add builder and updater

scripts/uploadRelease.mjs

@@ -0,0 +1,34 @@
+import { digest } from './releaseArtifacts.mjs'
+import { validateFeedUrl } from '../build/config.mjs'
+
+/** Publish immutable assets first and the feed pointer last, verifying public bytes. */
+export async function uploadRelease(release, { uploadUrl, token, fetchImpl = fetch, log = console.log }) {
+  uploadUrl = validateFeedUrl(uploadUrl)
+  if (!token || /[\r\n]/.test(token)) throw new Error('Set CAPSULE_UPLOAD_TOKEN in the release environment.')
+  for (const file of release.files) {
+    const metadata = file.name === 'latest.yml'
+    const response = await fetchImpl(new URL(file.name, uploadUrl), {
+      method: 'PUT',
+      redirect: 'error',
+      signal: AbortSignal.timeout(10 * 60 * 1000),
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': metadata ? 'application/yaml' : 'application/octet-stream',
+        'Cache-Control': metadata ? 'no-cache' : 'public, max-age=31536000, immutable',
+        ...(!metadata ? { 'If-None-Match': '*' } : {})
+      },
+      body: file.data
+    })
+    // Existing immutable files are safe to reuse only after verifying their public bytes.
+    if (!response.ok && !(response.status === 412 && !metadata)) {
+      throw new Error(`Upload failed for ${file.name}: HTTP ${response.status}. Publication stopped.`)
+    }
+    const publicResponse = await fetchImpl(new URL(file.name, release.feedUrl), {
+      redirect: 'error', signal: AbortSignal.timeout(10 * 60 * 1000), cache: 'no-store'
+    })
+    if (!publicResponse.ok || digest(Buffer.from(await publicResponse.arrayBuffer())) !== digest(file.data)) {
+      throw new Error(`Public verification failed for ${file.name}. Publication stopped.`)
+    }
+    log(`Published and verified ${file.name}`)
+  }
+}