@synopackageland/cli 0.1.0

package/dist/publish/curated-release.js

@@ -0,0 +1,693 @@
+import { createHash, createPublicKey } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { decodeJwt, decodeProtectedHeader, importJWK, importPKCS8, importSPKI, jwtVerify, } from "jose";
+import { buildImmutableAttestationKey, buildImmutableSpkKey, } from "@synopackageland/package-source/index-manifest";
+import { createR2CuratedReleasePublisher, publishCuratedRelease, } from "@synopackageland/package-source/publish-spk";
+import { digestAppPackageClaims, digestCuratedReleaseClaims, normalizeCapabilities, signCuratedAppPackageAttestationToken, signCuratedReleaseAttestationToken, } from "../attestation/app-package.js";
+import { CuratedTrustRootError, loadCuratedTrustRoot, resolveCuratedSigningTrust, } from "../attestation/keyring.js";
+import { loadContract } from "../contract/load.js";
+import { loadCompose } from "../compose/analyze.js";
+import { EMBEDDED_ATTESTATION_RELATIVE_PATH, buildSpk, extractSpk, } from "../build-spk/generator.js";
+import { findProjectRoot } from "../discovery.js";
+import { validateProject } from "../validate.js";
+export const CURATED_ATTESTATION_PRIVATE_JWK_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_PRIVATE_JWK";
+export const CURATED_ATTESTATION_PRIVATE_PKCS8_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_PRIVATE_PKCS8";
+export const CURATED_ATTESTATION_KID_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KID";
+export { CURATED_ATTESTATION_KEYRING_ENV, CURATED_ATTESTATION_KEYRING_PATH_ENV } from "../attestation/keyring.js";
+export class CuratedReleaseError extends Error {
+    code;
+    constructor(code, message = code) {
+        super(message);
+        this.code = code;
+        this.name = "CuratedReleaseError";
+    }
+}
+/**
+ * The release-only Compose gate. Development Compose may use tags and build:;
+ * a trusted release may contain neither and every service must pin a digest.
+ */
+export function validateCuratedCompose(compose) {
+    const errors = [];
+    const services = compose.services;
+    if (!services || Object.keys(services).length === 0) {
+        return { ok: false, errors: ["CURATED_COMPOSE_SERVICES_REQUIRED"] };
+    }
+    for (const [serviceName, service] of Object.entries(services)) {
+        const path = `services.${serviceName}`;
+        if (Object.prototype.hasOwnProperty.call(service, "build")) {
+            errors.push(`CURATED_COMPOSE_BUILD_FORBIDDEN:${path}.build`);
+        }
+        if (typeof service.image !== "string" || service.image.trim().length === 0) {
+            errors.push(`CURATED_COMPOSE_IMAGE_REQUIRED:${path}.image`);
+        }
+        else if (!isPublicOciDigest(service.image)) {
+            errors.push(`CURATED_COMPOSE_IMAGE_DIGEST_REQUIRED:${path}.image`);
+        }
+    }
+    return { ok: errors.length === 0, errors };
+}
+export function isPublicOciDigest(image) {
+    const trimmed = image.trim();
+    const at = trimmed.lastIndexOf("@");
+    if (at <= 0 || at === trimmed.length - 1 || /\s/.test(trimmed)) {
+        return false;
+    }
+    const name = trimmed.slice(0, at);
+    const digest = trimmed.slice(at + 1);
+    if (!/^sha256:[a-f0-9]{64}$/.test(digest)) {
+        return false;
+    }
+    if (name.includes("://") ||
+        name.includes("$") ||
+        name.includes("\\") ||
+        name.startsWith("/") ||
+        name.endsWith("/") ||
+        name.split("/").some((part) => part.length === 0)) {
+        return false;
+    }
+    const registry = name.includes("/") ? name.split("/")[0] ?? "" : "";
+    if (registry === "localhost" ||
+        registry.startsWith("127.") ||
+        registry.startsWith("0.0.0.0") ||
+        registry === "[::1]" ||
+        registry.endsWith(".local")) {
+        return false;
+    }
+    return /^[a-z0-9][a-z0-9._:/-]*$/.test(name);
+}
+/** Execute the trusted dual-envelope release state machine for one allocated Build. */
+export async function releaseCurated(options) {
+    let packageIdentity;
+    try {
+        const prepared = prepareRelease(options.project, options.build);
+        packageIdentity = prepared.packageIdentity;
+        const contractDigest = digestFile(options.project.contractPath);
+        const bundleDigest = digestReleaseBundle(options.project);
+        const capabilities = collectCapabilities(prepared.contract, prepared.compose);
+        const embeddedInput = {
+            packageIdentity,
+            packageVersion: prepared.version,
+            packageBuild: options.build,
+            contractDigest,
+            bundleDigest,
+            capabilities,
+        };
+        // This token deliberately contains no final archive digest. It must exist
+        // before the SPK is built because it is itself part of that archive.
+        let embedded;
+        try {
+            embedded = await options.signer.sign(embeddedInput);
+        }
+        catch (error) {
+            if (error instanceof CuratedReleaseError) {
+                throw error;
+            }
+            throw new CuratedReleaseError("CURATED_ATTESTATION_BINDING_FAILED");
+        }
+        assertEmbeddedAttestation(embedded, embeddedInput);
+        await verifySignedToken(options.signer, embedded.token, "embedded");
+        const workspace = mkdtempSync(join(tmpdir(), "synopkgland-curated-release-"));
+        try {
+            const releaseProject = copyReleaseProject(options.project, workspace, packageIdentity);
+            const outputPath = join(workspace, `${packageIdentity}.spk`);
+            const buildFn = options.buildSpk ?? buildSpk;
+            const built = await buildFn({
+                project: releaseProject,
+                outputPath,
+                packageIdentity,
+                displayname: prepared.displayname,
+                spkVersion: prepared.version,
+                embeddedAttestationToken: embedded.token,
+            });
+            if (!built.ok || !built.outputPath) {
+                throw new CuratedReleaseError("CURATED_BUILD_FAILED");
+            }
+            await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
+            const artifact = digestArtifact(built.outputPath);
+            if (!options.signer.signRelease) {
+                throw new CuratedReleaseError("CURATED_RELEASE_SIGNER_MISSING");
+            }
+            const detachedInput = {
+                packageIdentity,
+                packageVersion: prepared.version,
+                packageBuild: options.build,
+                artifactDigest: artifact.sha256,
+                embeddedAttestationDigest: embedded.attestationDigest,
+            };
+            let detached;
+            try {
+                detached = await options.signer.signRelease(detachedInput);
+            }
+            catch (error) {
+                if (error instanceof CuratedReleaseError) {
+                    throw error;
+                }
+                throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
+            }
+            assertDetachedAttestation(detached, detachedInput);
+            await verifySignedToken(options.signer, detached.token, "release");
+            const artifactKey = buildImmutableSpkKey({
+                package: packageIdentity,
+                version: prepared.version,
+                sha256: artifact.sha256,
+            });
+            const attestationKey = buildImmutableAttestationKey({
+                package: packageIdentity,
+                version: prepared.version,
+                artifactDigest: artifact.sha256,
+            });
+            const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
+            if (!options.signer.verificationJwk) {
+                throw new CuratedReleaseError("CURATED_ATTESTATION_SIGNATURE_INVALID");
+            }
+            const attestation = {
+                packageId: packageIdentity,
+                version: prepared.version,
+                packageBuild: options.build,
+                artifactDigest: artifact.sha256,
+                embeddedAttestationDigest: embedded.attestationDigest,
+                key: attestationKey,
+                token: detached.token,
+                digest: detached.attestationDigest,
+                tokenSha256,
+                verificationJwk: options.signer.verificationJwk,
+            };
+            const index = {
+                packageId: packageIdentity,
+                version: prepared.version,
+                displayname: prepared.displayname,
+                description: prepared.description,
+                ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
+                osMinVer: prepared.osMinVer,
+                artifact: {
+                    key: artifactKey,
+                    size: artifact.size,
+                    md5: artifact.md5,
+                    sha256: artifact.sha256,
+                },
+                attestation: {
+                    key: attestationKey,
+                    digest: detached.attestationDigest,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
+                },
+            };
+            // This is the only transition to external publication. Both tokens have
+            // been claim-checked, signature-checked when the signer supplies a key,
+            // and the embedded token was read back from the final SPK first.
+            await publishCuratedRelease({
+                artifact: {
+                    packageId: packageIdentity,
+                    version: prepared.version,
+                    path: built.outputPath,
+                    key: artifactKey,
+                    size: artifact.size,
+                    md5: artifact.md5,
+                    sha256: artifact.sha256,
+                },
+                attestation,
+                index,
+            }, options.publisher);
+            return {
+                packageIdentity,
+                packageBuild: options.build,
+                version: prepared.version,
+                artifactKey,
+                artifactDigest: artifact.sha256,
+                attestationKey,
+                embeddedAttestationDigest: embedded.attestationDigest,
+                attestationDigest: detached.attestationDigest,
+            };
+        }
+        finally {
+            rmSync(workspace, { recursive: true, force: true });
+        }
+    }
+    catch (error) {
+        if (packageIdentity && options.ledger && isValidBuild(options.build)) {
+            try {
+                options.ledger.markPublishFailed(packageIdentity, options.build);
+            }
+            catch {
+                // The allocated number remains consumed even if failure bookkeeping
+                // itself is unavailable. Never hide the release failure or allocate again.
+            }
+        }
+        throw error;
+    }
+}
+export const runCuratedRelease = releaseCurated;
+export async function createCuratedAttestationSignerFromEnv(env = process.env) {
+    const jwkRaw = env[CURATED_ATTESTATION_PRIVATE_JWK_ENV]?.trim();
+    const pkcs8Raw = env[CURATED_ATTESTATION_PRIVATE_PKCS8_ENV]?.trim();
+    const kidFromEnv = env[CURATED_ATTESTATION_KID_ENV]?.trim();
+    if (!jwkRaw && !pkcs8Raw) {
+        throw new CuratedReleaseError("CURATED_SIGNING_MATERIAL_MISSING");
+    }
+    if (jwkRaw && pkcs8Raw) {
+        throw new CuratedReleaseError("CURATED_SIGNING_MATERIAL_AMBIGUOUS");
+    }
+    try {
+        const loaded = jwkRaw
+            ? await loadJwkSigningMaterial(jwkRaw, kidFromEnv)
+            : await loadPkcs8SigningMaterial(pkcs8Raw, kidFromEnv);
+        const trustRoot = await loadCuratedTrustRoot(env);
+        const trustPublicKey = await resolveCuratedSigningTrust(trustRoot, loaded.signingKey.kid, loaded.publicJwk);
+        const trustEntry = trustRoot.keys.find((entry) => entry.kid === loaded.signingKey.kid);
+        if (!trustEntry) {
+            throw new CuratedReleaseError("CURATED_SIGNING_KEY_UNKNOWN");
+        }
+        return {
+            sign: async (input) => signCuratedAppPackageAttestationToken(input, loaded.signingKey),
+            signRelease: async (input) => signCuratedReleaseAttestationToken(input, loaded.signingKey),
+            verify: async (token, kind) => {
+                const result = await jwtVerify(token, trustPublicKey, {
+                    algorithms: ["RS256"],
+                    issuer: "synopkgland-curated",
+                });
+                if (result.protectedHeader.alg !== "RS256" ||
+                    result.protectedHeader.typ !== "JWT" ||
+                    result.protectedHeader.kid !== loaded.signingKey.kid ||
+                    result.payload.typ !==
+                        (kind === "embedded" ? "app-package-attestation" : "curated-release-attestation")) {
+                    throw new Error("attestation signature envelope mismatch");
+                }
+            },
+            verificationJwk: trustEntry.publicJwk,
+        };
+    }
+    catch (error) {
+        if (error instanceof CuratedReleaseError) {
+            throw error;
+        }
+        if (error instanceof CuratedTrustRootError) {
+            throw new CuratedReleaseError(error.code, error.message);
+        }
+        throw new CuratedReleaseError("CURATED_SIGNING_MATERIAL_INVALID");
+    }
+}
+export async function runCuratedReleaseCli(argv = process.argv, env = process.env) {
+    if (argv[2] !== "release" || !argv[3] || !argv[4] || argv.length > 5) {
+        process.stderr.write("CURATED_RELEASE_USAGE\n");
+        return 1;
+    }
+    try {
+        const build = parseBuild(argv[4]);
+        const signer = await createCuratedAttestationSignerFromEnv(env);
+        const projectPath = resolve(process.cwd(), argv[3]);
+        const project = findProjectRoot(projectPath);
+        if (!project) {
+            throw new CuratedReleaseError("CURATED_APP_NOT_FOUND");
+        }
+        const result = await releaseCurated({
+            project,
+            build,
+            signer,
+            publisher: createR2CuratedReleasePublisher(),
+        });
+        process.stdout.write(`${JSON.stringify({
+            packageIdentity: result.packageIdentity,
+            packageBuild: result.packageBuild,
+            version: result.version,
+            artifactDigest: result.artifactDigest,
+            embeddedAttestationDigest: result.embeddedAttestationDigest,
+            attestationDigest: result.attestationDigest,
+        })}\n`);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof CuratedReleaseError ? error.code : "CURATED_RELEASE_FAILED"}\n`);
+        return 1;
+    }
+}
+function prepareRelease(project, build) {
+    const parsed = loadContract(project.contractPath);
+    const contract = parsed.contract;
+    const packageIdentity = typeof contract.package === "string" ? contract.package.trim() : "";
+    if (!packageIdentity) {
+        throw new CuratedReleaseError("CURATED_PACKAGE_IDENTITY_REQUIRED");
+    }
+    if (packageIdentity.endsWith(".dev")) {
+        throw new CuratedReleaseError("CURATED_DEVELOPMENT_IDENTITY_FORBIDDEN");
+    }
+    if (basename(project.root) !== packageIdentity) {
+        throw new CuratedReleaseError("CURATED_PACKAGE_DIRECTORY_MISMATCH");
+    }
+    if (!isValidBuild(build)) {
+        throw new CuratedReleaseError("CURATED_BUILD_INVALID");
+    }
+    const appVersion = typeof contract.version === "string" ? contract.version.trim() : "";
+    if (!appVersion) {
+        throw new CuratedReleaseError("CURATED_APP_VERSION_REQUIRED");
+    }
+    if (/-\d+$/.test(appVersion)) {
+        throw new CuratedReleaseError("CURATED_BUILD_MUST_NOT_BE_IN_SOURCE_VERSION");
+    }
+    const version = `${appVersion}-${String(build).padStart(4, "0")}`;
+    const validation = validateProject(project, { profile: "listing" });
+    if (!validation.ok) {
+        throw new CuratedReleaseError("CURATED_VALIDATION_FAILED", validation.errors.map((error) => error.code).join(","));
+    }
+    const parsedCompose = loadCompose(project.composePath);
+    if (!parsedCompose) {
+        throw new CuratedReleaseError("CURATED_COMPOSE_MISSING");
+    }
+    const composeGate = validateCuratedCompose(parsedCompose.compose);
+    if (!composeGate.ok) {
+        throw new CuratedReleaseError("CURATED_COMPOSE_GATE_FAILED", composeGate.errors.join(","));
+    }
+    return {
+        contract,
+        compose: parsedCompose.compose,
+        packageIdentity,
+        version,
+        displayname: String(contract.displayname),
+        description: String(contract.description),
+        maintainer: typeof contract.maintainer === "string" ? contract.maintainer : undefined,
+        osMinVer: String(contract.os_min_ver),
+    };
+}
+function copyReleaseProject(source, workspace, packageIdentity) {
+    const root = join(workspace, packageIdentity);
+    mkdirSync(root, { recursive: true });
+    const contractPath = join(root, "synology-app.yaml");
+    const composePath = join(root, "compose.yaml");
+    writeFileSync(contractPath, readFileSync(source.contractPath));
+    writeFileSync(composePath, readFileSync(source.composePath));
+    for (const name of ["icon.png", "README.md", "html"]) {
+        const sourcePath = join(source.root, name);
+        if (existsSync(sourcePath)) {
+            cpSync(sourcePath, join(root, name), { recursive: true });
+        }
+    }
+    return { root, contractPath, composePath };
+}
+function digestArtifact(path) {
+    const bytes = readFileSync(path);
+    return {
+        size: bytes.byteLength,
+        md5: digestBytes(bytes, "md5"),
+        sha256: digestBytes(bytes),
+    };
+}
+function digestFile(path) {
+    return digestBytes(readFileSync(path));
+}
+/**
+ * Canonical App Bundle digest. Only the three declared bundle areas are
+ * included; archive metadata and presentation files can never affect it.
+ */
+export function digestReleaseBundle(project) {
+    const files = [];
+    for (const name of ["compose.yaml", "synology-app.yaml"]) {
+        if (!existsSync(join(project.root, name)) || !statSync(join(project.root, name)).isFile()) {
+            throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", name);
+        }
+        files.push(name);
+    }
+    const htmlRoot = join(project.root, "html");
+    if (existsSync(htmlRoot)) {
+        collectBundleFiles(htmlRoot, "html", files);
+    }
+    files.sort();
+    const hash = createHash("sha256");
+    for (const relative of files) {
+        hash.update(relative, "utf8");
+        hash.update(Buffer.from([0]));
+        hash.update(readFileSync(join(project.root, relative)));
+        hash.update(Buffer.from([0]));
+    }
+    return hash.digest("hex");
+}
+function collectBundleFiles(root, relativeRoot, files) {
+    for (const name of readdirSync(root).sort()) {
+        const absolute = join(root, name);
+        const relative = `${relativeRoot}/${name}`;
+        const stat = statSync(absolute);
+        if (stat.isDirectory()) {
+            collectBundleFiles(absolute, relative, files);
+        }
+        else if (stat.isFile()) {
+            files.push(relative);
+        }
+    }
+}
+function collectCapabilities(contract, compose) {
+    const capabilities = [];
+    const files = contract.permissions?.files;
+    for (const name of ["read", "write", "delete"]) {
+        if (files?.[name] === true) {
+            capabilities.push(`files.${name}`);
+        }
+    }
+    const identity = contract.integration?.identity;
+    if (identity?.mode === "broker-managed") {
+        capabilities.push("identity");
+    }
+    for (const [name, parameter] of Object.entries(contract.install ?? {})) {
+        if (parameter && typeof parameter === "object" && typeof parameter.type === "string") {
+            capabilities.push(`install.${name}:${parameter.type}`);
+        }
+    }
+    if (Object.values(compose.services ?? {}).some((service) => service.privileged === true)) {
+        capabilities.push("compose.privileged");
+    }
+    return normalizeCapabilities(capabilities);
+}
+function assertEmbeddedAttestation(signed, expected) {
+    if (!signed.token || !signed.attestationDigest) {
+        throw new CuratedReleaseError("CURATED_ATTESTATION_BINDING_FAILED");
+    }
+    try {
+        assertProtectedHeader(signed.token);
+        const payload = decodeJwt(signed.token);
+        const rawCapabilities = readStringArray(payload.capabilities);
+        const capabilities = normalizeCapabilities(rawCapabilities);
+        const expectedCapabilities = normalizeCapabilities(expected.capabilities);
+        if (payload.typ !== "app-package-attestation" ||
+            payload.version !== 2 ||
+            payload.iss !== "synopkgland-curated" ||
+            payload.sub !== expected.packageIdentity ||
+            payload.packageIdentity !== expected.packageIdentity ||
+            payload.packageVersion !== expected.packageVersion ||
+            payload.packageBuild !== expected.packageBuild ||
+            payload.contractDigest !== expected.contractDigest ||
+            payload.bundleDigest !== expected.bundleDigest ||
+            JSON.stringify(rawCapabilities) !== JSON.stringify(capabilities) ||
+            JSON.stringify(capabilities) !== JSON.stringify(expectedCapabilities) ||
+            Object.prototype.hasOwnProperty.call(payload, "artifactDigest") ||
+            !isCanonicalIssuedAt(payload.issuedAt) ||
+            new Date(String(payload.issuedAt)).getTime() > Date.now() ||
+            payload.jti !== signed.attestationDigest) {
+            throw new Error("embedded claims do not bind release");
+        }
+        const claims = {
+            typ: "app-package-attestation",
+            version: 2,
+            packageIdentity: String(payload.packageIdentity),
+            packageVersion: String(payload.packageVersion),
+            packageBuild: Number(payload.packageBuild),
+            contractDigest: String(payload.contractDigest),
+            bundleDigest: String(payload.bundleDigest),
+            capabilities,
+            issuedAt: String(payload.issuedAt),
+        };
+        if (digestAppPackageClaims(claims) !== signed.attestationDigest) {
+            throw new Error("embedded attestation digest does not match claims");
+        }
+    }
+    catch {
+        throw new CuratedReleaseError("CURATED_ATTESTATION_BINDING_FAILED");
+    }
+}
+function assertDetachedAttestation(signed, expected) {
+    if (!signed.token || !signed.attestationDigest) {
+        throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
+    }
+    try {
+        assertProtectedHeader(signed.token);
+        const payload = decodeJwt(signed.token);
+        if (payload.typ !== "curated-release-attestation" ||
+            payload.version !== 1 ||
+            payload.iss !== "synopkgland-curated" ||
+            payload.sub !== expected.packageIdentity ||
+            payload.packageIdentity !== expected.packageIdentity ||
+            payload.packageVersion !== expected.packageVersion ||
+            payload.packageBuild !== expected.packageBuild ||
+            payload.artifactDigest !== expected.artifactDigest ||
+            payload.embeddedAttestationDigest !== expected.embeddedAttestationDigest ||
+            !isCanonicalIssuedAt(payload.issuedAt) ||
+            new Date(String(payload.issuedAt)).getTime() > Date.now() ||
+            payload.jti !== signed.attestationDigest) {
+            throw new Error("detached claims do not bind release");
+        }
+        const claims = {
+            typ: "curated-release-attestation",
+            version: 1,
+            packageIdentity: String(payload.packageIdentity),
+            packageVersion: String(payload.packageVersion),
+            packageBuild: Number(payload.packageBuild),
+            artifactDigest: String(payload.artifactDigest),
+            embeddedAttestationDigest: String(payload.embeddedAttestationDigest),
+            issuedAt: String(payload.issuedAt),
+        };
+        if (digestCuratedReleaseClaims(claims) !== signed.attestationDigest) {
+            throw new Error("detached attestation digest does not match claims");
+        }
+    }
+    catch {
+        throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
+    }
+}
+function assertProtectedHeader(token) {
+    const header = decodeProtectedHeader(token);
+    if (header.alg !== "RS256" ||
+        header.typ !== "JWT" ||
+        typeof header.kid !== "string" ||
+        header.kid.length === 0) {
+        throw new Error("attestation protected header is invalid");
+    }
+}
+async function assertEmbeddedAttestationInSpk(spkPath, expectedToken, expectedInput, signer) {
+    const staging = mkdtempSync(join(tmpdir(), "synopkgland-curated-attestation-check-"));
+    try {
+        try {
+            await extractSpk(spkPath, staging);
+        }
+        catch {
+            throw new CuratedReleaseError("CURATED_EMBEDDED_ATTESTATION_MISSING");
+        }
+        const path = join(staging, "package", EMBEDDED_ATTESTATION_RELATIVE_PATH);
+        if (!existsSync(path) || !statSync(path).isFile()) {
+            throw new CuratedReleaseError("CURATED_EMBEDDED_ATTESTATION_MISSING");
+        }
+        const token = readFileSync(path, "utf8");
+        if (token !== expectedToken) {
+            throw new CuratedReleaseError("CURATED_EMBEDDED_ATTESTATION_BINDING_FAILED");
+        }
+        const signed = {
+            token,
+            attestationDigest: decodeJwt(token).jti ?? "",
+        };
+        assertEmbeddedAttestation(signed, expectedInput);
+        await verifySignedToken(signer, token, "embedded");
+    }
+    finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}
+async function verifySignedToken(signer, token, kind) {
+    if (!signer.verify) {
+        throw new CuratedReleaseError("CURATED_ATTESTATION_SIGNATURE_INVALID");
+    }
+    try {
+        await signer.verify(token, kind);
+    }
+    catch {
+        throw new CuratedReleaseError("CURATED_ATTESTATION_SIGNATURE_INVALID");
+    }
+}
+function readStringArray(value) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+        throw new Error("attestation capabilities must be strings");
+    }
+    return value;
+}
+function isCanonicalIssuedAt(value) {
+    if (typeof value !== "string" ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) {
+        return false;
+    }
+    const date = new Date(value);
+    return Number.isFinite(date.getTime()) && date.toISOString() === value;
+}
+function digestBytes(bytes, algorithm = "sha256") {
+    return createHash(algorithm).update(bytes).digest("hex");
+}
+function parseBuild(value) {
+    if (!/^\d+$/.test(value)) {
+        throw new CuratedReleaseError("CURATED_BUILD_INVALID");
+    }
+    const build = Number(value);
+    if (!isValidBuild(build)) {
+        throw new CuratedReleaseError("CURATED_BUILD_INVALID");
+    }
+    return build;
+}
+function isValidBuild(build) {
+    return Number.isSafeInteger(build) && build > 0;
+}
+async function loadJwkSigningMaterial(raw, kidFromEnv) {
+    const parsed = JSON.parse(raw);
+    const privateJwk = parsed.privateJwk ?? parsed;
+    const kid = kidFromEnv ?? parsed.kid ?? privateJwk.kid;
+    if (typeof kid !== "string" || kid.length === 0 || !privateJwk.d) {
+        throw new Error("invalid private JWK");
+    }
+    if (kidFromEnv && parsed.kid && parsed.kid !== kidFromEnv) {
+        throw new Error("private JWK kid does not match custody kid");
+    }
+    if (privateJwk.kid && privateJwk.kid !== kid) {
+        throw new Error("private JWK kid does not match custody kid");
+    }
+    if (privateJwk.kty !== "RSA" || privateJwk.alg !== "RS256") {
+        throw new Error("private signing material must be an RSA RS256 JWK");
+    }
+    if (typeof privateJwk.n !== "string" ||
+        typeof privateJwk.e !== "string") {
+        throw new Error("private signing material did not produce a public RSA key");
+    }
+    const privateKey = (await importJWK({ ...privateJwk, kid }, "RS256"));
+    const publicJwk = {
+        kty: privateJwk.kty,
+        n: privateJwk.n,
+        e: privateJwk.e,
+        alg: "RS256",
+        use: "sig",
+        kid,
+    };
+    const suppliedPublicJwk = parsed.publicJwk;
+    if (suppliedPublicJwk &&
+        (suppliedPublicJwk.kty !== publicJwk.kty ||
+            suppliedPublicJwk.n !== publicJwk.n ||
+            suppliedPublicJwk.e !== publicJwk.e)) {
+        throw new Error("private and public signing material do not match");
+    }
+    return {
+        signingKey: {
+            kid,
+            privateKey,
+        },
+        publicKey: (await importJWK(publicJwk, "RS256")),
+        publicJwk,
+    };
+}
+async function loadPkcs8SigningMaterial(raw, kid) {
+    if (!kid) {
+        throw new Error("missing kid");
+    }
+    const encoded = raw.includes("BEGIN") ? raw : Buffer.from(raw, "base64").toString("utf8");
+    const privateKey = await importPKCS8(encoded, "RS256");
+    const publicKeyObject = createPublicKey(encoded);
+    const publicJwk = {
+        ...publicKeyObject.export({ format: "jwk" }),
+        alg: "RS256",
+        use: "sig",
+        kid,
+    };
+    const publicPem = publicKeyObject.export({ type: "spki", format: "pem" }).toString();
+    const publicKey = await importSPKI(publicPem, "RS256");
+    return { signingKey: { kid, privateKey }, publicKey, publicJwk };
+}
+function isMainModule() {
+    return process.argv[1] !== undefined && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+}
+if (isMainModule()) {
+    runCuratedReleaseCli().then((status) => {
+        process.exitCode = status;
+    });
+}