@pipobscure/bundle 0.0.1

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,4EAA4E;AAC5E,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,qEAAqE;AACrE,6EAA6E;AAC7E,gFAAgF;AAChF,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,oDAAoD;AACpD,EAAE;AACF,gFAAgF;AAChF,2BAA2B;AAC3B,EAAE;AACF,kEAAkE;AAClE,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6DAA6D;AAC7D,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,8EAA8E;AAC9E,gBAAgB;AAChB,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,qBAAqB;AACrB,EAAE;AACF,8DAA8D;AAC9D,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,+EAA+E;AAC/E,oEAAoE;AAEpE,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AACzC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;AAkFtB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,MAAM,GAA6E;IAC5F,UAAU,EAAS,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAW,IAAI,EAAE,8BAA8B,EAAE;IAChG,SAAS,EAAU,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAY,IAAI,EAAE,uDAAuD,EAAE;IACzH,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,sDAAsD,EAAE;IACxH,OAAO,EAAY,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAc,IAAI,EAAE,kDAAkD,EAAE;CACvH,CAAC;AAEF,wEAAwE;AACxE,qBAAqB;AACrB,MAAM,UAAU,aAAa,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAIhE,EAAE;IACF,IAAI,IAAI,GAAG,IAAI,KAAK,IAAI,OAAO,WAAW,OAAO,IAAI,CAAC;IACtD,IAAI,OAAO,IAAI,KAAK;QAAE,IAAI,IAAI,SAAS,OAAO,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;IAChG,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,OAAwB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;;YACtC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,+DAA+D,CAAC,IAAI,EAAE,CAAC;IAChG,OAAO;QACH,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC;QAC1B,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ;QACvC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;KAClE,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAqB,EAAE,OAAO,GAAkB,EAAE;IACzE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACD,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,iCAAiC;QACjC,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,+BAA+B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,MAAM,GAAG,CAAC;IACd,CAAC;YAAS,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC5B,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAqB,EAAE,OAAuB;IACvE,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAUD,SAAS,SAAS,CAAC,OAAsC;IACrD,IAAI,OAAO,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,+EAA+E;AAC/E,kCAAkC;AAClC,SAAS,OAAO,CAAC,MAAqB,EAAE,EAAU,EAAE,OAAsB;IACtE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAE/D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAE3E,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,UAAU,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,iDAAiD;IAEpF,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzB,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,+CAA+C,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE1H,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACD,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1H,CAAC;IAAC,MAAM,CAAC;QACL,WAAW,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,oDAAoD,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAErH,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW;YAAE,SAAS;QACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,6BAA6B,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtH,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACD,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,MAAM,CAAC,SAAS,EAAE,6BAA6B,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,YAAY,KAAK,QAAQ,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,oBAAoB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACnI,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,qCAAqC;IACrC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAChB,OAAO,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,sDAAsD;IACtD,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,iBAAiB,EAC3B,0EAA0E,EAC1E,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAC1C,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,mDAAmD,EACtF,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,SAAS,aAAa,CAClB,OAAe,EACf,MAAuB,EACvB,KAA+B,EAC/B,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAMhD;IAED,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAEtF,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC,yEAAyE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,SAAS,CAAC,yFAAyF,CAAC,CAAC;IAChH,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,uBAAuB;IACvB,IAAI,IAAmC,CAAC;IACxC,IAAI,CAAC;QACD,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,SAAS,EAAE,sCAAsC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,wCAAwC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5F,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC,SAAS,EAAE,iFAAiF,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9H,CAAC;IAED,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrH,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,CAAC,QAAQ,IAAI,QAAQ,QAAQ,GAAG,CAAC,MAAM,IAAI,gBAAgB,GAAG,IAAI,EAAE,EAC/G,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,oEAAoE;QACpE,kEAAkE;QAClE,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC,yDAAyD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,MAAM,CAAC,SAAS,EAAE,iCAAiC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC1C,MAAM,CAAC,GAAG,6DAA6D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAIlD;IACG,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QACpE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC5F,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,uBAAuB,CAAC,CAAC;QAClG,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC7C,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/E,OAAO,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAYD,SAAS,UAAU,CAAC,IAAY;IAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACpC,OAAO;QACH,IAAI;QACJ,IAAI;YACA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,GAAG,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAC/E,OAAO,GAAG,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,GAAG;YACV,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBACrD,IAAI,GAAG,GAAG,CAAC,CAAC;gBACZ,OAAO,GAAG,GAAG,GAAG,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;oBAC3E,IAAI,IAAI,IAAI,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;oBACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;oBACnC,GAAG,IAAI,IAAI,CAAC;gBAChB,CAAC;YACL,CAAC;oBAAS,CAAC;gBACP,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;QACL,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;KAChC,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC7B,OAAO;QACH,IAAI,EAAE,GAAG,CAAC,MAAM;QAChB,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;KACtC,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE;QAC5B,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAClD,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM;gBAAE,SAAS;YAC9D,OAAO,GAAG,CAAC;QACf,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;IACd,CAAC,CAAC;IACF,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,GAAG,GAAG,CAAC;QAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC7B,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,kEAAkE;QAClE,oEAAoE;QACpE,wCAAwC;QACxC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YAAC,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7E,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,wCAAwC;gBAC1E,uEAAuE;gBACvE,mCAAmC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CACX,KAAwB,EACxB,MAAc,EACd,KAAgC,EAChC,KAAmC;IAEnC,OAAO;QACH,KAAK;QACL,MAAM;QACN,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACzD,MAAM,EAAE,KAAK,KAAK,UAAU;QAC5B,OAAO,EAAE,KAAK,KAAK,OAAO;QAC1B,GAAG,KAAK;KACX,CAAC;AACN,CAAC;AAED,SAAS,UAAU,CAAC,KAA2B;IAC3C,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,GAAG,CAAC,IAAwB;IACjC,IAAI,CAAC;QACD,OAAO,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,IAA4B,EAAE,GAAW;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChF,CAAC;AAED,0CAA0C;AAC1C,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,+CAA+C;AAC/C,SAAS,QAAQ,CAAC,KAA+B,EAAE,KAA+B,EAAE,GAAW;IAC3F,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,sEAAsE;QACtE,oCAAoC;QACpC,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACzG,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,OAAO,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,40 @@
+export declare const DEFAULT_ISSUER = "https://oauth2.sigstore.dev/auth";
+export declare const DEFAULT_CLIENT_ID = "sigstore";
+/** How an identity token was obtained. */
+export type IdentityFlow = 'supplied' | 'ci' | 'browser' | 'device';
+/** What the caller may ask for; 'auto' picks by looking at the environment. */
+export type RequestedFlow = 'auto' | 'ci' | 'browser' | 'device';
+export interface IdentityTokenOptions {
+    /** A token supplied by the caller; returned as-is. */
+    token?: string | undefined;
+    /** OIDC issuer base URL (default: sigstore's Dex). */
+    issuer?: string | undefined;
+    /** OAuth client id (default: 'sigstore'). */
+    clientID?: string | undefined;
+    /** Dex connector to jump straight to (default: 'github'). */
+    connector?: string | undefined;
+    flow?: RequestedFlow | undefined;
+    /** Audience to request for the CI token (default: 'sigstore'). */
+    audience?: string | undefined;
+    log?: ((line: string) => void) | undefined;
+}
+export interface IdentityTokenResult {
+    token: string;
+    flow: IdentityFlow;
+}
+/**
+ * Resolve a connector name to what Dex expects. An empty value means "do not
+ * preselect", which lands the user on the provider chooser.
+ */
+export declare function connectorId(name: string | undefined): string | undefined;
+/** The audience Fulcio expects to find in the token it is handed. */
+export declare const FULCIO_AUDIENCE = "sigstore";
+/** Obtain an identity token, by whichever route fits where this is running. */
+export declare function identityToken(options?: IdentityTokenOptions): Promise<IdentityTokenResult>;
+/**
+ * Whether an ambient CI identity is available. Only GitHub's shape is
+ * implemented, since that is what the `--connector github` path mirrors, but
+ * this is the hook other providers would land on.
+ */
+export declare function inCI(): boolean;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,cAAc,qCAAqC,CAAC;AACjE,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAG5C,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACjC,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;CACtB;AAaD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGxE;AAED,qEAAqE;AACrE,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C,+EAA+E;AAC/E,wBAAsB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqBpG;AAED;;;;GAIG;AACH,wBAAgB,IAAI,IAAI,OAAO,CAE9B"}

package/dist/oidc.js

@@ -0,0 +1,320 @@
+import * as CRYPTO from 'node:crypto';
+import * as HTTP from 'node:http';
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+// Getting an OIDC identity token to present to Fulcio — the "who are you"
+// half of sigstore signing. Fulcio does not care how the token was obtained,
+// only that it is a valid one from an issuer it recognises, so this module's
+// whole job is to produce one and then get out of the way.
+//
+// Three routes, tried in this order, because the right one is a property of
+// where the command is running rather than something a user should have to
+// pick:
+//
+//   * An ambient CI token. GitHub Actions exposes a token endpoint through
+//     `ACTIONS_ID_TOKEN_REQUEST_URL`/`ACTIONS_ID_TOKEN_REQUEST_TOKEN` (given
+//     `permissions: id-token: write`), and the resulting token names the
+//     repository and workflow rather than a person. That is the identity you
+//     actually want on a release artifact, so CI wins whenever it is present.
+//
+//   * A browser sign-in. Sigstore runs a Dex instance at oauth2.sigstore.dev
+//     that federates to GitHub, Google and Microsoft; naming one as
+//     `connector_id` skips its chooser and goes straight there. The
+//     redirect comes back to a loopback server this process opens on an
+//     ephemeral port, which is why no client secret is needed: the flow is a
+//     public-client authorization code exchange bound by PKCE.
+//
+//   * A device code. The same Dex, for machines with no browser to open — an
+//     SSH session, a container. The user is given a short code and a URL to
+//     open somewhere else, and this process polls until they finish.
+//
+// Nothing here is sigstore-specific beyond the default endpoints; pointing
+// `issuer` at another OIDC provider works, which is the point of Fulcio
+// accepting a token rather than a credential of its own.
+export const DEFAULT_ISSUER = 'https://oauth2.sigstore.dev/auth';
+export const DEFAULT_CLIENT_ID = 'sigstore';
+const DEFAULT_SCOPE = 'openid email';
+// Dex identifies a connector by the upstream issuer's URL, not by a short name,
+// and rejects the request outright if handed something it does not recognise.
+// These are the three sigstore's instance offers; the short names are a
+// convenience this module translates, so `--connector github` works and an
+// unrecognised value is still passed through verbatim for another deployment.
+const CONNECTORS = {
+    github: 'https://github.com/login/oauth',
+    google: 'https://accounts.google.com',
+    microsoft: 'https://login.microsoftonline.com',
+};
+/**
+ * Resolve a connector name to what Dex expects. An empty value means "do not
+ * preselect", which lands the user on the provider chooser.
+ */
+export function connectorId(name) {
+    if (!name || name === 'none')
+        return undefined;
+    return CONNECTORS[name.toLowerCase()] ?? name;
+}
+/** The audience Fulcio expects to find in the token it is handed. */
+export const FULCIO_AUDIENCE = 'sigstore';
+/** Obtain an identity token, by whichever route fits where this is running. */
+export async function identityToken(options = {}) {
+    const opts = {
+        issuer: options.issuer ?? DEFAULT_ISSUER,
+        clientID: options.clientID ?? DEFAULT_CLIENT_ID,
+        connector: connectorId(options.connector ?? 'github'),
+        audience: options.audience ?? FULCIO_AUDIENCE,
+        log: options.log ?? ((line) => { process.stderr.write(`${line}\n`); }),
+    };
+    const flow = options.flow ?? 'auto';
+    if (options.token)
+        return { token: options.token, flow: 'supplied' };
+    if (flow === 'ci' || (flow === 'auto' && inCI())) {
+        if (!inCI())
+            throw new Error('no CI OIDC token endpoint in the environment');
+        return { token: await ciToken(opts.audience), flow: 'ci' };
+    }
+    const chosen = flow === 'auto' ? (canOpenBrowser() ? 'browser' : 'device') : flow;
+    const config = await discover(opts.issuer);
+    const token = chosen === 'device' ? await deviceFlow(config, opts) : await browserFlow(config, opts);
+    return { token, flow: chosen };
+}
+/**
+ * Whether an ambient CI identity is available. Only GitHub's shape is
+ * implemented, since that is what the `--connector github` path mirrors, but
+ * this is the hook other providers would land on.
+ */
+export function inCI() {
+    return Boolean(process.env['ACTIONS_ID_TOKEN_REQUEST_URL'] && process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN']);
+}
+// GitHub Actions' OIDC endpoint. The workflow must ask for it:
+//
+//   permissions:
+//     id-token: write
+//
+// Without that the variables are simply absent, which is what `inCI()` reads.
+async function ciToken(audience) {
+    const url = new URL(process.env['ACTIONS_ID_TOKEN_REQUEST_URL']);
+    url.searchParams.set('audience', audience);
+    const res = await fetch(url, {
+        headers: { Authorization: `Bearer ${process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN']}` },
+    });
+    if (!res.ok)
+        throw new Error(`CI OIDC token request failed: ${res.status} ${res.statusText}`);
+    const body = await res.json();
+    if (!body.value)
+        throw new Error('CI OIDC token response carried no token');
+    return body.value;
+}
+// The OIDC discovery document, so endpoints are read from the issuer rather
+// than hard-coded next to it.
+async function discover(issuer) {
+    const url = `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`;
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`OIDC discovery failed for ${issuer}: ${res.status} ${res.statusText}`);
+    return await res.json();
+}
+// Authorization code + PKCE against a loopback redirect. The server is bound
+// to 127.0.0.1 on an ephemeral port and lives exactly as long as the one
+// request it is waiting for.
+async function browserFlow(config, opts) {
+    const verifier = base64url(CRYPTO.randomBytes(32));
+    const challenge = base64url(CRYPTO.createHash('sha256').update(verifier).digest());
+    const state = base64url(CRYPTO.randomBytes(16));
+    const nonce = base64url(CRYPTO.randomBytes(16));
+    const { server, port } = await listen();
+    const redirect = `http://localhost:${port}/auth/callback`;
+    try {
+        const authorize = new URL(config.authorization_endpoint);
+        authorize.search = new URLSearchParams({
+            response_type: 'code',
+            client_id: opts.clientID,
+            scope: DEFAULT_SCOPE,
+            redirect_uri: redirect,
+            code_challenge: challenge,
+            code_challenge_method: 'S256',
+            state,
+            nonce,
+            ...(opts.connector ? { connector_id: opts.connector } : {}),
+        }).toString();
+        opts.log(`  opening ${label(opts.connector)}sign-in in your browser`);
+        opts.log(`  if it does not open, visit:\n    ${authorize}`);
+        openBrowser(authorize.toString());
+        const code = await awaitCode(server, state);
+        return await exchange(config, {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirect,
+            client_id: opts.clientID,
+            code_verifier: verifier,
+        });
+    }
+    finally {
+        server.close();
+    }
+}
+// Resolves with the `code` from the single callback request, or rejects with
+// whatever the provider reported instead. `state` is checked before the code is
+// accepted, so a request that did not originate from this flow is rejected.
+function awaitCode(server, state) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error('timed out waiting for the browser sign-in to complete'));
+        }, 5 * 60_000);
+        timer.unref?.();
+        server.on('request', (req, res) => {
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            if (url.pathname !== '/auth/callback')
+                return respond(res, 404, 'Not found.');
+            clearTimeout(timer);
+            const error = url.searchParams.get('error');
+            if (error) {
+                respond(res, 400, `Sign-in failed: ${error}`);
+                return reject(new Error(`sign-in failed: ${url.searchParams.get('error_description') || error}`));
+            }
+            if (url.searchParams.get('state') !== state) {
+                respond(res, 400, 'Sign-in failed: state mismatch.');
+                return reject(new Error('sign-in failed: state parameter did not match'));
+            }
+            const code = url.searchParams.get('code');
+            if (!code) {
+                respond(res, 400, 'Sign-in failed: no authorization code.');
+                return reject(new Error('sign-in failed: no authorization code in the callback'));
+            }
+            respond(res, 200, 'Signed in. You can close this tab and return to the terminal.');
+            resolve(code);
+        });
+        server.on('error', reject);
+    });
+}
+// Device authorization: the user finishes the flow on another device while this
+// process polls. `interval` and the slow_down response are honoured, because
+// Dex will reject a client that ignores them.
+//
+// PKCE is required here as well as on the browser flow — Dex rejects a device
+// request without it — even though the device flow's own security does not
+// depend on it.
+async function deviceFlow(config, opts) {
+    const endpoint = config.device_authorization_endpoint
+        ?? `${opts.issuer.replace(/\/+$/, '')}/device/code`;
+    const verifier = base64url(CRYPTO.randomBytes(32));
+    const challenge = base64url(CRYPTO.createHash('sha256').update(verifier).digest());
+    const res = await fetch(endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: opts.clientID,
+            scope: DEFAULT_SCOPE,
+            code_challenge: challenge,
+            code_challenge_method: 'S256',
+        }).toString(),
+    });
+    if (!res.ok) {
+        const detail = await res.text().catch(() => '');
+        throw new Error(`device authorization failed: ${res.status} ${detail || res.statusText}`);
+    }
+    const grant = await res.json();
+    opts.log(`  open ${grant.verification_uri_complete ?? grant.verification_uri}`);
+    if (grant.user_code)
+        opts.log(`  and enter the code: ${grant.user_code}`);
+    const deadline = Date.now() + (grant.expires_in ?? 600) * 1000;
+    let interval = (grant.interval ?? 5) * 1000;
+    for (;;) {
+        await sleep(interval);
+        if (Date.now() > deadline)
+            throw new Error('device sign-in expired before it was approved');
+        try {
+            return await exchange(config, {
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: grant.device_code,
+                client_id: opts.clientID,
+                code_verifier: verifier,
+            });
+        }
+        catch (err) {
+            // These two are the flow working as designed: still waiting for the
+            // user, or told to back off. Anything else is a real failure.
+            const oauthError = err.oauthError;
+            if (oauthError === 'authorization_pending')
+                continue;
+            if (oauthError === 'slow_down') {
+                interval += 5000;
+                continue;
+            }
+            throw err;
+        }
+    }
+}
+// Token endpoint exchange, shared by both interactive flows. Dex treats
+// `sigstore` as a public client, so the empty client_secret is what it expects
+// rather than an omission.
+async function exchange(config, params) {
+    const res = await fetch(config.token_endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ client_secret: '', ...params }).toString(),
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+        throw Object.assign(new Error(`token exchange failed: ${body.error_description || body.error || res.statusText}`), { oauthError: body.error });
+    }
+    if (!body.id_token)
+        throw new Error('token exchange returned no id_token');
+    return body.id_token;
+}
+function listen() {
+    const server = HTTP.createServer();
+    server.listen(0, '127.0.0.1');
+    return once(server, 'listening').then(() => {
+        const address = server.address();
+        if (!address || typeof address === 'string')
+            throw new Error('loopback server did not bind a port');
+        return { server, port: address.port };
+    });
+}
+function respond(res, status, message) {
+    res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end(`${message}\n`);
+}
+// Whether launching a browser is plausible. A headless Linux box has no
+// DISPLAY, and an SSH session should not try to open one on the far end — in
+// both cases the device flow is the honest answer.
+function canOpenBrowser() {
+    if (process.env['BUNDLE_NO_BROWSER'])
+        return false;
+    if (process.env['SSH_CONNECTION'] || process.env['SSH_TTY'])
+        return false;
+    if (process.platform === 'darwin' || process.platform === 'win32')
+        return true;
+    return Boolean(process.env['DISPLAY'] || process.env['WAYLAND_DISPLAY']);
+}
+// Best effort: if this fails the URL has already been printed, and the flow
+// still completes when the user opens it themselves.
+//
+// Windows goes through the URL protocol handler directly rather than
+// `cmd /c start`: cmd would read every `&` in the query string as a command
+// separator, run the pieces after it, and open a truncated URL.
+function openBrowser(url) {
+    const [cmd, ...args] = process.platform === 'darwin' ? ['open', url]
+        : process.platform === 'win32' ? ['rundll32', 'url.dll,FileProtocolHandler', url]
+            : ['xdg-open', url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => { }).unref();
+    }
+    catch {
+        // ignored — the URL is on screen
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => { setTimeout(resolve, ms); });
+}
+function base64url(buf) {
+    return buf.toString('base64url');
+}
+// A connector URL, said the way a person would.
+function label(connector) {
+    if (!connector)
+        return '';
+    const name = Object.keys(CONNECTORS).find((key) => CONNECTORS[key] === connector);
+    return name ? `${name} ` : '';
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2DAA2D;AAC3D,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,QAAQ;AACR,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,6EAA6E;AAC7E,oEAAoE;AACpE,oEAAoE;AACpE,wEAAwE;AACxE,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,yDAAyD;AAEzD,MAAM,CAAC,MAAM,cAAc,GAAG,kCAAkC,CAAC;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAC5C,MAAM,aAAa,GAAG,cAAc,CAAC;AA4BrC,gFAAgF;AAChF,8EAA8E;AAC9E,wEAAwE;AACxE,2EAA2E;AAC3E,8EAA8E;AAC9E,MAAM,UAAU,GAA2B;IACvC,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE,mCAAmC;CACjD,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAwB;IAChD,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAO,GAAyB,EAAE;IAClE,MAAM,IAAI,GAAG;QACT,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc;QACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,iBAAiB;QAC/C,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;QACrD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,eAAe;QAC7C,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;KACjF,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;IAEpC,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAErE,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAyB,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI;IAChB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;AACjH,CAAC;AAgBD,+DAA+D;AAC/D,EAAE;AACF,iBAAiB;AACjB,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,KAAK,UAAU,OAAO,CAAC,QAAgB;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAE,CAAC,CAAC;IAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QACzB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,EAAE;KACxF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAwB,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,4EAA4E;AAC5E,8BAA8B;AAC9B,KAAK,UAAU,QAAQ,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACrG,OAAO,MAAM,GAAG,CAAC,IAAI,EAAgB,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,6BAA6B;AAC7B,KAAK,UAAU,WAAW,CAAC,MAAkB,EAAE,IAAqB;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,oBAAoB,IAAI,gBAAgB,CAAC;IAC1D,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACzD,SAAS,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;YACnC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,QAAQ;YACtB,cAAc,EAAE,SAAS;YACzB,qBAAqB,EAAE,MAAM;YAC7B,KAAK;YACL,KAAK;YACL,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEd,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;QAC5D,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE;YAC1B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,QAAQ;SAC1B,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QACP,MAAM,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,SAAS,SAAS,CAAC,MAAmB,EAAE,KAAa;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;QAC/E,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;QACf,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAEhB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB;gBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACR,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,KAAK,EAAE,CAAC,CAAC;gBAC9C,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;gBACrD,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACR,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAC;gBAC5D,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,+DAA+D,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,8CAA8C;AAC9C,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,gBAAgB;AAChB,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,IAAqB;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,6BAA6B;WAC9C,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC;IACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAEnF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACtB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAE,aAAa;YACpB,cAAc,EAAE,SAAS;YACzB,qBAAqB,EAAE,MAAM;SAChC,CAAC,CAAC,QAAQ,EAAE;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAG3B,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,yBAAyB,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,yBAAyB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,SAAS,CAAC;QACN,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC5F,IAAI,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE;gBAC1B,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,QAAQ;aAC1B,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,oEAAoE;YACpE,8DAA8D;YAC9D,MAAM,UAAU,GAAI,GAA+B,CAAC,UAAU,CAAC;YAC/D,IAAI,UAAU,KAAK,uBAAuB;gBAAE,SAAS;YACrD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;gBAAC,QAAQ,IAAI,IAAI,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC/D,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,+EAA+E;AAC/E,2BAA2B;AAC3B,KAAK,UAAU,QAAQ,CAAC,MAAkB,EAAE,MAA8B;IACtE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAsE,CAAC;IACrH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,EAC7G,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,MAAM;IACX,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACpG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,OAAO,CAAC,GAAwB,EAAE,MAAc,EAAE,OAAe;IACtE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,wEAAwE;AACxE,6EAA6E;AAC7E,mDAAmD;AACnD,SAAS,cAAc;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,4EAA4E;AAC5E,qDAAqD;AACrD,EAAE;AACF,qEAAqE;AACrE,4EAA4E;AAC5E,gEAAgE;AAChE,SAAS,WAAW,CAAC,GAAW;IAC5B,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;QAChE,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,6BAA6B,EAAE,GAAG,CAAC;YACjF,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC;QACD,KAAK,CAAC,GAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACL,iCAAiC;IACrC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,gDAAgD;AAChD,SAAS,KAAK,CAAC,SAA6B;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC"}

package/dist/preload.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Load a sibling module of `from` by base name, with whichever extension the
+ * caller is currently running as — `.ts` straight from source (node strips the
+ * types), `.js` once compiled.
+ */
+export declare function sibling<T>(from: string, name: string): T;
+/**
+ * Run a preload's registration, translating the one failure worth explaining:
+ * `node:vfs` only exists under `--experimental-vfs`, and without it every one
+ * of these modules is unloadable for a reason the raw error does not make
+ * obvious.
+ */
+export declare function preload(register: () => void): void;
+//# sourceMappingURL=preload.d.ts.map

package/dist/preload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preload.d.ts","sourceRoot":"","sources":["../src/preload.ts"],"names":[],"mappings":"AAaA;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAWlD"}

package/dist/preload.js

@@ -0,0 +1,38 @@
+import { createRequire } from 'node:module';
+// Shared plumbing for the two `-r` preloads.
+//
+// A preload has to load synchronously — `node -r` uses the CommonJS loader, and
+// a module with a top-level `await` in it is rejected outright — so the sibling
+// it pulls in is `require()`d rather than imported. That also puts the load
+// inside a `try`, which is the point: both preloads want a missing `node:vfs`
+// to be said in words rather than raised as a builtin-module error from deep
+// inside node's startup.
+const require = createRequire(import.meta.url);
+/**
+ * Load a sibling module of `from` by base name, with whichever extension the
+ * caller is currently running as — `.ts` straight from source (node strips the
+ * types), `.js` once compiled.
+ */
+export function sibling(from, name) {
+    return require(`./${name}${from.endsWith('.ts') ? '.ts' : '.js'}`);
+}
+/**
+ * Run a preload's registration, translating the one failure worth explaining:
+ * `node:vfs` only exists under `--experimental-vfs`, and without it every one
+ * of these modules is unloadable for a reason the raw error does not make
+ * obvious.
+ */
+export function preload(register) {
+    try {
+        register();
+    }
+    catch (err) {
+        const code = err?.code;
+        const text = err instanceof Error ? err.message : String(err);
+        if ((code === 'ERR_UNKNOWN_BUILTIN_MODULE' || code === 'MODULE_NOT_FOUND') && /node:vfs/.test(text)) {
+            throw new Error('bundle: node:vfs is unavailable — run node with --experimental-vfs', { cause: err });
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=preload.js.map

package/dist/preload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preload.js","sourceRoot":"","sources":["../src/preload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,6CAA6C;AAC7C,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yBAAyB;AAEzB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAI,IAAY,EAAE,IAAY;IACjD,OAAO,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAM,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,QAAoB;IACxC,IAAI,CAAC;QACD,QAAQ,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,KAAK,4BAA4B,IAAI,IAAI,KAAK,kBAAkB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,oEAAoE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC"}

package/dist/provider.d.ts

@@ -0,0 +1,83 @@
+import * as VFS from 'node:vfs';
+import * as ZLIB from 'node:zlib';
+import * as FS from 'node:fs';
+export declare const EXTENSION = ".bundle";
+export interface ProviderOptions {
+    /** File suffixes claimed outright (default: ['.bundle']). */
+    extensions?: string[] | undefined;
+    /**
+     * Also claim any file carrying our signature marker, whatever it is named
+     * (default: true). This is what keeps a renamed archive from falling
+     * through to the built-in ZIP provider, which checks nothing.
+     */
+    claimSigned?: boolean | undefined;
+    /**
+     * Extra trusted roots, as PEM text or paths to PEM files (default: the
+     * `BUNDLE_ROOTS` environment variable, a path-delimiter-separated list).
+     */
+    roots?: string[] | undefined;
+    /**
+     * Accept a good signature whose chain is not anchored in the trust store
+     * (default: the `BUNDLE_ALLOW_UNTRUSTED` environment variable).
+     */
+    allowUntrusted?: boolean | undefined;
+    /**
+     * Recompute every member digest at mount instead of on fetch
+     * (default: false — fetches check them anyway).
+     */
+    deep?: boolean | undefined;
+    /** Require this sigstore signing identity (default: `BUNDLE_IDENTITY`). */
+    identity?: string | undefined;
+    /** Require this sigstore OIDC issuer (default: `BUNDLE_ISSUER`). */
+    issuer?: string | undefined;
+    /** Path to the sigstore trust root (default: `BUNDLE_SIGSTORE_ROOT`). */
+    trustedRoot?: string | undefined;
+    /** Identifier reported in diagnostics (default: 'bundle'). */
+    name?: string | undefined;
+}
+interface Settings {
+    [kSettings]: true;
+    name: string;
+    extensions: string[];
+    claimSigned: boolean;
+    extraRoots: string[];
+    allowUntrusted: boolean;
+    deep: boolean;
+    identity: string | undefined;
+    issuer: string | undefined;
+    trustedRoot: string | undefined;
+}
+/**
+ * Verify `path` and return a provider that serves it, or throw. `options` are
+ * the same as `register()`'s.
+ */
+export declare function open(path: string, options?: ProviderOptions | Settings): BundleProvider;
+/**
+ * Register this provider with `node:vfs` so the `--vfs-load` startup flag
+ * selects it for signed archives. Meant to be preloaded, before `--vfs-load`
+ * picks a provider:
+ *
+ *   node --experimental-vfs -r @pipobscure/bundle/register --vfs-load=app.bundle
+ */
+export declare function register(options?: ProviderOptions): Settings;
+/**
+ * A read-only `ZipProvider` that will not hand out a member's content until
+ * that content has been hashed and matched against the digest recorded for it.
+ */
+export declare class BundleProvider extends VFS.ZipProvider {
+    #private;
+    /**
+     * `digests` is the member-name -> hex-digest map from a `verifySync()` of
+     * this very archive; `hashAlg` the algorithm those digests are in.
+     */
+    constructor(archive: ZLIB.ZipFile, { hashAlg, digests }?: {
+        hashAlg?: string | undefined;
+        digests?: Map<string, string> | undefined;
+    });
+    get readonly(): boolean;
+    open(path: string, flags?: string | number, mode?: number): Promise<FS.promises.FileHandle>;
+    openSync(path: string, flags?: string | number, mode?: number): number;
+}
+declare const kSettings: unique symbol;
+export {};
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AA4B9B,eAAO,MAAM,SAAS,YAAY,CAAC;AAKnC,MAAM,WAAW,eAAe;IAC5B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,UAAU,QAAQ;IACd,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,GAAG,cAAc,CAoBvF;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAQ5D;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,GAAG,CAAC,WAAW;;IAM/C;;;OAGG;IACH,YAAY,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,OAAkB,EAAE,OAAmC,EAAE,GAAE;QAC5F,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;KACxC,EAeL;IAKD,IAAa,QAAQ,IAAI,OAAO,CAAiB;IAElC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,mCAIvE;IAEQ,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,UAIrE;CA4BJ;AAiCD,QAAA,MAAM,SAAS,EAAE,OAAO,MAAkC,CAAC"}