@voltro/plugin-releases 0.85.0 → 0.86.0

package/THIRD-PARTY-NOTICES.md

@@ -1,11 +1,11 @@
 # Third-Party Notices — @voltro/plugin-releases
 
-This package depends on the open-source software listed below. Each is the
+This package uses the open-source software listed below. Each is the
 property of its respective copyright holders and is used under the terms of
 its license. This file is provided for attribution; it grants no rights in
 @voltro/plugin-releases itself, which is proprietary (see LICENSE).
 
-Generated from the resolved runtime dependency closure (48 packages).
+Generated from the resolved runtime dependency closure (47 packages).
 
 ---
 
@@ -3776,34 +3776,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## layerr@3.0.0
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2020 Perry Mitchell
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## lib0@0.2.117
 
 License: MIT
@@ -4153,14 +4125,14 @@ Apache License
    limitations under the License.
 ```
 
-## ulidx@2.4.1
+## ulid@3.0.2
 
 License: MIT
 
 ```
-MIT License
+The MIT License (MIT)
 
-Copyright (c) 2021 Perry Mitchell
+Copyright (c) 2017 Alizain Feerasta
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/artifactMetadata.js

@@ -0,0 +1,27 @@
+//#region src/artifactMetadata.ts
+var e = (e) => typeof e == "string" && e.trim().length > 0 && !/[\u0000-\u001f\u007f]/.test(e), t = (t) => e(t) && t.length <= 200, n = (e) => typeof e == "string" && /^[a-f0-9]{64}$/i.test(e), r = (e) => Number.isSafeInteger(e) && e > 0, i = (e) => typeof e == "string" && e.trim().length > 0 && !e.includes("\0"), a = (a) => {
+	for (let t of [
+		"releaseId",
+		"kind",
+		"url"
+	]) if (!e(a[t])) return `Artifact ${t} must be nonblank text without control characters`;
+	if (a.operationId !== void 0 && !t(a.operationId)) return "Artifact operationId must be nonblank text without control characters and at most 200 characters";
+	if (!n(a.sha256)) return "Artifact sha256 must contain exactly 64 hexadecimal characters";
+	if (!r(a.size)) return "Artifact size must be a positive safe integer";
+	for (let t of [
+		"target",
+		"assetKey",
+		"contentType"
+	]) {
+		let n = a[t];
+		if (n !== void 0 && !e(n)) return `Artifact ${t} must be nonblank text without control characters`;
+	}
+	if (a.signature !== void 0 && !i(a.signature)) return "Artifact signature must not be blank or contain NUL";
+}, o = (e) => {
+	if (typeof e != "string" || !/^[1-9][0-9]*$/.test(e)) throw Error("Stored artifact size must be a positive integer");
+	let t = Number(e);
+	if (!r(t)) throw Error("Stored artifact size exceeds the numeric feed range");
+	return t;
+};
+//#endregion
+export { n as artifactHash, a as artifactMetadataIssue, t as artifactOperationId, r as artifactSize, o as artifactStoredSize, e as artifactText, i as hasArtifactSignature };

package/dist/feeds.js

@@ -0,0 +1,112 @@
+import { hasArtifactSignature as e } from "./artifactMetadata.js";
+import { compareVersions as t, inRollout as n } from "./rollout.js";
+//#region src/feeds.ts
+var r = (e, r) => r.currentVersion !== null && t(e.version, r.currentVersion) <= 0 ? !1 : n({
+	installId: r.installId,
+	salt: e.rolloutSalt,
+	percent: e.rolloutPercent,
+	...r.cohorts === void 0 ? {} : { installCohorts: r.cohorts },
+	releaseCohorts: e.cohorts
+}), i = (t, n) => {
+	if (!r(t, n)) return null;
+	let i = t.artifacts.find((t) => t.target === n.target && e(t.signature)) ?? (n.target === "darwin-aarch64" || n.target === "darwin-x86_64" ? t.artifacts.find((t) => t.target === "darwin-universal" && e(t.signature)) : void 0);
+	return !i || !e(i.signature) ? null : {
+		version: t.version,
+		notes: t.notes ?? "",
+		pub_date: t.createdAt.toISOString(),
+		platforms: { [n.target]: {
+			signature: i.signature,
+			url: i.url
+		} }
+	};
+}, a = (e, t, n = {}) => {
+	let r = {
+		win: [
+			"nsis",
+			"msi",
+			"exe"
+		],
+		mac: ["dmg", "zip"],
+		linux: [
+			"appimage",
+			"deb",
+			"rpm"
+		]
+	}, i = e.artifacts.filter((e) => r[t].includes(e.kind));
+	if (i.length === 0) return null;
+	let a = [`version: ${e.version}`, "files:"];
+	for (let e of i) {
+		a.push(`  - url: ${e.url}`);
+		let t = n[e.sha256];
+		a.push(t === void 0 ? `    sha256: ${e.sha256}` : `    sha512: ${t}`), a.push(`    size: ${e.size}`);
+	}
+	let o = i[0];
+	a.push(`path: ${o.url}`);
+	let s = n[o.sha256];
+	return a.push(s === void 0 ? `sha256: ${o.sha256}` : `sha512: ${s}`), a.push(`releaseDate: '${e.createdAt.toISOString()}'`), e.notes && a.push(`releaseNotes: ${JSON.stringify(e.notes)}`), a.join("\n") + "\n";
+}, o = (e, t, n) => {
+	if (n.rolledBackTo !== null) return {
+		kind: "rollback",
+		commitTime: n.rolledBackTo.commitTime.toISOString()
+	};
+	if (e === null || n.runtimeVersion !== null && n.runtimeVersion !== t.runtimeVersion) return { kind: "no-update" };
+	let i = e.buildId ?? e.id;
+	if (t.currentUpdateId === i || !r(e, {
+		installId: t.installId,
+		currentVersion: null,
+		...t.cohorts === void 0 ? {} : { cohorts: t.cohorts }
+	})) return { kind: "no-update" };
+	let a = e.artifacts.find((e) => e.kind === "expo-bundle" && e.target === t.platform);
+	if (!a) return { kind: "no-update" };
+	let o = e.artifacts.filter((e) => e.kind === "expo-asset" && (e.target === null || e.target === t.platform)).map((e) => ({
+		hash: e.sha256,
+		key: e.assetKey ?? e.sha256,
+		contentType: e.contentType ?? "application/octet-stream",
+		url: e.url
+	}));
+	return {
+		kind: "manifest",
+		manifest: {
+			id: i,
+			createdAt: e.createdAt.toISOString(),
+			runtimeVersion: t.runtimeVersion,
+			launchAsset: {
+				hash: a.sha256,
+				key: a.assetKey ?? "bundle",
+				contentType: a.contentType ?? "application/javascript",
+				url: a.url
+			},
+			assets: o,
+			metadata: {},
+			extra: {
+				version: e.version,
+				...e.notes ? { notes: e.notes } : {}
+			}
+		}
+	};
+}, s = {
+	macos: ["dmg", "zip"],
+	windows: [
+		"nsis",
+		"msi",
+		"exe"
+	],
+	linux: [
+		"appimage",
+		"deb",
+		"rpm"
+	],
+	ios: ["ipa"],
+	android: ["apk", "aab"]
+}, c = (e, t, n) => {
+	let r = s[t] ?? [], i = e.artifacts.filter((e) => r.includes(e.kind));
+	return i.length === 0 ? null : n === void 0 ? (t === "macos" ? i.find((e) => e.target === "darwin-universal") : void 0) ?? i[0] : i.find((e) => e.target === `${t === "macos" ? "darwin" : t}-${n}`) || (t === "macos" && (n === "aarch64" || n === "x86_64") ? i.find((e) => e.target === "darwin-universal") ?? null : null);
+}, l = (e) => /Windows/i.test(e) ? {
+	os: "windows",
+	arch: /ARM64|aarch64/i.test(e) ? "aarch64" : "x86_64"
+} : /Macintosh|Mac OS X/i.test(e) ? { os: "macos" } : /Android/i.test(e) ? { os: "android" } : /iPhone|iPad|iPod/i.test(e) ? { os: "ios" } : /Linux/i.test(e) ? {
+	os: "linux",
+	arch: /aarch64|arm64/i.test(e) ? "aarch64" : "x86_64"
+} : null;
+//#endregion
+export { r as offeredTo, l as osFromUserAgent, c as pickDownload, a as renderElectronLatestYml, o as renderExpoFeed, i as renderTauriFeed };

package/dist/index.d.ts

@@ -1,6 +1,9 @@
 import { ColumnBuilder } from '@voltro/database';
+import { DataStore } from '@voltro/database';
+import { Effect } from 'effect';
 import { FieldDefinitions } from '@voltro/database';
 import { InferRow } from '@voltro/database';
+import { PluginRouteContext } from '@voltro/protocol';
 import { Schema } from 'effect';
 import { Table } from '@voltro/database';
 import { VoltroPlugin } from '@voltro/protocol';
@@ -184,7 +187,7 @@ export declare const releaseArtifactsTable: Table<"_voltro_release_artifacts", F
     /** Where the bytes are — a storage ref URL, a CDN URL. The feed hands this out. */
     readonly url: ColumnBuilder<string, "text", boolean>;
     readonly sha256: ColumnBuilder<string, "text", boolean>;
-    readonly size: ColumnBuilder<number, "integer", boolean>;
+    readonly size: ColumnBuilder<string, "bigint", boolean>;
     /** minisign / Expo code-signing signature over the bytes. */
     readonly signature: ColumnBuilder<string | null, "text", boolean>;
     readonly notarized: ColumnBuilder<boolean, "boolean", true>;
@@ -228,6 +231,12 @@ export declare const releaseEventsTable: Table<"_voltro_release_events", FieldDe
     readonly at: ColumnBuilder<Date, "timestamp", true>;
 }>, true, "byReleaseEventApp">;
 
+export declare type ReleaseManagementAction = 'apps' | 'create' | 'prepare-upload' | 'upload' | 'promote' | 'rollout' | 'rollback' | 'policy';
+
+export declare interface ReleaseManagementContext extends PluginRouteContext {
+    readonly mutationStore: DataStore;
+}
+
 export declare class ReleaseNotFound extends ReleaseNotFound_base {
 }
 
@@ -269,7 +278,14 @@ export declare const RELEASES_TABLE = "_voltro_releases";
 
 export declare type ReleaseShell = (typeof RELEASE_SHELLS)[number];
 
-export declare const releasesPlugin: (options: ReleasesPluginOptions) => VoltroPlugin;
+export declare interface ReleasesPlugin extends VoltroPlugin {
+    /** Trusted server capability. Authorize the caller and execute inside its
+     * transaction; failed Effects must escape that transaction to roll it back.
+     * Uses the same input schemas and atomic writers as RPC and Inspect. */
+    readonly manage: (action: ReleaseManagementAction, input: unknown, context: ReleaseManagementContext) => Effect.Effect<unknown, unknown>;
+}
+
+export declare const releasesPlugin: (options: ReleasesPluginOptions) => ReleasesPlugin;
 
 export declare interface ReleasesPluginOptions {
     /** The app targets this api releases for; created on activation if absent. */
@@ -372,7 +388,7 @@ export declare const releaseTables: readonly [ Table<"_voltro_release_apps", Fie
     /** Where the bytes are — a storage ref URL, a CDN URL. The feed hands this out. */
     readonly url: ColumnBuilder<string, "text", boolean>;
     readonly sha256: ColumnBuilder<string, "text", boolean>;
-    readonly size: ColumnBuilder<number, "integer", boolean>;
+    readonly size: ColumnBuilder<string, "bigint", boolean>;
     /** minisign / Expo code-signing signature over the bytes. */
     readonly signature: ColumnBuilder<string | null, "text", boolean>;
     readonly notarized: ColumnBuilder<boolean, "boolean", true>;