@aiwg/cli 2026.9.20 → 2026.9.24

package/dist/src/providers/grok-build-headless.js

@@ -0,0 +1,170 @@
+/** Bounded Grok Build headless transport. The caller owns task authorization. */
+import { spawn } from 'node:child_process';
+const MAX_TIMEOUT_MS = 10 * 60_000;
+const DEFAULT_TIMEOUT_MS = 2 * 60_000;
+const DEFAULT_MAX_OUTPUT = 8 * 1024 * 1024;
+export function redactGrokOutput(value, env = process.env) {
+    let redacted = value
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/-]+/gi, '$1[REDACTED]')
+        .replace(/\b(xai-[A-Za-z0-9_-]{8,})\b/g, '[REDACTED]')
+        .replace(/\b((?:api[_-]?key|access[_-]?token|authorization)\s*[:=]\s*)[^\s,}"']+/gi, '$1[REDACTED]');
+    for (const key of ['XAI_API_KEY', 'GROK_CODE_XAI_API_KEY']) {
+        const secret = env[key];
+        if (secret && secret.length >= 4)
+            redacted = redacted.split(secret).join('[REDACTED]');
+    }
+    return redacted;
+}
+function scrubEvent(event, env) {
+    // JSON roundtrip scrubs nested provider event payloads before any callback.
+    return JSON.parse(redactGrokOutput(JSON.stringify(event), env));
+}
+function isTerminal(event) {
+    return ['result', 'error', 'complete', 'completed'].includes(String(event.type ?? event.event ?? ''));
+}
+function isError(event) {
+    return event.is_error === true || event.error !== undefined || ['error', 'failed'].includes(String(event.type ?? event.event ?? ''));
+}
+function stopProcess(child) {
+    if (child.pid && process.platform !== 'win32') {
+        try {
+            process.kill(-child.pid, 'SIGTERM');
+            return;
+        }
+        catch { /* process already exited */ }
+    }
+    child.kill('SIGTERM');
+}
+export async function runGrokHeadless(options) {
+    if (!options.prompt.trim())
+        throw new Error('Grok Build prompt is required');
+    const format = options.format ?? 'streaming-json';
+    if (!['plain', 'json', 'streaming-json'].includes(format))
+        throw new Error(`Unsupported Grok output format: ${format}`);
+    const timeoutMs = Math.min(Math.max(options.timeoutMs ?? DEFAULT_TIMEOUT_MS, 1), MAX_TIMEOUT_MS);
+    const maxBytes = Math.min(Math.max(options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT, 1024), DEFAULT_MAX_OUTPUT);
+    const env = options.env ?? process.env;
+    const args = [...(options.prefixArgs ?? []), '--no-auto-update', ...(options.disableSubagents ? ['--no-subagents'] : []), '-p', options.prompt, '--output-format', format];
+    return new Promise((resolve, reject) => {
+        const child = spawn(options.command ?? 'grok', args, {
+            cwd: options.cwd,
+            env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: process.platform !== 'win32',
+            shell: false,
+        });
+        let stdout = '';
+        let stderr = '';
+        let pending = '';
+        let bytes = 0;
+        let settled = false;
+        let terminalSeen = false;
+        let terminalError = false;
+        const events = [];
+        let drainTimer;
+        const finish = (error, code = 0) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (drainTimer)
+                clearTimeout(drainTimer);
+            options.signal?.removeEventListener('abort', abort);
+            if (error) {
+                stopProcess(child);
+                reject(error);
+                return;
+            }
+            const cleanStdout = redactGrokOutput(stdout, env);
+            const cleanStderr = redactGrokOutput(stderr, env);
+            if (code !== 0 || terminalError) {
+                reject(new Error(`Grok Build headless failed (exit ${code}): ${cleanStderr || 'provider error event'}`));
+                return;
+            }
+            if (format === 'streaming-json' && !terminalSeen) {
+                reject(new Error('Grok Build streaming-json ended without a terminal event'));
+                return;
+            }
+            if (format === 'json') {
+                try {
+                    const parsed = JSON.parse(cleanStdout);
+                    if (isError(parsed))
+                        throw new Error('Grok Build returned a JSON error result');
+                    events.push(parsed);
+                }
+                catch (cause) {
+                    reject(cause instanceof Error ? cause : new Error('Invalid Grok Build JSON result'));
+                    return;
+                }
+            }
+            resolve({ format, text: cleanStdout, events, exitCode: code, stderr: cleanStderr });
+        };
+        const abort = () => finish(new Error('Grok Build headless aborted'));
+        const timer = setTimeout(() => finish(new Error(`Grok Build headless timed out after ${timeoutMs}ms`)), timeoutMs);
+        options.signal?.addEventListener('abort', abort, { once: true });
+        if (options.signal?.aborted)
+            abort();
+        child.on('error', error => finish(new Error(`Grok Build headless launch failed: ${error.message}`)));
+        child.stdout.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > maxBytes) {
+                finish(new Error(`Grok Build headless output exceeded ${maxBytes} bytes`));
+                return;
+            }
+            const part = chunk.toString('utf8');
+            stdout += part;
+            if (format !== 'streaming-json')
+                return;
+            pending += part;
+            let end;
+            while ((end = pending.indexOf('\n')) >= 0) {
+                const line = pending.slice(0, end).trim();
+                pending = pending.slice(end + 1);
+                if (!line)
+                    continue;
+                let event;
+                try {
+                    event = JSON.parse(line);
+                }
+                catch {
+                    finish(new Error('Invalid Grok Build streaming-json event'));
+                    return;
+                }
+                const safe = scrubEvent(event, env);
+                events.push(safe);
+                options.onEvent?.(safe);
+                if (isError(safe))
+                    terminalError = true;
+                if (isTerminal(safe)) {
+                    terminalSeen = true;
+                    // Some provider builds leave background work attached after the
+                    // result. Allow a short drain, then terminate the process group.
+                    drainTimer ??= setTimeout(() => { stopProcess(child); finish(undefined, terminalError ? 1 : 0); }, 300);
+                }
+            }
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk.toString('utf8');
+            if (Buffer.byteLength(stderr) > maxBytes)
+                finish(new Error(`Grok Build stderr exceeded ${maxBytes} bytes`));
+        });
+        child.on('close', code => {
+            if (format === 'streaming-json' && pending.trim()) {
+                try {
+                    const event = scrubEvent(JSON.parse(pending), env);
+                    events.push(event);
+                    if (isError(event))
+                        terminalError = true;
+                    if (isTerminal(event))
+                        terminalSeen = true;
+                }
+                catch {
+                    finish(new Error('Invalid trailing Grok Build streaming-json event'));
+                    return;
+                }
+            }
+            finish(undefined, code ?? 1);
+        });
+    });
+}
+//# sourceMappingURL=grok-build-headless.js.map

package/dist/src/providers/muse-paths.js

@@ -0,0 +1,105 @@
+/**
+ * Muse Code skill-root resolution — documented roots only, fail-closed on bad metadata.
+ *
+ * Muse Code's documented user skill root is `$XDG_CONFIG_HOME/muse/skills`
+ * (default `~/.config/muse/skills` when XDG_CONFIG_HOME is unset). The
+ * project skill root (`<repo>/.agents/skills`) is static provider metadata
+ * on the `muse` skillNamespace; this module resolves only the XDG user root
+ * at deploy time.
+ *
+ * Unlike Grok Bot (AIWG_GROKBOT_SKILLS_DIR, fail-closed until configured),
+ * the Muse user root is documented, so an unset XDG_CONFIG_HOME falls back
+ * to the documented default — but malformed metadata (relative
+ * XDG_CONFIG_HOME, bare `~`, NUL bytes, root-only resolution) fails closed
+ * so the deployer never invents a bogus tree.
+ *
+ * Never invent `~/.muse`, `~/.config/muse` siblings outside `muse/skills`,
+ * or `~/.agents/skills` as a write target.
+ *
+ * @see docs/architecture/adr-muse-provider-target.md
+ * @issue #234
+ */
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+/** Muse's documented user skills subtree below the XDG config root. */
+export const MUSE_XDG_SKILLS_SUBDIR = path.join('muse', 'skills');
+/**
+ * Expand a leading `~/` against the operator home directory.
+ * Bare `~` is rejected — it would invent a home skill root.
+ */
+function expandHomePrefix(raw, userHome = homedir()) {
+    if (raw === '~')
+        return raw;
+    if (raw.startsWith('~/'))
+        return path.join(userHome, raw.slice(2));
+    return raw;
+}
+/**
+ * Validate and resolve the Muse XDG user skills directory.
+ * Returns a structured result so the deployer can fail closed on bad metadata.
+ */
+export function resolveMuseXdgSkillsDirResult(env = process.env, userHome = homedir()) {
+    const raw = (env.XDG_CONFIG_HOME || '').trim();
+    if (!raw) {
+        // Documented default: ~/.config/muse/skills when XDG_CONFIG_HOME is unset.
+        return {
+            ok: true,
+            path: path.join(userHome, '.config', MUSE_XDG_SKILLS_SUBDIR),
+            source: 'default',
+        };
+    }
+    const expanded = expandHomePrefix(raw, userHome);
+    if (expanded === '~' || expanded.startsWith('~')) {
+        return {
+            ok: false,
+            reason: 'not-absolute',
+            message: `XDG_CONFIG_HOME must be an absolute path (got '${raw}'). Bare '~' is rejected so AIWG never invents a Muse home layout.`,
+        };
+    }
+    if (!path.isAbsolute(expanded)) {
+        return {
+            ok: false,
+            reason: 'not-absolute',
+            message: `XDG_CONFIG_HOME must be an absolute path (got '${raw}'). Relative values are rejected.`,
+        };
+    }
+    if (raw.includes('\0') || expanded.includes('\0')) {
+        return {
+            ok: false,
+            reason: 'traversal',
+            message: 'XDG_CONFIG_HOME contains an invalid path character.',
+        };
+    }
+    // Defensive: refuse a config root that collapses to the filesystem root;
+    // deploying skills to /muse/skills is never the operator's intent.
+    const normalized = path.normalize(expanded);
+    if (normalized === path.sep) {
+        return {
+            ok: false,
+            reason: 'empty',
+            message: 'XDG_CONFIG_HOME resolves to the filesystem root; refuse to deploy skills there.',
+        };
+    }
+    return {
+        ok: true,
+        path: path.join(normalized, MUSE_XDG_SKILLS_SUBDIR),
+        source: 'env',
+    };
+}
+/**
+ * Absolute Muse XDG user skills dir when the metadata is sane; otherwise
+ * null (fail closed). Never invents ~/.muse.
+ */
+export function resolveMuseXdgSkillsDir(env = process.env, userHome = homedir()) {
+    const resolution = resolveMuseXdgSkillsDirResult(env, userHome);
+    return resolution.ok ? resolution.path : null;
+}
+/**
+ * User-facing remediation for bad Muse XDG metadata.
+ * Shared by the deployer so a blocked deploy explains the fix.
+ */
+export function museXdgSkillsDirRemediation(env = process.env, userHome = homedir()) {
+    const resolution = resolveMuseXdgSkillsDirResult(env, userHome);
+    return resolution.ok ? '' : resolution.message;
+}
+//# sourceMappingURL=muse-paths.js.map

package/dist/src/providers/provider-definitions.js

@@ -23,6 +23,7 @@ const ProviderDefinitionSchema = z.object({
         'grokbot',
         'grok-build',
         'hermes',
+        'muse',
         'opencode',
         'openclaw',
         'openhuman',
@@ -146,6 +147,7 @@ export const PROVIDER_IDS = [
     'grokbot',
     'grok-build',
     'hermes',
+    'muse',
     'opencode',
     'openclaw',
     'openhuman',
@@ -244,6 +246,20 @@ const CONTEXT_CONTRACTS = {
         bootstrapTargets: ['.hermes.md', 'AGENTS.md'], maxContextBytes: null, recommendedMaxLines: 30, nestedContext: false, support: 'degraded',
         verification: { method: 'AIWG Hermes adapter contract; on-demand artifact-read required', source: 'agentic/code/providers/capability-matrix.yaml', lastVerified: VERIFIED_ON },
     },
+    // #225: Muse Code prefers AGENTS.md over CLAUDE.md at each directory level;
+    // project AGENTS.md loads only after the workspace is explicitly trusted
+    // (first-run trust prompt). AIWG deploys a discover-first AGENTS.md bridge.
+    muse: {
+        startupFiles: ['AGENTS.md'],
+        precedence: ['provider/system', 'project AGENTS.md once the workspace is trusted', 'explicit aiwg discover/show'],
+        loadMode: 'prose-directive', includeSyntax: null, configRegistration: null,
+        bootstrapTargets: ['AGENTS.md'], maxContextBytes: null, recommendedMaxLines: null, nestedContext: false, support: 'supported',
+        verification: {
+            method: 'ADR-locked surfaces; discover-first AGENTS.md bridge per official Muse Code docs (trust-gated load)',
+            source: 'docs/architecture/adr-muse-provider-target.md',
+            lastVerified: '2026-09-24',
+        },
+    },
     opencode: {
         startupFiles: ['AGENTS.md', 'CLAUDE.md', 'opencode.json#instructions'], precedence: ['provider/system', 'nearest AGENTS.md', 'CLAUDE compatibility', 'registered instructions'],
         loadMode: 'config-registration', includeSyntax: null, configRegistration: { file: 'opencode.json', key: 'instructions' },
@@ -669,16 +685,14 @@ const BUILT_IN_SEEDS = [
         surfaces: {
             primary: 'grok-build',
             compatibility: [],
-            // Agents/rules native writers deferred #2577; host still discovers those dirs.
-            precedence: ['AGENTS.md', '.grok/skills/', '.grok/rules/ (host; AIWG writer deferred #2577)', '.grok/config.toml (config only)', '$GROK_HOME'],
+            precedence: ['AGENTS.md', '.grok/agents/ (qualified model workers)', '.grok/skills/', '.grok/rules/ (host)', '.grok/config.toml (config only)', '$GROK_HOME'],
             related: [],
         },
         detection: { env: ['GROK_HOME'], process: ['grok'], capabilityId: 'grok-build' },
         paths: {
             deployTarget: 'mixed',
             artifacts: {
-                // Wave 1 writes skills + AGENTS.md only; agents/rules indexed until #2577.
-                agents: null,
+                agents: '.grok/agents',
                 commands: null,
                 skills: '.grok/skills',
                 rules: null,
@@ -695,7 +709,7 @@ const BUILT_IN_SEEDS = [
             contextFiles: { aiwgMd: true, agentsMd: true, claudeMdHook: false, hookFile: null, contextFile: 'AGENTS.md' },
         },
         smithPaths: {
-            agents: null,
+            agents: '.grok/agents',
             commands: null,
             skills: '.grok/skills',
             rules: null,
@@ -711,8 +725,8 @@ const BUILT_IN_SEEDS = [
         },
         adapters: {
             agentFormat: 'agents-md',
-            hookBridge: null,
-            mcpInjection: null,
+            hookBridge: 'grok-build',
+            mcpInjection: 'grok-build',
             contextAggregation: 'agents-md',
             ruleFormat: 'agents-md-section',
         },
@@ -764,6 +778,78 @@ const BUILT_IN_SEEDS = [
         },
         matrixRef: 'hermes',
     },
+    {
+        id: 'muse',
+        displayName: 'Muse Code',
+        // #225: ADR fixes the canonical id as `muse` with no aliases.
+        aliases: [],
+        status: 'experimental',
+        builtIn: true,
+        surfaces: {
+            primary: 'muse',
+            compatibility: [],
+            precedence: ['AGENTS.md', '.agents/skills/'],
+            related: [],
+        },
+        // Fail-closed: no env or process signals. A bare `muse` process name collides
+        // with unrelated software, so it is not evidence of Muse Code. The `muse`
+        // CLI binary name is a documented fact, not a detection claim
+        // (docs/architecture/adr-muse-provider-target.md).
+        detection: { env: [], process: [], capabilityId: 'muse' },
+        paths: {
+            deployTarget: 'mixed',
+            artifacts: {
+                // Skills are written natively; agents, commands, and rules stay
+                // indexed (aiwg discover/show) behind the AGENTS.md bridge.
+                agents: null,
+                commands: null,
+                skills: '.agents/skills',
+                rules: null,
+                behaviors: null,
+            },
+            kernelSkills: '.agents/skills',
+            contextDiscovery: {
+                agents: null,
+                skills: '.agents/skills',
+                rules: null,
+                behaviors: null,
+            },
+            configFile: null,
+            contextFiles: { aiwgMd: true, agentsMd: true, claudeMdHook: false, hookFile: null, contextFile: 'AGENTS.md' },
+        },
+        smithPaths: {
+            agents: null,
+            commands: null,
+            skills: '.agents/skills',
+            rules: null,
+            fileExtension: '.md',
+            configFile: null,
+            aggregated: false,
+        },
+        // Project skill root only: the namespace default resolves to
+        // <repo>/.agents/skills — a project tree, never a home-dir tree — so the
+        // deployer cannot invent ~/.muse, ~/.config/muse siblings outside
+        // muse/skills, or ~/.agents/skills from this metadata alone. The XDG
+        // user root ($XDG_CONFIG_HOME/muse/skills, default ~/.config/muse/skills)
+        // is not a static namespace default; it resolves dynamically at deploy
+        // time via resolveMuseXdgSkillsDir (src/providers/muse-paths.ts, #234),
+        // which fails closed on bad XDG metadata. Never write ~/.muse or
+        // silently mirror into ~/.agents/skills (#226).
+        skillNamespace: {
+            deploymentGroup: 'deep-recursion',
+            pathType: 'project',
+            skillsBaseDir: '.agents/skills',
+            subdirLayout: true,
+        },
+        adapters: {
+            agentFormat: 'agents-md',
+            hookBridge: null,
+            mcpInjection: null,
+            contextAggregation: 'agents-md',
+            ruleFormat: 'agents-md-section',
+        },
+        matrixRef: 'muse',
+    },
     {
         id: 'opencode',
         aliases: [],

package/dist/src/providers/provider-definitions.mjs

@@ -1,6 +1,6 @@
 import { resolveOmpPaths } from './omp-paths.mjs';
 import { homedir } from 'os';
-import { resolve } from 'path';
+import { isAbsolute, join, resolve } from 'path';
 
 const MCP_INJECTION_DEFINITIONS = [
   {
@@ -72,6 +72,19 @@ const MCP_INJECTION_DEFINITIONS = [
       supportsEphemeral: true,
     },
   },
+  {
+    id: 'grok-build', aliases: [],
+    mcp: {
+      providerId: 'grok-build',
+      includeInSupportedProviders: true,
+      configFormat: 'toml',
+      serverConfigFormat: 'grok-build',
+      serversKey: null,
+      configPath: { scope: 'project', path: '.grok/config.toml' },
+      supportsEphemeral: false,
+      unsupportedReason: 'Grok Build project MCP configuration is trust-scoped and must remain in its reviewed config layer.',
+    },
+  },
   {
     id: 'opencode',
     aliases: [],
@@ -172,6 +185,13 @@ export function resolveMcpConfigPath(provider, projectDir = '.', options = {}) {
   if (normalizeRuntimeProviderId(provider) === 'omp' && options.scope === 'user') {
     return resolve(resolveOmpPaths(options).agentDir, 'mcp.json');
   }
+  if (normalizeRuntimeProviderId(provider) === 'grok-build' && options.scope === 'user') {
+    const userHome = process.env.HOME || process.env.USERPROFILE || homedir();
+    const raw = process.env.GROK_HOME || join(userHome, '.grok');
+    const home = raw.startsWith('~/') ? join(userHome, raw.slice(2)) : raw;
+    if (!isAbsolute(home) || resolve(home) === resolve(home, '..')) throw new Error('GROK_HOME must be an absolute non-root path for MCP injection');
+    return resolve(home, 'config.toml');
+  }
   const definition = getMcpInjectionDefinition(provider);
   if (!definition) return '';
 

package/dist/src/providers/provider-inventory.js

@@ -13,7 +13,10 @@ const PROVIDER_EXECUTABLES = {
     'deepseek-harness': ['dsh'],
     factory: ['droid'],
     // Grok Bot has no verified CLI executable name; omit rather than invent.
+    // Muse Code's documented CLI binary is `muse`; the bare process name is
+    // deliberately NOT a detection signal (fail-closed per ADR).
     'grok-build': ['grok'],
+    muse: ['muse'],
     hermes: ['hermes'],
     opencode: ['opencode'],
     openclaw: ['openclaw'],

package/dist/src/security/artifact-attestation.js

@@ -1,5 +1,6 @@
-import { createPrivateKey, createPublicKey, sign as signBytes, } from 'node:crypto';
-import { canonicalJson, dssePae, publicKeyFingerprint, sha256 } from './artifact-trust.js';
+import { createPrivateKey, createPublicKey, } from 'node:crypto';
+import { canonicalJson, sha256 } from './artifact-trust.js';
+import { signDsseEnvelope } from './signing.js';
 export const ARTIFACT_ATTESTATION_MEDIA_TYPE = 'application/vnd.aiwg.artifact-attestation.v1+json';
 export const ARTIFACT_PROVENANCE_PREDICATE_TYPE = 'https://aiwg.io/attestations/artifact-provenance/v1';
 export const IN_TOTO_STATEMENT_V1 = 'https://in-toto.io/Statement/v1';
@@ -87,14 +88,9 @@ export function createArtifactAttestation(options) {
     const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
     const statement = createArtifactProvenanceStatement(options);
     const payload = Buffer.from(canonicalJson(statement), 'utf8');
-    const signature = signBytes(null, dssePae(DSSE_IN_TOTO_PAYLOAD_TYPE, payload), privateKey);
     return {
         mediaType: ARTIFACT_ATTESTATION_MEDIA_TYPE,
-        envelope: {
-            payloadType: DSSE_IN_TOTO_PAYLOAD_TYPE,
-            payload: payload.toString('base64'),
-            signatures: [{ keyid: publicKeyFingerprint(publicKeyPem), sig: signature.toString('base64') }],
-        },
+        envelope: signDsseEnvelope(DSSE_IN_TOTO_PAYLOAD_TYPE, payload, privateKey),
         verificationMaterial: {
             kind: 'public-key',
             algorithm: 'ed25519',

package/dist/src/security/signing.js

@@ -0,0 +1,119 @@
+/**
+ * Ed25519 signing helpers shared across subsystems.
+ *
+ * Two shapes are provided:
+ *
+ * - canonical-document signatures: an Ed25519 signature over the canonical JSON
+ *   of a document, with its SHA-256 and signer SPKI carried alongside;
+ * - DSSE envelopes: an Ed25519 signature over the DSSE pre-authentication
+ *   encoding (`artifact-trust.dssePae`) of exact payload bytes.
+ *
+ * Canonicalization defaults to the RFC 8785 implementation in
+ * `artifact-trust.canonicalJson`. A caller whose stored signatures were made
+ * over a different canonical form can bind its own canonicalizer through
+ * `createCanonicalSigner`, so existing signatures keep verifying byte for byte.
+ */
+import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify, } from 'node:crypto';
+import { canonicalJson, decodeBase64, dssePae, publicKeyFingerprint, publicKeyObject, verifyBytes } from './artifact-trust.js';
+export const DEFAULT_KEY_TYPE_ERROR_MESSAGE = 'Signing keys must use Ed25519';
+function sha256Hex(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function publicKeyFromBase64(value) {
+    return createPublicKey({ key: Buffer.from(value, 'base64'), format: 'der', type: 'spki' });
+}
+/** Bind the canonical-document signing helpers to one canonicalizer and error message. */
+export function createCanonicalSigner(options = {}) {
+    const canonicalize = options.canonicalize ?? canonicalJson;
+    const keyTypeError = options.keyTypeErrorMessage ?? DEFAULT_KEY_TYPE_ERROR_MESSAGE;
+    function publicKeyDer(key) {
+        const object = typeof key === 'string'
+            ? createPublicKey(key)
+            : key.type === 'public' ? key : createPublicKey(key);
+        if (object.asymmetricKeyType !== 'ed25519')
+            throw new Error(keyTypeError);
+        return object.export({ format: 'der', type: 'spki' });
+    }
+    function signingKeyId(publicKey) {
+        return `ed25519:${sha256Hex(publicKeyDer(publicKey)).slice(0, 32)}`;
+    }
+    function signCanonicalDocument(document, privateKeyPem, signOptions = {}) {
+        const privateKey = createPrivateKey(privateKeyPem);
+        if (privateKey.asymmetricKeyType !== 'ed25519')
+            throw new Error(keyTypeError);
+        const publicKey = signOptions.publicKeyPem ? createPublicKey(signOptions.publicKeyPem) : createPublicKey(privateKey);
+        const payload = canonicalize(document);
+        return {
+            keyId: signOptions.keyId ?? signingKeyId(publicKey),
+            algorithm: 'ed25519',
+            publicKey: publicKeyDer(publicKey).toString('base64'),
+            signedAt: signOptions.signedAt ?? new Date().toISOString(),
+            payloadSha256: sha256Hex(payload),
+            signature: cryptoSign(null, Buffer.from(payload), privateKey).toString('base64'),
+        };
+    }
+    function verifyCanonicalSignature(document, signature) {
+        const payload = canonicalize(document);
+        return signature.algorithm === 'ed25519'
+            && signature.payloadSha256 === sha256Hex(payload)
+            && cryptoVerify(null, Buffer.from(payload), publicKeyFromBase64(signature.publicKey), Buffer.from(signature.signature, 'base64'));
+    }
+    return { signCanonicalDocument, verifyCanonicalSignature, signingKeyId, publicKeyDer };
+}
+const defaultSigner = createCanonicalSigner();
+/** Sign the RFC 8785 canonical JSON of `document` with an Ed25519 private key. */
+export const signCanonicalDocument = defaultSigner.signCanonicalDocument;
+/** Verify a signature made by `signCanonicalDocument` over the RFC 8785 canonical JSON. */
+export const verifyCanonicalSignature = defaultSigner.verifyCanonicalSignature;
+/** Stable identifier for an Ed25519 public key: `ed25519:` plus 32 hex chars of its SPKI SHA-256. */
+export const signingKeyId = defaultSigner.signingKeyId;
+function ed25519PrivateKey(privateKey, message) {
+    const key = typeof privateKey === 'string' ? createPrivateKey(privateKey) : privateKey;
+    if (key.asymmetricKeyType !== 'ed25519')
+        throw new Error(message);
+    return key;
+}
+/**
+ * Sign exact payload bytes as a single-signature DSSE envelope. The keyid is the
+ * SHA-256 of the signer's SPKI DER (`artifact-trust.publicKeyFingerprint`).
+ */
+export function signDsseEnvelope(payloadType, payload, privateKey, options = {}) {
+    const key = ed25519PrivateKey(privateKey, options.keyTypeErrorMessage ?? DEFAULT_KEY_TYPE_ERROR_MESSAGE);
+    const publicKeyPem = createPublicKey(key).export({ type: 'spki', format: 'pem' }).toString();
+    const body = Buffer.from(payload);
+    const signature = cryptoSign(null, dssePae(payloadType, body), key);
+    return {
+        payloadType,
+        payload: body.toString('base64'),
+        signatures: [{ keyid: publicKeyFingerprint(publicKeyPem), sig: signature.toString('base64') }],
+    };
+}
+/**
+ * Verify that at least one envelope signature is a valid Ed25519 signature by
+ * `publicKey` (PEM or base64 SPKI DER) over the DSSE PAE of the envelope's
+ * payload type and payload. Keyids are lookup hints and are not trusted.
+ * Malformed input verifies as false rather than throwing.
+ */
+export function verifyDsseEnvelope(envelope, publicKey) {
+    let payload;
+    try {
+        if (typeof envelope?.payloadType !== 'string' || !Array.isArray(envelope.signatures))
+            return false;
+        if (publicKeyObject(publicKey).asymmetricKeyType !== 'ed25519')
+            return false;
+        payload = decodeBase64(envelope.payload, 'DSSE payload');
+    }
+    catch {
+        return false;
+    }
+    const pae = dssePae(envelope.payloadType, payload);
+    return envelope.signatures.some((signature) => {
+        try {
+            return verifyBytes('ed25519', publicKey, pae, decodeBase64(signature.sig, 'DSSE signature'));
+        }
+        catch {
+            return false;
+        }
+    });
+}
+//# sourceMappingURL=signing.js.map