@mannyc1/ts-release 0.0.7 → 0.3.0

package/src/model/catalog.ts

@@ -0,0 +1,220 @@
+import * as Schema from "effect/Schema"
+import * as Semver from "semver"
+import { encodeCanonicalJson, parseStrictJson } from "./canonical.js"
+import { Sha256Digest } from "./digest.js"
+import { NonEmptyName, OutputId, SafeRelativePath, Version } from "./primitives.js"
+
+const optional = Schema.optionalKey
+
+export const GitHubRepositoryCoordinate = Schema.NonEmptyString.check(Schema.makeFilter(
+  (value: string) => /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/u.test(value)
+    ? undefined
+    : "Catalog repository must be an owner/repository coordinate."
+)).pipe(Schema.brand("GitHubRepositoryCoordinate"))
+export type GitHubRepositoryCoordinate = typeof GitHubRepositoryCoordinate.Type
+
+export const GitBranchName = Schema.NonEmptyString.check(Schema.makeFilter((value: string) =>
+  !value.startsWith("-") && !value.startsWith("/") && !value.endsWith("/") && !value.endsWith(".") &&
+  !value.endsWith(".lock") && !value.includes("..") && !value.includes("//") && !value.includes("@{") &&
+  !/[~^:?*[\\\u0000-\u001f\u007f]/u.test(value)
+    ? undefined
+    : "Catalog branch must be one canonical Git branch name."))
+  .pipe(Schema.brand("GitBranchName"))
+export type GitBranchName = typeof GitBranchName.Type
+
+export const CatalogRepositoryPath = SafeRelativePath.check(Schema.makeFilter((value) =>
+  value.toString() !== "." ? undefined : "Catalog repository paths must identify files."))
+  .pipe(Schema.brand("CatalogRepositoryPath"))
+export type CatalogRepositoryPath = typeof CatalogRepositoryPath.Type
+
+export const CatalogArchitecture = Schema.Literals(["x64", "arm64"])
+export type CatalogArchitecture = typeof CatalogArchitecture.Type
+
+export class CatalogRenderSource extends Schema.Class<CatalogRenderSource>("CatalogRenderSource")({
+  artifactId: OutputId,
+  architecture: CatalogArchitecture,
+  url: Schema.NonEmptyString,
+  filename: NonEmptyName
+}) {}
+
+export class PreparedCatalogDownload extends Schema.Class<PreparedCatalogDownload>("PreparedCatalogDownload")({
+  architecture: CatalogArchitecture,
+  url: Schema.NonEmptyString,
+  filename: NonEmptyName,
+  sha256: Sha256Digest
+}) {}
+
+const rendererFields = {
+  name: NonEmptyName,
+  description: Schema.NonEmptyString,
+  homepage: Schema.NonEmptyString,
+  license: optional(Schema.NonEmptyString)
+}
+
+export class HomebrewRenderer extends Schema.TaggedClass<HomebrewRenderer>()("homebrew", {
+  ...rendererFields,
+  installPath: NonEmptyName
+}) {}
+
+export class ScoopRenderer extends Schema.TaggedClass<ScoopRenderer>()("scoop", {
+  ...rendererFields,
+  bin: NonEmptyName
+}) {}
+
+export const CatalogRenderer = Schema.Union([HomebrewRenderer, ScoopRenderer])
+export type CatalogRenderer = typeof CatalogRenderer.Type
+
+export class PreparedCatalogRenderer
+  extends Schema.Class<PreparedCatalogRenderer>("PreparedCatalogRenderer")({
+    renderer: CatalogRenderer,
+    downloads: Schema.NonEmptyArray(PreparedCatalogDownload)
+  }) {}
+
+export const CatalogManagedStatus = Schema.Literals(["active", "corrected", "superseded"])
+
+export class CatalogManagedState extends Schema.Class<CatalogManagedState>("CatalogManagedState")({
+  schemaVersion: Schema.Literal("ts-release/catalog-state/v2"),
+  catalogId: NonEmptyName,
+  renderer: Schema.Literals(["homebrew", "scoop"]),
+  generation: Version,
+  status: CatalogManagedStatus,
+  targetDigest: Sha256Digest,
+  sourceRepository: GitHubRepositoryCoordinate,
+  sourceTag: NonEmptyName,
+  correctionId: optional(Sha256Digest),
+  reason: optional(Schema.NonEmptyString),
+  replacementVersion: optional(Version)
+}) {}
+
+export const encodeCatalogManagedState = (value: CatalogManagedState): Uint8Array =>
+  new TextEncoder().encode(encodeCanonicalJson(Schema.encodeSync(CatalogManagedState)(value)))
+
+export const decodeCatalogManagedState = (bytes: Uint8Array): CatalogManagedState | undefined => {
+  try {
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes)
+    const value = Schema.decodeUnknownSync(CatalogManagedState, { onExcessProperty: "error" })(parseStrictJson(text))
+    if (Semver.valid(value.generation.toString()) !== value.generation.toString()) return undefined
+    const canonical = encodeCatalogManagedState(value)
+    return canonical.length === bytes.length && canonical.every((byte, index) => byte === bytes[index])
+      ? value
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+export const canonicalCatalogVersion = (value: string): Version => {
+  const parsed = Semver.valid(value)
+  if (parsed === null || parsed !== value) throw new Error(`Catalog generation requires a canonical semantic version, got ${JSON.stringify(value)}.`)
+  return Version.make(value)
+}
+
+export const compareCatalogVersions = (left: string, right: string): number => {
+  canonicalCatalogVersion(left)
+  canonicalCatalogVersion(right)
+  return Semver.compare(left, right)
+}
+
+const assertDownloads = (downloads: ReadonlyArray<PreparedCatalogDownload>): void => {
+  if (downloads.length === 0) throw new Error("Catalog renderer requires at least one download.")
+  const architectures = downloads.map((download) => download.architecture)
+  if (new Set(architectures).size !== architectures.length) {
+    throw new Error("Catalog renderer repeats an architecture.")
+  }
+  for (const download of downloads) {
+    const url = new URL(download.url)
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hash !== "") {
+      throw new Error("Catalog download URLs must be credential-free HTTPS URLs.")
+    }
+  }
+}
+
+const rubyString = (value: string): string => JSON.stringify(value)
+const formulaClass = (value: string): string => value.split(/[^A-Za-z0-9]+/u).filter(Boolean)
+  .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`).join("") || "GeneratedFormula"
+
+const homebrewDownload = (download: PreparedCatalogDownload, indent: string): ReadonlyArray<string> => [
+  `${indent}url ${rubyString(download.url)}`,
+  `${indent}sha256 ${rubyString(download.sha256.hex)}`
+]
+
+const renderHomebrew = (
+  version: Version,
+  renderer: HomebrewRenderer,
+  downloads: ReadonlyArray<PreparedCatalogDownload>
+): string => {
+  const lines = [
+    `class ${formulaClass(renderer.name)} < Formula`,
+    `  desc ${rubyString(renderer.description)}`,
+    `  homepage ${rubyString(renderer.homepage)}`,
+    ...(renderer.license === undefined ? [] : [`  license ${rubyString(renderer.license)}`]),
+    `  version ${rubyString(version.toString())}`
+  ]
+  if (downloads.length === 1) {
+    lines.push(...homebrewDownload(downloads[0]!, "  "))
+  } else {
+    lines.push("", "  on_macos do")
+    for (const architecture of ["arm64", "x64"] as const) {
+      const download = downloads.find((candidate) => candidate.architecture === architecture)
+      if (download === undefined) continue
+      lines.push(`    ${architecture === "arm64" ? "on_arm" : "on_intel"} do`)
+      lines.push(...homebrewDownload(download, "      "))
+      lines.push("    end")
+    }
+    lines.push("  end")
+  }
+  lines.push(
+    "",
+    "  def install",
+    `    bin.install ${rubyString(renderer.installPath)} => ${rubyString(renderer.name)}`,
+    "  end",
+    "",
+    "  test do",
+    `    assert_predicate bin/${rubyString(renderer.name)}, :executable?`,
+    "  end",
+    "end",
+    ""
+  )
+  return lines.join("\n")
+}
+
+const scoopDownload = (download: PreparedCatalogDownload): Readonly<Record<string, string>> => ({
+  url: download.url,
+  hash: download.sha256.hex
+})
+
+const renderScoop = (
+  version: Version,
+  renderer: ScoopRenderer,
+  downloads: ReadonlyArray<PreparedCatalogDownload>
+): string => {
+  const common: Record<string, unknown> = {
+    version: version.toString(),
+    description: renderer.description,
+    homepage: renderer.homepage,
+    ...(renderer.license === undefined ? {} : { license: renderer.license })
+  }
+  const value = downloads.length === 1
+    ? { ...common, ...scoopDownload(downloads[0]!), bin: renderer.bin.toString() }
+    : {
+      ...common,
+      architecture: Object.fromEntries(downloads
+        .slice()
+        .sort((left, right) => left.architecture < right.architecture ? -1 : 1)
+        .map((download) => [download.architecture === "x64" ? "64bit" : "arm64", scoopDownload(download)])),
+      bin: renderer.bin.toString()
+    }
+  return `${JSON.stringify(value, null, 2)}\n`
+}
+
+export const renderCatalog = (
+  version: Version,
+  renderer: CatalogRenderer,
+  downloads: ReadonlyArray<PreparedCatalogDownload>
+): Uint8Array => {
+  canonicalCatalogVersion(version.toString())
+  assertDownloads(downloads)
+  return new TextEncoder().encode(renderer._tag === "homebrew"
+    ? renderHomebrew(version, renderer, downloads)
+    : renderScoop(version, renderer, downloads))
+}

package/src/model/digest.ts

@@ -0,0 +1,172 @@
+import * as Schema from "effect/Schema"
+import { createHash } from "node:crypto"
+
+const lowercaseHex = (algorithm: "sha1" | "sha256" | "sha512", length: number) =>
+  Schema.String.check(Schema.makeFilter((value: string) =>
+    new RegExp(`^[a-f0-9]{${length}}$`, "u").test(value)
+      ? undefined
+      : `${algorithm} digest bytes must be exactly ${length} lowercase hexadecimal characters.`
+  )).pipe(Schema.brand(`${algorithm}Hex`))
+
+export const Sha1Hex = lowercaseHex("sha1", 40)
+export type Sha1Hex = typeof Sha1Hex.Type
+
+export const Sha256Hex = lowercaseHex("sha256", 64)
+export type Sha256Hex = typeof Sha256Hex.Type
+
+export const Sha512Hex = lowercaseHex("sha512", 128)
+export type Sha512Hex = typeof Sha512Hex.Type
+
+export class Sha1Digest
+  extends Schema.TaggedClass<Sha1Digest>()("Sha1Digest", {
+    algorithm: Schema.Literal("sha1"),
+    hex: Sha1Hex
+  }) {}
+
+export class Sha256Digest
+  extends Schema.TaggedClass<Sha256Digest>()("Sha256Digest", {
+    algorithm: Schema.Literal("sha256"),
+    hex: Sha256Hex
+  }) {}
+
+export class Sha512Digest
+  extends Schema.TaggedClass<Sha512Digest>()("Sha512Digest", {
+    algorithm: Schema.Literal("sha512"),
+    hex: Sha512Hex
+  }) {}
+
+export const AlgorithmDigest = Schema.Union([
+  Sha1Digest,
+  Sha256Digest,
+  Sha512Digest
+])
+export type AlgorithmDigest = typeof AlgorithmDigest.Type
+
+export const DigestEncoding = Schema.Literals([
+  "sha1-hex",
+  "sha256-hex",
+  "sha512-hex",
+  "github-sha256",
+  "npm-sha512-sri",
+  "npm-sha1-shasum"
+])
+export type DigestEncoding = typeof DigestEncoding.Type
+
+export class DigestCodecError
+  extends Schema.TaggedErrorClass<DigestCodecError>()("DigestCodecError", {
+    encoding: DigestEncoding,
+    reason: Schema.NonEmptyString
+  }) {}
+
+const decodeHex = (
+  value: unknown,
+  encoding: "sha1-hex" | "sha256-hex" | "sha512-hex",
+  length: 40 | 64 | 128
+): string => {
+  if (typeof value !== "string" ||
+      !new RegExp(`^[a-f0-9]{${length}}$`, "u").test(value)) {
+    throw new DigestCodecError({
+      encoding,
+      reason: `Value is not a canonical ${encoding} digest encoding.`
+    })
+  }
+  return value
+}
+
+export const parseSha1Hex = (value: unknown): Sha1Digest => Sha1Digest.make({
+  algorithm: "sha1",
+  hex: Sha1Hex.make(decodeHex(value, "sha1-hex", 40))
+})
+
+export const parseSha256Hex = (value: unknown): Sha256Digest => Sha256Digest.make({
+  algorithm: "sha256",
+  hex: Sha256Hex.make(decodeHex(value, "sha256-hex", 64))
+})
+
+export const parseSha512Hex = (value: unknown): Sha512Digest => Sha512Digest.make({
+  algorithm: "sha512",
+  hex: Sha512Hex.make(decodeHex(value, "sha512-hex", 128))
+})
+
+export const formatSha1Hex = (digest: Sha1Digest): Sha1Hex => digest.hex
+export const formatSha256Hex = (digest: Sha256Digest): Sha256Hex => digest.hex
+export const formatSha512Hex = (digest: Sha512Digest): Sha512Hex => digest.hex
+
+export const parseGitHubSha256 = (value: unknown): Sha256Digest => {
+  if (typeof value !== "string" || !value.startsWith("sha256:")) {
+    throw new DigestCodecError({
+      encoding: "github-sha256",
+      reason: "GitHub SHA-256 must use the canonical sha256:<lowercase-hex> encoding."
+    })
+  }
+  try {
+    return parseSha256Hex(value.slice("sha256:".length))
+  } catch {
+    throw new DigestCodecError({
+      encoding: "github-sha256",
+      reason: "GitHub SHA-256 must use the canonical sha256:<lowercase-hex> encoding."
+    })
+  }
+}
+
+export const formatGitHubSha256 = (digest: Sha256Digest): string =>
+  `sha256:${formatSha256Hex(digest)}`
+
+export const parseNpmSha512Sri = (value: unknown): Sha512Digest => {
+  if (typeof value !== "string" || !value.startsWith("sha512-")) {
+    throw new DigestCodecError({
+      encoding: "npm-sha512-sri",
+      reason: "npm SHA-512 integrity must use the canonical sha512-<base64> SRI encoding."
+    })
+  }
+  const encoded = value.slice("sha512-".length)
+  if (!/^[A-Za-z0-9+/]{86}==$/u.test(encoded)) {
+    throw new DigestCodecError({
+      encoding: "npm-sha512-sri",
+      reason: "npm SHA-512 integrity contains malformed or noncanonical base64."
+    })
+  }
+  const bytes = Buffer.from(encoded, "base64")
+  if (bytes.length !== 64 || bytes.toString("base64") !== encoded) {
+    throw new DigestCodecError({
+      encoding: "npm-sha512-sri",
+      reason: "npm SHA-512 integrity contains malformed or noncanonical base64."
+    })
+  }
+  return parseSha512Hex(bytes.toString("hex"))
+}
+
+export const formatNpmSha512Sri = (digest: Sha512Digest): string =>
+  `sha512-${Buffer.from(formatSha512Hex(digest), "hex").toString("base64")}`
+
+export const parseNpmSha1Shasum = (value: unknown): Sha1Digest => {
+  try {
+    const parsed = parseSha1Hex(value)
+    return Sha1Digest.make({ algorithm: "sha1", hex: parsed.hex })
+  } catch {
+    throw new DigestCodecError({
+      encoding: "npm-sha1-shasum",
+      reason: "npm shasum must be exactly 40 lowercase hexadecimal SHA-1 characters."
+    })
+  }
+}
+
+export const formatNpmSha1Shasum = (digest: Sha1Digest): string =>
+  formatSha1Hex(digest)
+
+const hashHex = (algorithm: "sha1" | "sha256" | "sha512", bytes: Uint8Array): string =>
+  createHash(algorithm).update(bytes).digest("hex")
+
+export const sha1Digest = (bytes: Uint8Array): Sha1Digest =>
+  parseSha1Hex(hashHex("sha1", bytes))
+
+export const sha256Digest = (bytes: Uint8Array): Sha256Digest =>
+  parseSha256Hex(hashHex("sha256", bytes))
+
+export const sha512Digest = (bytes: Uint8Array): Sha512Digest =>
+  parseSha512Hex(hashHex("sha512", bytes))
+
+export const digestEquals = (
+  left: AlgorithmDigest,
+  right: AlgorithmDigest
+): boolean => left.algorithm === right.algorithm && left.hex === right.hex

package/src/model/errors.ts

@@ -0,0 +1,6 @@
+import * as Schema from "effect/Schema"
+
+const reason = { reason: Schema.String }
+export const MISSING_COMMIT = "source.commit is required and could not be observed from the repository."
+export class ConfigValueError extends Schema.TaggedErrorClass<ConfigValueError>()("ConfigValueError", reason) {}
+export class ConfigDecodeError extends Schema.TaggedErrorClass<ConfigDecodeError>()("ConfigDecodeError", reason) {}

package/src/model/primitives.ts

@@ -0,0 +1,37 @@
+import * as Schema from "effect/Schema"
+
+const identifier = <const Name extends string>(name: Name) =>
+  Schema.NonEmptyString.pipe(Schema.brand(name))
+
+export const OperationId = identifier("OperationId"); export type OperationId = typeof OperationId.Type
+export const OutputId = identifier("OutputId"); export type OutputId = typeof OutputId.Type
+export const Digest = identifier("Digest"); export type Digest = typeof Digest.Type
+export const NonEmptyName = identifier("NonEmptyName"); export type NonEmptyName = typeof NonEmptyName.Type
+export const Version = identifier("Version"); export type Version = typeof Version.Type
+
+export const isSafeRelativePath = (value: string): boolean =>
+  value.trim().length > 0 &&
+  !value.startsWith("/") &&
+  !value.startsWith("\\") &&
+  !/^[A-Za-z]:[\\/]/u.test(value) &&
+  !value.split(/[\\/]+/u).includes("..")
+
+export const SafeRelativePath = Schema.String.check(
+  Schema.makeFilter((value: string) =>
+    isSafeRelativePath(value)
+      ? undefined
+      : "Path must be nonempty, relative, and contain no parent traversal.")
+).pipe(Schema.brand("SafeRelativePath"))
+export type SafeRelativePath = typeof SafeRelativePath.Type
+
+export const SafeArchivePattern = Schema.String.check(
+  Schema.makeFilter((value: string) =>
+    isSafeRelativePath(value) ? undefined : "Archive pattern must be relative and contain no parent traversal.")
+).pipe(Schema.brand("SafeArchivePattern"))
+export type SafeArchivePattern = typeof SafeArchivePattern.Type
+
+export const WorkspaceRoot = Schema.String.check(
+  Schema.makeFilter((value: string) =>
+    value.startsWith("/") ? undefined : "WorkspaceRoot must be absolute.")
+).pipe(Schema.brand("WorkspaceRoot"))
+export type WorkspaceRoot = typeof WorkspaceRoot.Type

package/src/model/pypi.ts

@@ -0,0 +1,30 @@
+import * as Schema from "effect/Schema"
+
+export const PyPiRepository = Schema.Literals(["pypi", "testpypi"])
+export type PyPiRepository = typeof PyPiRepository.Type
+
+export const normalizePyPiProjectName = (value: string): string => {
+  if (!/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/u.test(value)) {
+    throw new Error("PyPI project names may contain only ASCII letters, digits, period, underscore, and hyphen.")
+  }
+  return value.toLowerCase().replace(/[-_.]+/gu, "-")
+}
+
+export const PyPiProjectName = Schema.NonEmptyString.check(Schema.makeFilter((value: string) => {
+  try {
+    return normalizePyPiProjectName(value) === value ? undefined : "PyPI project name must be normalized."
+  } catch (cause) {
+    return cause instanceof Error ? cause.message : String(cause)
+  }
+})).pipe(Schema.brand("PyPiProjectName"))
+export type PyPiProjectName = typeof PyPiProjectName.Type
+
+export interface PyPiRepositoryEndpoints {
+  readonly simpleBaseUrl: string
+  readonly uploadUrl: string
+}
+
+export const pypiRepositoryEndpoints = (repository: PyPiRepository): PyPiRepositoryEndpoints =>
+  repository === "pypi"
+    ? { simpleBaseUrl: "https://pypi.org/simple/", uploadUrl: "https://upload.pypi.org/legacy/" }
+    : { simpleBaseUrl: "https://test.pypi.org/simple/", uploadUrl: "https://test.pypi.org/legacy/" }