@cloudhal/release-verify 0.0.0-stage → 0.10.0

package/dist/src/generated/release-manifest.js

@@ -0,0 +1,237 @@
+/* eslint-disable */
+/* biome-ignore-all lint: generated */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/release-{manifest,statement,keys,yank-list}.schema.json
+ * (run `pnpm gen`; packages/release-verify/scripts/gen-validators.ts)
+ */
+/* biome-ignore-all lint: generated */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/*.schema.json  (run `pnpm gen`)
+ */
+
+/**
+ * Version of this contract. Readers reject unknown versions; migrations move documents forward one version at a time.
+ *
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "SchemaVersion".
+ */
+                              
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "CloudhalVersion".
+ */
+                                     
+/**
+ * RFC 3339 / ISO 8601 instant in UTC.
+ *
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "Timestamp".
+ */
+                               
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "MigrationName".
+ */
+                                   
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "BindingName".
+ */
+                                 
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "Sha256Hex".
+ */
+                               
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "SecretName".
+ */
+                        
+                        
+                   
+                             
+                          
+                           
+                          
+                            
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "ScopeId".
+ */
+                             
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "Capability".
+ */
+                                                                                       
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "SiteId".
+ */
+                            
+
+/**
+ * cloudhal.release-manifest@1 (RFC-0046): the manifest of one Cloudhal release bundle, published as the release asset manifest.json next to the gzip tarball cloudhal-release-<version>.tar.gz. A project release is signed through release-statement.json, which pins this file's SHA-256 and size (signing.signature = release-statement.sig); the legacy form manifest.sig, a raw 64-byte Ed25519 signature over these exact bytes, is for development keys only. It describes every built Worker module and static asset by size and SHA-256, the binding templates, feature levels, migration range and rollback facts a remote deployer needs to install, update or refuse a version without running a build. Portable on purpose: it references common only for SchemaVersion and Timestamp; every other definition is local.
+ */
+                                  
+                               
+                                        
+                           
+                             
+                           
+                 
+                       
+              
+                     
+    
+           
+                      
+                  
+    
+               
+                         
+                        
+                  
+       
+                  
+       
+                                               
+                                    
+    
+                   
+               
+                        
+                        
+                        
+        
+                             
+    
+            
+                              
+                                 
+    
+              
+                                    
+    
+          
+                 
+                    
+                         
+                              
+                            
+    
+           
+                 
+                      
+      
+            
+                         
+                          
+    
+                     
+                          
+                           
+    
+                            
+                            
+                                     
+                                     
+          
+       
+                          
+       
+       
+                       
+                     
+                      
+                          
+                       
+        
+             
+                                     
+                                  
+                               
+                                     
+    
+                      
+            
+                  
+                         
+                                                        
+    
+ 
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "WorkerArtifact".
+ */
+                                 
+                     
+     
+                
+     
+            
+     
+                   
+                                                     
+                    
+                        
+      
+        
+                   
+                                                     
+                    
+                        
+        
+    
+           
+                  
+                  
+       
+                      
+       
+            
+                   
+                    
+                        
+                        
+                          
+        
+                    
+              
+                                                                           
+                                  
+      
+    
+                                     
+ 
+/**
+ * This interface was referenced by `ReleaseManifest`'s JSON-Schema
+ * via the `definition` "BindingTemplate".
+ */
+                                  
+             
+                      
+         
+            
+                   
+                
+                 
+                                  
+                          
+                       
+                   
+                   
+                    
+            
+                  
+                      
+                            
+      
+                      
+                        
+                  
+                
+ 

package/dist/src/generated/release-statement.d.ts

@@ -0,0 +1,61 @@
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/release-{manifest,statement,keys,yank-list}.schema.json
+ * (run `pnpm gen`; packages/release-verify/scripts/gen-validators.ts)
+ */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/*.schema.json  (run `pnpm gen`)
+ */
+/**
+ * Version of this contract. Readers reject unknown versions; migrations move documents forward one version at a time.
+ *
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "SchemaVersion".
+ */
+export type SchemaVersion = 1;
+/**
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "CloudhalVersion".
+ */
+export type CloudhalVersion = string;
+/**
+ * RFC 3339 / ISO 8601 instant in UTC.
+ *
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "Timestamp".
+ */
+export type Timestamp = string;
+/**
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "Sha256Hex".
+ */
+export type Sha256Hex = string;
+/**
+ * cloudhal.release-statement@1 (RFC-0046): the small canonical document a Cloudhal release signs, published as the release asset release-statement.json next to release-statement.sig (a raw 64-byte Ed25519 signature over the exact bytes, at most 4096 of them). It names the version, channel, commit and key id and pins the SHA-256 and size of manifest.json and of the tarball, so a remote deployer verifies one small file and then checks every other asset by digest. Canonical bytes: keys sorted recursively, 2-space indent, a trailing newline; a consumer verifies the bytes it downloaded and never re-serialises them. Portable on purpose: it references common only for SchemaVersion and Timestamp.
+ */
+export interface ReleaseStatement {
+    schemaVersion: SchemaVersion;
+    format: "cloudhal.release-statement@1";
+    version: CloudhalVersion;
+    channel: "stable" | "next";
+    securityRelease: boolean;
+    commit: string;
+    createdAt: Timestamp;
+    signing: {
+        keyId: string;
+        algorithm: "Ed25519";
+        signature: "release-statement.sig";
+    };
+    manifest: StatementAsset;
+    tarball: StatementAsset;
+}
+/**
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "StatementAsset".
+ */
+export interface StatementAsset {
+    name: string;
+    sha256: Sha256Hex;
+    bytes: number;
+}

package/dist/src/generated/release-statement.js

@@ -0,0 +1,66 @@
+/* eslint-disable */
+/* biome-ignore-all lint: generated */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/release-{manifest,statement,keys,yank-list}.schema.json
+ * (run `pnpm gen`; packages/release-verify/scripts/gen-validators.ts)
+ */
+/* biome-ignore-all lint: generated */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/*.schema.json  (run `pnpm gen`)
+ */
+
+/**
+ * Version of this contract. Readers reject unknown versions; migrations move documents forward one version at a time.
+ *
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "SchemaVersion".
+ */
+                              
+/**
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "CloudhalVersion".
+ */
+                                     
+/**
+ * RFC 3339 / ISO 8601 instant in UTC.
+ *
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "Timestamp".
+ */
+                               
+/**
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "Sha256Hex".
+ */
+                               
+
+/**
+ * cloudhal.release-statement@1 (RFC-0046): the small canonical document a Cloudhal release signs, published as the release asset release-statement.json next to release-statement.sig (a raw 64-byte Ed25519 signature over the exact bytes, at most 4096 of them). It names the version, channel, commit and key id and pins the SHA-256 and size of manifest.json and of the tarball, so a remote deployer verifies one small file and then checks every other asset by digest. Canonical bytes: keys sorted recursively, 2-space indent, a trailing newline; a consumer verifies the bytes it downloaded and never re-serialises them. Portable on purpose: it references common only for SchemaVersion and Timestamp.
+ */
+                                   
+                               
+                                         
+                           
+                             
+                           
+                 
+                       
+            
+                  
+                         
+                                       
+    
+                           
+                          
+ 
+/**
+ * This interface was referenced by `ReleaseStatement`'s JSON-Schema
+ * via the `definition` "StatementAsset".
+ */
+                                 
+               
+                    
+                
+ 

package/dist/src/generated/release-yank-list.d.ts

@@ -0,0 +1,73 @@
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/release-{manifest,statement,keys,yank-list}.schema.json
+ * (run `pnpm gen`; packages/release-verify/scripts/gen-validators.ts)
+ */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/*.schema.json  (run `pnpm gen`)
+ */
+/**
+ * Version of this contract. Readers reject unknown versions; migrations move documents forward one version at a time.
+ *
+ * This interface was referenced by `ReleaseYankList`'s JSON-Schema
+ * via the `definition` "SchemaVersion".
+ */
+export type SchemaVersion = 1;
+/**
+ * RFC 3339 / ISO 8601 instant in UTC.
+ *
+ * This interface was referenced by `ReleaseYankList`'s JSON-Schema
+ * via the `definition` "Timestamp".
+ */
+export type Timestamp = string;
+/**
+ * This interface was referenced by `ReleaseYankList`'s JSON-Schema
+ * via the `definition` "CloudhalVersion".
+ */
+export type CloudhalVersion = string;
+/**
+ * This interface was referenced by `ReleaseYankList`'s JSON-Schema
+ * via the `definition` "KeyId".
+ */
+export type KeyId = string;
+/**
+ * cloudhal.release-yank-list@1 (RFC-0046 §9): the yank list, published as yanked.json at https://cloudhal.dev/.well-known/cloudhal/yanked.json next to yanked.json.sig (a raw 64-byte Ed25519 signature by a yank-role key from keys.json over the exact bytes). It only reduces trust: versions no consumer may install, and release key ids every consumer must refuse. Re-signed weekly; it expires 30 days after issuedAt, and a stale list blocks new installs only.
+ */
+export interface ReleaseYankList {
+    schemaVersion: SchemaVersion;
+    format: "cloudhal.release-yank-list@1";
+    /**
+     * Increases by one at every signing. A consumer that keeps state refuses a serial lower than the last one it saw (a rollback to an older, validly signed list).
+     */
+    serial: number;
+    issuedAt: Timestamp;
+    /**
+     * RFC 3339 / ISO 8601 instant in UTC.
+     */
+    expires: string;
+    signing: {
+        /**
+         * The yank-role key that signed this list.
+         */
+        keyId: string;
+        algorithm: "Ed25519";
+        signature: "yanked.json.sig";
+    };
+    /**
+     * @maxItems 1000
+     */
+    versions: {
+        version: CloudhalVersion;
+        yankedAt: Timestamp;
+        reason: string;
+    }[];
+    /**
+     * @maxItems 64
+     */
+    revokedKeys: {
+        keyId: KeyId;
+        revokedAt: Timestamp;
+        reason: string;
+    }[];
+}

package/dist/src/generated/release-yank-list.js

@@ -0,0 +1,78 @@
+/* eslint-disable */
+/* biome-ignore-all lint: generated */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/release-{manifest,statement,keys,yank-list}.schema.json
+ * (run `pnpm gen`; packages/release-verify/scripts/gen-validators.ts)
+ */
+/* biome-ignore-all lint: generated */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/*.schema.json  (run `pnpm gen`)
+ */
+
+/**
+ * Version of this contract. Readers reject unknown versions; migrations move documents forward one version at a time.
+ *
+ * This interface was referenced by `ReleaseYankList`'s JSON-Schema
+ * via the `definition` "SchemaVersion".
+ */
+                              
+/**
+ * RFC 3339 / ISO 8601 instant in UTC.
+ *
+ * This interface was referenced by `ReleaseYankList`'s JSON-Schema
+ * via the `definition` "Timestamp".
+ */
+                               
+/**
+ * This interface was referenced by `ReleaseYankList`'s JSON-Schema
+ * via the `definition` "CloudhalVersion".
+ */
+                                     
+/**
+ * This interface was referenced by `ReleaseYankList`'s JSON-Schema
+ * via the `definition` "KeyId".
+ */
+                           
+
+/**
+ * cloudhal.release-yank-list@1 (RFC-0046 §9): the yank list, published as yanked.json at https://cloudhal.dev/.well-known/cloudhal/yanked.json next to yanked.json.sig (a raw 64-byte Ed25519 signature by a yank-role key from keys.json over the exact bytes). It only reduces trust: versions no consumer may install, and release key ids every consumer must refuse. Re-signed weekly; it expires 30 days after issuedAt, and a stale list blocks new installs only.
+ */
+                                  
+                               
+                                         
+     
+                                                                                                                                                                  
+     
+                 
+                      
+     
+                                        
+     
+                  
+            
+       
+                                               
+       
+                  
+                         
+                                 
+    
+     
+                   
+     
+             
+                             
+                        
+                   
+      
+     
+                 
+     
+                
+                 
+                         
+                   
+      
+ 

package/dist/src/generated/validators.d.ts

@@ -0,0 +1,22 @@
+/* eslint-disable */
+/* biome-ignore-all lint: generated */
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ * Source: packages/core-contracts/schemas/release-{manifest,statement,keys,yank-list}.schema.json
+ * (run `pnpm gen`; packages/release-verify/scripts/gen-validators.ts)
+ */
+
+import type { ReleaseKeys } from "./release-keys.js";
+import type { ReleaseManifest } from "./release-manifest.js";
+import type { ReleaseStatement } from "./release-statement.js";
+import type { ReleaseYankList } from "./release-yank-list.js";
+
+export interface StandaloneValidator<T> {
+  (data: unknown): data is T;
+  errors?: { instancePath: string; message?: string }[] | null;
+}
+
+export declare const validateReleaseManifest: StandaloneValidator<ReleaseManifest>;
+export declare const validateReleaseStatement: StandaloneValidator<ReleaseStatement>;
+export declare const validateReleaseKeys: StandaloneValidator<ReleaseKeys>;
+export declare const validateReleaseYankList: StandaloneValidator<ReleaseYankList>;