@xemahq/biome-supply-chain 0.1.0

package/LICENSE

@@ -0,0 +1,175 @@
+Xema Business Source License 1.1
+
+License text copyright (c) 2020 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Parameters
+
+Licensor:  Neuralchowder Inc.
+
+Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc..
+
+  The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
+  Xema Kernel, Xema control plane, Xema application runtime, Xema biome
+  runtime, Xema biome registry, Xema store services, Xema orchestration
+  services, Xema agents, Xema skills, Xema memory services, Xema APIs, Xema
+  user interfaces, Xema command-line tools, Xema deployment artifacts, Xema
+  templates, Xema specifications, Xema schemas, Xema manifests, Xema
+  documentation, Xema examples, and all source code, object code, binaries,
+  packages, modules, configuration files, manifests, schemas, examples,
+  templates, documentation, and derivative works included in or distributed
+  as part of the Xema software project.
+
+  The Licensed Work does not include any third-party software, libraries,
+  dependencies, packages, assets, or components that are distributed with the
+  Licensed Work but are governed by their own separate license terms. Such
+  third-party materials remain subject to their respective licenses.
+
+  A specific file, package, component, or directory may state that it is
+  governed by a different license. In that case, that specific file, package,
+  component, or directory is governed by the license expressly stated therein.
+
+Additional Use Grant:
+
+  You may make production use of the Licensed Work, provided that your use
+  does not include offering, providing, making available, distributing,
+  hosting, managing, embedding, reselling, white-labeling, sublicensing,
+  commercializing, or otherwise making the Licensed Work, or any modified
+  version or derivative work of the Licensed Work, available to Third Parties
+  as part of a Competitive Offering.
+
+The following definitions and clarifications form part of, and govern
+the interpretation of, the Additional Use Grant set out above.
+
+  1. "Production Use" means any use of the Licensed Work other than for
+     development, testing, evaluation, demonstration, experimentation,
+     benchmarking, or other non-production purposes.
+
+  2. "Affiliate" means any entity that, directly or indirectly,
+     controls, is controlled by, or is under common control with you,
+     where "control" means ownership of more than fifty percent (50%) of
+     the voting interests of the entity, or the power to direct its
+     management.
+
+  3. "Third Party" means any natural person or legal entity other than
+     you and your Affiliates.
+
+  4. "Competitive Offering" means any product or service, made available
+     to one or more Third Parties for a fee or other consideration
+     (including without limitation on a paid, subscription,
+     advertising-supported, hosted, or managed-service basis), that is
+     offered or marketed as, or that competes with, a software platform,
+     runtime, orchestration system, agent or automation system,
+     extension or distribution marketplace, or other software system
+     that provides, in substantial part, the same or substantially
+     similar capabilities as those provided by the Licensed Work. A
+     product or service is a Competitive Offering whether the Licensed
+     Work is provided in whole or in part, alone or bundled with other
+     software, and whether modified or unmodified.
+
+  5. Providing, hosting, or managing the Licensed Work for a Third Party,
+     or otherwise making the Licensed Work available to a Third Party as
+     a hosted or managed service such that the Third Party obtains the
+     principal value or functionality of the Licensed Work, is a
+     Competitive Offering and is not permitted by the Additional Use
+     Grant.
+
+  6. Subject to the foregoing, the Additional Use Grant permits you to
+     make Production Use of the Licensed Work for your own internal
+     business purposes and to build, operate, and provide your own
+     products and services to Third Parties, provided that the Licensed
+     Work itself (whether modified or unmodified) is not the product or
+     service, and is not a Competitive Offering, made available to those
+     Third Parties.
+
+  7. You may modify the Licensed Work and create derivative works for
+     any purpose permitted by this License. Any Production Use of such
+     modified or derivative works remains subject to the same
+     restrictions as the Licensed Work, including the prohibition on
+     Competitive Offerings.
+
+  8. Use of the Licensed Work by your own employees, contractors, and
+     agents, acting on your behalf and for your benefit, is not by
+     itself making the Licensed Work available to a Third Party.
+
+  9. Embedding or distributing the Licensed Work as a component of your
+     own product or service is permitted only where the Licensed Work
+     does not constitute the principal value of that product or service
+     and the product or service is not a Competitive Offering.
+
+  10. Nothing in this Additional Use Grant grants any right to use any
+      name, trademark, service mark, or logo of the Licensor or its
+      Affiliates, except as reasonably required for customary
+      attribution.
+
+  11. The rights stated in this Additional Use Grant are the maximum
+      rights granted for Production Use prior to the Change Date. Any
+      Production Use not expressly permitted requires a separate
+      commercial license from the Licensor.
+
+  12. If any provision of this Additional Use Grant is held invalid or
+      unenforceable, that provision shall be limited or eliminated to
+      the minimum extent necessary so that the remainder of this
+      Additional Use Grant, and of this License, remains in full force
+      and effect. The Licensor reserves all rights not expressly granted
+      by this License.
+
+
+Change Date:  Four years from the date the specific version of the Licensed
+  Work is first publicly released by Licensor.
+
+Change License:  Mozilla Public License, Version 2.0
+
+For information about alternative licensing arrangements, commercial
+licensing, enterprise licensing, OEM licensing, appliance licensing, managed
+service licensing, cloud provider licensing, or other commercial use of the
+Licensed Work, please contact: licensing@neuralchowder.com
+
+-----------------------------------------------------------------------------
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph above
+terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of
+the Licensed Work, are subject to this License. This License applies separately
+for each version of the Licensed Work and the Change Date may vary for each
+version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or modified
+form from a third party, the terms and conditions set forth in this License
+apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor
+or its affiliates, provided that you may use a trademark or logo of Licensor
+as expressly required by this License.
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN
+"AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS
+OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

package/README.md

@@ -0,0 +1,51 @@
+# @xemahq/biome-supply-chain
+
+This package belongs to Layer 1 — a framework-free runtime SDK utility.
+
+Shared cosign supply-chain verification for Xema biomes. It centralizes the two
+things that were previously copy-pasted between `biome-fetcher-api` (OCI bundle
+verification) and `@xemahq/biome-package` (the packaging CLI):
+
+- the single cosign CLI invocation (`ensureCosignAvailable`,
+  `verifyCosignSignature`, `verifyCosignAttestation`, `verifyCosignBlob`), and
+- the signature / provenance verdict vocabulary (`SignatureVerdict`,
+  `ProvenanceVerdict`, `CosignErrorCode`, `CosignVerifyOutcome`).
+
+It shells out to the `cosign` binary and uses only Node built-ins — no NestJS,
+no framework, no external runtime dependencies — so it is safe to import from a
+service runtime image and from a build-time CLI alike.
+
+## Usage
+
+```ts
+import {
+  ensureCosignAvailable,
+  verifyCosignSignature,
+  verifyCosignBlob,
+  SignatureVerdict,
+  CosignVerifyOutcome,
+} from '@xemahq/biome-supply-chain';
+
+await ensureCosignAvailable();
+
+// OCI ref (keyless identity allowlist)
+await verifyCosignSignature({
+  ociRef: 'oci://registry/biome:1.2.0',
+  trustedIdentities: ['https://github.com/xema-dev/...'],
+  oidcIssuer: 'https://token.actions.githubusercontent.com',
+});
+
+// Detached blob (caller owns artifact/bundle files on disk)
+const { outcome, matchedIdentity } = await verifyCosignBlob({
+  artifactPath: '/tmp/remoteEntry.js',
+  bundlePath: '/tmp/remoteEntry.js.bundle',
+  trustedIdentityRegexps: ['^https://github.com/xema-dev/.*$'],
+});
+if (outcome === CosignVerifyOutcome.Verified) {
+  // matchedIdentity is the regexp that verified
+}
+```
+
+Artifact resolution (resolving an OCI ref, or fetching + writing a blob to a
+temp file) stays with each consumer; this package owns only the cosign exec and
+the verdict enums.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './lib/verdicts';
+export * from './lib/cosign-exec';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/verdicts"), exports);
+__exportStar(require("./lib/cosign-exec"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,oDAAkC"}

package/dist/lib/cosign-exec.d.ts

@@ -0,0 +1,32 @@
+import { CosignVerifyOutcome } from './verdicts';
+export declare function ensureCosignAvailable(bin?: string): Promise<void>;
+export interface VerifyCosignSignatureInput {
+    readonly ociRef: string;
+    readonly trustedIdentities: readonly string[];
+    readonly oidcIssuer?: string;
+    readonly keyPath?: string;
+    readonly bin?: string;
+}
+export declare function verifyCosignSignature(input: VerifyCosignSignatureInput): Promise<void>;
+export interface VerifyCosignAttestationInput {
+    readonly ociRef: string;
+    readonly predicateType: string;
+    readonly trustedIdentities: readonly string[];
+    readonly oidcIssuer?: string;
+    readonly keyPath?: string;
+    readonly bin?: string;
+}
+export declare function verifyCosignAttestation(input: VerifyCosignAttestationInput): Promise<void>;
+export interface VerifyCosignBlobInput {
+    readonly artifactPath: string;
+    readonly bundlePath: string;
+    readonly trustedIdentityRegexps: readonly string[];
+    readonly oidcIssuer?: string;
+    readonly bin?: string;
+}
+export interface VerifyCosignBlobResult {
+    readonly outcome: CosignVerifyOutcome;
+    readonly matchedIdentity?: string;
+}
+export declare function verifyCosignBlob(input: VerifyCosignBlobInput): Promise<VerifyCosignBlobResult>;
+//# sourceMappingURL=cosign-exec.d.ts.map

package/dist/lib/cosign-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AASD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAuBjC"}

package/dist/lib/cosign-exec.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureCosignAvailable = ensureCosignAvailable;
+exports.verifyCosignSignature = verifyCosignSignature;
+exports.verifyCosignAttestation = verifyCosignAttestation;
+exports.verifyCosignBlob = verifyCosignBlob;
+const node_child_process_1 = require("node:child_process");
+const verdicts_1 = require("./verdicts");
+const DEFAULT_COSIGN_BIN = 'cosign';
+function runCosign(bin, args) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)(bin, [...args], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stderr = '';
+        child.stderr?.on('data', (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            resolve({ code: code ?? 1, stderr });
+        });
+    });
+}
+async function ensureCosignAvailable(bin = DEFAULT_COSIGN_BIN) {
+    try {
+        const { code, stderr } = await runCosign(bin, ['version']);
+        if (code !== 0) {
+            throw new Error(`\`${bin} version\` exited ${code}: ${stderr.slice(-200)}`);
+        }
+    }
+    catch (cause) {
+        throw new Error(`cosign CLI is not on PATH — install from https://github.com/sigstore/cosign ` +
+            `(${cause instanceof Error ? cause.message : String(cause)})`);
+    }
+}
+async function verifyCosignSignature(input) {
+    const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+    const args = ['verify'];
+    if (input.keyPath) {
+        args.push('--key', input.keyPath);
+    }
+    else {
+        if (input.trustedIdentities.length === 0) {
+            throw new Error('verifyCosignSignature: keyless mode requires at least one trusted identity');
+        }
+        for (const id of input.trustedIdentities) {
+            args.push('--certificate-identity', id);
+        }
+        if (input.oidcIssuer) {
+            args.push('--certificate-oidc-issuer', input.oidcIssuer);
+        }
+    }
+    args.push(input.ociRef);
+    const { code, stderr } = await runCosign(bin, args);
+    if (code !== 0) {
+        throw new Error(`${bin} verify failed (code=${code}): ${stderr.slice(-200)}`);
+    }
+}
+async function verifyCosignAttestation(input) {
+    const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+    const args = ['verify-attestation', '--type', input.predicateType];
+    if (input.keyPath) {
+        args.push('--key', input.keyPath);
+    }
+    else {
+        if (input.trustedIdentities.length === 0) {
+            throw new Error('verifyCosignAttestation: keyless mode requires at least one trusted identity');
+        }
+        for (const id of input.trustedIdentities) {
+            args.push('--certificate-identity', id);
+        }
+        if (input.oidcIssuer) {
+            args.push('--certificate-oidc-issuer', input.oidcIssuer);
+        }
+    }
+    args.push(input.ociRef);
+    const { code, stderr } = await runCosign(bin, args);
+    if (code !== 0) {
+        throw new Error(`${bin} verify-attestation failed (code=${code}): ${stderr.slice(-200)}`);
+    }
+}
+async function verifyCosignBlob(input) {
+    const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+    if (input.trustedIdentityRegexps.length === 0) {
+        return { outcome: verdicts_1.CosignVerifyOutcome.Failed };
+    }
+    for (const identity of input.trustedIdentityRegexps) {
+        const args = [
+            'verify-blob',
+            '--bundle',
+            input.bundlePath,
+            '--certificate-identity-regexp',
+            identity,
+        ];
+        if (input.oidcIssuer) {
+            args.push('--certificate-oidc-issuer', input.oidcIssuer);
+        }
+        args.push(input.artifactPath);
+        const { code } = await runCosign(bin, args);
+        if (code === 0) {
+            return { outcome: verdicts_1.CosignVerifyOutcome.Verified, matchedIdentity: identity };
+        }
+    }
+    return { outcome: verdicts_1.CosignVerifyOutcome.Failed };
+}
+//# sourceMappingURL=cosign-exec.js.map

package/dist/lib/cosign-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;AAsCA,sDAcC;AAiBD,sDAyBC;AAeD,0DA2BC;AA0BD,4CAyBC;AA3LD,2DAA2C;AAE3C,yCAAiD;AAGjD,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAapC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAiBM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,wBAAwB,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAeM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AA0BM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACpD,MAAM,IAAI,GAAa;YACrB,aAAa;YACb,UAAU;YACV,KAAK,CAAC,UAAU;YAChB,+BAA+B;YAC/B,QAAQ;SACT,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}

package/dist/lib/verdicts.d.ts

@@ -0,0 +1,24 @@
+export declare enum SignatureVerdict {
+    Valid = "valid",
+    Invalid = "invalid",
+    Unsigned = "unsigned"
+}
+export declare enum ProvenanceVerdict {
+    Valid = "valid",
+    Invalid = "invalid",
+    Missing = "missing"
+}
+export declare enum CosignErrorCode {
+    SignatureMissing = "BIOME_SIGNATURE_MISSING",
+    SignatureInvalid = "BIOME_SIGNATURE_INVALID",
+    IdentityNotTrusted = "BIOME_SIGNATURE_IDENTITY_NOT_TRUSTED",
+    ProvenanceMissing = "BIOME_PROVENANCE_MISSING",
+    ProvenanceInvalid = "BIOME_PROVENANCE_INVALID",
+    CosignUnavailable = "BIOME_COSIGN_UNAVAILABLE"
+}
+export declare enum CosignVerifyOutcome {
+    Verified = "verified",
+    Failed = "failed"
+}
+export declare const SLSA_PROVENANCE_PREDICATE_TYPE: "https://slsa.dev/provenance/v1";
+//# sourceMappingURL=verdicts.d.ts.map

package/dist/lib/verdicts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAgBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;CAC/C;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}

package/dist/lib/verdicts.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SLSA_PROVENANCE_PREDICATE_TYPE = exports.CosignVerifyOutcome = exports.CosignErrorCode = exports.ProvenanceVerdict = exports.SignatureVerdict = void 0;
+var SignatureVerdict;
+(function (SignatureVerdict) {
+    SignatureVerdict["Valid"] = "valid";
+    SignatureVerdict["Invalid"] = "invalid";
+    SignatureVerdict["Unsigned"] = "unsigned";
+})(SignatureVerdict || (exports.SignatureVerdict = SignatureVerdict = {}));
+var ProvenanceVerdict;
+(function (ProvenanceVerdict) {
+    ProvenanceVerdict["Valid"] = "valid";
+    ProvenanceVerdict["Invalid"] = "invalid";
+    ProvenanceVerdict["Missing"] = "missing";
+})(ProvenanceVerdict || (exports.ProvenanceVerdict = ProvenanceVerdict = {}));
+var CosignErrorCode;
+(function (CosignErrorCode) {
+    CosignErrorCode["SignatureMissing"] = "BIOME_SIGNATURE_MISSING";
+    CosignErrorCode["SignatureInvalid"] = "BIOME_SIGNATURE_INVALID";
+    CosignErrorCode["IdentityNotTrusted"] = "BIOME_SIGNATURE_IDENTITY_NOT_TRUSTED";
+    CosignErrorCode["ProvenanceMissing"] = "BIOME_PROVENANCE_MISSING";
+    CosignErrorCode["ProvenanceInvalid"] = "BIOME_PROVENANCE_INVALID";
+    CosignErrorCode["CosignUnavailable"] = "BIOME_COSIGN_UNAVAILABLE";
+})(CosignErrorCode || (exports.CosignErrorCode = CosignErrorCode = {}));
+var CosignVerifyOutcome;
+(function (CosignVerifyOutcome) {
+    CosignVerifyOutcome["Verified"] = "verified";
+    CosignVerifyOutcome["Failed"] = "failed";
+})(CosignVerifyOutcome || (exports.CosignVerifyOutcome = CosignVerifyOutcome = {}));
+exports.SLSA_PROVENANCE_PREDICATE_TYPE = 'https://slsa.dev/provenance/v1';
+//# sourceMappingURL=verdicts.js.map

package/dist/lib/verdicts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAgBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;AAChD,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@xemahq/biome-supply-chain",
+  "version": "0.1.0",
+  "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundles) and @xemahq/biome-package (packaging CLI). Node-builtins only.",
+  "license": "Apache-2.0",
+  "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
+  "homepage": "https://xema.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xema-dev/xema-biome-sdk.git",
+    "directory": "packages/sdks/biome-supply-chain"
+  },
+  "bugs": "https://github.com/xema-dev/xema-biome-sdk/issues",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "xema-source": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./dist/lib/*": {
+      "types": "./dist/lib/*.d.ts",
+      "default": "./dist/lib/*.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "src"
+  ],
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "jest": "^29.0.0",
+    "ts-jest": "^29.0.0",
+    "typescript": "^5.0.0"
+  },
+  "keywords": [
+    "xema",
+    "biome",
+    "cosign",
+    "sigstore",
+    "slsa",
+    "supply-chain",
+    "signature-verification"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "type-check": "tsc --noEmit",
+    "lint": "tsc --noEmit",
+    "test": "jest --passWithNoTests"
+  }
+}

package/src/index.ts

@@ -0,0 +1,2 @@
+export * from './lib/verdicts';
+export * from './lib/cosign-exec';

package/src/lib/cosign-exec.ts

@@ -0,0 +1,188 @@
+import { spawn } from 'node:child_process';
+
+import { CosignVerifyOutcome } from './verdicts';
+
+/** Default cosign binary name (overridable per call). */
+const DEFAULT_COSIGN_BIN = 'cosign';
+
+interface CosignRunResult {
+  readonly code: number;
+  readonly stderr: string;
+}
+
+/**
+ * The single canonical cosign invocation. Spawns the binary, captures stderr,
+ * and resolves with the exit code (never rejects on a non-zero exit — the
+ * caller decides whether a non-zero code is an error or a "failed" verdict).
+ * Rejects only when the process cannot be spawned at all.
+ */
+function runCosign(
+  bin: string,
+  args: readonly string[],
+): Promise<CosignRunResult> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(bin, [...args], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stderr = '';
+    child.stderr?.on('data', (chunk: Buffer) => {
+      stderr += chunk.toString();
+    });
+    child.on('error', reject);
+    child.on('close', (code) => {
+      resolve({ code: code ?? 1, stderr });
+    });
+  });
+}
+
+/** Throws if the cosign CLI is not available on PATH. */
+export async function ensureCosignAvailable(
+  bin: string = DEFAULT_COSIGN_BIN,
+): Promise<void> {
+  try {
+    const { code, stderr } = await runCosign(bin, ['version']);
+    if (code !== 0) {
+      throw new Error(`\`${bin} version\` exited ${code}: ${stderr.slice(-200)}`);
+    }
+  } catch (cause) {
+    throw new Error(
+      `cosign CLI is not on PATH — install from https://github.com/sigstore/cosign ` +
+        `(${cause instanceof Error ? cause.message : String(cause)})`,
+    );
+  }
+}
+
+export interface VerifyCosignSignatureInput {
+  readonly ociRef: string;
+  /** Exact keyless certificate-identity URIs (any one may match). */
+  readonly trustedIdentities: readonly string[];
+  readonly oidcIssuer?: string;
+  /** Keyed verification: path to the public key (mutually exclusive w/ keyless). */
+  readonly keyPath?: string;
+  readonly bin?: string;
+}
+
+/**
+ * Verify a signature on an OCI ref (keyless identity allowlist OR keyed).
+ * Throws on non-verification; resolves on success. Mirrors the fetcher's
+ * former inline behaviour.
+ */
+export async function verifyCosignSignature(
+  input: VerifyCosignSignatureInput,
+): Promise<void> {
+  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+  const args: string[] = ['verify'];
+  if (input.keyPath) {
+    args.push('--key', input.keyPath);
+  } else {
+    if (input.trustedIdentities.length === 0) {
+      throw new Error(
+        'verifyCosignSignature: keyless mode requires at least one trusted identity',
+      );
+    }
+    for (const id of input.trustedIdentities) {
+      args.push('--certificate-identity', id);
+    }
+    if (input.oidcIssuer) {
+      args.push('--certificate-oidc-issuer', input.oidcIssuer);
+    }
+  }
+  args.push(input.ociRef);
+  const { code, stderr } = await runCosign(bin, args);
+  if (code !== 0) {
+    throw new Error(`${bin} verify failed (code=${code}): ${stderr.slice(-200)}`);
+  }
+}
+
+export interface VerifyCosignAttestationInput {
+  readonly ociRef: string;
+  readonly predicateType: string;
+  readonly trustedIdentities: readonly string[];
+  readonly oidcIssuer?: string;
+  readonly keyPath?: string;
+  readonly bin?: string;
+}
+
+/**
+ * Verify an in-toto/SLSA attestation on an OCI ref. Throws on
+ * non-verification; resolves on success.
+ */
+export async function verifyCosignAttestation(
+  input: VerifyCosignAttestationInput,
+): Promise<void> {
+  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+  const args: string[] = ['verify-attestation', '--type', input.predicateType];
+  if (input.keyPath) {
+    args.push('--key', input.keyPath);
+  } else {
+    if (input.trustedIdentities.length === 0) {
+      throw new Error(
+        'verifyCosignAttestation: keyless mode requires at least one trusted identity',
+      );
+    }
+    for (const id of input.trustedIdentities) {
+      args.push('--certificate-identity', id);
+    }
+    if (input.oidcIssuer) {
+      args.push('--certificate-oidc-issuer', input.oidcIssuer);
+    }
+  }
+  args.push(input.ociRef);
+  const { code, stderr } = await runCosign(bin, args);
+  if (code !== 0) {
+    throw new Error(
+      `${bin} verify-attestation failed (code=${code}): ${stderr.slice(-200)}`,
+    );
+  }
+}
+
+export interface VerifyCosignBlobInput {
+  /** Path to the artifact bytes on disk (caller owns fetch/temp-file lifecycle). */
+  readonly artifactPath: string;
+  /** Path to the detached signature bundle on disk. */
+  readonly bundlePath: string;
+  /** Keyless certificate-identity REGEXPS (any one may match). */
+  readonly trustedIdentityRegexps: readonly string[];
+  readonly oidcIssuer?: string;
+  readonly bin?: string;
+}
+
+export interface VerifyCosignBlobResult {
+  readonly outcome: CosignVerifyOutcome;
+  /** The identity regexp that matched, when Verified. */
+  readonly matchedIdentity?: string;
+}
+
+/**
+ * Verify a detached signature over a blob (`cosign verify-blob --bundle`).
+ * Tries each trusted identity regexp; the first that verifies wins. Returns a
+ * neutral {@link CosignVerifyOutcome} (never throws on a failed verification —
+ * an empty trust list or all-mismatch resolves to `Failed`). The caller owns
+ * artifact/bundle materialisation on disk.
+ */
+export async function verifyCosignBlob(
+  input: VerifyCosignBlobInput,
+): Promise<VerifyCosignBlobResult> {
+  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+  if (input.trustedIdentityRegexps.length === 0) {
+    return { outcome: CosignVerifyOutcome.Failed };
+  }
+  for (const identity of input.trustedIdentityRegexps) {
+    const args: string[] = [
+      'verify-blob',
+      '--bundle',
+      input.bundlePath,
+      '--certificate-identity-regexp',
+      identity,
+    ];
+    if (input.oidcIssuer) {
+      args.push('--certificate-oidc-issuer', input.oidcIssuer);
+    }
+    args.push(input.artifactPath);
+    const { code } = await runCosign(bin, args);
+    if (code === 0) {
+      return { outcome: CosignVerifyOutcome.Verified, matchedIdentity: identity };
+    }
+  }
+  return { outcome: CosignVerifyOutcome.Failed };
+}

package/src/lib/verdicts.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared cosign supply-chain verdict vocabulary.
+ *
+ * This is the single source of truth for the lowercase verdict/error enums
+ * that `biome-fetcher-api` (OCI bundle verification) and `@xemahq/biome-package`
+ * (the packaging CLI) previously duplicated locally. They are value-identical
+ * to those former copies, so adopting this package is a pure de-duplication
+ * with no wire/behaviour change.
+ *
+ * NOTE: `xema-store-api` keeps its OWN UPPERCASE `SignatureVerdict` /
+ * `ProvenanceVerdict` (persisted + OpenAPI + cross-service event wire); it
+ * consumes only the cosign EXEC + {@link CosignVerifyOutcome} from this
+ * package, mapping the neutral outcome to its own wire enum.
+ */
+
+/** Signature verification verdict. */
+export enum SignatureVerdict {
+  Valid = 'valid',
+  Invalid = 'invalid',
+  Unsigned = 'unsigned',
+}
+
+/** SLSA attestation / provenance verdict. */
+export enum ProvenanceVerdict {
+  Valid = 'valid',
+  Invalid = 'invalid',
+  Missing = 'missing',
+}
+
+/** Stable, typed reasons a cosign verification may reject an artifact. */
+export enum CosignErrorCode {
+  SignatureMissing = 'BIOME_SIGNATURE_MISSING',
+  SignatureInvalid = 'BIOME_SIGNATURE_INVALID',
+  IdentityNotTrusted = 'BIOME_SIGNATURE_IDENTITY_NOT_TRUSTED',
+  ProvenanceMissing = 'BIOME_PROVENANCE_MISSING',
+  ProvenanceInvalid = 'BIOME_PROVENANCE_INVALID',
+  CosignUnavailable = 'BIOME_COSIGN_UNAVAILABLE',
+}
+
+/**
+ * Casing-neutral internal outcome of a detached-blob verification. The blob
+ * path (store) maps this to its own UPPERCASE wire verdict; it deliberately
+ * does not leak the wire casing into the shared exec layer.
+ */
+export enum CosignVerifyOutcome {
+  Verified = 'verified',
+  Failed = 'failed',
+}
+
+/** Canonical SLSA provenance predicate type. */
+export const SLSA_PROVENANCE_PREDICATE_TYPE =
+  'https://slsa.dev/provenance/v1' as const;