@microck/canonfig 2.0.0

package/dist/profile/profile-catalog.errors.js

@@ -0,0 +1,50 @@
+import { Schema } from "effect";
+export class DiscoveryFilesystemError extends Schema.TaggedError()("DiscoveryFilesystemError", {
+    path: Schema.String,
+    operation: Schema.Literals(["read", "stat"]),
+    reason: Schema.String,
+}) {
+}
+export class DiscoveryParseError extends Schema.TaggedError()("DiscoveryParseError", {
+    path: Schema.String,
+    format: Schema.Literals(["json", "toml"]),
+    reason: Schema.String,
+}) {
+}
+export class InvalidDiscoveryInputError extends Schema.TaggedError()("InvalidDiscoveryInputError", {
+    reason: Schema.String,
+}) {
+}
+export class PublicationNotConfiguredError extends Schema.TaggedError()("PublicationNotConfiguredError", {
+    operation: Schema.Literals(["publish", "getRevision"]),
+}) {
+}
+export class PublicationReviewRequiredError extends Schema.TaggedError()("PublicationReviewRequiredError", {
+    decision: Schema.String,
+}) {
+}
+export class UnresolvedPublicationProposalError extends Schema.TaggedError()("UnresolvedPublicationProposalError", {
+    reasons: Schema.Array(Schema.String),
+}) {
+}
+export class InvalidPublicationResourcesError extends Error {
+    errors;
+    constructor(errors) {
+        super(errors.map((error) => error._tag).join(", "));
+        this.name = "InvalidPublicationResourcesError";
+        this.errors = errors;
+    }
+}
+export class InvalidPublicationInputError extends Schema.TaggedError()("InvalidPublicationInputError", {
+    reason: Schema.String,
+}) {
+}
+export class PublicationSigningError extends Schema.TaggedError()("PublicationSigningError", {
+    operation: Schema.Literals(["sign", "verify"]),
+    reason: Schema.String,
+}) {
+}
+export class InvalidPublicationSignatureError extends Schema.TaggedError()("InvalidPublicationSignatureError", {
+    keyId: Schema.String,
+}) {
+}

package/dist/profile/profile-catalog.layer.js

@@ -0,0 +1,20 @@
+import { Effect, Layer } from "effect";
+import { StateRepository } from "../state/state-repository.service.js";
+import { scanDiscovery } from "./discovery.js";
+import { PublicationNotConfiguredError } from "./profile-catalog.errors.js";
+import { ProfileCatalog } from "./profile-catalog.service.js";
+import { makePublication, } from "./publication.js";
+export const ProfileCatalogLive = Layer.succeed(ProfileCatalog, ProfileCatalog.of({
+    scan: scanDiscovery,
+    publish: () => Effect.fail(new PublicationNotConfiguredError({ operation: "publish" })),
+    getRevision: () => Effect.fail(new PublicationNotConfiguredError({ operation: "getRevision" })),
+}));
+export const profileCatalogLayer = (signer) => Layer.effect(ProfileCatalog, Effect.gen(function* () {
+    const repository = yield* StateRepository;
+    const publication = makePublication(signer, repository);
+    return ProfileCatalog.of({
+        scan: scanDiscovery,
+        publish: publication.publish,
+        getRevision: repository.getRevision,
+    });
+}));

package/dist/profile/profile-catalog.service.js

@@ -0,0 +1,7 @@
+import { Context } from "effect";
+/**
+ * C7 profile boundary. Scanning itself never mutates or publishes a profile;
+ * publication requires an explicit accepted review.
+ */
+export class ProfileCatalog extends Context.Service()("canonfig/profile/ProfileCatalog") {
+}

package/dist/profile/profile-codec.js

@@ -0,0 +1,153 @@
+import { Predicate, Schema as S } from "effect";
+/** Canonical JSON encoding: sorted keys, no insignificant whitespace. */
+export const canonicalJson = (value) => encodeCanonical(value);
+const encodeCanonical = (value) => {
+    if (value === null)
+        return "null";
+    if (Predicate.isString(value))
+        return JSON.stringify(value);
+    if (Predicate.isNumber(value)) {
+        if (!Number.isFinite(value))
+            throw new TypeError("canonical JSON cannot encode a non-finite number");
+        return JSON.stringify(value);
+    }
+    if (Predicate.isBoolean(value))
+        return value ? "true" : "false";
+    if (Array.isArray(value))
+        return `[${value.map(encodeCanonical).join(",")}]`;
+    const keys = Object.keys(value).sort();
+    const parts = keys.map((key) => `${JSON.stringify(key)}:${encodeCanonical(value[key])}`);
+    return `{${parts.join(",")}}`;
+};
+/** Content digest over canonical bytes, hex encoded. */
+export const digestOf = (value) => sha256Hex(canonicalJson(value));
+export const sha256Hex = (text) => {
+    const bytes = new TextEncoder().encode(text);
+    return sha256BytesHex(bytes);
+};
+export const sha256BytesHex = (bytes) => {
+    // Lazy import boundary: node:crypto is the runtime; this codec runs on Node only.
+    const { createHash } = nodeCrypto();
+    // SAFETY: SHA-256 with hex encoding always returns a content digest string.
+    return createHash("sha256").update(bytes).digest("hex");
+};
+let cachedCrypto = null;
+const nodeCrypto = () => {
+    if (cachedCrypto === null)
+        cachedCrypto = requireNodeCrypto();
+    return cachedCrypto;
+};
+const requireNodeCrypto = () => {
+    // SAFETY: process is available in the Node runtime this package targets; the
+    // dynamic import is resolved at first use and cached.
+    const load = globalThis.process?.getBuiltinModule;
+    if (load !== undefined)
+        return load("node:crypto");
+    throw new Error("node:crypto is unavailable in this runtime");
+};
+/**
+ * Strip JSONC comments and trailing commas from authoring text.
+ * Handles line comments, block comments (not inside strings), and trailing commas.
+ * JSONC is parsed only at the authoring boundary; canonical forms never contain it.
+ */
+export const stripJsonc = (text) => {
+    let out = "";
+    let i = 0;
+    let inString = false;
+    let stringEscape = false;
+    while (i < text.length) {
+        const ch = text[i];
+        const next = i + 1 < text.length ? text[i + 1] : "";
+        if (inString) {
+            out += ch;
+            if (stringEscape) {
+                stringEscape = false;
+            }
+            else if (ch === "\\") {
+                stringEscape = true;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            i += 1;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            out += ch;
+            i += 1;
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            out += " ";
+            while (i < text.length && text[i] !== "\n")
+                i += 1;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            out += " ";
+            i += 2;
+            let terminated = false;
+            while (i + 1 < text.length) {
+                if (text[i] === "*" && text[i + 1] === "/") {
+                    terminated = true;
+                    break;
+                }
+                i += 1;
+            }
+            if (!terminated)
+                throw new SyntaxError("unterminated JSONC block comment");
+            i += 2;
+            continue;
+        }
+        out += ch;
+        i += 1;
+    }
+    return removeTrailingCommas(out);
+};
+const removeTrailingCommas = (text) => {
+    let out = "";
+    let inString = false;
+    let stringEscape = false;
+    for (let index = 0; index < text.length; index += 1) {
+        const ch = text[index];
+        if (inString) {
+            out += ch;
+            if (stringEscape) {
+                stringEscape = false;
+            }
+            else if (ch === "\\") {
+                stringEscape = true;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            out += ch;
+            continue;
+        }
+        if (ch === ",") {
+            let lookahead = index + 1;
+            while (lookahead < text.length && /\s/u.test(text[lookahead] ?? ""))
+                lookahead += 1;
+            const next = text[lookahead];
+            if (next === "}" || next === "]")
+                continue;
+        }
+        out += ch;
+    }
+    return out;
+};
+/** Parse JSONC authoring text into validated JSON data. Throws on invalid JSON. */
+export const parseJsonc = (text) => {
+    const stripped = stripJsonc(text);
+    return S.decodeUnknownSync(S.MutableJson)(JSON.parse(stripped));
+};
+/** Parse and decode with a schema at the authoring boundary. */
+export const decodeJsonc = (schema) => (text) => S.decodeUnknownSync(schema, {
+    errors: "all",
+    onExcessProperty: "error",
+})(parseJsonc(text));

package/dist/profile/publication.js

@@ -0,0 +1,298 @@
+import { Effect, Schema } from "effect";
+import { BlobId, ProfileRevisionId, ResourceId, Timestamp, ToolId, } from "../domain/brand.js";
+import { normalizeMachineProfile, validateMachineProfile, } from "../domain/profile.js";
+import { encodeMachineProfile, digestMachineProfile } from "../domain/profile.js";
+import { RevisionImmutableError } from "../state/state-repository.errors.js";
+import { InvalidPublicationInputError, InvalidPublicationResourcesError, InvalidPublicationSignatureError, PublicationReviewRequiredError, UnresolvedPublicationProposalError, } from "./profile-catalog.errors.js";
+import { canonicalJson, digestOf, sha256Hex } from "./profile-codec.js";
+const compareText = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const asJson = (value) => Schema.decodeUnknownSync(Schema.MutableJson)(JSON.parse(JSON.stringify(value)));
+/** Stable digest reviewers accept; it binds acceptance to the exact proposal. */
+export const digestDiscoveryProposal = (proposal) => digestOf(asJson(proposal));
+export const acceptPublicationProposal = (proposal, reviewer, reviewedAt) => ({
+    decision: "accepted",
+    reviewer,
+    reviewedAt,
+    proposalDigest: digestDiscoveryProposal(proposal),
+});
+const packageForRecipe = (recipe) => {
+    switch (recipe.method) {
+        case "npm":
+        case "uv":
+            return recipe.package;
+        case "homebrew":
+            return recipe.formula;
+        case "winget":
+            return recipe.id;
+        case "cargo":
+            return recipe.crate;
+        case "source":
+            return recipe.repository;
+    }
+};
+const platformsForRecipe = (recipe) => {
+    switch (recipe.method) {
+        case "homebrew":
+            return ["macos"];
+        case "winget":
+            return ["windows"];
+        case "npm":
+        case "uv":
+        case "cargo":
+        case "source":
+            return ["linux", "macos", "windows"];
+    }
+};
+const resourceForTool = (tool) => ({
+    id: Schema.decodeUnknownSync(ResourceId)(tool.id),
+    kind: "tool",
+    policy: "ensure",
+    target: tool.executable,
+    dependsOn: [],
+    spec: {
+        kind: "tool",
+        toolId: Schema.decodeUnknownSync(ToolId)(tool.id),
+        recipes: tool.recipes
+            .flatMap((recipe) => platformsForRecipe(recipe).map((platform) => ({
+            platform,
+            method: recipe.method,
+            package: packageForRecipe(recipe),
+            version: recipe.version,
+            indexPolicy: recipe.indexPolicy,
+            source: recipe.integrity === undefined
+                ? recipe.source
+                : {
+                    source: recipe.source,
+                    integrity: recipe.integrity,
+                },
+            buildPolicy: recipe.buildPolicy,
+        })))
+            .sort((left, right) => compareText(`${left.platform}\0${left.method}\0${left.package}\0${left.version}\0${JSON.stringify(left.source)}`, `${right.platform}\0${right.method}\0${right.package}\0${right.version}\0${JSON.stringify(right.source)}`)),
+        login: { required: false },
+    },
+    verify: {
+        method: "command",
+        command: [...tool.verify.command],
+    },
+});
+const skillFilesDigest = (files) => sha256Hex([...files]
+    .sort((left, right) => compareText(left.path, right.path))
+    .map((file) => `${file.path}\0${sha256Hex(file.content)}\0${file.executable === true ? "x" : "-"}`)
+    .join("\n"));
+const resourceForSkill = (skill) => {
+    const files = skill.files ?? [];
+    return {
+        id: Schema.decodeUnknownSync(ResourceId)(skill.id),
+        kind: "skill",
+        policy: "replace-if-unmodified",
+        target: skill.target ?? `skills/${skill.id}`,
+        dependsOn: [],
+        spec: {
+            kind: "skill",
+            name: skill.id,
+            files: files.map((file) => ({
+                path: file.path,
+                content: file.content,
+                executable: file.executable ?? false,
+            })),
+        },
+        verify: {
+            method: "digest",
+            digest: skillFilesDigest(files),
+        },
+    };
+};
+const skillEvidenceId = (invocation) => {
+    const match = /^skills\/([A-Za-z0-9._-]+)\/SKILL\.md$/iu.exec(invocation ?? "");
+    return match?.[1]?.toLowerCase();
+};
+const unresolvedReasons = (proposal) => {
+    const reasons = [];
+    for (const task of proposal.agentTasks) {
+        reasons.push(`agent-task:${task.id}`);
+    }
+    for (const resource of proposal.resources) {
+        // Skills are reviewable discovery proposals and can be omitted without
+        // preventing unrelated reviewed tools from publishing.
+        if (resource.kind === "skill")
+            continue;
+        if (resource.reviewStatus !== "accepted") {
+            reasons.push(`resource-needs-review:${resource.kind}:${resource.id}`);
+        }
+        for (const evidence of resource.evidence) {
+            if (evidence.reviewStatus !== "accepted"
+                || evidence.confidence === "review"
+                || evidence.kind === "prose") {
+                reasons.push(`evidence-needs-review:${evidence.sourcePath}:${evidence.kind}`);
+            }
+        }
+    }
+    for (const evidence of proposal.evidence) {
+        if (skillEvidenceId(evidence.invocation[0]) !== undefined)
+            continue;
+        if (evidence.reviewStatus !== "accepted"
+            || evidence.confidence === "review"
+            || evidence.kind === "prose") {
+            reasons.push(`evidence-needs-review:${evidence.sourcePath}:${evidence.kind}`);
+        }
+    }
+    return [...new Set(reasons)].sort(compareText);
+};
+const validateReview = (input) => {
+    const review = input.review;
+    if (review.decision !== "accepted") {
+        return Effect.fail(new PublicationReviewRequiredError({ decision: review.decision }));
+    }
+    if (review.reviewer.trim().length === 0) {
+        return Effect.fail(new InvalidPublicationInputError({ reason: "reviewer is required" }));
+    }
+    try {
+        Schema.decodeUnknownSync(Timestamp)(review.reviewedAt);
+        Schema.decodeUnknownSync(Timestamp)(input.publishedAt);
+    }
+    catch (cause) {
+        return Effect.fail(new InvalidPublicationInputError({
+            reason: `invalid publication timestamp: ${String(cause)}`,
+        }));
+    }
+    if (review.proposalDigest !== digestDiscoveryProposal(input.proposal)) {
+        return Effect.fail(new InvalidPublicationInputError({
+            reason: "accepted proposal digest does not match publication proposal",
+        }));
+    }
+    return Effect.void;
+};
+const validateProposal = (proposal) => {
+    const reasons = unresolvedReasons(proposal);
+    return reasons.length === 0
+        ? Effect.void
+        : Effect.fail(new UnresolvedPublicationProposalError({ reasons }));
+};
+const machineProfileFor = (input) => {
+    const discoveryStatus = new Map(input.proposal.resources.map((resource) => [resource.id, resource.reviewStatus]));
+    const discoveryAccepted = (id, status) => status === "accepted" && (discoveryStatus.get(id) ?? "accepted") === "accepted";
+    const acceptedDiscoveryResources = [
+        ...input.proposal.tools
+            .filter((tool) => discoveryAccepted(tool.id, tool.reviewStatus))
+            .map(resourceForTool),
+        ...input.proposal.skills
+            .filter((skill) => discoveryAccepted(skill.id, skill.reviewStatus))
+            .map(resourceForSkill),
+    ];
+    // An explicitly authored resource is authoritative when it shares an id
+    // with a discovered proposal. The map also makes the merge deterministic
+    // before normalizeMachineProfile applies its canonical id ordering.
+    const resources = new Map(acceptedDiscoveryResources.map((resource) => [resource.id, resource]));
+    for (const resource of input.profile.resources ?? []) {
+        resources.set(resource.id, resource);
+    }
+    return normalizeMachineProfile({
+        id: input.profile.id,
+        version: 2,
+        name: input.profile.name,
+        groups: input.profile.groups ?? [],
+        resources: [...resources.values()],
+        scheduleDefault: input.profile.scheduleDefault ?? {
+            type: "daily",
+            at: "00:00",
+            timezone: "local",
+        },
+    });
+};
+const publishedResources = (profile) => profile.resources.map((resource) => {
+    const blob = Schema.decodeUnknownSync(BlobId)(digestOf(asJson(resource.spec)));
+    const base = {
+        id: Schema.decodeUnknownSync(ResourceId)(resource.id),
+        kind: resource.kind,
+        policy: resource.policy ?? "ensure",
+        target: resource.target,
+        dependsOn: (resource.dependsOn ?? []).map((dependency) => Schema.decodeUnknownSync(ResourceId)(dependency)),
+        blobs: [blob],
+    };
+    return resource.groups === undefined
+        ? base
+        : { ...base, groups: resource.groups };
+});
+export const revisionSigningPayload = (revision) => {
+    // The profile's canonical bytes already authenticate scheduleDefault. Keep
+    // it out of this legacy payload shape so revisions written before schedule
+    // metadata transport remain signature-compatible.
+    const { scheduleDefault: _, ...signed } = revision;
+    return canonicalJson(asJson(signed));
+};
+export const makePublication = (signer, repository) => {
+    const publish = (input) => Effect.gen(function* () {
+        yield* validateReview(input);
+        yield* validateProposal(input.proposal);
+        const profile = yield* Effect.try({
+            try: () => machineProfileFor(input),
+            catch: (cause) => new InvalidPublicationInputError({
+                reason: `invalid publication metadata: ${String(cause)}`,
+            }),
+        });
+        const errors = validateMachineProfile(profile);
+        if (errors.length > 0) {
+            return yield* Effect.fail(new InvalidPublicationResourcesError(errors));
+        }
+        const encoded = yield* Effect.try({
+            try: () => ({
+                canonicalBytes: encodeMachineProfile(profile),
+                digest: digestMachineProfile(profile),
+            }),
+            catch: (cause) => new InvalidPublicationInputError({
+                reason: `profile cannot be canonically encoded: ${String(cause)}`,
+            }),
+        });
+        const { canonicalBytes, digest } = encoded;
+        const id = Schema.decodeUnknownSync(ProfileRevisionId)(`${profile.id}:${digest}`);
+        const existing = yield* repository.findRevision(id);
+        if (existing !== undefined) {
+            if (existing.profileId !== profile.id
+                || existing.digest !== digest
+                || existing.canonicalBytes !== canonicalBytes) {
+                return yield* new RevisionImmutableError({
+                    revision: id,
+                    message: "content-addressed revision identity names different content",
+                });
+            }
+            return existing;
+        }
+        const latest = yield* repository.getLatestRevision(profile.id);
+        const sequence = (latest?.sequence ?? 0) + 1;
+        const unsigned = {
+            id,
+            profileId: profile.id,
+            sequence,
+            canonicalBytes,
+            digest,
+            publishedAt: input.publishedAt,
+            resources: publishedResources(profile),
+            groups: profile.groups,
+            scheduleDefault: profile.scheduleDefault,
+            signingKeyId: signer.keyId,
+        };
+        const payload = revisionSigningPayload(unsigned);
+        const signature = yield* signer.sign(payload);
+        const verified = yield* signer.verify(payload, signature);
+        if (!verified) {
+            return yield* new InvalidPublicationSignatureError({
+                keyId: signer.keyId,
+            });
+        }
+        const revision = {
+            id: unsigned.id,
+            profileId: unsigned.profileId,
+            sequence: unsigned.sequence,
+            canonicalBytes: unsigned.canonicalBytes,
+            digest: unsigned.digest,
+            signature,
+            publishedAt: unsigned.publishedAt,
+            resources: unsigned.resources,
+            groups: unsigned.groups,
+            scheduleDefault: unsigned.scheduleDefault,
+        };
+        yield* repository.publishRevision({ revision });
+        return revision;
+    });
+    return { publish };
+};