@synopackageland/cli 0.3.9 → 0.4.0

package/templates/native-go-vue/frontend/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "native-dsm-vue-app", "private": true, "type": "module",
+  "scripts": {"build": "vue-tsc --noEmit && vite build", "test": "vitest run"},
+  "dependencies": {"@synopackageland/ui": "0.4.0", "vue": "3.5.43"},
+  "devDependencies": {"@vitejs/plugin-vue": "6.0.9", "vite": "7.3.6", "typescript": "5.9.3", "vue-tsc": "3.3.11", "vitest": "3.2.4", "jsdom": "26.1.0"}
+}

package/templates/native-go-vue/frontend/src/App.vue

@@ -0,0 +1,132 @@
+<script setup lang="ts">
+import {computed, onMounted, onUnmounted, ref} from 'vue'
+import {AppRoot, Button, Callout, Dialog, SettingsSection, Textarea} from '@synopackageland/ui'
+import {stateCopy, type AppStatus, type Context, type Status} from './context'
+const props = defineProps<{ctx: Context}>()
+const app = ref<AppStatus>()
+const status = ref<Status>()
+const busy = ref(false)
+const error = ref('')
+const notice = ref('')
+const disableOpen = ref(false)
+const id = ref('')
+const text = ref('')
+const identity = ref('')
+let disposed = false
+const refreshing = ref(false)
+let appCookie = ''
+const configured = computed(() => status.value?.reason !== "not-requested")
+const details = computed(() => status.value ? stateCopy[status.value.state] : undefined)
+function message(e: unknown) {
+ const code = (e as {code?: string})?.code || 'request_failed'
+ return ({session_required:'Your DSM session expired. Sign in again.',access_denied:'This sample belongs to another account.',integration_unavailable:'Integration is unavailable. Ask an administrator to activate or recover it.',personal_unavailable:'Sample storage is unavailable. Ask an administrator to check package data.',root_conflict:'A conflicting scheduler task exists. Ask an administrator to review it.',root_verify_failed:'Scheduler verification failed. Refresh and review the task.',root_run_failed:'The approved operation failed. Review integration status and cleanup.'} as Record<string,string>)[code] || `Request failed (${code}). Refresh and try again.`
+}
+async function refresh() {
+ if(disposed || refreshing.value) return
+ refreshing.value = true; error.value = ''
+ try {
+  const [a,s] = await Promise.all([props.ctx.call<AppStatus>('app.status'),props.ctx.call<Status>('integration.status')])
+  if(disposed) return
+  app.value = a; status.value = s
+  if(s.state !== 'ready') {id.value='';text.value='';return}
+  // Plain --ui vue has no personal routes; not-enabled status hides this.
+  const list = await props.ctx.call<{items:Array<{id:string;name:string}>}>('personal.list')
+  if(disposed) return
+  id.value = list.items[0]?.id || ''
+  if(id.value) {
+   const note = await props.ctx.call<{text:string}>('personal.read',{id:id.value})
+   if(!disposed) text.value = note.text
+  }
+ } catch(e) {if(!disposed) {error.value = message(e);status.value=undefined;id.value='';text.value=''}} finally {refreshing.value=false}
+}
+async function action(op: string) {
+ if(busy.value || refreshing.value || disposed) return
+ busy.value=true;error.value='';notice.value=''
+ try {
+  if(!props.ctx.root) throw {code:'unsupported'}
+  const approved = await props.ctx.root.authorize(op)
+  if(disposed) return
+  if(approved !== 'ready') {notice.value='Approval cancelled. No operation was run.';return}
+  await props.ctx.root.run(op)
+  if(disposed) return
+  notice.value='Operation completed. Integration status was checked again.'
+  await refresh()
+ } catch(e) {if(!disposed) {await refresh();if(!disposed) error.value=message(e)}}
+ finally {if(!disposed) busy.value=false}
+}
+async function save() {
+ if(busy.value || refreshing.value || !id.value || disposed) return
+ busy.value=true;error.value='';notice.value=''
+ try {await props.ctx.call('personal.write',{id:id.value,text:text.value});if(!disposed) notice.value='Your sample note was saved.'}
+ catch(e) {if(!disposed) error.value=message(e)} finally {if(!disposed) busy.value=false}
+}
+async function login() {
+ if(busy.value || refreshing.value || disposed) return
+ busy.value=true;error.value=''
+ try {
+  const result=await props.ctx.call<{cookie:string;user:string}>('identity.login')
+  if(!disposed){appCookie=result.cookie;identity.value=`App session for ${result.user}`}
+ } catch(e) {if(!disposed) error.value=message(e)} finally {if(!disposed) busy.value=false}
+}
+async function checkIdentity() {
+ if(busy.value || refreshing.value || disposed) return
+ busy.value=true;error.value=''
+ try {const result=await props.ctx.call<{user:string}>('identity.current',{cookie:appCookie});if(!disposed) identity.value=`App session for ${result.user}`}
+ catch(e) {if(!disposed) {appCookie='';identity.value='';error.value=message(e)}} finally {if(!disposed) busy.value=false}
+}
+const hasIdentity = ref(false)
+onMounted(async()=>{
+ props.ctx.reopen(()=>{if(!disposed) void refresh()})
+ await refresh()
+ if(disposed || !app.value) return
+ try {const result = await props.ctx.call<{mode:string}>('identity.status');if(!disposed) hasIdentity.value = result.mode==='better-auth'} catch { /* Optional route absent in Go-only. */ }
+})
+onUnmounted(()=>{disposed=true;appCookie='';text.value='';id.value=''})
+</script>
+
+<template>
+ <AppRoot modal-scope="app" style="height: 100%">
+  <main class="integration-app" :aria-busy="busy || refreshing" aria-label="Package settings">
+   <header class="integration-heading">
+    <div><h1>{{ app?.package || 'Package settings' }}</h1><p v-if="app">{{ app.user }} · {{ app.version }}</p></div>
+    <Button variant="secondary" :disabled="busy || refreshing" @click="error=''; refresh()">Refresh</Button>
+   </header>
+   <p v-if="refreshing" role="status">Refreshing status…</p>
+   <p v-else-if="busy" role="status">Completing operation…</p>
+   <Callout v-if="error" tone="danger" title="Action required"><span role="alert">{{ error }}</span></Callout>
+   <p v-if="notice" class="integration-notice" role="status">{{ notice }}</p>
+   <SettingsSection title="DSM integration" :collapsible="false">
+    <div v-if="status && details" :data-integration-state="status.state" class="integration-status" role="status">
+     <h2>{{ details.label }}</h2><p>{{ details.description }}</p>
+     <p v-if="status.cleanup === 'required'">Cleanup is required. Ask an administrator to run teardown or disable.</p>
+     <dl><dt>Package running</dt><dd>{{ status.packageRunning }}</dd><dt>Scheduler</dt><dd>{{ status.scheduler }}</dd></dl>
+    </div>
+    <p v-else-if="error" role="status">Status could not be loaded. Refresh to try again.</p>
+    <p v-else role="status">Loading integration status…</p>
+    <div v-if="app?.admin && ctx.root && configured" class="integration-actions">
+     <Button variant="primary" :disabled="busy || refreshing" @click="action('helper_enable')">Approve and activate</Button>
+     <Button variant="secondary" :disabled="busy || refreshing" @click="action('helper_recover')">Recover</Button>
+     <Button variant="secondary" :disabled="busy || refreshing" @click="action('helper_teardown')">Teardown</Button>
+     <Button variant="secondary" :disabled="busy || refreshing" @click="disableOpen=true">Disable</Button>
+    </div>
+    <Callout v-if="app && !app.admin && status?.state !== 'ready'" title="Administrator action needed">Ask a DSM administrator to open this package's settings. Your login cannot approve root operations.</Callout>
+   </SettingsSection>
+   <SettingsSection v-if="status?.state === 'ready'" title="My sample data" :collapsible="false">
+    <p class="integration-help">This synthetic note belongs to your DSM account and is stored in package data.</p>
+    <p v-if="refreshing" role="status">Loading your sample data…</p>
+    <Callout v-else-if="!id" title="No sample data">Refresh to request your sample data again.</Callout>
+    <label v-if="id" class="integration-field"><span>My sample note</span><Textarea v-model="text" aria-label="My sample note" :disabled="busy || refreshing" /></label>
+    <Button v-if="id" variant="primary" :disabled="busy || refreshing" @click="save">Save my note</Button>
+   </SettingsSection>
+   <SettingsSection v-if="hasIdentity" title="Optional app identity" :collapsible="false">
+    <p class="integration-help">Your DSM login is checked again for every app session request.</p>
+    <div class="integration-actions"><Button variant="primary" :disabled="busy || refreshing" @click="login">Create app session</Button><Button variant="secondary" :disabled="busy || refreshing || !identity" @click="checkIdentity">Check app session</Button></div>
+    <p v-if="identity" role="status">{{ identity }}</p>
+   </SettingsSection>
+   <Dialog v-model:open="disableOpen" title="Disable integration?" description="New integration requests will be refused before helper cleanup begins.">
+    <p>Your sample data and historical root output are retained. A failed cleanup remains visible.</p>
+    <template #footer><Button variant="secondary" @click="disableOpen=false">Cancel</Button><Button variant="danger" :disabled="busy || refreshing" @click="disableOpen=false; action('helper_disable')">Confirm disable</Button></template>
+   </Dialog>
+  </main>
+ </AppRoot>
+</template>

package/templates/native-go-vue/frontend/src/context.ts

@@ -0,0 +1,17 @@
+export type IntegrationState = 'not-enabled' | 'ready' | 'needs-approval' | 'incompatible' | 'stopped' | 'failed'
+export interface Status {state: IntegrationState; reason?: string; cleanup?: string; packageRunning: string; scheduler: string}
+export interface Context {
+ call<T = unknown>(method: string, params?: Record<string, unknown>): Promise<T>
+ reopen(fn: () => void): void
+ locale: string
+ root?: {state(op: string): Promise<string>; authorize(op: string): Promise<string>; run(op: string): Promise<unknown>; remove(op: string): Promise<string>}
+}
+export interface AppStatus {package: string; version: string; user: string; admin: boolean}
+export const stateCopy: Record<IntegrationState, {label: string; description: string}> = {
+ 'not-enabled': {label: 'Not enabled', description: 'An administrator can enable integration for this package.'},
+ ready: {label: 'Ready', description: 'The helper passed a fresh trusted health check.'},
+ 'needs-approval': {label: 'Approval required', description: 'Ask an administrator to approve and activate integration.'},
+ incompatible: {label: 'Incompatible', description: 'Inventory or trust checks failed. Ask an administrator to review this package.'},
+ stopped: {label: 'Stopped', description: 'An administrator must recover integration after start or reboot.'},
+ failed: {label: 'Failed', description: 'Integration could not finish. Review cleanup status before retrying.'},
+}

package/templates/native-go-vue/frontend/src/main.ts

@@ -0,0 +1,26 @@
+import {createApp} from 'vue'
+import App from './App.vue'
+import type {Context} from './context'
+import '@synopackageland/ui/themes/dsm7-embedded.css'
+import './style.css'
+
+let mountSequence = 0
+export function mount(root: HTMLElement, ctx: Context) {
+ const app = createApp(App, {ctx})
+ // Include the generated package ID, an instance counter and randomness even
+ // across separately loaded bundles. getRandomValues also works on DSM HTTP.
+ app.config.idPrefix = `__PACKAGE__-${++mountSequence}-${crypto.getRandomValues(new Uint32Array(4)).join('-')}`
+ const hadRootClass = root.classList.contains('dsmapp-vue-root')
+ root.classList.add('dsmapp-vue-root')
+ app.mount(root)
+ return {unmount() {app.unmount(); if(!hadRootClass) root.classList.remove('dsmapp-vue-root')}}
+}
+// Register with the existing per-package DSM window loader. Never share a
+// singleton app or user/session state between different mount calls.
+const script = document.currentScript as HTMLScriptElement | null
+const packageID = script?.getAttribute('data-package')
+const host = window as unknown as {DsmPackageApps: Record<string, {mount: typeof mount}>}
+if (packageID) {
+ host.DsmPackageApps = host.DsmPackageApps || {}
+ host.DsmPackageApps[packageID] = {mount}
+}

package/templates/native-go-vue/frontend/src/style.css

@@ -0,0 +1,14 @@
+.dsmapp-vue-root {height: 100%; min-height: 0; width: 100%; overflow: hidden;}
+[data-ui-app] .integration-app {padding: var(--ui-space-5, 20px); max-width: 72ch; color: var(--ui-text); font-family: var(--ui-font-sans); font-size: 13px; line-height: 1.5;}
+[data-ui-app] .integration-heading {display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 20px;}
+[data-ui-app] .integration-heading h1 {font-size: 20px; font-weight: 600; margin: 0;}
+[data-ui-app] .integration-heading p {color: var(--ui-text); margin: 4px 0 0;}
+[data-ui-app] .integration-app section {margin-top: 24px;}
+[data-ui-app] .integration-status h2 {font-size: 15px; font-weight: 600; margin: 0;}
+[data-ui-app] .integration-status p {margin: 6px 0;}
+[data-ui-app] .integration-status dl {display: grid; grid-template-columns: max-content 1fr; gap: 4px 16px; margin: 12px 0;}
+[data-ui-app] .integration-status dt, [data-ui-app] .integration-help {color: var(--ui-text);}
+[data-ui-app] .integration-status dd {margin: 0;}
+[data-ui-app] .integration-actions {display: flex; flex-wrap: wrap; gap: 8px; margin-top: 16px;}
+[data-ui-app] .integration-field {display: grid; gap: 6px; margin: 12px 0;}
+[data-ui-app] .integration-notice {color: var(--ui-text);}

package/templates/native-go-vue/frontend/test/apps.test.ts

@@ -0,0 +1,148 @@
+// @vitest-environment jsdom
+import {expect, test, vi} from 'vitest'
+import {nextTick} from 'vue'
+import {mount} from '../src/main'
+import type {Context, IntegrationState} from '../src/context'
+
+function fixture(id: string, admin: boolean, state: IntegrationState = 'ready') {
+ const reopen: Array<() => void> = []
+ const call = vi.fn(async (method: string) => {
+  if(method === 'app.status') return {package: id, version:'0.1.0-0001',user:admin?'admin':'normal1',admin}
+  if(method === 'integration.status') return {state,reason:'fixture',packageRunning:'unknown',scheduler:'not-probed'}
+  if(method === 'personal.list') return {items:[{id:`${id}-private`,name:'My sample note'}]}
+  if(method === 'personal.read') return {id:`${id}-private`,text:`Private ${id}`}
+  throw {code:'unknown_method'}
+ })
+ const ctx = {call,reopen:(fn:()=>void)=>reopen.push(fn),locale:'en',root:{state:vi.fn(async()=> 'missing'),authorize:vi.fn(async()=> 'ready'),run:vi.fn(async()=>{}),remove:vi.fn(async()=> 'missing')}} as Context
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,ctx)
+ return {root,app,ctx,call,reopen}
+}
+async function settle(){for(let i=0;i<12;i++){await Promise.resolve();await nextTick()}await new Promise(resolve=>setTimeout(resolve,25))}
+function click(root:HTMLElement,text:string){const node=[...root.querySelectorAll('button')].find(node=>node.textContent?.trim()===text);expect(node, text).toBeTruthy();node!.click()}
+
+test('six states and ordinary-user errors give actionable status without approval controls',async()=>{
+ for(const state of ['not-enabled','ready','needs-approval','incompatible','stopped','failed'] as IntegrationState[]){
+  const f=fixture('Ordinary',false,state);await settle()
+  expect(f.root.querySelector('[data-integration-state]')?.getAttribute('data-integration-state')).toBe(state)
+  expect(f.root.textContent).not.toContain('Approve and activate')
+  f.app.unmount();f.root.remove()
+ }
+})
+test('approval cancellation never runs the root task and all fixed controls recheck status',async()=>{
+ const f=fixture('Admin',true,'needs-approval');await settle()
+ f.ctx.root!.authorize=vi.fn(async()=> 'cancelled')
+ click(f.root,'Approve and activate');await settle()
+ expect(f.ctx.root!.run).not.toHaveBeenCalled()
+ expect(f.root.textContent).toContain('Approval cancelled')
+ f.ctx.root!.authorize=vi.fn(async()=> 'ready')
+ click(f.root,'Approve and activate');await settle()
+ expect(f.ctx.root!.run).toHaveBeenCalledWith('helper_enable')
+ for(const [label,op] of [['Recover','helper_recover'],['Teardown','helper_teardown']] as const){click(f.root,label);await settle();expect(f.ctx.root!.run).toHaveBeenCalledWith(op)}
+ click(f.root,'Disable');await settle();click(f.root,'Confirm disable');await settle();expect(f.ctx.root!.run).toHaveBeenCalledWith('helper_disable')
+ f.app.unmount();f.root.remove()
+})
+test('two generated package IDs keep mounts, reopen events, overlays and unmount independent',async()=>{
+ const a=fixture('M1bAlpha',true),b=fixture('M1bBeta',true);await settle()
+ expect(a.root.textContent).toContain('M1bAlpha');expect(a.root.textContent).not.toContain('M1bBeta')
+ expect(b.root.textContent).toContain('M1bBeta')
+ click(a.root,'Disable');await settle()
+ expect(a.root.querySelector('[role="dialog"]')).toBeTruthy()
+ expect(b.root.querySelector('[role="dialog"]')).toBeNull()
+ const ac=a.call.mock.calls.length,bc=b.call.mock.calls.length
+ a.reopen.forEach(fn=>fn());await settle();expect(a.call.mock.calls.length).toBeGreaterThan(ac);expect(b.call.mock.calls.length).toBe(bc)
+ a.app.unmount();await settle();expect(a.root.childElementCount).toBe(0)
+ const count=a.call.mock.calls.length;a.reopen.forEach(fn=>fn());await settle();expect(a.call.mock.calls.length).toBe(count)
+ b.reopen.forEach(fn=>fn());await settle();expect(b.call.mock.calls.length).toBeGreaterThan(bc)
+ b.app.unmount();a.root.remove();b.root.remove()
+})
+
+test('first-load errors replace loading text with an explicit retry state',async()=>{
+ const root=document.createElement('div');document.body.append(root)
+ const ctx={locale:'en',reopen(){},call:vi.fn(async()=>{throw {code:'auth_unavailable'}})} as Context
+ const app=mount(root,ctx);await settle()
+ expect(root.textContent).toContain('Status could not be loaded')
+ expect(root.textContent).not.toContain('Loading integration status')
+ app.unmount();root.remove()
+})
+test('a ready integration with no sample handle shows an explicit empty state',async()=>{
+ const f=fixture('Empty',false)
+ f.call.mockImplementation(async(method:string)=> {
+  if(method==='app.status')return {package:'Empty',version:'0.1.0',user:'normal1',admin:false}
+  if(method==='integration.status')return {state:'ready',packageRunning:'unknown',scheduler:'not-probed'}
+  if(method==='personal.list')return {items:[]}
+  throw {code:'unknown_method'}
+ })
+ f.reopen.forEach(fn=>fn());await settle()
+ // Reopen once after the initial in-flight refresh has finished.
+ f.reopen.forEach(fn=>fn());await settle()
+ expect(f.root.textContent).toContain('No sample data')
+ f.app.unmount();f.root.remove()
+})
+
+test('root failure diagnostics survive the required post-failure status refresh',async()=>{
+ const f=fixture('RootFailure',true,'needs-approval');await settle()
+ f.ctx.root!.run=vi.fn(async()=>{throw {code:'root_run_failed'}})
+ click(f.root,'Approve and activate');await settle()
+ expect(f.root.textContent).toContain('The approved operation failed')
+ expect(f.call.mock.calls.filter(args=>args[0]==='integration.status').length).toBeGreaterThan(1)
+ f.app.unmount();f.root.remove()
+})
+
+test('a local modal leaves the other mount interactive and preserves host styles',async()=>{
+ const a=fixture('M1bAlpha',true),b=fixture('M1bBeta',true)
+ const body=document.body.getAttribute('style'),html=document.documentElement.getAttribute('style')
+ try {
+  await settle();click(a.root,'Disable');await settle()
+  const dialog=a.root.querySelector('[role="dialog"]')!
+  expect(dialog).toBeTruthy()
+  expect(dialog.hasAttribute('aria-modal')).toBe(false)
+  expect(b.root.querySelector('.integration-app')!.closest('[inert], [aria-hidden="true"]')).toBeNull()
+  expect(getComputedStyle(b.root).pointerEvents).not.toBe('none')
+  expect(document.body.getAttribute('style')).toBe(body)
+  expect(document.documentElement.getAttribute('style')).toBe(html)
+  const before=b.call.mock.calls.length
+  click(b.root,'Refresh');await settle()
+  expect(b.call.mock.calls.length).toBeGreaterThan(before)
+  click(b.root,'Disable');await settle()
+  expect(a.root.querySelector('[role="dialog"]')).toBeTruthy()
+  expect(b.root.querySelector('[role="dialog"]')).toBeTruthy()
+  click(a.root,'Cancel');await settle()
+  expect(a.root.querySelector('[role="dialog"]')).toBeNull()
+  expect(b.root.querySelector('[role="dialog"]')).toBeTruthy()
+  expect(a.root.querySelector('.integration-app')!.closest('[inert], [aria-hidden="true"]')).toBeNull()
+ } finally {
+  a.app.unmount();b.app.unmount();a.root.remove();b.root.remove();await settle()
+ }
+ expect(document.body.getAttribute('style')).toBe(body)
+ expect(document.documentElement.getAttribute('style')).toBe(html)
+})
+
+test('repeated mounts of the same package use unique, package-prefixed ARIA references',async()=>{
+ const a=fixture('SamePackage',true),b=fixture('SamePackage',true)
+ try {
+  await settle();click(a.root,'Disable');click(b.root,'Disable');await settle()
+  const ids=[...document.querySelectorAll('[id]')].map(node=>node.id).filter(Boolean)
+  expect(new Set(ids).size).toBe(ids.length)
+  for(const f of [a,b]) {
+   const dialog=f.root.querySelector('[role="dialog"]')!
+   for(const attr of ['aria-labelledby','aria-describedby']) {
+    const id=dialog.getAttribute(attr)!
+    // CLI substitutes the package ID in this template before building.
+    expect(id).toContain('__PACKAGE__-')
+    expect(f.root.querySelector(`[id="${id}"]`)).toBeTruthy()
+   }
+  }
+ } finally {a.app.unmount();b.app.unmount();a.root.remove();b.root.remove();await settle()}
+})
+
+test('unmount releases its sizing class and preserves an existing host class',async()=>{
+ const f=fixture('Sizing',false)
+ expect(f.root.classList.contains('dsmapp-vue-root')).toBe(true)
+ f.app.unmount()
+ expect(f.root.classList.contains('dsmapp-vue-root')).toBe(false)
+ f.root.classList.add('dsmapp-vue-root')
+ const app=mount(f.root,f.ctx);await settle();app.unmount()
+ expect(f.root.classList.contains('dsmapp-vue-root')).toBe(true)
+ f.root.remove()
+})

package/templates/native-go-vue/frontend/tsconfig.json

@@ -0,0 +1 @@
+{"compilerOptions":{"target":"ES2022","module":"ESNext","moduleResolution":"Bundler","strict":true,"lib":["ES2022","DOM"],"skipLibCheck":true,"types":["vite/client"]},"include":["src/**/*.ts","src/**/*.vue","vite.config.ts"]}

package/templates/native-go-vue/frontend/vite.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from 'vite'
+import vue from '@vitejs/plugin-vue'
+export default defineConfig({
+  plugins: [vue()],
+  // Library mode must replace Vue dependency env guards for the DSM browser.
+  define: {'process.env.NODE_ENV': JSON.stringify('production')},
+  build: {lib: {entry: 'src/main.ts', formats: ['iife'], name: 'DsmVueApp', fileName: () => 'app.js'}, cssCodeSplit: false, rollupOptions: {output: {assetFileNames: 'app.[ext]'}}},
+})

package/templates/native-go-vue/gitignore

@@ -0,0 +1,2 @@
+dist/
+node_modules/

package/dist/attestation/app-package.d.ts

@@ -1,86 +0,0 @@
-import { type JWK } from "jose";
-export declare const PLATFORM_ATTESTATION_ISSUER = "synopkgland-curated";
-export declare const APP_PACKAGE_ATTESTATION_TYP = "app-package-attestation";
-export declare const APP_PACKAGE_ATTESTATION_VERSION: 2;
-export declare const CURATED_RELEASE_ATTESTATION_TYP = "curated-release-attestation";
-export declare const CURATED_RELEASE_ATTESTATION_VERSION: 1;
-export interface AppPackageSigningKey {
-    kid: string;
-    privateKey: CryptoKey;
-}
-export interface LabAttestationKeys extends AppPackageSigningKey {
-    publicKey: CryptoKey;
-    publicJwk: JWK;
-}
-/** Inputs for the token embedded in the generated SPK. */
-export interface CuratedAppPackageAttestationInput {
-    packageIdentity: string;
-    packageVersion: string;
-    packageBuild: number;
-    contractDigest: string;
-    bundleDigest: string;
-    capabilities: string[];
-}
-/** Inputs for the detached token published beside the final SPK. */
-export interface CuratedReleaseAttestationInput {
-    packageIdentity: string;
-    packageVersion: string;
-    packageBuild: number;
-    artifactDigest: string;
-    embeddedAttestationDigest: string;
-}
-export interface AppPackageAttestationClaims {
-    typ: typeof APP_PACKAGE_ATTESTATION_TYP;
-    version: typeof APP_PACKAGE_ATTESTATION_VERSION;
-    packageIdentity: string;
-    packageVersion: string;
-    packageBuild: number;
-    contractDigest: string;
-    bundleDigest: string;
-    capabilities: string[];
-    issuedAt: string;
-}
-export interface CuratedReleaseAttestationClaims {
-    typ: typeof CURATED_RELEASE_ATTESTATION_TYP;
-    version: typeof CURATED_RELEASE_ATTESTATION_VERSION;
-    packageIdentity: string;
-    packageVersion: string;
-    packageBuild: number;
-    artifactDigest: string;
-    embeddedAttestationDigest: string;
-    issuedAt: string;
-}
-export declare function loadOrCreateLabAttestationKeys(filePath: string): Promise<LabAttestationKeys>;
-/**
- * Sign the local development token used by the inner-loop flow.
- * Curated releases must use the v2 function below and never this helper.
- */
-export declare function signAppPackageAttestationToken(input: {
-    packageIdentity: string;
-    contractDigest: string;
-    bundleDigest: string;
-    capabilities: string[];
-}, keys: LabAttestationKeys): Promise<{
-    token: string;
-    attestationDigest: string;
-}>;
-/** Sign the v2 App Package Attestation embedded in a Curated SPK. */
-export declare function signCuratedAppPackageAttestationToken(input: CuratedAppPackageAttestationInput, key: AppPackageSigningKey): Promise<{
-    token: string;
-    attestationDigest: string;
-    claims: AppPackageAttestationClaims;
-}>;
-/** Sign the v1 detached release attestation for a final SPK archive. */
-export declare function signCuratedReleaseAttestationToken(input: CuratedReleaseAttestationInput, key: AppPackageSigningKey): Promise<{
-    token: string;
-    attestationDigest: string;
-    claims: CuratedReleaseAttestationClaims;
-}>;
-/** Stable JSON representation used by the embedded token's jti binding. */
-export declare function canonicalAppPackageClaims(claims: AppPackageAttestationClaims): string;
-export declare function digestAppPackageClaims(claims: AppPackageAttestationClaims): string;
-/** Stable JSON representation used by the detached token's jti binding. */
-export declare function canonicalCuratedReleaseClaims(claims: CuratedReleaseAttestationClaims): string;
-export declare function digestCuratedReleaseClaims(claims: CuratedReleaseAttestationClaims): string;
-export declare function normalizeCapabilities(capabilities: string[]): string[];
-export declare function assertPackageVersionBinding(packageVersion: string, packageBuild: number): void;