@enactprotocol/trust 2.0.0 → 2.0.2

package/dist/sigstore/verification.js

@@ -0,0 +1,317 @@
+/**
+ * Sigstore verification module
+ *
+ * This module provides verification capabilities for Sigstore bundles and attestations.
+ * It verifies signatures, certificates, and transparency log entries.
+ *
+ * NOTE: This implementation bypasses TUF (The Update Framework) and uses bundled trusted
+ * roots directly. This is necessary for Bun compatibility because TUF verification fails
+ * with BoringSSL's stricter signature algorithm requirements.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { bundleFromJSON } from "@sigstore/bundle";
+import { TrustedRoot } from "@sigstore/protobuf-specs";
+import { Verifier, toSignedEntity, toTrustMaterial } from "@sigstore/verify";
+import { extractIdentityFromBundle } from "./signing";
+// ============================================================================
+// Constants
+// ============================================================================
+/**
+ * Get the path to bundled TUF seeds
+ * We need to navigate from the @sigstore/tuf main entry point to find seeds.json
+ */
+function getTufSeedsPath() {
+    // The package.json main points to dist/index.js, but seeds.json is at package root
+    const tufPkgPath = require.resolve("@sigstore/tuf/package.json");
+    return path.join(path.dirname(tufPkgPath), "seeds.json");
+}
+// ============================================================================
+// Trusted Root Management
+// ============================================================================
+/**
+ * Load the trusted root from bundled TUF seeds
+ * This bypasses TUF's online verification which fails with BoringSSL
+ */
+async function loadTrustedRoot() {
+    const seedsPath = getTufSeedsPath();
+    const seeds = JSON.parse(fs.readFileSync(seedsPath, "utf8"));
+    const seedData = seeds["https://tuf-repo-cdn.sigstore.dev"];
+    const trustedRootB64 = seedData.targets["trusted_root.json"];
+    const trustedRootJson = JSON.parse(Buffer.from(trustedRootB64, "base64").toString());
+    return TrustedRoot.fromJSON(trustedRootJson);
+}
+/**
+ * Create trust material from the bundled trusted root
+ */
+async function createTrustMaterial() {
+    const trustedRoot = await loadTrustedRoot();
+    return toTrustMaterial(trustedRoot);
+}
+// ============================================================================
+// Verification Functions
+// ============================================================================
+/**
+ * Verify a Sigstore bundle
+ *
+ * @param bundle - The Sigstore bundle to verify
+ * @param artifact - Optional artifact data (for message signature bundles)
+ * @param options - Verification options
+ * @returns Verification result with detailed checks
+ *
+ * @example
+ * ```ts
+ * const result = await verifyBundle(bundle, artifact, {
+ *   expectedIdentity: {
+ *     subjectAlternativeName: "user@example.com",
+ *     issuer: "https://accounts.google.com"
+ *   }
+ * });
+ * if (result.verified) {
+ *   console.log("Bundle verified successfully");
+ * }
+ * ```
+ */
+export async function verifyBundle(bundle, artifact, options = {}) {
+    const details = {
+        signatureValid: false,
+        certificateValid: false,
+        certificateWithinValidity: false,
+        rekorEntryValid: false,
+        inclusionProofValid: false,
+        errors: [],
+    };
+    try {
+        // Create trust material from bundled roots
+        const trustMaterial = await createTrustMaterial();
+        // Create verifier
+        const verifier = new Verifier(trustMaterial);
+        // Convert bundle to proper format
+        const parsedBundle = bundleFromJSON(bundle);
+        const signedEntity = toSignedEntity(parsedBundle, artifact);
+        // Perform verification
+        verifier.verify(signedEntity);
+        // If we get here, verification passed
+        details.signatureValid = true;
+        details.certificateValid = true;
+        details.certificateWithinValidity = true;
+        details.rekorEntryValid = true;
+        details.inclusionProofValid = true;
+        // Extract identity from bundle
+        const identity = extractIdentityFromBundle(bundle);
+        // Check identity if expected identity is provided
+        if (options.expectedIdentity) {
+            details.identityMatches = matchesExpectedIdentity(identity, options.expectedIdentity);
+            if (!details.identityMatches) {
+                details.errors.push("Identity does not match expected values");
+                const result = {
+                    verified: false,
+                    error: "Identity mismatch",
+                    details,
+                };
+                if (identity)
+                    result.identity = identity;
+                const timestamp = extractTimestampFromBundle(bundle);
+                if (timestamp)
+                    result.timestamp = timestamp;
+                return result;
+            }
+        }
+        const result = {
+            verified: true,
+            details,
+        };
+        if (identity)
+            result.identity = identity;
+        const timestamp = extractTimestampFromBundle(bundle);
+        if (timestamp)
+            result.timestamp = timestamp;
+        return result;
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        details.errors.push(errorMessage);
+        // Try to determine which check failed based on error message
+        categorizeVerificationError(errorMessage, details);
+        return {
+            verified: false,
+            error: errorMessage,
+            details,
+        };
+    }
+}
+/**
+ * Create a reusable verifier for multiple verifications
+ *
+ * @param options - Verification options
+ * @returns A verifier object that can verify multiple bundles
+ *
+ * @example
+ * ```ts
+ * const verifier = await createBundleVerifier({
+ *   expectedIdentity: { issuer: "https://accounts.google.com" }
+ * });
+ *
+ * // Verify multiple bundles efficiently
+ * for (const bundle of bundles) {
+ *   verifier.verify(bundle);
+ * }
+ * ```
+ */
+export async function createBundleVerifier(options = {}) {
+    // Create trust material once and reuse
+    const trustMaterial = await createTrustMaterial();
+    const verifier = new Verifier(trustMaterial);
+    return {
+        /**
+         * Verify a bundle using the cached verifier
+         */
+        verify: async (bundle, artifact) => {
+            const details = {
+                signatureValid: false,
+                certificateValid: false,
+                certificateWithinValidity: false,
+                rekorEntryValid: false,
+                inclusionProofValid: false,
+                errors: [],
+            };
+            try {
+                // Convert bundle to proper format
+                const parsedBundle = bundleFromJSON(bundle);
+                const signedEntity = toSignedEntity(parsedBundle, artifact);
+                // Perform verification
+                verifier.verify(signedEntity);
+                details.signatureValid = true;
+                details.certificateValid = true;
+                details.certificateWithinValidity = true;
+                details.rekorEntryValid = true;
+                details.inclusionProofValid = true;
+                const identity = extractIdentityFromBundle(bundle);
+                if (options.expectedIdentity) {
+                    details.identityMatches = matchesExpectedIdentity(identity, options.expectedIdentity);
+                    if (!details.identityMatches) {
+                        details.errors.push("Identity does not match expected values");
+                        const result = {
+                            verified: false,
+                            error: "Identity mismatch",
+                            details,
+                        };
+                        if (identity)
+                            result.identity = identity;
+                        const timestamp = extractTimestampFromBundle(bundle);
+                        if (timestamp)
+                            result.timestamp = timestamp;
+                        return result;
+                    }
+                }
+                const result = {
+                    verified: true,
+                    details,
+                };
+                if (identity)
+                    result.identity = identity;
+                const timestamp = extractTimestampFromBundle(bundle);
+                if (timestamp)
+                    result.timestamp = timestamp;
+                return result;
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                details.errors.push(errorMessage);
+                categorizeVerificationError(errorMessage, details);
+                return {
+                    verified: false,
+                    error: errorMessage,
+                    details,
+                };
+            }
+        },
+    };
+}
+/**
+ * Quick verification check - returns boolean only
+ *
+ * @param bundle - The Sigstore bundle to verify
+ * @param artifact - Optional artifact data
+ * @returns True if verification passes, false otherwise
+ */
+export async function isVerified(bundle, artifact) {
+    try {
+        const trustMaterial = await createTrustMaterial();
+        const verifier = new Verifier(trustMaterial);
+        const parsedBundle = bundleFromJSON(bundle);
+        const signedEntity = toSignedEntity(parsedBundle, artifact);
+        verifier.verify(signedEntity);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ============================================================================
+// Helper Functions
+// ============================================================================
+/**
+ * Check if an identity matches expected values
+ */
+function matchesExpectedIdentity(identity, expected) {
+    if (!identity) {
+        return false;
+    }
+    // Check issuer
+    if (expected.issuer && identity.issuer !== expected.issuer) {
+        return false;
+    }
+    // Check subject alternative name (could be email or URI)
+    if (expected.subjectAlternativeName) {
+        const san = expected.subjectAlternativeName;
+        if (identity.email !== san && identity.subject !== san) {
+            return false;
+        }
+    }
+    // Check GitHub workflow repository
+    if (expected.workflowRepository && identity.workflowRepository !== expected.workflowRepository) {
+        return false;
+    }
+    // Check GitHub workflow ref
+    if (expected.workflowRef && identity.workflowRef !== expected.workflowRef) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Extract timestamp from a Sigstore bundle
+ */
+function extractTimestampFromBundle(bundle) {
+    // Try to get timestamp from transparency log entry
+    const tlogEntry = bundle.verificationMaterial?.tlogEntries?.[0];
+    if (tlogEntry?.integratedTime) {
+        const timestamp = Number.parseInt(tlogEntry.integratedTime, 10);
+        if (!Number.isNaN(timestamp)) {
+            return new Date(timestamp * 1000);
+        }
+    }
+    return undefined;
+}
+/**
+ * Categorize a verification error to update details
+ */
+function categorizeVerificationError(errorMessage, details) {
+    const lowerError = errorMessage.toLowerCase();
+    if (lowerError.includes("signature")) {
+        details.signatureValid = false;
+    }
+    else if (lowerError.includes("certificate") && lowerError.includes("expired")) {
+        details.certificateWithinValidity = false;
+    }
+    else if (lowerError.includes("certificate")) {
+        details.certificateValid = false;
+    }
+    else if (lowerError.includes("rekor") || lowerError.includes("transparency")) {
+        details.rekorEntryValid = false;
+    }
+    else if (lowerError.includes("inclusion") || lowerError.includes("proof")) {
+        details.inclusionProofValid = false;
+    }
+}
+//# sourceMappingURL=verification.js.map

package/dist/sigstore/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/sigstore/verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAUtD,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,eAAe;IACtB,mFAAmF;IACnF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;GAGG;AACH,KAAK,UAAU,eAAe;IAC5B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrF,OAAO,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB;IAChC,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;IAC5C,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAsB,EACtB,QAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAwB;QACnC,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,KAAK;QAChC,eAAe,EAAE,KAAK;QACtB,mBAAmB,EAAE,KAAK;QAC1B,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,aAAa,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAElD,kBAAkB;QAClB,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC;QAE7C,kCAAkC;QAClC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAE5D,uBAAuB;QACvB,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE9B,sCAAsC;QACtC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;QAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAChC,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACzC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;QAC/B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAEnC,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAEnD,kDAAkD;QAClD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,OAAO,CAAC,eAAe,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAuB;oBACjC,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,mBAAmB;oBAC1B,OAAO;iBACR,CAAC;gBACF,IAAI,QAAQ;oBAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBACrD,IAAI,SAAS;oBAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,IAAI;YACd,OAAO;SACR,CAAC;QACF,IAAI,QAAQ;YAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAElC,6DAA6D;QAC7D,2BAA2B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEnD,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,YAAY;YACnB,OAAO;SACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAA+B,EAAE;IAC1E,uCAAuC;IACvC,MAAM,aAAa,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC;IAE7C,OAAO;QACL;;WAEG;QACH,MAAM,EAAE,KAAK,EAAE,MAAsB,EAAE,QAAiB,EAA+B,EAAE;YACvF,MAAM,OAAO,GAAwB;gBACnC,cAAc,EAAE,KAAK;gBACrB,gBAAgB,EAAE,KAAK;gBACvB,yBAAyB,EAAE,KAAK;gBAChC,eAAe,EAAE,KAAK;gBACtB,mBAAmB,EAAE,KAAK;gBAC1B,MAAM,EAAE,EAAE;aACX,CAAC;YAEF,IAAI,CAAC;gBACH,kCAAkC;gBAClC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,YAAY,GAAG,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;gBAE5D,uBAAuB;gBACvB,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAE9B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAChC,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;gBACzC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC/B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBAEnC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAEnD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,OAAO,CAAC,eAAe,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;oBACtF,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;wBAC7B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;wBAC/D,MAAM,MAAM,GAAuB;4BACjC,QAAQ,EAAE,KAAK;4BACf,KAAK,EAAE,mBAAmB;4BAC1B,OAAO;yBACR,CAAC;wBACF,IAAI,QAAQ;4BAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;wBACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;wBACrD,IAAI,SAAS;4BAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;wBAC5C,OAAO,MAAM,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAuB;oBACjC,QAAQ,EAAE,IAAI;oBACd,OAAO;iBACR,CAAC;gBACF,IAAI,QAAQ;oBAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBACrD,IAAI,SAAS;oBAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5E,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAClC,2BAA2B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBAEnD,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,YAAY;oBACnB,OAAO;iBACR,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAsB,EAAE,QAAiB;IACxE,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC5D,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;GAEG;AACH,SAAS,uBAAuB,CAC9B,QAAkC,EAClC,QAA0B;IAE1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe;IACf,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yDAAyD;IACzD,IAAI,QAAQ,CAAC,sBAAsB,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,sBAAsB,CAAC;QAC5C,IAAI,QAAQ,CAAC,KAAK,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,QAAQ,CAAC,kBAAkB,IAAI,QAAQ,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4BAA4B;IAC5B,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CAAC,MAAsB;IACxD,mDAAmD;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,YAAoB,EAAE,OAA4B;IACrF,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IAE9C,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;IACjC,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChF,OAAO,CAAC,yBAAyB,GAAG,KAAK,CAAC;IAC5C,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC;IACnC,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;IAClC,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Type definitions for security operations
+ */
+/**
+ * Supported hash algorithms
+ */
+export type HashAlgorithm = "sha256" | "sha512";
+/**
+ * Result of a hash operation
+ */
+export interface HashResult {
+    /** The hash algorithm used */
+    algorithm: HashAlgorithm;
+    /** The hash digest in hexadecimal format */
+    digest: string;
+}
+/**
+ * Options for file hashing operations
+ */
+export interface FileHashOptions {
+    /** Hash algorithm to use (default: sha256) */
+    algorithm?: HashAlgorithm;
+    /** Progress callback for large files */
+    onProgress?: (bytesRead: number, totalBytes: number) => void;
+}
+/**
+ * Supported key types
+ */
+export type KeyType = "rsa" | "ed25519" | "ecdsa";
+/**
+ * Key format for storage
+ */
+export type KeyFormat = "pem" | "der" | "jwk";
+/**
+ * A cryptographic key pair
+ */
+export interface KeyPair {
+    /** Public key */
+    publicKey: string;
+    /** Private key (encrypted or plain) */
+    privateKey: string;
+    /** Key type */
+    type: KeyType;
+    /** Key format */
+    format: KeyFormat;
+}
+/**
+ * Options for key generation
+ */
+export interface KeyGenerationOptions {
+    /** Key type to generate */
+    type: KeyType;
+    /** Output format */
+    format?: KeyFormat;
+    /** RSA key size in bits (only for RSA keys) */
+    modulusLength?: number;
+    /** Passphrase for encrypting private key */
+    passphrase?: string;
+}
+export type SecurityConfig = Record<string, unknown>;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,wCAAwC;IACxC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D;AAMD;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe;IACf,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB;IACjB,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,2BAA2B;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC"}

package/dist/types.js

@@ -0,0 +1,5 @@
+/**
+ * Type definitions for security operations
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enactprotocol/trust",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Sigstore integration, attestations, and verification for Enact",
   "type": "module",
   "main": "./dist/index.js",