@pipobscure/bundle 0.0.1

package/dist/sea.js

@@ -0,0 +1,220 @@
+import * as FS from 'node:fs';
+import * as OS from 'node:os';
+import * as PATH from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { mount, start, verify } from './launch.js';
+import { signBundle, createBundle } from './api.js';
+import { moduleFiles, packageRoot, moduleDir } from './files.js';
+/**
+ * Verify the running container and mount the archive appended to it. Returns
+ * where it landed; nothing has been executed out of it yet.
+ */
+export function mountSelf(options = {}) {
+    return mount(options.container ?? process.execPath, options);
+}
+/** Verify the running container, mount it, and run the application inside. */
+export async function bootstrap(options = {}) {
+    await start(mountSelf(options));
+}
+/**
+ * Verify the running container without mounting it — for an application that
+ * wants to report on its own provenance ("signed by X at Y").
+ */
+export function verifySelf(options = {}) {
+    return verify(options.container ?? process.execPath, options);
+}
+// -------------------------------------------------------------------- build ---
+/** The default flags the container runs itself with. */
+export const SEA_EXEC_ARGV = ['--no-warnings', '--experimental-vfs'];
+/**
+ * Build the SEA base: a node runtime whose injected main mounts this package
+ * out of its own blob and hands over to `bootstrap()`. The result is a binary
+ * with no application in it yet — append one with `buildSea` or with
+ * `sign --prefix`.
+ */
+export async function createSeaBase(options) {
+    const scratch = options.scratch ?? FS.mkdtempSync(PATH.join(OS.tmpdir(), 'bundle-sea-'));
+    const owned = !options.scratch;
+    try {
+        let verifier = options.verifier;
+        let contents;
+        if (verifier) {
+            contents = [];
+        }
+        else {
+            verifier = PATH.join(scratch, 'verifier.bundle');
+            const files = verifierFiles(options);
+            await createBundle({ base: packageRoot(), files, output: verifier });
+            contents = files;
+        }
+        const stub = PATH.join(scratch, 'stub.js');
+        FS.writeFileSync(stub, stubSource(anchorPolicy(options.bootstrap ?? {})));
+        const config = PATH.join(scratch, 'sea-config.json');
+        FS.writeFileSync(config, `${JSON.stringify({
+            main: stub,
+            output: PATH.resolve(options.output),
+            disableExperimentalSEAWarning: true,
+            useSnapshot: false,
+            useCodeCache: false,
+            // The verifier bundle is the executable's file system rather than
+            // an asset it has to unpack: node embeds the ZIP as it is and
+            // mounts it, and the stub — injected at the root of that mount —
+            // requires this package out of it by relative path.
+            useVfs: true,
+            vfsArchive: verifier,
+            // The stub is injected at the root of that bundle, where this
+            // package's own `"type": "module"` decides what a `.js` is — so it
+            // is an ES module, and saying so is what makes it one. Note that
+            // `"mainFormat": "commonjs"` would not do the opposite: the mount's
+            // package.json still wins, and the only way to a CommonJS stub is a
+            // `.cjs` extension.
+            mainFormat: 'module',
+            execArgv: options.execArgv ?? SEA_EXEC_ARGV,
+            execArgvExtension: 'none',
+            ...(options.node ? { executable: PATH.resolve(options.node) } : {}),
+        }, null, 2)}\n`);
+        const built = spawnSync(process.execPath, ['--no-warnings', '--build-sea', config], { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf-8' });
+        if (built.error)
+            throw built.error;
+        if (built.status !== 0) {
+            throw new Error(`--build-sea failed (exit ${built.status}): ${(built.stderr || built.stdout || '').trim()}`);
+        }
+        FS.chmodSync(options.output, 0o755);
+        // `--build-sea` ignores configuration keys it does not know, so a node
+        // without `vfsArchive` would produce a binary that builds cleanly and
+        // fails at startup with nothing mounted. Run the result once: it costs
+        // milliseconds and it is the difference between finding that out here
+        // and finding it out in front of a user. A cross-build cannot be run,
+        // so it is not checked — the platform it is for is not this one.
+        if (!options.node)
+            selftest(options.output);
+        return { output: options.output, size: FS.statSync(options.output).size, verifier: contents };
+    }
+    finally {
+        if (owned)
+            FS.rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/**
+ * Build a self-validating executable: a SEA base with `app` appended and the
+ * whole thing signed as one file. Everything the container will check — the
+ * runtime, the verifier and the application — is inside what the signature
+ * covers.
+ */
+export async function buildSea(options) {
+    const log = options.log ?? (() => { });
+    const scratch = options.scratch ?? FS.mkdtempSync(PATH.join(OS.tmpdir(), 'bundle-sea-'));
+    const owned = !options.scratch;
+    try {
+        let base = options.base;
+        if (!base) {
+            base = PATH.join(scratch, 'sea-base');
+            log('* building the SEA base (node runtime + verifier)');
+            const built = await createSeaBase({ ...options, output: base, scratch });
+            log(`  base: ${built.size} bytes, ${built.verifier.length} verifier members`);
+        }
+        log(`* appending ${options.app} behind ${PATH.basename(base)}`);
+        const res = await signBundle({
+            source: options.app,
+            output: options.output,
+            prefix: base,
+            executable: true,
+            hashAlg: options.hashAlg,
+            signAlg: options.signAlg,
+            signer: options.signer,
+        });
+        log(res.signed ? `* signed: ${res.hash}` : '* built unsigned — it will refuse to run until it is signed');
+        return res;
+    }
+    finally {
+        if (owned)
+            FS.rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/**
+ * The files the embedded verifier needs, as paths relative to this package's
+ * root. That is this package's own compiled modules plus, unless turned off,
+ * the sigstore libraries — resolved through `node_modules` rather than listed,
+ * so the set cannot fall behind the dependency tree.
+ */
+export function verifierFiles({ sigstore = true } = {}) {
+    return moduleFiles({
+        base: packageRoot(),
+        files: ['package.json'],
+        dirs: [moduleDir()],
+        dependencies: sigstore ? SIGSTORE_PACKAGES : [],
+        // Source maps and declarations are for reading the code, not running
+        // it, and a verifier that ships inside every executable should carry
+        // only what it executes.
+        filter: (name) => !name.endsWith('.map') && !name.endsWith('.d.ts') && !name.endsWith('.d.cts'),
+    });
+}
+/** The sigstore libraries verification needs; signing pulls in more at runtime. */
+const SIGSTORE_PACKAGES = ['@sigstore/verify', '@sigstore/bundle', '@sigstore/protobuf-specs', '@sigstore/tuf'];
+/**
+ * Resolve the paths in a baked policy, because a policy is baked *here* and read
+ * *there*. `--root build/certs/root.pem` is a sentence about the directory the
+ * build ran in; the binary that carries it may be run anywhere, by anyone, and a
+ * trust root it cannot find is a container that refuses everything. PEM text
+ * passes through untouched — it is not a path and has no directory to be
+ * relative to.
+ */
+function anchorPolicy(options) {
+    const anchored = { ...options };
+    if (options.roots) {
+        anchored.roots = options.roots.map((root) => (root.includes('-----BEGIN') ? root : PATH.resolve(root)));
+    }
+    if (options.trustedRoot)
+        anchored.trustedRoot = PATH.resolve(options.trustedRoot);
+    return anchored;
+}
+/**
+ * Run the built binary once, to prove that the file system inside it mounts and
+ * this package can be required out of it. `--version` is the cheapest thing
+ * that touches all of that, and it works whichever shape the binary is.
+ */
+function selftest(output) {
+    const res = spawnSync(PATH.resolve(output), ['--version'], { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf-8' });
+    if (res.error)
+        throw res.error;
+    if (res.status !== 0 || !/bundle/.test(res.stdout)) {
+        throw new Error(`the built executable does not run (exit ${res.status}): ${(res.stderr || res.stdout || '').trim()}\n` +
+            'A node whose --build-sea does not understand "vfsArchive" builds exactly this: ' +
+            'the configuration key is ignored, nothing is mounted, and the stub has nothing to require.');
+    }
+}
+/**
+ * The CommonJS stub injected as the SEA's main script. It runs at the root of
+ * the mounted verifier bundle, so requiring this package is a relative path and
+ * nothing more; everything else it needs to decide, `launch` decides by looking
+ * at the binary's own tail.
+ *
+ * It stays the one piece no test can exercise from source, so it stays small.
+ */
+export function stubSource(options) {
+    const dir = moduleDir();
+    const entry = `./${dir}/launch${dir === 'src' ? '.ts' : '.js'}`;
+    return `// Generated by @pipobscure/bundle. The SEA main, running at the root of the
+// archive this executable carries: hand over to the launcher, which verifies
+// either the archive appended to this file or the one named on the command
+// line before running anything out of it.
+import * as launch from ${JSON.stringify(entry)};
+
+const OPTIONS = ${JSON.stringify(options, null, 2)};
+
+try {
+    // Only a binary with nothing behind it takes an archive from the command
+    // line. One with an *unsigned* archive appended is not a launcher with a
+    // stray tail — it is a container somebody forgot to sign, and saying so is
+    // worth more than falling back to a usage message.
+    const code = launch.appended(process.execPath) === 'none'
+        ? await launch.main(process.argv.slice(2), OPTIONS)
+        : await launch.runSelf(OPTIONS);
+    if (typeof code === 'number' && code !== 0) process.exitCode = code;
+} catch (err) {
+    process.stderr.write(\`\${err && err.stack || err}\\n\`);
+    process.exitCode = 1;
+}
+`;
+}
+//# sourceMappingURL=sea.js.map

package/dist/sea.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sea.js","sourceRoot":"","sources":["../src/sea.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAA4B,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAoB,MAAM,UAAU,CAAC;AAEtE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAgEjE;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAO,GAAqB,EAAE;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAO,GAAqB,EAAE;IAC1D,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAO,GAAqB,EAAE;IACrD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,iFAAiF;AAEjF,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;AAiDrE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAuB;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC;QACD,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChC,IAAI,QAAkB,CAAC;QACvB,IAAI,QAAQ,EAAE,CAAC;YACX,QAAQ,GAAG,EAAE,CAAC;QAClB,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrE,QAAQ,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACrD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACvC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YACpC,6BAA6B,EAAE,IAAI;YACnC,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,KAAK;YACnB,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,oDAAoD;YACpD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,QAAQ;YACpB,8DAA8D;YAC9D,mEAAmE;YACnE,iEAAiE;YACjE,oEAAoE;YACpE,oEAAoE;YACpE,oBAAoB;YACpB,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa;YAC3C,iBAAiB,EAAE,MAAM;YACzB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAEjB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,MAAM,CAAC,EAC9E,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,KAAK,CAAC,KAAK,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEpC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE5C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAClG,CAAC;YAAS,CAAC;QACP,IAAI,KAAK;YAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAmB;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC;QACD,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACtC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAClF,CAAC;QAED,GAAG,CAAC,eAAe,OAAO,CAAC,GAAG,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;YACzB,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,6DAA6D,CAAC,CAAC;QAC1G,OAAO,GAAG,CAAC;IACf,CAAC;YAAS,CAAC;QACP,IAAI,KAAK;YAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAoB,EAAE;IACnE,OAAO,WAAW,CAAC;QACf,IAAI,EAAE,WAAW,EAAE;QACnB,KAAK,EAAE,CAAC,cAAc,CAAC;QACvB,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACnB,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;QAC/C,qEAAqE;QACrE,qEAAqE;QACrE,yBAAyB;QACzB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAClG,CAAC,CAAC;AACP,CAAC;AAED,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,eAAe,CAAC,CAAC;AAEhH;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAAyB;IAC3C,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,CAAC,WAAW;QAAE,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,MAAc;IAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,EACrD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,KAAK;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACX,2CAA2C,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI;YACtG,iFAAiF;YACjF,4FAA4F,CAAC,CAAC;IACtG,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,OAAyB;IAChD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAChE,OAAO;;;;0BAIe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;kBAE7B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;CAejD,CAAC;AACF,CAAC"}

package/dist/sigstore.d.ts

@@ -0,0 +1,112 @@
+import * as CRYPTO from 'node:crypto';
+import type { Signer } from './archive.ts';
+import type * as SigstoreSpecs from '@sigstore/protobuf-specs';
+export declare const DEFAULT_FULCIO_URL = "https://fulcio.sigstore.dev";
+export declare const DEFAULT_REKOR_URL = "https://rekor.sigstore.dev";
+export declare const DEFAULT_TSA_URL = "https://timestamp.sigstore.dev/api/v1/timestamp";
+export declare const DEFAULT_TUF_MIRROR = "https://tuf-repo-cdn.sigstore.dev";
+/** The comment field the sigstore bundle travels in. */
+export declare const FIELD = "SIGSTORE";
+/** Where a trust root came from, so a caller can say how fresh it is. */
+export type TrustedRootOrigin = 'explicit' | 'environment' | 'cache' | 'seed';
+export interface TrustedRootLocation {
+    origin: TrustedRootOrigin;
+    /** The file it was read from, or the seed's mirror key. */
+    path: string;
+}
+export interface SigstoreIdentity {
+    subject?: string | undefined;
+    issuer?: string | undefined;
+    /** GitHub Actions tokens name the workflow that ran. */
+    workflow?: string | undefined;
+}
+export interface SigstoreSignerOptions {
+    /** An OIDC token to use instead of signing in. */
+    token?: string | undefined;
+    flow?: 'auto' | 'ci' | 'browser' | 'device' | undefined;
+    /** OIDC issuer (default: sigstore's Dex). */
+    issuer?: string | undefined;
+    /** Dex connector to jump to (default: 'github'). */
+    connector?: string | undefined;
+    fulcioURL?: string | undefined;
+    /** Transparency log; '' to skip. */
+    rekorURL?: string | undefined;
+    /** RFC 3161 timestamp authority; '' to skip. */
+    tsaURL?: string | undefined;
+    /** Digest the signature uses (default: 'sha256'). */
+    signAlg?: string | undefined;
+    log?: ((line: string) => void) | undefined;
+}
+/** A sigstore-backed `Signer`, with the identity it authenticated as. */
+export interface SigstoreSigner extends Signer {
+    kind: 'sigstore';
+    identity: SigstoreIdentity;
+}
+export interface BundleVerification {
+    identity?: string | undefined;
+    issuer?: string | undefined;
+    signedAt?: Date | undefined;
+}
+/** Whether the sigstore libraries needed for *verification* are loadable. */
+export declare function available(): boolean;
+/**
+ * Phase one: authenticate, mint an ephemeral keypair, and get a Fulcio
+ * certificate for it. Returns a signer whose `chain` can go straight into
+ * `AUTHORITY.PEM` and whose `sign()` finishes the job once the hash exists.
+ */
+export declare function signer(options?: SigstoreSignerOptions): Promise<SigstoreSigner>;
+/**
+ * Verify a sigstore bundle over `artifact` (the whole-file hash bytes) and
+ * return the identity it establishes. Synchronous, because the mount path is:
+ * `provider.ts` decides whether to serve an archive before any of the program
+ * in it runs, and cannot await.
+ *
+ * Throws on a bundle that does not verify. `trustedRoot` must be supplied —
+ * this deliberately does not reach for the network.
+ */
+export declare function verifyBundle(encoded: string, artifact: Buffer, { trustedRoot, identity, issuer }: {
+    trustedRoot: SigstoreSpecs.TrustedRoot;
+    identity?: string | undefined;
+    issuer?: string | undefined;
+}): BundleVerification;
+/**
+ * The leaf certificate a sigstore bundle carries, as an X509Certificate — so a
+ * verifier can confirm the inspectable `AUTHORITY.PEM` names the same
+ * certificate the bundle was actually verified against.
+ */
+export declare function bundleCertificate(encoded: string): CRYPTO.X509Certificate | null;
+/**
+ * Where the sigstore trust root would be read from, in the order tried:
+ * an explicit path, `BUNDLE_SIGSTORE_ROOT`, the cache `bundle trust` maintains,
+ * and finally the seed `@sigstore/tuf` ships. Returns null when none exists.
+ *
+ * The seed is the fallback rather than the first choice because it is frozen at
+ * the version of the library that was installed; `bundle trust` fetches the
+ * live one over TUF and that copy wins whenever it is present.
+ */
+export declare function trustedRootLocation(source?: string | undefined): TrustedRootLocation | null;
+/**
+ * Load the sigstore trust root synchronously. Returns null when there is none —
+ * verification then reports that as a reason rather than failing, because
+ * "I could not check" and "this is forged" are different answers.
+ */
+export declare function trustedRootSync(source?: string | undefined): SigstoreSpecs.TrustedRoot | null;
+/**
+ * Refresh the trust root over the network, through TUF — signed metadata with
+ * its own root of trust, not a plain download. Returns the cache path.
+ */
+export declare function refreshTrustedRoot({ mirror, force }?: {
+    mirror?: string | undefined;
+    force?: boolean | undefined;
+}): Promise<string>;
+/**
+ * Where `@sigstore/tuf` keeps the target it downloaded. Mirrors its own
+ * `appDataPath()` so the two agree without depending on a private export.
+ */
+export declare function cachedRootPath(mirror?: string): string;
+/**
+ * A policy string that matches `value` and nothing else, for a verifier that
+ * reads its policy as a regular expression.
+ */
+export declare function exactly(value: string): string;
+//# sourceMappingURL=sigstore.d.ts.map

package/dist/sigstore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigstore.d.ts","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAMtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAK3C,OAAO,KAAK,KAAK,aAAa,MAAM,0BAA0B,CAAC;AAgD/D,eAAO,MAAM,kBAAkB,gCAAgC,CAAC;AAChE,eAAO,MAAM,iBAAiB,+BAA+B,CAAC;AAC9D,eAAO,MAAM,eAAe,oDAAoD,CAAC;AACjF,eAAO,MAAM,kBAAkB,sCAAsC,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,KAAK,aAAa,CAAC;AAEhC,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAChC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IAClC,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxD,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC9C;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAe,SAAQ,MAAM;IAC1C,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAC/B;AAiBD,6EAA6E;AAC7E,wBAAgB,SAAS,IAAI,OAAO,CASnC;AAID;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0CzF;AAoHD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;IAC/B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,GACF,kBAAkB,CA0BpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,CAQhF;AAYD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAQ3F;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC,WAAW,GAAG,IAAI,CAY7F;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,MAA2B,EAAE,KAAY,EAAE,GAAE;IACpF,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAA2B,GAAG,MAAM,CAM1E;AAyBD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C"}