@wavehouse/chtypes 2.0.0-dev.1 → 2.0.0-dev.10

package/dist/ocifetch/ensure.d.ts

@@ -3,9 +3,20 @@
  * `listInstalled`, `verifyInstalled`, `fetchSigned`. This is the only file
  * that wires resolve (`oci.ts`), trust (`dsse.ts`), bytes (`unpack.ts`), the
  * cache (`layout.ts`) and the lock (`lock.ts`) together; nothing outside
- * `index.ts` calls into those modules directly.
+ * `index.ts` calls into those modules directly. `resolve.ts` (`chtypes
+ * resolve`) takes the same resolve and trust steps, through
+ * `verifyManifestTrust`, and `prune.ts` (`chtypes prune`) reads and removes
+ * cache entries under the in-use hold (`hold.ts`).
  */
-import type { FetchV1Options, PlatformKey, Resolved, TrustedKey, VerifyResult } from './types.js';
+import { type TrustResult } from './dsse.js';
+import { FetchV1Error } from './errors.js';
+import { type RequestOptions } from './http.js';
+import { type ReferrerListing } from './referrers.js';
+import { type RevocationContext } from './revocation.js';
+import { type ManifestInfo } from './oci.js';
+import type { ArtifactPredicate, FetchV1Options, PlatformKey, Resolved, TrustedKey, VerifyResult } from './types.js';
+/** The bases: the caller's or `CHTYPES_ARTIFACTS_URL` when the active contract honors them, else the contract's own (the staging dev channel alone, rule r6). */
+export declare function resolveBases(options: FetchV1Options): readonly string[];
 /**
  * The bases, the trust list and the unsigned decision a call with `options`
  * reads under the active contract: exactly what `ensure`, `fetchSigned` and
@@ -17,6 +28,27 @@ export declare function effectiveFetchOptions(options: FetchV1Options): {
     readonly trustedKeys: readonly TrustedKey[];
     readonly allowUnsigned: boolean;
 };
+/** The request options every fetch over `bases` sends: the clock, and the token for the configured base hosts only. */
+export declare function requestOptionsFor(options: FetchV1Options, bases: readonly string[]): Omit<RequestOptions, 'maxBytes'>;
+/**
+ * What one revocation check reads from `options` (`revocation.ts`). The override
+ * is per call and forensic: it never lets a lock or an update pin a revoked build.
+ */
+export declare function revocationContext(options: FetchV1Options): RevocationContext;
+/** What `checkInstalled` answers: the warnings an open prints, and the refusal, if any. */
+export interface InstalledCheck {
+    readonly warnings: readonly string[];
+    /** `ArtifactRevokedError`, or in strict mode the transport's error; `undefined` when the build may be used. */
+    readonly error: FetchV1Error | undefined;
+}
+/**
+ * The installed-build revocation check a registry makes after `resolveInstalled`
+ * answers and before it loads the build (guide §9, `check_installed`): the stored
+ * record, then, unless offline, at most one check per build per process. The
+ * warnings the open prints are returned even when the build is refused, as Go
+ * returns them beside the error. Under the v1 contract it does nothing.
+ */
+export declare function checkInstalled(res: Resolved, options?: FetchV1Options): Promise<InstalledCheck>;
 /**
  * Never touches the network (guide §9). The source of truth is the
  * immutable `unpacked/sha256/*\/verified.json` records (guide §6) — never
@@ -29,6 +61,8 @@ export declare function effectiveFetchOptions(options: FetchV1Options): {
  * `clickhouse_version` lies within `request`.
  */
 export declare function resolveInstalled(request: string, platform: PlatformKey, options?: FetchV1Options): Promise<Resolved | undefined>;
+/** The directories every lookup reads, in order: the cache root, then each system directory (public issue #530). It reads and creates nothing. */
+export declare function searchDirs(options?: FetchV1Options): readonly string[];
 /**
  * What a `CHTYPES_ARTIFACT_MISSING` answer from the cache `options` names adds
  * to its message, each a complete sentence: the 0.x hint when the cache is a
@@ -61,6 +95,31 @@ export declare function verifyInstalled(options?: FetchV1Options): Promise<reado
  * warning (spec/abi-v2/docs.md, rule r6).
  */
 export declare function ensure(request: string, options?: FetchV1Options): Promise<Resolved>;
+/** What `verifyManifestTrust` established for one platform manifest. */
+export interface ManifestTrust {
+    /** The verified signature, or `undefined` when the call proceeds unsigned (allow-unsigned). */
+    readonly trust: TrustResult | undefined;
+    /** The signed predicate, or under allow-unsigned the config blob's (`unsignedPredicateFallback`). */
+    readonly predicate: ArtifactPredicate;
+    /** The key id that verified the signature, `''` when unsigned. */
+    readonly signedBy: string;
+    readonly warnings: readonly string[];
+    /** The referrers listing the trust step read, whose revocation candidates an install, a lock and an update check at no extra listing request. */
+    readonly listing: ReferrerListing;
+}
+/**
+ * The trust step of a fetch for one platform manifest (guide §4), exactly as
+ * `ensure` takes it before anything is downloaded: a signature referrer of the
+ * manifest verified under the trust list, its statement checked against the
+ * manifest's layer, the platform and `request`; no signature that verifies is
+ * `ArtifactUntrustedError` unless allow-unsigned is honored, when the config
+ * blob's metadata stands in with a warning. A signed build is then checked by
+ * the dev channel's ahead-of-registry rule (public issue #578: the alias for
+ * its own fingerprint answered 404 on every base, and the tag's build is
+ * signed for another), refused from the signed statement, before any layer is
+ * requested. `chtypes resolve` takes the same step for every platform.
+ */
+export declare function verifyManifestTrust(repositoryRoot: string, manifest: ManifestInfo, aliasAbsent: boolean, platform: PlatformKey, request: string, options: FetchV1Options, baseReqOptions: Omit<RequestOptions, 'maxBytes'>): Promise<ManifestTrust>;
 export interface FetchSignedResult {
     readonly path: string;
     readonly statement: unknown;
@@ -88,12 +147,13 @@ export interface FetchSignedResult {
  */
 export declare function fetchSigned(callerRepository: string, ref: string, predicateType: string, options?: FetchV1Options): Promise<FetchSignedResult>;
 /**
- * The version spellings a repository publishes: `GET tags/list` from the first
- * base that has the repository, every tag that is not a version spelling
- * (`SPELLING_REGEX`: the `sha256-<hex>` referrers fallback tags, symbolic tags)
- * dropped, the rest in ascending numeric order. A tag names a version, not a
- * platform: whether a platform is offered is that tag's index, which only a
- * resolve reads. A next page is followed through the `Link` header.
+ * The lines a repository publishes: `GET tags/list` from the first base that
+ * has the repository, every tag that is not a two-part line (three- and
+ * four-part versions, aliases, the `sha256-<hex>` referrers fallback tags,
+ * symbolic tags) dropped, the rest in ascending numeric order. A tag names a
+ * line, not a platform: whether a platform is offered is that tag's index,
+ * which only a resolve reads. A next page is followed through the `Link`
+ * header.
  */
 export declare function listTags(options?: FetchV1Options): Promise<readonly string[]>;
 //# sourceMappingURL=ensure.d.ts.map

package/dist/ocifetch/ensure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure.d.ts","sourceRoot":"","sources":["../../src/ocifetch/ensure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAyDH,OAAO,KAAK,EAAqB,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAyBrH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC,CAEA;AA2DD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA6B/B;AAkBD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAO3F;AAED,uLAAuL;AACvL,wBAAsB,UAAU,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAKzF;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE3E;AAoCD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG1E;AA0DD,wBAAsB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAW9F;AAID,mGAAmG;AACnG,wBAAsB,eAAe,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAgBpG;AAID;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAU7F;AAoaD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAiC5B;AA0ID;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA4CvF"}
+{"version":3,"file":"ensure.d.ts","sourceRoot":"","sources":["../../src/ocifetch/ensure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoBH,OAAO,EAAiE,KAAK,WAAW,EAAkD,MAAM,WAAW,CAAC;AAC5J,OAAO,EAML,YAAY,EAEb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAe,KAAK,cAAc,EAAmB,MAAM,WAAW,CAAC;AAqB9E,OAAO,EAA4C,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEhG,OAAO,EAOL,KAAK,iBAAiB,EAMvB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAkE,KAAK,YAAY,EAAc,MAAM,UAAU,CAAC;AAGzH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAUrH,iKAAiK;AACjK,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,MAAM,EAAE,CAYvE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC,CAEA;AAeD,uHAAuH;AACvH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAMrH;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,iBAAiB,CAW5E;AAOD,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+GAA+G;IAC/G,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CASzG;AAsCD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA+B/B;AAyBD,kJAAkJ;AAClJ,wBAAgB,UAAU,CAAC,OAAO,GAAE,cAAmB,GAAG,SAAS,MAAM,EAAE,CAE1E;AAaD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAO3F;AAED,uLAAuL;AACvL,wBAAsB,UAAU,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAKzF;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE3E;AAoCD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG1E;AA+DD,wBAAsB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAW9F;AAID,mGAAmG;AACnG,wBAAsB,eAAe,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAqBpG;AAID;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAU7F;AAuLD,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,qGAAqG;IACrG,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iJAAiJ;IACjJ,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAE,OAAO,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,GAC/C,OAAO,CAAC,aAAa,CAAC,CA+BxB;AAuXD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAiC5B;AA+ID;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA2CvF"}