@xemahq/biome-supply-chain 0.1.2 → 0.2.0

package/README.md

@@ -22,6 +22,7 @@ import {
   ensureCosignAvailable,
   verifyCosignSignature,
   verifyCosignBlob,
+  CosignTrustAnchorKind,
   SignatureVerdict,
   CosignVerifyOutcome,
 } from '@xemahq/biome-supply-chain';
@@ -35,20 +36,41 @@ await verifyCosignSignature({
   oidcIssuer: 'https://token.actions.githubusercontent.com',
 });
 
-// Detached blob (caller owns artifact/bundle files on disk)
-const { outcome, matchedIdentity } = await verifyCosignBlob({
+// Detached blob (caller owns artifact/bundle/public-key files on disk).
+// A trust anchor is EITHER a keyless certificate-identity pattern OR a NAMED
+// public key; both kinds share one list and one result shape, and the anchors
+// are tried in order until one verifies.
+const { outcome, matchedAnchor } = await verifyCosignBlob({
   artifactPath: '/tmp/remoteEntry.js',
   bundlePath: '/tmp/remoteEntry.js.bundle',
-  trustedIdentityRegexps: ['^https://github.com/xema-dev/.*$'],
+  anchors: [
+    {
+      kind: CosignTrustAnchorKind.KeylessIdentity,
+      name: '^https://github.com/xema-dev/.*$', // the name IS the regexp
+    },
+    {
+      kind: CosignTrustAnchorKind.PublicKey,
+      name: 'release-2026',
+      publicKeyPath: '/etc/cosign/release.pub',
+    },
+  ],
+  // Optional: pin the Sigstore trusted root so KEYLESS anchors verify with
+  // `--offline --trusted-root` (air-gap capable). A missing, unreadable or
+  // digest-mismatched root THROWS `CosignTrustedRootError` before cosign is
+  // spawned — it never falls back to cosign's online default.
+  trustedRoot: { path: '/etc/sigstore/trusted-root.json', sha256: '<64 hex>' },
 });
 if (outcome === CosignVerifyOutcome.Verified) {
-  // matchedIdentity is the regexp that verified
+  // matchedAnchor is { kind, name } — WHICH anchor vouched for the bytes
 }
 ```
 
+An empty `anchors` list resolves to `Failed` without spawning cosign, and a
+failed verification is a neutral outcome rather than a throw.
+
 Artifact resolution (resolving an OCI ref, or fetching + writing a blob to a
-temp file) stays with each consumer; this package owns only the cosign exec and
-the verdict enums.
+temp file) stays with each consumer; this package owns only the cosign exec,
+the trust-anchor vocabulary and the verdict enums.
 
 ## License
 

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from './lib/verdicts';
+export * from './lib/trust-anchors';
 export * from './lib/cosign-exec';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -15,5 +15,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./lib/verdicts"), exports);
+__exportStar(require("./lib/trust-anchors"), exports);
 __exportStar(require("./lib/cosign-exec"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,oDAAkC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,oDAAkC"}

package/dist/lib/cosign-exec.d.ts

@@ -1,3 +1,4 @@
+import { type CosignBlobTrustAnchor, type CosignMatchedAnchor, type CosignPinnedTrustedRoot } from './trust-anchors';
 import { CosignVerifyOutcome } from './verdicts';
 export declare function ensureCosignAvailable(bin?: string): Promise<void>;
 export interface VerifyCosignSignatureInput {
@@ -20,13 +21,14 @@ export declare function verifyCosignAttestation(input: VerifyCosignAttestationIn
 export interface VerifyCosignBlobInput {
     readonly artifactPath: string;
     readonly bundlePath: string;
-    readonly trustedIdentityRegexps: readonly string[];
+    readonly anchors: readonly CosignBlobTrustAnchor[];
     readonly oidcIssuer?: string | undefined;
+    readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
     readonly bin?: string | undefined;
 }
 export interface VerifyCosignBlobResult {
     readonly outcome: CosignVerifyOutcome;
-    readonly matchedIdentity?: string | undefined;
+    readonly matchedAnchor?: CosignMatchedAnchor | undefined;
 }
 export declare function verifyCosignBlob(input: VerifyCosignBlobInput): Promise<VerifyCosignBlobResult>;
 //# sourceMappingURL=cosign-exec.d.ts.map

package/dist/lib/cosign-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AASD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAuBjC"}
+{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAO5B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAKnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAWzC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAOtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1D;AA8DD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAoBjC"}

package/dist/lib/cosign-exec.js

@@ -5,6 +5,7 @@ exports.verifyCosignSignature = verifyCosignSignature;
 exports.verifyCosignAttestation = verifyCosignAttestation;
 exports.verifyCosignBlob = verifyCosignBlob;
 const node_child_process_1 = require("node:child_process");
+const trust_anchors_1 = require("./trust-anchors");
 const verdicts_1 = require("./verdicts");
 const DEFAULT_COSIGN_BIN = 'cosign';
 function runCosign(bin, args) {
@@ -80,26 +81,38 @@ async function verifyCosignAttestation(input) {
         throw new Error(`${bin} verify-attestation failed (code=${code}): ${stderr.slice(-200)}`);
     }
 }
+function buildBlobVerifyArgs(anchor, input) {
+    const args = ['verify-blob'];
+    if (anchor.kind === trust_anchors_1.CosignTrustAnchorKind.PublicKey) {
+        args.push('--key', anchor.publicKeyPath, '--bundle', input.bundlePath, '--insecure-ignore-tlog');
+        args.push(input.artifactPath);
+        return args;
+    }
+    args.push('--bundle', input.bundlePath, '--certificate-identity-regexp', anchor.name);
+    if (input.oidcIssuer) {
+        args.push('--certificate-oidc-issuer', input.oidcIssuer);
+    }
+    if (input.trustedRoot) {
+        args.push('--offline', '--trusted-root', input.trustedRoot.path);
+    }
+    args.push(input.artifactPath);
+    return args;
+}
 async function verifyCosignBlob(input) {
     const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-    if (input.trustedIdentityRegexps.length === 0) {
+    if (input.anchors.length === 0) {
         return { outcome: verdicts_1.CosignVerifyOutcome.Failed };
     }
-    for (const identity of input.trustedIdentityRegexps) {
-        const args = [
-            'verify-blob',
-            '--bundle',
-            input.bundlePath,
-            '--certificate-identity-regexp',
-            identity,
-        ];
-        if (input.oidcIssuer) {
-            args.push('--certificate-oidc-issuer', input.oidcIssuer);
-        }
-        args.push(input.artifactPath);
-        const { code } = await runCosign(bin, args);
+    if (input.trustedRoot) {
+        (0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
+    }
+    for (const anchor of input.anchors) {
+        const { code } = await runCosign(bin, buildBlobVerifyArgs(anchor, input));
         if (code === 0) {
-            return { outcome: verdicts_1.CosignVerifyOutcome.Verified, matchedIdentity: identity };
+            return {
+                outcome: verdicts_1.CosignVerifyOutcome.Verified,
+                matchedAnchor: { kind: anchor.kind, name: anchor.name },
+            };
         }
     }
     return { outcome: verdicts_1.CosignVerifyOutcome.Failed };

package/dist/lib/cosign-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;AAsCA,sDAcC;AAiBD,sDAyBC;AAeD,0DA2BC;AA0BD,4CAyBC;AA3LD,2DAA2C;AAE3C,yCAAiD;AAGjD,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAapC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAiBM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,wBAAwB,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAeM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AA0BM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACpD,MAAM,IAAI,GAAa;YACrB,aAAa;YACb,UAAU;YACV,KAAK,CAAC,UAAU;YAChB,+BAA+B;YAC/B,QAAQ;SACT,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;AA6CA,sDAcC;AAiBD,sDAyBC;AAeD,0DA2BC;AAwGD,4CAsBC;AA7QD,2DAA2C;AAE3C,mDAMyB;AACzB,yCAAiD;AAGjD,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAapC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAiBM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,wBAAwB,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAeM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAwDD,SAAS,mBAAmB,CAC1B,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,+BAA+B,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAMtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAaM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAGtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8BAAmB,CAAC,QAAQ;gBACrC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}

package/dist/lib/trust-anchors.d.ts

@@ -0,0 +1,27 @@
+export declare enum CosignTrustAnchorKind {
+    KeylessIdentity = "keyless-identity",
+    PublicKey = "public-key"
+}
+export interface CosignKeylessIdentityAnchor {
+    readonly kind: CosignTrustAnchorKind.KeylessIdentity;
+    readonly name: string;
+}
+export interface CosignPublicKeyAnchor {
+    readonly kind: CosignTrustAnchorKind.PublicKey;
+    readonly name: string;
+    readonly publicKeyPath: string;
+}
+export type CosignBlobTrustAnchor = CosignKeylessIdentityAnchor | CosignPublicKeyAnchor;
+export interface CosignMatchedAnchor {
+    readonly kind: CosignTrustAnchorKind;
+    readonly name: string;
+}
+export interface CosignPinnedTrustedRoot {
+    readonly path: string;
+    readonly sha256: string;
+}
+export declare class CosignTrustedRootError extends Error {
+    constructor(message: string);
+}
+export declare function assertPinnedTrustedRoot(root: CosignPinnedTrustedRoot): void;
+//# sourceMappingURL=trust-anchors.d.ts.map

package/dist/lib/trust-anchors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-anchors.d.ts","sourceRoot":"","sources":["../../src/lib/trust-anchors.ts"],"names":[],"mappings":"AAiBA,oBAAY,qBAAqB;IAC/B,eAAe,qBAAqB;IACpC,SAAS,eAAe;CACzB;AAQD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,eAAe,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAQD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,qBAAqB,CAAC;AAQ1B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAcD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAUD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAuBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CA0C3E"}

package/dist/lib/trust-anchors.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CosignTrustedRootError = exports.CosignTrustAnchorKind = void 0;
+exports.assertPinnedTrustedRoot = assertPinnedTrustedRoot;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+var CosignTrustAnchorKind;
+(function (CosignTrustAnchorKind) {
+    CosignTrustAnchorKind["KeylessIdentity"] = "keyless-identity";
+    CosignTrustAnchorKind["PublicKey"] = "public-key";
+})(CosignTrustAnchorKind || (exports.CosignTrustAnchorKind = CosignTrustAnchorKind = {}));
+class CosignTrustedRootError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CosignTrustedRootError';
+    }
+}
+exports.CosignTrustedRootError = CosignTrustedRootError;
+const SHA256_HEX = /^[a-f0-9]{64}$/u;
+const SIGSTORE_TRUSTED_ROOT_MEDIA_TYPE = 'application/vnd.dev.sigstore.trustedroot+json;version=0.1';
+const MAX_TRUSTED_ROOT_BYTES = 8 * 1024 * 1024;
+function assertPinnedTrustedRoot(root) {
+    if (!SHA256_HEX.test(root.sha256)) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted-root digest '${root.sha256}' is not a lowercase-hex sha256`);
+    }
+    let bytes;
+    try {
+        bytes = (0, node_fs_1.readFileSync)(root.path);
+    }
+    catch (cause) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted root '${root.path}' could not be read: ` +
+            `${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    if (bytes.byteLength > MAX_TRUSTED_ROOT_BYTES) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted root '${root.path}' is ${bytes.byteLength} bytes, over the ${MAX_TRUSTED_ROOT_BYTES}-byte ceiling`);
+    }
+    const actual = (0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex');
+    if (actual !== root.sha256) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted-root digest mismatch for '${root.path}': expected ${root.sha256}, got ${actual}`);
+    }
+    let document;
+    try {
+        document = JSON.parse(bytes.toString('utf8'));
+    }
+    catch (cause) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted root '${root.path}' is not valid JSON: ` +
+            `${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    const mediaType = document?.mediaType;
+    if (mediaType !== SIGSTORE_TRUSTED_ROOT_MEDIA_TYPE) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted root '${root.path}' declares mediaType ` +
+            `'${String(mediaType)}' — expected '${SIGSTORE_TRUSTED_ROOT_MEDIA_TYPE}'`);
+    }
+}
+//# sourceMappingURL=trust-anchors.js.map

package/dist/lib/trust-anchors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-anchors.js","sourceRoot":"","sources":["../../src/lib/trust-anchors.ts"],"names":[],"mappings":";;;AAoHA,0DA0CC;AA9JD,6CAAyC;AACzC,qCAAuC;AAgBvC,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,6DAAoC,CAAA;IACpC,iDAAwB,CAAA;AAC1B,CAAC,EAHW,qBAAqB,qCAArB,qBAAqB,QAGhC;AAoED,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAGD,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAOrC,MAAM,gCAAgC,GACpC,2DAA2D,CAAC;AAG9D,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAS/C,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAC9B,wCAAwC,IAAI,CAAC,MAAM,iCAAiC,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,QAAQ,KAAK,CAAC,UAAU,oBAAoB,sBAAsB,eAAe,CAC5H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAC9B,qDAAqD,IAAI,CAAC,IAAI,eAAe,IAAI,CAAC,MAAM,SAAS,MAAM,EAAE,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAI,QAA2C,EAAE,SAAS,CAAC;IAC1E,IAAI,SAAS,KAAK,gCAAgC,EAAE,CAAC;QACnD,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,IAAI,MAAM,CAAC,SAAS,CAAC,iBAAiB,gCAAgC,GAAG,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-supply-chain",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
   "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -29,8 +29,7 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "devDependencies": {
     "@types/node": "25.2.3",

package/src/index.ts

@@ -1,2 +0,0 @@
-export * from './lib/verdicts';
-export * from './lib/cosign-exec';

package/src/lib/cosign-exec.ts

@@ -1,188 +0,0 @@
-import { spawn } from 'node:child_process';
-
-import { CosignVerifyOutcome } from './verdicts';
-
-/** Default cosign binary name (overridable per call). */
-const DEFAULT_COSIGN_BIN = 'cosign';
-
-interface CosignRunResult {
-  readonly code: number;
-  readonly stderr: string;
-}
-
-/**
- * The single canonical cosign invocation. Spawns the binary, captures stderr,
- * and resolves with the exit code (never rejects on a non-zero exit — the
- * caller decides whether a non-zero code is an error or a "failed" verdict).
- * Rejects only when the process cannot be spawned at all.
- */
-function runCosign(
-  bin: string,
-  args: readonly string[],
-): Promise<CosignRunResult> {
-  return new Promise((resolve, reject) => {
-    const child = spawn(bin, [...args], {
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let stderr = '';
-    child.stderr?.on('data', (chunk: Buffer) => {
-      stderr += chunk.toString();
-    });
-    child.on('error', reject);
-    child.on('close', (code) => {
-      resolve({ code: code ?? 1, stderr });
-    });
-  });
-}
-
-/** Throws if the cosign CLI is not available on PATH. */
-export async function ensureCosignAvailable(
-  bin: string = DEFAULT_COSIGN_BIN,
-): Promise<void> {
-  try {
-    const { code, stderr } = await runCosign(bin, ['version']);
-    if (code !== 0) {
-      throw new Error(`\`${bin} version\` exited ${code}: ${stderr.slice(-200)}`);
-    }
-  } catch (cause) {
-    throw new Error(
-      `cosign CLI is not on PATH — install from https://github.com/sigstore/cosign ` +
-        `(${cause instanceof Error ? cause.message : String(cause)})`,
-    );
-  }
-}
-
-export interface VerifyCosignSignatureInput {
-  readonly ociRef: string;
-  /** Exact keyless certificate-identity URIs (any one may match). */
-  readonly trustedIdentities: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  /** Keyed verification: path to the public key (mutually exclusive w/ keyless). */
-  readonly keyPath?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-/**
- * Verify a signature on an OCI ref (keyless identity allowlist OR keyed).
- * Throws on non-verification; resolves on success. Mirrors the fetcher's
- * former inline behaviour.
- */
-export async function verifyCosignSignature(
-  input: VerifyCosignSignatureInput,
-): Promise<void> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  const args: string[] = ['verify'];
-  if (input.keyPath) {
-    args.push('--key', input.keyPath);
-  } else {
-    if (input.trustedIdentities.length === 0) {
-      throw new Error(
-        'verifyCosignSignature: keyless mode requires at least one trusted identity',
-      );
-    }
-    for (const id of input.trustedIdentities) {
-      args.push('--certificate-identity', id);
-    }
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-  }
-  args.push(input.ociRef);
-  const { code, stderr } = await runCosign(bin, args);
-  if (code !== 0) {
-    throw new Error(`${bin} verify failed (code=${code}): ${stderr.slice(-200)}`);
-  }
-}
-
-export interface VerifyCosignAttestationInput {
-  readonly ociRef: string;
-  readonly predicateType: string;
-  readonly trustedIdentities: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  readonly keyPath?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-/**
- * Verify an in-toto/SLSA attestation on an OCI ref. Throws on
- * non-verification; resolves on success.
- */
-export async function verifyCosignAttestation(
-  input: VerifyCosignAttestationInput,
-): Promise<void> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  const args: string[] = ['verify-attestation', '--type', input.predicateType];
-  if (input.keyPath) {
-    args.push('--key', input.keyPath);
-  } else {
-    if (input.trustedIdentities.length === 0) {
-      throw new Error(
-        'verifyCosignAttestation: keyless mode requires at least one trusted identity',
-      );
-    }
-    for (const id of input.trustedIdentities) {
-      args.push('--certificate-identity', id);
-    }
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-  }
-  args.push(input.ociRef);
-  const { code, stderr } = await runCosign(bin, args);
-  if (code !== 0) {
-    throw new Error(
-      `${bin} verify-attestation failed (code=${code}): ${stderr.slice(-200)}`,
-    );
-  }
-}
-
-export interface VerifyCosignBlobInput {
-  /** Path to the artifact bytes on disk (caller owns fetch/temp-file lifecycle). */
-  readonly artifactPath: string;
-  /** Path to the detached signature bundle on disk. */
-  readonly bundlePath: string;
-  /** Keyless certificate-identity REGEXPS (any one may match). */
-  readonly trustedIdentityRegexps: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-export interface VerifyCosignBlobResult {
-  readonly outcome: CosignVerifyOutcome;
-  /** The identity regexp that matched, when Verified. */
-  readonly matchedIdentity?: string | undefined;
-}
-
-/**
- * Verify a detached signature over a blob (`cosign verify-blob --bundle`).
- * Tries each trusted identity regexp; the first that verifies wins. Returns a
- * neutral {@link CosignVerifyOutcome} (never throws on a failed verification —
- * an empty trust list or all-mismatch resolves to `Failed`). The caller owns
- * artifact/bundle materialisation on disk.
- */
-export async function verifyCosignBlob(
-  input: VerifyCosignBlobInput,
-): Promise<VerifyCosignBlobResult> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  if (input.trustedIdentityRegexps.length === 0) {
-    return { outcome: CosignVerifyOutcome.Failed };
-  }
-  for (const identity of input.trustedIdentityRegexps) {
-    const args: string[] = [
-      'verify-blob',
-      '--bundle',
-      input.bundlePath,
-      '--certificate-identity-regexp',
-      identity,
-    ];
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-    args.push(input.artifactPath);
-    const { code } = await runCosign(bin, args);
-    if (code === 0) {
-      return { outcome: CosignVerifyOutcome.Verified, matchedIdentity: identity };
-    }
-  }
-  return { outcome: CosignVerifyOutcome.Failed };
-}

package/src/lib/verdicts.ts

@@ -1,57 +0,0 @@
-/**
- * Shared cosign supply-chain verdict vocabulary.
- *
- * This is the single source of truth for the lowercase verdict/error enums
- * that `biome-fetcher-api` (OCI bundle verification) previously duplicated
- * locally. They are value-identical to that former copy, so adopting this
- * package is a pure de-duplication with no wire/behaviour change.
- *
- * (`@xemahq/biome-package` was a second consumer until 2026-08-01, when it was
- * deleted: it emitted a 4-layer OCI artifact whose layers carry no
- * `org.opencontainers.image.title`, so the fetcher's `oras pull` skipped every
- * one of them and materialised nothing. `xema biome publish` is now the single
- * biome packager.)
- *
- * NOTE: `xema-store-api` keeps its OWN UPPERCASE `SignatureVerdict` /
- * `ProvenanceVerdict` (persisted + OpenAPI + cross-service event wire); it
- * consumes only the cosign EXEC + {@link CosignVerifyOutcome} from this
- * package, mapping the neutral outcome to its own wire enum.
- */
-
-/** Signature verification verdict. */
-export enum SignatureVerdict {
-  Valid = 'valid',
-  Invalid = 'invalid',
-  Unsigned = 'unsigned',
-}
-
-/** SLSA attestation / provenance verdict. */
-export enum ProvenanceVerdict {
-  Valid = 'valid',
-  Invalid = 'invalid',
-  Missing = 'missing',
-}
-
-/** Stable, typed reasons a cosign verification may reject an artifact. */
-export enum CosignErrorCode {
-  SignatureMissing = 'BIOME_SIGNATURE_MISSING',
-  SignatureInvalid = 'BIOME_SIGNATURE_INVALID',
-  IdentityNotTrusted = 'BIOME_SIGNATURE_IDENTITY_NOT_TRUSTED',
-  ProvenanceMissing = 'BIOME_PROVENANCE_MISSING',
-  ProvenanceInvalid = 'BIOME_PROVENANCE_INVALID',
-  CosignUnavailable = 'BIOME_COSIGN_UNAVAILABLE',
-}
-
-/**
- * Casing-neutral internal outcome of a detached-blob verification. The blob
- * path (store) maps this to its own UPPERCASE wire verdict; it deliberately
- * does not leak the wire casing into the shared exec layer.
- */
-export enum CosignVerifyOutcome {
-  Verified = 'verified',
-  Failed = 'failed',
-}
-
-/** Canonical SLSA provenance predicate type. */
-export const SLSA_PROVENANCE_PREDICATE_TYPE =
-  'https://slsa.dev/provenance/v1' as const;