@0xrama/bnpm 0.0.1

package/dist/src/package/pack.js

@@ -0,0 +1,238 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, readFile, realpath } from "node:fs/promises";
+import { basename, join, posix, relative, resolve, sep } from "node:path";
+import { createGzip } from "node:zlib";
+import packlist from "npm-packlist";
+import semver from "semver";
+import tar from "tar-stream";
+const maxFiles = 100_000;
+const maxUnpackedBytes = 1024 * 1024 * 1024;
+const maxFileBytes = 128 * 1024 * 1024;
+const portableTime = new Date("1985-10-26T08:15:00.000Z");
+const packageName = /^(?:@[^/@\s]+\/)?[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export class PackError extends Error {
+    constructor(message) {
+        super(`Pack error: ${message}`);
+        this.name = "PackError";
+    }
+}
+function record(value, source) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new PackError(`${source} must contain a JSON object`);
+    return value;
+}
+function safePath(root, entry) {
+    if (!entry || entry.includes("\0") || entry.includes("\\") || entry.startsWith("/") || /^[A-Za-z]:/.test(entry)) {
+        throw new PackError(`unsafe package path ${JSON.stringify(entry)}`);
+    }
+    const normalized = posix.normalize(entry);
+    if (normalized === ".." || normalized.startsWith("../"))
+        throw new PackError(`package path escapes the root: ${entry}`);
+    const target = resolve(root, ...normalized.split("/"));
+    if (target !== root && !target.startsWith(`${root}${sep}`))
+        throw new PackError(`package path escapes the root: ${entry}`);
+    return target;
+}
+async function readRegularFile(root, entry, allowedRoots) {
+    const path = safePath(root, entry);
+    const info = await lstat(path);
+    if (!info.isFile())
+        throw new PackError(`unsupported non-file entry ${entry}`);
+    if (info.size > maxFileBytes)
+        throw new PackError(`${entry} exceeds the ${maxFileBytes}-byte per-file limit`);
+    const canonical = await realpath(path);
+    if (canonical !== root && !canonical.startsWith(`${root}${sep}`) && ![...allowedRoots].some((allowed) => canonical === allowed || canonical.startsWith(`${allowed}${sep}`))) {
+        throw new PackError(`${entry} resolves outside the package root and bundled dependencies`);
+    }
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const current = await handle.stat();
+        if (!current.isFile())
+            throw new PackError(`unsupported non-file entry ${entry}`);
+        const bytes = await handle.readFile();
+        if (bytes.length !== current.size || bytes.length > maxFileBytes)
+            throw new PackError(`${entry} changed while it was being packed`);
+        return { bytes, mode: (current.mode & 0o111) === 0 ? 0o644 : 0o755 };
+    }
+    finally {
+        await handle.close();
+    }
+}
+function dependencyNames(manifest, field) {
+    const value = manifest[field];
+    if (value === undefined)
+        return [];
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new PackError(`package.json ${field} must be an object`);
+    return Object.keys(value).sort((left, right) => left.localeCompare(right));
+}
+async function installedTree(path, manifest, isProjectRoot, cache) {
+    const canonical = await realpath(path);
+    const existing = cache.get(canonical);
+    if (existing)
+        return existing;
+    const edgesOut = new Map();
+    const tree = { path, package: manifest, isProjectRoot, edgesOut };
+    cache.set(canonical, tree);
+    const prod = new Set([...dependencyNames(manifest, "dependencies"), ...dependencyNames(manifest, "optionalDependencies")]);
+    const dev = new Set(dependencyNames(manifest, "devDependencies"));
+    const peer = new Set(dependencyNames(manifest, "peerDependencies"));
+    const relevant = isProjectRoot
+        ? Array.isArray(manifest.bundleDependencies) ? manifest.bundleDependencies.filter((name) => typeof name === "string") : []
+        : [...prod];
+    const kinds = [...new Set(relevant)].map((name) => ({ name, peer: !prod.has(name) && peer.has(name), dev: !prod.has(name) && dev.has(name) }));
+    for (const kind of kinds.sort((left, right) => left.name.localeCompare(right.name))) {
+        if (edgesOut.has(kind.name))
+            continue;
+        const logical = join(path, "node_modules", ...kind.name.split("/"));
+        try {
+            const info = await lstat(logical);
+            const targetPath = await realpath(logical);
+            const raw = record(JSON.parse(await readFile(join(targetPath, "package.json"), "utf8")), join(targetPath, "package.json"));
+            const target = await installedTree(targetPath, raw, false, cache);
+            edgesOut.set(kind.name, { peer: kind.peer, dev: kind.dev, to: { path: logical, target, isLink: info.isSymbolicLink() || targetPath !== logical } });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            edgesOut.set(kind.name, { peer: kind.peer, dev: kind.dev });
+        }
+    }
+    return tree;
+}
+function bundledEdges(tree) {
+    const names = tree.isProjectRoot
+        ? Array.isArray(tree.package.bundleDependencies) ? tree.package.bundleDependencies.filter((name) => typeof name === "string") : []
+        : [...dependencyNames(tree.package, "dependencies"), ...dependencyNames(tree.package, "optionalDependencies")];
+    return [...new Set(names)].sort((left, right) => left.localeCompare(right)).flatMap((name) => {
+        const edge = tree.edgesOut.get(name);
+        return edge && !edge.peer && !edge.dev ? [[name, edge]] : [];
+    });
+}
+async function treeRoots(tree, seen = new Set(), roots = new Set()) {
+    if (seen.has(tree))
+        return roots;
+    seen.add(tree);
+    roots.add(await realpath(tree.path));
+    for (const [, edge] of bundledEdges(tree))
+        if (edge.to)
+            await treeRoots(edge.to.target, seen, roots);
+    return roots;
+}
+async function bundleMappings(tree, root, logical = root, seen = new Set(), mappings = []) {
+    const key = `${await realpath(tree.path)}\0${logical}`;
+    if (seen.has(key))
+        return mappings;
+    seen.add(key);
+    for (const [name, edge] of bundledEdges(tree)) {
+        if (!edge.to)
+            continue;
+        const real = await realpath(edge.to.target.path);
+        const childLogical = join(logical, "node_modules", ...name.split("/"));
+        mappings.push({ real, logical: childLogical });
+        await bundleMappings(edge.to.target, root, childLogical, seen, mappings);
+    }
+    return mappings.sort((left, right) => right.real.length - left.real.length);
+}
+async function logicalSelection(root, entry, mappings) {
+    const absolute = resolve(root, ...entry.split("/"));
+    if (absolute === root || absolute.startsWith(`${root}${sep}`))
+        return entry;
+    const canonical = await realpath(absolute);
+    const mapping = mappings.find(({ real }) => canonical === real || canonical.startsWith(`${real}${sep}`));
+    if (!mapping)
+        throw new PackError(`packlist selected a path outside the package and bundled dependencies: ${entry}`);
+    return relative(root, join(mapping.logical, relative(mapping.real, canonical))).split(sep).join("/");
+}
+function normalizeBundles(manifest) {
+    const value = manifest.bundleDependencies ?? manifest.bundledDependencies;
+    if (value === undefined || value === false)
+        return { ...manifest, bundleDependencies: [] };
+    if (value === true)
+        return { ...manifest, bundleDependencies: dependencyNames(manifest, "dependencies") };
+    if (!Array.isArray(value) || value.some((name) => typeof name !== "string" || !packageName.test(name)))
+        throw new PackError("bundleDependencies must be a boolean or an array of package names");
+    return { ...manifest, bundleDependencies: [...new Set(value)].sort((left, right) => left.localeCompare(right)) };
+}
+async function archive(entries) {
+    const pack = tar.pack();
+    const gzip = createGzip({ level: 9 });
+    const chunks = [];
+    const completion = new Promise((resolvePromise, reject) => {
+        gzip.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+        gzip.once("end", () => resolvePromise(Buffer.concat(chunks)));
+        gzip.once("error", reject);
+        pack.once("error", reject);
+    });
+    pack.pipe(gzip);
+    for (const entry of entries) {
+        await new Promise((resolvePromise, reject) => {
+            pack.entry({
+                name: `package/${entry.path}`,
+                type: "file",
+                size: entry.bytes.length,
+                mode: entry.mode,
+                uid: 0,
+                gid: 0,
+                uname: "",
+                gname: "",
+                mtime: portableTime,
+            }, entry.bytes, (error) => error ? reject(error) : resolvePromise());
+        });
+    }
+    pack.finalize();
+    return completion;
+}
+export async function packPackage(directory) {
+    const root = await realpath(directory);
+    let manifest;
+    try {
+        manifest = record(JSON.parse(await readFile(join(root, "package.json"), "utf8")), join(root, "package.json"));
+    }
+    catch (error) {
+        if (error instanceof PackError)
+            throw error;
+        throw new PackError(`${join(root, "package.json")} is missing or invalid JSON`);
+    }
+    const name = manifest.name;
+    const version = manifest.version;
+    if (typeof name !== "string" || !packageName.test(name))
+        throw new PackError("package.json requires a valid name");
+    if (typeof version !== "string" || semver.valid(version) !== version)
+        throw new PackError("package.json requires an exact semantic version");
+    const tree = await installedTree(root, normalizeBundles(manifest), true, new Map());
+    const selected = await packlist(tree);
+    const allowedRoots = await treeRoots(tree);
+    const mappings = await bundleMappings(tree, root);
+    const logicalFiles = await Promise.all(selected.map((entry) => logicalSelection(root, entry, mappings)));
+    if (logicalFiles.length > maxFiles)
+        throw new PackError(`package exceeds the ${maxFiles}-file limit`);
+    const entries = [];
+    let unpackedSize = 0;
+    for (const entry of [...new Set(logicalFiles)].sort((left, right) => left.localeCompare(right, "en"))) {
+        const file = await readRegularFile(root, entry, allowedRoots);
+        unpackedSize += file.bytes.length;
+        if (unpackedSize > maxUnpackedBytes)
+            throw new PackError(`package exceeds the ${maxUnpackedBytes}-byte unpacked-size limit`);
+        entries.push({ path: entry, ...file });
+    }
+    if (!entries.some((entry) => entry.path === "package.json"))
+        throw new PackError("packlist omitted package.json");
+    const tarball = await archive(entries);
+    const filename = `${name.replace(/^@/, "").replaceAll("/", "-")}-${version}.tgz`;
+    return {
+        id: `${name}@${version}`,
+        name,
+        version,
+        filename,
+        size: tarball.length,
+        unpackedSize,
+        shasum: createHash("sha1").update(tarball).digest("hex"),
+        integrity: `sha512-${createHash("sha512").update(tarball).digest("base64")}`,
+        files: entries.map((entry) => ({ path: entry.path, size: entry.bytes.length, mode: entry.mode })),
+        manifest,
+        tarball,
+    };
+}
+//# sourceMappingURL=pack.js.map

package/dist/src/package/pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../../src/package/pack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,QAAQ,MAAM,cAAc,CAAC;AACpC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,GAAG,MAAM,YAAY,CAAC;AAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC;AACzB,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,8CAA8C,CAAC;AAEnE,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAsBD,SAAS,MAAM,CAAC,KAAc,EAAE,MAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,MAAM,6BAA6B,CAAC,CAAC;IACrI,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,SAAS,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IAC3H,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,YAAiC;IAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,IAAI,GAAG,YAAY;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,gBAAgB,YAAY,sBAAsB,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,KAAK,OAAO,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5K,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,6DAA6D,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;QACpI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAqBD,SAAS,eAAe,CAAC,QAAiC,EAAE,KAAa;IACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,KAAK,oBAAoB,CAAC,CAAC;IACxI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAiC,EAAE,aAAsB,EAAE,KAA4B;IAChI,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IAC5E,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,aAAa;QAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;QAC1I,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/I,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;YAC3H,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAClE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,UAAU,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;QACtJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAc;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa;QAC9B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;QAClJ,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,IAAI,GAAG,IAAI,GAAG,EAAY,EAAE,KAAK,GAAG,IAAI,GAAG,EAAU;IAC5F,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACf,KAAK,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,IAAI,IAAI,CAAC,EAAE;YAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC;AACf,CAAC;AAID,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,IAAY,EAAE,OAAO,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,QAAQ,GAAoB,EAAE;IAClI,MAAM,GAAG,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,SAAS;QACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/C,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,QAAkC;IAC7F,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IACzG,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,0EAA0E,KAAK,EAAE,CAAC,CAAC;IACrH,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,kBAAkB,IAAI,QAAQ,CAAC,mBAAmB,CAAC;IAC1E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;IAC3F,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;IAC1G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,mEAAmE,CAAC,CAAC;IACjM,OAAO,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC/H,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAA4F;IACjH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAChE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;YACjD,IAAI,CAAC,KAAK,CAAC;gBACT,IAAI,EAAE,WAAW,KAAK,CAAC,IAAI,EAAE;gBAC7B,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,CAAC;gBACN,GAAG,EAAE,CAAC;gBACN,KAAK,EAAE,EAAE;gBACT,KAAK,EAAE,EAAE;gBACT,KAAK,EAAE,YAAY;aACpB,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAiB;IACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAChH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,SAAS;YAAE,MAAM,KAAK,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,6BAA6B,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACnH,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IAC7I,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzG,IAAI,YAAY,CAAC,MAAM,GAAG,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,QAAQ,aAAa,CAAC,CAAC;IACtG,MAAM,OAAO,GAAoD,EAAE,CAAC;IACpE,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC9D,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,IAAI,YAAY,GAAG,gBAAgB;YAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,gBAAgB,2BAA2B,CAAC,CAAC;QAC7H,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAClH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,MAAM,CAAC;IACjF,OAAO;QACL,EAAE,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE;QACxB,IAAI;QACJ,OAAO;QACP,QAAQ;QACR,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,YAAY;QACZ,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACxD,SAAS,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC5E,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/src/package/provenance.d.ts

@@ -0,0 +1,28 @@
+import type { SignOptions } from "sigstore";
+import type { PackedPackage } from "./pack.js";
+export interface ProvenanceBundle {
+    readonly mediaType: string;
+    readonly dsseEnvelope: {
+        readonly payload: string;
+    };
+    readonly [key: string]: unknown;
+}
+export interface ProvenanceServices {
+    readonly verify: (bundle: ProvenanceBundle) => Promise<unknown>;
+}
+export interface ProvenanceSigner {
+    (payload: Buffer, payloadType: string, options?: SignOptions): Promise<ProvenanceBundle>;
+}
+export declare class ProvenanceError extends Error {
+    constructor(message: string);
+}
+export declare function provenanceSubject(artifact: PackedPackage): {
+    readonly name: string;
+    readonly digest: {
+        readonly sha512: string;
+    };
+};
+export declare function extractProvenancePayload(bundle: ProvenanceBundle): Record<string, unknown>;
+export declare function loadProvenance(artifact: PackedPackage, path: string, services?: ProvenanceServices): Promise<ProvenanceBundle>;
+export declare function generateProvenance(artifact: PackedPackage, environment?: NodeJS.ProcessEnv, signer?: ProvenanceSigner): Promise<ProvenanceBundle>;
+export declare function transparencyLogUrl(bundle: ProvenanceBundle): string | undefined;

package/dist/src/package/provenance.js

@@ -0,0 +1,162 @@
+import { readFile, stat } from "node:fs/promises";
+import npa from "npm-package-arg";
+const maxProvenanceBytes = 10 * 1024 * 1024;
+export class ProvenanceError extends Error {
+    constructor(message) {
+        super(`Provenance error: ${message}`);
+        this.name = "ProvenanceError";
+    }
+}
+function record(value, message) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error(message);
+    return value;
+}
+function packagePurl(name, version) {
+    const api = npa;
+    return api.toPurl(npa.resolve(name, version));
+}
+function sha512Hex(integrity) {
+    const value = integrity.match(/^sha512-([A-Za-z0-9+/]+={0,2})$/)?.[1];
+    if (!value)
+        throw new Error("Packed package has invalid SHA-512 integrity");
+    return Buffer.from(value, "base64").toString("hex");
+}
+export function provenanceSubject(artifact) {
+    return { name: packagePurl(artifact.name, artifact.version), digest: { sha512: sha512Hex(artifact.integrity) } };
+}
+export function extractProvenancePayload(bundle) {
+    if (!bundle.dsseEnvelope || typeof bundle.dsseEnvelope.payload !== "string" || bundle.dsseEnvelope.payload.length === 0) {
+        throw new Error("No dsseEnvelope with payload found in Sigstore bundle");
+    }
+    try {
+        return record(JSON.parse(Buffer.from(bundle.dsseEnvelope.payload, "base64").toString("utf8")), "Sigstore payload must be an object");
+    }
+    catch (error) {
+        throw new Error(`Failed to parse payload from dsseEnvelope: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+export async function loadProvenance(artifact, path, services = { verify: async (bundle) => (await import("sigstore")).verify(bundle) }) {
+    let info;
+    try {
+        info = await stat(path);
+    }
+    catch (error) {
+        throw new ProvenanceError(`cannot read provenance file: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!info.isFile() || info.size > maxProvenanceBytes)
+        throw new ProvenanceError(`file must be a regular file no larger than ${maxProvenanceBytes} bytes`);
+    let bundle;
+    try {
+        const parsed = record(JSON.parse(await readFile(path, "utf8")), "Sigstore bundle must be an object");
+        if (typeof parsed.mediaType !== "string" || parsed.mediaType.length === 0)
+            throw new Error("Sigstore bundle has no mediaType");
+        const envelope = record(parsed.dsseEnvelope, "Sigstore bundle has no dsseEnvelope");
+        if (typeof envelope.payload !== "string")
+            throw new Error("Sigstore bundle has no payload");
+        bundle = parsed;
+    }
+    catch (error) {
+        throw new ProvenanceError(`invalid bundle: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+        const payload = extractProvenancePayload(bundle);
+        if (!Array.isArray(payload.subject) || payload.subject.length !== 1)
+            throw new Error("Sigstore bundle must contain exactly one subject");
+        const subject = record(payload.subject[0], "Sigstore bundle subject must be an object");
+        const digest = record(subject.digest, "Sigstore bundle subject must contain a digest");
+        const expected = provenanceSubject(artifact);
+        if (subject.name !== expected.name)
+            throw new Error(`subject ${String(subject.name)} does not match the package: ${expected.name}`);
+        if (digest.sha512 !== expected.digest.sha512)
+            throw new Error("subject digest does not match the package");
+    }
+    catch (error) {
+        throw new ProvenanceError(error instanceof Error ? error.message : String(error));
+    }
+    try {
+        await services.verify(bundle);
+    }
+    catch (error) {
+        throw new ProvenanceError(`signature verification failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return bundle;
+}
+function required(environment, name) {
+    const value = environment[name];
+    if (!value)
+        throw new ProvenanceError(`missing required CI environment variable ${name}`);
+    return value;
+}
+function githubStatement(artifact, environment) {
+    required(environment, "ACTIONS_ID_TOKEN_REQUEST_URL");
+    const repository = required(environment, "GITHUB_REPOSITORY");
+    const server = required(environment, "GITHUB_SERVER_URL");
+    const workflowRefValue = required(environment, "GITHUB_WORKFLOW_REF").replace(`${repository}/`, "");
+    const delimiter = workflowRefValue.indexOf("@");
+    if (delimiter <= 0 || delimiter === workflowRefValue.length - 1)
+        throw new ProvenanceError("GITHUB_WORKFLOW_REF is malformed");
+    return {
+        _type: "https://in-toto.io/Statement/v1",
+        subject: [provenanceSubject(artifact)],
+        predicateType: "https://slsa.dev/provenance/v1",
+        predicate: {
+            buildDefinition: {
+                buildType: "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1",
+                externalParameters: { workflow: { ref: workflowRefValue.slice(delimiter + 1), repository: `${server}/${repository}`, path: workflowRefValue.slice(0, delimiter) } },
+                internalParameters: { github: { event_name: environment.GITHUB_EVENT_NAME, repository_id: environment.GITHUB_REPOSITORY_ID, repository_owner_id: environment.GITHUB_REPOSITORY_OWNER_ID } },
+                resolvedDependencies: [{ uri: `git+${server}/${repository}@${required(environment, "GITHUB_REF")}`, digest: { gitCommit: required(environment, "GITHUB_SHA") } }],
+            },
+            runDetails: {
+                builder: { id: `https://github.com/actions/runner/${required(environment, "RUNNER_ENVIRONMENT")}` },
+                metadata: { invocationId: `${server}/${repository}/actions/runs/${required(environment, "GITHUB_RUN_ID")}/attempts/${required(environment, "GITHUB_RUN_ATTEMPT")}` },
+            },
+        },
+    };
+}
+function gitlabStatement(artifact, environment) {
+    const projectUrl = required(environment, "CI_PROJECT_URL");
+    const commit = required(environment, "CI_COMMIT_SHA");
+    return {
+        _type: "https://in-toto.io/Statement/v0.1",
+        subject: [provenanceSubject(artifact)],
+        predicateType: "https://slsa.dev/provenance/v0.2",
+        predicate: {
+            buildType: "https://github.com/npm/cli/gitlab/v0alpha1",
+            builder: { id: `${projectUrl}/-/runners/${required(environment, "CI_RUNNER_ID")}` },
+            invocation: {
+                configSource: { uri: `git+${projectUrl}`, digest: { sha1: commit }, entryPoint: required(environment, "CI_JOB_NAME") },
+                parameters: { CI: environment.CI, CI_COMMIT_REF_NAME: environment.CI_COMMIT_REF_NAME, CI_PIPELINE_SOURCE: environment.CI_PIPELINE_SOURCE },
+                environment: { server: environment.CI_SERVER_URL, project: environment.CI_PROJECT_PATH, job: { id: environment.CI_JOB_ID }, pipeline: { id: environment.CI_PIPELINE_ID, ref: environment.CI_CONFIG_PATH } },
+            },
+            metadata: { buildInvocationId: required(environment, "CI_JOB_URL"), completeness: { parameters: true, environment: true, materials: false }, reproducible: false },
+            materials: [{ uri: `git+${projectUrl}`, digest: { sha1: commit } }],
+        },
+    };
+}
+export async function generateProvenance(artifact, environment = process.env, signer = async (payload, payloadType, options) => (await import("sigstore")).attest(payload, payloadType, options)) {
+    let statement;
+    let signOptions;
+    if (environment.GITHUB_ACTIONS === "true") {
+        statement = githubStatement(artifact, environment);
+    }
+    else if (environment.GITLAB_CI === "true") {
+        statement = gitlabStatement(artifact, environment);
+        signOptions = { identityToken: required(environment, "SIGSTORE_ID_TOKEN") };
+    }
+    else {
+        throw new ProvenanceError("automatic generation is supported only in GitHub Actions or GitLab CI");
+    }
+    return signer(Buffer.from(JSON.stringify(statement)), "application/vnd.in-toto+json", signOptions);
+}
+export function transparencyLogUrl(bundle) {
+    const material = bundle.verificationMaterial;
+    if (typeof material !== "object" || material === null || Array.isArray(material))
+        return undefined;
+    const entries = material.tlogEntries;
+    if (!Array.isArray(entries) || typeof entries[0] !== "object" || entries[0] === null)
+        return undefined;
+    const index = entries[0].logIndex;
+    return typeof index === "number" || typeof index === "string" ? `https://search.sigstore.dev/?logIndex=${encodeURIComponent(String(index))}` : undefined;
+}
+//# sourceMappingURL=provenance.js.map

package/dist/src/package/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../src/package/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,GAAG,MAAM,iBAAiB,CAAC;AAIlC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAgB5C,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,OAAe;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAClG,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,MAAM,GAAG,GAAG,GAAwD,CAAC;IACrE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAuB;IACvD,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAwB;IAC/D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC;IACvI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAuB,EACvB,IAAY,EACZ,QAAQ,GAAuB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAgB,CAAC,EAAE;IAEhH,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACvK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB;QAAE,MAAM,IAAI,eAAe,CAAC,8CAA8C,kBAAkB,QAAQ,CAAC,CAAC;IAC1J,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;QACrG,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC/H,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,qCAAqC,CAAC,CAAC;QACpF,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5F,MAAM,GAAG,MAAqC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,mBAAmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACzI,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,2CAA2C,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACpI,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC7G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAC/K,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,WAA8B,EAAE,IAAY;IAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAuB,EAAE,WAA8B;IAC9E,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,OAAO,CAAC,GAAG,UAAU,GAAG,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,CAAC,CAAC;IAC/H,OAAO;QACL,KAAK,EAAE,iCAAiC;QACxC,OAAO,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACtC,aAAa,EAAE,gCAAgC;QAC/C,SAAS,EAAE;YACT,eAAe,EAAE;gBACf,SAAS,EAAE,wEAAwE;gBACnF,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE;gBACnK,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,iBAAiB,EAAE,aAAa,EAAE,WAAW,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,WAAW,CAAC,0BAA0B,EAAE,EAAE;gBAC3L,oBAAoB,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,MAAM,IAAI,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;aAClK;YACD,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,EAAE,EAAE,qCAAqC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,EAAE;gBACnG,QAAQ,EAAE,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,UAAU,iBAAiB,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,aAAa,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,EAAE;aACrK;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAuB,EAAE,WAA8B;IAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACtD,OAAO;QACL,KAAK,EAAE,mCAAmC;QAC1C,OAAO,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACtC,aAAa,EAAE,kCAAkC;QACjD,SAAS,EAAE;YACT,SAAS,EAAE,4CAA4C;YACvD,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,cAAc,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,EAAE;YACnF,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE;gBACtH,UAAU,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE;gBAC1I,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC,cAAc,EAAE,EAAE;aAC5M;YACD,QAAQ,EAAE,EAAE,iBAAiB,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE;YAClK,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;SACpE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAuB,EACvB,WAAW,GAAsB,OAAO,CAAC,GAAG,EAC5C,MAAM,GAAqB,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAA8B;IAEjK,IAAI,SAAkC,CAAC;IACvC,IAAI,WAAoC,CAAC;IACzC,IAAI,WAAW,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;SAAM,IAAI,WAAW,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC5C,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACnD,WAAW,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,eAAe,CAAC,uEAAuE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,8BAA8B,EAAE,WAAW,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAwB;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACnG,MAAM,OAAO,GAAI,QAAsC,CAAC,WAAW,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACvG,MAAM,KAAK,GAAI,OAAO,CAAC,CAAC,CAA4B,CAAC,QAAQ,CAAC;IAC9D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3J,CAAC"}

package/dist/src/package/publish.d.ts

@@ -0,0 +1,28 @@
+import type { BnpmPaths } from "../config/paths.js";
+import type { PackedPackage } from "./pack.js";
+import { type ProvenanceBundle } from "./provenance.js";
+export interface PublishOptions {
+    readonly artifact: PackedPackage;
+    readonly paths: BnpmPaths;
+    readonly registry?: URL;
+    readonly tag?: string;
+    readonly access?: "public" | "restricted";
+    readonly otp?: string;
+    readonly signal?: AbortSignal;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly provenance?: ProvenanceBundle;
+    readonly generateProvenance?: boolean;
+    readonly provenanceGenerator?: (artifact: PackedPackage) => Promise<ProvenanceBundle>;
+    readonly environment?: Readonly<Record<string, string | undefined>>;
+    readonly stage?: boolean;
+}
+export interface PublishResult {
+    readonly registry: string;
+    readonly tag: string;
+    readonly access?: "public" | "restricted";
+    readonly status: number;
+    readonly provenance: boolean;
+    readonly transparencyLogUrl?: string;
+    readonly stageId?: string;
+}
+export declare function publishPackage(options: PublishOptions): Promise<PublishResult>;