@microck/canonfig 2.0.0

package/dist/cli/render.js

@@ -0,0 +1,56 @@
+import { Schema } from "effect";
+const secretField = /^(?:credential|credentialValue|password|secret|privateKey|signingKey|tlsKey|accessToken|refreshToken|apiKey|authorization|cookie)$/iu;
+const redact = (value) => {
+    if (Array.isArray(value))
+        return value.map(redact);
+    if (value === null
+        || Schema.is(Schema.String)(value)
+        || Schema.is(Schema.Number)(value)
+        || Schema.is(Schema.Boolean)(value))
+        return value;
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (entry === undefined)
+            continue;
+        result[key] = secretField.test(key) ? "[REDACTED]" : redact(entry);
+    }
+    return result;
+};
+const ordered = (value) => {
+    if (Array.isArray(value))
+        return value.map(ordered);
+    if (value === null
+        || Schema.is(Schema.String)(value)
+        || Schema.is(Schema.Number)(value)
+        || Schema.is(Schema.Boolean)(value))
+        return value;
+    const result = {};
+    for (const [key, entry] of Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))) {
+        if (entry === undefined)
+            continue;
+        result[key] = ordered(entry);
+    }
+    return result;
+};
+export const sanitizeCliData = (value) => ordered(redact(value));
+export const renderCliResult = (result, format) => {
+    const data = result.data === undefined
+        ? undefined
+        : sanitizeCliData(result.data);
+    if (format === "json") {
+        const envelope = {
+            schema: "canonfig.cli/v1",
+            command: result.command,
+            status: result.exitCode === 0 ? "success" : "error",
+            exitCode: result.exitCode,
+            message: result.message,
+        };
+        if (data !== undefined)
+            envelope.data = data;
+        return `${JSON.stringify(envelope)}\n`;
+    }
+    if (data === undefined)
+        return `${result.message}\n`;
+    return `${result.message}\n${JSON.stringify(data, null, 2)}\n`;
+};

package/dist/cli/source-commands.js

@@ -0,0 +1,5 @@
+import { Context, Data } from "effect";
+export class CliCommandFailure extends Data.TaggedError("CliCommandFailure") {
+}
+export class SourceCommands extends Context.Service()("canonfig/cli/SourceCommands") {
+}

package/dist/domain/brand.js

@@ -0,0 +1,29 @@
+import { Schema } from "effect";
+/**
+ * Branded identifier schemas. Every identifier that crosses a boundary or is
+ * persisted is branded so an `AgentName` cannot be used where a
+ * `FollowerId` is required.
+ */
+const IdentifierText = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u, {
+    expected: "a non-empty portable identifier",
+}));
+const ReferenceText = Schema.NonEmptyString;
+export const ProfileId = IdentifierText.pipe(Schema.brand("ProfileId"));
+export const ProfileRevisionId = IdentifierText.pipe(Schema.brand("ProfileRevisionId"));
+export const ResourceId = IdentifierText.pipe(Schema.brand("ResourceId"));
+export const FollowerId = IdentifierText.pipe(Schema.brand("FollowerId"));
+export const GroupName = IdentifierText.pipe(Schema.brand("GroupName"));
+export const RunId = IdentifierText.pipe(Schema.brand("RunId"));
+export const ActionId = IdentifierText.pipe(Schema.brand("ActionId"));
+export const AgentTaskId = IdentifierText.pipe(Schema.brand("AgentTaskId"));
+export const InvitationCode = ReferenceText.pipe(Schema.brand("InvitationCode"));
+export const CredentialReference = ReferenceText.pipe(Schema.brand("CredentialReference"));
+export const ContentDigest = Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/u, { expected: "a lowercase SHA-256 digest" })).pipe(Schema.brand("ContentDigest"));
+export const BlobId = ContentDigest.pipe(Schema.brand("BlobId"));
+export const CertificateFingerprint = ReferenceText.pipe(Schema.brand("CertificateFingerprint"));
+export const SourceSignature = ReferenceText.pipe(Schema.brand("SourceSignature"));
+export const ToolId = IdentifierText.pipe(Schema.brand("ToolId"));
+/** RFC 3339 timestamp kept as a string at persistence and wire boundaries. */
+export const Timestamp = Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/u, { expected: "an RFC 3339 timestamp" }));
+/** Decode helpers that keep branding at the boundary. */
+export const decode = Schema.decodeUnknownSync;

package/dist/domain/identity.js

@@ -0,0 +1,31 @@
+import { Schema } from "effect";
+import { CertificateFingerprint, FollowerId, GroupName, InvitationCode, Timestamp, } from "./brand.js";
+/** Source Machine identity: an ed25519 signing key with a public fingerprint. */
+export const SourceIdentity = Schema.Struct({
+    keyId: Schema.NonEmptyString,
+    publicKeyFingerprint: CertificateFingerprint,
+});
+/** One issued Follower Identity with its independently revocable credential reference. */
+export const FollowerReference = Schema.Struct({
+    id: FollowerId,
+    name: Schema.NonEmptyString,
+});
+export const FollowerIdentity = Schema.Struct({
+    id: FollowerId,
+    name: Schema.NonEmptyString,
+    groups: Schema.Array(GroupName),
+    revoked: Schema.Boolean,
+    credentialReference: Schema.NonEmptyString,
+    enrolledAt: Timestamp,
+});
+/** A short-lived, single-use enrollment invitation. */
+export const EnrollmentInvitation = Schema.Struct({
+    code: InvitationCode,
+    endpoint: Schema.NonEmptyString,
+    fingerprint: CertificateFingerprint,
+    groups: Schema.Array(GroupName),
+    expiresAt: Timestamp,
+    used: Schema.Boolean,
+});
+/** Agent execution policy on a follower. */
+export const AgentPolicy = Schema.Literals(["deterministic-only", "agent-propose", "agent-apply"]);

package/dist/domain/npm-package-spec.js

@@ -0,0 +1,186 @@
+const hostedOrigins = {
+    bitbucket: "https://bitbucket.org",
+    github: "https://github.com",
+    gitlab: "https://gitlab.com",
+};
+const hostedProtocol = /^(github|gitlab|bitbucket):/iu;
+const localProtocol = /^(?:file|link|workspace):/iu;
+const githubShorthand = /^[^/@\s:]+\/[^/@\s:]+(?:#.*)?$/u;
+const originForHttpUrl = (value) => {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return undefined;
+        if (url.username.length > 0 || url.password.length > 0)
+            return undefined;
+        return url.origin;
+    }
+    catch {
+        return undefined;
+    }
+};
+const hostedOriginForUrl = (value) => {
+    try {
+        const url = new URL(value);
+        if (!["git:", "http:", "https:", "ssh:"].includes(url.protocol))
+            return undefined;
+        const host = url.hostname.toLowerCase();
+        const hosted = Object.entries(hostedOrigins).find(([, origin]) => new URL(origin).hostname === host);
+        if (hosted === undefined)
+            return undefined;
+        if (url.username.length > 0 && url.username.toLowerCase() !== "git")
+            return undefined;
+        if (url.password.length > 0)
+            return undefined;
+        const defaultPort = (url.protocol === "http:" && url.port === "80")
+            || (url.protocol === "https:" && url.port === "443");
+        const port = url.port.length === 0 || defaultPort ? "" : `:${url.port}`;
+        return `${hosted[1]}${port}`;
+    }
+    catch {
+        return undefined;
+    }
+};
+const hostedNameForHost = (host) => {
+    const normalized = host.toLowerCase();
+    if (normalized === "github.com" || normalized === "www.github.com")
+        return "github";
+    if (normalized === "gitlab.com" || normalized === "www.gitlab.com")
+        return "gitlab";
+    if (normalized === "bitbucket.org" || normalized === "www.bitbucket.org")
+        return "bitbucket";
+    return undefined;
+};
+const remoteOrigin = (value) => {
+    if (/^git@/iu.test(value)) {
+        const match = /^git@([^/:?#\s]+):([^?#\s]+)$/iu.exec(value);
+        if (match === null)
+            return undefined;
+        const host = match[1].toLowerCase();
+        const hostedName = hostedNameForHost(host);
+        const hosted = hostedName === undefined ? undefined : hostedOrigins[hostedName];
+        return hosted === undefined
+            ? undefined
+            : hosted;
+    }
+    const withoutGitPrefix = value.replace(/^git\+/iu, "");
+    const hosted = hostedOriginForUrl(withoutGitPrefix);
+    if (hosted !== undefined)
+        return hosted;
+    return originForHttpUrl(withoutGitPrefix);
+};
+export const isNpmRegistryPackageName = (value) => /^[A-Za-z0-9][A-Za-z0-9._~-]*$/u.test(value)
+    || /^@[A-Za-z0-9._~-]+\/[A-Za-z0-9._~-]+$/u.test(value);
+const isRegistryVersion = (value) => value.length > 0
+    && !/[\s/:\\]/u.test(value)
+    && !value.startsWith("#");
+const packageNameAndTarget = (value) => {
+    const separator = value.startsWith("@")
+        ? value.indexOf("@", 1)
+        : value.indexOf("@");
+    if (separator <= 0)
+        return undefined;
+    const name = value.slice(0, separator);
+    const target = value.slice(separator + 1);
+    return target.length === 0 ? undefined : { name, target };
+};
+const classifyRemoteTarget = (value) => {
+    const hosted = hostedProtocol.exec(value);
+    if (hosted !== null) {
+        const protocol = hosted[1].toLowerCase();
+        const rest = value.slice(hosted[0].length);
+        if (!/^[^/#\s?@:]+\/[^#\s?@:]+(?:#.*)?$/u.test(rest)) {
+            return { kind: "ambiguous" };
+        }
+        const origin = protocol === "github"
+            ? hostedOrigins.github
+            : protocol === "gitlab"
+                ? hostedOrigins.gitlab
+                : hostedOrigins.bitbucket;
+        return { kind: "remote", origin };
+    }
+    if (/^(?:git\+|git:\/\/|git@|https?:\/\/|ssh:\/\/)/iu.test(value)) {
+        const origin = remoteOrigin(value);
+        return origin === undefined
+            ? { kind: "ambiguous" }
+            : { kind: "remote", origin };
+    }
+    if (githubShorthand.test(value)) {
+        return { kind: "remote", origin: hostedOrigins.github };
+    }
+    return undefined;
+};
+const classifyRegistryOrAlias = (value) => {
+    const remote = classifyRemoteTarget(value);
+    if (remote !== undefined)
+        return remote;
+    if (localProtocol.test(value))
+        return localSpecification(value);
+    if (value.startsWith("npm:")) {
+        const target = value.slice("npm:".length);
+        if (!isNpmRegistryPackageName(target) && !packageNameAndTarget(target)) {
+            return { kind: "ambiguous" };
+        }
+        return classifyRegistryOrAlias(target);
+    }
+    const alias = packageNameAndTarget(value);
+    if (alias !== undefined) {
+        if (!isNpmRegistryPackageName(alias.name))
+            return { kind: "ambiguous" };
+        if (alias.target.startsWith("npm:")) {
+            return classifyRegistryOrAlias(alias.target.slice("npm:".length));
+        }
+        const remote = classifyRemoteTarget(alias.target);
+        if (remote !== undefined)
+            return remote;
+        if (localProtocol.test(alias.target))
+            return localSpecification(alias.target);
+        return isRegistryVersion(alias.target)
+            ? { kind: "registry" }
+            : { kind: "ambiguous" };
+    }
+    if (isNpmRegistryPackageName(value))
+        return { kind: "registry" };
+    return { kind: "ambiguous" };
+};
+const localSpecification = (value) => {
+    const separator = value.indexOf(":");
+    if (separator < 0)
+        return { kind: "local" };
+    const protocol = value.slice(0, separator).toLowerCase();
+    const path = value.slice(separator + 1);
+    if (protocol === "workspace" && (path === "*" || path === "^" || path === "~")) {
+        return { kind: "local" };
+    }
+    if (path.length === 0 || /\s/u.test(path))
+        return { kind: "ambiguous" };
+    return { kind: "local", path };
+};
+/**
+ * Classify one value in an npm package position.
+ *
+ * `foo/bar` is npm's GitHub shorthand. Explicit relative, absolute, and
+ * workspace forms remain local, while unsupported protocol-like values are
+ * ambiguous and must not be treated as registry packages.
+ */
+export const parseNpmPackageSpecification = (value) => {
+    if (value.length === 0 || /\s/u.test(value))
+        return { kind: "ambiguous" };
+    if (localProtocol.test(value))
+        return localSpecification(value);
+    if (value.startsWith("/")
+        || value.startsWith("./")
+        || value.startsWith("../")
+        || value.startsWith("~/")
+        || /^[A-Za-z]:[\\/]/u.test(value)) {
+        return { kind: "local", path: value };
+    }
+    const remote = classifyRemoteTarget(value);
+    if (remote !== undefined)
+        return remote;
+    if ((value.includes("://") || /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(value))
+        && packageNameAndTarget(value) === undefined) {
+        return { kind: "ambiguous" };
+    }
+    return classifyRegistryOrAlias(value);
+};