@mannyc1/ts-release 0.0.7 → 0.3.0

package/src/platform/host-support.ts

@@ -0,0 +1,4 @@
+export const unsupportedExecutionHost = (platform: string): string | undefined =>
+  platform === "linux"
+    ? undefined
+    : "ts-release is currently certified to run on Linux. Its Bun builder can cross-compile the advertised macOS artifacts."

package/src/platform/node.ts

@@ -0,0 +1,38 @@
+import * as NodeChildProcessSpawner from "@effect/platform-node/NodeChildProcessSpawner"
+import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem"
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient"
+import * as NodePath from "@effect/platform-node/NodePath"
+import * as Layer from "effect/Layer"
+import { join } from "node:path"
+import type { ReleaseApiLayer } from "../api/types.js"
+import { SourceObserverLive } from "./source-observer.js"
+import { makeReleaseServicesLive } from "./services.js"
+import {
+  makeLocalPreparedReleaseStore,
+  type PreparedReleaseStoreShape
+} from "../release/prepared-store.js"
+import type { PublicationClaimStoreShape } from "../publication/claim.js"
+
+const nodeHost = Layer.mergeAll(
+  NodeChildProcessSpawner.layer.pipe(Layer.provide(Layer.mergeAll(
+    NodeFileSystem.layer,
+    NodePath.layer
+  ))),
+  NodeHttpClient.layerFetch,
+  SourceObserverLive
+)
+
+/** A custom Node host takes one already-selected durable store service. */
+export const makeNodeReleaseLayer = (
+  preparedStore: PreparedReleaseStoreShape,
+  publicationClaimStore?: PublicationClaimStoreShape
+): ReleaseApiLayer => makeReleaseServicesLive(preparedStore, publicationClaimStore).pipe(Layer.provide(nodeHost))
+
+const defaultNodeStore = makeLocalPreparedReleaseStore(join(
+  process.cwd(),
+  ".release",
+  "ts-release",
+  "prepared"
+))
+
+export const NodeReleaseLayer: ReleaseApiLayer = makeNodeReleaseLayer(defaultNodeStore)

package/src/platform/release-runtime.ts

@@ -0,0 +1,47 @@
+import * as Effect from "effect/Effect"
+import * as Layer from "effect/Layer"
+import * as HttpBody from "effect/unstable/http/HttpBody"
+import * as HttpClient from "effect/unstable/http/HttpClient"
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest"
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner"
+import { ReleaseRuntime } from "../api/runtime.js"
+import { makeRunCommand } from "../drivers/process.js"
+import { PublicationHttpError, type HttpRequest, type HttpResponse, type PublicationHttp } from "../publication/http.js"
+import { SourceObserver } from "../release/context.js"
+
+const makeWireRequest = (request: HttpRequest): HttpClientRequest.HttpClientRequest => {
+  const wire = HttpClientRequest.make(request.method)(request.url, request.body === undefined ? {} : {
+    body: HttpBody.uint8Array(typeof request.body === "string"
+      ? new TextEncoder().encode(request.body)
+      : request.body)
+  })
+  return request.headers === undefined ? wire : HttpClientRequest.setHeaders(wire, request.headers)
+}
+
+export const makePublicationHttp = (client: HttpClient.HttpClient): PublicationHttp => ({
+  request: (request: HttpRequest) => makeWireRequest(request).pipe(
+    (wire) => client.execute(wire),
+    Effect.flatMap((response) => response.arrayBuffer.pipe(Effect.map((body) => ({
+      status: response.status,
+      headers: Object.fromEntries(Object.entries(response.headers)),
+      body: new Uint8Array(body)
+    } satisfies HttpResponse)))),
+    Effect.mapError(() => PublicationHttpError.make({
+      commitment: "unknown",
+      reason: "The provider HTTP transport failed after dispatch."
+    }))
+  )
+})
+
+/** Runtime-only process and source services. Durable storage is a direct service. */
+export const ReleaseRuntimeLive: Layer.Layer<
+  ReleaseRuntime,
+  never,
+  SourceObserver | ChildProcessSpawner
+> = Layer.effect(ReleaseRuntime, Effect.gen(function*() {
+  const source = yield* SourceObserver
+  const run = yield* makeRunCommand
+  return { source, run }
+}))
+
+export const makeReleaseRuntimeLive = (): typeof ReleaseRuntimeLive => ReleaseRuntimeLive

package/src/platform/services.ts

@@ -0,0 +1,57 @@
+import * as Context from "effect/Context"
+import * as Effect from "effect/Effect"
+import * as Layer from "effect/Layer"
+import * as HttpClient from "effect/unstable/http/HttpClient"
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner"
+import type { ReleaseApiServices } from "../api/types.js"
+import { ReleaseRuntime } from "../api/runtime.js"
+import { makeRunCommand } from "../drivers/process.js"
+import {
+  AuthorizedMutationHttp,
+  CertifiedPublisherSpawn,
+  HttpAuthorizer,
+  NpmUserConfigResource,
+  makeEnvironmentCredentialPlatform
+} from "./credentials.js"
+import { CredentialProvider } from "../publication/authority.js"
+import { PublicationClaimStore, type PublicationClaimStoreShape } from "../publication/claim.js"
+import { SourceObserver } from "../release/context.js"
+import {
+  PreparedReleaseStore,
+  type PreparedReleaseStoreShape
+} from "../release/prepared-store.js"
+import { makePublicationHttp } from "./release-runtime.js"
+
+export type ReleaseServicesLayer = Layer.Layer<
+  ReleaseApiServices,
+  never,
+  SourceObserver | ChildProcessSpawner | HttpClient.HttpClient
+>
+
+/**
+ * Compose the API's complete service boundary once. The raw HTTP transport and
+ * child-process spawner remain host inputs; only authority-checking services
+ * and the direct prepared store enter the API environment.
+ */
+export const makeReleaseServicesLive = (
+  preparedStore: PreparedReleaseStoreShape,
+  publicationClaimStore?: PublicationClaimStoreShape
+): ReleaseServicesLayer => Layer.effectContext(Effect.gen(function*() {
+  const source = yield* SourceObserver
+  const run = yield* makeRunCommand
+  const client = yield* HttpClient.HttpClient
+  const spawner = yield* ChildProcessSpawner
+  const credentials = makeEnvironmentCredentialPlatform(makePublicationHttp(client), spawner)
+
+  const context = Context.make(ReleaseRuntime, { source, run }).pipe(
+    Context.add(PreparedReleaseStore, preparedStore),
+    Context.add(CredentialProvider, credentials.credentialProvider),
+    Context.add(HttpAuthorizer, credentials.httpAuthorizer),
+    Context.add(AuthorizedMutationHttp, credentials.authorizedMutationHttp),
+    Context.add(NpmUserConfigResource, credentials.npmUserConfigResource),
+    Context.add(CertifiedPublisherSpawn, credentials.certifiedPublisherSpawn)
+  )
+  return publicationClaimStore === undefined
+    ? context
+    : Context.add(context, PublicationClaimStore, publicationClaimStore)
+}))

package/src/platform/source-observer.ts

@@ -0,0 +1,193 @@
+import * as Effect from "effect/Effect"
+import * as Layer from "effect/Layer"
+import {
+  chmodSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  symlinkSync,
+  writeFileSync
+} from "node:fs"
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path"
+import { spawnSync } from "node:child_process"
+import { sha256Digest } from "../model/digest.js"
+import { SafeRelativePath } from "../model/primitives.js"
+import {
+  makeSourceObserver,
+  SourceMaterializationError,
+  SourceObserver,
+  type SourceObserverRuntime,
+  type StagingEntry,
+  type VerifiedSource
+} from "../release/context.js"
+import { canonicalStagingPath, snapshotStaging } from "../release/staging.js"
+
+const materializationFailure = (field: string, reason: string): SourceMaterializationError =>
+  new SourceMaterializationError({ field, reason })
+
+const gitBytes = (workspace: string, argv: ReadonlyArray<string>, input?: Uint8Array): Uint8Array => {
+  const result = spawnSync("git", [...argv], {
+    cwd: workspace,
+    encoding: null,
+    stdio: ["pipe", "pipe", "pipe"],
+    ...(input === undefined ? {} : { input }),
+    maxBuffer: 1024 * 1024 * 1024
+  })
+  if (result.error !== undefined) throw result.error
+  if (result.status !== 0) {
+    throw new Error(Buffer.from(result.stderr ?? []).toString("utf8").trim() || `git ${argv[0]} exited ${result.status}.`)
+  }
+  return new Uint8Array(result.stdout ?? [])
+}
+
+const gitText = (workspace: string, argv: ReadonlyArray<string>, input?: Uint8Array): string =>
+  new TextDecoder("utf-8", { fatal: true }).decode(gitBytes(workspace, argv, input))
+
+const contained = (root: string, candidate: string): boolean => {
+  const path = relative(root, candidate)
+  return path === "" || (path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path))
+}
+
+interface GitTreeEntry {
+  readonly mode: "100644" | "100755" | "120000"
+  readonly object: string
+  readonly path: SafeRelativePath
+  readonly bytes: Uint8Array
+}
+
+const parseTree = (workspace: string, source: VerifiedSource): ReadonlyArray<GitTreeEntry> => {
+  const raw = gitBytes(workspace, ["ls-tree", "-r", "-z", "--full-tree", source.commit.toString()])
+  const decoded = new TextDecoder("utf-8", { fatal: true })
+  const entries: GitTreeEntry[] = []
+  let cursor = 0
+  while (cursor < raw.length) {
+    const end = raw.indexOf(0, cursor)
+    if (end < 0) throw materializationFailure("source.tree", "Git tree output omitted its NUL terminator.")
+    const record = raw.slice(cursor, end)
+    cursor = end + 1
+    const tab = record.indexOf(9)
+    if (tab < 0) throw materializationFailure("source.tree", "Git tree output omitted its pathname separator.")
+    const header = decoded.decode(record.slice(0, tab))
+    const match = /^(100644|100755|120000) blob ([a-f0-9]+)$/u.exec(header)
+    if (match === null) {
+      const unsupported = /^(\d+) (\w+) /u.exec(header)
+      throw materializationFailure(
+        "source.tree",
+        unsupported?.[2] === "commit"
+          ? "Verified source contains a submodule; declare and verify it as a separate input before preparation."
+          : `Verified source contains unsupported Git entry ${header}.`
+      )
+    }
+    const pathText = decoded.decode(record.slice(tab + 1))
+    const path = canonicalStagingPath(pathText)
+    const bytes = gitBytes(workspace, ["cat-file", "blob", match[2]!])
+    const observedObject = gitText(workspace, ["hash-object", "--stdin"], bytes).trim()
+    if (observedObject !== match[2]) {
+      throw materializationFailure("source.tree", `Git object ${match[2]} failed content verification.`)
+    }
+    entries.push({ mode: match[1] as GitTreeEntry["mode"], object: match[2]!, path, bytes })
+  }
+  return entries.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0)
+}
+
+const assertTrackedSourceStable = (workspace: string, source: VerifiedSource): void => {
+  const head = gitText(workspace, ["rev-parse", "HEAD"]).trim()
+  const tree = gitText(workspace, ["rev-parse", `${source.commit}^{tree}`]).trim()
+  const status = gitText(workspace, ["status", "--porcelain=v1", "--untracked-files=no"]).trim()
+  if (head !== source.commit.toString()) {
+    throw materializationFailure("source.commit", `Verified commit ${source.commit} drifted to ${head} before materialization.`)
+  }
+  if (tree !== source.tree.toString()) {
+    throw materializationFailure("source.tree", `Verified tree ${source.tree} disagrees with commit tree ${tree}.`)
+  }
+  if (status.length > 0) {
+    throw materializationFailure("source.clean", "Tracked source changed after verification and before materialization.")
+  }
+}
+
+export const materializeGitSource = (
+  workspaceValue: string,
+  source: VerifiedSource,
+  destinationValue: string
+) => {
+  const workspace = realpathSync(workspaceValue)
+  const destination = realpathSync(destinationValue)
+  if (lstatSync(destination).isSymbolicLink() || !lstatSync(destination).isDirectory() || readdirSync(destination).length > 0) {
+    throw materializationFailure("source.destination", "Exact source materialization requires a fresh real directory.")
+  }
+  assertTrackedSourceStable(workspace, source)
+  const entries = parseTree(workspace, source)
+  const folded = new Map<string, string>()
+  for (const entry of entries) {
+    const portablePath = entry.path.toString()
+    const collision = folded.get(portablePath.toLocaleLowerCase("en-US"))
+    if (collision !== undefined && collision !== portablePath) {
+      throw materializationFailure("source.path", `Git paths ${collision} and ${portablePath} collide under case folding.`)
+    }
+    folded.set(portablePath.toLocaleLowerCase("en-US"), portablePath)
+    const target = join(destination, portablePath)
+    if (!contained(destination, target)) throw materializationFailure("source.path", `Git path ${portablePath} escapes staging.`)
+    mkdirSync(dirname(target), { recursive: true, mode: 0o700 })
+    if (entry.mode === "120000") {
+      const link = new TextDecoder("utf-8", { fatal: true }).decode(entry.bytes)
+      const landed = resolve(dirname(target), link)
+      if (link.length === 0 || isAbsolute(link) || !contained(destination, landed)) {
+        throw materializationFailure("source.symlink", `Git symlink ${portablePath} escapes private staging.`)
+      }
+      symlinkSync(link, target)
+    } else {
+      writeFileSync(target, entry.bytes, { mode: entry.mode === "100755" ? 0o755 : 0o644, flag: "wx" })
+      chmodSync(target, entry.mode === "100755" ? 0o755 : 0o644)
+    }
+  }
+  const snapshot = snapshotStaging(destination)
+  const files = snapshot.entries.filter((entry) => entry.kind !== "directory")
+  if (files.length !== entries.length) {
+    throw materializationFailure("source.tree", "Materialized tree has an unexpected file or symlink set.")
+  }
+  const actual = new Map<string, StagingEntry>(files.map((entry) => [entry.path.toString(), entry]))
+  for (const expected of entries) {
+    const entry = actual.get(expected.path.toString())
+    const kind = expected.mode === "120000" ? "symlink" : expected.mode === "100755" ? "executable" : "file"
+    if (entry === undefined || entry.kind !== kind || entry.size !== expected.bytes.length ||
+        entry.digest.hex !== sha256Digest(expected.bytes).hex) {
+      throw materializationFailure("source.tree", `Materialized path ${expected.path} failed byte or mode verification.`)
+    }
+  }
+  const packageBytes = new Uint8Array(readFileSync(join(destination, source.packageManifestPath.toString())))
+  if (sha256Digest(packageBytes).hex !== source.packageManifestDigest.hex) {
+    throw materializationFailure("source.packageManifestDigest", "Materialized package manifest disagrees with verified source facts.")
+  }
+  assertTrackedSourceStable(workspace, source)
+  return snapshot
+}
+
+const runtime: SourceObserverRuntime = {
+  canonicalRoot: (workspace) => Effect.try({
+    try: () => realpathSync(workspace), catch: (cause) => cause
+  }),
+  read: (workspace, path) => Effect.try({
+    try: () => new Uint8Array(readFileSync(join(workspace, path))), catch: (cause) => cause
+  }),
+  command: (workspace, argv) => Effect.try({
+    try: () => {
+      const result = spawnSync("git", [...argv], { cwd: workspace, encoding: "utf8", stdio: "pipe" })
+      if (result.error !== undefined) throw result.error
+      if (result.status !== 0) throw new Error(result.stderr.trim() || `Command exited ${result.status}.`)
+      return result.stdout
+    },
+    catch: (cause) => cause
+  }),
+  digest: (bytes) => Effect.sync(() => sha256Digest(bytes)),
+  materialize: (workspace, source, destination) => Effect.try({
+    try: () => materializeGitSource(workspace, source, destination),
+    catch: (cause) => cause
+  })
+}
+
+// Both supported runtimes use the same observation contract; only this host
+// layer closes its filesystem/process primitives. The observer itself remains
+// shared with tests and future library hosts.
+export const SourceObserverLive = Layer.succeed(SourceObserver, makeSourceObserver(runtime))

package/src/provider-sdk.ts

@@ -0,0 +1,48 @@
+/**
+ * Library/application-only provider composition. The stock CLI and Action do
+ * not discover packages, import configured code, or install adapters from
+ * serialized release configuration.
+ */
+export {
+  ProviderAdapterContract,
+  customProviderSubjects,
+  makeProviderAdapter
+} from "./extensions/provider-adapter.js"
+export type {
+  CustomProviderAdapter,
+  CustomProviderAdapterInput
+} from "./extensions/provider-adapter.js"
+export type { PublicationSubjectServices } from "./capabilities/module.js"
+export type {
+  ReleaseObservationContext,
+  ReleaseSubject
+} from "./publication/coordinator.js"
+export {
+  conservativeUnknownRecoveryProfile,
+  makeRecoveryCapabilityProfile
+} from "./publication/recovery.js"
+export type {
+  PublicationProfileRegistration,
+  RecoveryCapabilityProfile
+} from "./publication/recovery.js"
+export {
+  SubjectId,
+  CanonicalAudience,
+  CredentialRef,
+  CredentialRequest,
+  ProviderId
+} from "./model/authority.js"
+export {
+  AuthoritativelyAbsent,
+  InconclusiveObservation,
+  MutationPrecondition,
+  NeedsMutation,
+  OutcomeUnknown,
+  PresentDifferent,
+  PresentEquivalent,
+  ProviderAlreadyEquivalent,
+  ProviderBlocked,
+  RejectedByProvider,
+  SafeReason,
+  Started
+} from "./publication/report.js"

package/src/publication/adapter.ts

@@ -0,0 +1,132 @@
+import * as Effect from "effect/Effect"
+import * as Option from "effect/Option"
+import { SubjectId } from "../model/authority.js"
+import {
+  githubPublicationCapability,
+  catalogPublicationCapability,
+  npmPublicationCapability,
+  pyPiPublicationCapability
+} from "../capabilities/registry.js"
+import { encodePreparedRelease } from "../release/prepared.js"
+import type { PreparedBundle } from "../release/prepared-store.js"
+import { sha256 } from "../drivers/utils.js"
+import {
+  observeReleaseSubjects,
+  publishReleaseSubjects,
+  type ReleaseSubject
+} from "./coordinator.js"
+import { AuthorizedMutationHttp, HttpAuthorizer } from "./http.js"
+import {
+  CertifiedPublisherSpawn,
+  NpmUserConfigResource
+} from "./publisher.js"
+import {
+  validateRecoveryProfileSubjects,
+  type PublicationProfileRegistration
+} from "./recovery.js"
+import {
+  PublicationClaimStore,
+  unavailablePublicationClaimStore
+} from "./claim.js"
+import { customProviderSubjects, type CustomProviderAdapter } from "../extensions/provider-adapter.js"
+export { installedPublicationProfiles } from "./profiles.js"
+
+const registerSubjects = (
+  registration: PublicationProfileRegistration,
+  subjects: ReadonlyArray<ReleaseSubject>
+): ReadonlyArray<ReleaseSubject> => {
+  validateRecoveryProfileSubjects(
+    registration.id,
+    registration.recovery,
+    subjects.map((subject) => subject.recovery)
+  )
+  return subjects
+}
+
+const preparedSubject = (bundle: PreparedBundle): SubjectId => SubjectId.make(
+  `prepared:sha256-${sha256(encodePreparedRelease(bundle.manifest))}`
+)
+
+/**
+ * Construct provider subjects only after the caller has loaded and verified
+ * the complete prepared bundle. The host authorizer is captured as an opaque
+ * sink; transports and credential values never enter the subject contract.
+ */
+export const subjectsForPreparedRelease = Effect.fn("subjectsForPreparedRelease")(function*(
+  bundle: PreparedBundle,
+  adapters: ReadonlyArray<CustomProviderAdapter> = []
+) {
+  const http = yield* HttpAuthorizer
+  const mutationHttp = yield* AuthorizedMutationHttp
+  const userConfigs = yield* NpmUserConfigResource
+  const publisher = yield* CertifiedPublisherSpawn
+  const claimOption = yield* Effect.serviceOption(PublicationClaimStore)
+  const claims = Option.getOrElse(claimOption, () => unavailablePublicationClaimStore)
+  const subjects: Array<ReleaseSubject> = []
+  const priorPublicationSubjects: Array<SubjectId> = []
+  const services = { http, mutationHttp, userConfigs, publisher, claims }
+  for (const publication of bundle.manifest.publications) {
+    const moduleSubjects = publication._tag === "PreparedNpmPublication"
+      ? npmPublicationCapability.subjects(bundle, publication, services)
+      : publication._tag === "PreparedPyPiPublication"
+      ? pyPiPublicationCapability.subjects(bundle, publication, services)
+      : publication._tag === "PreparedGitHubPublication"
+      ? githubPublicationCapability.subjects(bundle, publication, services)
+      : catalogPublicationCapability.subjects(bundle, publication, services)
+    const registered = registerSubjects(
+      publication._tag === "PreparedNpmPublication"
+        ? npmPublicationCapability.profile
+        : publication._tag === "PreparedPyPiPublication"
+        ? pyPiPublicationCapability.profile
+        : publication._tag === "PreparedGitHubPublication"
+        ? githubPublicationCapability.profile
+        : catalogPublicationCapability.profile,
+      moduleSubjects
+    )
+    const ordered = registered.map((subject): ReleaseSubject => priorPublicationSubjects.length === 0
+      ? subject
+      : {
+          ...subject,
+          prerequisites: [...new Set([
+            ...(subject.prerequisites ?? []),
+            ...priorPublicationSubjects
+          ])]
+        })
+    subjects.push(...ordered)
+    priorPublicationSubjects.push(...registered.map((subject) => subject.id))
+  }
+  const custom = customProviderSubjects(
+    bundle,
+    adapters,
+    services,
+    new Set([preparedSubject(bundle).toString(), ...priorPublicationSubjects.map((id) => id.toString())])
+  ).map((subject): ReleaseSubject => priorPublicationSubjects.length === 0
+    ? subject
+    : {
+        ...subject,
+        prerequisites: [...new Set([
+          ...(subject.prerequisites ?? []),
+          ...priorPublicationSubjects
+        ])]
+      })
+  subjects.push(...custom)
+  return subjects as ReadonlyArray<ReleaseSubject>
+})
+
+/** Remote, read-only observation through the same provider subjects as publish. */
+export const observePreparedRelease = Effect.fn("observePreparedRelease")(function*(
+  bundle: PreparedBundle,
+  adapters: ReadonlyArray<CustomProviderAdapter> = []
+) {
+  const subjects = yield* subjectsForPreparedRelease(bundle, adapters)
+  return yield* observeReleaseSubjects({ prepared: preparedSubject(bundle), subjects })
+})
+
+/** Dependency-ordered conservative publication through the shared coordinator. */
+export const publishPreparedRelease = Effect.fn("publishPreparedRelease")(function*(
+  bundle: PreparedBundle,
+  adapters: ReadonlyArray<CustomProviderAdapter> = []
+) {
+  const subjects = yield* subjectsForPreparedRelease(bundle, adapters)
+  return yield* publishReleaseSubjects({ prepared: preparedSubject(bundle), subjects })
+})