@synopackageland/cli 0.3.10 → 0.4.1

package/dist/publish/curated-release.js

@@ -1,883 +0,0 @@
-import { createHash, createPublicKey } from "node:crypto";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { decodeJwt, decodeProtectedHeader, importJWK, importPKCS8, importSPKI, jwtVerify, } from "jose";
-import { CURATED_BUILD_OFFSET, buildImmutableAttestationKey, buildImmutableSpkKey, } from "@synopackageland/package-source/index-manifest";
-import { createR2CuratedReleasePublisher, publishCuratedRelease, } from "@synopackageland/package-source/publish-spk";
-import { digestAppPackageClaims, digestCuratedReleaseClaims, normalizeCapabilities, signCuratedAppPackageAttestationToken, signCuratedReleaseAttestationToken, } from "../attestation/app-package.js";
-import { CuratedTrustRootError, loadCuratedTrustRoot, resolveCuratedSigningTrust, } from "../attestation/keyring.js";
-import { loadContract } from "../contract/load.js";
-import { classifyComposeRoute, loadCompose } from "../compose/analyze.js";
-import { loadNative } from "../native/load.js";
-import { infoArchValue, isNativeArchFamily } from "../build-spk/dsm-arch.js";
-import { EMBEDDED_ATTESTATION_RELATIVE_PATH, buildSpk, extractSpk, } from "../build-spk/generator.js";
-import { findProjectRoot } from "../discovery.js";
-import { validateProject } from "../validate.js";
-export const CURATED_ATTESTATION_PRIVATE_JWK_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_PRIVATE_JWK";
-export const CURATED_ATTESTATION_PRIVATE_PKCS8_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_PRIVATE_PKCS8";
-export const CURATED_ATTESTATION_KID_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KID";
-export { CURATED_ATTESTATION_KEYRING_ENV, CURATED_ATTESTATION_KEYRING_PATH_ENV } from "../attestation/keyring.js";
-export class CuratedReleaseError extends Error {
-    code;
-    constructor(code, message = code) {
-        super(message);
-        this.code = code;
-        this.name = "CuratedReleaseError";
-    }
-}
-/**
- * The release-only Compose gate. Development Compose may use tags and build:;
- * a trusted release may contain neither and every service must pin a digest.
- */
-export function validateCuratedCompose(compose) {
-    const errors = [];
-    const services = compose.services;
-    if (!services || Object.keys(services).length === 0) {
-        return { ok: false, errors: ["CURATED_COMPOSE_SERVICES_REQUIRED"] };
-    }
-    for (const [serviceName, service] of Object.entries(services)) {
-        const path = `services.${serviceName}`;
-        if (Object.prototype.hasOwnProperty.call(service, "build")) {
-            errors.push(`CURATED_COMPOSE_BUILD_FORBIDDEN:${path}.build`);
-        }
-        if (typeof service.image !== "string" || service.image.trim().length === 0) {
-            errors.push(`CURATED_COMPOSE_IMAGE_REQUIRED:${path}.image`);
-        }
-        else if (!isPublicOciDigest(service.image)) {
-            errors.push(`CURATED_COMPOSE_IMAGE_DIGEST_REQUIRED:${path}.image`);
-        }
-    }
-    return { ok: errors.length === 0, errors };
-}
-export function isPublicOciDigest(image) {
-    const trimmed = image.trim();
-    const at = trimmed.lastIndexOf("@");
-    if (at <= 0 || at === trimmed.length - 1 || /\s/.test(trimmed)) {
-        return false;
-    }
-    const name = trimmed.slice(0, at);
-    const digest = trimmed.slice(at + 1);
-    if (!/^sha256:[a-f0-9]{64}$/.test(digest)) {
-        return false;
-    }
-    if (name.includes("://") ||
-        name.includes("$") ||
-        name.includes("\\") ||
-        name.startsWith("/") ||
-        name.endsWith("/") ||
-        name.split("/").some((part) => part.length === 0)) {
-        return false;
-    }
-    const registry = name.includes("/") ? name.split("/")[0] ?? "" : "";
-    if (registry === "localhost" ||
-        registry.startsWith("127.") ||
-        registry.startsWith("0.0.0.0") ||
-        registry === "[::1]" ||
-        registry.endsWith(".local")) {
-        return false;
-    }
-    return /^[a-z0-9][a-z0-9._:/-]*$/.test(name);
-}
-/** Execute the trusted dual-envelope release state machine for one allocated Build. */
-export async function releaseCurated(options) {
-    let packageIdentity;
-    try {
-        const prepared = prepareRelease(options.project, options.build);
-        packageIdentity = prepared.packageIdentity;
-        const contractDigest = digestFile(options.project.contractPath);
-        const bundleDigest = digestReleaseBundle(options.project);
-        const capabilities = collectCapabilities(prepared.contract, prepared.compose);
-        const embeddedInput = {
-            packageIdentity,
-            packageVersion: prepared.version,
-            packageBuild: options.build,
-            contractDigest,
-            bundleDigest,
-            capabilities,
-        };
-        // This token deliberately contains no final archive digest. It must exist
-        // before the SPK is built because it is itself part of that archive.
-        let embedded;
-        try {
-            embedded = await options.signer.sign(embeddedInput);
-        }
-        catch (error) {
-            if (error instanceof CuratedReleaseError) {
-                throw error;
-            }
-            throw new CuratedReleaseError("CURATED_ATTESTATION_BINDING_FAILED");
-        }
-        assertEmbeddedAttestation(embedded, embeddedInput);
-        await verifySignedToken(options.signer, embedded.token, "embedded");
-        const workspace = mkdtempSync(join(tmpdir(), "synopkgland-curated-release-"));
-        try {
-            const releaseProject = copyReleaseProject(options.project, workspace, packageIdentity);
-            const buildFn = options.buildSpk ?? buildSpk;
-            if (!options.signer.signRelease) {
-                throw new CuratedReleaseError("CURATED_RELEASE_SIGNER_MISSING");
-            }
-            if (!options.signer.verificationJwk) {
-                throw new CuratedReleaseError("CURATED_ATTESTATION_SIGNATURE_INVALID");
-            }
-            if (!prepared.isNative) {
-                // Compose single-artifact release
-                const outputPath = join(workspace, `${packageIdentity}.spk`);
-                const built = await buildFn({
-                    project: releaseProject,
-                    outputPath,
-                    packageIdentity,
-                    displayname: prepared.displayname,
-                    spkVersion: prepared.version,
-                    embeddedAttestationToken: embedded.token,
-                });
-                if (!built.ok || !built.outputPath) {
-                    throw new CuratedReleaseError("CURATED_BUILD_FAILED");
-                }
-                await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
-                const artifact = digestArtifact(built.outputPath);
-                const detachedInput = {
-                    packageIdentity,
-                    packageVersion: prepared.version,
-                    packageBuild: options.build,
-                    artifactDigest: artifact.sha256,
-                    embeddedAttestationDigest: embedded.attestationDigest,
-                };
-                let detached;
-                try {
-                    detached = await options.signer.signRelease(detachedInput);
-                }
-                catch (error) {
-                    if (error instanceof CuratedReleaseError) {
-                        throw error;
-                    }
-                    throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
-                }
-                assertDetachedAttestation(detached, detachedInput);
-                await verifySignedToken(options.signer, detached.token, "release");
-                const artifactKey = buildImmutableSpkKey({
-                    package: packageIdentity,
-                    version: prepared.version,
-                    sha256: artifact.sha256,
-                });
-                const attestationKey = buildImmutableAttestationKey({
-                    package: packageIdentity,
-                    version: prepared.version,
-                    artifactDigest: artifact.sha256,
-                });
-                const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
-                const attestation = {
-                    packageId: packageIdentity,
-                    version: prepared.version,
-                    packageBuild: options.build,
-                    artifactDigest: artifact.sha256,
-                    embeddedAttestationDigest: embedded.attestationDigest,
-                    key: attestationKey,
-                    token: detached.token,
-                    digest: detached.attestationDigest,
-                    tokenSha256,
-                    verificationJwk: options.signer.verificationJwk,
-                };
-                const index = {
-                    packageId: packageIdentity,
-                    version: prepared.version,
-                    displayname: prepared.displayname,
-                    description: prepared.description,
-                    ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
-                    osMinVer: prepared.osMinVer,
-                    artifact: {
-                        key: artifactKey,
-                        size: artifact.size,
-                        md5: artifact.md5,
-                        sha256: artifact.sha256,
-                    },
-                    attestation: {
-                        key: attestationKey,
-                        digest: detached.attestationDigest,
-                        packageBuild: options.build,
-                        artifactDigest: artifact.sha256,
-                        embeddedAttestationDigest: embedded.attestationDigest,
-                    },
-                };
-                // This is the only transition to external publication. Both tokens have
-                // been claim-checked, signature-checked when the signer supplies a key,
-                // and the embedded token was read back from the final SPK first.
-                await publishCuratedRelease({
-                    artifact: {
-                        packageId: packageIdentity,
-                        version: prepared.version,
-                        path: built.outputPath,
-                        key: artifactKey,
-                        size: artifact.size,
-                        md5: artifact.md5,
-                        sha256: artifact.sha256,
-                    },
-                    attestation,
-                    index,
-                }, options.publisher);
-                return {
-                    packageIdentity,
-                    packageBuild: options.build,
-                    version: prepared.version,
-                    artifactKey,
-                    artifactDigest: artifact.sha256,
-                    attestationKey,
-                    embeddedAttestationDigest: embedded.attestationDigest,
-                    attestationDigest: detached.attestationDigest,
-                };
-            }
-            // Native multi-arch release (1 Build -> N artifacts)
-            const targetFamilies = Object.keys(prepared.native?.targets ?? {}).filter(isNativeArchFamily);
-            if (targetFamilies.length === 0) {
-                throw new CuratedReleaseError("CURATED_NATIVE_TARGETS_EMPTY");
-            }
-            const builtArches = [];
-            for (const family of targetFamilies) {
-                const outputPath = join(workspace, `${packageIdentity}-${family}.spk`);
-                const built = await buildFn({
-                    project: releaseProject,
-                    outputPath,
-                    packageIdentity,
-                    displayname: prepared.displayname,
-                    spkVersion: prepared.version,
-                    embeddedAttestationToken: embedded.token,
-                    archFamily: family,
-                });
-                if (!built.ok || !built.outputPath) {
-                    throw new CuratedReleaseError("CURATED_BUILD_FAILED");
-                }
-                await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
-                const artifact = digestArtifact(built.outputPath);
-                const detachedInput = {
-                    packageIdentity,
-                    packageVersion: prepared.version,
-                    packageBuild: options.build,
-                    artifactDigest: artifact.sha256,
-                    embeddedAttestationDigest: embedded.attestationDigest,
-                };
-                let detached;
-                try {
-                    detached = await options.signer.signRelease(detachedInput);
-                }
-                catch (error) {
-                    if (error instanceof CuratedReleaseError) {
-                        throw error;
-                    }
-                    throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
-                }
-                assertDetachedAttestation(detached, detachedInput);
-                await verifySignedToken(options.signer, detached.token, "release");
-                const artifactKey = buildImmutableSpkKey({
-                    package: packageIdentity,
-                    version: prepared.version,
-                    sha256: artifact.sha256,
-                });
-                const attestationKey = buildImmutableAttestationKey({
-                    package: packageIdentity,
-                    version: prepared.version,
-                    artifactDigest: artifact.sha256,
-                });
-                const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
-                const releaseArtifact = {
-                    packageId: packageIdentity,
-                    version: prepared.version,
-                    path: built.outputPath,
-                    key: artifactKey,
-                    size: artifact.size,
-                    md5: artifact.md5,
-                    sha256: artifact.sha256,
-                };
-                const releaseAttestation = {
-                    packageId: packageIdentity,
-                    version: prepared.version,
-                    packageBuild: options.build,
-                    artifactDigest: artifact.sha256,
-                    embeddedAttestationDigest: embedded.attestationDigest,
-                    key: attestationKey,
-                    token: detached.token,
-                    digest: detached.attestationDigest,
-                    tokenSha256,
-                    verificationJwk: options.signer.verificationJwk,
-                };
-                const archPlatforms = infoArchValue(family).split(" ");
-                const archArtifact = {
-                    key: artifactKey,
-                    size: artifact.size,
-                    md5: artifact.md5,
-                    sha256: artifact.sha256,
-                    arch: archPlatforms,
-                    attestation: {
-                        key: attestationKey,
-                        digest: detached.attestationDigest,
-                        packageBuild: options.build,
-                        artifactDigest: artifact.sha256,
-                        embeddedAttestationDigest: embedded.attestationDigest,
-                    },
-                };
-                builtArches.push({
-                    family,
-                    outputPath: built.outputPath,
-                    artifact,
-                    artifactKey,
-                    attestationKey,
-                    detached,
-                    tokenSha256,
-                    releaseArtifact,
-                    releaseAttestation,
-                    archArtifact,
-                });
-            }
-            const primary = builtArches[0];
-            const allArchs = targetFamilies.flatMap((family) => infoArchValue(family).split(" "));
-            const indexPayload = {
-                packageId: packageIdentity,
-                version: prepared.version,
-                displayname: prepared.displayname,
-                description: prepared.description,
-                ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
-                osMinVer: prepared.osMinVer,
-                arch: allArchs,
-                artifact: {
-                    key: primary.artifactKey,
-                    size: primary.artifact.size,
-                    md5: primary.artifact.md5,
-                    sha256: primary.artifact.sha256,
-                },
-                attestation: {
-                    key: primary.attestationKey,
-                    digest: primary.detached.attestationDigest,
-                    packageBuild: options.build,
-                    artifactDigest: primary.artifact.sha256,
-                    embeddedAttestationDigest: embedded.attestationDigest,
-                },
-                artifacts: builtArches.map((item) => item.archArtifact),
-            };
-            // 5. Publication order: all artifacts -> all detached attestations -> index
-            for (const item of builtArches) {
-                await options.publisher.uploadArtifact(item.releaseArtifact);
-            }
-            for (const item of builtArches) {
-                await options.publisher.uploadAttestation(item.releaseAttestation);
-            }
-            await options.publisher.updateIndex(indexPayload);
-            return {
-                packageIdentity,
-                packageBuild: options.build,
-                version: prepared.version,
-                artifactKey: primary.artifactKey,
-                artifactDigest: primary.artifact.sha256,
-                attestationKey: primary.attestationKey,
-                embeddedAttestationDigest: embedded.attestationDigest,
-                attestationDigest: primary.detached.attestationDigest,
-            };
-        }
-        finally {
-            rmSync(workspace, { recursive: true, force: true });
-        }
-    }
-    catch (error) {
-        if (packageIdentity && options.ledger && isValidBuild(options.build)) {
-            try {
-                options.ledger.markPublishFailed(packageIdentity, options.build);
-            }
-            catch {
-                // The allocated number remains consumed even if failure bookkeeping
-                // itself is unavailable. Never hide the release failure or allocate again.
-            }
-        }
-        throw error;
-    }
-}
-export const runCuratedRelease = releaseCurated;
-export async function createCuratedAttestationSignerFromEnv(env = process.env) {
-    const jwkRaw = env[CURATED_ATTESTATION_PRIVATE_JWK_ENV]?.trim();
-    const pkcs8Raw = env[CURATED_ATTESTATION_PRIVATE_PKCS8_ENV]?.trim();
-    const kidFromEnv = env[CURATED_ATTESTATION_KID_ENV]?.trim();
-    if (!jwkRaw && !pkcs8Raw) {
-        throw new CuratedReleaseError("CURATED_SIGNING_MATERIAL_MISSING");
-    }
-    if (jwkRaw && pkcs8Raw) {
-        throw new CuratedReleaseError("CURATED_SIGNING_MATERIAL_AMBIGUOUS");
-    }
-    try {
-        const loaded = jwkRaw
-            ? await loadJwkSigningMaterial(jwkRaw, kidFromEnv)
-            : await loadPkcs8SigningMaterial(pkcs8Raw, kidFromEnv);
-        const trustRoot = await loadCuratedTrustRoot(env);
-        const trustPublicKey = await resolveCuratedSigningTrust(trustRoot, loaded.signingKey.kid, loaded.publicJwk);
-        const trustEntry = trustRoot.keys.find((entry) => entry.kid === loaded.signingKey.kid);
-        if (!trustEntry) {
-            throw new CuratedReleaseError("CURATED_SIGNING_KEY_UNKNOWN");
-        }
-        return {
-            sign: async (input) => signCuratedAppPackageAttestationToken(input, loaded.signingKey),
-            signRelease: async (input) => signCuratedReleaseAttestationToken(input, loaded.signingKey),
-            verify: async (token, kind) => {
-                const result = await jwtVerify(token, trustPublicKey, {
-                    algorithms: ["RS256"],
-                    issuer: "synopkgland-curated",
-                });
-                if (result.protectedHeader.alg !== "RS256" ||
-                    result.protectedHeader.typ !== "JWT" ||
-                    result.protectedHeader.kid !== loaded.signingKey.kid ||
-                    result.payload.typ !==
-                        (kind === "embedded" ? "app-package-attestation" : "curated-release-attestation")) {
-                    throw new Error("attestation signature envelope mismatch");
-                }
-            },
-            verificationJwk: trustEntry.publicJwk,
-        };
-    }
-    catch (error) {
-        if (error instanceof CuratedReleaseError) {
-            throw error;
-        }
-        if (error instanceof CuratedTrustRootError) {
-            throw new CuratedReleaseError(error.code, error.message);
-        }
-        throw new CuratedReleaseError("CURATED_SIGNING_MATERIAL_INVALID");
-    }
-}
-export async function runCuratedReleaseCli(argv = process.argv, env = process.env) {
-    if (argv[2] !== "release" || !argv[3] || !argv[4] || argv.length > 5) {
-        process.stderr.write("CURATED_RELEASE_USAGE\n");
-        return 1;
-    }
-    try {
-        const build = parseBuild(argv[4]);
-        const signer = await createCuratedAttestationSignerFromEnv(env);
-        const projectPath = resolve(process.cwd(), argv[3]);
-        const project = findProjectRoot(projectPath);
-        if (!project) {
-            throw new CuratedReleaseError("CURATED_APP_NOT_FOUND");
-        }
-        const result = await releaseCurated({
-            project,
-            build,
-            signer,
-            publisher: createR2CuratedReleasePublisher(),
-        });
-        process.stdout.write(`${JSON.stringify({
-            packageIdentity: result.packageIdentity,
-            packageBuild: result.packageBuild,
-            version: result.version,
-            artifactDigest: result.artifactDigest,
-            embeddedAttestationDigest: result.embeddedAttestationDigest,
-            attestationDigest: result.attestationDigest,
-        })}\n`);
-        return 0;
-    }
-    catch (error) {
-        process.stderr.write(`${error instanceof CuratedReleaseError ? error.code : "CURATED_RELEASE_FAILED"}\n`);
-        return 1;
-    }
-}
-function prepareRelease(project, build) {
-    const parsed = loadContract(project.contractPath);
-    const contract = parsed.contract;
-    const packageIdentity = typeof contract.package === "string" ? contract.package.trim() : "";
-    if (!packageIdentity) {
-        throw new CuratedReleaseError("CURATED_PACKAGE_IDENTITY_REQUIRED");
-    }
-    if (packageIdentity.endsWith(".dev")) {
-        throw new CuratedReleaseError("CURATED_DEVELOPMENT_IDENTITY_FORBIDDEN");
-    }
-    if (basename(project.root) !== packageIdentity) {
-        throw new CuratedReleaseError("CURATED_PACKAGE_DIRECTORY_MISMATCH");
-    }
-    if (!isValidBuild(build)) {
-        throw new CuratedReleaseError("CURATED_BUILD_INVALID");
-    }
-    const appVersion = typeof contract.version === "string" ? contract.version.trim() : "";
-    if (!appVersion) {
-        throw new CuratedReleaseError("CURATED_APP_VERSION_REQUIRED");
-    }
-    if (/-\d+$/.test(appVersion)) {
-        throw new CuratedReleaseError("CURATED_BUILD_MUST_NOT_BE_IN_SOURCE_VERSION");
-    }
-    const version = `${appVersion}-${String(CURATED_BUILD_OFFSET + build).padStart(5, "0")}`;
-    const validation = validateProject(project, { profile: "listing" });
-    if (!validation.ok) {
-        throw new CuratedReleaseError("CURATED_VALIDATION_FAILED", validation.errors.map((error) => error.code).join(","));
-    }
-    const nativePath = project.nativePath ?? join(project.root, "native.yaml");
-    const isNative = existsSync(nativePath);
-    if (isNative) {
-        const parsedNative = loadNative(nativePath);
-        if (!parsedNative) {
-            throw new CuratedReleaseError("CURATED_NATIVE_MISSING");
-        }
-        return {
-            isNative: true,
-            contract,
-            native: parsedNative.native,
-            packageIdentity,
-            version,
-            displayname: String(contract.displayname),
-            description: String(contract.description),
-            maintainer: typeof contract.maintainer === "string" ? contract.maintainer : undefined,
-            osMinVer: String(contract.os_min_ver),
-        };
-    }
-    const parsedCompose = loadCompose(project.composePath);
-    if (!parsedCompose) {
-        throw new CuratedReleaseError("CURATED_COMPOSE_MISSING");
-    }
-    const route = classifyComposeRoute(contract, parsedCompose);
-    if (route.route === "broker-installer" && contract.adminport !== undefined) {
-        throw new CuratedReleaseError("CURATED_BROKER_ROUTE_FORBIDDEN");
-    }
-    const composeGate = validateCuratedCompose(parsedCompose.compose);
-    if (!composeGate.ok) {
-        throw new CuratedReleaseError("CURATED_COMPOSE_GATE_FAILED", composeGate.errors.join(","));
-    }
-    return {
-        isNative: false,
-        contract,
-        compose: parsedCompose.compose,
-        packageIdentity,
-        version,
-        displayname: String(contract.displayname),
-        description: String(contract.description),
-        maintainer: typeof contract.maintainer === "string" ? contract.maintainer : undefined,
-        osMinVer: String(contract.os_min_ver),
-    };
-}
-function copyReleaseProject(source, workspace, packageIdentity) {
-    const root = join(workspace, packageIdentity);
-    mkdirSync(root, { recursive: true });
-    const contractPath = join(root, "synology-app.yaml");
-    const composePath = join(root, "compose.yaml");
-    const nativePath = join(root, "native.yaml");
-    writeFileSync(contractPath, readFileSync(source.contractPath));
-    if (existsSync(source.composePath)) {
-        writeFileSync(composePath, readFileSync(source.composePath));
-    }
-    const srcNative = source.nativePath ?? join(source.root, "native.yaml");
-    if (existsSync(srcNative)) {
-        writeFileSync(nativePath, readFileSync(srcNative));
-    }
-    for (const name of ["icon.png", "README.md", "html"]) {
-        const sourcePath = join(source.root, name);
-        if (existsSync(sourcePath)) {
-            cpSync(sourcePath, join(root, name), { recursive: true });
-        }
-    }
-    return { root, contractPath, composePath, nativePath };
-}
-function digestArtifact(path) {
-    const bytes = readFileSync(path);
-    return {
-        size: bytes.byteLength,
-        md5: digestBytes(bytes, "md5"),
-        sha256: digestBytes(bytes),
-    };
-}
-function digestFile(path) {
-    return digestBytes(readFileSync(path));
-}
-/**
- * Canonical App Bundle digest. Only the three declared bundle areas are
- * included; archive metadata and presentation files can never affect it.
- */
-export function digestReleaseBundle(project) {
-    const files = [];
-    if (!existsSync(project.contractPath) || !statSync(project.contractPath).isFile()) {
-        throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", "synology-app.yaml");
-    }
-    files.push("synology-app.yaml");
-    const hasCompose = existsSync(project.composePath) && statSync(project.composePath).isFile();
-    const nativePath = project.nativePath ?? join(project.root, "native.yaml");
-    const hasNative = existsSync(nativePath) && statSync(nativePath).isFile();
-    if (!hasCompose && !hasNative) {
-        throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", "compose.yaml");
-    }
-    if (hasCompose) {
-        files.push("compose.yaml");
-    }
-    if (hasNative) {
-        files.push("native.yaml");
-    }
-    const htmlRoot = join(project.root, "html");
-    if (existsSync(htmlRoot)) {
-        collectBundleFiles(htmlRoot, "html", files);
-    }
-    files.sort();
-    const hash = createHash("sha256");
-    for (const relative of files) {
-        hash.update(relative, "utf8");
-        hash.update(Buffer.from([0]));
-        hash.update(readFileSync(join(project.root, relative)));
-        hash.update(Buffer.from([0]));
-    }
-    return hash.digest("hex");
-}
-function collectBundleFiles(root, relativeRoot, files) {
-    for (const name of readdirSync(root).sort()) {
-        const absolute = join(root, name);
-        const relative = `${relativeRoot}/${name}`;
-        const stat = statSync(absolute);
-        if (stat.isDirectory()) {
-            collectBundleFiles(absolute, relative, files);
-        }
-        else if (stat.isFile()) {
-            files.push(relative);
-        }
-    }
-}
-function collectCapabilities(contract, compose) {
-    const capabilities = [];
-    const files = contract.permissions?.files;
-    for (const name of ["read", "write", "delete"]) {
-        if (files?.[name] === true) {
-            capabilities.push(`files.${name}`);
-        }
-    }
-    const identity = contract.integration?.identity;
-    if (identity?.mode === "broker-managed") {
-        capabilities.push("identity");
-    }
-    for (const [name, parameter] of Object.entries(contract.install ?? {})) {
-        if (parameter && typeof parameter === "object" && typeof parameter.type === "string") {
-            capabilities.push(`install.${name}:${parameter.type}`);
-        }
-    }
-    if (compose && Object.values(compose.services ?? {}).some((service) => service.privileged === true)) {
-        capabilities.push("compose.privileged");
-    }
-    return normalizeCapabilities(capabilities);
-}
-function assertEmbeddedAttestation(signed, expected) {
-    if (!signed.token || !signed.attestationDigest) {
-        throw new CuratedReleaseError("CURATED_ATTESTATION_BINDING_FAILED");
-    }
-    try {
-        assertProtectedHeader(signed.token);
-        const payload = decodeJwt(signed.token);
-        const rawCapabilities = readStringArray(payload.capabilities);
-        const capabilities = normalizeCapabilities(rawCapabilities);
-        const expectedCapabilities = normalizeCapabilities(expected.capabilities);
-        if (payload.typ !== "app-package-attestation" ||
-            payload.version !== 2 ||
-            payload.iss !== "synopkgland-curated" ||
-            payload.sub !== expected.packageIdentity ||
-            payload.packageIdentity !== expected.packageIdentity ||
-            payload.packageVersion !== expected.packageVersion ||
-            payload.packageBuild !== expected.packageBuild ||
-            payload.contractDigest !== expected.contractDigest ||
-            payload.bundleDigest !== expected.bundleDigest ||
-            JSON.stringify(rawCapabilities) !== JSON.stringify(capabilities) ||
-            JSON.stringify(capabilities) !== JSON.stringify(expectedCapabilities) ||
-            Object.prototype.hasOwnProperty.call(payload, "artifactDigest") ||
-            !isCanonicalIssuedAt(payload.issuedAt) ||
-            new Date(String(payload.issuedAt)).getTime() > Date.now() ||
-            payload.jti !== signed.attestationDigest) {
-            throw new Error("embedded claims do not bind release");
-        }
-        const claims = {
-            typ: "app-package-attestation",
-            version: 2,
-            packageIdentity: String(payload.packageIdentity),
-            packageVersion: String(payload.packageVersion),
-            packageBuild: Number(payload.packageBuild),
-            contractDigest: String(payload.contractDigest),
-            bundleDigest: String(payload.bundleDigest),
-            capabilities,
-            issuedAt: String(payload.issuedAt),
-        };
-        if (digestAppPackageClaims(claims) !== signed.attestationDigest) {
-            throw new Error("embedded attestation digest does not match claims");
-        }
-    }
-    catch {
-        throw new CuratedReleaseError("CURATED_ATTESTATION_BINDING_FAILED");
-    }
-}
-function assertDetachedAttestation(signed, expected) {
-    if (!signed.token || !signed.attestationDigest) {
-        throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
-    }
-    try {
-        assertProtectedHeader(signed.token);
-        const payload = decodeJwt(signed.token);
-        if (payload.typ !== "curated-release-attestation" ||
-            payload.version !== 1 ||
-            payload.iss !== "synopkgland-curated" ||
-            payload.sub !== expected.packageIdentity ||
-            payload.packageIdentity !== expected.packageIdentity ||
-            payload.packageVersion !== expected.packageVersion ||
-            payload.packageBuild !== expected.packageBuild ||
-            payload.artifactDigest !== expected.artifactDigest ||
-            payload.embeddedAttestationDigest !== expected.embeddedAttestationDigest ||
-            !isCanonicalIssuedAt(payload.issuedAt) ||
-            new Date(String(payload.issuedAt)).getTime() > Date.now() ||
-            payload.jti !== signed.attestationDigest) {
-            throw new Error("detached claims do not bind release");
-        }
-        const claims = {
-            typ: "curated-release-attestation",
-            version: 1,
-            packageIdentity: String(payload.packageIdentity),
-            packageVersion: String(payload.packageVersion),
-            packageBuild: Number(payload.packageBuild),
-            artifactDigest: String(payload.artifactDigest),
-            embeddedAttestationDigest: String(payload.embeddedAttestationDigest),
-            issuedAt: String(payload.issuedAt),
-        };
-        if (digestCuratedReleaseClaims(claims) !== signed.attestationDigest) {
-            throw new Error("detached attestation digest does not match claims");
-        }
-    }
-    catch {
-        throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
-    }
-}
-function assertProtectedHeader(token) {
-    const header = decodeProtectedHeader(token);
-    if (header.alg !== "RS256" ||
-        header.typ !== "JWT" ||
-        typeof header.kid !== "string" ||
-        header.kid.length === 0) {
-        throw new Error("attestation protected header is invalid");
-    }
-}
-async function assertEmbeddedAttestationInSpk(spkPath, expectedToken, expectedInput, signer) {
-    const staging = mkdtempSync(join(tmpdir(), "synopkgland-curated-attestation-check-"));
-    try {
-        try {
-            await extractSpk(spkPath, staging);
-        }
-        catch {
-            throw new CuratedReleaseError("CURATED_EMBEDDED_ATTESTATION_MISSING");
-        }
-        const path = join(staging, "package", EMBEDDED_ATTESTATION_RELATIVE_PATH);
-        if (!existsSync(path) || !statSync(path).isFile()) {
-            throw new CuratedReleaseError("CURATED_EMBEDDED_ATTESTATION_MISSING");
-        }
-        const token = readFileSync(path, "utf8");
-        if (token !== expectedToken) {
-            throw new CuratedReleaseError("CURATED_EMBEDDED_ATTESTATION_BINDING_FAILED");
-        }
-        const signed = {
-            token,
-            attestationDigest: decodeJwt(token).jti ?? "",
-        };
-        assertEmbeddedAttestation(signed, expectedInput);
-        await verifySignedToken(signer, token, "embedded");
-    }
-    finally {
-        rmSync(staging, { recursive: true, force: true });
-    }
-}
-async function verifySignedToken(signer, token, kind) {
-    if (!signer.verify) {
-        throw new CuratedReleaseError("CURATED_ATTESTATION_SIGNATURE_INVALID");
-    }
-    try {
-        await signer.verify(token, kind);
-    }
-    catch {
-        throw new CuratedReleaseError("CURATED_ATTESTATION_SIGNATURE_INVALID");
-    }
-}
-function readStringArray(value) {
-    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
-        throw new Error("attestation capabilities must be strings");
-    }
-    return value;
-}
-function isCanonicalIssuedAt(value) {
-    if (typeof value !== "string" ||
-        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) {
-        return false;
-    }
-    const date = new Date(value);
-    return Number.isFinite(date.getTime()) && date.toISOString() === value;
-}
-function digestBytes(bytes, algorithm = "sha256") {
-    return createHash(algorithm).update(bytes).digest("hex");
-}
-function parseBuild(value) {
-    if (!/^\d+$/.test(value)) {
-        throw new CuratedReleaseError("CURATED_BUILD_INVALID");
-    }
-    const build = Number(value);
-    if (!isValidBuild(build)) {
-        throw new CuratedReleaseError("CURATED_BUILD_INVALID");
-    }
-    return build;
-}
-function isValidBuild(build) {
-    return Number.isSafeInteger(build) && build > 0 && build < CURATED_BUILD_OFFSET;
-}
-async function loadJwkSigningMaterial(raw, kidFromEnv) {
-    const parsed = JSON.parse(raw);
-    const privateJwk = parsed.privateJwk ?? parsed;
-    const kid = kidFromEnv ?? parsed.kid ?? privateJwk.kid;
-    if (typeof kid !== "string" || kid.length === 0 || !privateJwk.d) {
-        throw new Error("invalid private JWK");
-    }
-    if (kidFromEnv && parsed.kid && parsed.kid !== kidFromEnv) {
-        throw new Error("private JWK kid does not match custody kid");
-    }
-    if (privateJwk.kid && privateJwk.kid !== kid) {
-        throw new Error("private JWK kid does not match custody kid");
-    }
-    if (privateJwk.kty !== "RSA" || privateJwk.alg !== "RS256") {
-        throw new Error("private signing material must be an RSA RS256 JWK");
-    }
-    if (typeof privateJwk.n !== "string" ||
-        typeof privateJwk.e !== "string") {
-        throw new Error("private signing material did not produce a public RSA key");
-    }
-    const privateKey = (await importJWK({ ...privateJwk, kid }, "RS256"));
-    const publicJwk = {
-        kty: privateJwk.kty,
-        n: privateJwk.n,
-        e: privateJwk.e,
-        alg: "RS256",
-        use: "sig",
-        kid,
-    };
-    const suppliedPublicJwk = parsed.publicJwk;
-    if (suppliedPublicJwk &&
-        (suppliedPublicJwk.kty !== publicJwk.kty ||
-            suppliedPublicJwk.n !== publicJwk.n ||
-            suppliedPublicJwk.e !== publicJwk.e)) {
-        throw new Error("private and public signing material do not match");
-    }
-    return {
-        signingKey: {
-            kid,
-            privateKey,
-        },
-        publicKey: (await importJWK(publicJwk, "RS256")),
-        publicJwk,
-    };
-}
-async function loadPkcs8SigningMaterial(raw, kid) {
-    if (!kid) {
-        throw new Error("missing kid");
-    }
-    const encoded = raw.includes("BEGIN") ? raw : Buffer.from(raw, "base64").toString("utf8");
-    const privateKey = await importPKCS8(encoded, "RS256");
-    const publicKeyObject = createPublicKey(encoded);
-    const publicJwk = {
-        ...publicKeyObject.export({ format: "jwk" }),
-        alg: "RS256",
-        use: "sig",
-        kid,
-    };
-    const publicPem = publicKeyObject.export({ type: "spki", format: "pem" }).toString();
-    const publicKey = await importSPKI(publicPem, "RS256");
-    return { signingKey: { kid, privateKey }, publicKey, publicJwk };
-}
-function isMainModule() {
-    return process.argv[1] !== undefined && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
-}
-if (isMainModule()) {
-    runCuratedReleaseCli().then((status) => {
-        process.exitCode = status;
-    });
-}