@mannyc1/ts-release 0.0.7 → 0.2.2

package/src/model/canonical.ts

@@ -0,0 +1,205 @@
+import { createHash } from "node:crypto"
+
+export type Json =
+  | boolean
+  | null
+  | number
+  | string
+  | ReadonlyArray<Json>
+  | { readonly [key: string]: Json }
+
+class StrictJsonParser {
+  private index = 0
+  constructor(private readonly text: string) {}
+
+  parse(): Json {
+    this.space()
+    const value = this.value()
+    this.space()
+    if (this.index !== this.text.length) this.fail("trailing input")
+    return value
+  }
+
+  private fail(reason: string): never {
+    throw new Error(`Invalid strict JSON at ${this.index}: ${reason}`)
+  }
+
+  private space(): void {
+    while (/[\t\n\r ]/u.test(this.text[this.index] ?? "")) this.index += 1
+  }
+
+  private take(expected: string): void {
+    if (!this.text.startsWith(expected, this.index)) this.fail(`expected ${expected}`)
+    this.index += expected.length
+  }
+
+  private value(): Json {
+    const token = this.text[this.index]
+    if (token === "{") return this.object()
+    if (token === "[") return this.array()
+    if (token === '"') return this.string()
+    if (token === "t") {
+      this.take("true")
+      return true
+    }
+    if (token === "f") {
+      this.take("false")
+      return false
+    }
+    if (token === "n") {
+      this.take("null")
+      return null
+    }
+    if (token === "-" || token !== undefined && /[0-9]/u.test(token)) return this.number()
+    return this.fail("expected value")
+  }
+
+  private string(): string {
+    const start = this.index
+    this.index += 1
+    let escaped = false
+    while (this.index < this.text.length) {
+      const character = this.text[this.index]!
+      if (!escaped && character === '"') {
+        this.index += 1
+        const value = JSON.parse(this.text.slice(start, this.index)) as string
+        if (value !== value.normalize("NFC")) this.fail("non-NFC string")
+        return value
+      }
+      if (!escaped && character.codePointAt(0)! < 0x20) this.fail("control character")
+      escaped = !escaped && character === "\\"
+      this.index += 1
+    }
+    return this.fail("unterminated string")
+  }
+
+  private number(): number {
+    const match = /^-?(?:0|[1-9][0-9]*)/u.exec(this.text.slice(this.index))
+    if (match === null) return this.fail("invalid number")
+    const token = match[0]
+    const next = this.text[this.index + token.length]
+    if (next === "." || next === "e" || next === "E") this.fail("float")
+    this.index += token.length
+    const value = Number(token)
+    if (!Number.isSafeInteger(value) || Object.is(value, -0)) this.fail("unsafe integer")
+    return value
+  }
+
+  private array(): ReadonlyArray<Json> {
+    this.index += 1
+    this.space()
+    const result: Array<Json> = []
+    if (this.text[this.index] === "]") {
+      this.index += 1
+      return result
+    }
+    while (true) {
+      result.push(this.value())
+      this.space()
+      if (this.text[this.index] === "]") {
+        this.index += 1
+        return result
+      }
+      this.take(",")
+      this.space()
+    }
+  }
+
+  private object(): { readonly [key: string]: Json } {
+    this.index += 1
+    this.space()
+    const result: Record<string, Json> = {}
+    if (this.text[this.index] === "}") {
+      this.index += 1
+      return result
+    }
+    while (true) {
+      if (this.text[this.index] !== '"') this.fail("expected object key")
+      const key = this.string()
+      if (Object.hasOwn(result, key)) this.fail(`duplicate key ${key}`)
+      this.space()
+      this.take(":")
+      this.space()
+      result[key] = this.value()
+      this.space()
+      if (this.text[this.index] === "}") {
+        this.index += 1
+        return result
+      }
+      this.take(",")
+      this.space()
+    }
+  }
+}
+
+const codePointOrder = (left: string, right: string): number => {
+  const a = [...left]
+  const b = [...right]
+  let index = 0
+  while (index < Math.min(a.length, b.length)) {
+    const difference = a[index]!.codePointAt(0)! - b[index]!.codePointAt(0)!
+    if (difference !== 0) return difference
+    index += 1
+  }
+  return a.length - b.length
+}
+
+const canonicalArray = (value: ReadonlyArray<unknown>, parents: Set<object>): string => {
+  let index = 0
+  while (index < value.length) {
+    if (!Object.hasOwn(value, index)) throw new Error("sparse array")
+    index += 1
+  }
+  return `[${value.map((item) => canonical(item, parents)).join(",")}]`
+}
+
+const canonicalObject = (value: object, parents: Set<object>): string => {
+  if (Object.getPrototypeOf(value) !== Object.prototype) throw new Error("non-plain object")
+  const entries = Object.entries(value).map(([key, item]) => [key.normalize("NFC"), item] as const)
+  if (new Set(entries.map(([key]) => key)).size !== entries.length) {
+    throw new Error("normalized key collision")
+  }
+  entries.sort(([left], [right]) => codePointOrder(left, right))
+  return `{${entries.map(([key, item]) =>
+    `${JSON.stringify(key)}:${canonical(item, parents)}`).join(",")}}`
+}
+
+const canonical = (value: unknown, parents: Set<object>): string => {
+  if (value === null || typeof value === "boolean") return JSON.stringify(value)
+  if (typeof value === "string") return JSON.stringify(value.normalize("NFC"))
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value) || Object.is(value, -0)) throw new Error("unsafe number")
+    return String(value)
+  }
+  if (typeof value !== "object") throw new Error("non-JSON value")
+  if (parents.has(value)) throw new Error("cyclic value")
+  parents.add(value)
+  try {
+    return Array.isArray(value)
+      ? canonicalArray(value, parents)
+      : canonicalObject(value, parents)
+  } finally {
+    parents.delete(value)
+  }
+}
+
+const frame = (value: Uint8Array): Uint8Array => {
+  const result = new Uint8Array(value.length + 4)
+  new DataView(result.buffer).setUint32(0, value.length, false)
+  result.set(value, 4)
+  return result
+}
+
+export const parseStrictJson = (text: string): Json => new StrictJsonParser(text).parse()
+export const encodeCanonicalJson = (value: unknown): string =>
+  `${canonical(value, new Set())}\n`
+export const hashFramed = (domain: string, parts: ReadonlyArray<Uint8Array>): string => {
+  const hash = createHash("sha256")
+  hash.update(frame(new TextEncoder().encode(domain.normalize("NFC"))))
+  parts.forEach((part) => {
+    hash.update(frame(part))
+  })
+  return hash.digest("hex")
+}
+export const hashCanonical = (domain: string, value: unknown): string =>
+  hashFramed(domain, [new TextEncoder().encode(encodeCanonicalJson(value))])

package/src/model/catalog.ts

@@ -0,0 +1,220 @@
+import * as Schema from "effect/Schema"
+import * as Semver from "semver"
+import { encodeCanonicalJson, parseStrictJson } from "./canonical.js"
+import { Sha256Digest } from "./digest.js"
+import { NonEmptyName, OutputId, SafeRelativePath, Version } from "./primitives.js"
+
+const optional = Schema.optionalKey
+
+export const GitHubRepositoryCoordinate = Schema.NonEmptyString.check(Schema.makeFilter(
+  (value: string) => /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/u.test(value)
+    ? undefined
+    : "Catalog repository must be an owner/repository coordinate."
+)).pipe(Schema.brand("GitHubRepositoryCoordinate"))
+export type GitHubRepositoryCoordinate = typeof GitHubRepositoryCoordinate.Type
+
+export const GitBranchName = Schema.NonEmptyString.check(Schema.makeFilter((value: string) =>
+  !value.startsWith("-") && !value.startsWith("/") && !value.endsWith("/") && !value.endsWith(".") &&
+  !value.endsWith(".lock") && !value.includes("..") && !value.includes("//") && !value.includes("@{") &&
+  !/[~^:?*[\\\u0000-\u001f\u007f]/u.test(value)
+    ? undefined
+    : "Catalog branch must be one canonical Git branch name."))
+  .pipe(Schema.brand("GitBranchName"))
+export type GitBranchName = typeof GitBranchName.Type
+
+export const CatalogRepositoryPath = SafeRelativePath.check(Schema.makeFilter((value) =>
+  value.toString() !== "." ? undefined : "Catalog repository paths must identify files."))
+  .pipe(Schema.brand("CatalogRepositoryPath"))
+export type CatalogRepositoryPath = typeof CatalogRepositoryPath.Type
+
+export const CatalogArchitecture = Schema.Literals(["x64", "arm64"])
+export type CatalogArchitecture = typeof CatalogArchitecture.Type
+
+export class CatalogRenderSource extends Schema.Class<CatalogRenderSource>("CatalogRenderSource")({
+  artifactId: OutputId,
+  architecture: CatalogArchitecture,
+  url: Schema.NonEmptyString,
+  filename: NonEmptyName
+}) {}
+
+export class PreparedCatalogDownload extends Schema.Class<PreparedCatalogDownload>("PreparedCatalogDownload")({
+  architecture: CatalogArchitecture,
+  url: Schema.NonEmptyString,
+  filename: NonEmptyName,
+  sha256: Sha256Digest
+}) {}
+
+const rendererFields = {
+  name: NonEmptyName,
+  description: Schema.NonEmptyString,
+  homepage: Schema.NonEmptyString,
+  license: optional(Schema.NonEmptyString)
+}
+
+export class HomebrewRenderer extends Schema.TaggedClass<HomebrewRenderer>()("homebrew", {
+  ...rendererFields,
+  installPath: NonEmptyName
+}) {}
+
+export class ScoopRenderer extends Schema.TaggedClass<ScoopRenderer>()("scoop", {
+  ...rendererFields,
+  bin: NonEmptyName
+}) {}
+
+export const CatalogRenderer = Schema.Union([HomebrewRenderer, ScoopRenderer])
+export type CatalogRenderer = typeof CatalogRenderer.Type
+
+export class PreparedCatalogRenderer
+  extends Schema.Class<PreparedCatalogRenderer>("PreparedCatalogRenderer")({
+    renderer: CatalogRenderer,
+    downloads: Schema.NonEmptyArray(PreparedCatalogDownload)
+  }) {}
+
+export const CatalogManagedStatus = Schema.Literals(["active", "corrected", "superseded"])
+
+export class CatalogManagedState extends Schema.Class<CatalogManagedState>("CatalogManagedState")({
+  schemaVersion: Schema.Literal("ts-release/catalog-state/v2"),
+  catalogId: NonEmptyName,
+  renderer: Schema.Literals(["homebrew", "scoop"]),
+  generation: Version,
+  status: CatalogManagedStatus,
+  targetDigest: Sha256Digest,
+  sourceRepository: GitHubRepositoryCoordinate,
+  sourceTag: NonEmptyName,
+  correctionId: optional(Sha256Digest),
+  reason: optional(Schema.NonEmptyString),
+  replacementVersion: optional(Version)
+}) {}
+
+export const encodeCatalogManagedState = (value: CatalogManagedState): Uint8Array =>
+  new TextEncoder().encode(encodeCanonicalJson(Schema.encodeSync(CatalogManagedState)(value)))
+
+export const decodeCatalogManagedState = (bytes: Uint8Array): CatalogManagedState | undefined => {
+  try {
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes)
+    const value = Schema.decodeUnknownSync(CatalogManagedState, { onExcessProperty: "error" })(parseStrictJson(text))
+    if (Semver.valid(value.generation.toString()) !== value.generation.toString()) return undefined
+    const canonical = encodeCatalogManagedState(value)
+    return canonical.length === bytes.length && canonical.every((byte, index) => byte === bytes[index])
+      ? value
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+export const canonicalCatalogVersion = (value: string): Version => {
+  const parsed = Semver.valid(value)
+  if (parsed === null || parsed !== value) throw new Error(`Catalog generation requires a canonical semantic version, got ${JSON.stringify(value)}.`)
+  return Version.make(value)
+}
+
+export const compareCatalogVersions = (left: string, right: string): number => {
+  canonicalCatalogVersion(left)
+  canonicalCatalogVersion(right)
+  return Semver.compare(left, right)
+}
+
+const assertDownloads = (downloads: ReadonlyArray<PreparedCatalogDownload>): void => {
+  if (downloads.length === 0) throw new Error("Catalog renderer requires at least one download.")
+  const architectures = downloads.map((download) => download.architecture)
+  if (new Set(architectures).size !== architectures.length) {
+    throw new Error("Catalog renderer repeats an architecture.")
+  }
+  for (const download of downloads) {
+    const url = new URL(download.url)
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hash !== "") {
+      throw new Error("Catalog download URLs must be credential-free HTTPS URLs.")
+    }
+  }
+}
+
+const rubyString = (value: string): string => JSON.stringify(value)
+const formulaClass = (value: string): string => value.split(/[^A-Za-z0-9]+/u).filter(Boolean)
+  .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`).join("") || "GeneratedFormula"
+
+const homebrewDownload = (download: PreparedCatalogDownload, indent: string): ReadonlyArray<string> => [
+  `${indent}url ${rubyString(download.url)}`,
+  `${indent}sha256 ${rubyString(download.sha256.hex)}`
+]
+
+const renderHomebrew = (
+  version: Version,
+  renderer: HomebrewRenderer,
+  downloads: ReadonlyArray<PreparedCatalogDownload>
+): string => {
+  const lines = [
+    `class ${formulaClass(renderer.name)} < Formula`,
+    `  desc ${rubyString(renderer.description)}`,
+    `  homepage ${rubyString(renderer.homepage)}`,
+    ...(renderer.license === undefined ? [] : [`  license ${rubyString(renderer.license)}`]),
+    `  version ${rubyString(version.toString())}`
+  ]
+  if (downloads.length === 1) {
+    lines.push(...homebrewDownload(downloads[0]!, "  "))
+  } else {
+    lines.push("", "  on_macos do")
+    for (const architecture of ["arm64", "x64"] as const) {
+      const download = downloads.find((candidate) => candidate.architecture === architecture)
+      if (download === undefined) continue
+      lines.push(`    ${architecture === "arm64" ? "on_arm" : "on_intel"} do`)
+      lines.push(...homebrewDownload(download, "      "))
+      lines.push("    end")
+    }
+    lines.push("  end")
+  }
+  lines.push(
+    "",
+    "  def install",
+    `    bin.install ${rubyString(renderer.installPath)} => ${rubyString(renderer.name)}`,
+    "  end",
+    "",
+    "  test do",
+    `    assert_predicate bin/${rubyString(renderer.name)}, :executable?`,
+    "  end",
+    "end",
+    ""
+  )
+  return lines.join("\n")
+}
+
+const scoopDownload = (download: PreparedCatalogDownload): Readonly<Record<string, string>> => ({
+  url: download.url,
+  hash: download.sha256.hex
+})
+
+const renderScoop = (
+  version: Version,
+  renderer: ScoopRenderer,
+  downloads: ReadonlyArray<PreparedCatalogDownload>
+): string => {
+  const common: Record<string, unknown> = {
+    version: version.toString(),
+    description: renderer.description,
+    homepage: renderer.homepage,
+    ...(renderer.license === undefined ? {} : { license: renderer.license })
+  }
+  const value = downloads.length === 1
+    ? { ...common, ...scoopDownload(downloads[0]!), bin: renderer.bin.toString() }
+    : {
+      ...common,
+      architecture: Object.fromEntries(downloads
+        .slice()
+        .sort((left, right) => left.architecture < right.architecture ? -1 : 1)
+        .map((download) => [download.architecture === "x64" ? "64bit" : "arm64", scoopDownload(download)])),
+      bin: renderer.bin.toString()
+    }
+  return `${JSON.stringify(value, null, 2)}\n`
+}
+
+export const renderCatalog = (
+  version: Version,
+  renderer: CatalogRenderer,
+  downloads: ReadonlyArray<PreparedCatalogDownload>
+): Uint8Array => {
+  canonicalCatalogVersion(version.toString())
+  assertDownloads(downloads)
+  return new TextEncoder().encode(renderer._tag === "homebrew"
+    ? renderHomebrew(version, renderer, downloads)
+    : renderScoop(version, renderer, downloads))
+}

package/src/model/digest.ts

@@ -0,0 +1,172 @@
+import * as Schema from "effect/Schema"
+import { createHash } from "node:crypto"
+
+const lowercaseHex = (algorithm: "sha1" | "sha256" | "sha512", length: number) =>
+  Schema.String.check(Schema.makeFilter((value: string) =>
+    new RegExp(`^[a-f0-9]{${length}}$`, "u").test(value)
+      ? undefined
+      : `${algorithm} digest bytes must be exactly ${length} lowercase hexadecimal characters.`
+  )).pipe(Schema.brand(`${algorithm}Hex`))
+
+export const Sha1Hex = lowercaseHex("sha1", 40)
+export type Sha1Hex = typeof Sha1Hex.Type
+
+export const Sha256Hex = lowercaseHex("sha256", 64)
+export type Sha256Hex = typeof Sha256Hex.Type
+
+export const Sha512Hex = lowercaseHex("sha512", 128)
+export type Sha512Hex = typeof Sha512Hex.Type
+
+export class Sha1Digest
+  extends Schema.TaggedClass<Sha1Digest>()("Sha1Digest", {
+    algorithm: Schema.Literal("sha1"),
+    hex: Sha1Hex
+  }) {}
+
+export class Sha256Digest
+  extends Schema.TaggedClass<Sha256Digest>()("Sha256Digest", {
+    algorithm: Schema.Literal("sha256"),
+    hex: Sha256Hex
+  }) {}
+
+export class Sha512Digest
+  extends Schema.TaggedClass<Sha512Digest>()("Sha512Digest", {
+    algorithm: Schema.Literal("sha512"),
+    hex: Sha512Hex
+  }) {}
+
+export const AlgorithmDigest = Schema.Union([
+  Sha1Digest,
+  Sha256Digest,
+  Sha512Digest
+])
+export type AlgorithmDigest = typeof AlgorithmDigest.Type
+
+export const DigestEncoding = Schema.Literals([
+  "sha1-hex",
+  "sha256-hex",
+  "sha512-hex",
+  "github-sha256",
+  "npm-sha512-sri",
+  "npm-sha1-shasum"
+])
+export type DigestEncoding = typeof DigestEncoding.Type
+
+export class DigestCodecError
+  extends Schema.TaggedErrorClass<DigestCodecError>()("DigestCodecError", {
+    encoding: DigestEncoding,
+    reason: Schema.NonEmptyString
+  }) {}
+
+const decodeHex = (
+  value: unknown,
+  encoding: "sha1-hex" | "sha256-hex" | "sha512-hex",
+  length: 40 | 64 | 128
+): string => {
+  if (typeof value !== "string" ||
+      !new RegExp(`^[a-f0-9]{${length}}$`, "u").test(value)) {
+    throw new DigestCodecError({
+      encoding,
+      reason: `Value is not a canonical ${encoding} digest encoding.`
+    })
+  }
+  return value
+}
+
+export const parseSha1Hex = (value: unknown): Sha1Digest => Sha1Digest.make({
+  algorithm: "sha1",
+  hex: Sha1Hex.make(decodeHex(value, "sha1-hex", 40))
+})
+
+export const parseSha256Hex = (value: unknown): Sha256Digest => Sha256Digest.make({
+  algorithm: "sha256",
+  hex: Sha256Hex.make(decodeHex(value, "sha256-hex", 64))
+})
+
+export const parseSha512Hex = (value: unknown): Sha512Digest => Sha512Digest.make({
+  algorithm: "sha512",
+  hex: Sha512Hex.make(decodeHex(value, "sha512-hex", 128))
+})
+
+export const formatSha1Hex = (digest: Sha1Digest): Sha1Hex => digest.hex
+export const formatSha256Hex = (digest: Sha256Digest): Sha256Hex => digest.hex
+export const formatSha512Hex = (digest: Sha512Digest): Sha512Hex => digest.hex
+
+export const parseGitHubSha256 = (value: unknown): Sha256Digest => {
+  if (typeof value !== "string" || !value.startsWith("sha256:")) {
+    throw new DigestCodecError({
+      encoding: "github-sha256",
+      reason: "GitHub SHA-256 must use the canonical sha256:<lowercase-hex> encoding."
+    })
+  }
+  try {
+    return parseSha256Hex(value.slice("sha256:".length))
+  } catch {
+    throw new DigestCodecError({
+      encoding: "github-sha256",
+      reason: "GitHub SHA-256 must use the canonical sha256:<lowercase-hex> encoding."
+    })
+  }
+}
+
+export const formatGitHubSha256 = (digest: Sha256Digest): string =>
+  `sha256:${formatSha256Hex(digest)}`
+
+export const parseNpmSha512Sri = (value: unknown): Sha512Digest => {
+  if (typeof value !== "string" || !value.startsWith("sha512-")) {
+    throw new DigestCodecError({
+      encoding: "npm-sha512-sri",
+      reason: "npm SHA-512 integrity must use the canonical sha512-<base64> SRI encoding."
+    })
+  }
+  const encoded = value.slice("sha512-".length)
+  if (!/^[A-Za-z0-9+/]{86}==$/u.test(encoded)) {
+    throw new DigestCodecError({
+      encoding: "npm-sha512-sri",
+      reason: "npm SHA-512 integrity contains malformed or noncanonical base64."
+    })
+  }
+  const bytes = Buffer.from(encoded, "base64")
+  if (bytes.length !== 64 || bytes.toString("base64") !== encoded) {
+    throw new DigestCodecError({
+      encoding: "npm-sha512-sri",
+      reason: "npm SHA-512 integrity contains malformed or noncanonical base64."
+    })
+  }
+  return parseSha512Hex(bytes.toString("hex"))
+}
+
+export const formatNpmSha512Sri = (digest: Sha512Digest): string =>
+  `sha512-${Buffer.from(formatSha512Hex(digest), "hex").toString("base64")}`
+
+export const parseNpmSha1Shasum = (value: unknown): Sha1Digest => {
+  try {
+    const parsed = parseSha1Hex(value)
+    return Sha1Digest.make({ algorithm: "sha1", hex: parsed.hex })
+  } catch {
+    throw new DigestCodecError({
+      encoding: "npm-sha1-shasum",
+      reason: "npm shasum must be exactly 40 lowercase hexadecimal SHA-1 characters."
+    })
+  }
+}
+
+export const formatNpmSha1Shasum = (digest: Sha1Digest): string =>
+  formatSha1Hex(digest)
+
+const hashHex = (algorithm: "sha1" | "sha256" | "sha512", bytes: Uint8Array): string =>
+  createHash(algorithm).update(bytes).digest("hex")
+
+export const sha1Digest = (bytes: Uint8Array): Sha1Digest =>
+  parseSha1Hex(hashHex("sha1", bytes))
+
+export const sha256Digest = (bytes: Uint8Array): Sha256Digest =>
+  parseSha256Hex(hashHex("sha256", bytes))
+
+export const sha512Digest = (bytes: Uint8Array): Sha512Digest =>
+  parseSha512Hex(hashHex("sha512", bytes))
+
+export const digestEquals = (
+  left: AlgorithmDigest,
+  right: AlgorithmDigest
+): boolean => left.algorithm === right.algorithm && left.hex === right.hex

package/src/model/errors.ts

@@ -0,0 +1,6 @@
+import * as Schema from "effect/Schema"
+
+const reason = { reason: Schema.String }
+export const MISSING_COMMIT = "source.commit is required and could not be observed from the repository."
+export class ConfigValueError extends Schema.TaggedErrorClass<ConfigValueError>()("ConfigValueError", reason) {}
+export class ConfigDecodeError extends Schema.TaggedErrorClass<ConfigDecodeError>()("ConfigDecodeError", reason) {}

package/src/model/primitives.ts

@@ -0,0 +1,37 @@
+import * as Schema from "effect/Schema"
+
+const identifier = <const Name extends string>(name: Name) =>
+  Schema.NonEmptyString.pipe(Schema.brand(name))
+
+export const OperationId = identifier("OperationId"); export type OperationId = typeof OperationId.Type
+export const OutputId = identifier("OutputId"); export type OutputId = typeof OutputId.Type
+export const Digest = identifier("Digest"); export type Digest = typeof Digest.Type
+export const NonEmptyName = identifier("NonEmptyName"); export type NonEmptyName = typeof NonEmptyName.Type
+export const Version = identifier("Version"); export type Version = typeof Version.Type
+
+export const isSafeRelativePath = (value: string): boolean =>
+  value.trim().length > 0 &&
+  !value.startsWith("/") &&
+  !value.startsWith("\\") &&
+  !/^[A-Za-z]:[\\/]/u.test(value) &&
+  !value.split(/[\\/]+/u).includes("..")
+
+export const SafeRelativePath = Schema.String.check(
+  Schema.makeFilter((value: string) =>
+    isSafeRelativePath(value)
+      ? undefined
+      : "Path must be nonempty, relative, and contain no parent traversal.")
+).pipe(Schema.brand("SafeRelativePath"))
+export type SafeRelativePath = typeof SafeRelativePath.Type
+
+export const SafeArchivePattern = Schema.String.check(
+  Schema.makeFilter((value: string) =>
+    isSafeRelativePath(value) ? undefined : "Archive pattern must be relative and contain no parent traversal.")
+).pipe(Schema.brand("SafeArchivePattern"))
+export type SafeArchivePattern = typeof SafeArchivePattern.Type
+
+export const WorkspaceRoot = Schema.String.check(
+  Schema.makeFilter((value: string) =>
+    value.startsWith("/") ? undefined : "WorkspaceRoot must be absolute.")
+).pipe(Schema.brand("WorkspaceRoot"))
+export type WorkspaceRoot = typeof WorkspaceRoot.Type

package/src/model/pypi.ts

@@ -0,0 +1,30 @@
+import * as Schema from "effect/Schema"
+
+export const PyPiRepository = Schema.Literals(["pypi", "testpypi"])
+export type PyPiRepository = typeof PyPiRepository.Type
+
+export const normalizePyPiProjectName = (value: string): string => {
+  if (!/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/u.test(value)) {
+    throw new Error("PyPI project names may contain only ASCII letters, digits, period, underscore, and hyphen.")
+  }
+  return value.toLowerCase().replace(/[-_.]+/gu, "-")
+}
+
+export const PyPiProjectName = Schema.NonEmptyString.check(Schema.makeFilter((value: string) => {
+  try {
+    return normalizePyPiProjectName(value) === value ? undefined : "PyPI project name must be normalized."
+  } catch (cause) {
+    return cause instanceof Error ? cause.message : String(cause)
+  }
+})).pipe(Schema.brand("PyPiProjectName"))
+export type PyPiProjectName = typeof PyPiProjectName.Type
+
+export interface PyPiRepositoryEndpoints {
+  readonly simpleBaseUrl: string
+  readonly uploadUrl: string
+}
+
+export const pypiRepositoryEndpoints = (repository: PyPiRepository): PyPiRepositoryEndpoints =>
+  repository === "pypi"
+    ? { simpleBaseUrl: "https://pypi.org/simple/", uploadUrl: "https://upload.pypi.org/legacy/" }
+    : { simpleBaseUrl: "https://test.pypi.org/simple/", uploadUrl: "https://test.pypi.org/legacy/" }