@originator-profile/ca-client 0.0.0 → 0.7.0-beta.4

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,5 @@
+Originator Profile
+Copyright 2025 Originator Profile Collaborative Innovation Partnership
+
+This product includes software developed at
+Originator Profile Collaborative Innovation Partnership (https://originator-profile.org/)

package/README.md

@@ -1,45 +1,269 @@
-# @originator-profile/ca-client
+# CA Client
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+[![npm version](https://img.shields.io/npm/v/@originator-profile/ca-client)](https://www.npmjs.com/package/@originator-profile/ca-client) [![jsDocs.io](https://img.shields.io/badge/jsDocs.io-reference-blue)](https://www.jsdocs.io/package/@originator-profile/ca-client)
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+Content Attestation (CA) を発行し、Content Attestation Set (CAS) として配信するための Node.js クライアントです。
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+<!-- prettier-ignore-start -->
+<!-- environments-start -->
 
-## Purpose
+<!-- NOTE: Auto-generated by ../../scripts/update-readme-environments.ts from package.json, .github/workflows/test.yml, Dockerfile, and manifest.json. Edit the source, not this section. -->
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@originator-profile/ca-client`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+## Environment
 
-## What is OIDC Trusted Publishing?
+### Verified
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+- OS: Ubuntu 24.04
 
-## Setup Instructions
+### Development
 
-To properly configure OIDC trusted publishing for this package:
+- Node.js: `^22.18.0 || ^24.10.0 || ^26.2.0`
+- pnpm: `11.0.9`
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
+<!-- environments-stop -->
+<!-- prettier-ignore-end -->
 
-## DO NOT USE THIS PACKAGE
+## 使い方
 
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
+### インストール
 
-## More Information
+任意のパッケージマネージャーでインストールしてください。
 
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+```bash
+npm install @originator-profile/ca-client
+# or
+yarn add @originator-profile/ca-client
+# or
+pnpm add @originator-profile/ca-client
+```
 
----
+### クライアントを生成する
 
-**Maintained for OIDC setup purposes only**
+CA サーバーと連携するクライアントオブジェクトを生成します。
+
+```ts
+import { createCaClient } from "@originator-profile/ca-client";
+
+const client = createCaClient({
+  endpoint: "YOUR_CA_SERVER_URL", // CA サーバーのエンドポイント URL
+  issuer: "YOUR_ISSUER", // 発行者 ID（例: `dns:example.com`）
+  ccspConfig: "YOUR_CCSP_CONFIG", // 下記 ccspConfig の設定を参照
+  // tokenBufferSeconds: 300, // トークン期限切れ前のバッファ（秒、デフォルト 300）
+});
+```
+
+`ccspConfig` は OAuth の client credentials（`client_secret_post`）設定です。次の JSON を Base64 エンコードし、先頭に `CCSP:` を付けた文字列です。
+
+```json
+{
+  "authType": "client_secret_post",
+  "clientId": "YOUR_CLIENT_ID",
+  "clientSec": "YOUR_CLIENT_SECRET",
+  "tokenUrl": "https://example.com/oauth/token"
+}
+```
+
+次のような Node.js コマンドで JSON を Base64 エンコードし、先頭に `CCSP:` を付けます。
+
+```bash
+node -e 'console.log("CCSP:" + Buffer.from(JSON.stringify({
+  authType: "client_secret_post",
+  clientId: "YOUR_CLIENT_ID",
+  clientSec: "YOUR_CLIENT_SECRET",
+  tokenUrl: "https://example.com/oauth/token"
+})).toString("base64"))'
+```
+
+結果は `CCSP:eyJhds...` のような形式になります。この文字列を `ccspConfig` に渡します。
+
+> [!NOTE]
+> `authType` は `client_secret_post` のみ対応しています。`clientSec` は OAuth の `client_secret` の略称です。
+
+### 基本的な使い方
+
+未署名 CA を CA サーバーで署名し、署名済み JWT を CAS ファイルとして書き出します。
+
+```ts
+import { writeCasFile } from "@originator-profile/ca-client";
+
+const jwt = await client.sign(unsignedCa);
+
+await writeCasFile({
+  filePath: "dist/cas/ja-JP.hello.cas.json",
+  jwt,
+});
+```
+
+## APIメソッド
+
+### sign
+
+`sign` メソッドは、未署名の Content Attestation を CA サーバーで署名し、JWT 文字列を返します。
+
+引数は [Content Attestation のプロパティ一覧](https://docs.originator-profile.org/ja/opb/ca/#content-attestation-properties) に従う未署名 CA を指定します。
+
+戻り値は [OP VC Securing Mechanism](https://docs.originator-profile.org/ja/opb/securing-mechanism/#content-attestation) に従う署名済み CA の JWT です。
+
+```ts
+const jwt = await client.sign({
+  "@context": [
+    "https://www.w3.org/ns/credentials/v2",
+    "https://originator-profile.org/ns/credentials/v1",
+  ],
+  type: ["VerifiableCredential", "ContentAttestation"],
+  issuer: "dns:example.com",
+  credentialSubject: {
+    type: "Article",
+    headline: "タイトル",
+  },
+  allowedUrl: ["https://example.com/ja-JP/about(/?)"],
+  target: [
+    {
+      type: "TextTargetIntegrity",
+      cssSelector: "main",
+    },
+  ],
+});
+```
+
+### reSign
+
+`reSign` メソッドは、既存 CAS の JWT payload を再署名し、JWT 文字列を返します。
+第 1 引数は [署名済み CA の JWT](https://docs.originator-profile.org/ja/opb/securing-mechanism/#content-attestation) をデコードした payload です。
+第 2 引数は payload が不正なとき、エラーメッセージに埋め込む識別子です。
+
+```ts
+import { readFile } from "node:fs/promises";
+
+const casJson = JSON.parse(
+  await readFile("dist/cas/ja-JP.page.cas.json", "utf8"),
+);
+const jwt = casJson[0]; // CAS ファイルは JWT の配列
+const existingPayload = JSON.parse(
+  Buffer.from(jwt.split(".")[1], "base64url").toString("utf8"),
+);
+
+const renewed = await client.reSign(
+  existingPayload,
+  "dist/cas/ja-JP.page.cas.json",
+);
+```
+
+`createCaClient` に渡した `issuer` が、payload の `issuer` より優先されます。
+
+### writeCasFile
+
+`writeCasFile` は、署名済み JWT を [CAS](https://docs.originator-profile.org/ja/opb/content-attestation-set/) ファイルとして書き出します。`filePath`・`jwt` は必須です。
+
+```ts
+import { writeCasFile } from "@originator-profile/ca-client";
+
+await writeCasFile({
+  filePath: "dist/cas/ja-JP.page.cas.json",
+  jwt,
+});
+```
+
+生成されるファイルは JWT 1つを含む JSON 配列です。
+
+```json
+["eyJ..."]
+```
+
+### detectDrift
+
+`detectDrift` は、ビルド後 HTML から target integrity を再計算し、CAS に記録された target とのずれを判定します。`html`・`filePath` は必須です。
+
+`html` には CAS が対象とするページの **HTML 文字列** を渡します。
+静的サイトならビルド成果物（例: `dist/ja-JP/page/index.html`）を、SSR ならそのページのレスポンス HTML を渡します。
+
+```ts
+import { readFile } from "node:fs/promises";
+import { detectDrift } from "@originator-profile/ca-client";
+
+const html = await readFile("dist/ja-JP/page/index.html", "utf8");
+
+const result = await detectDrift({
+  html,
+  filePath: "dist/cas/ja-JP.page.cas.json",
+});
+
+switch (result.status) {
+  case "ok":
+    break;
+  case "cas_missing":
+    // CAS ファイルが無い → 新規署名
+    break;
+  case "cas_invalid":
+    console.warn(result.reason);
+    break;
+  case "html_no_targets":
+    // セレクタに一致する要素が HTML に無い
+    break;
+  case "drifted":
+    // result.current / result.expected で差分を確認
+    break;
+}
+```
+
+| `status`          | 意味                                               |
+| ----------------- | -------------------------------------------------- |
+| `ok`              | HTML から再計算した target が CAS と一致する       |
+| `cas_missing`     | CAS ファイルが存在しない                           |
+| `cas_invalid`     | CAS の JSON / JWT が不正                           |
+| `html_no_targets` | HTML から target を抽出できない                    |
+| `drifted`         | target がずれている（`current` / `expected` 付き） |
+
+TextTargetIntegrity などの `cssSelector` は CAS に記録された値を使い、同じセレクタで HTML を再評価します。CAS にセレクタが無いときだけ、オプションで渡せます。
+
+```ts
+await detectDrift({
+  html,
+  filePath: "dist/cas/ja-JP.page.cas.json",
+  textSelector: "main",
+  externalSelector: ".op-resource",
+});
+```
+
+### エラー
+
+失敗時はすべて `CaClientError` を throw します。失敗の層は `code` で、HTTP の詳細は `status` で判定してください。
+
+```ts
+import {
+  CaClientError,
+  CaClientErrorCode,
+  isUnauthorized,
+} from "@originator-profile/ca-client";
+
+try {
+  const jwt = await client.sign(unsignedCa);
+} catch (error) {
+  if (error instanceof CaClientError) {
+    if (
+      error.code === CaClientErrorCode.Http &&
+      (error.status === undefined ||
+        error.status === 429 ||
+        error.status >= 500)
+    ) {
+      // サーバーのネットワーク障害、429、5xx
+    } else if (isUnauthorized(error)) {
+      // 401 → OAuth 認証情報（`ccspConfig`）を再確認
+    }
+    console.error(error.code, error.status, error.message);
+  }
+  throw error;
+}
+```
+
+| `code`          | エラー内容                                                                                                                                                                  | 原因と回避策                                       |
+| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
+| `CA_CONFIG`     | OAuth 設定（`ccspConfig`）の欠落・不正、未対応の `authType`                                                                                                                 | 認証設定を直してから再実行する                     |
+| `CA_VALIDATION` | 未署名 CA・CAS payload・日付・パス・JWT の不正                                                                                                                              | 入力を直してから再実行する                         |
+| `CA_HTTP`       | CA サーバーアクセス失敗。400 / 401 / 403 / 404 の原因は [CA Server のエラーリスト](https://docs.originator-profile.org/ja/error-reference/#ca-server-のエラーリスト) を参照 | `status` が 401 の場合: OAuth 認証情報を再確認     |
+| `CA_RESPONSE`   | 2xx だが `access_token` や JWT を含まない                                                                                                                                   | サーバー応答の形式を確認する                       |
+| `CA_FILE`       | CAS ファイルの読み取り・書き込み・削除に失敗した                                                                                                                            | パス・権限・ディスク空き容量を直してから再実行する |
+
+## ライセンス
+
+Apache-2.0

package/dist/index.d.ts

@@ -0,0 +1,130 @@
+import { UnsignedContentAttestation } from '@originator-profile/model';
+import { DocumentProvider } from '@originator-profile/sign';
+
+interface FetchOperations {
+    fetch: (url: string, options?: {
+        method?: string;
+        headers?: Record<string, string>;
+        body?: string;
+    }) => Promise<Response>;
+}
+
+type TimingOptions = {
+    issuedAt?: Date | string;
+    expiredAt?: Date | string;
+};
+
+type SignByCaServerOptions = TimingOptions & {
+    endpoint: string;
+    accessToken: string;
+    documentProvider?: DocumentProvider;
+    fetchOps?: FetchOperations;
+};
+declare function signByCaServer(uca: UnsignedContentAttestation, { endpoint, accessToken, documentProvider, fetchOps, ...timingOptions }: SignByCaServerOptions): Promise<string>;
+
+/** Same signature as {@link signByCaServer}. */
+type CaServerSign = typeof signByCaServer;
+
+type CaClientConfig = {
+    /** CA server endpoint URL */
+    endpoint: string;
+    /** Issuer ID (e.g. `dns:example.com`) */
+    issuer: string;
+    /** CCSP auth config (Base64, optional `CCSP:` prefix) */
+    ccspConfig: string;
+    /** Seconds before token expiry to refresh (default 300) */
+    tokenBufferSeconds?: number;
+};
+type CaClient = {
+    config: CaClientConfig;
+    /** Sign an unsigned CA on the CA server */
+    sign: (uca: UnsignedContentAttestation) => Promise<string>;
+    /**
+     * Re-sign an existing CAS JWT payload.
+     * @param source - Context for error messages (e.g. CAS file path)
+     */
+    reSign: (jwtPayload: Record<string, unknown>, source: string) => Promise<string>;
+};
+declare const createCaClient: (config: CaClientConfig, options?: {
+    sign?: CaServerSign;
+}) => CaClient;
+
+type WriteCasFileOptions = {
+    /**
+     * Destination CAS file path, e.g. `dist/cas/ja-JP.page.cas.json`.
+     * Relative paths resolve against the current working directory.
+     */
+    filePath: string;
+    /** Signed JWT string to write. */
+    jwt: string;
+};
+declare const writeCasFile: ({ filePath, jwt, }: WriteCasFileOptions) => Promise<void>;
+
+type NormalizedTarget = {
+    type: string;
+    integrity: string;
+    cssSelector?: string;
+};
+type DriftResult = {
+    status: "ok";
+    casFilePath: string;
+} | {
+    status: "cas_missing";
+    casFilePath: string;
+} | {
+    status: "cas_invalid";
+    casFilePath: string;
+    reason: string;
+} | {
+    status: "html_no_targets";
+    casFilePath: string;
+} | {
+    status: "drifted";
+    casFilePath: string;
+    current: NormalizedTarget[];
+    expected: NormalizedTarget[];
+};
+type DetectDriftOptions = {
+    /** Built HTML to recompute target integrity from. */
+    html: string;
+    /**
+     * Path to the CAS file, e.g. `dist/cas/ja-JP.page.cas.json`.
+     * Relative paths resolve against the current working directory.
+     */
+    filePath: string;
+    /** CSS selector for TextTargetIntegrity when CAS has none. */
+    textSelector?: string;
+    /** CSS selector for HtmlTargetIntegrity when CAS has none. */
+    htmlSelector?: string;
+    /** CSS selector for VisibleTextTargetIntegrity when CAS has none. */
+    visibleTextSelector?: string;
+    /**
+     * CSS selector for ExternalResourceTargetIntegrity elements.
+     * Defaults to the CAS `cssSelector`, then `.target-integrity`.
+     */
+    externalSelector?: string;
+};
+declare const detectDrift: (options: DetectDriftOptions) => Promise<DriftResult>;
+
+declare const CaClientErrorCode: {
+    readonly Config: "CA_CONFIG";
+    readonly Validation: "CA_VALIDATION";
+    readonly Http: "CA_HTTP";
+    readonly Response: "CA_RESPONSE";
+    readonly File: "CA_FILE";
+};
+type CaClientErrorCode = (typeof CaClientErrorCode)[keyof typeof CaClientErrorCode];
+declare class CaClientError extends Error {
+    readonly code: CaClientErrorCode;
+    readonly status?: number;
+    constructor(message: string, options: {
+        code: CaClientErrorCode;
+        cause?: unknown;
+        status?: number;
+    });
+}
+/** True when the request failed with HTTP 401. */
+declare const isUnauthorized: (error: unknown) => boolean;
+
+export { CaClientError, CaClientErrorCode, createCaClient, detectDrift, isUnauthorized, writeCasFile };
+export type { CaClient, CaClientConfig, DetectDriftOptions, DriftResult, NormalizedTarget, WriteCasFileOptions };