@mannyc1/ts-release 0.0.6 → 0.2.2

package/dist/platform/credentials.js

@@ -0,0 +1,772 @@
+import { Buffer } from "node:buffer";
+import { chmod, copyFile, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, isAbsolute, join, resolve } from "node:path";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as Semver from "semver";
+import { EnvironmentName } from "../model/authority.js";
+import { redactOutput } from "../drivers/redact.js";
+import { CredentialAudienceMismatch, CredentialProvider, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, makeCredentialProvider, validateGrantForOperation } from "../publication/authority.js";
+import { AuthorizedMutationHttp, HttpAuthorizer } from "../publication/http.js";
+import { CertifiedPublisherSpawn, NpmUserConfigResource, PublisherExited, PublisherOutcomeUnknown, RejectedBeforeStart, makeNpmUserConfigHandle, npmPublishArgv } from "../publication/publisher.js";
+import { canonicalizeRegistryUrl } from "../release/graph.js";
+export { AuthorizedMutationHttp, CertifiedPublisherSpawn, HttpAuthorizer, NpmUserConfigResource, PublisherExited, PublisherOutcomeUnknown, RejectedBeforeStart };
+export class CredentialPlatformError extends Schema.TaggedErrorClass()("CredentialPlatformError", {
+    phase: Schema.Literals(["observe", "mutate", "resource", "spawn"]),
+    commitment: Schema.Literals(["before-dispatch", "unknown"]),
+    reason: Schema.NonEmptyString
+}) {
+}
+// These are deliberately the only literal spellings in production code. The
+// import-rules AST gate keeps OIDC request material in this host module.
+const oidcRequestUrlName = EnvironmentName.make("ACTIONS_ID_TOKEN_REQUEST_URL");
+const oidcRequestTokenName = EnvironmentName.make("ACTIONS_ID_TOKEN_REQUEST_TOKEN");
+const oidcNames = [oidcRequestUrlName, oidcRequestTokenName];
+const githubActionsName = "GITHUB_ACTIONS";
+const githubRepositoryName = "GITHUB_REPOSITORY";
+const githubWorkflowRefName = "GITHUB_WORKFLOW_REF";
+const githubServerUrlName = "GITHUB_SERVER_URL";
+const githubEventName = "GITHUB_EVENT_NAME";
+const githubRepositoryIdName = "GITHUB_REPOSITORY_ID";
+const githubRepositoryOwnerIdName = "GITHUB_REPOSITORY_OWNER_ID";
+const githubRefName = "GITHUB_REF";
+const githubShaName = "GITHUB_SHA";
+const runnerEnvironmentName = "RUNNER_ENVIRONMENT";
+const githubRunIdName = "GITHUB_RUN_ID";
+const githubRunAttemptName = "GITHUB_RUN_ATTEMPT";
+const portableEnvironmentName = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+const certifiedWorkflow = /^\.github\/workflows\/[A-Za-z0-9_.-]+\.ya?ml$/u;
+const certifiedRepository = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/u;
+const certifiedWorkflowRef = /^(?:refs\/(?:heads|tags)\/[A-Za-z0-9][A-Za-z0-9._/-]*|[a-f0-9]{40}(?:[a-f0-9]{24})?)$/u;
+const certifiedSourceCommit = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u;
+const certifiedEvent = /^[a-z][a-z0-9_]*$/u;
+const certifiedDecimalId = /^[1-9][0-9]*$/u;
+const certifiedSourceRef = /^refs\/(?:heads|tags)\/[A-Za-z0-9][A-Za-z0-9._/-]*$/u;
+const rememberObservationGrant = (observationGrants, grant) => {
+    observationGrants.set(grant, grant._tag === "AnonymousAccess"
+        ? {
+            _tag: grant._tag,
+            subject: grant.subject,
+            audience: grant.audience,
+            purposes: new Set(grant.purposes)
+        }
+        : {
+            _tag: grant._tag,
+            subject: grant.subject,
+            audience: grant.audience,
+            purposes: new Set(grant.purposes),
+            ref: grant.ref
+        });
+};
+const vaultKey = (subject, name) => `${subject}\u0000${name}`;
+const platformError = (phase, commitment, reason) => new CredentialPlatformError({ phase, commitment, reason });
+const unavailable = (request, reason) => new CredentialUnavailable({
+    subject: request.subject,
+    provider: request.provider,
+    purpose: request.purpose,
+    reason
+});
+const unsupported = (request, reason) => new CredentialStrategyUnsupported({
+    subject: request.subject,
+    provider: request.provider,
+    strategy: request.strategy.kind,
+    reason
+});
+const readSecret = (request, name) => Config.redacted(name).pipe(Effect.mapError(() => unavailable(request, `Credential reference ${name} is unavailable.`)));
+const trustedStrategyIssue = (request) => {
+    const strategy = request.strategy;
+    if (strategy.kind !== "trusted-publishing")
+        return "The request does not carry trusted-publishing intent.";
+    if (request.provider !== "npm" || request.audience !== "https://registry.npmjs.org/" ||
+        request.purpose !== "publish") {
+        return "Trusted publishing is certified only for npm publish at the canonical npm registry.";
+    }
+    if (strategy.identityProvider !== "github-actions" || strategy.runnerClass !== "github-hosted" ||
+        !certifiedRepository.test(strategy.repository) || !certifiedWorkflow.test(strategy.workflow) ||
+        !certifiedWorkflowRef.test(strategy.workflowRef) ||
+        !certifiedSourceCommit.test(strategy.sourceCommit) ||
+        strategy.provenanceEnvironmentContract !== "github-actions-npm-provenance-v1" ||
+        strategy.allowedAction !== "npm-publish-direct" || strategy.publisherSink !== "certified-npm-cli") {
+        return "Trusted publishing requires one exact GitHub-hosted workflow/ref, source commit, provenance environment contract, and certified direct npm sink.";
+    }
+    return undefined;
+};
+/** Validate non-secret GitHub host facts before either OIDC request value is read. */
+const verifyTrustedHostIdentity = Effect.fn("EnvironmentCredentialProvider.verifyTrustedHostIdentity")(function* (request) {
+    const issue = trustedStrategyIssue(request);
+    if (issue !== undefined)
+        return yield* unsupported(request, issue);
+    if (request.strategy.kind !== "trusted-publishing")
+        return yield* unsupported(request, issue ?? "Invalid strategy.");
+    const expected = [
+        [githubActionsName, "true"],
+        [githubRepositoryName, request.strategy.repository],
+        [githubWorkflowRefName,
+            `${request.strategy.repository}/${request.strategy.workflow}@${request.strategy.workflowRef}`],
+        [githubServerUrlName, "https://github.com"],
+        [githubShaName, request.strategy.sourceCommit],
+        [runnerEnvironmentName, "github-hosted"]
+    ];
+    const values = {};
+    for (const [name, value] of expected) {
+        const observed = yield* Config.string(name).pipe(Effect.mapError(() => unsupported(request, `Trusted publishing host identity ${name} is unavailable.`)));
+        if (observed !== value) {
+            return yield* unsupported(request, `Trusted publishing host identity ${name} does not match prepared intent.`);
+        }
+        values[name] = observed;
+    }
+    const shaped = [
+        [githubEventName, certifiedEvent, "a canonical GitHub event name"],
+        [githubRepositoryIdName, certifiedDecimalId, "a canonical positive decimal repository ID"],
+        [githubRepositoryOwnerIdName, certifiedDecimalId, "a canonical positive decimal repository-owner ID"],
+        [githubRefName, certifiedSourceRef, "a canonical heads/tags source ref"],
+        [githubRunIdName, certifiedDecimalId, "a canonical positive decimal run ID"],
+        [githubRunAttemptName, certifiedDecimalId, "a canonical positive decimal run attempt"]
+    ];
+    for (const [name, pattern, description] of shaped) {
+        const observed = yield* Config.string(name).pipe(Effect.mapError(() => unsupported(request, `Trusted publishing provenance fact ${name} is unavailable.`)));
+        if (!pattern.test(observed)) {
+            return yield* unsupported(request, `Trusted publishing provenance fact ${name} is not ${description}.`);
+        }
+        values[name] = observed;
+    }
+    return Object.freeze({
+        GITHUB_ACTIONS: values[githubActionsName],
+        GITHUB_REPOSITORY: values[githubRepositoryName],
+        GITHUB_WORKFLOW_REF: values[githubWorkflowRefName],
+        GITHUB_SERVER_URL: values[githubServerUrlName],
+        GITHUB_EVENT_NAME: values[githubEventName],
+        GITHUB_REPOSITORY_ID: values[githubRepositoryIdName],
+        GITHUB_REPOSITORY_OWNER_ID: values[githubRepositoryOwnerIdName],
+        GITHUB_REF: values[githubRefName],
+        GITHUB_SHA: values[githubShaName],
+        RUNNER_ENVIRONMENT: values[runnerEnvironmentName],
+        GITHUB_RUN_ID: values[githubRunIdName],
+        GITHUB_RUN_ATTEMPT: values[githubRunAttemptName]
+    });
+});
+/**
+ * A raw environment token has no host-verifiable downscope metadata. Treat it
+ * conservatively as bundled provider authority instead of relabeling the same
+ * bearer as a purpose-specific secret merely because one method requested it.
+ */
+const environmentTokenPurposes = (purpose) => purpose === "correct"
+    ? ["observe", "publish", "correct"]
+    : ["observe", "publish"];
+const makeEnvironmentAcquirer = (vault, onTrustedWorkload) => ({
+    acquire: Effect.fn("EnvironmentCredentialProvider.acquire")(function* (request) {
+        switch (request.strategy.kind) {
+            case "anonymous":
+                return { _tag: "AnonymousAccess", purposes: ["observe"] };
+            case "token": {
+                if (request.provider === "npm" && request.purpose === "observe") {
+                    return yield* unsupported(request, "Authenticated npm observation is unsupported without a distinct typed read credential.");
+                }
+                const name = request.strategy.credential.toString();
+                if (!portableEnvironmentName.test(name)) {
+                    return yield* unsupported(request, "Token credential references must be portable environment names.");
+                }
+                const value = yield* readSecret(request, name);
+                vault.set(vaultKey(request.subject, name), value);
+                return {
+                    _tag: "ScopedSecret",
+                    purposes: environmentTokenPurposes(request.purpose),
+                    ref: request.strategy.credential
+                };
+            }
+            case "trusted-publishing": {
+                if (onTrustedWorkload === undefined) {
+                    return yield* unsupported(request, "Trusted workload acquisition requires a private host-material binding.");
+                }
+                const snapshot = yield* verifyTrustedHostIdentity(request);
+                const oidcValues = new Map();
+                for (const name of oidcNames) {
+                    const value = yield* readSecret(request, name);
+                    oidcValues.set(name, value);
+                }
+                onTrustedWorkload(Object.freeze({ snapshot, oidc: oidcValues }));
+                return {
+                    _tag: "WorkloadIdentity",
+                    purposes: [request.purpose],
+                    names: oidcNames
+                };
+            }
+        }
+    })
+});
+const makeProvider = (vault, trustedWorkloads, observationGrants) => {
+    const provider = makeCredentialProvider(makeEnvironmentAcquirer(vault));
+    return {
+        acquireForObservation: Effect.fn("EnvironmentCredentialProvider.acquireForObservation")(function* (request) {
+            const grant = yield* provider.acquireForObservation(request);
+            if (grant._tag !== "WorkloadIdentity") {
+                rememberObservationGrant(observationGrants, grant);
+            }
+            return grant;
+        }),
+        acquireForMutation: Effect.fn("EnvironmentCredentialProvider.acquireForMutation")(function* (request, decision) {
+            let grant;
+            if (request.strategy.kind === "trusted-publishing") {
+                let material;
+                const trustedProvider = makeCredentialProvider(makeEnvironmentAcquirer(vault, (acquired) => { material = acquired; }));
+                grant = yield* trustedProvider.acquireForMutation(request, decision);
+                if (grant._tag !== "WorkloadIdentity" || material === undefined) {
+                    return yield* unavailable(request, "Trusted publishing host evidence was not bound to its workload grant.");
+                }
+                trustedWorkloads.set(grant, material);
+            }
+            else {
+                grant = yield* provider.acquireForMutation(request, decision);
+            }
+            // npm publication tokens never become observation capabilities. GitHub
+            // retains its truthfully bundled installation-token read/write model.
+            if (grant._tag === "ScopedSecret" && request.provider !== "npm") {
+                rememberObservationGrant(observationGrants, grant);
+            }
+            return grant;
+        })
+    };
+};
+/** Environment-backed provider projection for hosts that need no sinks. */
+export const makeEnvironmentCredentialProvider = () => makeProvider(new Map(), new WeakMap(), new WeakMap());
+const hasAuthorizationHeader = (headers) => headers !== undefined && Object.keys(headers).some((name) => name.toLowerCase() === "authorization");
+const audienceAllows = (audience, requested) => {
+    try {
+        const expected = new URL(audience);
+        const observed = new URL(requested);
+        if (expected.protocol !== "https:" || observed.protocol !== "https:")
+            return false;
+        if (expected.username !== "" || expected.password !== "" || expected.search !== "" || expected.hash !== "")
+            return false;
+        if (expected.origin !== observed.origin)
+            return false;
+        const base = expected.pathname.endsWith("/") ? expected.pathname : `${expected.pathname}/`;
+        return observed.pathname === expected.pathname || observed.pathname.startsWith(base);
+    }
+    catch {
+        return false;
+    }
+};
+const githubUploadAudienceAllows = (audience, requested) => {
+    try {
+        const expected = new URL(audience);
+        const observed = new URL(requested);
+        if (expected.protocol !== "https:" || expected.hostname !== "api.github.com" ||
+            expected.port !== "" || expected.username !== "" || expected.password !== "" ||
+            expected.search !== "" || expected.hash !== "")
+            return false;
+        if (observed.protocol !== "https:" || observed.hostname !== "uploads.github.com" ||
+            observed.port !== "" || observed.username !== "" || observed.password !== "" ||
+            observed.hash !== "")
+            return false;
+        const repository = /^\/repos\/[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/u.exec(expected.pathname)?.[0];
+        if (repository === undefined ||
+            !new RegExp(`^${repository.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}\/releases\/[1-9][0-9]*\/assets$`, "u")
+                .test(observed.pathname))
+            return false;
+        const keys = [...observed.searchParams.keys()];
+        return /^\?name=[^&]+(?:&label=[^&]*)?$/u.test(observed.search) &&
+            new Set(keys).size === keys.length && observed.searchParams.get("name").length > 0;
+    }
+    catch {
+        return false;
+    }
+};
+const checkAudience = (subject, audience, requested, allowGithubUpload = false) => audienceAllows(audience, requested) ||
+    (allowGithubUpload && githubUploadAudienceAllows(audience, requested))
+    ? Effect.void
+    : Effect.fail(new CredentialAudienceMismatch({
+        subject,
+        expected: audience,
+        observed: requested
+    }));
+const lookupToken = (vault, subject, ref) => {
+    const value = vault.get(vaultKey(subject, ref));
+    return value === undefined
+        ? Effect.fail(new CredentialUnavailable({
+            subject,
+            provider: "unknown",
+            purpose: "unknown",
+            reason: "The credential grant has no host-owned secret in this platform boundary."
+        }))
+        : Effect.succeed(value);
+};
+const validateObservationGrant = Effect.fn("HttpAuthorizer.validateGrant")(function* (input, grant, observationGrants) {
+    const issued = observationGrants.get(grant);
+    if (issued === undefined) {
+        return yield* new CredentialUnavailable({
+            subject: input.subject,
+            provider: "unknown",
+            purpose: "observe",
+            reason: "The supplied observation grant was not issued by this platform boundary."
+        });
+    }
+    if (issued.subject !== input.subject) {
+        return yield* new CredentialSubjectMismatch({
+            expected: input.subject,
+            observed: issued.subject
+        });
+    }
+    if (!issued.purposes.has("observe")) {
+        return yield* new CredentialPurposeMismatch({
+            subject: input.subject,
+            required: "observe",
+            granted: [...issued.purposes]
+        });
+    }
+    yield* checkAudience(input.subject, issued.audience, input.url);
+    return issued;
+});
+const sendAnonymous = (http, request) => {
+    if (hasAuthorizationHeader(request.headers)) {
+        return Effect.fail(platformError("observe", "before-dispatch", "Callers may not supply an Authorization header."));
+    }
+    return http.request({
+        method: request.method,
+        url: request.url,
+        ...(request.headers === undefined ? {} : { headers: request.headers }),
+        ...(request.body === undefined ? {} : { body: request.body })
+    }).pipe(Effect.mapError(() => platformError("observe", "unknown", "Observation HTTP transport failed after dispatch.")));
+};
+const sendAuthorized = (http, request, token, phase, credentialScheme = "bearer") => {
+    if (hasAuthorizationHeader(request.headers)) {
+        return Effect.fail(platformError(phase, "before-dispatch", "Callers may not supply an Authorization header."));
+    }
+    const headers = {
+        ...(request.headers ?? {}),
+        authorization: credentialScheme === "pypi-token-basic"
+            ? `Basic ${Buffer.from(`__token__:${Redacted.value(token)}`, "utf8").toString("base64")}`
+            : `Bearer ${Redacted.value(token)}`
+    };
+    return http.request({
+        method: request.method,
+        url: request.url,
+        headers,
+        ...(request.body === undefined ? {} : { body: request.body })
+    }).pipe(Effect.mapError(() => platformError(phase, "unknown", "Authorized HTTP transport failed after dispatch.")));
+};
+const makeHttpAuthorizer = (http, vault, observationGrants) => ({
+    execute: Effect.fn("HttpAuthorizer.execute")(function* (input, grant) {
+        const issued = yield* validateObservationGrant(input, grant, observationGrants);
+        if (issued._tag === "AnonymousAccess") {
+            return yield* sendAnonymous(http, input);
+        }
+        const token = yield* lookupToken(vault, issued.subject, issued.ref);
+        return yield* sendAuthorized(http, input, token, "observe");
+    })
+});
+const makeAuthorizedMutationHttp = (http, vault) => ({
+    execute: Effect.fn("AuthorizedMutationHttp.execute")(function* (operation, request, grant) {
+        yield* validateGrantForOperation(operation, grant);
+        if ((operation.provider === "pypi") !== (request.credentialScheme === "pypi-token-basic")) {
+            return yield* platformError("mutate", "before-dispatch", "The PyPI Basic credential projection is accepted only for typed PyPI mutations and is mandatory for them.");
+        }
+        yield* checkAudience(operation.subject, operation.audience, request.url, operation.provider === "github");
+        const token = yield* lookupToken(vault, grant.subject, grant.ref);
+        return yield* sendAuthorized(http, request, token, "mutate", request.credentialScheme);
+    })
+});
+const npmUserConfigs = new WeakMap();
+const npmAuthLine = (registryUrl, token) => {
+    const registry = new URL(registryUrl);
+    const pathname = registry.pathname.endsWith("/") ? registry.pathname : `${registry.pathname}/`;
+    return `//${registry.host}${pathname}:_authToken=${Redacted.value(token)}`;
+};
+const makeNpmUserConfigResource = (vault, temporaryRoot) => ({
+    acquire: Effect.fn("NpmUserConfigResource.acquire")(function* (input, grant) {
+        yield* validateGrantForOperation(input.operation, grant);
+        if (input.operation.provider !== "npm") {
+            return yield* platformError("resource", "before-dispatch", "npm user config accepts only the npm provider.");
+        }
+        yield* checkAudience(input.operation.subject, input.operation.audience, input.registryUrl);
+        const token = yield* lookupToken(vault, grant.subject, grant.ref);
+        const root = temporaryRoot ?? tmpdir();
+        const handle = makeNpmUserConfigHandle();
+        const acquired = Effect.tryPromise({
+            try: async () => {
+                await mkdir(root, { recursive: true, mode: 0o700 });
+                const directory = await mkdtemp(join(root, "ts-release-npm-"));
+                try {
+                    const path = join(directory, "userconfig");
+                    const contents = `${npmAuthLine(input.registryUrl, token)}\nignore-scripts=true\n`;
+                    await writeFile(path, contents, { mode: 0o600, flag: "wx" });
+                    npmUserConfigs.set(handle, { directory, path, subject: input.operation.subject, grant, token });
+                    return handle;
+                }
+                catch (cause) {
+                    await rm(directory, { recursive: true, force: true });
+                    throw cause;
+                }
+            },
+            catch: () => platformError("resource", "before-dispatch", "Unable to create the scoped npm user config.")
+        });
+        return yield* Effect.acquireRelease(acquired, (resource) => {
+            const metadata = npmUserConfigs.get(resource);
+            npmUserConfigs.delete(resource);
+            return metadata === undefined
+                ? Effect.void
+                : Effect.tryPromise({
+                    try: () => rm(metadata.directory, { recursive: true, force: true }),
+                    catch: () => undefined
+                }).pipe(Effect.catch(() => Effect.void));
+        });
+    })
+});
+const collect = (stream) => Stream.mkString(Stream.decodeText(stream));
+const minimumTrustedNode = [22, 14, 0];
+const minimumTrustedNpm = [11, 5, 1];
+const parseVersion = (value) => {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?\s*$/u.exec(value);
+    if (match === null)
+        return undefined;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+};
+const versionAtLeast = (value, minimum) => value[0] > minimum[0] ||
+    (value[0] === minimum[0] && (value[1] > minimum[1] ||
+        (value[1] === minimum[1] && value[2] >= minimum[2])));
+const optionalPath = Config.option(Config.string("PATH")).pipe(Effect.map(Option.getOrUndefined), Effect.orElseSucceed(() => undefined));
+const closedBaseEnvironment = (path) => path === undefined ? {} : { PATH: path };
+const workloadEnvironment = Effect.fn("CertifiedPublisherSpawn.workloadEnvironment")(function* (trustedWorkloads, grant) {
+    if (grant.names.size !== oidcNames.length || oidcNames.some((name) => !grant.names.has(name))) {
+        return yield* new CredentialStrategyUnsupported({
+            subject: grant.subject,
+            provider: grant.provider,
+            strategy: "trusted-publishing",
+            reason: "Workload identity lacks the exact certified GitHub Actions OIDC names."
+        });
+    }
+    const material = trustedWorkloads.get(grant);
+    if (material === undefined) {
+        return yield* new CredentialUnavailable({
+            subject: grant.subject,
+            provider: grant.provider,
+            purpose: "publish",
+            reason: "Certified GitHub Actions provenance facts are unavailable in this platform boundary."
+        });
+    }
+    const path = yield* optionalPath;
+    const env = closedBaseEnvironment(path);
+    for (const name of oidcNames) {
+        const value = material.oidc.get(name);
+        if (value === undefined) {
+            return yield* new CredentialUnavailable({
+                subject: grant.subject,
+                provider: grant.provider,
+                purpose: "publish",
+                reason: "Certified workload identity material is unavailable in this platform boundary."
+            });
+        }
+        env[name] = Redacted.value(value);
+    }
+    // npm's OIDC exchange consumes the two host-held request values. Its
+    // libnpmpublish provenance builder separately consumes this exact validated
+    // non-secret GitHub run snapshot. No ambient environment is inherited.
+    Object.assign(env, material.snapshot);
+    env.NPM_CONFIG_IGNORE_SCRIPTS = "true";
+    return env;
+});
+const validateTrustedNpmOperation = Effect.fn("CertifiedPublisherSpawn.validateTrustedNpmOperation")(function* (operation, grant) {
+    if (operation.provider !== "npm" || operation.purpose !== "publish" ||
+        operation.audience !== "https://registry.npmjs.org/" ||
+        grant.strategy.identityProvider !== "github-actions" ||
+        grant.strategy.runnerClass !== "github-hosted" ||
+        grant.strategy.allowedAction !== "npm-publish-direct" ||
+        grant.strategy.publisherSink !== "certified-npm-cli") {
+        return yield* new CredentialStrategyUnsupported({
+            subject: operation.subject,
+            provider: operation.provider,
+            strategy: "trusted-publishing",
+            reason: "The workload grant is not bound to the certified direct npm publisher sink."
+        });
+    }
+});
+const publisherSpecKeys = Object.freeze({
+    NpmPublisherSpec: [
+        "_tag", "access", "cwd", "distTag", "operation", "packageName", "provenance",
+        "registryUrl", "tarballPath", "userConfig", "version"
+    ],
+    WorkloadPublisherSpec: [
+        "_tag", "access", "cwd", "distTag", "operation", "packageName", "provenance",
+        "registryUrl", "tarballPath", "version"
+    ]
+});
+const sameKeys = (value, expected) => {
+    const observed = Object.keys(value).sort();
+    return observed.length === expected.length && observed.every((key, index) => key === expected[index]);
+};
+const certifiedNpmSpecIssue = (spec) => {
+    const tagDescriptor = Object.getOwnPropertyDescriptor(spec, "_tag");
+    const tag = tagDescriptor !== undefined && "value" in tagDescriptor
+        ? tagDescriptor.value
+        : undefined;
+    if (tag !== "NpmPublisherSpec" && tag !== "WorkloadPublisherSpec") {
+        return "The certified npm publisher accepts only its two closed typed spec variants.";
+    }
+    const expectedKeys = publisherSpecKeys[tag];
+    const descriptors = Object.getOwnPropertyDescriptors(spec);
+    if (!sameKeys(spec, expectedKeys) || expectedKeys.some((key) => {
+        const descriptor = descriptors[key];
+        return descriptor === undefined || !("value" in descriptor);
+    })) {
+        return "The certified npm publisher accepts only its exact typed fields; generic argv and override fields are forbidden.";
+    }
+    const operation = spec.operation;
+    if (operation._tag !== "PublishOperation" || operation.provider !== "npm" || operation.purpose !== "publish") {
+        return "The certified npm publisher accepts only an npm publish operation.";
+    }
+    if (typeof spec.packageName !== "string" || spec.packageName.length === 0 ||
+        typeof spec.version !== "string" || Semver.valid(spec.version) !== spec.version) {
+        return "The certified npm publisher requires one nonempty package name and canonical semantic version.";
+    }
+    if (operation.subject !== `npm:${spec.packageName}@${spec.version}`) {
+        return "The certified npm publisher package and version do not match the authorized operation subject.";
+    }
+    try {
+        if (canonicalizeRegistryUrl(spec.registryUrl) !== spec.registryUrl ||
+            operation.audience.toString() !== spec.registryUrl.toString()) {
+            return "The certified npm publisher registry does not match the authorized canonical audience.";
+        }
+    }
+    catch {
+        return "The certified npm publisher requires a canonical registry and npm distribution tag.";
+    }
+    if (Semver.validRange(spec.distTag) !== null || spec.distTag.trim() !== spec.distTag ||
+        encodeURIComponent(spec.distTag) !== spec.distTag) {
+        return "The certified npm publisher requires a canonical registry and npm distribution tag.";
+    }
+    if ((spec.access !== "public" && spec.access !== "restricted") ||
+        (spec.provenance !== "required" && spec.provenance !== "automatic" && spec.provenance !== "disabled") ||
+        (spec._tag === "NpmPublisherSpec" && spec.provenance === "automatic") ||
+        (spec.access === "restricted" && !spec.packageName.startsWith("@")) ||
+        (Semver.prerelease(spec.version) !== null && spec.distTag === "latest")) {
+        return "The certified npm publisher access, provenance, or dist-tag policy is not an allowed canonical value.";
+    }
+    try {
+        const fileName = basename(spec.tarballPath);
+        if (!isAbsolute(spec.cwd) || resolve(spec.cwd) !== spec.cwd ||
+            !/^[a-f0-9]{64}$/u.test(fileName) ||
+            resolve(spec.cwd, "blobs", fileName) !== spec.tarballPath) {
+            return "The certified npm publisher tarball must be the canonical prepared-store blob path.";
+        }
+    }
+    catch {
+        return "The certified npm publisher tarball must be the canonical prepared-store blob path.";
+    }
+    return undefined;
+};
+const validateCertifiedNpmSpec = Effect.fn("CertifiedPublisherSpawn.validateCertifiedNpmSpec")(function* (spec) {
+    const issue = certifiedNpmSpecIssue(spec);
+    if (issue !== undefined) {
+        return yield* new CredentialStrategyUnsupported({
+            subject: spec.operation.subject,
+            provider: spec.operation.provider,
+            strategy: spec._tag === "WorkloadPublisherSpec" ? "trusted-publishing" : "token",
+            reason: issue
+        });
+    }
+});
+/** Snapshot caller data once so accessors or concurrent mutation cannot change the admitted command after validation. */
+const snapshotCertifiedNpmSpec = (spec) => {
+    const operation = Object.freeze({
+        ...spec.operation,
+        decision: Object.freeze({ ...spec.operation.decision })
+    });
+    return Object.freeze({ ...spec, operation });
+};
+const publisherEnvironment = Effect.fn("CertifiedPublisherSpawn.environment")(function* (vault, trustedWorkloads, spec, grant) {
+    yield* validateCertifiedNpmSpec(spec);
+    if (spec._tag === "NpmPublisherSpec") {
+        if (grant._tag !== "ScopedSecret") {
+            return yield* new CredentialStrategyUnsupported({
+                subject: spec.operation.subject,
+                provider: spec.operation.provider,
+                strategy: "trusted-publishing",
+                reason: "A scoped npm user config requires a scoped-secret grant."
+            });
+        }
+        const metadata = npmUserConfigs.get(spec.userConfig);
+        if (metadata === undefined || metadata.subject !== spec.operation.subject || metadata.grant !== grant) {
+            return yield* new CredentialUnavailable({
+                subject: spec.operation.subject,
+                provider: spec.operation.provider,
+                purpose: spec.operation.purpose,
+                reason: "The npm user config is not active for this exact operation and grant."
+            });
+        }
+        const path = yield* optionalPath;
+        return {
+            ...closedBaseEnvironment(path),
+            NPM_CONFIG_USERCONFIG: metadata.path,
+            NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        };
+    }
+    if (grant._tag !== "WorkloadIdentity") {
+        return yield* new CredentialStrategyUnsupported({
+            subject: spec.operation.subject,
+            provider: spec.operation.provider,
+            strategy: "token",
+            reason: "The workload publisher requires a workload-identity grant."
+        });
+    }
+    yield* validateTrustedNpmOperation(spec.operation, grant);
+    return yield* workloadEnvironment(trustedWorkloads, grant);
+});
+const redactPublisherOutput = (value, env, spec) => {
+    const metadata = spec._tag === "NpmPublisherSpec" ? npmUserConfigs.get(spec.userConfig) : undefined;
+    const known = metadata === undefined
+        ? env
+        : { ...env, PUBLISH_CREDENTIAL: Redacted.value(metadata.token) };
+    return redactOutput(value, known);
+};
+/**
+ * npm classifies a suffixless local path as a package directory. Prepared
+ * artifacts deliberately use digest-only blob names, so expose the already
+ * admitted bytes through a private `.tgz` transport name only while npm runs.
+ */
+const makeNpmPublishTransport = (sourcePath, temporaryRoot) => {
+    const root = temporaryRoot ?? tmpdir();
+    const acquired = Effect.tryPromise({
+        try: async () => {
+            await mkdir(root, { recursive: true, mode: 0o700 });
+            const directory = await mkdtemp(join(root, "ts-release-npm-tarball-"));
+            try {
+                const path = join(directory, "package.tgz");
+                await copyFile(sourcePath, path);
+                await chmod(path, 0o600);
+                return { directory, path };
+            }
+            catch (cause) {
+                await rm(directory, { recursive: true, force: true });
+                throw cause;
+            }
+        },
+        catch: () => platformError("resource", "before-dispatch", "Unable to materialize the verified npm tarball transport path.")
+    });
+    return Effect.acquireRelease(acquired, ({ directory }) => Effect.tryPromise({
+        try: () => rm(directory, { recursive: true, force: true }),
+        catch: () => undefined
+    }).pipe(Effect.catch(() => Effect.void)));
+};
+const makeCertifiedPublisherSpawn = (spawner, vault, trustedWorkloads, temporaryRoot) => {
+    const runClosed = Effect.fn("CertifiedPublisherSpawn.runClosed")(function* (argv) {
+        const path = yield* optionalPath;
+        const command = ChildProcess.make(argv[0], [...argv.slice(1)], {
+            env: closedBaseEnvironment(path),
+            extendEnv: false,
+            stdin: "ignore",
+            stdout: "pipe",
+            stderr: "pipe"
+        });
+        return yield* Effect.scoped(Effect.gen(function* () {
+            const spawned = yield* Effect.exit(spawner.spawn(command));
+            if (Exit.isFailure(spawned)) {
+                return yield* platformError("spawn", "before-dispatch", "Trusted npm preflight could not start its version probe.");
+            }
+            const output = yield* Effect.exit(Effect.all({
+                stdout: collect(spawned.value.stdout),
+                stderr: collect(spawned.value.stderr),
+                exitCode: spawned.value.exitCode
+            }, { concurrency: "unbounded" }));
+            if (Exit.isFailure(output)) {
+                return yield* platformError("spawn", "before-dispatch", "Trusted npm preflight could not observe its version probe.");
+            }
+            if (Number(output.value.exitCode) !== 0) {
+                return yield* platformError("spawn", "before-dispatch", "Trusted npm preflight version probe was rejected.");
+            }
+            return output.value.stdout;
+        }));
+    });
+    return {
+        preflightTrustedNpm: Effect.fn("CertifiedPublisherSpawn.preflightTrustedNpm")(function* (operation, grant) {
+            yield* validateGrantForOperation(operation, grant);
+            if (grant._tag !== "WorkloadIdentity") {
+                return yield* new CredentialStrategyUnsupported({
+                    subject: operation.subject,
+                    provider: operation.provider,
+                    strategy: "token",
+                    reason: "Trusted npm preflight requires a workload-identity grant."
+                });
+            }
+            yield* validateTrustedNpmOperation(operation, grant);
+            // Validate the exact host-held OIDC names before any provider authority is dispatched.
+            yield* workloadEnvironment(trustedWorkloads, grant);
+            const node = parseVersion(yield* runClosed(["node", "--version"]));
+            const npm = parseVersion(yield* runClosed(["npm", "--version"]));
+            if (node === undefined || !versionAtLeast(node, minimumTrustedNode) ||
+                npm === undefined || !versionAtLeast(npm, minimumTrustedNpm)) {
+                return yield* platformError("spawn", "before-dispatch", "Trusted npm publishing requires Node >=22.14.0 and npm >=11.5.1.");
+            }
+        }),
+        spawn: Effect.fn("CertifiedPublisherSpawn.spawn")(function* (inputSpec, grant) {
+            yield* validateGrantForOperation(inputSpec.operation, grant);
+            yield* validateCertifiedNpmSpec(inputSpec);
+            const spec = snapshotCertifiedNpmSpec(inputSpec);
+            const env = yield* publisherEnvironment(vault, trustedWorkloads, spec, grant);
+            return yield* Effect.scoped(Effect.gen(function* () {
+                const transport = yield* makeNpmPublishTransport(spec.tarballPath, temporaryRoot);
+                const argv = npmPublishArgv({ ...spec, tarballPath: transport.path });
+                const command = ChildProcess.make(argv[0], [...argv.slice(1)], {
+                    cwd: spec.cwd,
+                    env,
+                    extendEnv: false,
+                    stdin: "ignore",
+                    stdout: "pipe",
+                    stderr: "pipe"
+                });
+                const spawned = yield* Effect.exit(spawner.spawn(command));
+                if (Exit.isFailure(spawned)) {
+                    return {
+                        _tag: "RejectedBeforeStart",
+                        commitment: "before-dispatch",
+                        reason: "The certified publisher process did not return a started handle."
+                    };
+                }
+                const output = yield* Effect.exit(Effect.all({
+                    stdout: collect(spawned.value.stdout),
+                    stderr: collect(spawned.value.stderr),
+                    exitCode: spawned.value.exitCode
+                }, { concurrency: "unbounded" }));
+                if (Exit.isFailure(output)) {
+                    return {
+                        _tag: "PublisherOutcomeUnknown",
+                        commitment: "unknown",
+                        reason: "The certified publisher started, but its final outcome could not be observed."
+                    };
+                }
+                return {
+                    _tag: "PublisherExited",
+                    commitment: "started",
+                    exitCode: Number(output.value.exitCode),
+                    stdout: redactPublisherOutput(output.value.stdout, env, spec),
+                    stderr: redactPublisherOutput(output.value.stderr, env, spec)
+                };
+            }));
+        })
+    };
+};
+/** All host sinks share one private vault; no secret is returned from it. */
+export const makeEnvironmentCredentialPlatform = (http, spawner, options = {}) => {
+    const vault = new Map();
+    const trustedWorkloads = new WeakMap();
+    const observationGrants = new WeakMap();
+    return {
+        credentialProvider: makeProvider(vault, trustedWorkloads, observationGrants),
+        httpAuthorizer: makeHttpAuthorizer(http, vault, observationGrants),
+        authorizedMutationHttp: makeAuthorizedMutationHttp(http, vault),
+        npmUserConfigResource: makeNpmUserConfigResource(vault, options.temporaryRoot),
+        certifiedPublisherSpawn: makeCertifiedPublisherSpawn(spawner, vault, trustedWorkloads, options.temporaryRoot)
+    };
+};
+export const makeEnvironmentCredentialPlatformLayer = (http, spawner, options = {}) => {
+    const platform = makeEnvironmentCredentialPlatform(http, spawner, options);
+    return Layer.mergeAll(Layer.succeed(CredentialProvider)(platform.credentialProvider), Layer.succeed(HttpAuthorizer)(platform.httpAuthorizer), Layer.succeed(AuthorizedMutationHttp)(platform.authorizedMutationHttp), Layer.succeed(NpmUserConfigResource)(platform.npmUserConfigResource), Layer.succeed(CertifiedPublisherSpawn)(platform.certifiedPublisherSpawn));
+};
+//# sourceMappingURL=credentials.js.map