@effected/sbom 0.1.0

package/SbomDocument.js

@@ -0,0 +1,223 @@
+import { Schema } from "effect";
+import { License, isValidExpression } from "@effected/spdx";
+
+//#region src/SbomDocument.ts
+/** The BOM format discriminator. CycloneDX requires this exact string. */
+const BOM_FORMAT = "CycloneDX";
+/** The only specification version this package emits. */
+const SPEC_VERSION = "1.6";
+/**
+* The CycloneDX component types this package emits.
+*
+* @remarks
+* A deliberate subset of the specification's fourteen: an npm SBOM describes
+* libraries and applications. The full enum is available in the schema; adding
+* a member here is a one-line change when something needs one.
+*
+* @public
+*/
+const ComponentType = Schema.Literals([
+	"library",
+	"application",
+	"framework"
+]);
+/**
+* An external reference's kind.
+*
+* @remarks
+* The four the manifest mapping produces, out of the specification's 43. Each
+* corresponds to a `package.json` field: `vcs` ← `repository`,
+* `issue-tracker` ← `bugs`, `website` and `documentation` ← `homepage`.
+*
+* @public
+*/
+const ExternalReferenceType = Schema.Literals([
+	"vcs",
+	"issue-tracker",
+	"website",
+	"documentation"
+]);
+/**
+* A link from a component to something outside the BOM.
+*
+* @public
+*/
+var ExternalReference = class extends Schema.Class("ExternalReference")({
+	/** The reference kind. */
+	type: ExternalReferenceType,
+	/** The URL it points at, passed through exactly as supplied. */
+	url: Schema.String
+}) {};
+/**
+* A point of contact — a person at a supplier, or an author of the BOM.
+*
+* @public
+*/
+var Contact = class extends Schema.Class("Contact")({
+	/** The contact's name. */
+	name: Schema.optionalKey(Schema.String),
+	/** Their email address. */
+	email: Schema.optionalKey(Schema.String),
+	/** Their telephone number. */
+	phone: Schema.optionalKey(Schema.String)
+}) {};
+/**
+* The organization that supplied a component.
+*
+* @remarks
+* `name` is required because `metadata.supplier.name` is **NTIA minimum
+* element 1**; a supplier without one satisfies nothing.
+*
+* @public
+*/
+var Supplier = class extends Schema.Class("Supplier")({
+	/** The supplier organization's name. */
+	name: Schema.String,
+	/** Its URLs. */
+	url: Schema.optionalKey(Schema.Array(Schema.String)),
+	/** Its points of contact. */
+	contact: Schema.optionalKey(Schema.Array(Contact))
+}) {};
+/**
+* One component in the BOM — the root, or a dependency.
+*
+* @remarks
+* `bomRef` is spelled **`bom-ref`** in the emitted JSON; the rename happens in
+* `Sbom.toJson`. Emitting `bomRef` produces a document that looks
+* correct and validates wrong, which is why a test pins the key name.
+*
+* @public
+*/
+var Component = class extends Schema.Class("Component")({
+	/** What kind of component this is. */
+	type: ComponentType,
+	/** The component's name — NTIA minimum element 2. */
+	name: Schema.String,
+	/** Its version — NTIA minimum element 3. */
+	version: Schema.optionalKey(Schema.String),
+	/** The package URL uniquely identifying it — NTIA minimum element 4. */
+	purl: Schema.optionalKey(Schema.String),
+	/** The identifier other parts of the document reference it by. */
+	bomRef: Schema.optionalKey(Schema.String),
+	/** A short description. */
+	description: Schema.optionalKey(Schema.String),
+	/** SPDX license identifiers or expressions. */
+	licenses: Schema.optionalKey(Schema.Array(Schema.String)),
+	/** Links out of the BOM. */
+	externalReferences: Schema.optionalKey(Schema.Array(ExternalReference)),
+	/** Discovery keywords — CycloneDX 1.6's `tags`, from the manifest's `keywords`. */
+	tags: Schema.optionalKey(Schema.Array(Schema.String)),
+	/** The component's authors. */
+	authors: Schema.optionalKey(Schema.Array(Contact)),
+	/** The entity that published it. */
+	publisher: Schema.optionalKey(Schema.String),
+	/** A copyright statement. */
+	copyright: Schema.optionalKey(Schema.String)
+}) {};
+/**
+* Document-level metadata: who made the BOM, when, and about what.
+*
+* @public
+*/
+var SbomMetadata = class extends Schema.Class("SbomMetadata")({
+	/** When the BOM was assembled — NTIA minimum element 7. */
+	timestamp: Schema.optionalKey(Schema.String),
+	/** Who created the BOM — NTIA minimum element 6. */
+	authors: Schema.optionalKey(Schema.Array(Contact)),
+	/** The component the BOM describes. */
+	component: Schema.optionalKey(Component),
+	/** Who supplied that component — NTIA minimum element 1. */
+	supplier: Schema.optionalKey(Supplier)
+}) {};
+/**
+* A CycloneDX 1.6 bill of materials.
+*
+* @remarks
+* Constructed by `Sbom.generate` and serialized by `Sbom.toJson`; both are
+* total functions, because an owned model over validated values has nothing to
+* fail at.
+*
+* @public
+*/
+var SbomDocument = class extends Schema.Class("SbomDocument")({
+	/** Always `"CycloneDX"`. */
+	bomFormat: Schema.Literal(BOM_FORMAT),
+	/** Always `"1.6"`. */
+	specVersion: Schema.Literal("1.6"),
+	/** The document revision, `1` for a freshly assembled BOM. */
+	version: Schema.Number,
+	/** Document metadata. */
+	metadata: Schema.optionalKey(SbomMetadata),
+	/** The components the BOM describes, sorted by name. */
+	components: Schema.Array(Component)
+}) {};
+/** Drop absent keys so the emitted JSON omits them rather than carrying nulls. */
+const compact = (value) => {
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry !== void 0) out[key] = entry;
+	return out;
+};
+/**
+* The `licenses` array in one of the three shapes CycloneDX permits.
+*
+* A manifest's `license` field is an SPDX **expression** field: `MIT`,
+* `MIT OR Apache-2.0` and `UNLICENSED` are all legal values of it, and the
+* specification renders them three different ways — `license.id` is constrained
+* to the SPDX identifier enumeration, an expression goes in a one-element
+* `{ expression }` tuple, and anything else is a named license. Emitting every
+* value as an id produces a document that looks right and validates wrong.
+*
+* The identifier-versus-expression question is `@effected/spdx`'s to answer:
+* the kit's one SPDX engine, never a local regex.
+*/
+const licensesJson = (licenses) => {
+	const [only] = licenses;
+	if (licenses.length === 1 && only !== void 0 && !License.isKnownId(only) && isValidExpression(only)) return [{ expression: only }];
+	return licenses.map((license) => License.isKnownId(license) ? { license: { id: license } } : { license: { name: license } });
+};
+const contactJson = (contact) => compact({
+	name: contact.name,
+	email: contact.email,
+	phone: contact.phone
+});
+const componentJson = (component) => compact({
+	type: component.type,
+	"bom-ref": component.bomRef,
+	name: component.name,
+	version: component.version,
+	description: component.description,
+	publisher: component.publisher,
+	copyright: component.copyright,
+	authors: component.authors?.map(contactJson),
+	licenses: component.licenses === void 0 ? void 0 : licensesJson(component.licenses),
+	purl: component.purl,
+	externalReferences: component.externalReferences?.map((reference) => ({
+		url: reference.url,
+		type: reference.type
+	})),
+	tags: component.tags
+});
+/**
+* The document as a plain JSON value, in CycloneDX's key shapes.
+*
+* @internal
+*/
+const documentJson = (document) => compact({
+	bomFormat: document.bomFormat,
+	specVersion: document.specVersion,
+	version: document.version,
+	metadata: document.metadata === void 0 ? void 0 : compact({
+		timestamp: document.metadata.timestamp,
+		authors: document.metadata.authors?.map(contactJson),
+		component: document.metadata.component === void 0 ? void 0 : componentJson(document.metadata.component),
+		supplier: document.metadata.supplier === void 0 ? void 0 : compact({
+			name: document.metadata.supplier.name,
+			url: document.metadata.supplier.url,
+			contact: document.metadata.supplier.contact?.map(contactJson)
+		})
+	}),
+	components: document.components.map(componentJson)
+});
+
+//#endregion
+export { BOM_FORMAT, Component, ComponentType, Contact, ExternalReference, ExternalReferenceType, SbomDocument, SbomMetadata, Supplier, documentJson };

package/SbomMetadataSource.js

@@ -0,0 +1,202 @@
+import { Component, Contact, ExternalReference, SbomMetadata, Supplier } from "./SbomDocument.js";
+import { Option } from "effect";
+
+//#region src/SbomMetadataSource.ts
+/** The purl namespace and name segments for an npm package name. */
+const purlSegments = (name) => {
+	const separator = name.lastIndexOf("/");
+	if (!name.startsWith("@") || separator <= 0) return encodeURIComponent(name);
+	return `${encodeURIComponent(name.slice(0, separator))}/${encodeURIComponent(name.slice(separator + 1))}`;
+};
+const npmPurl = (name, version) => {
+	const path = purlSegments(name);
+	return version === void 0 ? `pkg:npm/${path}` : `pkg:npm/${path}@${version}`;
+};
+const contactOf = (person) => Contact.make({
+	name: person.name,
+	...person.email !== void 0 && { email: person.email }
+});
+/** The manifest's authors: its maintainers, or its lone author when it lists none. */
+const authorsOf = (pkg) => {
+	if (pkg.maintainers !== void 0 && pkg.maintainers.length > 0) return pkg.maintainers.map(contactOf);
+	return pkg.author === void 0 ? void 0 : [contactOf(pkg.author)];
+};
+/** The supplier's first URL, which becomes a `website` reference when it says something new. */
+const supplierUrl = (options) => options?.supplier?.url?.[0];
+const documentationUrl = (pkg, options) => options?.documentationUrl ?? pkg.homepage;
+const externalReferences = (pkg, options) => {
+	const references = [];
+	const vcs = pkg.repository === void 0 ? Option.none() : pkg.repository.browseUrl;
+	if (Option.isSome(vcs)) references.push(ExternalReference.make({
+		type: "vcs",
+		url: vcs.value
+	}));
+	if (pkg.bugs?.url !== void 0) references.push(ExternalReference.make({
+		type: "issue-tracker",
+		url: pkg.bugs.url
+	}));
+	const documentation = documentationUrl(pkg, options);
+	if (documentation !== void 0) references.push(ExternalReference.make({
+		type: "documentation",
+		url: documentation
+	}));
+	const website = supplierUrl(options);
+	if (website !== void 0 && website !== documentation) references.push(ExternalReference.make({
+		type: "website",
+		url: website
+	}));
+	return references;
+};
+const componentFor = (input) => Component.make({
+	type: input.type ?? "library",
+	name: input.name,
+	...input.version !== void 0 && { version: input.version },
+	purl: npmPurl(input.name, input.version),
+	bomRef: input.version === void 0 ? input.name : `${input.name}@${input.version}`,
+	...input.description !== void 0 && { description: input.description },
+	...input.license !== void 0 && { licenses: [input.license] }
+});
+const rootComponent = (pkg, options) => {
+	const version = pkg.version.toString();
+	const references = externalReferences(pkg, options);
+	const authors = authorsOf(pkg);
+	const publisher = options?.publisher ?? options?.supplier?.name ?? pkg.author?.name;
+	return Component.make({
+		type: options?.type ?? "library",
+		name: pkg.name,
+		version,
+		purl: npmPurl(pkg.name, version),
+		bomRef: `${pkg.name}@${version}`,
+		...pkg.description !== void 0 && { description: pkg.description },
+		...pkg.license !== void 0 && { licenses: [pkg.license] },
+		...references.length > 0 && { externalReferences: references },
+		...pkg.keywords !== void 0 && pkg.keywords.length > 0 && { tags: pkg.keywords },
+		...authors !== void 0 && { authors },
+		...publisher !== void 0 && { publisher },
+		...options?.copyright !== void 0 && { copyright: options.copyright }
+	});
+};
+const fromPackage = (pkg, options) => {
+	const supplier = options?.supplier;
+	const contacts = supplier?.contact ?? authorsOf(pkg);
+	const resolved = supplier === void 0 ? void 0 : Supplier.make({
+		name: supplier.name,
+		...supplier.url !== void 0 && { url: supplier.url },
+		...contacts !== void 0 && { contact: contacts }
+	});
+	return SbomMetadata.make({
+		...options?.timestamp !== void 0 && { timestamp: options.timestamp },
+		...options?.authors !== void 0 && { authors: options.authors },
+		...resolved !== void 0 && { supplier: resolved }
+	});
+};
+const formatCopyright = (holder, years) => years.startYear === void 0 || years.startYear === years.year ? `Copyright ${years.year} ${holder}` : `Copyright ${years.startYear}-${years.year} ${holder}`;
+const merge = (base, override) => {
+	const timestamp = override.timestamp ?? base.timestamp;
+	const authors = override.authors ?? base.authors;
+	const component = override.component ?? base.component;
+	const supplier = override.supplier ?? base.supplier;
+	return SbomMetadata.make({
+		...timestamp !== void 0 && { timestamp },
+		...authors !== void 0 && { authors },
+		...component !== void 0 && { component },
+		...supplier !== void 0 && { supplier }
+	});
+};
+/**
+* Derivation of CycloneDX metadata from a `package.json` manifest.
+*
+* @example
+* ```ts
+* import { Sbom, SbomMetadataSource } from "@effected/sbom";
+*
+* const root = SbomMetadataSource.rootComponent(pkg, { supplier });
+* const metadata = SbomMetadataSource.fromPackage(pkg, { supplier, timestamp });
+* const document = Sbom.generate({ root, components, metadata });
+* ```
+*
+* @public
+*/
+var SbomMetadataSource = class {
+	constructor() {}
+	/**
+	* The canonical npm package URL for a name and optional version.
+	*
+	* @remarks
+	* The NTIA's "unique identifier" element, and the identifier an in-toto
+	* subject names. Exposed because a caller assembling its own components —
+	* or a statement subject — needs the same encoding this module applies.
+	*/
+	static npmPurl = npmPurl;
+	/**
+	* A component entry for one resolved dependency.
+	*
+	* @remarks
+	* The caller assembles the component list — the kit has no second merge
+	* rule for sibling packages released in the same wave, because which
+	* versions are in flight is release planning and `@effected/workspaces`
+	* already knows it. This is the mapping that would otherwise be
+	* re-derived at every call site.
+	*/
+	static componentFor = componentFor;
+	/**
+	* The root component the BOM is about, derived from its own manifest.
+	*
+	* @remarks
+	* `publisher` resolves explicit → supplier name → the manifest's author,
+	* which is what lets NTIA element 6 be satisfied from a manifest alone.
+	*/
+	static rootComponent = rootComponent;
+	/**
+	* The manifest's outward links, as CycloneDX external references.
+	*
+	* @remarks
+	* Four of the specification's 43 types, one per manifest field: `vcs` ←
+	* `repository`, `issue-tracker` ← `bugs`, `documentation` ← `homepage`,
+	* `website` ← the supplier's first URL.
+	*
+	* A `repository` value the package-json model cannot interpret produces
+	* **no** reference rather than a passed-through string: CycloneDX's
+	* `externalReference.url` is a URL, and emitting `owner/name` there is a
+	* document that validates and misleads.
+	*/
+	static externalReferences = externalReferences;
+	/**
+	* Document-level metadata for a manifest.
+	*
+	* @remarks
+	* The root component is **not** on the returned value: `Sbom.generate`
+	* threads its `root` argument onto the metadata itself, so setting it
+	* here would only be overwritten. Build the root with
+	* {@link SbomMetadataSource.rootComponent} and pass both.
+	*
+	* When the caller supplies a supplier with no contacts, the manifest's
+	* maintainers fill them — the one derivation that crosses from manifest
+	* vocabulary into supplier vocabulary, and only where the caller left a
+	* hole.
+	*/
+	static fromPackage = fromPackage;
+	/**
+	* A copyright statement for a holder and a year, or a span of years.
+	*
+	* @remarks
+	* The year is an **argument**. The predecessor defaulted it to
+	* `new Date().getFullYear()`, which made its output untestable and its
+	* purity a claim rather than a property; the ambient read belongs at the
+	* caller's edge.
+	*/
+	static formatCopyright = formatCopyright;
+	/**
+	* Field-wise metadata merge: every field the override carries wins.
+	*
+	* @remarks
+	* A helper, not a policy. Which side is the override — a config file over
+	* inferred values, or the reverse — is the consumer's precedence rule,
+	* and a library that decided it would be encoding one repository's
+	* release policy.
+	*/
+	static merge = merge;
+};
+
+//#endregion
+export { SbomMetadataSource };

package/SigstoreBundle.js

@@ -0,0 +1,48 @@
+import { Schema } from "effect";
+
+//#region src/SigstoreBundle.ts
+/**
+* The Sigstore bundle media type this package produces.
+*
+* @remarks
+* v0.3 with a single certificate — what `DSSEBundleBuilder` emits by default,
+* and what GitHub's `POST /repos/{owner}/{repo}/attestations` accepts.
+*
+* @public
+*/
+const SIGSTORE_BUNDLE_V0_3_MEDIA_TYPE = "application/vnd.dev.sigstore.bundle.v0.3+json";
+/**
+* The DSSE payload type for an in-toto statement, per the GitHub attestations
+* specification.
+*
+* @public
+*/
+const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+/**
+* A signed Sigstore bundle: the wire form of an attestation.
+*
+* @remarks
+* `verificationMaterial` and `dsseEnvelope` are `unknown` because their shapes
+* belong to the Sigstore protobuf specifications, and re-declaring them here
+* would be a second, drifting copy of a wire format we do not own. The bundle
+* is opaque to everything that merely stores or forwards it.
+*
+* `mediaType` is carried through from what the builder produced rather than
+* asserted — the version is the producer's statement about the bundle, and a
+* literal here would quietly lie the day a builder emits a different one.
+*
+* @see {@link https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto | sigstore_bundle.proto}
+*
+* @public
+*/
+var SigstoreBundle = class extends Schema.Class("SigstoreBundle")({
+	/** The bundle's media type, usually {@link SIGSTORE_BUNDLE_V0_3_MEDIA_TYPE}. */
+	mediaType: Schema.String,
+	/** The certificate and transparency-log entries a verifier checks. */
+	verificationMaterial: Schema.Unknown,
+	/** The signed DSSE envelope carrying the statement. */
+	dsseEnvelope: Schema.Unknown
+}) {};
+
+//#endregion
+export { IN_TOTO_PAYLOAD_TYPE, SIGSTORE_BUNDLE_V0_3_MEDIA_TYPE, SigstoreBundle };

package/SigstoreSigner.js

@@ -0,0 +1,150 @@
+import { IdentityToken } from "./IdentityToken.js";
+import { IN_TOTO_PAYLOAD_TYPE, SigstoreBundle } from "./SigstoreBundle.js";
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+import { bundleToJSON } from "@sigstore/bundle";
+import { DSSEBundleBuilder, FulcioSigner, RekorWitness } from "@sigstore/sign";
+
+//#region src/SigstoreSigner.ts
+/**
+* The OIDC audience Sigstore's certificate authority requires.
+*
+* @remarks
+* It lives here, not at the call site, because it is the **signing protocol's**
+* requirement rather than the caller's knowledge — which is why
+* {@link SigstoreSignerShape.sign} takes only a statement and asks the identity
+* contract for a token. Considered and rejected: `sign(statement, { token })`,
+* which reads simpler and forces every caller to learn a constant that is none
+* of its business.
+*
+* @public
+*/
+const SIGSTORE_OIDC_AUDIENCE = "sigstore";
+/**
+* Which step of signing failed.
+*
+* @public
+*/
+const SigningErrorKind = Schema.Literals([
+	"identity",
+	"certificate",
+	"transparencyLog",
+	"bundle"
+]);
+/**
+* Raised when a statement cannot be signed.
+*
+* @remarks
+* Sized to what a caller can act on: an `identity` failure is a workflow
+* permissions problem, `certificate` is Fulcio, `transparencyLog` is Rekor, and
+* `bundle` is everything else about assembling the result. The original failure
+* is preserved structurally on `cause` rather than flattened into a message.
+*
+* @public
+*/
+var SigningError = class extends Schema.TaggedErrorClass()("SigningError", {
+	/** Which step failed. */
+	kind: SigningErrorKind,
+	/** The underlying failure, preserved structurally. */
+	cause: Schema.Defect()
+}) {
+	get message() {
+		return `Failed to sign the statement (${this.kind})`;
+	}
+};
+/**
+* Attribute a `@sigstore/sign` failure to a step.
+*
+* `InternalError` carries a `code`, which is a far better signal than the
+* message text the predecessor scraped. An unrecognized failure is `bundle` —
+* literally "the bundle did not get built" — rather than being guessed into a
+* step it may not belong to.
+*/
+const kindOf = (cause) => {
+	const code = cause?.code;
+	if (typeof code !== "string") return "bundle";
+	if (code.startsWith("IDENTITY_TOKEN_")) return "identity";
+	if (code.startsWith("CA_")) return "certificate";
+	if (code.startsWith("TLOG_") || code.startsWith("TSA_")) return "transparencyLog";
+	return "bundle";
+};
+const make = (identity, options) => ({ sign: Effect.fn("SigstoreSigner.sign")(function* (statement) {
+	const token = yield* identity.token(SIGSTORE_OIDC_AUDIENCE).pipe(Effect.mapError((cause) => new SigningError({
+		kind: "identity",
+		cause
+	})));
+	const builder = new DSSEBundleBuilder({
+		signer: options.signer ?? new FulcioSigner({
+			identityProvider: { getToken: () => Promise.resolve(Redacted.value(token)) },
+			...options.fulcioBaseUrl !== void 0 && { fulcioBaseURL: options.fulcioBaseUrl }
+		}),
+		witnesses: [...options.witnesses ?? [new RekorWitness({
+			entryType: "dsse",
+			...options.rekorBaseUrl !== void 0 && { rekorBaseURL: options.rekorBaseUrl }
+		})]]
+	});
+	const bundle = yield* Effect.tryPromise({
+		try: () => builder.create({
+			data: Buffer.from(statement.toJson(), "utf8"),
+			type: IN_TOTO_PAYLOAD_TYPE
+		}),
+		catch: (cause) => new SigningError({
+			kind: kindOf(cause),
+			cause
+		})
+	});
+	return yield* Effect.try({
+		try: () => {
+			const serialized = bundleToJSON(bundle);
+			return SigstoreBundle.make({
+				mediaType: serialized.mediaType,
+				verificationMaterial: serialized.verificationMaterial,
+				dsseEnvelope: serialized.dsseEnvelope
+			});
+		},
+		catch: (cause) => new SigningError({
+			kind: "bundle",
+			cause
+		})
+	});
+}) });
+const unstubbed = () => {
+	throw new Error("SigstoreSigner.makeTest: sign() was called but not stubbed — a fabricated bundle would be a signature-shaped lie. Pass a `sign` override, or drive the real builder through SigstoreSigner.layerWith({ signer, witnesses }).");
+};
+/**
+* Sigstore signing.
+*
+* @example
+* ```ts
+* import { IdentityToken, SigstoreSigner } from "@effected/sbom";
+* import { Effect, Layer } from "effect";
+*
+* const program = Effect.gen(function* () {
+*   const signer = yield* SigstoreSigner;
+*   return yield* signer.sign(statement);
+* });
+* ```
+*
+* @public
+*/
+var SigstoreSigner = class SigstoreSigner extends Context.Service()("@effected/sbom/SigstoreSigner") {
+	/** Signing against the public-good Fulcio and Rekor instances. */
+	static layer = Layer.effect(this, Effect.map(IdentityToken, (identity) => make(identity, {})));
+	/** {@link (SigstoreSigner:class).layer} with the signing endpoints, or the signer and witnesses, replaced. */
+	static layerWith = (options) => Layer.effect(SigstoreSigner, Effect.map(IdentityToken, (identity) => make(identity, options)));
+	/**
+	* An in-memory double whose `sign` **dies** unless stubbed.
+	*
+	* @remarks
+	* The strongest case in the kit for the die-loudly default: no honest
+	* fabricated answer exists, because a bundle that looks signed and is not is
+	* exactly the failure an attestation exists to prevent. A test that wants a
+	* real bundle without a network drives the real builder through
+	* {@link (SigstoreSigner:class).layerWith}.
+	*/
+	static makeTest = (overrides = {}) => ({ sign: overrides.sign ?? (() => unstubbed()) });
+	/** {@link (SigstoreSigner:class).makeTest} behind a `Layer`. */
+	static layerTest = (overrides = {}) => Layer.succeed(SigstoreSigner, SigstoreSigner.makeTest(overrides));
+};
+
+//#endregion
+export { SIGSTORE_OIDC_AUDIENCE, SigningError, SigningErrorKind, SigstoreSigner };