npm - @agimon-ai/po-web-security - Versions diffs - 0.0.0-alpha.22 → 0.0.0-alpha.23 - Mend

@agimon-ai/po-web-security 0.0.0-alpha.22 → 0.0.0-alpha.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/dist/browser.cjs +1 -1
package/dist/browser.d.mts +2 -2
package/dist/browser.mjs +1 -1
package/dist/index.cjs +1 -1
package/dist/index.d.mts +2 -2
package/dist/index.mjs +1 -1
package/dist/services/bundleSigner/index.cjs +1 -1
package/dist/services/bundleSigner/index.cjs.map +1 -1
package/dist/services/bundleSigner/index.mjs +1 -1
package/dist/services/bundleSigner/index.mjs.map +1 -1
package/dist/types/bundleManifest.cjs +1 -1
package/dist/types/bundleManifest.cjs.map +1 -1
package/dist/types/bundleManifest.d.mts +9 -2
package/dist/types/bundleManifest.d.mts.map +1 -1
package/dist/types/bundleManifest.mjs +2 -2
package/dist/types/bundleManifest.mjs.map +1 -1
package/package.json +1 -1

package/dist/browser.cjs CHANGED Viewed

	@@ -1 +1 @@
1	- Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./types/bundleManifest.cjs"),t=require("./services/browserBundleVerifier/index.cjs"),n=require("./services/browserSealedChannel/index.cjs"),r=require("./services/sealedTransport/index.cjs");exports.ATTESTATION_TAG=e.ATTESTATION_TAG,exports.BUNDLE_MANIFEST_ROUTE=e.BUNDLE_MANIFEST_ROUTE,exports.BUNDLE_MANIFEST_VERSION=e.BUNDLE_MANIFEST_VERSION,exports.NATIVE_COMPOSITION_MAX_BYTES=e.NATIVE_COMPOSITION_MAX_BYTES,exports.NATIVE_ENTRY_CONTENT_TYPE=e.NATIVE_ENTRY_CONTENT_TYPE,exports.NATIVE_ENTRY_PATH=e.NATIVE_ENTRY_PATH,exports.WEB_ENTRY_PATH=e.WEB_ENTRY_PATH,exports.assetFor=e.assetFor,exports.attestationBytes=e.attestationBytes,exports.canonicalManifest=e.canonicalManifest,exports.channelFromSecret=n.channelFromSecret,exports.connectSealedChannel=n.connectSealedChannel,exports.createSealedTransport=r.createSealedTransport,exports.digestFor=e.digestFor,exports.isBundleManifest=e.isBundleManifest,exports.isSignedBundleManifest=e.isSignedBundleManifest,exports.sealedTransport=r.sealedTransport,exports.verifyAttestation=t.verifyAttestation,exports.verifyBundleAsset=t.verifyBundleAsset,exports.verifySignedBundleManifest=t.verifySignedBundleManifest;
1	+ Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./types/bundleManifest.cjs"),t=require("./services/browserBundleVerifier/index.cjs"),n=require("./services/browserSealedChannel/index.cjs"),r=require("./services/sealedTransport/index.cjs");exports.APP_ASSET_MAX_BYTES=e.APP_ASSET_MAX_BYTES,exports.APP_DESCRIPTOR_PATH=e.APP_DESCRIPTOR_PATH,exports.APP_PART_PREFIX=e.APP_PART_PREFIX,exports.ATTESTATION_TAG=e.ATTESTATION_TAG,exports.BUNDLE_MANIFEST_ROUTE=e.BUNDLE_MANIFEST_ROUTE,exports.BUNDLE_MANIFEST_VERSION=e.BUNDLE_MANIFEST_VERSION,exports.NATIVE_COMPOSITION_MAX_BYTES=e.NATIVE_COMPOSITION_MAX_BYTES,exports.NATIVE_ENTRY_CONTENT_TYPE=e.NATIVE_ENTRY_CONTENT_TYPE,exports.NATIVE_ENTRY_PATH=e.NATIVE_ENTRY_PATH,exports.WEB_ENTRY_PATH=e.WEB_ENTRY_PATH,exports.assetFor=e.assetFor,exports.attestationBytes=e.attestationBytes,exports.canonicalManifest=e.canonicalManifest,exports.channelFromSecret=n.channelFromSecret,exports.connectSealedChannel=n.connectSealedChannel,exports.createSealedTransport=r.createSealedTransport,exports.digestFor=e.digestFor,exports.isBundleManifest=e.isBundleManifest,exports.isSignedBundleManifest=e.isSignedBundleManifest,exports.sealedTransport=r.sealedTransport,exports.verifyAttestation=t.verifyAttestation,exports.verifyBundleAsset=t.verifyBundleAsset,exports.verifySignedBundleManifest=t.verifySignedBundleManifest;

package/dist/browser.d.mts CHANGED Viewed

@@ -1,5 +1,5 @@
-import { ATTESTATION_TAG, BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, BundleAsset, BundleManifest, BundleProfile, NATIVE_COMPOSITION_MAX_BYTES, NATIVE_ENTRY_CONTENT_TYPE, NATIVE_ENTRY_PATH, SignedBundleManifest, WEB_ENTRY_PATH, assetFor, attestationBytes, canonicalManifest, digestFor, isBundleManifest, isSignedBundleManifest } from "./types/bundleManifest.mjs";
+import { APP_ASSET_MAX_BYTES, APP_DESCRIPTOR_PATH, APP_PART_PREFIX, ATTESTATION_TAG, BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, BundleAsset, BundleManifest, BundleProfile, NATIVE_COMPOSITION_MAX_BYTES, NATIVE_ENTRY_CONTENT_TYPE, NATIVE_ENTRY_PATH, SignedBundleManifest, WEB_ENTRY_PATH, assetFor, attestationBytes, canonicalManifest, digestFor, isBundleManifest, isSignedBundleManifest } from "./types/bundleManifest.mjs";
 import { BundleAssetVerificationFailure, BundleAssetVerificationResult, BundleVerificationFailure, BundleVerificationResult, verifyAttestation, verifyBundleAsset, verifySignedBundleManifest } from "./services/browserBundleVerifier/index.mjs";
 import { OpenResult, SealResult, SealedChannel, channelFromSecret, connectSealedChannel } from "./services/browserSealedChannel/index.mjs";
 import { SealedTransport, createSealedTransport, sealedTransport } from "./services/sealedTransport/index.mjs";
-export { ATTESTATION_TAG, BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, type BundleAsset, type BundleAssetVerificationFailure, type BundleAssetVerificationResult, type BundleManifest, type BundleProfile, type BundleVerificationFailure, type BundleVerificationResult, NATIVE_COMPOSITION_MAX_BYTES, NATIVE_ENTRY_CONTENT_TYPE, NATIVE_ENTRY_PATH, type OpenResult, type SealResult, type SealedChannel, type SealedTransport, type SignedBundleManifest, WEB_ENTRY_PATH, assetFor, attestationBytes, canonicalManifest, channelFromSecret, connectSealedChannel, createSealedTransport, digestFor, isBundleManifest, isSignedBundleManifest, sealedTransport, verifyAttestation, verifyBundleAsset, verifySignedBundleManifest };
+export { APP_ASSET_MAX_BYTES, APP_DESCRIPTOR_PATH, APP_PART_PREFIX, ATTESTATION_TAG, BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, type BundleAsset, type BundleAssetVerificationFailure, type BundleAssetVerificationResult, type BundleManifest, type BundleProfile, type BundleVerificationFailure, type BundleVerificationResult, NATIVE_COMPOSITION_MAX_BYTES, NATIVE_ENTRY_CONTENT_TYPE, NATIVE_ENTRY_PATH, type OpenResult, type SealResult, type SealedChannel, type SealedTransport, type SignedBundleManifest, WEB_ENTRY_PATH, assetFor, attestationBytes, canonicalManifest, channelFromSecret, connectSealedChannel, createSealedTransport, digestFor, isBundleManifest, isSignedBundleManifest, sealedTransport, verifyAttestation, verifyBundleAsset, verifySignedBundleManifest };

package/dist/browser.mjs CHANGED Viewed

	@@ -1 +1 @@
1	- import{~~ATTESTATION_TAG~~ as e,~~BUNDLE_MANIFEST_ROUTE~~ as t,~~BUNDLE_MANIFEST_VERSION~~ as n,~~NATIVE_COMPOSITION_MAX_BYTES~~ as r,~~NATIVE_ENTRY_CONTENT_TYPE~~ as i,~~NATIVE_ENTRY_PATH~~ as a,~~WEB_ENTRY_PATH~~ as o,~~assetFor~~ as s,~~attestationBytes~~ as c,~~canonicalManifest~~ as l,~~digestFor~~ as u,~~isBundleManifest~~ as d,isSignedBundleManifest as f}from"./types/bundleManifest.mjs";import{verifyAttestation as p,verifyBundleAsset as m,verifySignedBundleManifest as h}from"./services/browserBundleVerifier/index.mjs";import{channelFromSecret as g,connectSealedChannel as _}from"./services/browserSealedChannel/index.mjs";import{createSealedTransport as v,sealedTransport as y}from"./services/sealedTransport/index.mjs";export{e as ~~ATTESTATION_TAG~~,t as ~~BUNDLE_MANIFEST_ROUTE~~,n as ~~BUNDLE_MANIFEST_VERSION~~,r as ~~NATIVE_COMPOSITION_MAX_BYTES~~,i as ~~NATIVE_ENTRY_CONTENT_TYPE~~,a as ~~NATIVE_ENTRY_PATH~~,o as ~~WEB_ENTRY_PATH~~,s as ~~assetFor~~,c as ~~attestationBytes~~,l as canonicalManifest,g as channelFromSecret,_ as connectSealedChannel,v as createSealedTransport,u as digestFor,d as isBundleManifest,f as isSignedBundleManifest,y as sealedTransport,p as verifyAttestation,m as verifyBundleAsset,h as verifySignedBundleManifest};
1	+ import{APP_ASSET_MAX_BYTES as e,APP_DESCRIPTOR_PATH as t,APP_PART_PREFIX as n,ATTESTATION_TAG as r,BUNDLE_MANIFEST_ROUTE as i,BUNDLE_MANIFEST_VERSION as a,NATIVE_COMPOSITION_MAX_BYTES as o,NATIVE_ENTRY_CONTENT_TYPE as s,NATIVE_ENTRY_PATH as c,WEB_ENTRY_PATH as l,assetFor as u,attestationBytes as d,canonicalManifest as f,digestFor as p,isBundleManifest as m,isSignedBundleManifest as h}from"./types/bundleManifest.mjs";import{verifyAttestation as g,verifyBundleAsset as _,verifySignedBundleManifest as v}from"./services/browserBundleVerifier/index.mjs";import{channelFromSecret as y,connectSealedChannel as b}from"./services/browserSealedChannel/index.mjs";import{createSealedTransport as x,sealedTransport as S}from"./services/sealedTransport/index.mjs";export{e as APP_ASSET_MAX_BYTES,t as APP_DESCRIPTOR_PATH,n as APP_PART_PREFIX,r as ATTESTATION_TAG,i as BUNDLE_MANIFEST_ROUTE,a as BUNDLE_MANIFEST_VERSION,o as NATIVE_COMPOSITION_MAX_BYTES,s as NATIVE_ENTRY_CONTENT_TYPE,c as NATIVE_ENTRY_PATH,l as WEB_ENTRY_PATH,u as assetFor,d as attestationBytes,f as canonicalManifest,y as channelFromSecret,b as connectSealedChannel,x as createSealedTransport,p as digestFor,m as isBundleManifest,h as isSignedBundleManifest,S as sealedTransport,g as verifyAttestation,_ as verifyBundleAsset,v as verifySignedBundleManifest};

package/dist/index.cjs CHANGED Viewed

	@@ -1 +1 @@
1	- Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./types/bundleManifest.cjs"),t=require("./types/sealedChannel.cjs"),n=require("./services/serialQueue/index.cjs");exports.ATTESTATION_TAG=e.ATTESTATION_TAG,exports.BUNDLE_MANIFEST_ROUTE=e.BUNDLE_MANIFEST_ROUTE,exports.BUNDLE_MANIFEST_VERSION=e.BUNDLE_MANIFEST_VERSION,exports.CLIENT_TO_SERVER_INFO=t.CLIENT_TO_SERVER_INFO,exports.MAX_MESSAGES_PER_KEY=t.MAX_MESSAGES_PER_KEY,exports.NATIVE_COMPOSITION_MAX_BYTES=e.NATIVE_COMPOSITION_MAX_BYTES,exports.NATIVE_ENTRY_CONTENT_TYPE=e.NATIVE_ENTRY_CONTENT_TYPE,exports.NATIVE_ENTRY_PATH=e.NATIVE_ENTRY_PATH,exports.NONCE_BYTES=t.NONCE_BYTES,exports.NONCE_COUNTER_BYTES=t.NONCE_COUNTER_BYTES,exports.NONCE_PREFIX_BYTES=t.NONCE_PREFIX_BYTES,exports.SEALED_BODY_HEADER=t.SEALED_BODY_HEADER,exports.SEALED_CLIENT_KEY_HEADER=t.SEALED_CLIENT_KEY_HEADER,exports.SEALED_KEY_PARAM=t.SEALED_KEY_PARAM,exports.SEALED_VERSION=t.SEALED_VERSION,exports.SERVER_TO_CLIENT_INFO=t.SERVER_TO_CLIENT_INFO,exports.WEB_ENTRY_PATH=e.WEB_ENTRY_PATH,exports.assetFor=e.assetFor,exports.attestationBytes=e.attestationBytes,exports.canonicalManifest=e.canonicalManifest,exports.createSerialQueue=n.createSerialQueue,exports.describeSealedFailure=t.describeSealedFailure,exports.digestFor=e.digestFor,exports.infoFor=t.infoFor,exports.isBundleManifest=e.isBundleManifest,exports.isSealedEnvelope=t.isSealedEnvelope,exports.isSignedBundleManifest=e.isSignedBundleManifest;
1	+ Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./types/bundleManifest.cjs"),t=require("./types/sealedChannel.cjs"),n=require("./services/serialQueue/index.cjs");exports.APP_ASSET_MAX_BYTES=e.APP_ASSET_MAX_BYTES,exports.APP_DESCRIPTOR_PATH=e.APP_DESCRIPTOR_PATH,exports.APP_PART_PREFIX=e.APP_PART_PREFIX,exports.ATTESTATION_TAG=e.ATTESTATION_TAG,exports.BUNDLE_MANIFEST_ROUTE=e.BUNDLE_MANIFEST_ROUTE,exports.BUNDLE_MANIFEST_VERSION=e.BUNDLE_MANIFEST_VERSION,exports.CLIENT_TO_SERVER_INFO=t.CLIENT_TO_SERVER_INFO,exports.MAX_MESSAGES_PER_KEY=t.MAX_MESSAGES_PER_KEY,exports.NATIVE_COMPOSITION_MAX_BYTES=e.NATIVE_COMPOSITION_MAX_BYTES,exports.NATIVE_ENTRY_CONTENT_TYPE=e.NATIVE_ENTRY_CONTENT_TYPE,exports.NATIVE_ENTRY_PATH=e.NATIVE_ENTRY_PATH,exports.NONCE_BYTES=t.NONCE_BYTES,exports.NONCE_COUNTER_BYTES=t.NONCE_COUNTER_BYTES,exports.NONCE_PREFIX_BYTES=t.NONCE_PREFIX_BYTES,exports.SEALED_BODY_HEADER=t.SEALED_BODY_HEADER,exports.SEALED_CLIENT_KEY_HEADER=t.SEALED_CLIENT_KEY_HEADER,exports.SEALED_KEY_PARAM=t.SEALED_KEY_PARAM,exports.SEALED_VERSION=t.SEALED_VERSION,exports.SERVER_TO_CLIENT_INFO=t.SERVER_TO_CLIENT_INFO,exports.WEB_ENTRY_PATH=e.WEB_ENTRY_PATH,exports.assetFor=e.assetFor,exports.attestationBytes=e.attestationBytes,exports.canonicalManifest=e.canonicalManifest,exports.createSerialQueue=n.createSerialQueue,exports.describeSealedFailure=t.describeSealedFailure,exports.digestFor=e.digestFor,exports.infoFor=t.infoFor,exports.isBundleManifest=e.isBundleManifest,exports.isSealedEnvelope=t.isSealedEnvelope,exports.isSignedBundleManifest=e.isSignedBundleManifest;

package/dist/index.d.mts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { ATTESTATION_TAG, BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, BundleAsset, BundleManifest, BundleProfile, NATIVE_COMPOSITION_MAX_BYTES, NATIVE_ENTRY_CONTENT_TYPE, NATIVE_ENTRY_PATH, SignedBundleManifest, WEB_ENTRY_PATH, assetFor, attestationBytes, canonicalManifest, digestFor, isBundleManifest, isSignedBundleManifest } from "./types/bundleManifest.mjs";
+import { APP_ASSET_MAX_BYTES, APP_DESCRIPTOR_PATH, APP_PART_PREFIX, ATTESTATION_TAG, BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, BundleAsset, BundleManifest, BundleProfile, NATIVE_COMPOSITION_MAX_BYTES, NATIVE_ENTRY_CONTENT_TYPE, NATIVE_ENTRY_PATH, SignedBundleManifest, WEB_ENTRY_PATH, assetFor, attestationBytes, canonicalManifest, digestFor, isBundleManifest, isSignedBundleManifest } from "./types/bundleManifest.mjs";
 import { CLIENT_TO_SERVER_INFO, MAX_MESSAGES_PER_KEY, NONCE_BYTES, NONCE_COUNTER_BYTES, NONCE_PREFIX_BYTES, SEALED_BODY_HEADER, SEALED_CLIENT_KEY_HEADER, SEALED_KEY_PARAM, SEALED_VERSION, SERVER_TO_CLIENT_INFO, SealedDirection, SealedEnvelope, SealedFailure, describeSealedFailure, infoFor, isSealedEnvelope } from "./types/sealedChannel.mjs";
 import { SerialQueue, createSerialQueue } from "./services/serialQueue/index.mjs";
-export { ATTESTATION_TAG, BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, type BundleAsset, type BundleManifest, type BundleProfile, CLIENT_TO_SERVER_INFO, MAX_MESSAGES_PER_KEY, NATIVE_COMPOSITION_MAX_BYTES, NATIVE_ENTRY_CONTENT_TYPE, NATIVE_ENTRY_PATH, NONCE_BYTES, NONCE_COUNTER_BYTES, NONCE_PREFIX_BYTES, SEALED_BODY_HEADER, SEALED_CLIENT_KEY_HEADER, SEALED_KEY_PARAM, SEALED_VERSION, SERVER_TO_CLIENT_INFO, type SealedDirection, type SealedEnvelope, type SealedFailure, type SerialQueue, type SignedBundleManifest, WEB_ENTRY_PATH, assetFor, attestationBytes, canonicalManifest, createSerialQueue, describeSealedFailure, digestFor, infoFor, isBundleManifest, isSealedEnvelope, isSignedBundleManifest };
+export { APP_ASSET_MAX_BYTES, APP_DESCRIPTOR_PATH, APP_PART_PREFIX, ATTESTATION_TAG, BUNDLE_MANIFEST_ROUTE, BUNDLE_MANIFEST_VERSION, type BundleAsset, type BundleManifest, type BundleProfile, CLIENT_TO_SERVER_INFO, MAX_MESSAGES_PER_KEY, NATIVE_COMPOSITION_MAX_BYTES, NATIVE_ENTRY_CONTENT_TYPE, NATIVE_ENTRY_PATH, NONCE_BYTES, NONCE_COUNTER_BYTES, NONCE_PREFIX_BYTES, SEALED_BODY_HEADER, SEALED_CLIENT_KEY_HEADER, SEALED_KEY_PARAM, SEALED_VERSION, SERVER_TO_CLIENT_INFO, type SealedDirection, type SealedEnvelope, type SealedFailure, type SerialQueue, type SignedBundleManifest, WEB_ENTRY_PATH, assetFor, attestationBytes, canonicalManifest, createSerialQueue, describeSealedFailure, digestFor, infoFor, isBundleManifest, isSealedEnvelope, isSignedBundleManifest };

package/dist/index.mjs CHANGED Viewed

	@@ -1 +1 @@
1	- import{~~ATTESTATION_TAG~~ as e,~~BUNDLE_MANIFEST_ROUTE~~ as t,~~BUNDLE_MANIFEST_VERSION~~ as n,~~NATIVE_COMPOSITION_MAX_BYTES~~ as r,~~NATIVE_ENTRY_CONTENT_TYPE~~ as i,~~NATIVE_ENTRY_PATH~~ as a,~~WEB_ENTRY_PATH~~ as o,~~assetFor~~ as s,~~attestationBytes~~ as c,~~canonicalManifest~~ as l,~~digestFor~~ as u,~~isBundleManifest~~ as d,isSignedBundleManifest as f}from"./types/bundleManifest.mjs";import{CLIENT_TO_SERVER_INFO as p,MAX_MESSAGES_PER_KEY as m,NONCE_BYTES as h,NONCE_COUNTER_BYTES as g,NONCE_PREFIX_BYTES as _,SEALED_BODY_HEADER as v,SEALED_CLIENT_KEY_HEADER as y,SEALED_KEY_PARAM as b,SEALED_VERSION as x,SERVER_TO_CLIENT_INFO as S,describeSealedFailure as C,infoFor as w,isSealedEnvelope as T}from"./types/sealedChannel.mjs";import{createSerialQueue as E}from"./services/serialQueue/index.mjs";export{e as ~~ATTESTATION_TAG~~,t as ~~BUNDLE_MANIFEST_ROUTE~~,n as BUNDLE_MANIFEST_VERSION,p as CLIENT_TO_SERVER_INFO,m as MAX_MESSAGES_PER_KEY,r as NATIVE_COMPOSITION_MAX_BYTES,i as NATIVE_ENTRY_CONTENT_TYPE,a as NATIVE_ENTRY_PATH,h as NONCE_BYTES,g as NONCE_COUNTER_BYTES,_ as NONCE_PREFIX_BYTES,v as SEALED_BODY_HEADER,y as SEALED_CLIENT_KEY_HEADER,b as SEALED_KEY_PARAM,x as SEALED_VERSION,S as SERVER_TO_CLIENT_INFO,o as WEB_ENTRY_PATH,s as assetFor,c as attestationBytes,l as canonicalManifest,E as createSerialQueue,C as describeSealedFailure,u as digestFor,w as infoFor,d as isBundleManifest,T as isSealedEnvelope,f as isSignedBundleManifest};
1	+ import{APP_ASSET_MAX_BYTES as e,APP_DESCRIPTOR_PATH as t,APP_PART_PREFIX as n,ATTESTATION_TAG as r,BUNDLE_MANIFEST_ROUTE as i,BUNDLE_MANIFEST_VERSION as a,NATIVE_COMPOSITION_MAX_BYTES as o,NATIVE_ENTRY_CONTENT_TYPE as s,NATIVE_ENTRY_PATH as c,WEB_ENTRY_PATH as l,assetFor as u,attestationBytes as d,canonicalManifest as f,digestFor as p,isBundleManifest as m,isSignedBundleManifest as h}from"./types/bundleManifest.mjs";import{CLIENT_TO_SERVER_INFO as g,MAX_MESSAGES_PER_KEY as _,NONCE_BYTES as v,NONCE_COUNTER_BYTES as y,NONCE_PREFIX_BYTES as b,SEALED_BODY_HEADER as x,SEALED_CLIENT_KEY_HEADER as S,SEALED_KEY_PARAM as C,SEALED_VERSION as w,SERVER_TO_CLIENT_INFO as T,describeSealedFailure as E,infoFor as D,isSealedEnvelope as O}from"./types/sealedChannel.mjs";import{createSerialQueue as k}from"./services/serialQueue/index.mjs";export{e as APP_ASSET_MAX_BYTES,t as APP_DESCRIPTOR_PATH,n as APP_PART_PREFIX,r as ATTESTATION_TAG,i as BUNDLE_MANIFEST_ROUTE,a as BUNDLE_MANIFEST_VERSION,g as CLIENT_TO_SERVER_INFO,_ as MAX_MESSAGES_PER_KEY,o as NATIVE_COMPOSITION_MAX_BYTES,s as NATIVE_ENTRY_CONTENT_TYPE,c as NATIVE_ENTRY_PATH,v as NONCE_BYTES,y as NONCE_COUNTER_BYTES,b as NONCE_PREFIX_BYTES,x as SEALED_BODY_HEADER,S as SEALED_CLIENT_KEY_HEADER,C as SEALED_KEY_PARAM,w as SEALED_VERSION,T as SERVER_TO_CLIENT_INFO,l as WEB_ENTRY_PATH,u as assetFor,d as attestationBytes,f as canonicalManifest,k as createSerialQueue,E as describeSealedFailure,p as digestFor,D as infoFor,m as isBundleManifest,O as isSealedEnvelope,h as isSignedBundleManifest};

package/dist/services/bundleSigner/index.cjs CHANGED Viewed

@@ -1,2 +1,2 @@
-const e=require("../../_virtual/_rolldown/runtime.cjs"),t=require("../../types/bundleManifest.cjs");let n=require("node:crypto"),r=require("node:fs");r=e.__toESM(r,1);let i=require("node:path");i=e.__toESM(i,1);const a=`signing.json`,o=`sha256`,s=/* @__PURE__ */ new Set([`.map`]),c=[`web`,`native`],l={".css":`text/css`,".gif":`image/gif`,".html":`text/html`,".ico":`image/x-icon`,".jpeg":`image/jpeg`,".jpg":`image/jpeg`,".js":`text/javascript`,".json":`application/json`,".mjs":`text/javascript`,".png":`image/png`,".svg":`image/svg+xml`,".txt":`text/plain`,".wasm":`application/wasm`,".webp":`image/webp`,".woff":`font/woff`,".woff2":`font/woff2`};function u(e){r.default.mkdirSync(e,{recursive:!0,mode:448});let t=r.default.lstatSync(e);if(!t.isDirectory()||t.isSymbolicLink())throw Error(`bundle signing state is not a directory: ${e}`);r.default.chmodSync(e,448)}function d(e,t){u(e);let n=i.default.join(e,`signing.lock`),a;for(let e=0;e<500;e+=1)try{a=r.default.openSync(n,`wx`,384);break}catch(e){if(e.code!==`EEXIST`)throw e;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,10)}if(a===void 0)throw Error(`timed out waiting for bundle signing state lock: ${n}`);try{return t()}finally{r.default.closeSync(a),r.default.rmSync(n,{force:!0})}}function f(e,t){let o=i.default.join(e,a),s=i.default.join(e,`.${a}.${process.pid}.${(0,n.randomBytes)(8).toString(`hex`)}`),c=r.default.openSync(s,`wx`,384);try{r.default.writeFileSync(c,`${JSON.stringify(t,void 0,2)}\n`),r.default.fsyncSync(c)}finally{r.default.closeSync(c)}try{r.default.renameSync(s,o),r.default.chmodSync(o,384)}catch(e){throw r.default.rmSync(s,{force:!0}),e}}function p(e,t){if(typeof e!=`object`||!e)throw Error(`invalid bundle signing state: ${t}`);let n=e;if(typeof n.privateKey!=`string`||typeof n.publicKey!=`string`)throw Error(`invalid bundle signing state: ${t}`);let r=n.revision===void 0?0:n.revision;if(!Number.isSafeInteger(r)||r<0)throw Error(`invalid bundle signing revision: ${t}`);let i;try{i=y(n.privateKey)}catch{throw Error(`invalid bundle signing private key: ${t}`)}if(i!==n.publicKey)throw Error(`bundle signing keys do not match: ${t}`);return{privateKey:n.privateKey,publicKey:n.publicKey,revision:r}}function m(e){return d(e,()=>{let t=i.default.join(e,a);try{let n=r.default.lstatSync(t);if(!n.isFile()||n.isSymbolicLink())throw Error(`invalid bundle signing state file: ${t}`);let i=JSON.parse(r.default.readFileSync(t,`utf8`)),a=p(i,t);return r.default.chmodSync(t,384),i.revision===void 0&&f(e,a),a}catch(e){if(e.code!==`ENOENT`)throw e}let o=(0,n.generateKeyPairSync)(`ec`,{namedCurve:`prime256v1`,privateKeyEncoding:{type:`pkcs8`,format:`pem`},publicKeyEncoding:{type:`spki`,format:`der`}}),s={privateKey:o.privateKey,publicKey:Buffer.from(o.publicKey).toString(`base64url`),revision:0};return f(e,s),s})}function h(e,t){return d(e,()=>{let n=i.default.join(e,a),o=p(JSON.parse(r.default.readFileSync(n,`utf8`)),n);if(o.publicKey!==t)throw Error(`bundle signing key changed while the signer was active`);if(o.revision===2**53-1)throw Error(`bundle signing revision is exhausted`);let s={...o,revision:o.revision+1};return f(e,s),s.revision})}function g(e){return l[i.default.extname(e).toLowerCase()]??`application/octet-stream`}function _(e,t,a){let o=r.default.readdirSync(t,{withFileTypes:!0});for(let c of o){let o=i.default.join(t,c.name),l=r.default.lstatSync(o);if(l.isSymbolicLink())throw Error(`refusing to sign symbolic link: ${o}`);if(l.isDirectory()){_(e,o,a);continue}if(!l.isFile())throw Error(`refusing to omit unsupported asset: ${o}`);if(s.has(i.default.extname(c.name)))continue;let u=r.default.readFileSync(o);a.push({path:`/${i.default.relative(e,o).split(i.default.sep).map(e=>encodeURIComponent(e)).join(`/`)}`,sha256:(0,n.createHash)(`sha256`).update(u).digest(`hex`),byteLength:u.byteLength,contentType:g(o)})}}function v(e,a=()=>{}){let s=m(e),l=(0,n.createPrivateKey)(s.privateKey),u=/* @__PURE__ */ new Map,d=(e,t)=>`${t}:${i.default.resolve(e)}`,f=(i,a)=>{let c=r.default.lstatSync(i);if(!c.isDirectory()||c.isSymbolicLink())throw Error(`refusing to sign an unsafe asset root: ${i}`);let u=[];if(_(i,i,u),u.length===0)return;u.sort((e,t)=>e.path.localeCompare(t.path));let d={version:2,revision:h(e,s.publicKey),builtAt:Date.now(),assets:u};if(!t.isBundleManifest(d,a))throw Error(`refusing to sign an invalid ${a} bundle manifest`);return{manifest:d,signature:(0,n.createSign)(o).update(t.canonicalManifest(d)).sign({key:l,dsaEncoding:`ieee-p1363`}).toString(`base64url`),publicKey:s.publicKey}},p=(e,t=`web`)=>{let n=d(e,t);if(u.has(n))return u.get(n);let r=f(i.default.resolve(e),t);return u.set(n,r),r};return{publicKey:()=>s.publicKey,sign:p,refresh(e,t=`web`){return u.delete(d(e,t)),p(e,t)},invalidate(e){if(e===void 0)u.clear();else for(let t of c)u.delete(d(e,t))},attest(e,r){return(0,n.createSign)(o).update(t.attestationBytes(e,r)).sign({key:l,dsaEncoding:`ieee-p1363`}).toString(`base64url`)}}}function y(e){return Buffer.from((0,n.createPublicKey)(e).export({type:`spki`,format:`der`})).toString(`base64url`)}exports.createBundleSigner=v,exports.publicKeyOf=y;
+const e=require("../../_virtual/_rolldown/runtime.cjs"),t=require("../../types/bundleManifest.cjs");let n=require("node:crypto"),r=require("node:fs");r=e.__toESM(r,1);let i=require("node:path");i=e.__toESM(i,1);const a=`signing.json`,o=`sha256`,s=/* @__PURE__ */ new Set([`.map`]),c=[`web`,`native`,`app`],l={".css":`text/css`,".gif":`image/gif`,".html":`text/html`,".ico":`image/x-icon`,".jpeg":`image/jpeg`,".jpg":`image/jpeg`,".js":`text/javascript`,".json":`application/json`,".mjs":`text/javascript`,".png":`image/png`,".svg":`image/svg+xml`,".txt":`text/plain`,".wasm":`application/wasm`,".webp":`image/webp`,".woff":`font/woff`,".woff2":`font/woff2`};function u(e){r.default.mkdirSync(e,{recursive:!0,mode:448});let t=r.default.lstatSync(e);if(!t.isDirectory()||t.isSymbolicLink())throw Error(`bundle signing state is not a directory: ${e}`);r.default.chmodSync(e,448)}function d(e,t){u(e);let n=i.default.join(e,`signing.lock`),a;for(let e=0;e<500;e+=1)try{a=r.default.openSync(n,`wx`,384);break}catch(e){if(e.code!==`EEXIST`)throw e;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,10)}if(a===void 0)throw Error(`timed out waiting for bundle signing state lock: ${n}`);try{return t()}finally{r.default.closeSync(a),r.default.rmSync(n,{force:!0})}}function f(e,t){let o=i.default.join(e,a),s=i.default.join(e,`.${a}.${process.pid}.${(0,n.randomBytes)(8).toString(`hex`)}`),c=r.default.openSync(s,`wx`,384);try{r.default.writeFileSync(c,`${JSON.stringify(t,void 0,2)}\n`),r.default.fsyncSync(c)}finally{r.default.closeSync(c)}try{r.default.renameSync(s,o),r.default.chmodSync(o,384)}catch(e){throw r.default.rmSync(s,{force:!0}),e}}function p(e,t){if(typeof e!=`object`||!e)throw Error(`invalid bundle signing state: ${t}`);let n=e;if(typeof n.privateKey!=`string`||typeof n.publicKey!=`string`)throw Error(`invalid bundle signing state: ${t}`);let r=n.revision===void 0?0:n.revision;if(!Number.isSafeInteger(r)||r<0)throw Error(`invalid bundle signing revision: ${t}`);let i;try{i=y(n.privateKey)}catch{throw Error(`invalid bundle signing private key: ${t}`)}if(i!==n.publicKey)throw Error(`bundle signing keys do not match: ${t}`);return{privateKey:n.privateKey,publicKey:n.publicKey,revision:r}}function m(e){return d(e,()=>{let t=i.default.join(e,a);try{let n=r.default.lstatSync(t);if(!n.isFile()||n.isSymbolicLink())throw Error(`invalid bundle signing state file: ${t}`);let i=JSON.parse(r.default.readFileSync(t,`utf8`)),a=p(i,t);return r.default.chmodSync(t,384),i.revision===void 0&&f(e,a),a}catch(e){if(e.code!==`ENOENT`)throw e}let o=(0,n.generateKeyPairSync)(`ec`,{namedCurve:`prime256v1`,privateKeyEncoding:{type:`pkcs8`,format:`pem`},publicKeyEncoding:{type:`spki`,format:`der`}}),s={privateKey:o.privateKey,publicKey:Buffer.from(o.publicKey).toString(`base64url`),revision:0};return f(e,s),s})}function h(e,t){return d(e,()=>{let n=i.default.join(e,a),o=p(JSON.parse(r.default.readFileSync(n,`utf8`)),n);if(o.publicKey!==t)throw Error(`bundle signing key changed while the signer was active`);if(o.revision===2**53-1)throw Error(`bundle signing revision is exhausted`);let s={...o,revision:o.revision+1};return f(e,s),s.revision})}function g(e){return l[i.default.extname(e).toLowerCase()]??`application/octet-stream`}function _(e,t,a){let o=r.default.readdirSync(t,{withFileTypes:!0});for(let c of o){let o=i.default.join(t,c.name),l=r.default.lstatSync(o);if(l.isSymbolicLink())throw Error(`refusing to sign symbolic link: ${o}`);if(l.isDirectory()){_(e,o,a);continue}if(!l.isFile())throw Error(`refusing to omit unsupported asset: ${o}`);if(s.has(i.default.extname(c.name)))continue;let u=r.default.readFileSync(o);a.push({path:`/${i.default.relative(e,o).split(i.default.sep).map(e=>encodeURIComponent(e)).join(`/`)}`,sha256:(0,n.createHash)(`sha256`).update(u).digest(`hex`),byteLength:u.byteLength,contentType:g(o)})}}function v(e,a=()=>{}){let s=m(e),l=(0,n.createPrivateKey)(s.privateKey),u=/* @__PURE__ */ new Map,d=(e,t)=>`${t}:${i.default.resolve(e)}`,f=(i,a)=>{let c=r.default.lstatSync(i);if(!c.isDirectory()||c.isSymbolicLink())throw Error(`refusing to sign an unsafe asset root: ${i}`);let u=[];if(_(i,i,u),u.length===0)return;u.sort((e,t)=>e.path.localeCompare(t.path));let d={version:2,revision:h(e,s.publicKey),builtAt:Date.now(),assets:u};if(!t.isBundleManifest(d,a))throw Error(`refusing to sign an invalid ${a} bundle manifest`);return{manifest:d,signature:(0,n.createSign)(o).update(t.canonicalManifest(d)).sign({key:l,dsaEncoding:`ieee-p1363`}).toString(`base64url`),publicKey:s.publicKey}},p=(e,t=`web`)=>{let n=d(e,t);if(u.has(n))return u.get(n);let r=f(i.default.resolve(e),t);return u.set(n,r),r};return{publicKey:()=>s.publicKey,sign:p,refresh(e,t=`web`){return u.delete(d(e,t)),p(e,t)},invalidate(e){if(e===void 0)u.clear();else for(let t of c)u.delete(d(e,t))},attest(e,r){return(0,n.createSign)(o).update(t.attestationBytes(e,r)).sign({key:l,dsaEncoding:`ieee-p1363`}).toString(`base64url`)}}}function y(e){return Buffer.from((0,n.createPublicKey)(e).export({type:`spki`,format:`der`})).toString(`base64url`)}exports.createBundleSigner=v,exports.publicKeyOf=y;
 //# sourceMappingURL=index.cjs.map

package/dist/services/bundleSigner/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.cjs","names":["fs","path","randomBytes","generateKeyPairSync","createHash","createPrivateKey","isBundleManifest","createSign","canonicalManifest","attestationBytes","createPublicKey","require_runtime","require_bundleManifest","node_crypto","node_fs","node_path","SIGNING_FILE","SIGN_ALGORITHM","SKIPPED","PROFILES","MIME_TYPES","ensureStateDirectory","stateDir","stat","withStateLock","lockPath","descriptor","attempt","error","operation","atomicWriteState","destination","temporary","state","parseState","value","keyPath","candidate","revision","derived","publicKeyOf","loadOrCreateState","parsed","pair","reserveRevision","expectedPublicKey","next","contentTypeFor","filePath","walk","entries","current","entry","full","root","into","bytes","segment","createBundleSigner","key","privateKey","cache","cacheKeyOf","profile","assetsDir","signFresh","rootStat","assets","left","right","manifest","sign","cacheKey","signed","tag","fields","privateKeyPem"],"sources":["../../../src/services/bundleSigner/index.ts"],"sourcesContent":["import {\n createHash,\n createPrivateKey,\n createPublicKey,\n createSign,\n generateKeyPairSync,\n randomBytes,\n} from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n BUNDLE_MANIFEST_VERSION,\n type BundleAsset,\n type BundleManifest,\n type BundleProfile,\n type SignedBundleManifest,\n attestationBytes,\n canonicalManifest,\n isBundleManifest,\n} from '../../types/bundleManifest';\n\nconst SIGNING_FILE = 'signing.json';\nconst LOCK_FILE = 'signing.lock';\nconst FILE_MODE = 0o600;\nconst DIRECTORY_MODE = 0o700;\nconst CURVE = 'prime256v1';\nconst SIGN_ALGORITHM = 'sha256';\nconst SKIPPED = new Set(['.map']);\nconst PROFILES: readonly BundleProfile[] = ['web', 'native'];\nconst MIME_TYPES: Readonly<Record<string, string>> = {\n '.css': 'text/css',\n '.gif': 'image/gif',\n '.html': 'text/html',\n '.ico': 'image/x-icon',\n '.jpeg': 'image/jpeg',\n '.jpg': 'image/jpeg',\n '.js': 'text/javascript',\n '.json': 'application/json',\n '.mjs': 'text/javascript',\n '.png': 'image/png',\n '.svg': 'image/svg+xml',\n '.txt': 'text/plain',\n '.wasm': 'application/wasm',\n '.webp': 'image/webp',\n '.woff': 'font/woff',\n '.woff2': 'font/woff2',\n};\n\nexport interface BundleSigner {\n /** Base64url SPKI for an independently trusted verifier to pin. /\n publicKey(): string;\n /\n Hashes and signs once per asset directory and profile. Undefined when the bundle is empty. Throws\n * when the assets do not match the profile.\n /\n sign(assetsDir: string, profile?: BundleProfile): SignedBundleManifest \| undefined;\n /* Invalidates and immediately rebuilds one cached manifest. /\n refresh(assetsDir: string, profile?: BundleProfile): SignedBundleManifest \| undefined;\n /* Invalidates one cached directory under every profile, or every cached directory when omitted. /\n invalidate(assetsDir?: string): void;\n /\n Base64url IEEE P1363 signature over `attestationBytes(tag, fields)` with the bundle key. Throws on a\n * malformed tag.\n /\n attest(tag: string, fields: readonly string[]): string;\n}\n\ninterface StoredState {\n privateKey: string;\n publicKey: string;\n revision: number;\n}\n\nfunction ensureStateDirectory(stateDir: string): void {\n fs.mkdirSync(stateDir, { recursive: true, mode: DIRECTORY_MODE });\n const stat = fs.lstatSync(stateDir);\n if (!stat.isDirectory() \|\| stat.isSymbolicLink())\n throw new Error(`bundle signing state is not a directory: ${stateDir}`);\n fs.chmodSync(stateDir, DIRECTORY_MODE);\n}\n\nfunction withStateLock<T>(stateDir: string, operation: () => T): T {\n ensureStateDirectory(stateDir);\n const lockPath = path.join(stateDir, LOCK_FILE);\n let descriptor: number \| undefined;\n for (let attempt = 0; attempt < 500; attempt += 1) {\n try {\n descriptor = fs.openSync(lockPath, 'wx', FILE_MODE);\n break;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;\n Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);\n }\n }\n if (descriptor === undefined) throw new Error(`timed out waiting for bundle signing state lock: ${lockPath}`);\n try {\n return operation();\n } finally {\n fs.closeSync(descriptor);\n fs.rmSync(lockPath, { force: true });\n }\n}\n\nfunction atomicWriteState(stateDir: string, state: StoredState): void {\n const destination = path.join(stateDir, SIGNING_FILE);\n const temporary = path.join(stateDir, `.${SIGNING_FILE}.${process.pid}.${randomBytes(8).toString('hex')}`);\n const descriptor = fs.openSync(temporary, 'wx', FILE_MODE);\n try {\n fs.writeFileSync(descriptor, `${JSON.stringify(state, undefined, 2)}\\n`);\n fs.fsyncSync(descriptor);\n } finally {\n fs.closeSync(descriptor);\n }\n try {\n fs.renameSync(temporary, destination);\n fs.chmodSync(destination, FILE_MODE);\n } catch (error) {\n fs.rmSync(temporary, { force: true });\n throw error;\n }\n}\n\nfunction parseState(value: unknown, keyPath: string): StoredState {\n if (typeof value !== 'object' \|\| value === null) throw new Error(`invalid bundle signing state: ${keyPath}`);\n const candidate = value as Partial<StoredState>;\n if (typeof candidate.privateKey !== 'string' \|\| typeof candidate.publicKey !== 'string') {\n throw new Error(`invalid bundle signing state: ${keyPath}`);\n }\n const revision = candidate.revision === undefined ? 0 : candidate.revision;\n if (!Number.isSafeInteger(revision) \|\| revision < 0) throw new Error(`invalid bundle signing revision: ${keyPath}`);\n let derived: string;\n try {\n derived = publicKeyOf(candidate.privateKey);\n } catch {\n throw new Error(`invalid bundle signing private key: ${keyPath}`);\n }\n if (derived !== candidate.publicKey) throw new Error(`bundle signing keys do not match: ${keyPath}`);\n return { privateKey: candidate.privateKey, publicKey: candidate.publicKey, revision };\n}\n\nfunction loadOrCreateState(stateDir: string): StoredState {\n return withStateLock(stateDir, () => {\n const keyPath = path.join(stateDir, SIGNING_FILE);\n try {\n const stat = fs.lstatSync(keyPath);\n if (!stat.isFile() \|\| stat.isSymbolicLink()) throw new Error(`invalid bundle signing state file: ${keyPath}`);\n const parsed: unknown = JSON.parse(fs.readFileSync(keyPath, 'utf8'));\n const state = parseState(parsed, keyPath);\n fs.chmodSync(keyPath, FILE_MODE);\n if ((parsed as Partial<StoredState>).revision === undefined) atomicWriteState(stateDir, state);\n return state;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n }\n\n const pair = generateKeyPairSync('ec', {\n namedCurve: CURVE,\n privateKeyEncoding: { type: 'pkcs8', format: 'pem' },\n publicKeyEncoding: { type: 'spki', format: 'der' },\n });\n const state: StoredState = {\n privateKey: pair.privateKey,\n publicKey: Buffer.from(pair.publicKey).toString('base64url'),\n revision: 0,\n };\n atomicWriteState(stateDir, state);\n return state;\n });\n}\n\nfunction reserveRevision(stateDir: string, expectedPublicKey: string): number {\n return withStateLock(stateDir, () => {\n const keyPath = path.join(stateDir, SIGNING_FILE);\n const state = parseState(JSON.parse(fs.readFileSync(keyPath, 'utf8')) as unknown, keyPath);\n if (state.publicKey !== expectedPublicKey)\n throw new Error('bundle signing key changed while the signer was active');\n if (state.revision === Number.MAX_SAFE_INTEGER) throw new Error('bundle signing revision is exhausted');\n const next = { ...state, revision: state.revision + 1 };\n atomicWriteState(stateDir, next);\n return next.revision;\n });\n}\n\nfunction contentTypeFor(filePath: string): string {\n return MIME_TYPES[path.extname(filePath).toLowerCase()] ?? 'application/octet-stream';\n}\n\n/* Every servable regular file under the asset root, as browser paths. /\nfunction walk(root: string, current: string, into: BundleAsset[]): void {\n const entries = fs.readdirSync(current, { withFileTypes: true });\n for (const entry of entries) {\n const full = path.join(current, entry.name);\n const stat = fs.lstatSync(full);\n if (stat.isSymbolicLink()) throw new Error(`refusing to sign symbolic link: ${full}`);\n if (stat.isDirectory()) {\n walk(root, full, into);\n continue;\n }\n if (!stat.isFile()) throw new Error(`refusing to omit unsupported asset: ${full}`);\n if (SKIPPED.has(path.extname(entry.name))) continue;\n const bytes = fs.readFileSync(full);\n into.push({\n path: `/${path\n .relative(root, full)\n .split(path.sep)\n .map((segment) => encodeURIComponent(segment))\n .join('/')}`,\n sha256: createHash('sha256').update(bytes).digest('hex'),\n byteLength: bytes.byteLength,\n contentType: contentTypeFor(full),\n });\n }\n}\n\nexport function createBundleSigner(stateDir: string, _onNotice: (message: string) => void = () => {}): BundleSigner {\n const key = loadOrCreateState(stateDir);\n const privateKey = createPrivateKey(key.privateKey);\n const cache = new Map<string, SignedBundleManifest \| undefined>();\n const cacheKeyOf = (assetsDir: string, profile: BundleProfile): string => `${profile}:${path.resolve(assetsDir)}`;\n\n const signFresh = (assetsDir: string, profile: BundleProfile): SignedBundleManifest \| undefined => {\n const rootStat = fs.lstatSync(assetsDir);\n if (!rootStat.isDirectory() \|\| rootStat.isSymbolicLink()) {\n throw new Error(`refusing to sign an unsafe asset root: ${assetsDir}`);\n }\n const assets: BundleAsset[] = [];\n walk(assetsDir, assetsDir, assets);\n if (assets.length === 0) return undefined;\n assets.sort((left, right) => left.path.localeCompare(right.path));\n const manifest: BundleManifest = {\n version: BUNDLE_MANIFEST_VERSION,\n revision: reserveRevision(stateDir, key.publicKey),\n builtAt: Date.now(),\n assets,\n };\n if (!isBundleManifest(manifest, profile)) throw new Error(`refusing to sign an invalid ${profile} bundle manifest`);\n const signature = createSign(SIGN_ALGORITHM)\n .update(canonicalManifest(manifest))\n .sign({ key: privateKey, dsaEncoding: 'ieee-p1363' })\n .toString('base64url');\n return { manifest, signature, publicKey: key.publicKey };\n };\n\n const sign = (assetsDir: string, profile: BundleProfile = 'web'): SignedBundleManifest \| undefined => {\n const cacheKey = cacheKeyOf(assetsDir, profile);\n if (cache.has(cacheKey)) return cache.get(cacheKey);\n const signed = signFresh(path.resolve(assetsDir), profile);\n cache.set(cacheKey, signed);\n return signed;\n };\n\n return {\n publicKey: () => key.publicKey,\n sign,\n refresh(assetsDir, profile = 'web') {\n cache.delete(cacheKeyOf(assetsDir, profile));\n return sign(assetsDir, profile);\n },\n invalidate(assetsDir) {\n if (assetsDir === undefined) {\n cache.clear();\n return;\n }\n for (const profile of PROFILES) cache.delete(cacheKeyOf(assetsDir, profile));\n },\n attest(tag, fields) {\n return createSign(SIGN_ALGORITHM)\n .update(attestationBytes(tag, fields))\n .sign({ key: privateKey, dsaEncoding: 'ieee-p1363' })\n .toString('base64url');\n },\n };\n}\n\n/* Re-derives the public key from a stored private key. */\nexport function publicKeyOf(privateKeyPem: string): string {\n return Buffer.from(createPublicKey(privateKeyPem).export({ type: 'spki', format: 'der' }) as Buffer).toString(\n 'base64url',\n );\n}\n"],"mappings":"mNAsBA,MAAMgB,EAAe,eAKfC,EAAiB,SACjBC,kBAAU,IAAI,IAAI,CAAC,MAAM,CAAC,EAC1BC,EAAqC,CAAC,MAAO,QAAQ,EACrDC,EAA+C,CACnD,OAAQ,WACR,OAAQ,YACR,QAAS,YACT,OAAQ,eACR,QAAS,aACT,OAAQ,aACR,MAAO,kBACP,QAAS,mBACT,OAAQ,kBACR,OAAQ,YACR,OAAQ,gBACR,OAAQ,aACR,QAAS,mBACT,QAAS,aACT,QAAS,YACT,SAAU,YACZ,EA2BA,SAASC,EAAqB,EAAwB,CACpDP,EAAA,QAAG,UAAUQ,EAAU,CAAE,UAAW,GAAM,KAAM,GAAe,CAAC,EAChE,IAAMC,EAAOvB,EAAAA,QAAG,UAAUsB,CAAQ,EAClC,GAAI,CAACC,EAAK,YAAY,GAAKA,EAAK,eAAe,EAC7C,MAAU,MAAM,4CAA4CD,GAAU,EACxER,EAAA,QAAG,UAAUQ,EAAU,GAAc,CACvC,CAEA,SAASE,EAAiB,EAAkB,EAAuB,CACjEH,EAAqBC,CAAQ,EAC7B,IAAMG,EAAWxB,EAAAA,QAAK,KAAKqB,EAAU,cAAS,EAC1CI,EACJ,IAAK,IAAIC,EAAU,EAAGA,EAAU,IAAK,GAAW,EAC9C,GAAI,CACF,EAAa3B,EAAAA,QAAG,SAASyB,EAAU,KAAM,GAAS,EAClD,KACF,OAASG,EAAO,CACd,GAAKA,EAAgC,OAAS,SAAU,MAAMA,EAC9D,QAAQ,KAAK,IAAI,WAAW,IAAI,kBAAkB,CAAC,CAAC,EAAG,EAAG,EAAG,EAAE,CACjE,CAEF,GAAIF,IAAe,IAAA,GAAW,MAAU,MAAM,oDAAoDD,GAAU,EAC5G,GAAI,CACF,OAAOI,EAAU,CACnB,QAAU,CACRf,EAAA,QAAG,UAAUY,CAAU,EACvBZ,EAAA,QAAG,OAAOW,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,CACF,CAEA,SAASK,EAAiB,EAAkB,EAA0B,CACpE,IAAMC,EAAc9B,EAAAA,QAAK,KAAKqB,EAAUN,CAAY,EAC9CgB,EAAY/B,EAAAA,QAAK,KAAKqB,EAAU,IAAIN,EAAa,GAAG,QAAQ,IAAI,IAAA,EAAGd,EAAAA,YAAAA,CAAY,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,EACnGwB,EAAa1B,EAAAA,QAAG,SAASgC,EAAW,KAAM,GAAS,EACzD,GAAI,CACFlB,EAAA,QAAG,cAAcY,EAAY,GAAG,KAAK,UAAUO,EAAO,IAAA,GAAW,CAAC,EAAE,GAAG,EACvEnB,EAAA,QAAG,UAAUY,CAAU,CACzB,QAAU,CACRZ,EAAA,QAAG,UAAUY,CAAU,CACzB,CACA,GAAI,CACFZ,EAAA,QAAG,WAAWkB,EAAWD,CAAW,EACpCjB,EAAA,QAAG,UAAUiB,EAAa,GAAS,CACrC,OAASH,EAAO,CAEd,MADAd,EAAA,QAAG,OAAOkB,EAAW,CAAE,MAAO,EAAK,CAAC,EAC9BJ,CACR,CACF,CAEA,SAASM,EAAW,EAAgB,EAA8B,CAChE,GAAI,OAAOC,GAAU,WAAYA,EAAgB,MAAU,MAAM,iCAAiCC,GAAS,EAC3G,IAAMC,EAAYF,EAClB,GAAI,OAAOE,EAAU,YAAe,UAAY,OAAOA,EAAU,WAAc,SAC7E,MAAU,MAAM,iCAAiCD,GAAS,EAE5D,IAAME,EAAWD,EAAU,WAAa,IAAA,GAAY,EAAIA,EAAU,SAClE,GAAI,CAAC,OAAO,cAAcC,CAAQ,GAAKA,EAAW,EAAG,MAAU,MAAM,oCAAoCF,GAAS,EAClH,IAAIG,EACJ,GAAI,CACF,EAAUC,EAAYH,EAAU,UAAU,CAC5C,MAAQ,CACN,MAAU,MAAM,uCAAuCD,GAAS,CAClE,CACA,GAAIG,IAAYF,EAAU,UAAW,MAAU,MAAM,qCAAqCD,GAAS,EACnG,MAAO,CAAE,WAAYC,EAAU,WAAY,UAAWA,EAAU,UAAW,UAAS,CACtF,CAEA,SAASI,EAAkB,EAA+B,CACxD,OAAOjB,EAAcF,MAAgB,CACnC,IAAMc,EAAUnC,EAAAA,QAAK,KAAKqB,EAAUN,CAAY,EAChD,GAAI,CACF,IAAMO,EAAOvB,EAAAA,QAAG,UAAUoC,CAAO,EACjC,GAAI,CAACb,EAAK,OAAO,GAAKA,EAAK,eAAe,EAAG,MAAU,MAAM,sCAAsCa,GAAS,EAC5G,IAAMM,EAAkB,KAAK,MAAM1C,EAAAA,QAAG,aAAaoC,EAAS,MAAM,CAAC,EAC7DH,EAAQC,EAAWQ,EAAQN,CAAO,EAGxC,OAFAtB,EAAA,QAAG,UAAUsB,EAAS,GAAS,EAC1BM,EAAgC,WAAa,IAAA,IAAWZ,EAAiBR,EAAUW,CAAK,EACtFA,CACT,OAASL,EAAO,CACd,GAAKA,EAAgC,OAAS,SAAU,MAAMA,CAChE,CAEA,IAAMe,GAAA,EAAOxC,EAAAA,oBAAAA,CAAoB,KAAM,CACrC,WAAY,aACZ,mBAAoB,CAAE,KAAM,QAAS,OAAQ,KAAM,EACnD,kBAAmB,CAAE,KAAM,OAAQ,OAAQ,KAAM,CACnD,CAAC,EACK8B,EAAqB,CACzB,WAAYU,EAAK,WACjB,UAAW,OAAO,KAAKA,EAAK,SAAS,CAAC,CAAC,SAAS,WAAW,EAC3D,SAAU,CACZ,EAEA,OADAb,EAAiBR,EAAUW,CAAK,EACzBA,CACT,CAAC,CACH,CAEA,SAASW,EAAgB,EAAkB,EAAmC,CAC5E,OAAOpB,EAAcF,MAAgB,CACnC,IAAMc,EAAUnC,EAAAA,QAAK,KAAKqB,EAAUN,CAAY,EAC1CiB,EAAQC,EAAW,KAAK,MAAMlC,EAAAA,QAAG,aAAaoC,EAAS,MAAM,CAAC,EAAcA,CAAO,EACzF,GAAIH,EAAM,YAAcY,EACtB,MAAU,MAAM,wDAAwD,EAC1E,GAAIZ,EAAM,mBAAsC,MAAU,MAAM,sCAAsC,EACtG,IAAMa,EAAO,CAAE,GAAGb,EAAO,SAAUA,EAAM,SAAW,CAAE,EAEtD,OADAH,EAAiBR,EAAUwB,CAAI,EACxBA,EAAK,QACd,CAAC,CACH,CAEA,SAASC,EAAe,EAA0B,CAChD,OAAO3B,EAAWnB,EAAAA,QAAK,QAAQ+C,CAAQ,CAAC,CAAC,YAAY,IAAM,0BAC7D,CAGA,SAASC,EAAK,EAAc,EAAiB,EAA2B,CACtE,IAAMC,EAAUlD,EAAAA,QAAG,YAAYmD,EAAS,CAAE,cAAe,EAAK,CAAC,EAC/D,IAAK,IAAMC,KAASF,EAAS,CAC3B,IAAMG,EAAOpD,EAAAA,QAAK,KAAKkD,EAASC,EAAM,IAAI,EACpC7B,EAAOvB,EAAAA,QAAG,UAAUqD,CAAI,EAC9B,GAAI9B,EAAK,eAAe,EAAG,MAAU,MAAM,mCAAmC8B,GAAM,EACpF,GAAI9B,EAAK,YAAY,EAAG,CACtB0B,EAAKK,EAAMD,EAAME,CAAI,EACrB,QACF,CACA,GAAI,CAAChC,EAAK,OAAO,EAAG,MAAU,MAAM,uCAAuC8B,GAAM,EACjF,GAAInC,EAAQ,IAAIjB,EAAAA,QAAK,QAAQmD,EAAM,IAAI,CAAC,EAAG,SAC3C,IAAMI,EAAQxD,EAAAA,QAAG,aAAaqD,CAAI,EAClCE,EAAK,KAAK,CACR,KAAM,IAAItD,EAAAA,QACP,SAASqD,EAAMD,CAAI,CAAC,CACpB,MAAMpD,EAAAA,QAAK,GAAG,CAAC,CACf,IAAK,GAAY,mBAAmBwD,CAAO,CAAC,CAAC,CAC7C,KAAK,GAAG,IACX,QAAA,EAAQrD,EAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAOoD,CAAK,CAAC,CAAC,OAAO,KAAK,EACvD,WAAYA,EAAM,WAClB,YAAaT,EAAeM,CAAI,CAClC,CAAC,CACH,CACF,CAEA,SAAgBK,EAAmB,EAAkB,MAA6C,CAAC,EAAiB,CAClH,IAAMC,EAAMlB,EAAkBnB,CAAQ,EAChCsC,GAAA,EAAavD,EAAAA,iBAAAA,CAAiBsD,EAAI,UAAU,EAC5CE,kBAAQ,IAAI,IACZC,GAAc,EAAmB,IAAmC,GAAGC,EAAQ,GAAG9D,EAAAA,QAAK,QAAQ+D,CAAS,IAExGC,GAAa,EAAmB,IAA6D,CACjG,IAAMC,EAAWlE,EAAAA,QAAG,UAAUgE,CAAS,EACvC,GAAI,CAACE,EAAS,YAAY,GAAKA,EAAS,eAAe,EACrD,MAAU,MAAM,0CAA0CF,GAAW,EAEvE,IAAMG,EAAwB,CAAC,EAE/B,GADAlB,EAAKe,EAAWA,EAAWG,CAAM,EAC7BA,EAAO,SAAW,EAAG,OACzBA,EAAO,MAAM,EAAM,IAAUC,EAAK,KAAK,cAAcC,EAAM,IAAI,CAAC,EAChE,IAAMC,EAA2B,CAC/B,QAAA,EACA,SAAU1B,EAAgBtB,EAAUqC,EAAI,SAAS,EACjD,QAAS,KAAK,IAAI,EAClB,QACF,EACA,GAAI,CAACrD,EAAAA,iBAAiBgE,EAAUP,CAAO,EAAG,MAAU,MAAM,+BAA+BA,EAAQ,iBAAiB,EAKlH,MAAO,CAAE,WAAU,WAAA,EAJDxD,EAAAA,WAAAA,CAAWU,CAAc,CAAC,CACzC,OAAOT,EAAAA,kBAAkB8D,CAAQ,CAAC,CAAC,CACnC,KAAK,CAAE,IAAKV,EAAY,YAAa,YAAa,CAAC,CAAC,CACpD,SAAS,WACe,EAAG,UAAWD,EAAI,SAAU,CACzD,EAEMY,GAAQ,EAAmB,EAAyB,QAA4C,CACpG,IAAMC,EAAWV,EAAWE,EAAWD,CAAO,EAC9C,GAAIF,EAAM,IAAIW,CAAQ,EAAG,OAAOX,EAAM,IAAIW,CAAQ,EAClD,IAAMC,EAASR,EAAUhE,EAAAA,QAAK,QAAQ+D,CAAS,EAAGD,CAAO,EAEzD,OADAF,EAAM,IAAIW,EAAUC,CAAM,EACnBA,CACT,EAEA,MAAO,CACL,cAAiBd,EAAI,UACrB,OACA,QAAQ,EAAW,EAAU,MAAO,CAElC,OADAE,EAAM,OAAOC,EAAWE,EAAWD,CAAO,CAAC,EACpCQ,EAAKP,EAAWD,CAAO,CAChC,EACA,WAAW,EAAW,CACpB,GAAIC,IAAc,IAAA,GAChBH,EAAM,MAAM,OAGd,IAAK,IAAME,KAAW5C,EAAU0C,EAAM,OAAOC,EAAWE,EAAWD,CAAO,CAAC,CAC7E,EACA,OAAO,EAAK,EAAQ,CAClB,OAAA,EAAOxD,EAAAA,WAAAA,CAAWU,CAAc,CAAC,CAC9B,OAAOR,EAAAA,iBAAiBiE,EAAKC,CAAM,CAAC,CAAC,CACrC,KAAK,CAAE,IAAKf,EAAY,YAAa,YAAa,CAAC,CAAC,CACpD,SAAS,WAAW,CACzB,CACF,CACF,CAGA,SAAgBpB,EAAY,EAA+B,CACzD,OAAO,OAAO,MAAA,EAAK9B,EAAAA,gBAAAA,CAAgBkE,CAAa,CAAC,CAAC,OAAO,CAAE,KAAM,OAAQ,OAAQ,KAAM,CAAC,CAAW,CAAC,CAAC,SACnG,WACF,CACF"}
1	+ {"version":3,"file":"index.cjs","names":["fs","path","randomBytes","generateKeyPairSync","createHash","createPrivateKey","isBundleManifest","createSign","canonicalManifest","attestationBytes","createPublicKey","require_runtime","require_bundleManifest","node_crypto","node_fs","node_path","SIGNING_FILE","SIGN_ALGORITHM","SKIPPED","PROFILES","MIME_TYPES","ensureStateDirectory","stateDir","stat","withStateLock","lockPath","descriptor","attempt","error","operation","atomicWriteState","destination","temporary","state","parseState","value","keyPath","candidate","revision","derived","publicKeyOf","loadOrCreateState","parsed","pair","reserveRevision","expectedPublicKey","next","contentTypeFor","filePath","walk","entries","current","entry","full","root","into","bytes","segment","createBundleSigner","key","privateKey","cache","cacheKeyOf","profile","assetsDir","signFresh","rootStat","assets","left","right","manifest","sign","cacheKey","signed","tag","fields","privateKeyPem"],"sources":["../../../src/services/bundleSigner/index.ts"],"sourcesContent":["import {\n createHash,\n createPrivateKey,\n createPublicKey,\n createSign,\n generateKeyPairSync,\n randomBytes,\n} from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n BUNDLE_MANIFEST_VERSION,\n type BundleAsset,\n type BundleManifest,\n type BundleProfile,\n type SignedBundleManifest,\n attestationBytes,\n canonicalManifest,\n isBundleManifest,\n} from '../../types/bundleManifest';\n\nconst SIGNING_FILE = 'signing.json';\nconst LOCK_FILE = 'signing.lock';\nconst FILE_MODE = 0o600;\nconst DIRECTORY_MODE = 0o700;\nconst CURVE = 'prime256v1';\nconst SIGN_ALGORITHM = 'sha256';\nconst SKIPPED = new Set(['.map']);\nconst PROFILES: readonly BundleProfile[] = ['web', 'native', 'app'];\nconst MIME_TYPES: Readonly<Record<string, string>> = {\n '.css': 'text/css',\n '.gif': 'image/gif',\n '.html': 'text/html',\n '.ico': 'image/x-icon',\n '.jpeg': 'image/jpeg',\n '.jpg': 'image/jpeg',\n '.js': 'text/javascript',\n '.json': 'application/json',\n '.mjs': 'text/javascript',\n '.png': 'image/png',\n '.svg': 'image/svg+xml',\n '.txt': 'text/plain',\n '.wasm': 'application/wasm',\n '.webp': 'image/webp',\n '.woff': 'font/woff',\n '.woff2': 'font/woff2',\n};\n\nexport interface BundleSigner {\n /** Base64url SPKI for an independently trusted verifier to pin. /\n publicKey(): string;\n /\n Hashes and signs once per asset directory and profile. Undefined when the bundle is empty. Throws\n * when the assets do not match the profile.\n /\n sign(assetsDir: string, profile?: BundleProfile): SignedBundleManifest \| undefined;\n /* Invalidates and immediately rebuilds one cached manifest. /\n refresh(assetsDir: string, profile?: BundleProfile): SignedBundleManifest \| undefined;\n /* Invalidates one cached directory under every profile, or every cached directory when omitted. /\n invalidate(assetsDir?: string): void;\n /\n Base64url IEEE P1363 signature over `attestationBytes(tag, fields)` with the bundle key. Throws on a\n * malformed tag.\n /\n attest(tag: string, fields: readonly string[]): string;\n}\n\ninterface StoredState {\n privateKey: string;\n publicKey: string;\n revision: number;\n}\n\nfunction ensureStateDirectory(stateDir: string): void {\n fs.mkdirSync(stateDir, { recursive: true, mode: DIRECTORY_MODE });\n const stat = fs.lstatSync(stateDir);\n if (!stat.isDirectory() \|\| stat.isSymbolicLink())\n throw new Error(`bundle signing state is not a directory: ${stateDir}`);\n fs.chmodSync(stateDir, DIRECTORY_MODE);\n}\n\nfunction withStateLock<T>(stateDir: string, operation: () => T): T {\n ensureStateDirectory(stateDir);\n const lockPath = path.join(stateDir, LOCK_FILE);\n let descriptor: number \| undefined;\n for (let attempt = 0; attempt < 500; attempt += 1) {\n try {\n descriptor = fs.openSync(lockPath, 'wx', FILE_MODE);\n break;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;\n Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);\n }\n }\n if (descriptor === undefined) throw new Error(`timed out waiting for bundle signing state lock: ${lockPath}`);\n try {\n return operation();\n } finally {\n fs.closeSync(descriptor);\n fs.rmSync(lockPath, { force: true });\n }\n}\n\nfunction atomicWriteState(stateDir: string, state: StoredState): void {\n const destination = path.join(stateDir, SIGNING_FILE);\n const temporary = path.join(stateDir, `.${SIGNING_FILE}.${process.pid}.${randomBytes(8).toString('hex')}`);\n const descriptor = fs.openSync(temporary, 'wx', FILE_MODE);\n try {\n fs.writeFileSync(descriptor, `${JSON.stringify(state, undefined, 2)}\\n`);\n fs.fsyncSync(descriptor);\n } finally {\n fs.closeSync(descriptor);\n }\n try {\n fs.renameSync(temporary, destination);\n fs.chmodSync(destination, FILE_MODE);\n } catch (error) {\n fs.rmSync(temporary, { force: true });\n throw error;\n }\n}\n\nfunction parseState(value: unknown, keyPath: string): StoredState {\n if (typeof value !== 'object' \|\| value === null) throw new Error(`invalid bundle signing state: ${keyPath}`);\n const candidate = value as Partial<StoredState>;\n if (typeof candidate.privateKey !== 'string' \|\| typeof candidate.publicKey !== 'string') {\n throw new Error(`invalid bundle signing state: ${keyPath}`);\n }\n const revision = candidate.revision === undefined ? 0 : candidate.revision;\n if (!Number.isSafeInteger(revision) \|\| revision < 0) throw new Error(`invalid bundle signing revision: ${keyPath}`);\n let derived: string;\n try {\n derived = publicKeyOf(candidate.privateKey);\n } catch {\n throw new Error(`invalid bundle signing private key: ${keyPath}`);\n }\n if (derived !== candidate.publicKey) throw new Error(`bundle signing keys do not match: ${keyPath}`);\n return { privateKey: candidate.privateKey, publicKey: candidate.publicKey, revision };\n}\n\nfunction loadOrCreateState(stateDir: string): StoredState {\n return withStateLock(stateDir, () => {\n const keyPath = path.join(stateDir, SIGNING_FILE);\n try {\n const stat = fs.lstatSync(keyPath);\n if (!stat.isFile() \|\| stat.isSymbolicLink()) throw new Error(`invalid bundle signing state file: ${keyPath}`);\n const parsed: unknown = JSON.parse(fs.readFileSync(keyPath, 'utf8'));\n const state = parseState(parsed, keyPath);\n fs.chmodSync(keyPath, FILE_MODE);\n if ((parsed as Partial<StoredState>).revision === undefined) atomicWriteState(stateDir, state);\n return state;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n }\n\n const pair = generateKeyPairSync('ec', {\n namedCurve: CURVE,\n privateKeyEncoding: { type: 'pkcs8', format: 'pem' },\n publicKeyEncoding: { type: 'spki', format: 'der' },\n });\n const state: StoredState = {\n privateKey: pair.privateKey,\n publicKey: Buffer.from(pair.publicKey).toString('base64url'),\n revision: 0,\n };\n atomicWriteState(stateDir, state);\n return state;\n });\n}\n\nfunction reserveRevision(stateDir: string, expectedPublicKey: string): number {\n return withStateLock(stateDir, () => {\n const keyPath = path.join(stateDir, SIGNING_FILE);\n const state = parseState(JSON.parse(fs.readFileSync(keyPath, 'utf8')) as unknown, keyPath);\n if (state.publicKey !== expectedPublicKey)\n throw new Error('bundle signing key changed while the signer was active');\n if (state.revision === Number.MAX_SAFE_INTEGER) throw new Error('bundle signing revision is exhausted');\n const next = { ...state, revision: state.revision + 1 };\n atomicWriteState(stateDir, next);\n return next.revision;\n });\n}\n\nfunction contentTypeFor(filePath: string): string {\n return MIME_TYPES[path.extname(filePath).toLowerCase()] ?? 'application/octet-stream';\n}\n\n/* Every servable regular file under the asset root, as browser paths. /\nfunction walk(root: string, current: string, into: BundleAsset[]): void {\n const entries = fs.readdirSync(current, { withFileTypes: true });\n for (const entry of entries) {\n const full = path.join(current, entry.name);\n const stat = fs.lstatSync(full);\n if (stat.isSymbolicLink()) throw new Error(`refusing to sign symbolic link: ${full}`);\n if (stat.isDirectory()) {\n walk(root, full, into);\n continue;\n }\n if (!stat.isFile()) throw new Error(`refusing to omit unsupported asset: ${full}`);\n if (SKIPPED.has(path.extname(entry.name))) continue;\n const bytes = fs.readFileSync(full);\n into.push({\n path: `/${path\n .relative(root, full)\n .split(path.sep)\n .map((segment) => encodeURIComponent(segment))\n .join('/')}`,\n sha256: createHash('sha256').update(bytes).digest('hex'),\n byteLength: bytes.byteLength,\n contentType: contentTypeFor(full),\n });\n }\n}\n\nexport function createBundleSigner(stateDir: string, _onNotice: (message: string) => void = () => {}): BundleSigner {\n const key = loadOrCreateState(stateDir);\n const privateKey = createPrivateKey(key.privateKey);\n const cache = new Map<string, SignedBundleManifest \| undefined>();\n const cacheKeyOf = (assetsDir: string, profile: BundleProfile): string => `${profile}:${path.resolve(assetsDir)}`;\n\n const signFresh = (assetsDir: string, profile: BundleProfile): SignedBundleManifest \| undefined => {\n const rootStat = fs.lstatSync(assetsDir);\n if (!rootStat.isDirectory() \|\| rootStat.isSymbolicLink()) {\n throw new Error(`refusing to sign an unsafe asset root: ${assetsDir}`);\n }\n const assets: BundleAsset[] = [];\n walk(assetsDir, assetsDir, assets);\n if (assets.length === 0) return undefined;\n assets.sort((left, right) => left.path.localeCompare(right.path));\n const manifest: BundleManifest = {\n version: BUNDLE_MANIFEST_VERSION,\n revision: reserveRevision(stateDir, key.publicKey),\n builtAt: Date.now(),\n assets,\n };\n if (!isBundleManifest(manifest, profile)) throw new Error(`refusing to sign an invalid ${profile} bundle manifest`);\n const signature = createSign(SIGN_ALGORITHM)\n .update(canonicalManifest(manifest))\n .sign({ key: privateKey, dsaEncoding: 'ieee-p1363' })\n .toString('base64url');\n return { manifest, signature, publicKey: key.publicKey };\n };\n\n const sign = (assetsDir: string, profile: BundleProfile = 'web'): SignedBundleManifest \| undefined => {\n const cacheKey = cacheKeyOf(assetsDir, profile);\n if (cache.has(cacheKey)) return cache.get(cacheKey);\n const signed = signFresh(path.resolve(assetsDir), profile);\n cache.set(cacheKey, signed);\n return signed;\n };\n\n return {\n publicKey: () => key.publicKey,\n sign,\n refresh(assetsDir, profile = 'web') {\n cache.delete(cacheKeyOf(assetsDir, profile));\n return sign(assetsDir, profile);\n },\n invalidate(assetsDir) {\n if (assetsDir === undefined) {\n cache.clear();\n return;\n }\n for (const profile of PROFILES) cache.delete(cacheKeyOf(assetsDir, profile));\n },\n attest(tag, fields) {\n return createSign(SIGN_ALGORITHM)\n .update(attestationBytes(tag, fields))\n .sign({ key: privateKey, dsaEncoding: 'ieee-p1363' })\n .toString('base64url');\n },\n };\n}\n\n/* Re-derives the public key from a stored private key. */\nexport function publicKeyOf(privateKeyPem: string): string {\n return Buffer.from(createPublicKey(privateKeyPem).export({ type: 'spki', format: 'der' }) as Buffer).toString(\n 'base64url',\n );\n}\n"],"mappings":"mNAsBA,MAAMgB,EAAe,eAKfC,EAAiB,SACjBC,kBAAU,IAAI,IAAI,CAAC,MAAM,CAAC,EAC1BC,EAAqC,CAAC,MAAO,SAAU,KAAK,EAC5DC,EAA+C,CACnD,OAAQ,WACR,OAAQ,YACR,QAAS,YACT,OAAQ,eACR,QAAS,aACT,OAAQ,aACR,MAAO,kBACP,QAAS,mBACT,OAAQ,kBACR,OAAQ,YACR,OAAQ,gBACR,OAAQ,aACR,QAAS,mBACT,QAAS,aACT,QAAS,YACT,SAAU,YACZ,EA2BA,SAASC,EAAqB,EAAwB,CACpDP,EAAA,QAAG,UAAUQ,EAAU,CAAE,UAAW,GAAM,KAAM,GAAe,CAAC,EAChE,IAAMC,EAAOvB,EAAAA,QAAG,UAAUsB,CAAQ,EAClC,GAAI,CAACC,EAAK,YAAY,GAAKA,EAAK,eAAe,EAC7C,MAAU,MAAM,4CAA4CD,GAAU,EACxER,EAAA,QAAG,UAAUQ,EAAU,GAAc,CACvC,CAEA,SAASE,EAAiB,EAAkB,EAAuB,CACjEH,EAAqBC,CAAQ,EAC7B,IAAMG,EAAWxB,EAAAA,QAAK,KAAKqB,EAAU,cAAS,EAC1CI,EACJ,IAAK,IAAIC,EAAU,EAAGA,EAAU,IAAK,GAAW,EAC9C,GAAI,CACF,EAAa3B,EAAAA,QAAG,SAASyB,EAAU,KAAM,GAAS,EAClD,KACF,OAASG,EAAO,CACd,GAAKA,EAAgC,OAAS,SAAU,MAAMA,EAC9D,QAAQ,KAAK,IAAI,WAAW,IAAI,kBAAkB,CAAC,CAAC,EAAG,EAAG,EAAG,EAAE,CACjE,CAEF,GAAIF,IAAe,IAAA,GAAW,MAAU,MAAM,oDAAoDD,GAAU,EAC5G,GAAI,CACF,OAAOI,EAAU,CACnB,QAAU,CACRf,EAAA,QAAG,UAAUY,CAAU,EACvBZ,EAAA,QAAG,OAAOW,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,CACF,CAEA,SAASK,EAAiB,EAAkB,EAA0B,CACpE,IAAMC,EAAc9B,EAAAA,QAAK,KAAKqB,EAAUN,CAAY,EAC9CgB,EAAY/B,EAAAA,QAAK,KAAKqB,EAAU,IAAIN,EAAa,GAAG,QAAQ,IAAI,IAAA,EAAGd,EAAAA,YAAAA,CAAY,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,EACnGwB,EAAa1B,EAAAA,QAAG,SAASgC,EAAW,KAAM,GAAS,EACzD,GAAI,CACFlB,EAAA,QAAG,cAAcY,EAAY,GAAG,KAAK,UAAUO,EAAO,IAAA,GAAW,CAAC,EAAE,GAAG,EACvEnB,EAAA,QAAG,UAAUY,CAAU,CACzB,QAAU,CACRZ,EAAA,QAAG,UAAUY,CAAU,CACzB,CACA,GAAI,CACFZ,EAAA,QAAG,WAAWkB,EAAWD,CAAW,EACpCjB,EAAA,QAAG,UAAUiB,EAAa,GAAS,CACrC,OAASH,EAAO,CAEd,MADAd,EAAA,QAAG,OAAOkB,EAAW,CAAE,MAAO,EAAK,CAAC,EAC9BJ,CACR,CACF,CAEA,SAASM,EAAW,EAAgB,EAA8B,CAChE,GAAI,OAAOC,GAAU,WAAYA,EAAgB,MAAU,MAAM,iCAAiCC,GAAS,EAC3G,IAAMC,EAAYF,EAClB,GAAI,OAAOE,EAAU,YAAe,UAAY,OAAOA,EAAU,WAAc,SAC7E,MAAU,MAAM,iCAAiCD,GAAS,EAE5D,IAAME,EAAWD,EAAU,WAAa,IAAA,GAAY,EAAIA,EAAU,SAClE,GAAI,CAAC,OAAO,cAAcC,CAAQ,GAAKA,EAAW,EAAG,MAAU,MAAM,oCAAoCF,GAAS,EAClH,IAAIG,EACJ,GAAI,CACF,EAAUC,EAAYH,EAAU,UAAU,CAC5C,MAAQ,CACN,MAAU,MAAM,uCAAuCD,GAAS,CAClE,CACA,GAAIG,IAAYF,EAAU,UAAW,MAAU,MAAM,qCAAqCD,GAAS,EACnG,MAAO,CAAE,WAAYC,EAAU,WAAY,UAAWA,EAAU,UAAW,UAAS,CACtF,CAEA,SAASI,EAAkB,EAA+B,CACxD,OAAOjB,EAAcF,MAAgB,CACnC,IAAMc,EAAUnC,EAAAA,QAAK,KAAKqB,EAAUN,CAAY,EAChD,GAAI,CACF,IAAMO,EAAOvB,EAAAA,QAAG,UAAUoC,CAAO,EACjC,GAAI,CAACb,EAAK,OAAO,GAAKA,EAAK,eAAe,EAAG,MAAU,MAAM,sCAAsCa,GAAS,EAC5G,IAAMM,EAAkB,KAAK,MAAM1C,EAAAA,QAAG,aAAaoC,EAAS,MAAM,CAAC,EAC7DH,EAAQC,EAAWQ,EAAQN,CAAO,EAGxC,OAFAtB,EAAA,QAAG,UAAUsB,EAAS,GAAS,EAC1BM,EAAgC,WAAa,IAAA,IAAWZ,EAAiBR,EAAUW,CAAK,EACtFA,CACT,OAASL,EAAO,CACd,GAAKA,EAAgC,OAAS,SAAU,MAAMA,CAChE,CAEA,IAAMe,GAAA,EAAOxC,EAAAA,oBAAAA,CAAoB,KAAM,CACrC,WAAY,aACZ,mBAAoB,CAAE,KAAM,QAAS,OAAQ,KAAM,EACnD,kBAAmB,CAAE,KAAM,OAAQ,OAAQ,KAAM,CACnD,CAAC,EACK8B,EAAqB,CACzB,WAAYU,EAAK,WACjB,UAAW,OAAO,KAAKA,EAAK,SAAS,CAAC,CAAC,SAAS,WAAW,EAC3D,SAAU,CACZ,EAEA,OADAb,EAAiBR,EAAUW,CAAK,EACzBA,CACT,CAAC,CACH,CAEA,SAASW,EAAgB,EAAkB,EAAmC,CAC5E,OAAOpB,EAAcF,MAAgB,CACnC,IAAMc,EAAUnC,EAAAA,QAAK,KAAKqB,EAAUN,CAAY,EAC1CiB,EAAQC,EAAW,KAAK,MAAMlC,EAAAA,QAAG,aAAaoC,EAAS,MAAM,CAAC,EAAcA,CAAO,EACzF,GAAIH,EAAM,YAAcY,EACtB,MAAU,MAAM,wDAAwD,EAC1E,GAAIZ,EAAM,mBAAsC,MAAU,MAAM,sCAAsC,EACtG,IAAMa,EAAO,CAAE,GAAGb,EAAO,SAAUA,EAAM,SAAW,CAAE,EAEtD,OADAH,EAAiBR,EAAUwB,CAAI,EACxBA,EAAK,QACd,CAAC,CACH,CAEA,SAASC,EAAe,EAA0B,CAChD,OAAO3B,EAAWnB,EAAAA,QAAK,QAAQ+C,CAAQ,CAAC,CAAC,YAAY,IAAM,0BAC7D,CAGA,SAASC,EAAK,EAAc,EAAiB,EAA2B,CACtE,IAAMC,EAAUlD,EAAAA,QAAG,YAAYmD,EAAS,CAAE,cAAe,EAAK,CAAC,EAC/D,IAAK,IAAMC,KAASF,EAAS,CAC3B,IAAMG,EAAOpD,EAAAA,QAAK,KAAKkD,EAASC,EAAM,IAAI,EACpC7B,EAAOvB,EAAAA,QAAG,UAAUqD,CAAI,EAC9B,GAAI9B,EAAK,eAAe,EAAG,MAAU,MAAM,mCAAmC8B,GAAM,EACpF,GAAI9B,EAAK,YAAY,EAAG,CACtB0B,EAAKK,EAAMD,EAAME,CAAI,EACrB,QACF,CACA,GAAI,CAAChC,EAAK,OAAO,EAAG,MAAU,MAAM,uCAAuC8B,GAAM,EACjF,GAAInC,EAAQ,IAAIjB,EAAAA,QAAK,QAAQmD,EAAM,IAAI,CAAC,EAAG,SAC3C,IAAMI,EAAQxD,EAAAA,QAAG,aAAaqD,CAAI,EAClCE,EAAK,KAAK,CACR,KAAM,IAAItD,EAAAA,QACP,SAASqD,EAAMD,CAAI,CAAC,CACpB,MAAMpD,EAAAA,QAAK,GAAG,CAAC,CACf,IAAK,GAAY,mBAAmBwD,CAAO,CAAC,CAAC,CAC7C,KAAK,GAAG,IACX,QAAA,EAAQrD,EAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAOoD,CAAK,CAAC,CAAC,OAAO,KAAK,EACvD,WAAYA,EAAM,WAClB,YAAaT,EAAeM,CAAI,CAClC,CAAC,CACH,CACF,CAEA,SAAgBK,EAAmB,EAAkB,MAA6C,CAAC,EAAiB,CAClH,IAAMC,EAAMlB,EAAkBnB,CAAQ,EAChCsC,GAAA,EAAavD,EAAAA,iBAAAA,CAAiBsD,EAAI,UAAU,EAC5CE,kBAAQ,IAAI,IACZC,GAAc,EAAmB,IAAmC,GAAGC,EAAQ,GAAG9D,EAAAA,QAAK,QAAQ+D,CAAS,IAExGC,GAAa,EAAmB,IAA6D,CACjG,IAAMC,EAAWlE,EAAAA,QAAG,UAAUgE,CAAS,EACvC,GAAI,CAACE,EAAS,YAAY,GAAKA,EAAS,eAAe,EACrD,MAAU,MAAM,0CAA0CF,GAAW,EAEvE,IAAMG,EAAwB,CAAC,EAE/B,GADAlB,EAAKe,EAAWA,EAAWG,CAAM,EAC7BA,EAAO,SAAW,EAAG,OACzBA,EAAO,MAAM,EAAM,IAAUC,EAAK,KAAK,cAAcC,EAAM,IAAI,CAAC,EAChE,IAAMC,EAA2B,CAC/B,QAAA,EACA,SAAU1B,EAAgBtB,EAAUqC,EAAI,SAAS,EACjD,QAAS,KAAK,IAAI,EAClB,QACF,EACA,GAAI,CAACrD,EAAAA,iBAAiBgE,EAAUP,CAAO,EAAG,MAAU,MAAM,+BAA+BA,EAAQ,iBAAiB,EAKlH,MAAO,CAAE,WAAU,WAAA,EAJDxD,EAAAA,WAAAA,CAAWU,CAAc,CAAC,CACzC,OAAOT,EAAAA,kBAAkB8D,CAAQ,CAAC,CAAC,CACnC,KAAK,CAAE,IAAKV,EAAY,YAAa,YAAa,CAAC,CAAC,CACpD,SAAS,WACe,EAAG,UAAWD,EAAI,SAAU,CACzD,EAEMY,GAAQ,EAAmB,EAAyB,QAA4C,CACpG,IAAMC,EAAWV,EAAWE,EAAWD,CAAO,EAC9C,GAAIF,EAAM,IAAIW,CAAQ,EAAG,OAAOX,EAAM,IAAIW,CAAQ,EAClD,IAAMC,EAASR,EAAUhE,EAAAA,QAAK,QAAQ+D,CAAS,EAAGD,CAAO,EAEzD,OADAF,EAAM,IAAIW,EAAUC,CAAM,EACnBA,CACT,EAEA,MAAO,CACL,cAAiBd,EAAI,UACrB,OACA,QAAQ,EAAW,EAAU,MAAO,CAElC,OADAE,EAAM,OAAOC,EAAWE,EAAWD,CAAO,CAAC,EACpCQ,EAAKP,EAAWD,CAAO,CAChC,EACA,WAAW,EAAW,CACpB,GAAIC,IAAc,IAAA,GAChBH,EAAM,MAAM,OAGd,IAAK,IAAME,KAAW5C,EAAU0C,EAAM,OAAOC,EAAWE,EAAWD,CAAO,CAAC,CAC7E,EACA,OAAO,EAAK,EAAQ,CAClB,OAAA,EAAOxD,EAAAA,WAAAA,CAAWU,CAAc,CAAC,CAC9B,OAAOR,EAAAA,iBAAiBiE,EAAKC,CAAM,CAAC,CAAC,CACrC,KAAK,CAAE,IAAKf,EAAY,YAAa,YAAa,CAAC,CAAC,CACpD,SAAS,WAAW,CACzB,CACF,CACF,CAGA,SAAgBpB,EAAY,EAA+B,CACzD,OAAO,OAAO,MAAA,EAAK9B,EAAAA,gBAAAA,CAAgBkE,CAAa,CAAC,CAAC,OAAO,CAAE,KAAM,OAAQ,OAAQ,KAAM,CAAC,CAAW,CAAC,CAAC,SACnG,WACF,CACF"}

package/dist/services/bundleSigner/index.mjs CHANGED Viewed

@@ -1,2 +1,2 @@
-import{attestationBytes as e,canonicalManifest as t,isBundleManifest as n}from"../../types/bundleManifest.mjs";import{createHash as r,createPrivateKey as i,createPublicKey as a,createSign as o,generateKeyPairSync as s,randomBytes as c}from"node:crypto";import l from"node:fs";import u from"node:path";const d=`signing.json`,f=`sha256`,p=/* @__PURE__ */ new Set([`.map`]),m=[`web`,`native`],h={".css":`text/css`,".gif":`image/gif`,".html":`text/html`,".ico":`image/x-icon`,".jpeg":`image/jpeg`,".jpg":`image/jpeg`,".js":`text/javascript`,".json":`application/json`,".mjs":`text/javascript`,".png":`image/png`,".svg":`image/svg+xml`,".txt":`text/plain`,".wasm":`application/wasm`,".webp":`image/webp`,".woff":`font/woff`,".woff2":`font/woff2`};function g(e){l.mkdirSync(e,{recursive:!0,mode:448});let t=l.lstatSync(e);if(!t.isDirectory()||t.isSymbolicLink())throw Error(`bundle signing state is not a directory: ${e}`);l.chmodSync(e,448)}function _(e,t){g(e);let n=u.join(e,`signing.lock`),r;for(let e=0;e<500;e+=1)try{r=l.openSync(n,`wx`,384);break}catch(e){if(e.code!==`EEXIST`)throw e;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,10)}if(r===void 0)throw Error(`timed out waiting for bundle signing state lock: ${n}`);try{return t()}finally{l.closeSync(r),l.rmSync(n,{force:!0})}}function v(e,t){let n=u.join(e,d),r=u.join(e,`.${d}.${process.pid}.${c(8).toString(`hex`)}`),i=l.openSync(r,`wx`,384);try{l.writeFileSync(i,`${JSON.stringify(t,void 0,2)}\n`),l.fsyncSync(i)}finally{l.closeSync(i)}try{l.renameSync(r,n),l.chmodSync(n,384)}catch(e){throw l.rmSync(r,{force:!0}),e}}function y(e,t){if(typeof e!=`object`||!e)throw Error(`invalid bundle signing state: ${t}`);let n=e;if(typeof n.privateKey!=`string`||typeof n.publicKey!=`string`)throw Error(`invalid bundle signing state: ${t}`);let r=n.revision===void 0?0:n.revision;if(!Number.isSafeInteger(r)||r<0)throw Error(`invalid bundle signing revision: ${t}`);let i;try{i=T(n.privateKey)}catch{throw Error(`invalid bundle signing private key: ${t}`)}if(i!==n.publicKey)throw Error(`bundle signing keys do not match: ${t}`);return{privateKey:n.privateKey,publicKey:n.publicKey,revision:r}}function b(e){return _(e,()=>{let t=u.join(e,d);try{let n=l.lstatSync(t);if(!n.isFile()||n.isSymbolicLink())throw Error(`invalid bundle signing state file: ${t}`);let r=JSON.parse(l.readFileSync(t,`utf8`)),i=y(r,t);return l.chmodSync(t,384),r.revision===void 0&&v(e,i),i}catch(e){if(e.code!==`ENOENT`)throw e}let n=s(`ec`,{namedCurve:`prime256v1`,privateKeyEncoding:{type:`pkcs8`,format:`pem`},publicKeyEncoding:{type:`spki`,format:`der`}}),r={privateKey:n.privateKey,publicKey:Buffer.from(n.publicKey).toString(`base64url`),revision:0};return v(e,r),r})}function x(e,t){return _(e,()=>{let n=u.join(e,d),r=y(JSON.parse(l.readFileSync(n,`utf8`)),n);if(r.publicKey!==t)throw Error(`bundle signing key changed while the signer was active`);if(r.revision===2**53-1)throw Error(`bundle signing revision is exhausted`);let i={...r,revision:r.revision+1};return v(e,i),i.revision})}function S(e){return h[u.extname(e).toLowerCase()]??`application/octet-stream`}function C(e,t,n){let i=l.readdirSync(t,{withFileTypes:!0});for(let a of i){let i=u.join(t,a.name),o=l.lstatSync(i);if(o.isSymbolicLink())throw Error(`refusing to sign symbolic link: ${i}`);if(o.isDirectory()){C(e,i,n);continue}if(!o.isFile())throw Error(`refusing to omit unsupported asset: ${i}`);if(p.has(u.extname(a.name)))continue;let s=l.readFileSync(i);n.push({path:`/${u.relative(e,i).split(u.sep).map(e=>encodeURIComponent(e)).join(`/`)}`,sha256:r(`sha256`).update(s).digest(`hex`),byteLength:s.byteLength,contentType:S(i)})}}function w(r,a=()=>{}){let s=b(r),c=i(s.privateKey),d=/* @__PURE__ */ new Map,p=(e,t)=>`${t}:${u.resolve(e)}`,h=(e,i)=>{let a=l.lstatSync(e);if(!a.isDirectory()||a.isSymbolicLink())throw Error(`refusing to sign an unsafe asset root: ${e}`);let u=[];if(C(e,e,u),u.length===0)return;u.sort((e,t)=>e.path.localeCompare(t.path));let d={version:2,revision:x(r,s.publicKey),builtAt:Date.now(),assets:u};if(!n(d,i))throw Error(`refusing to sign an invalid ${i} bundle manifest`);return{manifest:d,signature:o(f).update(t(d)).sign({key:c,dsaEncoding:`ieee-p1363`}).toString(`base64url`),publicKey:s.publicKey}},g=(e,t=`web`)=>{let n=p(e,t);if(d.has(n))return d.get(n);let r=h(u.resolve(e),t);return d.set(n,r),r};return{publicKey:()=>s.publicKey,sign:g,refresh(e,t=`web`){return d.delete(p(e,t)),g(e,t)},invalidate(e){if(e===void 0)d.clear();else for(let t of m)d.delete(p(e,t))},attest(t,n){return o(f).update(e(t,n)).sign({key:c,dsaEncoding:`ieee-p1363`}).toString(`base64url`)}}}function T(e){return Buffer.from(a(e).export({type:`spki`,format:`der`})).toString(`base64url`)}export{w as createBundleSigner,T as publicKeyOf};
+import{attestationBytes as e,canonicalManifest as t,isBundleManifest as n}from"../../types/bundleManifest.mjs";import{createHash as r,createPrivateKey as i,createPublicKey as a,createSign as o,generateKeyPairSync as s,randomBytes as c}from"node:crypto";import l from"node:fs";import u from"node:path";const d=`signing.json`,f=`sha256`,p=/* @__PURE__ */ new Set([`.map`]),m=[`web`,`native`,`app`],h={".css":`text/css`,".gif":`image/gif`,".html":`text/html`,".ico":`image/x-icon`,".jpeg":`image/jpeg`,".jpg":`image/jpeg`,".js":`text/javascript`,".json":`application/json`,".mjs":`text/javascript`,".png":`image/png`,".svg":`image/svg+xml`,".txt":`text/plain`,".wasm":`application/wasm`,".webp":`image/webp`,".woff":`font/woff`,".woff2":`font/woff2`};function g(e){l.mkdirSync(e,{recursive:!0,mode:448});let t=l.lstatSync(e);if(!t.isDirectory()||t.isSymbolicLink())throw Error(`bundle signing state is not a directory: ${e}`);l.chmodSync(e,448)}function _(e,t){g(e);let n=u.join(e,`signing.lock`),r;for(let e=0;e<500;e+=1)try{r=l.openSync(n,`wx`,384);break}catch(e){if(e.code!==`EEXIST`)throw e;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,10)}if(r===void 0)throw Error(`timed out waiting for bundle signing state lock: ${n}`);try{return t()}finally{l.closeSync(r),l.rmSync(n,{force:!0})}}function v(e,t){let n=u.join(e,d),r=u.join(e,`.${d}.${process.pid}.${c(8).toString(`hex`)}`),i=l.openSync(r,`wx`,384);try{l.writeFileSync(i,`${JSON.stringify(t,void 0,2)}\n`),l.fsyncSync(i)}finally{l.closeSync(i)}try{l.renameSync(r,n),l.chmodSync(n,384)}catch(e){throw l.rmSync(r,{force:!0}),e}}function y(e,t){if(typeof e!=`object`||!e)throw Error(`invalid bundle signing state: ${t}`);let n=e;if(typeof n.privateKey!=`string`||typeof n.publicKey!=`string`)throw Error(`invalid bundle signing state: ${t}`);let r=n.revision===void 0?0:n.revision;if(!Number.isSafeInteger(r)||r<0)throw Error(`invalid bundle signing revision: ${t}`);let i;try{i=T(n.privateKey)}catch{throw Error(`invalid bundle signing private key: ${t}`)}if(i!==n.publicKey)throw Error(`bundle signing keys do not match: ${t}`);return{privateKey:n.privateKey,publicKey:n.publicKey,revision:r}}function b(e){return _(e,()=>{let t=u.join(e,d);try{let n=l.lstatSync(t);if(!n.isFile()||n.isSymbolicLink())throw Error(`invalid bundle signing state file: ${t}`);let r=JSON.parse(l.readFileSync(t,`utf8`)),i=y(r,t);return l.chmodSync(t,384),r.revision===void 0&&v(e,i),i}catch(e){if(e.code!==`ENOENT`)throw e}let n=s(`ec`,{namedCurve:`prime256v1`,privateKeyEncoding:{type:`pkcs8`,format:`pem`},publicKeyEncoding:{type:`spki`,format:`der`}}),r={privateKey:n.privateKey,publicKey:Buffer.from(n.publicKey).toString(`base64url`),revision:0};return v(e,r),r})}function x(e,t){return _(e,()=>{let n=u.join(e,d),r=y(JSON.parse(l.readFileSync(n,`utf8`)),n);if(r.publicKey!==t)throw Error(`bundle signing key changed while the signer was active`);if(r.revision===2**53-1)throw Error(`bundle signing revision is exhausted`);let i={...r,revision:r.revision+1};return v(e,i),i.revision})}function S(e){return h[u.extname(e).toLowerCase()]??`application/octet-stream`}function C(e,t,n){let i=l.readdirSync(t,{withFileTypes:!0});for(let a of i){let i=u.join(t,a.name),o=l.lstatSync(i);if(o.isSymbolicLink())throw Error(`refusing to sign symbolic link: ${i}`);if(o.isDirectory()){C(e,i,n);continue}if(!o.isFile())throw Error(`refusing to omit unsupported asset: ${i}`);if(p.has(u.extname(a.name)))continue;let s=l.readFileSync(i);n.push({path:`/${u.relative(e,i).split(u.sep).map(e=>encodeURIComponent(e)).join(`/`)}`,sha256:r(`sha256`).update(s).digest(`hex`),byteLength:s.byteLength,contentType:S(i)})}}function w(r,a=()=>{}){let s=b(r),c=i(s.privateKey),d=/* @__PURE__ */ new Map,p=(e,t)=>`${t}:${u.resolve(e)}`,h=(e,i)=>{let a=l.lstatSync(e);if(!a.isDirectory()||a.isSymbolicLink())throw Error(`refusing to sign an unsafe asset root: ${e}`);let u=[];if(C(e,e,u),u.length===0)return;u.sort((e,t)=>e.path.localeCompare(t.path));let d={version:2,revision:x(r,s.publicKey),builtAt:Date.now(),assets:u};if(!n(d,i))throw Error(`refusing to sign an invalid ${i} bundle manifest`);return{manifest:d,signature:o(f).update(t(d)).sign({key:c,dsaEncoding:`ieee-p1363`}).toString(`base64url`),publicKey:s.publicKey}},g=(e,t=`web`)=>{let n=p(e,t);if(d.has(n))return d.get(n);let r=h(u.resolve(e),t);return d.set(n,r),r};return{publicKey:()=>s.publicKey,sign:g,refresh(e,t=`web`){return d.delete(p(e,t)),g(e,t)},invalidate(e){if(e===void 0)d.clear();else for(let t of m)d.delete(p(e,t))},attest(t,n){return o(f).update(e(t,n)).sign({key:c,dsaEncoding:`ieee-p1363`}).toString(`base64url`)}}}function T(e){return Buffer.from(a(e).export({type:`spki`,format:`der`})).toString(`base64url`)}export{w as createBundleSigner,T as publicKeyOf};
 //# sourceMappingURL=index.mjs.map

package/dist/services/bundleSigner/index.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.mjs","names":["fs","path","SIGNING_FILE","SIGN_ALGORITHM","SKIPPED","PROFILES","MIME_TYPES","ensureStateDirectory","stateDir","stat","withStateLock","lockPath","descriptor","attempt","error","operation","atomicWriteState","destination","temporary","randomBytes","state","parseState","value","keyPath","candidate","revision","derived","publicKeyOf","loadOrCreateState","parsed","pair","generateKeyPairSync","reserveRevision","expectedPublicKey","next","contentTypeFor","filePath","walk","entries","current","entry","full","root","into","bytes","segment","createHash","createBundleSigner","key","privateKey","createPrivateKey","cache","cacheKeyOf","profile","assetsDir","signFresh","rootStat","assets","left","right","manifest","isBundleManifest","createSign","canonicalManifest","sign","cacheKey","signed","attestationBytes","tag","fields","createPublicKey","privateKeyPem"],"sources":["../../../src/services/bundleSigner/index.ts"],"sourcesContent":["import {\n createHash,\n createPrivateKey,\n createPublicKey,\n createSign,\n generateKeyPairSync,\n randomBytes,\n} from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n BUNDLE_MANIFEST_VERSION,\n type BundleAsset,\n type BundleManifest,\n type BundleProfile,\n type SignedBundleManifest,\n attestationBytes,\n canonicalManifest,\n isBundleManifest,\n} from '../../types/bundleManifest';\n\nconst SIGNING_FILE = 'signing.json';\nconst LOCK_FILE = 'signing.lock';\nconst FILE_MODE = 0o600;\nconst DIRECTORY_MODE = 0o700;\nconst CURVE = 'prime256v1';\nconst SIGN_ALGORITHM = 'sha256';\nconst SKIPPED = new Set(['.map']);\nconst PROFILES: readonly BundleProfile[] = ['web', 'native'];\nconst MIME_TYPES: Readonly<Record<string, string>> = {\n '.css': 'text/css',\n '.gif': 'image/gif',\n '.html': 'text/html',\n '.ico': 'image/x-icon',\n '.jpeg': 'image/jpeg',\n '.jpg': 'image/jpeg',\n '.js': 'text/javascript',\n '.json': 'application/json',\n '.mjs': 'text/javascript',\n '.png': 'image/png',\n '.svg': 'image/svg+xml',\n '.txt': 'text/plain',\n '.wasm': 'application/wasm',\n '.webp': 'image/webp',\n '.woff': 'font/woff',\n '.woff2': 'font/woff2',\n};\n\nexport interface BundleSigner {\n /** Base64url SPKI for an independently trusted verifier to pin. /\n publicKey(): string;\n /\n Hashes and signs once per asset directory and profile. Undefined when the bundle is empty. Throws\n * when the assets do not match the profile.\n /\n sign(assetsDir: string, profile?: BundleProfile): SignedBundleManifest \| undefined;\n /* Invalidates and immediately rebuilds one cached manifest. /\n refresh(assetsDir: string, profile?: BundleProfile): SignedBundleManifest \| undefined;\n /* Invalidates one cached directory under every profile, or every cached directory when omitted. /\n invalidate(assetsDir?: string): void;\n /\n Base64url IEEE P1363 signature over `attestationBytes(tag, fields)` with the bundle key. Throws on a\n * malformed tag.\n /\n attest(tag: string, fields: readonly string[]): string;\n}\n\ninterface StoredState {\n privateKey: string;\n publicKey: string;\n revision: number;\n}\n\nfunction ensureStateDirectory(stateDir: string): void {\n fs.mkdirSync(stateDir, { recursive: true, mode: DIRECTORY_MODE });\n const stat = fs.lstatSync(stateDir);\n if (!stat.isDirectory() \|\| stat.isSymbolicLink())\n throw new Error(`bundle signing state is not a directory: ${stateDir}`);\n fs.chmodSync(stateDir, DIRECTORY_MODE);\n}\n\nfunction withStateLock<T>(stateDir: string, operation: () => T): T {\n ensureStateDirectory(stateDir);\n const lockPath = path.join(stateDir, LOCK_FILE);\n let descriptor: number \| undefined;\n for (let attempt = 0; attempt < 500; attempt += 1) {\n try {\n descriptor = fs.openSync(lockPath, 'wx', FILE_MODE);\n break;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;\n Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);\n }\n }\n if (descriptor === undefined) throw new Error(`timed out waiting for bundle signing state lock: ${lockPath}`);\n try {\n return operation();\n } finally {\n fs.closeSync(descriptor);\n fs.rmSync(lockPath, { force: true });\n }\n}\n\nfunction atomicWriteState(stateDir: string, state: StoredState): void {\n const destination = path.join(stateDir, SIGNING_FILE);\n const temporary = path.join(stateDir, `.${SIGNING_FILE}.${process.pid}.${randomBytes(8).toString('hex')}`);\n const descriptor = fs.openSync(temporary, 'wx', FILE_MODE);\n try {\n fs.writeFileSync(descriptor, `${JSON.stringify(state, undefined, 2)}\\n`);\n fs.fsyncSync(descriptor);\n } finally {\n fs.closeSync(descriptor);\n }\n try {\n fs.renameSync(temporary, destination);\n fs.chmodSync(destination, FILE_MODE);\n } catch (error) {\n fs.rmSync(temporary, { force: true });\n throw error;\n }\n}\n\nfunction parseState(value: unknown, keyPath: string): StoredState {\n if (typeof value !== 'object' \|\| value === null) throw new Error(`invalid bundle signing state: ${keyPath}`);\n const candidate = value as Partial<StoredState>;\n if (typeof candidate.privateKey !== 'string' \|\| typeof candidate.publicKey !== 'string') {\n throw new Error(`invalid bundle signing state: ${keyPath}`);\n }\n const revision = candidate.revision === undefined ? 0 : candidate.revision;\n if (!Number.isSafeInteger(revision) \|\| revision < 0) throw new Error(`invalid bundle signing revision: ${keyPath}`);\n let derived: string;\n try {\n derived = publicKeyOf(candidate.privateKey);\n } catch {\n throw new Error(`invalid bundle signing private key: ${keyPath}`);\n }\n if (derived !== candidate.publicKey) throw new Error(`bundle signing keys do not match: ${keyPath}`);\n return { privateKey: candidate.privateKey, publicKey: candidate.publicKey, revision };\n}\n\nfunction loadOrCreateState(stateDir: string): StoredState {\n return withStateLock(stateDir, () => {\n const keyPath = path.join(stateDir, SIGNING_FILE);\n try {\n const stat = fs.lstatSync(keyPath);\n if (!stat.isFile() \|\| stat.isSymbolicLink()) throw new Error(`invalid bundle signing state file: ${keyPath}`);\n const parsed: unknown = JSON.parse(fs.readFileSync(keyPath, 'utf8'));\n const state = parseState(parsed, keyPath);\n fs.chmodSync(keyPath, FILE_MODE);\n if ((parsed as Partial<StoredState>).revision === undefined) atomicWriteState(stateDir, state);\n return state;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n }\n\n const pair = generateKeyPairSync('ec', {\n namedCurve: CURVE,\n privateKeyEncoding: { type: 'pkcs8', format: 'pem' },\n publicKeyEncoding: { type: 'spki', format: 'der' },\n });\n const state: StoredState = {\n privateKey: pair.privateKey,\n publicKey: Buffer.from(pair.publicKey).toString('base64url'),\n revision: 0,\n };\n atomicWriteState(stateDir, state);\n return state;\n });\n}\n\nfunction reserveRevision(stateDir: string, expectedPublicKey: string): number {\n return withStateLock(stateDir, () => {\n const keyPath = path.join(stateDir, SIGNING_FILE);\n const state = parseState(JSON.parse(fs.readFileSync(keyPath, 'utf8')) as unknown, keyPath);\n if (state.publicKey !== expectedPublicKey)\n throw new Error('bundle signing key changed while the signer was active');\n if (state.revision === Number.MAX_SAFE_INTEGER) throw new Error('bundle signing revision is exhausted');\n const next = { ...state, revision: state.revision + 1 };\n atomicWriteState(stateDir, next);\n return next.revision;\n });\n}\n\nfunction contentTypeFor(filePath: string): string {\n return MIME_TYPES[path.extname(filePath).toLowerCase()] ?? 'application/octet-stream';\n}\n\n/* Every servable regular file under the asset root, as browser paths. /\nfunction walk(root: string, current: string, into: BundleAsset[]): void {\n const entries = fs.readdirSync(current, { withFileTypes: true });\n for (const entry of entries) {\n const full = path.join(current, entry.name);\n const stat = fs.lstatSync(full);\n if (stat.isSymbolicLink()) throw new Error(`refusing to sign symbolic link: ${full}`);\n if (stat.isDirectory()) {\n walk(root, full, into);\n continue;\n }\n if (!stat.isFile()) throw new Error(`refusing to omit unsupported asset: ${full}`);\n if (SKIPPED.has(path.extname(entry.name))) continue;\n const bytes = fs.readFileSync(full);\n into.push({\n path: `/${path\n .relative(root, full)\n .split(path.sep)\n .map((segment) => encodeURIComponent(segment))\n .join('/')}`,\n sha256: createHash('sha256').update(bytes).digest('hex'),\n byteLength: bytes.byteLength,\n contentType: contentTypeFor(full),\n });\n }\n}\n\nexport function createBundleSigner(stateDir: string, _onNotice: (message: string) => void = () => {}): BundleSigner {\n const key = loadOrCreateState(stateDir);\n const privateKey = createPrivateKey(key.privateKey);\n const cache = new Map<string, SignedBundleManifest \| undefined>();\n const cacheKeyOf = (assetsDir: string, profile: BundleProfile): string => `${profile}:${path.resolve(assetsDir)}`;\n\n const signFresh = (assetsDir: string, profile: BundleProfile): SignedBundleManifest \| undefined => {\n const rootStat = fs.lstatSync(assetsDir);\n if (!rootStat.isDirectory() \|\| rootStat.isSymbolicLink()) {\n throw new Error(`refusing to sign an unsafe asset root: ${assetsDir}`);\n }\n const assets: BundleAsset[] = [];\n walk(assetsDir, assetsDir, assets);\n if (assets.length === 0) return undefined;\n assets.sort((left, right) => left.path.localeCompare(right.path));\n const manifest: BundleManifest = {\n version: BUNDLE_MANIFEST_VERSION,\n revision: reserveRevision(stateDir, key.publicKey),\n builtAt: Date.now(),\n assets,\n };\n if (!isBundleManifest(manifest, profile)) throw new Error(`refusing to sign an invalid ${profile} bundle manifest`);\n const signature = createSign(SIGN_ALGORITHM)\n .update(canonicalManifest(manifest))\n .sign({ key: privateKey, dsaEncoding: 'ieee-p1363' })\n .toString('base64url');\n return { manifest, signature, publicKey: key.publicKey };\n };\n\n const sign = (assetsDir: string, profile: BundleProfile = 'web'): SignedBundleManifest \| undefined => {\n const cacheKey = cacheKeyOf(assetsDir, profile);\n if (cache.has(cacheKey)) return cache.get(cacheKey);\n const signed = signFresh(path.resolve(assetsDir), profile);\n cache.set(cacheKey, signed);\n return signed;\n };\n\n return {\n publicKey: () => key.publicKey,\n sign,\n refresh(assetsDir, profile = 'web') {\n cache.delete(cacheKeyOf(assetsDir, profile));\n return sign(assetsDir, profile);\n },\n invalidate(assetsDir) {\n if (assetsDir === undefined) {\n cache.clear();\n return;\n }\n for (const profile of PROFILES) cache.delete(cacheKeyOf(assetsDir, profile));\n },\n attest(tag, fields) {\n return createSign(SIGN_ALGORITHM)\n .update(attestationBytes(tag, fields))\n .sign({ key: privateKey, dsaEncoding: 'ieee-p1363' })\n .toString('base64url');\n },\n };\n}\n\n/* Re-derives the public key from a stored private key. */\nexport function publicKeyOf(privateKeyPem: string): string {\n return Buffer.from(createPublicKey(privateKeyPem).export({ type: 'spki', format: 'der' }) as Buffer).toString(\n 'base64url',\n );\n}\n"],"mappings":"6SAsBA,MAAME,EAAe,eAKfC,EAAiB,SACjBC,kBAAU,IAAI,IAAI,CAAC,MAAM,CAAC,EAC1BC,EAAqC,CAAC,MAAO,QAAQ,EACrDC,EAA+C,CACnD,OAAQ,WACR,OAAQ,YACR,QAAS,YACT,OAAQ,eACR,QAAS,aACT,OAAQ,aACR,MAAO,kBACP,QAAS,mBACT,OAAQ,kBACR,OAAQ,YACR,OAAQ,gBACR,OAAQ,aACR,QAAS,mBACT,QAAS,aACT,QAAS,YACT,SAAU,YACZ,EA2BA,SAASC,EAAqB,EAAwB,CACpDP,EAAG,UAAUQ,EAAU,CAAE,UAAW,GAAM,KAAM,GAAe,CAAC,EAChE,IAAMC,EAAOT,EAAG,UAAUQ,CAAQ,EAClC,GAAI,CAACC,EAAK,YAAY,GAAKA,EAAK,eAAe,EAC7C,MAAU,MAAM,4CAA4CD,GAAU,EACxER,EAAG,UAAUQ,EAAU,GAAc,CACvC,CAEA,SAASE,EAAiB,EAAkB,EAAuB,CACjEH,EAAqBC,CAAQ,EAC7B,IAAMG,EAAWV,EAAK,KAAKO,EAAU,cAAS,EAC1CI,EACJ,IAAK,IAAIC,EAAU,EAAGA,EAAU,IAAK,GAAW,EAC9C,GAAI,CACF,EAAab,EAAG,SAASW,EAAU,KAAM,GAAS,EAClD,KACF,OAASG,EAAO,CACd,GAAKA,EAAgC,OAAS,SAAU,MAAMA,EAC9D,QAAQ,KAAK,IAAI,WAAW,IAAI,kBAAkB,CAAC,CAAC,EAAG,EAAG,EAAG,EAAE,CACjE,CAEF,GAAIF,IAAe,IAAA,GAAW,MAAU,MAAM,oDAAoDD,GAAU,EAC5G,GAAI,CACF,OAAOI,EAAU,CACnB,QAAU,CACRf,EAAG,UAAUY,CAAU,EACvBZ,EAAG,OAAOW,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,CACF,CAEA,SAASK,EAAiB,EAAkB,EAA0B,CACpE,IAAMC,EAAchB,EAAK,KAAKO,EAAUN,CAAY,EAC9CgB,EAAYjB,EAAK,KAAKO,EAAU,IAAIN,EAAa,GAAG,QAAQ,IAAI,GAAGiB,EAAY,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,EACnGP,EAAaZ,EAAG,SAASkB,EAAW,KAAM,GAAS,EACzD,GAAI,CACFlB,EAAG,cAAcY,EAAY,GAAG,KAAK,UAAUQ,EAAO,IAAA,GAAW,CAAC,EAAE,GAAG,EACvEpB,EAAG,UAAUY,CAAU,CACzB,QAAU,CACRZ,EAAG,UAAUY,CAAU,CACzB,CACA,GAAI,CACFZ,EAAG,WAAWkB,EAAWD,CAAW,EACpCjB,EAAG,UAAUiB,EAAa,GAAS,CACrC,OAASH,EAAO,CAEd,MADAd,EAAG,OAAOkB,EAAW,CAAE,MAAO,EAAK,CAAC,EAC9BJ,CACR,CACF,CAEA,SAASO,EAAW,EAAgB,EAA8B,CAChE,GAAI,OAAOC,GAAU,WAAYA,EAAgB,MAAU,MAAM,iCAAiCC,GAAS,EAC3G,IAAMC,EAAYF,EAClB,GAAI,OAAOE,EAAU,YAAe,UAAY,OAAOA,EAAU,WAAc,SAC7E,MAAU,MAAM,iCAAiCD,GAAS,EAE5D,IAAME,EAAWD,EAAU,WAAa,IAAA,GAAY,EAAIA,EAAU,SAClE,GAAI,CAAC,OAAO,cAAcC,CAAQ,GAAKA,EAAW,EAAG,MAAU,MAAM,oCAAoCF,GAAS,EAClH,IAAIG,EACJ,GAAI,CACF,EAAUC,EAAYH,EAAU,UAAU,CAC5C,MAAQ,CACN,MAAU,MAAM,uCAAuCD,GAAS,CAClE,CACA,GAAIG,IAAYF,EAAU,UAAW,MAAU,MAAM,qCAAqCD,GAAS,EACnG,MAAO,CAAE,WAAYC,EAAU,WAAY,UAAWA,EAAU,UAAW,UAAS,CACtF,CAEA,SAASI,EAAkB,EAA+B,CACxD,OAAOlB,EAAcF,MAAgB,CACnC,IAAMe,EAAUtB,EAAK,KAAKO,EAAUN,CAAY,EAChD,GAAI,CACF,IAAMO,EAAOT,EAAG,UAAUuB,CAAO,EACjC,GAAI,CAACd,EAAK,OAAO,GAAKA,EAAK,eAAe,EAAG,MAAU,MAAM,sCAAsCc,GAAS,EAC5G,IAAMM,EAAkB,KAAK,MAAM7B,EAAG,aAAauB,EAAS,MAAM,CAAC,EAC7DH,EAAQC,EAAWQ,EAAQN,CAAO,EAGxC,OAFAvB,EAAG,UAAUuB,EAAS,GAAS,EAC1BM,EAAgC,WAAa,IAAA,IAAWb,EAAiBR,EAAUY,CAAK,EACtFA,CACT,OAASN,EAAO,CACd,GAAKA,EAAgC,OAAS,SAAU,MAAMA,CAChE,CAEA,IAAMgB,EAAOC,EAAoB,KAAM,CACrC,WAAY,aACZ,mBAAoB,CAAE,KAAM,QAAS,OAAQ,KAAM,EACnD,kBAAmB,CAAE,KAAM,OAAQ,OAAQ,KAAM,CACnD,CAAC,EACKX,EAAqB,CACzB,WAAYU,EAAK,WACjB,UAAW,OAAO,KAAKA,EAAK,SAAS,CAAC,CAAC,SAAS,WAAW,EAC3D,SAAU,CACZ,EAEA,OADAd,EAAiBR,EAAUY,CAAK,EACzBA,CACT,CAAC,CACH,CAEA,SAASY,EAAgB,EAAkB,EAAmC,CAC5E,OAAOtB,EAAcF,MAAgB,CACnC,IAAMe,EAAUtB,EAAK,KAAKO,EAAUN,CAAY,EAC1CkB,EAAQC,EAAW,KAAK,MAAMrB,EAAG,aAAauB,EAAS,MAAM,CAAC,EAAcA,CAAO,EACzF,GAAIH,EAAM,YAAca,EACtB,MAAU,MAAM,wDAAwD,EAC1E,GAAIb,EAAM,mBAAsC,MAAU,MAAM,sCAAsC,EACtG,IAAMc,EAAO,CAAE,GAAGd,EAAO,SAAUA,EAAM,SAAW,CAAE,EAEtD,OADAJ,EAAiBR,EAAU0B,CAAI,EACxBA,EAAK,QACd,CAAC,CACH,CAEA,SAASC,EAAe,EAA0B,CAChD,OAAO7B,EAAWL,EAAK,QAAQmC,CAAQ,CAAC,CAAC,YAAY,IAAM,0BAC7D,CAGA,SAASC,EAAK,EAAc,EAAiB,EAA2B,CACtE,IAAMC,EAAUtC,EAAG,YAAYuC,EAAS,CAAE,cAAe,EAAK,CAAC,EAC/D,IAAK,IAAMC,KAASF,EAAS,CAC3B,IAAMG,EAAOxC,EAAK,KAAKsC,EAASC,EAAM,IAAI,EACpC/B,EAAOT,EAAG,UAAUyC,CAAI,EAC9B,GAAIhC,EAAK,eAAe,EAAG,MAAU,MAAM,mCAAmCgC,GAAM,EACpF,GAAIhC,EAAK,YAAY,EAAG,CACtB4B,EAAKK,EAAMD,EAAME,CAAI,EACrB,QACF,CACA,GAAI,CAAClC,EAAK,OAAO,EAAG,MAAU,MAAM,uCAAuCgC,GAAM,EACjF,GAAIrC,EAAQ,IAAIH,EAAK,QAAQuC,EAAM,IAAI,CAAC,EAAG,SAC3C,IAAMI,EAAQ5C,EAAG,aAAayC,CAAI,EAClCE,EAAK,KAAK,CACR,KAAM,IAAI1C,EACP,SAASyC,EAAMD,CAAI,CAAC,CACpB,MAAMxC,EAAK,GAAG,CAAC,CACf,IAAK,GAAY,mBAAmB4C,CAAO,CAAC,CAAC,CAC7C,KAAK,GAAG,IACX,OAAQC,EAAW,QAAQ,CAAC,CAAC,OAAOF,CAAK,CAAC,CAAC,OAAO,KAAK,EACvD,WAAYA,EAAM,WAClB,YAAaT,EAAeM,CAAI,CAClC,CAAC,CACH,CACF,CAEA,SAAgBM,EAAmB,EAAkB,MAA6C,CAAC,EAAiB,CAClH,IAAMC,EAAMpB,EAAkBpB,CAAQ,EAChCyC,EAAaC,EAAiBF,EAAI,UAAU,EAC5CG,kBAAQ,IAAI,IACZC,GAAc,EAAmB,IAAmC,GAAGC,EAAQ,GAAGpD,EAAK,QAAQqD,CAAS,IAExGC,GAAa,EAAmB,IAA6D,CACjG,IAAMC,EAAWxD,EAAG,UAAUsD,CAAS,EACvC,GAAI,CAACE,EAAS,YAAY,GAAKA,EAAS,eAAe,EACrD,MAAU,MAAM,0CAA0CF,GAAW,EAEvE,IAAMG,EAAwB,CAAC,EAE/B,GADApB,EAAKiB,EAAWA,EAAWG,CAAM,EAC7BA,EAAO,SAAW,EAAG,OACzBA,EAAO,MAAM,EAAM,IAAUC,EAAK,KAAK,cAAcC,EAAM,IAAI,CAAC,EAChE,IAAMC,EAA2B,CAC/B,QAAA,EACA,SAAU5B,EAAgBxB,EAAUwC,EAAI,SAAS,EACjD,QAAS,KAAK,IAAI,EAClB,QACF,EACA,GAAI,CAACa,EAAiBD,EAAUP,CAAO,EAAG,MAAU,MAAM,+BAA+BA,EAAQ,iBAAiB,EAKlH,MAAO,CAAE,WAAU,UAJDS,EAAW3D,CAAc,CAAC,CACzC,OAAO4D,EAAkBH,CAAQ,CAAC,CAAC,CACnC,KAAK,CAAE,IAAKX,EAAY,YAAa,YAAa,CAAC,CAAC,CACpD,SAAS,WACe,EAAG,UAAWD,EAAI,SAAU,CACzD,EAEMgB,GAAQ,EAAmB,EAAyB,QAA4C,CACpG,IAAMC,EAAWb,EAAWE,EAAWD,CAAO,EAC9C,GAAIF,EAAM,IAAIc,CAAQ,EAAG,OAAOd,EAAM,IAAIc,CAAQ,EAClD,IAAMC,EAASX,EAAUtD,EAAK,QAAQqD,CAAS,EAAGD,CAAO,EAEzD,OADAF,EAAM,IAAIc,EAAUC,CAAM,EACnBA,CACT,EAEA,MAAO,CACL,cAAiBlB,EAAI,UACrB,OACA,QAAQ,EAAW,EAAU,MAAO,CAElC,OADAG,EAAM,OAAOC,EAAWE,EAAWD,CAAO,CAAC,EACpCW,EAAKV,EAAWD,CAAO,CAChC,EACA,WAAW,EAAW,CACpB,GAAIC,IAAc,IAAA,GAChBH,EAAM,MAAM,OAGd,IAAK,IAAME,KAAWhD,EAAU8C,EAAM,OAAOC,EAAWE,EAAWD,CAAO,CAAC,CAC7E,EACA,OAAO,EAAK,EAAQ,CAClB,OAAOS,EAAW3D,CAAc,CAAC,CAC9B,OAAOgE,EAAiBC,EAAKC,CAAM,CAAC,CAAC,CACrC,KAAK,CAAE,IAAKpB,EAAY,YAAa,YAAa,CAAC,CAAC,CACpD,SAAS,WAAW,CACzB,CACF,CACF,CAGA,SAAgBtB,EAAY,EAA+B,CACzD,OAAO,OAAO,KAAK2C,EAAgBC,CAAa,CAAC,CAAC,OAAO,CAAE,KAAM,OAAQ,OAAQ,KAAM,CAAC,CAAW,CAAC,CAAC,SACnG,WACF,CACF"}
1	+ {"version":3,"file":"index.mjs","names":["fs","path","SIGNING_FILE","SIGN_ALGORITHM","SKIPPED","PROFILES","MIME_TYPES","ensureStateDirectory","stateDir","stat","withStateLock","lockPath","descriptor","attempt","error","operation","atomicWriteState","destination","temporary","randomBytes","state","parseState","value","keyPath","candidate","revision","derived","publicKeyOf","loadOrCreateState","parsed","pair","generateKeyPairSync","reserveRevision","expectedPublicKey","next","contentTypeFor","filePath","walk","entries","current","entry","full","root","into","bytes","segment","createHash","createBundleSigner","key","privateKey","createPrivateKey","cache","cacheKeyOf","profile","assetsDir","signFresh","rootStat","assets","left","right","manifest","isBundleManifest","createSign","canonicalManifest","sign","cacheKey","signed","attestationBytes","tag","fields","createPublicKey","privateKeyPem"],"sources":["../../../src/services/bundleSigner/index.ts"],"sourcesContent":["import {\n createHash,\n createPrivateKey,\n createPublicKey,\n createSign,\n generateKeyPairSync,\n randomBytes,\n} from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n BUNDLE_MANIFEST_VERSION,\n type BundleAsset,\n type BundleManifest,\n type BundleProfile,\n type SignedBundleManifest,\n attestationBytes,\n canonicalManifest,\n isBundleManifest,\n} from '../../types/bundleManifest';\n\nconst SIGNING_FILE = 'signing.json';\nconst LOCK_FILE = 'signing.lock';\nconst FILE_MODE = 0o600;\nconst DIRECTORY_MODE = 0o700;\nconst CURVE = 'prime256v1';\nconst SIGN_ALGORITHM = 'sha256';\nconst SKIPPED = new Set(['.map']);\nconst PROFILES: readonly BundleProfile[] = ['web', 'native', 'app'];\nconst MIME_TYPES: Readonly<Record<string, string>> = {\n '.css': 'text/css',\n '.gif': 'image/gif',\n '.html': 'text/html',\n '.ico': 'image/x-icon',\n '.jpeg': 'image/jpeg',\n '.jpg': 'image/jpeg',\n '.js': 'text/javascript',\n '.json': 'application/json',\n '.mjs': 'text/javascript',\n '.png': 'image/png',\n '.svg': 'image/svg+xml',\n '.txt': 'text/plain',\n '.wasm': 'application/wasm',\n '.webp': 'image/webp',\n '.woff': 'font/woff',\n '.woff2': 'font/woff2',\n};\n\nexport interface BundleSigner {\n /** Base64url SPKI for an independently trusted verifier to pin. /\n publicKey(): string;\n /\n Hashes and signs once per asset directory and profile. Undefined when the bundle is empty. Throws\n * when the assets do not match the profile.\n /\n sign(assetsDir: string, profile?: BundleProfile): SignedBundleManifest \| undefined;\n /* Invalidates and immediately rebuilds one cached manifest. /\n refresh(assetsDir: string, profile?: BundleProfile): SignedBundleManifest \| undefined;\n /* Invalidates one cached directory under every profile, or every cached directory when omitted. /\n invalidate(assetsDir?: string): void;\n /\n Base64url IEEE P1363 signature over `attestationBytes(tag, fields)` with the bundle key. Throws on a\n * malformed tag.\n /\n attest(tag: string, fields: readonly string[]): string;\n}\n\ninterface StoredState {\n privateKey: string;\n publicKey: string;\n revision: number;\n}\n\nfunction ensureStateDirectory(stateDir: string): void {\n fs.mkdirSync(stateDir, { recursive: true, mode: DIRECTORY_MODE });\n const stat = fs.lstatSync(stateDir);\n if (!stat.isDirectory() \|\| stat.isSymbolicLink())\n throw new Error(`bundle signing state is not a directory: ${stateDir}`);\n fs.chmodSync(stateDir, DIRECTORY_MODE);\n}\n\nfunction withStateLock<T>(stateDir: string, operation: () => T): T {\n ensureStateDirectory(stateDir);\n const lockPath = path.join(stateDir, LOCK_FILE);\n let descriptor: number \| undefined;\n for (let attempt = 0; attempt < 500; attempt += 1) {\n try {\n descriptor = fs.openSync(lockPath, 'wx', FILE_MODE);\n break;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;\n Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);\n }\n }\n if (descriptor === undefined) throw new Error(`timed out waiting for bundle signing state lock: ${lockPath}`);\n try {\n return operation();\n } finally {\n fs.closeSync(descriptor);\n fs.rmSync(lockPath, { force: true });\n }\n}\n\nfunction atomicWriteState(stateDir: string, state: StoredState): void {\n const destination = path.join(stateDir, SIGNING_FILE);\n const temporary = path.join(stateDir, `.${SIGNING_FILE}.${process.pid}.${randomBytes(8).toString('hex')}`);\n const descriptor = fs.openSync(temporary, 'wx', FILE_MODE);\n try {\n fs.writeFileSync(descriptor, `${JSON.stringify(state, undefined, 2)}\\n`);\n fs.fsyncSync(descriptor);\n } finally {\n fs.closeSync(descriptor);\n }\n try {\n fs.renameSync(temporary, destination);\n fs.chmodSync(destination, FILE_MODE);\n } catch (error) {\n fs.rmSync(temporary, { force: true });\n throw error;\n }\n}\n\nfunction parseState(value: unknown, keyPath: string): StoredState {\n if (typeof value !== 'object' \|\| value === null) throw new Error(`invalid bundle signing state: ${keyPath}`);\n const candidate = value as Partial<StoredState>;\n if (typeof candidate.privateKey !== 'string' \|\| typeof candidate.publicKey !== 'string') {\n throw new Error(`invalid bundle signing state: ${keyPath}`);\n }\n const revision = candidate.revision === undefined ? 0 : candidate.revision;\n if (!Number.isSafeInteger(revision) \|\| revision < 0) throw new Error(`invalid bundle signing revision: ${keyPath}`);\n let derived: string;\n try {\n derived = publicKeyOf(candidate.privateKey);\n } catch {\n throw new Error(`invalid bundle signing private key: ${keyPath}`);\n }\n if (derived !== candidate.publicKey) throw new Error(`bundle signing keys do not match: ${keyPath}`);\n return { privateKey: candidate.privateKey, publicKey: candidate.publicKey, revision };\n}\n\nfunction loadOrCreateState(stateDir: string): StoredState {\n return withStateLock(stateDir, () => {\n const keyPath = path.join(stateDir, SIGNING_FILE);\n try {\n const stat = fs.lstatSync(keyPath);\n if (!stat.isFile() \|\| stat.isSymbolicLink()) throw new Error(`invalid bundle signing state file: ${keyPath}`);\n const parsed: unknown = JSON.parse(fs.readFileSync(keyPath, 'utf8'));\n const state = parseState(parsed, keyPath);\n fs.chmodSync(keyPath, FILE_MODE);\n if ((parsed as Partial<StoredState>).revision === undefined) atomicWriteState(stateDir, state);\n return state;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n }\n\n const pair = generateKeyPairSync('ec', {\n namedCurve: CURVE,\n privateKeyEncoding: { type: 'pkcs8', format: 'pem' },\n publicKeyEncoding: { type: 'spki', format: 'der' },\n });\n const state: StoredState = {\n privateKey: pair.privateKey,\n publicKey: Buffer.from(pair.publicKey).toString('base64url'),\n revision: 0,\n };\n atomicWriteState(stateDir, state);\n return state;\n });\n}\n\nfunction reserveRevision(stateDir: string, expectedPublicKey: string): number {\n return withStateLock(stateDir, () => {\n const keyPath = path.join(stateDir, SIGNING_FILE);\n const state = parseState(JSON.parse(fs.readFileSync(keyPath, 'utf8')) as unknown, keyPath);\n if (state.publicKey !== expectedPublicKey)\n throw new Error('bundle signing key changed while the signer was active');\n if (state.revision === Number.MAX_SAFE_INTEGER) throw new Error('bundle signing revision is exhausted');\n const next = { ...state, revision: state.revision + 1 };\n atomicWriteState(stateDir, next);\n return next.revision;\n });\n}\n\nfunction contentTypeFor(filePath: string): string {\n return MIME_TYPES[path.extname(filePath).toLowerCase()] ?? 'application/octet-stream';\n}\n\n/* Every servable regular file under the asset root, as browser paths. /\nfunction walk(root: string, current: string, into: BundleAsset[]): void {\n const entries = fs.readdirSync(current, { withFileTypes: true });\n for (const entry of entries) {\n const full = path.join(current, entry.name);\n const stat = fs.lstatSync(full);\n if (stat.isSymbolicLink()) throw new Error(`refusing to sign symbolic link: ${full}`);\n if (stat.isDirectory()) {\n walk(root, full, into);\n continue;\n }\n if (!stat.isFile()) throw new Error(`refusing to omit unsupported asset: ${full}`);\n if (SKIPPED.has(path.extname(entry.name))) continue;\n const bytes = fs.readFileSync(full);\n into.push({\n path: `/${path\n .relative(root, full)\n .split(path.sep)\n .map((segment) => encodeURIComponent(segment))\n .join('/')}`,\n sha256: createHash('sha256').update(bytes).digest('hex'),\n byteLength: bytes.byteLength,\n contentType: contentTypeFor(full),\n });\n }\n}\n\nexport function createBundleSigner(stateDir: string, _onNotice: (message: string) => void = () => {}): BundleSigner {\n const key = loadOrCreateState(stateDir);\n const privateKey = createPrivateKey(key.privateKey);\n const cache = new Map<string, SignedBundleManifest \| undefined>();\n const cacheKeyOf = (assetsDir: string, profile: BundleProfile): string => `${profile}:${path.resolve(assetsDir)}`;\n\n const signFresh = (assetsDir: string, profile: BundleProfile): SignedBundleManifest \| undefined => {\n const rootStat = fs.lstatSync(assetsDir);\n if (!rootStat.isDirectory() \|\| rootStat.isSymbolicLink()) {\n throw new Error(`refusing to sign an unsafe asset root: ${assetsDir}`);\n }\n const assets: BundleAsset[] = [];\n walk(assetsDir, assetsDir, assets);\n if (assets.length === 0) return undefined;\n assets.sort((left, right) => left.path.localeCompare(right.path));\n const manifest: BundleManifest = {\n version: BUNDLE_MANIFEST_VERSION,\n revision: reserveRevision(stateDir, key.publicKey),\n builtAt: Date.now(),\n assets,\n };\n if (!isBundleManifest(manifest, profile)) throw new Error(`refusing to sign an invalid ${profile} bundle manifest`);\n const signature = createSign(SIGN_ALGORITHM)\n .update(canonicalManifest(manifest))\n .sign({ key: privateKey, dsaEncoding: 'ieee-p1363' })\n .toString('base64url');\n return { manifest, signature, publicKey: key.publicKey };\n };\n\n const sign = (assetsDir: string, profile: BundleProfile = 'web'): SignedBundleManifest \| undefined => {\n const cacheKey = cacheKeyOf(assetsDir, profile);\n if (cache.has(cacheKey)) return cache.get(cacheKey);\n const signed = signFresh(path.resolve(assetsDir), profile);\n cache.set(cacheKey, signed);\n return signed;\n };\n\n return {\n publicKey: () => key.publicKey,\n sign,\n refresh(assetsDir, profile = 'web') {\n cache.delete(cacheKeyOf(assetsDir, profile));\n return sign(assetsDir, profile);\n },\n invalidate(assetsDir) {\n if (assetsDir === undefined) {\n cache.clear();\n return;\n }\n for (const profile of PROFILES) cache.delete(cacheKeyOf(assetsDir, profile));\n },\n attest(tag, fields) {\n return createSign(SIGN_ALGORITHM)\n .update(attestationBytes(tag, fields))\n .sign({ key: privateKey, dsaEncoding: 'ieee-p1363' })\n .toString('base64url');\n },\n };\n}\n\n/* Re-derives the public key from a stored private key. */\nexport function publicKeyOf(privateKeyPem: string): string {\n return Buffer.from(createPublicKey(privateKeyPem).export({ type: 'spki', format: 'der' }) as Buffer).toString(\n 'base64url',\n );\n}\n"],"mappings":"6SAsBA,MAAME,EAAe,eAKfC,EAAiB,SACjBC,kBAAU,IAAI,IAAI,CAAC,MAAM,CAAC,EAC1BC,EAAqC,CAAC,MAAO,SAAU,KAAK,EAC5DC,EAA+C,CACnD,OAAQ,WACR,OAAQ,YACR,QAAS,YACT,OAAQ,eACR,QAAS,aACT,OAAQ,aACR,MAAO,kBACP,QAAS,mBACT,OAAQ,kBACR,OAAQ,YACR,OAAQ,gBACR,OAAQ,aACR,QAAS,mBACT,QAAS,aACT,QAAS,YACT,SAAU,YACZ,EA2BA,SAASC,EAAqB,EAAwB,CACpDP,EAAG,UAAUQ,EAAU,CAAE,UAAW,GAAM,KAAM,GAAe,CAAC,EAChE,IAAMC,EAAOT,EAAG,UAAUQ,CAAQ,EAClC,GAAI,CAACC,EAAK,YAAY,GAAKA,EAAK,eAAe,EAC7C,MAAU,MAAM,4CAA4CD,GAAU,EACxER,EAAG,UAAUQ,EAAU,GAAc,CACvC,CAEA,SAASE,EAAiB,EAAkB,EAAuB,CACjEH,EAAqBC,CAAQ,EAC7B,IAAMG,EAAWV,EAAK,KAAKO,EAAU,cAAS,EAC1CI,EACJ,IAAK,IAAIC,EAAU,EAAGA,EAAU,IAAK,GAAW,EAC9C,GAAI,CACF,EAAab,EAAG,SAASW,EAAU,KAAM,GAAS,EAClD,KACF,OAASG,EAAO,CACd,GAAKA,EAAgC,OAAS,SAAU,MAAMA,EAC9D,QAAQ,KAAK,IAAI,WAAW,IAAI,kBAAkB,CAAC,CAAC,EAAG,EAAG,EAAG,EAAE,CACjE,CAEF,GAAIF,IAAe,IAAA,GAAW,MAAU,MAAM,oDAAoDD,GAAU,EAC5G,GAAI,CACF,OAAOI,EAAU,CACnB,QAAU,CACRf,EAAG,UAAUY,CAAU,EACvBZ,EAAG,OAAOW,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,CACF,CAEA,SAASK,EAAiB,EAAkB,EAA0B,CACpE,IAAMC,EAAchB,EAAK,KAAKO,EAAUN,CAAY,EAC9CgB,EAAYjB,EAAK,KAAKO,EAAU,IAAIN,EAAa,GAAG,QAAQ,IAAI,GAAGiB,EAAY,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,EACnGP,EAAaZ,EAAG,SAASkB,EAAW,KAAM,GAAS,EACzD,GAAI,CACFlB,EAAG,cAAcY,EAAY,GAAG,KAAK,UAAUQ,EAAO,IAAA,GAAW,CAAC,EAAE,GAAG,EACvEpB,EAAG,UAAUY,CAAU,CACzB,QAAU,CACRZ,EAAG,UAAUY,CAAU,CACzB,CACA,GAAI,CACFZ,EAAG,WAAWkB,EAAWD,CAAW,EACpCjB,EAAG,UAAUiB,EAAa,GAAS,CACrC,OAASH,EAAO,CAEd,MADAd,EAAG,OAAOkB,EAAW,CAAE,MAAO,EAAK,CAAC,EAC9BJ,CACR,CACF,CAEA,SAASO,EAAW,EAAgB,EAA8B,CAChE,GAAI,OAAOC,GAAU,WAAYA,EAAgB,MAAU,MAAM,iCAAiCC,GAAS,EAC3G,IAAMC,EAAYF,EAClB,GAAI,OAAOE,EAAU,YAAe,UAAY,OAAOA,EAAU,WAAc,SAC7E,MAAU,MAAM,iCAAiCD,GAAS,EAE5D,IAAME,EAAWD,EAAU,WAAa,IAAA,GAAY,EAAIA,EAAU,SAClE,GAAI,CAAC,OAAO,cAAcC,CAAQ,GAAKA,EAAW,EAAG,MAAU,MAAM,oCAAoCF,GAAS,EAClH,IAAIG,EACJ,GAAI,CACF,EAAUC,EAAYH,EAAU,UAAU,CAC5C,MAAQ,CACN,MAAU,MAAM,uCAAuCD,GAAS,CAClE,CACA,GAAIG,IAAYF,EAAU,UAAW,MAAU,MAAM,qCAAqCD,GAAS,EACnG,MAAO,CAAE,WAAYC,EAAU,WAAY,UAAWA,EAAU,UAAW,UAAS,CACtF,CAEA,SAASI,EAAkB,EAA+B,CACxD,OAAOlB,EAAcF,MAAgB,CACnC,IAAMe,EAAUtB,EAAK,KAAKO,EAAUN,CAAY,EAChD,GAAI,CACF,IAAMO,EAAOT,EAAG,UAAUuB,CAAO,EACjC,GAAI,CAACd,EAAK,OAAO,GAAKA,EAAK,eAAe,EAAG,MAAU,MAAM,sCAAsCc,GAAS,EAC5G,IAAMM,EAAkB,KAAK,MAAM7B,EAAG,aAAauB,EAAS,MAAM,CAAC,EAC7DH,EAAQC,EAAWQ,EAAQN,CAAO,EAGxC,OAFAvB,EAAG,UAAUuB,EAAS,GAAS,EAC1BM,EAAgC,WAAa,IAAA,IAAWb,EAAiBR,EAAUY,CAAK,EACtFA,CACT,OAASN,EAAO,CACd,GAAKA,EAAgC,OAAS,SAAU,MAAMA,CAChE,CAEA,IAAMgB,EAAOC,EAAoB,KAAM,CACrC,WAAY,aACZ,mBAAoB,CAAE,KAAM,QAAS,OAAQ,KAAM,EACnD,kBAAmB,CAAE,KAAM,OAAQ,OAAQ,KAAM,CACnD,CAAC,EACKX,EAAqB,CACzB,WAAYU,EAAK,WACjB,UAAW,OAAO,KAAKA,EAAK,SAAS,CAAC,CAAC,SAAS,WAAW,EAC3D,SAAU,CACZ,EAEA,OADAd,EAAiBR,EAAUY,CAAK,EACzBA,CACT,CAAC,CACH,CAEA,SAASY,EAAgB,EAAkB,EAAmC,CAC5E,OAAOtB,EAAcF,MAAgB,CACnC,IAAMe,EAAUtB,EAAK,KAAKO,EAAUN,CAAY,EAC1CkB,EAAQC,EAAW,KAAK,MAAMrB,EAAG,aAAauB,EAAS,MAAM,CAAC,EAAcA,CAAO,EACzF,GAAIH,EAAM,YAAca,EACtB,MAAU,MAAM,wDAAwD,EAC1E,GAAIb,EAAM,mBAAsC,MAAU,MAAM,sCAAsC,EACtG,IAAMc,EAAO,CAAE,GAAGd,EAAO,SAAUA,EAAM,SAAW,CAAE,EAEtD,OADAJ,EAAiBR,EAAU0B,CAAI,EACxBA,EAAK,QACd,CAAC,CACH,CAEA,SAASC,EAAe,EAA0B,CAChD,OAAO7B,EAAWL,EAAK,QAAQmC,CAAQ,CAAC,CAAC,YAAY,IAAM,0BAC7D,CAGA,SAASC,EAAK,EAAc,EAAiB,EAA2B,CACtE,IAAMC,EAAUtC,EAAG,YAAYuC,EAAS,CAAE,cAAe,EAAK,CAAC,EAC/D,IAAK,IAAMC,KAASF,EAAS,CAC3B,IAAMG,EAAOxC,EAAK,KAAKsC,EAASC,EAAM,IAAI,EACpC/B,EAAOT,EAAG,UAAUyC,CAAI,EAC9B,GAAIhC,EAAK,eAAe,EAAG,MAAU,MAAM,mCAAmCgC,GAAM,EACpF,GAAIhC,EAAK,YAAY,EAAG,CACtB4B,EAAKK,EAAMD,EAAME,CAAI,EACrB,QACF,CACA,GAAI,CAAClC,EAAK,OAAO,EAAG,MAAU,MAAM,uCAAuCgC,GAAM,EACjF,GAAIrC,EAAQ,IAAIH,EAAK,QAAQuC,EAAM,IAAI,CAAC,EAAG,SAC3C,IAAMI,EAAQ5C,EAAG,aAAayC,CAAI,EAClCE,EAAK,KAAK,CACR,KAAM,IAAI1C,EACP,SAASyC,EAAMD,CAAI,CAAC,CACpB,MAAMxC,EAAK,GAAG,CAAC,CACf,IAAK,GAAY,mBAAmB4C,CAAO,CAAC,CAAC,CAC7C,KAAK,GAAG,IACX,OAAQC,EAAW,QAAQ,CAAC,CAAC,OAAOF,CAAK,CAAC,CAAC,OAAO,KAAK,EACvD,WAAYA,EAAM,WAClB,YAAaT,EAAeM,CAAI,CAClC,CAAC,CACH,CACF,CAEA,SAAgBM,EAAmB,EAAkB,MAA6C,CAAC,EAAiB,CAClH,IAAMC,EAAMpB,EAAkBpB,CAAQ,EAChCyC,EAAaC,EAAiBF,EAAI,UAAU,EAC5CG,kBAAQ,IAAI,IACZC,GAAc,EAAmB,IAAmC,GAAGC,EAAQ,GAAGpD,EAAK,QAAQqD,CAAS,IAExGC,GAAa,EAAmB,IAA6D,CACjG,IAAMC,EAAWxD,EAAG,UAAUsD,CAAS,EACvC,GAAI,CAACE,EAAS,YAAY,GAAKA,EAAS,eAAe,EACrD,MAAU,MAAM,0CAA0CF,GAAW,EAEvE,IAAMG,EAAwB,CAAC,EAE/B,GADApB,EAAKiB,EAAWA,EAAWG,CAAM,EAC7BA,EAAO,SAAW,EAAG,OACzBA,EAAO,MAAM,EAAM,IAAUC,EAAK,KAAK,cAAcC,EAAM,IAAI,CAAC,EAChE,IAAMC,EAA2B,CAC/B,QAAA,EACA,SAAU5B,EAAgBxB,EAAUwC,EAAI,SAAS,EACjD,QAAS,KAAK,IAAI,EAClB,QACF,EACA,GAAI,CAACa,EAAiBD,EAAUP,CAAO,EAAG,MAAU,MAAM,+BAA+BA,EAAQ,iBAAiB,EAKlH,MAAO,CAAE,WAAU,UAJDS,EAAW3D,CAAc,CAAC,CACzC,OAAO4D,EAAkBH,CAAQ,CAAC,CAAC,CACnC,KAAK,CAAE,IAAKX,EAAY,YAAa,YAAa,CAAC,CAAC,CACpD,SAAS,WACe,EAAG,UAAWD,EAAI,SAAU,CACzD,EAEMgB,GAAQ,EAAmB,EAAyB,QAA4C,CACpG,IAAMC,EAAWb,EAAWE,EAAWD,CAAO,EAC9C,GAAIF,EAAM,IAAIc,CAAQ,EAAG,OAAOd,EAAM,IAAIc,CAAQ,EAClD,IAAMC,EAASX,EAAUtD,EAAK,QAAQqD,CAAS,EAAGD,CAAO,EAEzD,OADAF,EAAM,IAAIc,EAAUC,CAAM,EACnBA,CACT,EAEA,MAAO,CACL,cAAiBlB,EAAI,UACrB,OACA,QAAQ,EAAW,EAAU,MAAO,CAElC,OADAG,EAAM,OAAOC,EAAWE,EAAWD,CAAO,CAAC,EACpCW,EAAKV,EAAWD,CAAO,CAChC,EACA,WAAW,EAAW,CACpB,GAAIC,IAAc,IAAA,GAChBH,EAAM,MAAM,OAGd,IAAK,IAAME,KAAWhD,EAAU8C,EAAM,OAAOC,EAAWE,EAAWD,CAAO,CAAC,CAC7E,EACA,OAAO,EAAK,EAAQ,CAClB,OAAOS,EAAW3D,CAAc,CAAC,CAC9B,OAAOgE,EAAiBC,EAAKC,CAAM,CAAC,CAAC,CACrC,KAAK,CAAE,IAAKpB,EAAY,YAAa,YAAa,CAAC,CAAC,CACpD,SAAS,WAAW,CACzB,CACF,CACF,CAGA,SAAgBtB,EAAY,EAA+B,CACzD,OAAO,OAAO,KAAK2C,EAAgBC,CAAa,CAAC,CAAC,OAAO,CAAE,KAAM,OAAQ,OAAQ,KAAM,CAAC,CAAW,CAAC,CAAC,SACnG,WACF,CACF"}

package/dist/types/bundleManifest.cjs CHANGED Viewed

@@ -1,3 +1,3 @@
 const e=`/index.html`,t=/^po\/[a-z0-9-]+\/v[1-9][0-9]*$/u,n=/^[0-9a-f]{64}$/u,r=/^[A-Za-z0-9_-]+$/u,i=/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/u;function a(e,t){let n=Object.keys(e).sort();return n.length===t.length&&n.every((e,n)=>e===t[n])}function o(e,t){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=t}function s(e){return typeof e!=`string`||e.length<2||!e.startsWith(`/`)||e.includes(`\\`)||e.includes(`\0`)||e.includes(`?`)||e.includes(`#`)||/[^\x21-\x7e]/u.test(e)||e.includes(`//`)||/%(?![0-9a-f]{2})/iu.test(e)||/%(?:2e|2f|5c)/iu.test(e)?!1:e.split(`/`).slice(1).every(e=>e!==``&&e!==`.`&&e!==`..`)}function c(e){let t=[...e.assets].sort((e,t)=>e.path<t.path?-1:+(e.path>t.path)).map(e=>`${e.path}\0${e.sha256}\0${String(e.byteLength)}\0${e.contentType}`);return[String(e.version),String(e.revision),String(e.builtAt),...t].join(`
-`)}function l(e,n){if(!t.test(e))throw Error(`invalid attestation tag: ${e}`);if(!Array.isArray(n)||!n.every(e=>typeof e==`string`))throw Error(`invalid attestation fields for ${e}`);return new TextEncoder().encode(`${e}\n${JSON.stringify(n)}`)}function u(t,n,r){if(r===`web`)return n.has(e);if(r!==`native`||t.length!==1)return!1;let[i]=t;return i!==void 0&&i.path===`/composition.js`&&i.contentType===`text/javascript`&&i.byteLength<=4194304}function d(e,t=`web`){if(typeof e!=`object`||!e||!a(e,[`assets`,`builtAt`,`revision`,`version`]))return!1;let r=e;if(r.version!==2||!o(r.revision,1)||!o(r.builtAt,0)||!Array.isArray(r.assets)||r.assets.length===0)return!1;let c=/* @__PURE__ */ new Set;for(let e of r.assets){if(typeof e!=`object`||!e||!a(e,[`byteLength`,`contentType`,`path`,`sha256`]))return!1;let t=e;if(!s(t.path)||c.has(t.path)||typeof t.sha256!=`string`||!n.test(t.sha256)||!o(t.byteLength,0)||typeof t.contentType!=`string`||!i.test(t.contentType))return!1;c.add(t.path)}return u(r.assets,c,t)}function f(e,t=`web`){if(typeof e!=`object`||!e||!a(e,[`manifest`,`publicKey`,`signature`]))return!1;let n=e;return d(n.manifest,t)&&typeof n.signature==`string`&&n.signature.length===86&&r.test(n.signature)&&typeof n.publicKey==`string`&&n.publicKey.length<=512&&r.test(n.publicKey)}function p(e,t){return e.assets.find(e=>e.path===t)}function m(e,t){return p(e,t)?.sha256}exports.ATTESTATION_TAG=t,exports.BUNDLE_MANIFEST_ROUTE=`/bundle-manifest.json`,exports.BUNDLE_MANIFEST_VERSION=2,exports.NATIVE_COMPOSITION_MAX_BYTES=4194304,exports.NATIVE_ENTRY_CONTENT_TYPE=`text/javascript`,exports.NATIVE_ENTRY_PATH=`/composition.js`,exports.WEB_ENTRY_PATH=e,exports.assetFor=p,exports.attestationBytes=l,exports.canonicalManifest=c,exports.digestFor=m,exports.isBundleManifest=d,exports.isSignedBundleManifest=f;
+`)}function l(e,n){if(!t.test(e))throw Error(`invalid attestation tag: ${e}`);if(!Array.isArray(n)||!n.every(e=>typeof e==`string`))throw Error(`invalid attestation fields for ${e}`);return new TextEncoder().encode(`${e}\n${JSON.stringify(n)}`)}function u(t,n,r){if(r===`web`)return n.has(e);if(r===`app`)return!n.has(`/index.html`)&&!n.has(`/composition.js`)&&n.has(`/app.json`)&&t.some(e=>e.path.startsWith(`/bundle/`))&&t.every(e=>e.byteLength<=2097152);if(r!==`native`||t.length!==1)return!1;let[i]=t;return i!==void 0&&i.path===`/composition.js`&&i.contentType===`text/javascript`&&i.byteLength<=4194304}function d(e,t=`web`){if(typeof e!=`object`||!e||!a(e,[`assets`,`builtAt`,`revision`,`version`]))return!1;let r=e;if(r.version!==2||!o(r.revision,1)||!o(r.builtAt,0)||!Array.isArray(r.assets)||r.assets.length===0)return!1;let c=/* @__PURE__ */ new Set;for(let e of r.assets){if(typeof e!=`object`||!e||!a(e,[`byteLength`,`contentType`,`path`,`sha256`]))return!1;let t=e;if(!s(t.path)||c.has(t.path)||typeof t.sha256!=`string`||!n.test(t.sha256)||!o(t.byteLength,0)||typeof t.contentType!=`string`||!i.test(t.contentType))return!1;c.add(t.path)}return u(r.assets,c,t)}function f(e,t=`web`){if(typeof e!=`object`||!e||!a(e,[`manifest`,`publicKey`,`signature`]))return!1;let n=e;return d(n.manifest,t)&&typeof n.signature==`string`&&n.signature.length===86&&r.test(n.signature)&&typeof n.publicKey==`string`&&n.publicKey.length<=512&&r.test(n.publicKey)}function p(e,t){return e.assets.find(e=>e.path===t)}function m(e,t){return p(e,t)?.sha256}exports.APP_ASSET_MAX_BYTES=2097152,exports.APP_DESCRIPTOR_PATH=`/app.json`,exports.APP_PART_PREFIX=`/bundle/`,exports.ATTESTATION_TAG=t,exports.BUNDLE_MANIFEST_ROUTE=`/bundle-manifest.json`,exports.BUNDLE_MANIFEST_VERSION=2,exports.NATIVE_COMPOSITION_MAX_BYTES=4194304,exports.NATIVE_ENTRY_CONTENT_TYPE=`text/javascript`,exports.NATIVE_ENTRY_PATH=`/composition.js`,exports.WEB_ENTRY_PATH=e,exports.assetFor=p,exports.attestationBytes=l,exports.canonicalManifest=c,exports.digestFor=m,exports.isBundleManifest=d,exports.isSignedBundleManifest=f;
 //# sourceMappingURL=bundleManifest.cjs.map

package/dist/types/bundleManifest.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"bundleManifest.cjs","names":["WEB_ENTRY_PATH","ATTESTATION_TAG","SHA256","BASE64URL","CONTENT_TYPE","hasExactKeys","keys","value","expected","key","index","isSafeInteger","minimum","isSafeAssetPath","segment","canonicalManifest","lines","manifest","left","right","asset","attestationBytes","tag","fields","field","matchesProfile","profile","paths","assets","entry","isBundleManifest","candidate","valueAsset","isSignedBundleManifest","assetFor","path","digestFor"],"sources":["../../src/types/bundleManifest.ts"],"sourcesContent":["/*\n A signed description of cockpit assets for an independently trusted verifier.\n \n A manifest does not let a browser SPA defend itself against the server or TLS\n * edge that supplied its executable code. Consumers need a separately trusted\n * bootstrap and key before these signatures become a delivery guarantee.\n /\n\nexport const BUNDLE_MANIFEST_ROUTE = '/bundle-manifest.json';\nexport const BUNDLE_MANIFEST_VERSION = 2;\n\n/\n Which asset shape a manifest must have. A web bundle always serves `/index.html`; a native bundle is\n * exactly one composition module and never serves `/index.html`, so no manifest can pass both.\n /\nexport type BundleProfile = 'web' \| 'native';\nexport const WEB_ENTRY_PATH = '/index.html';\nexport const NATIVE_ENTRY_PATH = '/composition.js';\nexport const NATIVE_ENTRY_CONTENT_TYPE = 'text/javascript';\n/* Largest native composition a sealed response can carry. /\nexport const NATIVE_COMPOSITION_MAX_BYTES = 4 1024 * 1024;\n/** Domain-separation tag for an attestation. Starts with `p`, so it can never collide with a `2\\n` manifest. /\nexport const ATTESTATION_TAG = /^po\\/[a-z0-9-]+\\/v[1-9][0-9]$/u;\n\nconst SHA256 = /^[0-9a-f]{64}$/u;\nconst BASE64URL = /^[A-Za-z0-9_-]+$/u;\nconst CONTENT_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]\\/[a-z0-9][a-z0-9!#$&^_.+-]$/u;\n\nexport interface BundleAsset {\n /** Normalized absolute URL path, without a query or fragment. /\n path: string;\n /* Lowercase hex SHA-256 of the served bytes. /\n sha256: string;\n byteLength: number;\n /* MIME type of the response, without parameters. /\n contentType: string;\n}\n\nexport interface BundleManifest {\n version: typeof BUNDLE_MANIFEST_VERSION;\n /* Monotonically increasing persistent signer revision. /\n revision: number;\n /* Unix time in milliseconds. /\n builtAt: number;\n assets: BundleAsset[];\n}\n\nexport interface SignedBundleManifest {\n manifest: BundleManifest;\n /* Base64url IEEE P1363 ECDSA P-256 signature over the canonical serialization. /\n signature: string;\n /* Base64url SPKI of the signing key. Trust must be established out of band. /\n publicKey: string;\n}\n\nfunction hasExactKeys(value: object, expected: readonly string[]): boolean {\n const keys = Object.keys(value).sort();\n return keys.length === expected.length && keys.every((key, index) => key === expected[index]);\n}\n\nfunction isSafeInteger(value: unknown, minimum: number): value is number {\n return typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum;\n}\n\nfunction isSafeAssetPath(value: unknown): value is string {\n if (typeof value !== 'string' \|\| value.length < 2 \|\| !value.startsWith('/')) return false;\n if (value.includes('\\\\') \|\| value.includes('\\0') \|\| value.includes('?') \|\| value.includes('#')) return false;\n if (/[^\\x21-\\x7e]/u.test(value) \|\| value.includes('//') \|\| /%(?![0-9a-f]{2})/iu.test(value)) return false;\n if (/%(?:2e\|2f\|5c)/iu.test(value)) return false;\n return value\n .split('/')\n .slice(1)\n .every((segment) => segment !== '' && segment !== '.' && segment !== '..');\n}\n\n/* The exact bytes signed by Node and verified by WebCrypto. /\nexport function canonicalManifest(manifest: BundleManifest): string {\n const assets = [...manifest.assets].sort((left, right) =>\n left.path < right.path ? -1 : left.path > right.path ? 1 : 0,\n );\n const lines = assets.map(\n (asset) => `${asset.path}\\0${asset.sha256}\\0${String(asset.byteLength)}\\0${asset.contentType}`,\n );\n return [String(manifest.version), String(manifest.revision), String(manifest.builtAt), ...lines].join('\\n');\n}\n\n/\n The exact bytes of a tagged attestation: `UTF-8(tag + \"\\n\" + JSON.stringify(fields))`. Fields are an\n * ordered list of strings, so both sides build the same bytes without relying on object key order.\n * Throws on a malformed tag or a non-string field.\n /\nexport function attestationBytes(tag: string, fields: readonly string[]): Uint8Array<ArrayBuffer> {\n if (!ATTESTATION_TAG.test(tag)) throw new Error(`invalid attestation tag: ${tag}`);\n if (!Array.isArray(fields) \|\| !fields.every((field) => typeof field === 'string')) {\n throw new Error(`invalid attestation fields for ${tag}`);\n }\n return new TextEncoder().encode(`${tag}\\n${JSON.stringify(fields)}`);\n}\n\nfunction matchesProfile(assets: readonly BundleAsset[], paths: ReadonlySet<string>, profile: BundleProfile): boolean {\n if (profile === 'web') return paths.has(WEB_ENTRY_PATH);\n if (profile !== 'native' \|\| assets.length !== 1) return false;\n const [entry] = assets;\n return (\n entry !== undefined &&\n entry.path === NATIVE_ENTRY_PATH &&\n entry.contentType === NATIVE_ENTRY_CONTENT_TYPE &&\n entry.byteLength <= NATIVE_COMPOSITION_MAX_BYTES\n );\n}\n\nexport function isBundleManifest(value: unknown, profile: BundleProfile = 'web'): value is BundleManifest {\n if (typeof value !== 'object' \|\| value === null) return false;\n if (!hasExactKeys(value, ['assets', 'builtAt', 'revision', 'version'])) return false;\n const candidate = value as Partial<BundleManifest>;\n if (candidate.version !== BUNDLE_MANIFEST_VERSION) return false;\n if (!isSafeInteger(candidate.revision, 1) \|\| !isSafeInteger(candidate.builtAt, 0)) return false;\n if (!Array.isArray(candidate.assets) \|\| candidate.assets.length === 0) return false;\n\n const paths = new Set<string>();\n for (const valueAsset of candidate.assets) {\n if (typeof valueAsset !== 'object' \|\| valueAsset === null) return false;\n if (!hasExactKeys(valueAsset, ['byteLength', 'contentType', 'path', 'sha256'])) return false;\n const asset = valueAsset as Partial<BundleAsset>;\n if (!isSafeAssetPath(asset.path) \|\| paths.has(asset.path)) return false;\n if (typeof asset.sha256 !== 'string' \|\| !SHA256.test(asset.sha256)) return false;\n if (!isSafeInteger(asset.byteLength, 0)) return false;\n if (typeof asset.contentType !== 'string' \|\| !CONTENT_TYPE.test(asset.contentType)) return false;\n paths.add(asset.path);\n }\n return matchesProfile(candidate.assets as BundleAsset[], paths, profile);\n}\n\nexport function isSignedBundleManifest(value: unknown, profile: BundleProfile = 'web'): value is SignedBundleManifest {\n if (typeof value !== 'object' \|\| value === null) return false;\n if (!hasExactKeys(value, ['manifest', 'publicKey', 'signature'])) return false;\n const candidate = value as Partial<SignedBundleManifest>;\n return (\n isBundleManifest(candidate.manifest, profile) &&\n typeof candidate.signature === 'string' &&\n candidate.signature.length === 86 &&\n BASE64URL.test(candidate.signature) &&\n typeof candidate.publicKey === 'string' &&\n candidate.publicKey.length <= 512 &&\n BASE64URL.test(candidate.publicKey)\n );\n}\n\n/* The recorded asset for one path, or undefined if the manifest does not cover it. /\nexport function assetFor(manifest: BundleManifest, path: string): BundleAsset \| undefined {\n return manifest.assets.find((asset) => asset.path === path);\n}\n\n/* The recorded digest for one asset, or undefined if the manifest does not cover it. */\nexport function digestFor(manifest: BundleManifest, path: string): string \| undefined {\n return assetFor(manifest, path)?.sha256;\n}\n"],"mappings":"AAQA,MAQaA,EAAiB,cAMjBC,EAAkB,kCAEzBC,EAAS,kBACTC,EAAY,oBACZC,EAAe,4DA6BrB,SAASC,EAAa,EAAe,EAAsC,CACzE,IAAMC,EAAO,OAAO,KAAKC,CAAK,CAAC,CAAC,KAAK,EACrC,OAAOD,EAAK,SAAWE,EAAS,QAAUF,EAAK,OAAO,EAAK,IAAUG,IAAQD,EAASE,EAAM,CAC9F,CAEA,SAASC,EAAc,EAAgB,EAAkC,CACvE,OAAO,OAAOJ,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAASK,CAC9E,CAEA,SAASC,EAAgB,EAAiC,CAKxD,OAJI,OAAON,GAAU,UAAYA,EAAM,OAAS,GAAK,CAACA,EAAM,WAAW,GAAG,GACtEA,EAAM,SAAS,IAAI,GAAKA,EAAM,SAAS,IAAI,GAAKA,EAAM,SAAS,GAAG,GAAKA,EAAM,SAAS,GAAG,GACzF,gBAAgB,KAAKA,CAAK,GAAKA,EAAM,SAAS,IAAI,GAAK,qBAAqB,KAAKA,CAAK,GACtF,kBAAkB,KAAKA,CAAK,EAAU,GACnCA,EACJ,MAAM,GAAG,CAAC,CACV,MAAM,CAAC,CAAC,CACR,MAAO,GAAYO,IAAY,IAAMA,IAAY,KAAOA,IAAY,IAAI,CAC7E,CAGA,SAAgBC,EAAkB,EAAkC,CAIlE,IAAMC,EAHS,CAAC,GAAGC,EAAS,MAAM,CAAC,CAAC,MAAM,EAAM,IAC9CC,EAAK,KAAOC,EAAM,KAAO,GAAK,IAAK,KAAOA,EAAM,KAE/B,CAAC,CAAC,IAClB,GAAU,GAAGC,EAAM,KAAK,IAAIA,EAAM,OAAO,IAAI,OAAOA,EAAM,UAAU,EAAE,IAAIA,EAAM,aACnF,EACA,MAAO,CAAC,OAAOH,EAAS,OAAO,EAAG,OAAOA,EAAS,QAAQ,EAAG,OAAOA,EAAS,OAAO,EAAG,GAAGD,CAAK,CAAC,CAAC,KAAK;CAAI,CAC5G,CAOA,SAAgBK,EAAiB,EAAa,EAAoD,CAChG,GAAI,CAACpB,EAAgB,KAAKqB,CAAG,EAAG,MAAU,MAAM,4BAA4BA,GAAK,EACjF,GAAI,CAAC,MAAM,QAAQC,CAAM,GAAK,CAACA,EAAO,MAAO,GAAU,OAAOC,GAAU,QAAQ,EAC9E,MAAU,MAAM,kCAAkCF,GAAK,EAEzD,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,GAAGA,EAAI,IAAI,KAAK,UAAUC,CAAM,GAAG,CACrE,CAEA,SAASE,EAAe,EAAgC,EAA4B,EAAiC,CACnH,GAAIC,IAAY,MAAO,OAAOC,EAAM,IAAI3B,CAAc,EACtD,GAAI0B,IAAY,UAAYE,EAAO,SAAW,EAAG,MAAO,GACxD,GAAM,CAACC,GAASD,EAChB,OACEC,IAAU,IAAA,IACVA,EAAM,OAAA,mBACNA,EAAM,cAAA,mBACNA,EAAM,YAAA,OAEV,CAEA,SAAgBC,EAAiB,EAAgB,EAAyB,MAAgC,CAExG,GADI,OAAOvB,GAAU,WAAYA,GAC7B,CAACF,EAAaE,EAAO,CAAC,SAAU,UAAW,WAAY,SAAS,CAAC,EAAG,MAAO,GAC/E,IAAMwB,EAAYxB,EAGlB,GAFIwB,EAAU,UAAA,GACV,CAACpB,EAAcoB,EAAU,SAAU,CAAC,GAAK,CAACpB,EAAcoB,EAAU,QAAS,CAAC,GAC5E,CAAC,MAAM,QAAQA,EAAU,MAAM,GAAKA,EAAU,OAAO,SAAW,EAAG,MAAO,GAE9E,IAAMJ,kBAAQ,IAAI,IAClB,IAAK,IAAMK,KAAcD,EAAU,OAAQ,CAEzC,GADI,OAAOC,GAAe,WAAYA,GAClC,CAAC3B,EAAa2B,EAAY,CAAC,aAAc,cAAe,OAAQ,QAAQ,CAAC,EAAG,MAAO,GACvF,IAAMZ,EAAQY,EAId,GAHI,CAACnB,EAAgBO,EAAM,IAAI,GAAKO,EAAM,IAAIP,EAAM,IAAI,GACpD,OAAOA,EAAM,QAAW,UAAY,CAAClB,EAAO,KAAKkB,EAAM,MAAM,GAC7D,CAACT,EAAcS,EAAM,WAAY,CAAC,GAClC,OAAOA,EAAM,aAAgB,UAAY,CAAChB,EAAa,KAAKgB,EAAM,WAAW,EAAG,MAAO,GAC3FO,EAAM,IAAIP,EAAM,IAAI,CACtB,CACA,OAAOK,EAAeM,EAAU,OAAyBJ,EAAOD,CAAO,CACzE,CAEA,SAAgBO,EAAuB,EAAgB,EAAyB,MAAsC,CAEpH,GADI,OAAO1B,GAAU,WAAYA,GAC7B,CAACF,EAAaE,EAAO,CAAC,WAAY,YAAa,WAAW,CAAC,EAAG,MAAO,GACzE,IAAMwB,EAAYxB,EAClB,OACEuB,EAAiBC,EAAU,SAAUL,CAAO,GAC5C,OAAOK,EAAU,WAAc,UAC/BA,EAAU,UAAU,SAAW,IAC/B5B,EAAU,KAAK4B,EAAU,SAAS,GAClC,OAAOA,EAAU,WAAc,UAC/BA,EAAU,UAAU,QAAU,KAC9B5B,EAAU,KAAK4B,EAAU,SAAS,CAEtC,CAGA,SAAgBG,EAAS,EAA0B,EAAuC,CACxF,OAAOjB,EAAS,OAAO,KAAM,GAAUG,EAAM,OAASe,CAAI,CAC5D,CAGA,SAAgBC,EAAU,EAA0B,EAAkC,CACpF,OAAOF,EAASjB,EAAUkB,CAAI,CAAC,EAAE,MACnC"}
1	+ {"version":3,"file":"bundleManifest.cjs","names":["WEB_ENTRY_PATH","ATTESTATION_TAG","SHA256","BASE64URL","CONTENT_TYPE","hasExactKeys","keys","value","expected","key","index","isSafeInteger","minimum","isSafeAssetPath","segment","canonicalManifest","lines","manifest","left","right","asset","attestationBytes","tag","fields","field","matchesProfile","profile","paths","assets","entry","isBundleManifest","candidate","valueAsset","isSignedBundleManifest","assetFor","path","digestFor"],"sources":["../../src/types/bundleManifest.ts"],"sourcesContent":["/*\n A signed description of cockpit assets for an independently trusted verifier.\n \n A manifest does not let a browser SPA defend itself against the server or TLS\n * edge that supplied its executable code. Consumers need a separately trusted\n * bootstrap and key before these signatures become a delivery guarantee.\n /\n\nexport const BUNDLE_MANIFEST_ROUTE = '/bundle-manifest.json';\nexport const BUNDLE_MANIFEST_VERSION = 2;\n\n/\n Which asset shape a manifest must have. A web bundle always serves `/index.html`; a native bundle is\n * exactly one composition module and never serves `/index.html`; an app bundle is `/app.json` plus\n * `/bundle/` parts and serves neither entry, so no manifest can pass two profiles.\n /\nexport type BundleProfile = 'web' \| 'native' \| 'app';\nexport const WEB_ENTRY_PATH = '/index.html';\nexport const NATIVE_ENTRY_PATH = '/composition.js';\nexport const NATIVE_ENTRY_CONTENT_TYPE = 'text/javascript';\n/* Largest native composition a sealed response can carry. /\nexport const NATIVE_COMPOSITION_MAX_BYTES = 4 1024 * 1024;\n/** JSON `{ platform, fingerprint }` naming the native binary an app bundle runs on. /\nexport const APP_DESCRIPTOR_PATH = '/app.json';\n/* App JS bundle parts; concatenated in path order they are the bundle. /\nexport const APP_PART_PREFIX = '/bundle/';\n/* Largest app asset, so every part fits one sealed response. /\nexport const APP_ASSET_MAX_BYTES = 2 1024 * 1024;\n/** Domain-separation tag for an attestation. Starts with `p`, so it can never collide with a `2\\n` manifest. /\nexport const ATTESTATION_TAG = /^po\\/[a-z0-9-]+\\/v[1-9][0-9]$/u;\n\nconst SHA256 = /^[0-9a-f]{64}$/u;\nconst BASE64URL = /^[A-Za-z0-9_-]+$/u;\nconst CONTENT_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]\\/[a-z0-9][a-z0-9!#$&^_.+-]$/u;\n\nexport interface BundleAsset {\n /** Normalized absolute URL path, without a query or fragment. /\n path: string;\n /* Lowercase hex SHA-256 of the served bytes. /\n sha256: string;\n byteLength: number;\n /* MIME type of the response, without parameters. /\n contentType: string;\n}\n\nexport interface BundleManifest {\n version: typeof BUNDLE_MANIFEST_VERSION;\n /* Monotonically increasing persistent signer revision. /\n revision: number;\n /* Unix time in milliseconds. /\n builtAt: number;\n assets: BundleAsset[];\n}\n\nexport interface SignedBundleManifest {\n manifest: BundleManifest;\n /* Base64url IEEE P1363 ECDSA P-256 signature over the canonical serialization. /\n signature: string;\n /* Base64url SPKI of the signing key. Trust must be established out of band. /\n publicKey: string;\n}\n\nfunction hasExactKeys(value: object, expected: readonly string[]): boolean {\n const keys = Object.keys(value).sort();\n return keys.length === expected.length && keys.every((key, index) => key === expected[index]);\n}\n\nfunction isSafeInteger(value: unknown, minimum: number): value is number {\n return typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum;\n}\n\nfunction isSafeAssetPath(value: unknown): value is string {\n if (typeof value !== 'string' \|\| value.length < 2 \|\| !value.startsWith('/')) return false;\n if (value.includes('\\\\') \|\| value.includes('\\0') \|\| value.includes('?') \|\| value.includes('#')) return false;\n if (/[^\\x21-\\x7e]/u.test(value) \|\| value.includes('//') \|\| /%(?![0-9a-f]{2})/iu.test(value)) return false;\n if (/%(?:2e\|2f\|5c)/iu.test(value)) return false;\n return value\n .split('/')\n .slice(1)\n .every((segment) => segment !== '' && segment !== '.' && segment !== '..');\n}\n\n/* The exact bytes signed by Node and verified by WebCrypto. /\nexport function canonicalManifest(manifest: BundleManifest): string {\n const assets = [...manifest.assets].sort((left, right) =>\n left.path < right.path ? -1 : left.path > right.path ? 1 : 0,\n );\n const lines = assets.map(\n (asset) => `${asset.path}\\0${asset.sha256}\\0${String(asset.byteLength)}\\0${asset.contentType}`,\n );\n return [String(manifest.version), String(manifest.revision), String(manifest.builtAt), ...lines].join('\\n');\n}\n\n/\n The exact bytes of a tagged attestation: `UTF-8(tag + \"\\n\" + JSON.stringify(fields))`. Fields are an\n * ordered list of strings, so both sides build the same bytes without relying on object key order.\n * Throws on a malformed tag or a non-string field.\n /\nexport function attestationBytes(tag: string, fields: readonly string[]): Uint8Array<ArrayBuffer> {\n if (!ATTESTATION_TAG.test(tag)) throw new Error(`invalid attestation tag: ${tag}`);\n if (!Array.isArray(fields) \|\| !fields.every((field) => typeof field === 'string')) {\n throw new Error(`invalid attestation fields for ${tag}`);\n }\n return new TextEncoder().encode(`${tag}\\n${JSON.stringify(fields)}`);\n}\n\nfunction matchesProfile(assets: readonly BundleAsset[], paths: ReadonlySet<string>, profile: BundleProfile): boolean {\n if (profile === 'web') return paths.has(WEB_ENTRY_PATH);\n if (profile === 'app') {\n return (\n !paths.has(WEB_ENTRY_PATH) &&\n !paths.has(NATIVE_ENTRY_PATH) &&\n paths.has(APP_DESCRIPTOR_PATH) &&\n assets.some((asset) => asset.path.startsWith(APP_PART_PREFIX)) &&\n assets.every((asset) => asset.byteLength <= APP_ASSET_MAX_BYTES)\n );\n }\n if (profile !== 'native' \|\| assets.length !== 1) return false;\n const [entry] = assets;\n return (\n entry !== undefined &&\n entry.path === NATIVE_ENTRY_PATH &&\n entry.contentType === NATIVE_ENTRY_CONTENT_TYPE &&\n entry.byteLength <= NATIVE_COMPOSITION_MAX_BYTES\n );\n}\n\nexport function isBundleManifest(value: unknown, profile: BundleProfile = 'web'): value is BundleManifest {\n if (typeof value !== 'object' \|\| value === null) return false;\n if (!hasExactKeys(value, ['assets', 'builtAt', 'revision', 'version'])) return false;\n const candidate = value as Partial<BundleManifest>;\n if (candidate.version !== BUNDLE_MANIFEST_VERSION) return false;\n if (!isSafeInteger(candidate.revision, 1) \|\| !isSafeInteger(candidate.builtAt, 0)) return false;\n if (!Array.isArray(candidate.assets) \|\| candidate.assets.length === 0) return false;\n\n const paths = new Set<string>();\n for (const valueAsset of candidate.assets) {\n if (typeof valueAsset !== 'object' \|\| valueAsset === null) return false;\n if (!hasExactKeys(valueAsset, ['byteLength', 'contentType', 'path', 'sha256'])) return false;\n const asset = valueAsset as Partial<BundleAsset>;\n if (!isSafeAssetPath(asset.path) \|\| paths.has(asset.path)) return false;\n if (typeof asset.sha256 !== 'string' \|\| !SHA256.test(asset.sha256)) return false;\n if (!isSafeInteger(asset.byteLength, 0)) return false;\n if (typeof asset.contentType !== 'string' \|\| !CONTENT_TYPE.test(asset.contentType)) return false;\n paths.add(asset.path);\n }\n return matchesProfile(candidate.assets as BundleAsset[], paths, profile);\n}\n\nexport function isSignedBundleManifest(value: unknown, profile: BundleProfile = 'web'): value is SignedBundleManifest {\n if (typeof value !== 'object' \|\| value === null) return false;\n if (!hasExactKeys(value, ['manifest', 'publicKey', 'signature'])) return false;\n const candidate = value as Partial<SignedBundleManifest>;\n return (\n isBundleManifest(candidate.manifest, profile) &&\n typeof candidate.signature === 'string' &&\n candidate.signature.length === 86 &&\n BASE64URL.test(candidate.signature) &&\n typeof candidate.publicKey === 'string' &&\n candidate.publicKey.length <= 512 &&\n BASE64URL.test(candidate.publicKey)\n );\n}\n\n/* The recorded asset for one path, or undefined if the manifest does not cover it. /\nexport function assetFor(manifest: BundleManifest, path: string): BundleAsset \| undefined {\n return manifest.assets.find((asset) => asset.path === path);\n}\n\n/* The recorded digest for one asset, or undefined if the manifest does not cover it. */\nexport function digestFor(manifest: BundleManifest, path: string): string \| undefined {\n return assetFor(manifest, path)?.sha256;\n}\n"],"mappings":"AAQA,MASaA,EAAiB,cAYjBC,EAAkB,kCAEzBC,EAAS,kBACTC,EAAY,oBACZC,EAAe,4DA6BrB,SAASC,EAAa,EAAe,EAAsC,CACzE,IAAMC,EAAO,OAAO,KAAKC,CAAK,CAAC,CAAC,KAAK,EACrC,OAAOD,EAAK,SAAWE,EAAS,QAAUF,EAAK,OAAO,EAAK,IAAUG,IAAQD,EAASE,EAAM,CAC9F,CAEA,SAASC,EAAc,EAAgB,EAAkC,CACvE,OAAO,OAAOJ,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAASK,CAC9E,CAEA,SAASC,EAAgB,EAAiC,CAKxD,OAJI,OAAON,GAAU,UAAYA,EAAM,OAAS,GAAK,CAACA,EAAM,WAAW,GAAG,GACtEA,EAAM,SAAS,IAAI,GAAKA,EAAM,SAAS,IAAI,GAAKA,EAAM,SAAS,GAAG,GAAKA,EAAM,SAAS,GAAG,GACzF,gBAAgB,KAAKA,CAAK,GAAKA,EAAM,SAAS,IAAI,GAAK,qBAAqB,KAAKA,CAAK,GACtF,kBAAkB,KAAKA,CAAK,EAAU,GACnCA,EACJ,MAAM,GAAG,CAAC,CACV,MAAM,CAAC,CAAC,CACR,MAAO,GAAYO,IAAY,IAAMA,IAAY,KAAOA,IAAY,IAAI,CAC7E,CAGA,SAAgBC,EAAkB,EAAkC,CAIlE,IAAMC,EAHS,CAAC,GAAGC,EAAS,MAAM,CAAC,CAAC,MAAM,EAAM,IAC9CC,EAAK,KAAOC,EAAM,KAAO,GAAK,IAAK,KAAOA,EAAM,KAE/B,CAAC,CAAC,IAClB,GAAU,GAAGC,EAAM,KAAK,IAAIA,EAAM,OAAO,IAAI,OAAOA,EAAM,UAAU,EAAE,IAAIA,EAAM,aACnF,EACA,MAAO,CAAC,OAAOH,EAAS,OAAO,EAAG,OAAOA,EAAS,QAAQ,EAAG,OAAOA,EAAS,OAAO,EAAG,GAAGD,CAAK,CAAC,CAAC,KAAK;CAAI,CAC5G,CAOA,SAAgBK,EAAiB,EAAa,EAAoD,CAChG,GAAI,CAACpB,EAAgB,KAAKqB,CAAG,EAAG,MAAU,MAAM,4BAA4BA,GAAK,EACjF,GAAI,CAAC,MAAM,QAAQC,CAAM,GAAK,CAACA,EAAO,MAAO,GAAU,OAAOC,GAAU,QAAQ,EAC9E,MAAU,MAAM,kCAAkCF,GAAK,EAEzD,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,GAAGA,EAAI,IAAI,KAAK,UAAUC,CAAM,GAAG,CACrE,CAEA,SAASE,EAAe,EAAgC,EAA4B,EAAiC,CACnH,GAAIC,IAAY,MAAO,OAAOC,EAAM,IAAI3B,CAAc,EACtD,GAAI0B,IAAY,MACd,MACE,CAACC,EAAM,IAAA,aAAkB,GACzB,CAACA,EAAM,IAAA,iBAAqB,GAC5BA,EAAM,IAAA,WAAuB,GAC7BC,EAAO,KAAM,GAAUR,EAAM,KAAK,WAAA,UAA0B,CAAC,GAC7DQ,EAAO,MAAO,GAAUR,EAAM,YAAA,OAAiC,EAGnE,GAAIM,IAAY,UAAYE,EAAO,SAAW,EAAG,MAAO,GACxD,GAAM,CAACC,GAASD,EAChB,OACEC,IAAU,IAAA,IACVA,EAAM,OAAA,mBACNA,EAAM,cAAA,mBACNA,EAAM,YAAA,OAEV,CAEA,SAAgBC,EAAiB,EAAgB,EAAyB,MAAgC,CAExG,GADI,OAAOvB,GAAU,WAAYA,GAC7B,CAACF,EAAaE,EAAO,CAAC,SAAU,UAAW,WAAY,SAAS,CAAC,EAAG,MAAO,GAC/E,IAAMwB,EAAYxB,EAGlB,GAFIwB,EAAU,UAAA,GACV,CAACpB,EAAcoB,EAAU,SAAU,CAAC,GAAK,CAACpB,EAAcoB,EAAU,QAAS,CAAC,GAC5E,CAAC,MAAM,QAAQA,EAAU,MAAM,GAAKA,EAAU,OAAO,SAAW,EAAG,MAAO,GAE9E,IAAMJ,kBAAQ,IAAI,IAClB,IAAK,IAAMK,KAAcD,EAAU,OAAQ,CAEzC,GADI,OAAOC,GAAe,WAAYA,GAClC,CAAC3B,EAAa2B,EAAY,CAAC,aAAc,cAAe,OAAQ,QAAQ,CAAC,EAAG,MAAO,GACvF,IAAMZ,EAAQY,EAId,GAHI,CAACnB,EAAgBO,EAAM,IAAI,GAAKO,EAAM,IAAIP,EAAM,IAAI,GACpD,OAAOA,EAAM,QAAW,UAAY,CAAClB,EAAO,KAAKkB,EAAM,MAAM,GAC7D,CAACT,EAAcS,EAAM,WAAY,CAAC,GAClC,OAAOA,EAAM,aAAgB,UAAY,CAAChB,EAAa,KAAKgB,EAAM,WAAW,EAAG,MAAO,GAC3FO,EAAM,IAAIP,EAAM,IAAI,CACtB,CACA,OAAOK,EAAeM,EAAU,OAAyBJ,EAAOD,CAAO,CACzE,CAEA,SAAgBO,EAAuB,EAAgB,EAAyB,MAAsC,CAEpH,GADI,OAAO1B,GAAU,WAAYA,GAC7B,CAACF,EAAaE,EAAO,CAAC,WAAY,YAAa,WAAW,CAAC,EAAG,MAAO,GACzE,IAAMwB,EAAYxB,EAClB,OACEuB,EAAiBC,EAAU,SAAUL,CAAO,GAC5C,OAAOK,EAAU,WAAc,UAC/BA,EAAU,UAAU,SAAW,IAC/B5B,EAAU,KAAK4B,EAAU,SAAS,GAClC,OAAOA,EAAU,WAAc,UAC/BA,EAAU,UAAU,QAAU,KAC9B5B,EAAU,KAAK4B,EAAU,SAAS,CAEtC,CAGA,SAAgBG,EAAS,EAA0B,EAAuC,CACxF,OAAOjB,EAAS,OAAO,KAAM,GAAUG,EAAM,OAASe,CAAI,CAC5D,CAGA,SAAgBC,EAAU,EAA0B,EAAkC,CACpF,OAAOF,EAASjB,EAAUkB,CAAI,CAAC,EAAE,MACnC"}

package/dist/types/bundleManifest.d.mts CHANGED Viewed

@@ -10,14 +10,21 @@ export declare const BUNDLE_MANIFEST_ROUTE = "/bundle-manifest.json";
 export declare const BUNDLE_MANIFEST_VERSION = 2;
 /**
  * Which asset shape a manifest must have. A web bundle always serves `/index.html`; a native bundle is
- * exactly one composition module and never serves `/index.html`, so no manifest can pass both.
+ * exactly one composition module and never serves `/index.html`; an app bundle is `/app.json` plus
+ * `/bundle/` parts and serves neither entry, so no manifest can pass two profiles.
  */
-export type BundleProfile = 'web' | 'native';
+export type BundleProfile = 'web' | 'native' | 'app';
 export declare const WEB_ENTRY_PATH = "/index.html";
 export declare const NATIVE_ENTRY_PATH = "/composition.js";
 export declare const NATIVE_ENTRY_CONTENT_TYPE = "text/javascript";
 /** Largest native composition a sealed response can carry. */
 export declare const NATIVE_COMPOSITION_MAX_BYTES: number;
+/** JSON `{ platform, fingerprint }` naming the native binary an app bundle runs on. */
+export declare const APP_DESCRIPTOR_PATH = "/app.json";
+/** App JS bundle parts; concatenated in path order they are the bundle. */
+export declare const APP_PART_PREFIX = "/bundle/";
+/** Largest app asset, so every part fits one sealed response. */
+export declare const APP_ASSET_MAX_BYTES: number;
 /** Domain-separation tag for an attestation. Starts with `p`, so it can never collide with a `2\n` manifest. */
 export declare const ATTESTATION_TAG: RegExp;
 export interface BundleAsset {

package/dist/types/bundleManifest.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"bundleManifest.d.mts","names":[],"sources":["../../src/types/bundleManifest.ts"],"mappings":";;;;;;;;qBAQa;qBACA~~;;;;;YAMD~~;qBACC;qBACA;qBACA;;qBAEA;;qBAEA,iBAAe;iBAMX;;EAEf;;EAEA;EACA;;EAEA;;iBAGe;EACf,gBAAgB;;EAEhB;;EAEA;EACA,QAAQ;;iBAGO;EACf,UAAU;;EAEV;;EAEA;;;wBAwBc,kBAAkB,UAAU;;;;;;wBAe5B,iBAAiB,aAAa,4BAA4B,WAAW;~~wBAoBrE~~,iBAAiB,gBAAgB,UAAS,gBAAwB,SAAS;wBAsB3E,uBAAuB,gBAAgB,UAAS,gBAAwB,SAAS;;wBAgBjF,SAAS,UAAU,gBAAgB,eAAe;;wBAKlD,UAAU,UAAU,gBAAgB"}
1	+ {"version":3,"file":"bundleManifest.d.mts","names":[],"sources":["../../src/types/bundleManifest.ts"],"mappings":";;;;;;;;qBAQa;qBACA;;;;;;YAOD;qBACC;qBACA;qBACA;;qBAEA;;qBAEA;;qBAEA;;qBAEA;;qBAEA,iBAAe;iBAMX;;EAEf;;EAEA;EACA;;EAEA;;iBAGe;EACf,gBAAgB;;EAEhB;;EAEA;EACA,QAAQ;;iBAGO;EACf,UAAU;;EAEV;;EAEA;;;wBAwBc,kBAAkB,UAAU;;;;;;wBAe5B,iBAAiB,aAAa,4BAA4B,WAAW;wBA6BrE,iBAAiB,gBAAgB,UAAS,gBAAwB,SAAS;wBAsB3E,uBAAuB,gBAAgB,UAAS,gBAAwB,SAAS;;wBAgBjF,SAAS,UAAU,gBAAgB,eAAe;;wBAKlD,UAAU,UAAU,gBAAgB"}

package/dist/types/bundleManifest.mjs CHANGED Viewed

@@ -1,3 +1,3 @@
-const e=`/bundle-manifest.json`,t=2,n=`/index.html`,r=`/composition.js`,i=`text/javascript`,a=4194304,o=/^po\/[a-z0-9-]+\/v[1-9][0-9]*$/u,s=/^[0-9a-f]{64}$/u,c=/^[A-Za-z0-9_-]+$/u,l=/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/u;function u(e,t){let n=Object.keys(e).sort();return n.length===t.length&&n.every((e,n)=>e===t[n])}function d(e,t){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=t}function f(e){return typeof e!=`string`||e.length<2||!e.startsWith(`/`)||e.includes(`\\`)||e.includes(`\0`)||e.includes(`?`)||e.includes(`#`)||/[^\x21-\x7e]/u.test(e)||e.includes(`//`)||/%(?![0-9a-f]{2})/iu.test(e)||/%(?:2e|2f|5c)/iu.test(e)?!1:e.split(`/`).slice(1).every(e=>e!==``&&e!==`.`&&e!==`..`)}function p(e){let t=[...e.assets].sort((e,t)=>e.path<t.path?-1:+(e.path>t.path)).map(e=>`${e.path}\0${e.sha256}\0${String(e.byteLength)}\0${e.contentType}`);return[String(e.version),String(e.revision),String(e.builtAt),...t].join(`
-`)}function m(e,t){if(!o.test(e))throw Error(`invalid attestation tag: ${e}`);if(!Array.isArray(t)||!t.every(e=>typeof e==`string`))throw Error(`invalid attestation fields for ${e}`);return new TextEncoder().encode(`${e}\n${JSON.stringify(t)}`)}function h(e,t,r){if(r===`web`)return t.has(n);if(r!==`native`||e.length!==1)return!1;let[i]=e;return i!==void 0&&i.path===`/composition.js`&&i.contentType===`text/javascript`&&i.byteLength<=4194304}function g(e,t=`web`){if(typeof e!=`object`||!e||!u(e,[`assets`,`builtAt`,`revision`,`version`]))return!1;let n=e;if(n.version!==2||!d(n.revision,1)||!d(n.builtAt,0)||!Array.isArray(n.assets)||n.assets.length===0)return!1;let r=/* @__PURE__ */ new Set;for(let e of n.assets){if(typeof e!=`object`||!e||!u(e,[`byteLength`,`contentType`,`path`,`sha256`]))return!1;let t=e;if(!f(t.path)||r.has(t.path)||typeof t.sha256!=`string`||!s.test(t.sha256)||!d(t.byteLength,0)||typeof t.contentType!=`string`||!l.test(t.contentType))return!1;r.add(t.path)}return h(n.assets,r,t)}function _(e,t=`web`){if(typeof e!=`object`||!e||!u(e,[`manifest`,`publicKey`,`signature`]))return!1;let n=e;return g(n.manifest,t)&&typeof n.signature==`string`&&n.signature.length===86&&c.test(n.signature)&&typeof n.publicKey==`string`&&n.publicKey.length<=512&&c.test(n.publicKey)}function v(e,t){return e.assets.find(e=>e.path===t)}function y(e,t){return v(e,t)?.sha256}export{o as ATTESTATION_TAG,e as BUNDLE_MANIFEST_ROUTE,t as BUNDLE_MANIFEST_VERSION,a as NATIVE_COMPOSITION_MAX_BYTES,i as NATIVE_ENTRY_CONTENT_TYPE,r as NATIVE_ENTRY_PATH,n as WEB_ENTRY_PATH,v as assetFor,m as attestationBytes,p as canonicalManifest,y as digestFor,g as isBundleManifest,_ as isSignedBundleManifest};
+const e=`/bundle-manifest.json`,t=2,n=`/index.html`,r=`/composition.js`,i=`text/javascript`,a=4194304,o=`/app.json`,s=`/bundle/`,c=2097152,l=/^po\/[a-z0-9-]+\/v[1-9][0-9]*$/u,u=/^[0-9a-f]{64}$/u,d=/^[A-Za-z0-9_-]+$/u,f=/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/u;function p(e,t){let n=Object.keys(e).sort();return n.length===t.length&&n.every((e,n)=>e===t[n])}function m(e,t){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=t}function h(e){return typeof e!=`string`||e.length<2||!e.startsWith(`/`)||e.includes(`\\`)||e.includes(`\0`)||e.includes(`?`)||e.includes(`#`)||/[^\x21-\x7e]/u.test(e)||e.includes(`//`)||/%(?![0-9a-f]{2})/iu.test(e)||/%(?:2e|2f|5c)/iu.test(e)?!1:e.split(`/`).slice(1).every(e=>e!==``&&e!==`.`&&e!==`..`)}function g(e){let t=[...e.assets].sort((e,t)=>e.path<t.path?-1:+(e.path>t.path)).map(e=>`${e.path}\0${e.sha256}\0${String(e.byteLength)}\0${e.contentType}`);return[String(e.version),String(e.revision),String(e.builtAt),...t].join(`
+`)}function _(e,t){if(!l.test(e))throw Error(`invalid attestation tag: ${e}`);if(!Array.isArray(t)||!t.every(e=>typeof e==`string`))throw Error(`invalid attestation fields for ${e}`);return new TextEncoder().encode(`${e}\n${JSON.stringify(t)}`)}function v(e,t,r){if(r===`web`)return t.has(n);if(r===`app`)return!t.has(`/index.html`)&&!t.has(`/composition.js`)&&t.has(`/app.json`)&&e.some(e=>e.path.startsWith(`/bundle/`))&&e.every(e=>e.byteLength<=2097152);if(r!==`native`||e.length!==1)return!1;let[i]=e;return i!==void 0&&i.path===`/composition.js`&&i.contentType===`text/javascript`&&i.byteLength<=4194304}function y(e,t=`web`){if(typeof e!=`object`||!e||!p(e,[`assets`,`builtAt`,`revision`,`version`]))return!1;let n=e;if(n.version!==2||!m(n.revision,1)||!m(n.builtAt,0)||!Array.isArray(n.assets)||n.assets.length===0)return!1;let r=/* @__PURE__ */ new Set;for(let e of n.assets){if(typeof e!=`object`||!e||!p(e,[`byteLength`,`contentType`,`path`,`sha256`]))return!1;let t=e;if(!h(t.path)||r.has(t.path)||typeof t.sha256!=`string`||!u.test(t.sha256)||!m(t.byteLength,0)||typeof t.contentType!=`string`||!f.test(t.contentType))return!1;r.add(t.path)}return v(n.assets,r,t)}function b(e,t=`web`){if(typeof e!=`object`||!e||!p(e,[`manifest`,`publicKey`,`signature`]))return!1;let n=e;return y(n.manifest,t)&&typeof n.signature==`string`&&n.signature.length===86&&d.test(n.signature)&&typeof n.publicKey==`string`&&n.publicKey.length<=512&&d.test(n.publicKey)}function x(e,t){return e.assets.find(e=>e.path===t)}function S(e,t){return x(e,t)?.sha256}export{c as APP_ASSET_MAX_BYTES,o as APP_DESCRIPTOR_PATH,s as APP_PART_PREFIX,l as ATTESTATION_TAG,e as BUNDLE_MANIFEST_ROUTE,t as BUNDLE_MANIFEST_VERSION,a as NATIVE_COMPOSITION_MAX_BYTES,i as NATIVE_ENTRY_CONTENT_TYPE,r as NATIVE_ENTRY_PATH,n as WEB_ENTRY_PATH,x as assetFor,_ as attestationBytes,g as canonicalManifest,S as digestFor,y as isBundleManifest,b as isSignedBundleManifest};
 //# sourceMappingURL=bundleManifest.mjs.map

package/dist/types/bundleManifest.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"bundleManifest.mjs","names":["BUNDLE_MANIFEST_ROUTE","BUNDLE_MANIFEST_VERSION","WEB_ENTRY_PATH","NATIVE_ENTRY_PATH","NATIVE_ENTRY_CONTENT_TYPE","NATIVE_COMPOSITION_MAX_BYTES","ATTESTATION_TAG","SHA256","BASE64URL","CONTENT_TYPE","hasExactKeys","keys","value","expected","key","index","isSafeInteger","minimum","isSafeAssetPath","segment","canonicalManifest","lines","manifest","left","right","asset","attestationBytes","tag","fields","field","matchesProfile","profile","paths","assets","entry","isBundleManifest","candidate","valueAsset","isSignedBundleManifest","assetFor","path","digestFor"],"sources":["../../src/types/bundleManifest.ts"],"sourcesContent":["/*\n A signed description of cockpit assets for an independently trusted verifier.\n \n A manifest does not let a browser SPA defend itself against the server or TLS\n * edge that supplied its executable code. Consumers need a separately trusted\n * bootstrap and key before these signatures become a delivery guarantee.\n /\n\nexport const BUNDLE_MANIFEST_ROUTE = '/bundle-manifest.json';\nexport const BUNDLE_MANIFEST_VERSION = 2;\n\n/\n Which asset shape a manifest must have. A web bundle always serves `/index.html`; a native bundle is\n * exactly one composition module and never serves `/index.html`, so no manifest can pass both.\n /\nexport type BundleProfile = 'web' \| 'native';\nexport const WEB_ENTRY_PATH = '/index.html';\nexport const NATIVE_ENTRY_PATH = '/composition.js';\nexport const NATIVE_ENTRY_CONTENT_TYPE = 'text/javascript';\n/* Largest native composition a sealed response can carry. /\nexport const NATIVE_COMPOSITION_MAX_BYTES = 4 1024 * 1024;\n/** Domain-separation tag for an attestation. Starts with `p`, so it can never collide with a `2\\n` manifest. /\nexport const ATTESTATION_TAG = /^po\\/[a-z0-9-]+\\/v[1-9][0-9]$/u;\n\nconst SHA256 = /^[0-9a-f]{64}$/u;\nconst BASE64URL = /^[A-Za-z0-9_-]+$/u;\nconst CONTENT_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]\\/[a-z0-9][a-z0-9!#$&^_.+-]$/u;\n\nexport interface BundleAsset {\n /** Normalized absolute URL path, without a query or fragment. /\n path: string;\n /* Lowercase hex SHA-256 of the served bytes. /\n sha256: string;\n byteLength: number;\n /* MIME type of the response, without parameters. /\n contentType: string;\n}\n\nexport interface BundleManifest {\n version: typeof BUNDLE_MANIFEST_VERSION;\n /* Monotonically increasing persistent signer revision. /\n revision: number;\n /* Unix time in milliseconds. /\n builtAt: number;\n assets: BundleAsset[];\n}\n\nexport interface SignedBundleManifest {\n manifest: BundleManifest;\n /* Base64url IEEE P1363 ECDSA P-256 signature over the canonical serialization. /\n signature: string;\n /* Base64url SPKI of the signing key. Trust must be established out of band. /\n publicKey: string;\n}\n\nfunction hasExactKeys(value: object, expected: readonly string[]): boolean {\n const keys = Object.keys(value).sort();\n return keys.length === expected.length && keys.every((key, index) => key === expected[index]);\n}\n\nfunction isSafeInteger(value: unknown, minimum: number): value is number {\n return typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum;\n}\n\nfunction isSafeAssetPath(value: unknown): value is string {\n if (typeof value !== 'string' \|\| value.length < 2 \|\| !value.startsWith('/')) return false;\n if (value.includes('\\\\') \|\| value.includes('\\0') \|\| value.includes('?') \|\| value.includes('#')) return false;\n if (/[^\\x21-\\x7e]/u.test(value) \|\| value.includes('//') \|\| /%(?![0-9a-f]{2})/iu.test(value)) return false;\n if (/%(?:2e\|2f\|5c)/iu.test(value)) return false;\n return value\n .split('/')\n .slice(1)\n .every((segment) => segment !== '' && segment !== '.' && segment !== '..');\n}\n\n/* The exact bytes signed by Node and verified by WebCrypto. /\nexport function canonicalManifest(manifest: BundleManifest): string {\n const assets = [...manifest.assets].sort((left, right) =>\n left.path < right.path ? -1 : left.path > right.path ? 1 : 0,\n );\n const lines = assets.map(\n (asset) => `${asset.path}\\0${asset.sha256}\\0${String(asset.byteLength)}\\0${asset.contentType}`,\n );\n return [String(manifest.version), String(manifest.revision), String(manifest.builtAt), ...lines].join('\\n');\n}\n\n/\n The exact bytes of a tagged attestation: `UTF-8(tag + \"\\n\" + JSON.stringify(fields))`. Fields are an\n * ordered list of strings, so both sides build the same bytes without relying on object key order.\n * Throws on a malformed tag or a non-string field.\n /\nexport function attestationBytes(tag: string, fields: readonly string[]): Uint8Array<ArrayBuffer> {\n if (!ATTESTATION_TAG.test(tag)) throw new Error(`invalid attestation tag: ${tag}`);\n if (!Array.isArray(fields) \|\| !fields.every((field) => typeof field === 'string')) {\n throw new Error(`invalid attestation fields for ${tag}`);\n }\n return new TextEncoder().encode(`${tag}\\n${JSON.stringify(fields)}`);\n}\n\nfunction matchesProfile(assets: readonly BundleAsset[], paths: ReadonlySet<string>, profile: BundleProfile): boolean {\n if (profile === 'web') return paths.has(WEB_ENTRY_PATH);\n if (profile !== 'native' \|\| assets.length !== 1) return false;\n const [entry] = assets;\n return (\n entry !== undefined &&\n entry.path === NATIVE_ENTRY_PATH &&\n entry.contentType === NATIVE_ENTRY_CONTENT_TYPE &&\n entry.byteLength <= NATIVE_COMPOSITION_MAX_BYTES\n );\n}\n\nexport function isBundleManifest(value: unknown, profile: BundleProfile = 'web'): value is BundleManifest {\n if (typeof value !== 'object' \|\| value === null) return false;\n if (!hasExactKeys(value, ['assets', 'builtAt', 'revision', 'version'])) return false;\n const candidate = value as Partial<BundleManifest>;\n if (candidate.version !== BUNDLE_MANIFEST_VERSION) return false;\n if (!isSafeInteger(candidate.revision, 1) \|\| !isSafeInteger(candidate.builtAt, 0)) return false;\n if (!Array.isArray(candidate.assets) \|\| candidate.assets.length === 0) return false;\n\n const paths = new Set<string>();\n for (const valueAsset of candidate.assets) {\n if (typeof valueAsset !== 'object' \|\| valueAsset === null) return false;\n if (!hasExactKeys(valueAsset, ['byteLength', 'contentType', 'path', 'sha256'])) return false;\n const asset = valueAsset as Partial<BundleAsset>;\n if (!isSafeAssetPath(asset.path) \|\| paths.has(asset.path)) return false;\n if (typeof asset.sha256 !== 'string' \|\| !SHA256.test(asset.sha256)) return false;\n if (!isSafeInteger(asset.byteLength, 0)) return false;\n if (typeof asset.contentType !== 'string' \|\| !CONTENT_TYPE.test(asset.contentType)) return false;\n paths.add(asset.path);\n }\n return matchesProfile(candidate.assets as BundleAsset[], paths, profile);\n}\n\nexport function isSignedBundleManifest(value: unknown, profile: BundleProfile = 'web'): value is SignedBundleManifest {\n if (typeof value !== 'object' \|\| value === null) return false;\n if (!hasExactKeys(value, ['manifest', 'publicKey', 'signature'])) return false;\n const candidate = value as Partial<SignedBundleManifest>;\n return (\n isBundleManifest(candidate.manifest, profile) &&\n typeof candidate.signature === 'string' &&\n candidate.signature.length === 86 &&\n BASE64URL.test(candidate.signature) &&\n typeof candidate.publicKey === 'string' &&\n candidate.publicKey.length <= 512 &&\n BASE64URL.test(candidate.publicKey)\n );\n}\n\n/* The recorded asset for one path, or undefined if the manifest does not cover it. /\nexport function assetFor(manifest: BundleManifest, path: string): BundleAsset \| undefined {\n return manifest.assets.find((asset) => asset.path === path);\n}\n\n/* The recorded digest for one asset, or undefined if the manifest does not cover it. */\nexport function digestFor(manifest: BundleManifest, path: string): string \| undefined {\n return assetFor(manifest, path)?.sha256;\n}\n"],"mappings":"AAQA,MAAaA,EAAwB,wBACxBC,EAA0B,EAO1BC,EAAiB,cACjBC,EAAoB,kBACpBC,EAA4B,kBAE5BC,EAA+B,QAE/BC,EAAkB,kCAEzBC,EAAS,kBACTC,EAAY,oBACZC,EAAe,4DA6BrB,SAASC,EAAa,EAAe,EAAsC,CACzE,IAAMC,EAAO,OAAO,KAAKC,CAAK,CAAC,CAAC,KAAK,EACrC,OAAOD,EAAK,SAAWE,EAAS,QAAUF,EAAK,OAAO,EAAK,IAAUG,IAAQD,EAASE,EAAM,CAC9F,CAEA,SAASC,EAAc,EAAgB,EAAkC,CACvE,OAAO,OAAOJ,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAASK,CAC9E,CAEA,SAASC,EAAgB,EAAiC,CAKxD,OAJI,OAAON,GAAU,UAAYA,EAAM,OAAS,GAAK,CAACA,EAAM,WAAW,GAAG,GACtEA,EAAM,SAAS,IAAI,GAAKA,EAAM,SAAS,IAAI,GAAKA,EAAM,SAAS,GAAG,GAAKA,EAAM,SAAS,GAAG,GACzF,gBAAgB,KAAKA,CAAK,GAAKA,EAAM,SAAS,IAAI,GAAK,qBAAqB,KAAKA,CAAK,GACtF,kBAAkB,KAAKA,CAAK,EAAU,GACnCA,EACJ,MAAM,GAAG,CAAC,CACV,MAAM,CAAC,CAAC,CACR,MAAO,GAAYO,IAAY,IAAMA,IAAY,KAAOA,IAAY,IAAI,CAC7E,CAGA,SAAgBC,EAAkB,EAAkC,CAIlE,IAAMC,EAHS,CAAC,GAAGC,EAAS,MAAM,CAAC,CAAC,MAAM,EAAM,IAC9CC,EAAK,KAAOC,EAAM,KAAO,GAAK,IAAK,KAAOA,EAAM,KAE/B,CAAC,CAAC,IAClB,GAAU,GAAGC,EAAM,KAAK,IAAIA,EAAM,OAAO,IAAI,OAAOA,EAAM,UAAU,EAAE,IAAIA,EAAM,aACnF,EACA,MAAO,CAAC,OAAOH,EAAS,OAAO,EAAG,OAAOA,EAAS,QAAQ,EAAG,OAAOA,EAAS,OAAO,EAAG,GAAGD,CAAK,CAAC,CAAC,KAAK;CAAI,CAC5G,CAOA,SAAgBK,EAAiB,EAAa,EAAoD,CAChG,GAAI,CAACpB,EAAgB,KAAKqB,CAAG,EAAG,MAAU,MAAM,4BAA4BA,GAAK,EACjF,GAAI,CAAC,MAAM,QAAQC,CAAM,GAAK,CAACA,EAAO,MAAO,GAAU,OAAOC,GAAU,QAAQ,EAC9E,MAAU,MAAM,kCAAkCF,GAAK,EAEzD,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,GAAGA,EAAI,IAAI,KAAK,UAAUC,CAAM,GAAG,CACrE,CAEA,SAASE,EAAe,EAAgC,EAA4B,EAAiC,CACnH,GAAIC,IAAY,MAAO,OAAOC,EAAM,IAAI9B,CAAc,EACtD,GAAI6B,IAAY,UAAYE,EAAO,SAAW,EAAG,MAAO,GACxD,GAAM,CAACC,GAASD,EAChB,OACEC,IAAU,IAAA,IACVA,EAAM,OAAA,mBACNA,EAAM,cAAA,mBACNA,EAAM,YAAA,OAEV,CAEA,SAAgBC,EAAiB,EAAgB,EAAyB,MAAgC,CAExG,GADI,OAAOvB,GAAU,WAAYA,GAC7B,CAACF,EAAaE,EAAO,CAAC,SAAU,UAAW,WAAY,SAAS,CAAC,EAAG,MAAO,GAC/E,IAAMwB,EAAYxB,EAGlB,GAFIwB,EAAU,UAAA,GACV,CAACpB,EAAcoB,EAAU,SAAU,CAAC,GAAK,CAACpB,EAAcoB,EAAU,QAAS,CAAC,GAC5E,CAAC,MAAM,QAAQA,EAAU,MAAM,GAAKA,EAAU,OAAO,SAAW,EAAG,MAAO,GAE9E,IAAMJ,kBAAQ,IAAI,IAClB,IAAK,IAAMK,KAAcD,EAAU,OAAQ,CAEzC,GADI,OAAOC,GAAe,WAAYA,GAClC,CAAC3B,EAAa2B,EAAY,CAAC,aAAc,cAAe,OAAQ,QAAQ,CAAC,EAAG,MAAO,GACvF,IAAMZ,EAAQY,EAId,GAHI,CAACnB,EAAgBO,EAAM,IAAI,GAAKO,EAAM,IAAIP,EAAM,IAAI,GACpD,OAAOA,EAAM,QAAW,UAAY,CAAClB,EAAO,KAAKkB,EAAM,MAAM,GAC7D,CAACT,EAAcS,EAAM,WAAY,CAAC,GAClC,OAAOA,EAAM,aAAgB,UAAY,CAAChB,EAAa,KAAKgB,EAAM,WAAW,EAAG,MAAO,GAC3FO,EAAM,IAAIP,EAAM,IAAI,CACtB,CACA,OAAOK,EAAeM,EAAU,OAAyBJ,EAAOD,CAAO,CACzE,CAEA,SAAgBO,EAAuB,EAAgB,EAAyB,MAAsC,CAEpH,GADI,OAAO1B,GAAU,WAAYA,GAC7B,CAACF,EAAaE,EAAO,CAAC,WAAY,YAAa,WAAW,CAAC,EAAG,MAAO,GACzE,IAAMwB,EAAYxB,EAClB,OACEuB,EAAiBC,EAAU,SAAUL,CAAO,GAC5C,OAAOK,EAAU,WAAc,UAC/BA,EAAU,UAAU,SAAW,IAC/B5B,EAAU,KAAK4B,EAAU,SAAS,GAClC,OAAOA,EAAU,WAAc,UAC/BA,EAAU,UAAU,QAAU,KAC9B5B,EAAU,KAAK4B,EAAU,SAAS,CAEtC,CAGA,SAAgBG,EAAS,EAA0B,EAAuC,CACxF,OAAOjB,EAAS,OAAO,KAAM,GAAUG,EAAM,OAASe,CAAI,CAC5D,CAGA,SAAgBC,EAAU,EAA0B,EAAkC,CACpF,OAAOF,EAASjB,EAAUkB,CAAI,CAAC,EAAE,MACnC"}
1	+ {"version":3,"file":"bundleManifest.mjs","names":["BUNDLE_MANIFEST_ROUTE","BUNDLE_MANIFEST_VERSION","WEB_ENTRY_PATH","NATIVE_ENTRY_PATH","NATIVE_ENTRY_CONTENT_TYPE","NATIVE_COMPOSITION_MAX_BYTES","APP_DESCRIPTOR_PATH","APP_PART_PREFIX","APP_ASSET_MAX_BYTES","ATTESTATION_TAG","SHA256","BASE64URL","CONTENT_TYPE","hasExactKeys","keys","value","expected","key","index","isSafeInteger","minimum","isSafeAssetPath","segment","canonicalManifest","lines","manifest","left","right","asset","attestationBytes","tag","fields","field","matchesProfile","profile","paths","assets","entry","isBundleManifest","candidate","valueAsset","isSignedBundleManifest","assetFor","path","digestFor"],"sources":["../../src/types/bundleManifest.ts"],"sourcesContent":["/*\n A signed description of cockpit assets for an independently trusted verifier.\n \n A manifest does not let a browser SPA defend itself against the server or TLS\n * edge that supplied its executable code. Consumers need a separately trusted\n * bootstrap and key before these signatures become a delivery guarantee.\n /\n\nexport const BUNDLE_MANIFEST_ROUTE = '/bundle-manifest.json';\nexport const BUNDLE_MANIFEST_VERSION = 2;\n\n/\n Which asset shape a manifest must have. A web bundle always serves `/index.html`; a native bundle is\n * exactly one composition module and never serves `/index.html`; an app bundle is `/app.json` plus\n * `/bundle/` parts and serves neither entry, so no manifest can pass two profiles.\n /\nexport type BundleProfile = 'web' \| 'native' \| 'app';\nexport const WEB_ENTRY_PATH = '/index.html';\nexport const NATIVE_ENTRY_PATH = '/composition.js';\nexport const NATIVE_ENTRY_CONTENT_TYPE = 'text/javascript';\n/* Largest native composition a sealed response can carry. /\nexport const NATIVE_COMPOSITION_MAX_BYTES = 4 1024 * 1024;\n/** JSON `{ platform, fingerprint }` naming the native binary an app bundle runs on. /\nexport const APP_DESCRIPTOR_PATH = '/app.json';\n/* App JS bundle parts; concatenated in path order they are the bundle. /\nexport const APP_PART_PREFIX = '/bundle/';\n/* Largest app asset, so every part fits one sealed response. /\nexport const APP_ASSET_MAX_BYTES = 2 1024 * 1024;\n/** Domain-separation tag for an attestation. Starts with `p`, so it can never collide with a `2\\n` manifest. /\nexport const ATTESTATION_TAG = /^po\\/[a-z0-9-]+\\/v[1-9][0-9]$/u;\n\nconst SHA256 = /^[0-9a-f]{64}$/u;\nconst BASE64URL = /^[A-Za-z0-9_-]+$/u;\nconst CONTENT_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]\\/[a-z0-9][a-z0-9!#$&^_.+-]$/u;\n\nexport interface BundleAsset {\n /** Normalized absolute URL path, without a query or fragment. /\n path: string;\n /* Lowercase hex SHA-256 of the served bytes. /\n sha256: string;\n byteLength: number;\n /* MIME type of the response, without parameters. /\n contentType: string;\n}\n\nexport interface BundleManifest {\n version: typeof BUNDLE_MANIFEST_VERSION;\n /* Monotonically increasing persistent signer revision. /\n revision: number;\n /* Unix time in milliseconds. /\n builtAt: number;\n assets: BundleAsset[];\n}\n\nexport interface SignedBundleManifest {\n manifest: BundleManifest;\n /* Base64url IEEE P1363 ECDSA P-256 signature over the canonical serialization. /\n signature: string;\n /* Base64url SPKI of the signing key. Trust must be established out of band. /\n publicKey: string;\n}\n\nfunction hasExactKeys(value: object, expected: readonly string[]): boolean {\n const keys = Object.keys(value).sort();\n return keys.length === expected.length && keys.every((key, index) => key === expected[index]);\n}\n\nfunction isSafeInteger(value: unknown, minimum: number): value is number {\n return typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum;\n}\n\nfunction isSafeAssetPath(value: unknown): value is string {\n if (typeof value !== 'string' \|\| value.length < 2 \|\| !value.startsWith('/')) return false;\n if (value.includes('\\\\') \|\| value.includes('\\0') \|\| value.includes('?') \|\| value.includes('#')) return false;\n if (/[^\\x21-\\x7e]/u.test(value) \|\| value.includes('//') \|\| /%(?![0-9a-f]{2})/iu.test(value)) return false;\n if (/%(?:2e\|2f\|5c)/iu.test(value)) return false;\n return value\n .split('/')\n .slice(1)\n .every((segment) => segment !== '' && segment !== '.' && segment !== '..');\n}\n\n/* The exact bytes signed by Node and verified by WebCrypto. /\nexport function canonicalManifest(manifest: BundleManifest): string {\n const assets = [...manifest.assets].sort((left, right) =>\n left.path < right.path ? -1 : left.path > right.path ? 1 : 0,\n );\n const lines = assets.map(\n (asset) => `${asset.path}\\0${asset.sha256}\\0${String(asset.byteLength)}\\0${asset.contentType}`,\n );\n return [String(manifest.version), String(manifest.revision), String(manifest.builtAt), ...lines].join('\\n');\n}\n\n/\n The exact bytes of a tagged attestation: `UTF-8(tag + \"\\n\" + JSON.stringify(fields))`. Fields are an\n * ordered list of strings, so both sides build the same bytes without relying on object key order.\n * Throws on a malformed tag or a non-string field.\n /\nexport function attestationBytes(tag: string, fields: readonly string[]): Uint8Array<ArrayBuffer> {\n if (!ATTESTATION_TAG.test(tag)) throw new Error(`invalid attestation tag: ${tag}`);\n if (!Array.isArray(fields) \|\| !fields.every((field) => typeof field === 'string')) {\n throw new Error(`invalid attestation fields for ${tag}`);\n }\n return new TextEncoder().encode(`${tag}\\n${JSON.stringify(fields)}`);\n}\n\nfunction matchesProfile(assets: readonly BundleAsset[], paths: ReadonlySet<string>, profile: BundleProfile): boolean {\n if (profile === 'web') return paths.has(WEB_ENTRY_PATH);\n if (profile === 'app') {\n return (\n !paths.has(WEB_ENTRY_PATH) &&\n !paths.has(NATIVE_ENTRY_PATH) &&\n paths.has(APP_DESCRIPTOR_PATH) &&\n assets.some((asset) => asset.path.startsWith(APP_PART_PREFIX)) &&\n assets.every((asset) => asset.byteLength <= APP_ASSET_MAX_BYTES)\n );\n }\n if (profile !== 'native' \|\| assets.length !== 1) return false;\n const [entry] = assets;\n return (\n entry !== undefined &&\n entry.path === NATIVE_ENTRY_PATH &&\n entry.contentType === NATIVE_ENTRY_CONTENT_TYPE &&\n entry.byteLength <= NATIVE_COMPOSITION_MAX_BYTES\n );\n}\n\nexport function isBundleManifest(value: unknown, profile: BundleProfile = 'web'): value is BundleManifest {\n if (typeof value !== 'object' \|\| value === null) return false;\n if (!hasExactKeys(value, ['assets', 'builtAt', 'revision', 'version'])) return false;\n const candidate = value as Partial<BundleManifest>;\n if (candidate.version !== BUNDLE_MANIFEST_VERSION) return false;\n if (!isSafeInteger(candidate.revision, 1) \|\| !isSafeInteger(candidate.builtAt, 0)) return false;\n if (!Array.isArray(candidate.assets) \|\| candidate.assets.length === 0) return false;\n\n const paths = new Set<string>();\n for (const valueAsset of candidate.assets) {\n if (typeof valueAsset !== 'object' \|\| valueAsset === null) return false;\n if (!hasExactKeys(valueAsset, ['byteLength', 'contentType', 'path', 'sha256'])) return false;\n const asset = valueAsset as Partial<BundleAsset>;\n if (!isSafeAssetPath(asset.path) \|\| paths.has(asset.path)) return false;\n if (typeof asset.sha256 !== 'string' \|\| !SHA256.test(asset.sha256)) return false;\n if (!isSafeInteger(asset.byteLength, 0)) return false;\n if (typeof asset.contentType !== 'string' \|\| !CONTENT_TYPE.test(asset.contentType)) return false;\n paths.add(asset.path);\n }\n return matchesProfile(candidate.assets as BundleAsset[], paths, profile);\n}\n\nexport function isSignedBundleManifest(value: unknown, profile: BundleProfile = 'web'): value is SignedBundleManifest {\n if (typeof value !== 'object' \|\| value === null) return false;\n if (!hasExactKeys(value, ['manifest', 'publicKey', 'signature'])) return false;\n const candidate = value as Partial<SignedBundleManifest>;\n return (\n isBundleManifest(candidate.manifest, profile) &&\n typeof candidate.signature === 'string' &&\n candidate.signature.length === 86 &&\n BASE64URL.test(candidate.signature) &&\n typeof candidate.publicKey === 'string' &&\n candidate.publicKey.length <= 512 &&\n BASE64URL.test(candidate.publicKey)\n );\n}\n\n/* The recorded asset for one path, or undefined if the manifest does not cover it. /\nexport function assetFor(manifest: BundleManifest, path: string): BundleAsset \| undefined {\n return manifest.assets.find((asset) => asset.path === path);\n}\n\n/* The recorded digest for one asset, or undefined if the manifest does not cover it. */\nexport function digestFor(manifest: BundleManifest, path: string): string \| undefined {\n return assetFor(manifest, path)?.sha256;\n}\n"],"mappings":"AAQA,MAAaA,EAAwB,wBACxBC,EAA0B,EAQ1BC,EAAiB,cACjBC,EAAoB,kBACpBC,EAA4B,kBAE5BC,EAA+B,QAE/BC,EAAsB,YAEtBC,EAAkB,WAElBC,EAAsB,QAEtBC,EAAkB,kCAEzBC,EAAS,kBACTC,EAAY,oBACZC,EAAe,4DA6BrB,SAASC,EAAa,EAAe,EAAsC,CACzE,IAAMC,EAAO,OAAO,KAAKC,CAAK,CAAC,CAAC,KAAK,EACrC,OAAOD,EAAK,SAAWE,EAAS,QAAUF,EAAK,OAAO,EAAK,IAAUG,IAAQD,EAASE,EAAM,CAC9F,CAEA,SAASC,EAAc,EAAgB,EAAkC,CACvE,OAAO,OAAOJ,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAASK,CAC9E,CAEA,SAASC,EAAgB,EAAiC,CAKxD,OAJI,OAAON,GAAU,UAAYA,EAAM,OAAS,GAAK,CAACA,EAAM,WAAW,GAAG,GACtEA,EAAM,SAAS,IAAI,GAAKA,EAAM,SAAS,IAAI,GAAKA,EAAM,SAAS,GAAG,GAAKA,EAAM,SAAS,GAAG,GACzF,gBAAgB,KAAKA,CAAK,GAAKA,EAAM,SAAS,IAAI,GAAK,qBAAqB,KAAKA,CAAK,GACtF,kBAAkB,KAAKA,CAAK,EAAU,GACnCA,EACJ,MAAM,GAAG,CAAC,CACV,MAAM,CAAC,CAAC,CACR,MAAO,GAAYO,IAAY,IAAMA,IAAY,KAAOA,IAAY,IAAI,CAC7E,CAGA,SAAgBC,EAAkB,EAAkC,CAIlE,IAAMC,EAHS,CAAC,GAAGC,EAAS,MAAM,CAAC,CAAC,MAAM,EAAM,IAC9CC,EAAK,KAAOC,EAAM,KAAO,GAAK,IAAK,KAAOA,EAAM,KAE/B,CAAC,CAAC,IAClB,GAAU,GAAGC,EAAM,KAAK,IAAIA,EAAM,OAAO,IAAI,OAAOA,EAAM,UAAU,EAAE,IAAIA,EAAM,aACnF,EACA,MAAO,CAAC,OAAOH,EAAS,OAAO,EAAG,OAAOA,EAAS,QAAQ,EAAG,OAAOA,EAAS,OAAO,EAAG,GAAGD,CAAK,CAAC,CAAC,KAAK;CAAI,CAC5G,CAOA,SAAgBK,EAAiB,EAAa,EAAoD,CAChG,GAAI,CAACpB,EAAgB,KAAKqB,CAAG,EAAG,MAAU,MAAM,4BAA4BA,GAAK,EACjF,GAAI,CAAC,MAAM,QAAQC,CAAM,GAAK,CAACA,EAAO,MAAO,GAAU,OAAOC,GAAU,QAAQ,EAC9E,MAAU,MAAM,kCAAkCF,GAAK,EAEzD,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,GAAGA,EAAI,IAAI,KAAK,UAAUC,CAAM,GAAG,CACrE,CAEA,SAASE,EAAe,EAAgC,EAA4B,EAAiC,CACnH,GAAIC,IAAY,MAAO,OAAOC,EAAM,IAAIjC,CAAc,EACtD,GAAIgC,IAAY,MACd,MACE,CAACC,EAAM,IAAA,aAAkB,GACzB,CAACA,EAAM,IAAA,iBAAqB,GAC5BA,EAAM,IAAA,WAAuB,GAC7BC,EAAO,KAAM,GAAUR,EAAM,KAAK,WAAA,UAA0B,CAAC,GAC7DQ,EAAO,MAAO,GAAUR,EAAM,YAAA,OAAiC,EAGnE,GAAIM,IAAY,UAAYE,EAAO,SAAW,EAAG,MAAO,GACxD,GAAM,CAACC,GAASD,EAChB,OACEC,IAAU,IAAA,IACVA,EAAM,OAAA,mBACNA,EAAM,cAAA,mBACNA,EAAM,YAAA,OAEV,CAEA,SAAgBC,EAAiB,EAAgB,EAAyB,MAAgC,CAExG,GADI,OAAOvB,GAAU,WAAYA,GAC7B,CAACF,EAAaE,EAAO,CAAC,SAAU,UAAW,WAAY,SAAS,CAAC,EAAG,MAAO,GAC/E,IAAMwB,EAAYxB,EAGlB,GAFIwB,EAAU,UAAA,GACV,CAACpB,EAAcoB,EAAU,SAAU,CAAC,GAAK,CAACpB,EAAcoB,EAAU,QAAS,CAAC,GAC5E,CAAC,MAAM,QAAQA,EAAU,MAAM,GAAKA,EAAU,OAAO,SAAW,EAAG,MAAO,GAE9E,IAAMJ,kBAAQ,IAAI,IAClB,IAAK,IAAMK,KAAcD,EAAU,OAAQ,CAEzC,GADI,OAAOC,GAAe,WAAYA,GAClC,CAAC3B,EAAa2B,EAAY,CAAC,aAAc,cAAe,OAAQ,QAAQ,CAAC,EAAG,MAAO,GACvF,IAAMZ,EAAQY,EAId,GAHI,CAACnB,EAAgBO,EAAM,IAAI,GAAKO,EAAM,IAAIP,EAAM,IAAI,GACpD,OAAOA,EAAM,QAAW,UAAY,CAAClB,EAAO,KAAKkB,EAAM,MAAM,GAC7D,CAACT,EAAcS,EAAM,WAAY,CAAC,GAClC,OAAOA,EAAM,aAAgB,UAAY,CAAChB,EAAa,KAAKgB,EAAM,WAAW,EAAG,MAAO,GAC3FO,EAAM,IAAIP,EAAM,IAAI,CACtB,CACA,OAAOK,EAAeM,EAAU,OAAyBJ,EAAOD,CAAO,CACzE,CAEA,SAAgBO,EAAuB,EAAgB,EAAyB,MAAsC,CAEpH,GADI,OAAO1B,GAAU,WAAYA,GAC7B,CAACF,EAAaE,EAAO,CAAC,WAAY,YAAa,WAAW,CAAC,EAAG,MAAO,GACzE,IAAMwB,EAAYxB,EAClB,OACEuB,EAAiBC,EAAU,SAAUL,CAAO,GAC5C,OAAOK,EAAU,WAAc,UAC/BA,EAAU,UAAU,SAAW,IAC/B5B,EAAU,KAAK4B,EAAU,SAAS,GAClC,OAAOA,EAAU,WAAc,UAC/BA,EAAU,UAAU,QAAU,KAC9B5B,EAAU,KAAK4B,EAAU,SAAS,CAEtC,CAGA,SAAgBG,EAAS,EAA0B,EAAuC,CACxF,OAAOjB,EAAS,OAAO,KAAM,GAAUG,EAAM,OAASe,CAAI,CAC5D,CAGA,SAAgBC,EAAU,EAA0B,EAAkC,CACpF,OAAOF,EAASjB,EAAUkB,CAAI,CAAC,EAAE,MACnC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@agimon-ai/po-web-security",
-  "version": "0.0.0-alpha.22",
+  "version": "0.0.0-alpha.23",
   "description": "Shared security primitives for the Po web cockpit: sealed channels and signed bundle manifests for independently trusted verifiers.",
   "keywords": [
     "ai",