@wenathlan/saddle 1.8.18 → 2.0.2

package/dist/release/assets.d.ts

@@ -1,144 +0,0 @@
-/**
- * release assets create deterministic checksums, SBOM data and provenance statements.
- * The adapter reads caller-selected artifacts and never publishes or handles credentials.
- */
-/** Builds deterministic release metadata files for caller-selected artifacts. */
-export declare function createassets(options?: {}): Promise<{
-    output: string;
-    files: {
-        checksums: string;
-        manifest: string;
-        sbom: string;
-        provenance: string;
-    };
-    subjects: {
-        name: string;
-        digest: string;
-        bytes: never;
-        updatedat: number;
-    }[];
-    sbom: {
-        bomFormat: string;
-        specVersion: string;
-        serialNumber: string;
-        version: number;
-        metadata: {
-            component: {
-                type: string;
-                name: string;
-                version: string;
-            };
-        };
-        components: {
-            "bom-ref": string;
-            name: string;
-            version: string;
-            purl: string;
-            scope: string;
-            type: string;
-        }[];
-    };
-    provenance: {
-        _type: string;
-        subject: {
-            name: string;
-            digest: {
-                sha256: string;
-            };
-        }[];
-        predicateType: string;
-        predicate: {
-            buildDefinition: {
-                buildType: string;
-                externalParameters: {
-                    package: string;
-                    version: string;
-                };
-                internalParameters: {};
-            };
-            runDetails: {
-                builder: {
-                    id: string;
-                };
-                metadata: {
-                    invocationId: string;
-                };
-            };
-        };
-    };
-    retention: {
-        policy: {};
-        evaluatedat: number;
-        decisions: {
-            name: string;
-            bytes: number;
-            updatedat: number;
-            action: string;
-            reasons: any[];
-        }[];
-    };
-}>;
-/** Computes deterministic keep or prune decisions without deleting caller files. */
-export declare function retentionplan(artifacts?: any[], options?: {}): {
-    policy: {};
-    evaluatedat: number;
-    decisions: {
-        name: string;
-        bytes: number;
-        updatedat: number;
-        action: string;
-        reasons: any[];
-    }[];
-};
-/** Creates a compact CycloneDX component list from the root lockfile dependencies. */
-export declare function createsbom(packagejson: any, lockjson?: {}): {
-    bomFormat: string;
-    specVersion: string;
-    serialNumber: string;
-    version: number;
-    metadata: {
-        component: {
-            type: string;
-            name: string;
-            version: string;
-        };
-    };
-    components: {
-        "bom-ref": string;
-        name: string;
-        version: string;
-        purl: string;
-        scope: string;
-        type: string;
-    }[];
-};
-/** Creates an in-toto statement whose subjects are the caller-selected release artifacts. */
-export declare function createprovenance(packagejson: any, subjects?: any[], options?: {}): {
-    _type: string;
-    subject: {
-        name: string;
-        digest: {
-            sha256: string;
-        };
-    }[];
-    predicateType: string;
-    predicate: {
-        buildDefinition: {
-            buildType: string;
-            externalParameters: {
-                package: string;
-                version: string;
-            };
-            internalParameters: {};
-        };
-        runDetails: {
-            builder: {
-                id: string;
-            };
-            metadata: {
-                invocationId: string;
-            };
-        };
-    };
-};
-//# sourceMappingURL=assets.d.ts.map

package/dist/release/assets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../release/assets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,OAAO,KAAK;;;;;;;;;;;;;;;;;;;;YAuEsH,SAAS;gBAAI,IAAI;gBAAiB,IAAI;gBAA4B,OAAO;;;;;;;;;;;;;;;;;gBAKtJ,MAAM;;;;;YAC0C,eAAe;gBAAI,SAAS;gBAAiD,kBAAkB;oBAAI,OAAO;oBAA4B,OAAO;;gBAAoD,kBAAkB;;YAAQ,UAAU;gBAAI,OAAO;oBAAI,EAAE;;gBAAiD,QAAQ;oBAAI,YAAY;;;;;;;;;;;;;;;;GA5Ctc;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,SAAS,QAAK,EAAE,OAAO,KAAK;;;;;;;;;;EAwBzD;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,WAAW,KAAA,EAAE,QAAQ,KAAK;;;;;;QAQgH,SAAS;YAAI,IAAI;YAAiB,IAAI;YAA4B,OAAO;;;;;;;;;;;EAC7O;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,WAAW,KAAA,EAAE,QAAQ,QAAK,EAAE,OAAO,KAAK;IAE9D,KAAK;IAAqC,OAAO;;;YAD4B,MAAM;;;IACpB,aAAa;IAAoC,SAAS;QAAI,eAAe;YAAI,SAAS;YAAiD,kBAAkB;gBAAI,OAAO;gBAA4B,OAAO;;YAAoD,kBAAkB;;QAAQ,UAAU;YAAI,OAAO;gBAAI,EAAE;;YAAiD,QAAQ;gBAAI,YAAY;;;;EACtc"}

package/dist/release/assets.js

@@ -1,157 +0,0 @@
-/**
- * release assets create deterministic checksums, SBOM data and provenance statements.
- * The adapter reads caller-selected artifacts and never publishes or handles credentials.
- */
-import { createHash } from "node:crypto";
-import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, join, relative, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-const modulepath = dirname(fileURLToPath(import.meta.url));
-const moduleparts = modulepath.split(sep);
-const rootpath = moduleparts.at(-1) === "release" && moduleparts.at(-2) === "dist" ? resolve(modulepath, "..", "..") : resolve(modulepath, "..");
-/** Builds deterministic release metadata files for caller-selected artifacts. */
-export async function createassets(options = {}) {
-    const packagefile = resolve(options.packagefile ?? join(rootpath, "package.json"));
-    const lockfile = resolve(options.lockfile ?? join(rootpath, "package-lock.json"));
-    const output = resolve(options.output ?? join(rootpath, "build", "release"));
-    const artifactroot = resolve(options.artifactroot ?? rootpath);
-    const packagejson = JSON.parse(await readFile(packagefile, "utf8"));
-    const lockjson = JSON.parse(await readFile(lockfile, "utf8"));
-    const artifacts = [...new Set((options.artifacts ?? []).map((artifact) => resolve(String(artifact))))].sort();
-    const version = String(options.version ?? packagejson.version);
-    const surface = normalizeSurface(options.surface ?? "library");
-    const subjects = await Promise.all(artifacts.map(async (artifact) => {
-        const name = relative(artifactroot, artifact).replaceAll("\\", "/");
-        validateArtifactName(basename(name));
-        const details = await stat(artifact);
-        return { name, digest: await sha256(artifact), bytes: details.size, updatedat: Math.trunc(details.mtimeMs) };
-    }));
-    await mkdir(output, { recursive: true });
-    const checksums = `${subjects.map((subject) => `${subject.digest}  ${subject.name}`).join("\n")}${subjects.length ? "\n" : ""}`;
-    const sbom = createsbom(packagejson, lockjson);
-    const provenance = createprovenance(packagejson, subjects, { ...options, version });
-    const retention = options.retention ? retentionplan(subjects, options.retention) : undefined;
-    const manifest = { name: String(packagejson.name), version, surface, files: subjects.map((subject) => basename(subject.name)), signing: String(options.signing ?? "caller-owned"), ...(retention ? { retention: retention.policy, retentionplan: retention.decisions, retentionevaluatedat: retention.evaluatedat } : {}) };
-    const files = {
-        checksums: join(output, `sha256.${surface}.${version}`),
-        manifest: join(output, `manifest.${surface}.${version}.json`),
-        sbom: join(output, `sbom.${surface}.${version}.cdx.json`),
-        provenance: join(output, `provenance.${surface}.${version}.intoto.jsonl`)
-    };
-    await writeFile(files.checksums, checksums);
-    await writeFile(files.manifest, `${JSON.stringify(manifest, null, 2)}\n`);
-    await writeFile(files.sbom, `${JSON.stringify(sbom, null, 2)}\n`);
-    await writeFile(files.provenance, `${JSON.stringify(provenance)}\n`);
-    return { output, files, subjects, sbom, provenance, retention };
-}
-/** Computes deterministic keep or prune decisions without deleting caller files. */
-export function retentionplan(artifacts = [], options = {}) {
-    const policy = normalizeretention(options);
-    const evaluatedat = Number(options.evaluatedat ?? options.now ?? 0);
-    if (!Number.isSafeInteger(evaluatedat) || evaluatedat < 0)
-        throw new RangeError("retention evaluatedat must be a non-negative safe integer");
-    const entries = [...new Map(artifacts.map((artifact) => {
-            const name = String(artifact.name ?? "");
-            if (!name)
-                throw new TypeError("retention artifact requires name");
-            return [name, { name, bytes: normalizebytes(artifact.bytes), updatedat: normalizeupdatedat(artifact.updatedat) }];
-        })).values()].sort(comparefreshness);
-    const decisions = entries.map((entry) => ({ ...entry, action: "keep", reasons: [] }));
-    for (const decision of decisions) {
-        if (policy.maxagedays !== undefined && evaluatedat > 0 && decision.updatedat + policy.maxagedays * 86400000 < evaluatedat) {
-            decision.action = "prune";
-            decision.reasons.push("max-age");
-        }
-    }
-    if (policy.maxcount !== undefined)
-        decisions.slice(policy.maxcount).forEach((decision) => { if (decision.action === "keep") {
-            decision.action = "prune";
-            decision.reasons.push("max-count");
-        } });
-    if (policy.maxbytes !== undefined) {
-        let total = decisions.filter((decision) => decision.action === "keep").reduce((sum, decision) => sum + decision.bytes, 0);
-        for (const decision of [...decisions].reverse()) {
-            if (total <= policy.maxbytes || decision.action !== "keep")
-                continue;
-            decision.action = "prune";
-            decision.reasons.push("max-bytes");
-            total -= decision.bytes;
-        }
-    }
-    return { policy, evaluatedat, decisions: decisions.sort((left, right) => left.name.localeCompare(right.name)) };
-}
-/** Creates a compact CycloneDX component list from the root lockfile dependencies. */
-export function createsbom(packagejson, lockjson = {}) {
-    const root = lockjson.packages?.[""] ?? {};
-    const dependencies = { ...(root.dependencies ?? {}), ...(root.devDependencies ?? {}) };
-    const components = Object.keys(dependencies).map((name) => {
-        const entry = lockjson.packages?.[`node_modules/${name}`] ?? {};
-        const version = String(entry.version ?? dependencies[name]).replace(/^[^0-9]*/, "");
-        return { "bom-ref": `pkg:npm/${name}@${version}`, name, version, purl: `pkg:npm/${name}@${version}`, scope: root.devDependencies?.[name] ? "optional" : "required", type: "library" };
-    }).sort((left, right) => left.name.localeCompare(right.name));
-    return { bomFormat: "CycloneDX", specVersion: "1.5", serialNumber: `urn:uuid:${stableuuid(`${packagejson.name}@${packagejson.version}`)}`, version: 1, metadata: { component: { type: "application", name: String(packagejson.name), version: String(packagejson.version) } }, components };
-}
-/** Creates an in-toto statement whose subjects are the caller-selected release artifacts. */
-export function createprovenance(packagejson, subjects = [], options = {}) {
-    const normalized = subjects.map((subject) => ({ name: String(subject.name), digest: { sha256: String(subject.digest) } })).sort((left, right) => left.name.localeCompare(right.name));
-    return { _type: "https://in-toto.io/Statement/v1", subject: normalized, predicateType: "https://slsa.dev/provenance/v1", predicate: { buildDefinition: { buildType: String(options.buildtype ?? "caller-defined"), externalParameters: { package: String(packagejson.name), version: String(options.version ?? packagejson.version) }, internalParameters: {} }, runDetails: { builder: { id: String(options.builder ?? "caller-defined") }, metadata: { invocationId: stableuuid(`${packagejson.name}@${options.version ?? packagejson.version}:${normalized.map((subject) => subject.name).join(",")}`) } } } };
-}
-async function sha256(path) { const hash = createHash("sha256"); hash.update(await readFile(path)); return hash.digest("hex"); }
-function stableuuid(value) { const hex = createHash("sha256").update(String(value)).digest("hex").slice(0, 32); return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-${(8 + (Number.parseInt(hex.slice(16, 17), 16) % 4).toString(16))}${hex.slice(17, 20)}-${hex.slice(20)}`; }
-/** Normalizes the public release surface used in metadata filenames. */
-function normalizeSurface(value) { const normalized = String(value).trim().toLowerCase(); if (!/^[a-z0-9]+(?:[.-][a-z0-9]+)*$/.test(normalized))
-    throw new TypeError(`invalid release surface: ${value}`); return normalized; }
-/** Rejects helper binaries and ambiguous public filenames before metadata generation. */
-function validateArtifactName(value) { if (value.includes("_") || /build[-_]script[-_]build|saddle[-_]desktop/i.test(value))
-    throw new TypeError(`forbidden release artifact filename: ${value}`); }
-function parsearguments(argumentslist) {
-    const options = { artifacts: [] };
-    for (let index = 0; index < argumentslist.length; index += 1) {
-        const argument = argumentslist[index];
-        if (argument === "--output")
-            options.output = argumentslist[++index];
-        else if (argument === "--version")
-            options.version = argumentslist[++index];
-        else if (argument === "--surface")
-            options.surface = argumentslist[++index];
-        else if (argument === "--signing")
-            options.signing = argumentslist[++index];
-        else if (argument === "--artifact")
-            options.artifacts.push(argumentslist[++index]);
-        else if (argument === "--build-type")
-            options.buildtype = argumentslist[++index];
-        else if (argument === "--builder")
-            options.builder = argumentslist[++index];
-        else if (argument === "--max-age-days")
-            (options.retention ??= {}).maxagedays = Number(argumentslist[++index]);
-        else if (argument === "--max-count")
-            (options.retention ??= {}).maxcount = Number(argumentslist[++index]);
-        else if (argument === "--max-bytes")
-            (options.retention ??= {}).maxbytes = Number(argumentslist[++index]);
-        else if (argument === "--evaluated-at")
-            (options.retention ??= {}).evaluatedat = Number(argumentslist[++index]);
-        else
-            throw new TypeError(`unsupported release asset argument: ${argument}`);
-    }
-    return options;
-}
-function normalizeretention(options) {
-    const result = {};
-    if (options.maxagedays !== undefined)
-        result.maxagedays = normalizepolicyinteger(options.maxagedays, "maxagedays");
-    if (options.maxcount !== undefined)
-        result.maxcount = normalizepolicyinteger(options.maxcount, "maxcount");
-    if (options.maxbytes !== undefined)
-        result.maxbytes = normalizepolicyinteger(options.maxbytes, "maxbytes");
-    return result;
-}
-function normalizepolicyinteger(value, name) { const normalized = Number(value); if (!Number.isSafeInteger(normalized) || normalized <= 0)
-    throw new RangeError(`${name} must be a positive safe integer`); return normalized; }
-function normalizebytes(value) { const normalized = Number(value ?? 0); if (!Number.isSafeInteger(normalized) || normalized < 0)
-    throw new RangeError("retention artifact bytes must be a non-negative safe integer"); return normalized; }
-function normalizeupdatedat(value) { const normalized = Number(value ?? 0); if (!Number.isSafeInteger(normalized) || normalized < 0)
-    throw new RangeError("retention artifact updatedat must be a non-negative safe integer"); return normalized; }
-function comparefreshness(left, right) { return right.updatedat - left.updatedat || right.bytes - left.bytes || left.name.localeCompare(right.name); }
-if (process.argv[1] === fileURLToPath(import.meta.url))
-    createassets(parsearguments(process.argv.slice(2))).then(({ output }) => { console.log(`release assets: ${output}`); }).catch((error) => { console.error(error.message); process.exitCode = 1; });
-//# sourceMappingURL=assets.js.map

package/dist/release/assets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../release/assets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAEjJ,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAO,GAAG,EAAE;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9G,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpE,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/G,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAChI,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,SAAS,EAAE,oBAAoB,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5T,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,OAAO,IAAI,OAAO,EAAE,CAAC;QACvD,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,OAAO,IAAI,OAAO,OAAO,CAAC;QAC7D,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,OAAO,IAAI,OAAO,WAAW,CAAC;QACzD,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,OAAO,IAAI,OAAO,eAAe,CAAC;KAC1E,CAAC;IACF,MAAM,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,SAAS,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE;IACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,2DAA2D,CAAC,CAAC;IAC7I,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC,IAAI,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,GAAG,QAAQ,GAAG,WAAW,EAAE,CAAC;YAAC,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;IAC7L,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClM,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1H,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,IAAI,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACrE,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;YAC1B,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAClH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,WAAW,EAAE,QAAQ,GAAG,EAAE;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;IACvF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,SAAS,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxL,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,UAAU,CAAC,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;AAC9R,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,WAAW,EAAE,QAAQ,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE;IACvE,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACtL,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,gCAAgC,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;AACplB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEhI,SAAS,UAAU,CAAC,KAAK,IAAI,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEhS,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,KAAK,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;AAE/N,yFAAyF;AACzF,SAAS,oBAAoB,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAEpM,SAAS,cAAc,CAAC,aAAa;IACnC,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;aAChE,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;aACvE,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;aACvE,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;aACvE,IAAI,QAAQ,KAAK,YAAY;YAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;aAC9E,IAAI,QAAQ,KAAK,cAAc;YAAE,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;aAC5E,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;aACvE,IAAI,QAAQ,KAAK,gBAAgB;YAAE,CAAC,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;aAC1G,IAAI,QAAQ,KAAK,aAAa;YAAE,CAAC,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;aACrG,IAAI,QAAQ,KAAK,aAAa;YAAE,CAAC,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;aACrG,IAAI,QAAQ,KAAK,gBAAgB;YAAE,CAAC,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;;YAC3G,MAAM,IAAI,SAAS,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAO;IACjC,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnH,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3G,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAK,EAAE,IAAI,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;IAAE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;AAEhO,SAAS,cAAc,CAAC,KAAK,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;IAAE,MAAM,IAAI,UAAU,CAAC,8DAA8D,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;AAE3O,SAAS,kBAAkB,CAAC,KAAK,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;IAAE,MAAM,IAAI,UAAU,CAAC,kEAAkE,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;AAEnP,SAAS,gBAAgB,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEtJ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/release/evidence.d.ts

@@ -1,92 +0,0 @@
-/**
- * Release evidence evaluates caller-supplied metadata without fetching, signing,
- * scanning, publishing or claiming an artifact has more assurance than proven.
- */
-/** Normalizes an immutable, caller-supplied artifact evidence record. */
-export declare function releaseevidence(input?: Record<string, unknown>): {
-    version: number;
-    kind: string;
-    status: string;
-    subjectdigest: string;
-    producer: string;
-    workflow: string;
-    verificationmethod: string;
-    verifiedat: number;
-    metadata: {
-        [x: string]: unknown;
-    };
-};
-/** Evaluates evidence against a caller-owned policy and returns reason codes, never a trust claim. */
-export declare function evaluateevidence(input?: Record<string, unknown>): {
-    version: number;
-    decision: string;
-    reasons: string[];
-    subjectdigest: string;
-    requiredkinds: string[];
-    evidence: {
-        version: number;
-        kind: string;
-        status: string;
-        subjectdigest: string;
-        producer: string;
-        workflow: string;
-        verificationmethod: string;
-        verifiedat: number;
-        metadata: {
-            [x: string]: unknown;
-        };
-    }[];
-};
-/** Builds a data-only readiness receipt for a release that a caller may later execute. */
-export declare function releasereadiness(input?: Record<string, unknown>): {
-    version: number;
-    sourcetag: string;
-    manifestversions: Record<string, string>;
-    requiredgates: Record<string, string>;
-    artifactplandigest: string;
-    targets: string[];
-    signingstatus: string;
-    evaluation: {
-        version: number;
-        decision: string;
-        reasons: string[];
-        subjectdigest: string;
-        requiredkinds: string[];
-        evidence: {
-            version: number;
-            kind: string;
-            status: string;
-            subjectdigest: string;
-            producer: string;
-            workflow: string;
-            verificationmethod: string;
-            verifiedat: number;
-            metadata: {
-                [x: string]: unknown;
-            };
-        }[];
-    };
-    decision: string;
-    ready: boolean;
-    reasons: string[];
-};
-/** Maps an already-completed local checksum verification result to evidence records. */
-export declare function evidencefromverification(input?: Record<string, unknown>): {
-    version: number;
-    releaseversion: string;
-    signingstatus: string;
-    evidence: {
-        version: number;
-        kind: string;
-        status: string;
-        subjectdigest: string;
-        producer: string;
-        workflow: string;
-        verificationmethod: string;
-        verifiedat: number;
-        metadata: {
-            [x: string]: unknown;
-        };
-    }[];
-};
-//# sourceMappingURL=evidence.d.ts.map

package/dist/release/evidence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../release/evidence.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;;;;;;;;;;;;EAalE;AAED,sGAAsG;AACtG,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;;;;;;;;;;;;;;;;;;;EAqBnE;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBnE;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;;;;;;;;;;;;;;;;;EAoB3E"}

package/dist/release/evidence.js

@@ -1,148 +0,0 @@
-/**
- * Release evidence evaluates caller-supplied metadata without fetching, signing,
- * scanning, publishing or claiming an artifact has more assurance than proven.
- */
-const evidencestatuses = new Set(["notProvided", "declared", "parsed", "checked", "verified", "rejected", "unknown"]);
-const verifiedstatuses = new Set(["checked", "verified"]);
-/** Normalizes an immutable, caller-supplied artifact evidence record. */
-export function releaseevidence(input = {}) {
-    const status = normalizestatus(input.status ?? "notProvided");
-    const kind = requiredtext(input.kind, "evidence kind");
-    const subjectdigest = optionaldigest(input.subjectdigest, "subject digest");
-    const producer = optionaltext(input.producer);
-    const workflow = optionaltext(input.workflow);
-    const method = optionaltext(input.verificationmethod);
-    const verifiedat = optionaltime(input.verifiedat, "verification time");
-    if (verifiedstatuses.has(status) && !subjectdigest)
-        throw new TypeError("checked evidence requires a subject digest");
-    if (verifiedstatuses.has(status) && !method)
-        throw new TypeError("checked evidence requires a verification method");
-    if (status === "verified" && !producer)
-        throw new TypeError("verified evidence requires a producer");
-    if (status === "verified" && !verifiedat)
-        throw new TypeError("verified evidence requires a verification time");
-    return { version: 1, kind, status, subjectdigest, producer, workflow, verificationmethod: method, verifiedat, metadata: objectcopy(input.metadata) };
-}
-/** Evaluates evidence against a caller-owned policy and returns reason codes, never a trust claim. */
-export function evaluateevidence(input = {}) {
-    const evidence = Array.isArray(input.evidence) ? input.evidence.map((entry) => releaseevidence(objectvalue(entry, "evidence entry"))) : [];
-    const policy = objectcopy(input.policy);
-    const requiredkinds = stringlist(policy.requiredkinds, "required kinds");
-    const allowedstatuses = new Set(stringlist(policy.allowedstatuses ?? ["verified"], "allowed statuses"));
-    const expectedproducer = textmap(policy.expectedproducer, "expected producer");
-    const expectedworkflow = textmap(policy.expectedworkflow, "expected workflow");
-    const subjectdigest = optionaldigest(input.subjectdigest, "subject digest");
-    const reasons = new Set();
-    for (const kind of requiredkinds) {
-        const matches = evidence.filter((entry) => entry.kind === kind);
-        if (matches.length === 0) {
-            reasons.add(`required-evidence-missing:${kind}`);
-            continue;
-        }
-        const accepted = matches.some((entry) => evidenceaccepted(entry, { allowedstatuses, expectedproducer, expectedworkflow, subjectdigest }, reasons));
-        if (!accepted)
-            reasons.add(`required-evidence-unsatisfied:${kind}`);
-    }
-    const evaluated = requiredkinds.length === 0 ? evidence : evidence.filter((entry) => requiredkinds.includes(entry.kind));
-    for (const entry of evaluated)
-        evidenceaccepted(entry, { allowedstatuses, expectedproducer, expectedworkflow, subjectdigest }, reasons);
-    const ordered = [...reasons].sort();
-    const rejected = ordered.some((reason) => reason.startsWith("evidence-rejected:") || reason.startsWith("producer-mismatch:") || reason.startsWith("workflow-mismatch:") || reason.startsWith("subject-mismatch:"));
-    const decision = rejected ? "rejected" : ordered.length > 0 ? "insufficient" : "accepted";
-    return { version: 1, decision, reasons: ordered, subjectdigest, requiredkinds, evidence };
-}
-/** Builds a data-only readiness receipt for a release that a caller may later execute. */
-export function releasereadiness(input = {}) {
-    const sourcetag = requiredtext(input.sourcetag, "source tag");
-    const manifestversions = textmap(input.manifestversions, "manifest versions");
-    const requiredgates = textmap(input.requiredgates, "required gates");
-    const artifactplandigest = optionaldigest(input.artifactplandigest, "artifact plan digest");
-    const targets = stringlist(input.targets, "publication targets");
-    const signingstatus = optionaltext(input.signingstatus) ?? "unknown";
-    const evaluation = evaluateevidence(objectvalue(input.evaluation, "evidence evaluation"));
-    const reasons = new Set(evaluation.reasons);
-    if (Object.values(manifestversions).some((value) => value !== sourcetag.replace(/^v/, "")))
-        reasons.add("manifest-version-mismatch");
-    for (const [gate, status] of Object.entries(requiredgates))
-        if (status !== "passed")
-            reasons.add(`required-gate-not-passed:${gate}`);
-    if (!artifactplandigest)
-        reasons.add("artifact-plan-digest-missing");
-    if (targets.length === 0)
-        reasons.add("publication-targets-missing");
-    if (signingstatus === "unknown")
-        reasons.add("signing-status-unknown");
-    const ordered = [...reasons].sort();
-    const decision = evaluation.decision === "rejected" ? "rejected" : ordered.length > 0 ? "insufficient" : "accepted";
-    return { version: 1, sourcetag, manifestversions, requiredgates, artifactplandigest, targets, signingstatus, evaluation, decision, ready: decision === "accepted", reasons: ordered };
-}
-/** Maps an already-completed local checksum verification result to evidence records. */
-export function evidencefromverification(input = {}) {
-    const verification = objectvalue(input.verification, "verification result");
-    if (verification.valid !== true)
-        throw new TypeError("verification result must be valid");
-    const releaseversion = requiredtext(verification.version, "release version");
-    const signingstatus = requiredtext(verification.signing, "signing status");
-    const files = requiredarray(verification.files, "verification files");
-    if (files.length === 0)
-        throw new TypeError("verification files must not be empty");
-    const names = new Set();
-    const producer = optionaltext(input.producer);
-    const workflow = optionaltext(input.workflow);
-    const verificationmethod = optionaltext(input.verificationmethod) ?? "checksum-manifest";
-    const verifiedat = optionaltime(input.verifiedat, "verification time");
-    const evidence = files.map((file) => {
-        const entry = objectvalue(file, "verification file");
-        const name = requiredtext(entry.name, "artifact name");
-        if (names.has(name))
-            throw new TypeError(`duplicate verification artifact: ${name}`);
-        names.add(name);
-        return releaseevidence({ kind: "checksum", status: "checked", subjectdigest: entry.digest, producer, workflow, verificationmethod, verifiedat, metadata: { artifact: name, releaseversion, signingstatus } });
-    });
-    return { version: 1, releaseversion, signingstatus, evidence };
-}
-function evidenceaccepted(entry, policy, reasons) {
-    let accepted = true;
-    if (entry.status === "rejected") {
-        reasons.add(`evidence-rejected:${entry.kind}`);
-        accepted = false;
-    }
-    if (!policy.allowedstatuses.has(entry.status)) {
-        reasons.add(`evidence-status-not-allowed:${entry.kind}:${entry.status}`);
-        accepted = false;
-    }
-    if (policy.subjectdigest && entry.subjectdigest !== policy.subjectdigest) {
-        reasons.add(`subject-mismatch:${entry.kind}`);
-        accepted = false;
-    }
-    if (policy.expectedproducer[entry.kind] && entry.producer !== policy.expectedproducer[entry.kind]) {
-        reasons.add(`producer-mismatch:${entry.kind}`);
-        accepted = false;
-    }
-    if (policy.expectedworkflow[entry.kind] && entry.workflow !== policy.expectedworkflow[entry.kind]) {
-        reasons.add(`workflow-mismatch:${entry.kind}`);
-        accepted = false;
-    }
-    return accepted;
-}
-function normalizestatus(value) { const status = requiredtext(value, "evidence status"); if (!evidencestatuses.has(status))
-    throw new TypeError(`unknown evidence status: ${status}`); return status; }
-function requiredtext(value, label) { const text = optionaltext(value); if (!text)
-    throw new TypeError(`${label} is required`); return text; }
-function optionaltext(value) { const text = value === undefined || value === null ? undefined : String(value).trim(); return text || undefined; }
-function optionaldigest(value, label) { const digest = optionaltext(value)?.toLowerCase(); if (digest && !/^[a-f0-9]{64}$/.test(digest))
-    throw new TypeError(`${label} must be a sha256 hex digest`); return digest; }
-function optionaltime(value, label) { if (value === undefined || value === null)
-    return undefined; const time = Number(value); if (!Number.isFinite(time) || time < 0)
-    throw new TypeError(`${label} must be a non-negative finite number`); return time; }
-function requiredarray(value, label) { if (!Array.isArray(value))
-    throw new TypeError(`${label} must be an array`); return value; }
-function stringlist(value, label) { if (value === undefined || value === null)
-    return []; if (!Array.isArray(value))
-    throw new TypeError(`${label} must be an array`); return [...new Set(value.map((item) => requiredtext(item, label)))].sort(); }
-function textmap(value, label) { if (value === undefined || value === null)
-    return {}; const source = objectvalue(value, label); return Object.fromEntries(Object.entries(source).map(([key, item]) => [requiredtext(key, label), requiredtext(item, label)])); }
-function objectcopy(value) { return value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {}; }
-function objectvalue(value, label) { if (!value || typeof value !== "object" || Array.isArray(value))
-    throw new TypeError(`${label} must be an object`); return value; }
-//# sourceMappingURL=evidence.js.map

package/dist/release/evidence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../release/evidence.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AACtH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1D,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,KAAK,GAA4B,EAAE;IACjE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACvE,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACtH,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACpH,IAAI,MAAM,KAAK,UAAU,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACrG,IAAI,MAAM,KAAK,UAAU,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAChH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,KAAK,GAA4B,EAAE;IAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3I,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACxG,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACnJ,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzH,KAAK,MAAM,KAAK,IAAI,SAAS;QAAE,gBAAgB,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC;IACxI,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnN,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC5F,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAK,GAA4B,EAAE;IAClE,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrE,MAAM,kBAAkB,GAAG,cAAc,CAAC,KAAK,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;IACrE,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACrI,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IACrI,IAAI,CAAC,kBAAkB;QAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACrE,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IACpH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,KAAK,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACxL,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,wBAAwB,CAAC,KAAK,GAA4B,EAAE;IAC1E,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAC5E,IAAI,YAAY,CAAC,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,aAAa,CAAC,YAAY,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,kBAAkB,GAAG,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,mBAAmB,CAAC;IACzF,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;QACrF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IAChN,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyC,EAAE,MAAoJ,EAAE,OAAoB;IAC7O,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAAC,CAAC;IACtG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAAC,CAAC;IAC9I,IAAI,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAAC,CAAC;IAC9I,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAAC,CAAC;IACxK,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAAC,CAAC;IACxK,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,IAAI,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC;AAChN,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa,IAAI,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;IAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;AAC/J,SAAS,YAAY,CAAC,KAAc,IAAI,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC;AAC1J,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa,IAAI,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC;AACvO,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;IAAE,OAAO,SAAS,CAAC,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;AAC5Q,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC;AACpJ,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;IAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACrQ,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;IAAE,OAAO,EAA4B,CAAC,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5S,SAAS,UAAU,CAAC,KAAc,IAAI,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAI,KAAiC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5J,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC,CAAC,OAAO,KAAgC,CAAC,CAAC,CAAC"}

package/dist/release/verify.d.ts

@@ -1,12 +0,0 @@
-/**
- * Release verification checks artifact digests, manifest consistency and
- * explicit signing state without contacting a registry or a provider.
- */
-/** Verifies a release checksum file and its correlated public manifest. */
-export declare function verifyassets(options?: {}): Promise<{
-    valid: boolean;
-    version: string;
-    signing: string;
-    files: any[];
-}>;
-//# sourceMappingURL=verify.d.ts.map

package/dist/release/verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../release/verify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,2EAA2E;AAC3E,wBAAsB,YAAY,CAAC,OAAO,KAAK;;;;;GAyB9C"}