@xemahq/biome-supply-chain 0.1.1 → 0.1.3

package/LICENSE

@@ -9,7 +9,7 @@ Parameters
 
 Licensor:  Neuralchowder Inc.
 
-Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc..
+Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc.
 
   The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
   Xema Kernel, Xema control plane, Xema application runtime, Xema biome

package/README.md

@@ -4,7 +4,7 @@ This package belongs to Layer 1 — a framework-free runtime SDK utility.
 
 Shared cosign supply-chain verification for Xema biomes. It centralizes the two
 things that were previously copy-pasted between `biome-fetcher-api` (OCI bundle
-verification) and `@xemahq/biome-package` (the packaging CLI):
+verification) and `xema-store-api`:
 
 - the single cosign CLI invocation (`ensureCosignAvailable`,
   `verifyCosignSignature`, `verifyCosignAttestation`, `verifyCosignBlob`), and
@@ -49,3 +49,9 @@ if (outcome === CosignVerifyOutcome.Verified) {
 Artifact resolution (resolving an OCI ref, or fetching + writing a blob to a
 temp file) stays with each consumer; this package owns only the cosign exec and
 the verdict enums.
+
+## License
+
+Business Source License 1.1 (BSL-1.1) — source-available; converts to MPL-2.0
+four years after each release. © Xema — [xema.dev](https://xema.dev). See
+the [repository LICENSE](../../../LICENSE).

package/dist/lib/verdicts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAgBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;CAC/C;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}
+{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAqBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;CAC/C;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}

package/dist/lib/verdicts.js.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAgBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;AAChD,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}
+{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAqBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;AAChD,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@xemahq/biome-supply-chain",
-  "version": "0.1.1",
-  "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundles) and @xemahq/biome-package (packaging CLI). Node-builtins only.",
-  "license": "Apache-2.0",
+  "version": "0.1.3",
+  "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
+  "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
   "homepage": "https://xema.dev",
   "repository": {
@@ -29,14 +29,11 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "jest": "^29.0.0",
-    "ts-jest": "^29.0.0",
-    "typescript": "^5.0.0"
+    "@types/node": "25.2.3",
+    "typescript": "5.9.3"
   },
   "keywords": [
     "xema",
@@ -48,9 +45,9 @@
     "signature-verification"
   ],
   "scripts": {
-    "build": "tsc",
-    "type-check": "tsc --noEmit",
-    "lint": "tsc --noEmit",
-    "test": "jest --passWithNoTests"
+    "build": "tsc -p tsconfig.build.json",
+    "test": "tsc -p tsconfig.json && node --test \"dist-test/test/**/*.test.js\"",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rm -rf dist dist-test"
   }
 }

package/src/index.ts

@@ -1,2 +0,0 @@
-export * from './lib/verdicts';
-export * from './lib/cosign-exec';

package/src/lib/cosign-exec.ts

@@ -1,188 +0,0 @@
-import { spawn } from 'node:child_process';
-
-import { CosignVerifyOutcome } from './verdicts';
-
-/** Default cosign binary name (overridable per call). */
-const DEFAULT_COSIGN_BIN = 'cosign';
-
-interface CosignRunResult {
-  readonly code: number;
-  readonly stderr: string;
-}
-
-/**
- * The single canonical cosign invocation. Spawns the binary, captures stderr,
- * and resolves with the exit code (never rejects on a non-zero exit — the
- * caller decides whether a non-zero code is an error or a "failed" verdict).
- * Rejects only when the process cannot be spawned at all.
- */
-function runCosign(
-  bin: string,
-  args: readonly string[],
-): Promise<CosignRunResult> {
-  return new Promise((resolve, reject) => {
-    const child = spawn(bin, [...args], {
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let stderr = '';
-    child.stderr?.on('data', (chunk: Buffer) => {
-      stderr += chunk.toString();
-    });
-    child.on('error', reject);
-    child.on('close', (code) => {
-      resolve({ code: code ?? 1, stderr });
-    });
-  });
-}
-
-/** Throws if the cosign CLI is not available on PATH. */
-export async function ensureCosignAvailable(
-  bin: string = DEFAULT_COSIGN_BIN,
-): Promise<void> {
-  try {
-    const { code, stderr } = await runCosign(bin, ['version']);
-    if (code !== 0) {
-      throw new Error(`\`${bin} version\` exited ${code}: ${stderr.slice(-200)}`);
-    }
-  } catch (cause) {
-    throw new Error(
-      `cosign CLI is not on PATH — install from https://github.com/sigstore/cosign ` +
-        `(${cause instanceof Error ? cause.message : String(cause)})`,
-    );
-  }
-}
-
-export interface VerifyCosignSignatureInput {
-  readonly ociRef: string;
-  /** Exact keyless certificate-identity URIs (any one may match). */
-  readonly trustedIdentities: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  /** Keyed verification: path to the public key (mutually exclusive w/ keyless). */
-  readonly keyPath?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-/**
- * Verify a signature on an OCI ref (keyless identity allowlist OR keyed).
- * Throws on non-verification; resolves on success. Mirrors the fetcher's
- * former inline behaviour.
- */
-export async function verifyCosignSignature(
-  input: VerifyCosignSignatureInput,
-): Promise<void> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  const args: string[] = ['verify'];
-  if (input.keyPath) {
-    args.push('--key', input.keyPath);
-  } else {
-    if (input.trustedIdentities.length === 0) {
-      throw new Error(
-        'verifyCosignSignature: keyless mode requires at least one trusted identity',
-      );
-    }
-    for (const id of input.trustedIdentities) {
-      args.push('--certificate-identity', id);
-    }
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-  }
-  args.push(input.ociRef);
-  const { code, stderr } = await runCosign(bin, args);
-  if (code !== 0) {
-    throw new Error(`${bin} verify failed (code=${code}): ${stderr.slice(-200)}`);
-  }
-}
-
-export interface VerifyCosignAttestationInput {
-  readonly ociRef: string;
-  readonly predicateType: string;
-  readonly trustedIdentities: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  readonly keyPath?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-/**
- * Verify an in-toto/SLSA attestation on an OCI ref. Throws on
- * non-verification; resolves on success.
- */
-export async function verifyCosignAttestation(
-  input: VerifyCosignAttestationInput,
-): Promise<void> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  const args: string[] = ['verify-attestation', '--type', input.predicateType];
-  if (input.keyPath) {
-    args.push('--key', input.keyPath);
-  } else {
-    if (input.trustedIdentities.length === 0) {
-      throw new Error(
-        'verifyCosignAttestation: keyless mode requires at least one trusted identity',
-      );
-    }
-    for (const id of input.trustedIdentities) {
-      args.push('--certificate-identity', id);
-    }
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-  }
-  args.push(input.ociRef);
-  const { code, stderr } = await runCosign(bin, args);
-  if (code !== 0) {
-    throw new Error(
-      `${bin} verify-attestation failed (code=${code}): ${stderr.slice(-200)}`,
-    );
-  }
-}
-
-export interface VerifyCosignBlobInput {
-  /** Path to the artifact bytes on disk (caller owns fetch/temp-file lifecycle). */
-  readonly artifactPath: string;
-  /** Path to the detached signature bundle on disk. */
-  readonly bundlePath: string;
-  /** Keyless certificate-identity REGEXPS (any one may match). */
-  readonly trustedIdentityRegexps: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-export interface VerifyCosignBlobResult {
-  readonly outcome: CosignVerifyOutcome;
-  /** The identity regexp that matched, when Verified. */
-  readonly matchedIdentity?: string | undefined;
-}
-
-/**
- * Verify a detached signature over a blob (`cosign verify-blob --bundle`).
- * Tries each trusted identity regexp; the first that verifies wins. Returns a
- * neutral {@link CosignVerifyOutcome} (never throws on a failed verification —
- * an empty trust list or all-mismatch resolves to `Failed`). The caller owns
- * artifact/bundle materialisation on disk.
- */
-export async function verifyCosignBlob(
-  input: VerifyCosignBlobInput,
-): Promise<VerifyCosignBlobResult> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  if (input.trustedIdentityRegexps.length === 0) {
-    return { outcome: CosignVerifyOutcome.Failed };
-  }
-  for (const identity of input.trustedIdentityRegexps) {
-    const args: string[] = [
-      'verify-blob',
-      '--bundle',
-      input.bundlePath,
-      '--certificate-identity-regexp',
-      identity,
-    ];
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-    args.push(input.artifactPath);
-    const { code } = await runCosign(bin, args);
-    if (code === 0) {
-      return { outcome: CosignVerifyOutcome.Verified, matchedIdentity: identity };
-    }
-  }
-  return { outcome: CosignVerifyOutcome.Failed };
-}

package/src/lib/verdicts.ts

@@ -1,52 +0,0 @@
-/**
- * Shared cosign supply-chain verdict vocabulary.
- *
- * This is the single source of truth for the lowercase verdict/error enums
- * that `biome-fetcher-api` (OCI bundle verification) and `@xemahq/biome-package`
- * (the packaging CLI) previously duplicated locally. They are value-identical
- * to those former copies, so adopting this package is a pure de-duplication
- * with no wire/behaviour change.
- *
- * NOTE: `xema-store-api` keeps its OWN UPPERCASE `SignatureVerdict` /
- * `ProvenanceVerdict` (persisted + OpenAPI + cross-service event wire); it
- * consumes only the cosign EXEC + {@link CosignVerifyOutcome} from this
- * package, mapping the neutral outcome to its own wire enum.
- */
-
-/** Signature verification verdict. */
-export enum SignatureVerdict {
-  Valid = 'valid',
-  Invalid = 'invalid',
-  Unsigned = 'unsigned',
-}
-
-/** SLSA attestation / provenance verdict. */
-export enum ProvenanceVerdict {
-  Valid = 'valid',
-  Invalid = 'invalid',
-  Missing = 'missing',
-}
-
-/** Stable, typed reasons a cosign verification may reject an artifact. */
-export enum CosignErrorCode {
-  SignatureMissing = 'BIOME_SIGNATURE_MISSING',
-  SignatureInvalid = 'BIOME_SIGNATURE_INVALID',
-  IdentityNotTrusted = 'BIOME_SIGNATURE_IDENTITY_NOT_TRUSTED',
-  ProvenanceMissing = 'BIOME_PROVENANCE_MISSING',
-  ProvenanceInvalid = 'BIOME_PROVENANCE_INVALID',
-  CosignUnavailable = 'BIOME_COSIGN_UNAVAILABLE',
-}
-
-/**
- * Casing-neutral internal outcome of a detached-blob verification. The blob
- * path (store) maps this to its own UPPERCASE wire verdict; it deliberately
- * does not leak the wire casing into the shared exec layer.
- */
-export enum CosignVerifyOutcome {
-  Verified = 'verified',
-  Failed = 'failed',
-}
-
-/** Canonical SLSA provenance predicate type. */
-export const SLSA_PROVENANCE_PREDICATE_TYPE =
-  'https://slsa.dev/provenance/v1' as const;