invalid.");
+    const result = {};
+    for (const [path, item] of Object.entries(source)) {
+        const file = object(item);
+        if (!safePath(path) || !file || !integer(file.size) || file.size < 0 ||
+            typeof file.checksum !== "string" ||
+            !/^sha256-[0-9a-f]{64}$/.test(file.checksum))
+            throw new TypeError("JSR manifest is invalid.");
+        result[path] = { size: file.size, checksum: file.checksum };
+    }
+    return result;
+}
+function graph(value) {
+    const source = object(value);
+    if (!source ||
+        Object.entries(source).some(([path, item]) => !safePath(path) || !object(item))) {
+        throw new TypeError("JSR module graph is invalid.");
+    }
+    return source;
+}
+function exportMap(value) {
+    const source = typeof value === "string" ? { ".": value } : object(value);
+    if (!source || Object.keys(source).length === 0) {
+        throw new TypeError("JSR exports are invalid.");
+    }
+    const result = {};
+    for (const [key, entry] of Object.entries(source)) {
+        if ((key !== "." && !/^\.\/[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(key)) ||
+            typeof entry !== "string" || !entry.startsWith("./") ||
+            !safePath(`/${entry.slice(2)}`)) {
+            throw new TypeError("JSR exports are invalid.");
+        }
+        result[key] = entry;
+    }
+    return result;
+}
+function safePath(path) {
+    if (!/^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/.test(path)) {
+        return false;
+    }
+    return !path.slice(1).split("/").some((part) => part === "." || part === "..");
+}
+function safeLocalPath(path) {
+    return safePath(`/${path}`) && !path.startsWith("/");
+}
+function sameRecord(left, right) {
+    const keys = Object.keys(left);
+    return keys.length === Object.keys(right).length &&
+        keys.every((key) => left[key] === right[key]);
+}
+function verifyStatement(statement, input) {
+    const subjects = array(statement?.subject);
+    const subject = subjects?.length === 1 ? object(subjects[0]) : undefined;
+    const predicate = object(statement?.predicate);
+    const build = object(predicate?.buildDefinition);
+    const external = object(build?.externalParameters);
+    const internal = object(build?.internalParameters);
+    const workflow = object(external?.workflow);
+    const github = object(internal?.github);
+    const details = object(predicate?.runDetails);
+    const builder = object(details?.builder);
+    const metadata = object(details?.metadata);
+    if (!statement || statement.type !== "https://in-toto.io/Statement/v1" ||
+        statement.predicateType !== "https://slsa.dev/provenance/v1" ||
+        !subject || !predicate ||
+        build?.buildType !==
+            "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1" ||
+        builder?.id !== "https://github.com/actions/runner/github-hosted" ||
+        workflow?.repository !== `https://github.com/${input.repository}` ||
+        workflow?.path !== ".github/workflows/hj-release-publish-jsr.yaml" ||
+        typeof workflow.ref !== "string" ||
+        !/^refs\/(?:heads|tags)\/[^\s]+$/.test(workflow.ref) ||
+        (github?.eventName !== "repository_dispatch" &&
+            github?.eventName !== "workflow_dispatch") ||
+        !/^[1-9]\d*$/.test(String(github?.repositoryId)) ||
+        !/^[1-9]\d*$/.test(String(github?.repositoryOwnerId)) ||
+        typeof metadata?.invocationId !== "string" ||
+        !new RegExp(`^https://github\\.com/${escapeRegex(input.repository)}/actions/runs/[1-9]\\d*/attempts/[1-9]\\d*$`).test(metadata.invocationId))
+        throw new TypeError("Rekor provenance differs from release.");
+    const digest = object(subject.digest);
+    if (subject.name !== `pkg:jsr/${input.packageName}@${input.version}` ||
+        !digest || Object.keys(digest).length !== 1 ||
+        !/^[0-9a-f]{64}$/.test(String(digest.sha256)) ||
+        digest.sha256 !== input.manifestDigest)
+        throw new TypeError("Rekor subject differs from release.");
+    const dependencies = array(build?.resolvedDependencies);
+    if (!dependencies || !dependencies.some((value) => {
+        const dependency = object(value);
+        const digest = object(dependency?.digest);
+        return typeof dependency?.uri === "string" &&
+            new RegExp(`^git\\+https://github\\.com/${escapeRegex(input.repository)}@refs/(?:heads|tags)/[^\\s]+$`).test(dependency.uri) &&
+            digest?.gitCommit === input.sha;
+    }))
+        throw new TypeError("Rekor dependency differs from release.");
+}
+async function verifyEntryBody(body, data) {
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder().decode(base64(body)));
+    }
+    catch {
+        throw new TypeError("Rekor entry body is invalid.");
+    }
+    const entry = object(value);
+    const spec = object(entry?.spec);
+    const content = object(spec?.content);
+    const envelope = object(content?.envelope);
+    const payloadHash = object(content?.payloadHash);
+    const hash = object(content?.hash);
+    const signatures = array(envelope?.signatures);
+    if (entry?.apiVersion !== "0.0.2" || entry.kind !== "intoto" || !content ||
+        envelope?.payloadType !== "application/vnd.in-toto+json" ||
+        !signatures || signatures.length === 0 ||
+        signatures.some((signature) => {
+            const value = object(signature);
+            return !nonemptyString(value?.publicKey) ||
+                base64(value.publicKey).length === 0 ||
+                !nonemptyString(value.sig) || base64(value.sig).length === 0;
+        }) ||
+        !sha256Hash(payloadHash) || !sha256Hash(hash) ||
+        payloadHash.value !== await sha256(data))
+        throw new TypeError("Rekor entry body is invalid.");
+}
+function inclusionProof(value) {
+    const proof = object(value);
+    const hashes = array(proof?.hashes);
+    return !!proof && integer(proof.logIndex) && integer(proof.treeSize) &&
+        proof.treeSize > 0 && typeof proof.rootHash === "string" &&
+        /^[0-9a-f]{64}$/.test(proof.rootHash) && !!hashes &&
+        hashes.every((hash) => typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash)) &&
+        nonemptyString(proof.checkpoint);
+}
+function sha256Hash(value) {
+    return value?.algorithm === "sha256" && typeof value.value === "string" &&
+        /^[0-9a-f]{64}$/.test(value.value);
+}
+async function sha256(bytes) {
+    const source = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", source));
+    return [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function base64(value) {
+    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+        throw new TypeError("Rekor base64 encoding is invalid.");
+    }
+    try {
+        return Uint8Array.from(atob(value), (character) => character.charCodeAt(0));
+    }
+    catch {
+        throw new TypeError("Rekor attestation encoding is invalid.");
+    }
+}
+function object(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function array(value) {
+    return Array.isArray(value) ? value : undefined;
+}
+function integer(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function logId(value) {
+    if (integer(value) && value > 0)
+        return value;
+    if (typeof value !== "string" || !/^[1-9]\d*$/.test(value)) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;
+}
+function nonemptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+async function run(process, args) {
+    const result = await process.run("deno", args);
+    if (!result.success) {
+        throw new Error(`JSR command failed: deno ${args.join(" ")}.`);
+    }
+}