@mannyc1/ts-release 0.0.7 → 0.3.0

package/src/drivers/seccomp-helper-source.ts

@@ -0,0 +1,121 @@
+/**
+ * Embedded so source, built JS, npm consumers, and standalone CLI bundles all
+ * execute the same audited helper bytes through the pinned Bun runtime.
+ */
+export const makeNetworkIsolationHelperSource = (requiredLibrary = "libseccomp.so.2"): string => String.raw`import { dlopen, ptr } from "bun:ffi"
+import { createHash } from "node:crypto"
+import { readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs"
+import { arch, release } from "node:os"
+
+const fail = (reason) => {
+  process.stderr.write("ts-release network isolation failed closed: " + reason + "\n")
+  process.exit(125)
+}
+if (process.platform !== "linux" || !["x64", "arm64"].includes(process.arch)) {
+  fail("unsupported host " + process.platform + "/" + process.arch)
+}
+const identityPath = process.env.TS_RELEASE_NETWORK_IDENTITY_FILE
+const expectedHelperDigest = process.env.TS_RELEASE_NETWORK_HELPER_SHA256
+const libraryName = process.env.TS_RELEASE_NETWORK_LIBRARY
+if (!identityPath || !expectedHelperDigest || libraryName !== ${JSON.stringify(requiredLibrary)}) {
+  fail("missing or invalid internal isolation parameters")
+}
+const helperDigest = createHash("sha256").update(readFileSync(process.argv[1])).digest("hex")
+if (helperDigest !== expectedHelperDigest) fail("helper digest disagrees with parent")
+const argv = process.argv.slice(2)
+if (argv.length === 0) fail("missing command")
+const deniedSyscalls = [
+  "socket", "socketpair", "connect", "bind", "listen", "accept", "accept4",
+  "sendto", "sendmsg", "sendmmsg", "recvfrom", "recvmsg", "recvmmsg",
+  "io_uring_setup", "io_uring_enter", "io_uring_register", "pidfd_getfd"
+]
+let library
+try {
+  library = dlopen(libraryName, {
+    seccomp_init: { args: ["u32"], returns: "ptr" },
+    seccomp_rule_add: { args: ["ptr", "u32", "i32", "u32"], returns: "i32" },
+    seccomp_load: { args: ["ptr"], returns: "i32" },
+    seccomp_release: { args: ["ptr"], returns: "void" },
+    seccomp_syscall_resolve_name: { args: ["ptr"], returns: "i32" }
+  })
+} catch (cause) {
+  fail("libseccomp.so.2 unavailable: " + String(cause))
+}
+let libraryPath
+try {
+  const mapping = readFileSync("/proc/self/maps", "utf8").split("\n").find((line) => line.includes("libseccomp.so"))
+  const candidate = mapping && mapping.trim().split(/\s+/).at(-1)
+  if (!candidate || !candidate.startsWith("/")) fail("loaded libseccomp mapping is unavailable")
+  libraryPath = realpathSync(candidate)
+} catch (cause) {
+  fail("cannot identify loaded libseccomp: " + String(cause))
+}
+const libraryDigest = createHash("sha256").update(readFileSync(libraryPath)).digest("hex")
+const bunDigest = createHash("sha256").update(readFileSync(realpathSync(process.execPath))).digest("hex")
+const context = library.symbols.seccomp_init(0x7fff0000)
+if (context === null) fail("seccomp_init returned null")
+try {
+  for (const name of deniedSyscalls) {
+    const bytes = new TextEncoder().encode(name + "\0")
+    const syscall = library.symbols.seccomp_syscall_resolve_name(ptr(bytes))
+    if (syscall < 0) fail("kernel/libseccomp cannot resolve " + name)
+    const result = library.symbols.seccomp_rule_add(context, 0x00050001, syscall, 0)
+    if (result !== 0) fail("seccomp_rule_add(" + name + ") returned " + result)
+  }
+  const loaded = library.symbols.seccomp_load(context)
+  if (loaded !== 0) fail("seccomp_load returned " + loaded)
+} finally {
+  library.symbols.seccomp_release(context)
+}
+library.close()
+const identity = {
+  protocol: "ts-release-seccomp-network-deny/v1",
+  helperSha256: helperDigest,
+  librarySha256: libraryDigest,
+  bunVersion: globalThis["Bun"].version,
+  bunSha256: bunDigest,
+  kernel: release(),
+  architecture: arch(),
+  deniedSyscalls
+}
+try {
+  writeFileSync(identityPath, JSON.stringify(identity), { encoding: "utf8", flag: "wx", mode: 0o600 })
+} catch (cause) {
+  fail("cannot persist isolation identity: " + String(cause))
+}
+const childEnvironment = { ...process.env }
+delete childEnvironment.TS_RELEASE_NETWORK_IDENTITY_FILE
+delete childEnvironment.TS_RELEASE_NETWORK_HELPER_SHA256
+delete childEnvironment.TS_RELEASE_NETWORK_LIBRARY
+// The runtime spawn API preserves caller-provided non-stdio descriptors. Close only the
+// descriptors explicitly inherited without FD_CLOEXEC; Bun's own internal
+// descriptors remain untouched and are closed by exec.
+let libc
+try {
+  libc = dlopen("libc.so.6", {
+    fcntl: { args: ["i32", "i32"], returns: "i32" },
+    close: { args: ["i32"], returns: "i32" }
+  })
+  for (const item of readdirSync("/proc/self/fd")) {
+    const fd = Number(item)
+    if (!Number.isSafeInteger(fd) || fd <= 2) continue
+    const flags = libc.symbols.fcntl(fd, 1)
+    if (flags >= 0 && (flags & 1) === 0) libc.symbols.close(fd)
+  }
+  libc.close()
+} catch (cause) {
+  fail("cannot close inherited non-stdio descriptors: " + String(cause))
+}
+let child
+try {
+  child = globalThis["Bun"].spawn(argv, {
+    env: childEnvironment,
+    stdio: ["ignore", "inherit", "inherit"]
+  })
+} catch (cause) {
+  fail("isolated child spawn failed: " + String(cause))
+}
+process.exit(await child.exited)
+`
+
+export const networkIsolationHelperSource = makeNetworkIsolationHelperSource()

package/src/drivers/utils.ts

@@ -0,0 +1,10 @@
+import { createHash } from "node:crypto"
+import { DriverError } from "./errors.js"
+
+export const failure = (
+  reason: string,
+  commitment: "before-commit" | "unknown" = "before-commit"
+) => DriverError.make({ reason, commitment })
+
+export const sha256 = (bytes: Uint8Array): string =>
+  createHash("sha256").update(bytes).digest("hex")

package/src/drivers/workspace.ts

@@ -0,0 +1,46 @@
+import {
+  chmodSync, closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync,
+  mkdirSync, mkdtempSync, openSync, readFileSync, realpathSync, writeFileSync
+} from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { contained } from "./contain.js"
+import { DriverError } from "./errors.js"
+
+const fail = (reason: string): DriverError => DriverError.make({ reason, commitment: "before-commit" })
+
+/** Create private scratch beneath the host temp root and return its canonical path.
+ * macOS commonly exposes that root through /var while realpath resolves /private/var. */
+export const makeCanonicalTemporaryDirectory = (prefix: string): string =>
+  realpathSync(mkdtempSync(join(realpathSync(tmpdir()), prefix)))
+
+export const secureRead = (root: string, path: string): { readonly bytes: Uint8Array, readonly inode: number } => {
+  let current = root
+  for (const part of path.split(/[\\/]+/u)) {
+    current = join(current, part)
+    if (lstatSync(current).isSymbolicLink()) throw fail("Structured read encountered a symlink.")
+  }
+  const descriptor = openSync(current, constants.O_RDONLY | constants.O_NOFOLLOW)
+  try {
+    const opened = fstatSync(descriptor)
+    const resolved = realpathSync(current)
+    if (!contained(root, resolved)) throw fail("Opened file escaped the workspace root.")
+    const landed = lstatSync(resolved)
+    if (landed.ino !== opened.ino || landed.dev !== opened.dev) throw fail("Opened file changed identity.")
+    return { bytes: new Uint8Array(readFileSync(descriptor)), inode: opened.ino }
+  } finally { closeSync(descriptor) }
+}
+
+export const secureWrite = (root: string, path: string, bytes: Uint8Array | string): void => {
+  const parts = path.split(/[\\/]+/u).filter((part) => part.length > 0)
+  let parent = root
+  for (const part of parts.slice(0, -1)) {
+    parent = join(parent, part)
+    mkdirSync(parent, { recursive: true })
+    if (lstatSync(parent).isSymbolicLink()) throw fail("Structured write encountered a symlink.")
+  }
+  const target = join(parent, parts.at(-1)!)
+  if (existsSync(target) && lstatSync(target).isSymbolicLink()) throw fail("Structured write encountered a symlink.")
+  const descriptor = openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 0o644)
+  try { writeFileSync(descriptor, bytes); fsyncSync(descriptor) } finally { closeSync(descriptor) }
+}

package/src/extensions/provider-adapter.ts

@@ -0,0 +1,99 @@
+import * as Schema from "effect/Schema"
+import { NonEmptyName } from "../model/primitives.js"
+import type { ReleaseSubject } from "../publication/coordinator.js"
+import {
+  assertRecoveryProfileMatches,
+  validatePublicationProfiles,
+  type PublicationProfileRegistration
+} from "../publication/recovery.js"
+import type { PublicationSubjectServices } from "../capabilities/module.js"
+import type { PreparedBundle } from "../release/prepared-store.js"
+
+/**
+ * Closed acknowledgements required from every custom application adapter.
+ * They are intentionally precise rather than extensible strings: a boolean
+ * success callback or generic command publisher cannot satisfy this contract.
+ */
+export class ProviderAdapterContract
+  extends Schema.Class<ProviderAdapterContract>("ProviderAdapterContract")({
+    schemaVersion: Schema.Literal("ts-release/provider-adapter-contract/v1"),
+    preparedSubject: Schema.Literal("typed-canonical-data"),
+    identity: Schema.Literal("canonical-subject-id"),
+    observation: Schema.Literal("exact-equality-and-authoritative-absence"),
+    mutation: Schema.Literal("typed-precondition-and-commitment"),
+    credentials: Schema.Literal("audience-and-purpose-scoped"),
+    recovery: Schema.Literal("coordinator-profile"),
+    certification: Schema.Literal("provider-protocol-and-public-boundary-tests")
+  }) {}
+
+export interface CustomProviderAdapterInput {
+  readonly id: string
+  readonly contract: ProviderAdapterContract
+  readonly profile: PublicationProfileRegistration
+  /**
+   * Derive typed subjects only from a verified prepared bundle and opaque host
+   * sinks. Returning no subject means this installed application adapter does
+   * not apply to that bundle.
+   */
+  readonly subjects: (
+    bundle: PreparedBundle,
+    services: PublicationSubjectServices
+  ) => ReadonlyArray<ReleaseSubject>
+}
+
+export interface CustomProviderAdapter extends Omit<CustomProviderAdapterInput, "id"> {
+  readonly _tag: "CustomProviderAdapter"
+  readonly id: NonEmptyName
+}
+
+const decodeContract = Schema.decodeUnknownSync(ProviderAdapterContract, {
+  onExcessProperty: "error"
+})
+
+/** Validate once at custom-application composition time. */
+export const makeProviderAdapter = (input: CustomProviderAdapterInput): CustomProviderAdapter => {
+  const contract = decodeContract(input.contract)
+  const id = NonEmptyName.make(input.id)
+  const profile = validatePublicationProfiles({ [id.toString()]: input.profile })[id.toString()]!
+  if (profile.id !== id.toString()) {
+    throw new Error("A custom provider adapter id must equal its recovery-profile registration id.")
+  }
+  return Object.freeze({
+    _tag: "CustomProviderAdapter" as const,
+    ...input,
+    id,
+    contract,
+    profile
+  })
+}
+
+/**
+ * Build custom subjects behind the same profile and identity checks used by
+ * built-ins. Coordinator construction performs the final request identity,
+ * audience, purpose, mutation, prerequisite, and durable-history checks.
+ */
+export const customProviderSubjects = (
+  bundle: PreparedBundle,
+  adapters: ReadonlyArray<CustomProviderAdapter>,
+  services: PublicationSubjectServices,
+  reservedIds: ReadonlySet<string> = new Set()
+): ReadonlyArray<ReleaseSubject> => {
+  const result: Array<ReleaseSubject> = []
+  const ids = new Set(reservedIds)
+  for (const adapter of adapters) {
+    const subjects = adapter.subjects(bundle, services)
+    for (const subject of subjects) {
+      if (ids.has(subject.id.toString())) {
+        throw new Error(`Custom provider adapter ${adapter.id} repeats subject ${subject.id}.`)
+      }
+      assertRecoveryProfileMatches(adapter.profile.id, adapter.profile.recovery, subject.recovery)
+      if (subject.observationRequests.some((request) => request.provider.toString() !== adapter.profile.provider) ||
+          subject.mutationRequest.provider.toString() !== adapter.profile.provider) {
+        throw new Error(`Custom provider adapter ${adapter.id} emitted credential authority for a foreign provider.`)
+      }
+      ids.add(subject.id.toString())
+      result.push(subject)
+    }
+  }
+  return result
+}

package/src/host.ts

@@ -0,0 +1,140 @@
+import * as Layer from "effect/Layer"
+import type { ReleaseRuntimeShape } from "./api/runtime.js"
+import { ReleaseRuntime } from "./api/runtime.js"
+import type { ReleaseApiLayer } from "./api/types.js"
+import type { RunCommand } from "./drivers/process.js"
+import { Sha256Digest, sha256Digest } from "./model/digest.js"
+import { SafeRelativePath, WorkspaceRoot } from "./model/primitives.js"
+import type { CredentialRequest } from "./model/authority.js"
+import {
+  CredentialAudienceMismatch,
+  CredentialProvider,
+  CredentialPurposeMismatch,
+  CredentialStrategyUnsupported,
+  CredentialSubjectMismatch,
+  CredentialUnavailable,
+  makeCredentialProvider,
+  type CredentialAuthorityError,
+  type CredentialGrant,
+  type CredentialGrantAcquirer,
+  type CredentialGrantDescriptor,
+  type CredentialProviderShape,
+  type MutationCredentialGrant
+} from "./publication/authority.js"
+import {
+  AuthorizedMutationHttp,
+  HttpAuthorizer,
+  type AuthorizedMutationHttpShape,
+  type HttpAuthorizationError,
+  type HttpAuthorizerShape,
+  type HttpObservationRequest,
+  type HttpResponse
+} from "./publication/http.js"
+import {
+  CertifiedPublisherSpawn,
+  NpmUserConfigResource,
+  type CertifiedPublisherSpawnShape,
+  type NpmUserConfigResourceShape
+} from "./publication/publisher.js"
+import {
+  PublicationClaimOccupied,
+  PublicationClaimRequest,
+  PublicationClaimStore,
+  PublicationClaimUnavailable,
+  type PublicationClaimError,
+  type PublicationClaimStoreShape
+} from "./publication/claim.js"
+import {
+  ReleaseContextError,
+  SourceMaterializationError,
+  StagingEntry,
+  StagingSnapshot,
+  VerifiedSource,
+  makeSourceObserver,
+  type SourceObserverRuntime,
+  type SourceObserverShape,
+  type VerifiedReleaseContext
+} from "./release/context.js"
+import {
+  PreparedReleaseStore,
+  type PreparedReleaseStoreShape
+} from "./release/prepared-store.js"
+
+export {
+  CredentialAudienceMismatch,
+  CredentialPurposeMismatch,
+  CredentialStrategyUnsupported,
+  CredentialSubjectMismatch,
+  CredentialUnavailable,
+  PublicationClaimOccupied,
+  PublicationClaimRequest,
+  PublicationClaimUnavailable,
+  ReleaseContextError,
+  SafeRelativePath,
+  Sha256Digest,
+  SourceMaterializationError,
+  StagingEntry,
+  StagingSnapshot,
+  VerifiedSource,
+  WorkspaceRoot,
+  makeCredentialProvider,
+  makeSourceObserver,
+  sha256Digest
+}
+
+export type {
+  CredentialAuthorityError,
+  CredentialGrant,
+  CredentialGrantAcquirer,
+  CredentialGrantDescriptor,
+  CredentialProviderShape,
+  CredentialRequest,
+  HttpAuthorizationError,
+  HttpAuthorizerShape,
+  HttpObservationRequest,
+  HttpResponse,
+  AuthorizedMutationHttpShape,
+  CertifiedPublisherSpawnShape,
+  NpmUserConfigResourceShape,
+  PublicationClaimError,
+  PublicationClaimStoreShape,
+  MutationCredentialGrant,
+  ReleaseRuntimeShape,
+  RunCommand,
+  SourceObserverRuntime,
+  SourceObserverShape,
+  VerifiedReleaseContext
+}
+
+/** Structural inputs for a library-owned host integration. */
+export interface CustomReleaseLayerInput {
+  readonly runtime: ReleaseRuntimeShape
+  readonly preparedStore: PreparedReleaseStoreShape
+  readonly credentialProvider: CredentialProviderShape
+  readonly httpAuthorizer: HttpAuthorizerShape
+  readonly authorizedMutationHttp: AuthorizedMutationHttpShape
+  readonly npmUserConfigResource: NpmUserConfigResourceShape
+  readonly certifiedPublisherSpawn: CertifiedPublisherSpawnShape
+  /** Required before a durable-cas-required publication can acquire mutation credentials. */
+  readonly publicationClaimStore?: PublicationClaimStoreShape
+}
+
+/**
+ * Compose the complete API service boundary without exposing Context service
+ * tags. Credentials remain opaque grants and HTTP authorization remains a
+ * host-owned elimination boundary.
+ */
+export const makeCustomReleaseLayer = (
+  input: CustomReleaseLayerInput
+): ReleaseApiLayer => Layer.mergeAll(
+  Layer.succeed(ReleaseRuntime, input.runtime),
+  Layer.succeed(PreparedReleaseStore, input.preparedStore),
+  Layer.succeed(CredentialProvider, input.credentialProvider),
+  Layer.succeed(HttpAuthorizer, input.httpAuthorizer),
+  Layer.succeed(AuthorizedMutationHttp, input.authorizedMutationHttp),
+  Layer.succeed(NpmUserConfigResource, input.npmUserConfigResource),
+  Layer.succeed(CertifiedPublisherSpawn, input.certifiedPublisherSpawn),
+  ...(input.publicationClaimStore === undefined
+    ? []
+    : [Layer.succeed(PublicationClaimStore, input.publicationClaimStore)])
+)

package/src/index.ts

@@ -0,0 +1,64 @@
+declare global {
+  const SchemaErrorTypeId: unique symbol
+}
+// The root is the intentionally small public lifecycle surface.
+export {
+  CorrectionReport,
+  correct,
+  inspect,
+  makeReleaseApi,
+  observe,
+  prepare,
+  publish,
+  release
+} from "./api/api.js"
+export type {
+  CorrectInput,
+  InspectInput,
+  InspectOutput,
+  ObserveInput,
+  PrepareInput,
+  PublishInput,
+  ReleaseApi,
+  ReleaseApiLayer,
+  ReleaseApiOptions,
+  ReleaseInput,
+  ReleaseResult
+} from "./api/types.js"
+export {
+  AuthoredCatalogForwardCorrection,
+  AuthoredGithubReleaseAmendment,
+  AuthoredNpmDeprecation,
+  decodeAuthoredCorrection
+} from "./correction/intent.js"
+export type { AuthoredCorrection } from "./correction/intent.js"
+export {
+  PreparationModeUnsupported, ReleaseAbortedError, ReleaseIncompleteError,
+  ReleaseInputError, ReleasePreparationError
+} from "./api/errors.js"
+export {
+  CredentialStrategyUnsupported,
+  CredentialUnavailable
+} from "./publication/authority.js"
+export {
+  CredentialFailureCause,
+  CredentialStrategyUnsupportedCause,
+  CredentialUnavailableCause,
+  ObservationReport,
+  ReleaseReport
+} from "./publication/report.js"
+export {
+  CompletePreparedReleaseRef, GitHubActionsCompletePreparedReleaseRef,
+  LocalCompletePreparedReleaseRef, PreparedReleaseRefCodecError,
+  PreparedReleaseRefMalformedError, PreparedReleaseRefUnknownSchemeError,
+  decodeCompletePreparedReleaseRef, encodeCompletePreparedReleaseRef,
+  makeGitHubActionsCompletePreparedReleaseRef, makeLocalCompletePreparedReleaseRef
+} from "./release/prepared-ref.js"
+export type { PreparedReleaseSha256 } from "./release/prepared-ref.js"
+export { ReleaseRuntime } from "./api/runtime.js"
+export { unsupportedExecutionHost } from "./platform/host-support.js"
+export { resolveConfig } from "./resolve/resolve.js"
+export type { AuthoredConfig, AuthoredProject } from "./resolve/authored.js"
+export type { ObservedFacts } from "./resolve/facts.js"
+export { encodeResolvedConfig } from "./resolve/encode.js"
+export const defineRelease = <const Config>(config: Config): Config => config