@xemahq/biome-supply-chain 0.4.0 → 0.5.1

package/README.md

@@ -1,79 +1,43 @@
 # @xemahq/biome-supply-chain
 
-This package belongs to Layer 1 — a framework-free runtime SDK utility.
+Cosign signature and attestation verification for biome artifacts. It wraps the `cosign` CLI and exports the verdict and trust-anchor vocabulary. Node built-ins only, no framework.
 
-Shared cosign supply-chain verification for Xema biomes. It centralizes the two
-things that were previously copy-pasted between `biome-fetcher-api` (OCI bundle
-verification) and `xema-store-api`:
+## When to use it
 
-- the single cosign CLI invocation (`ensureCosignAvailable`,
-  `verifyCosignSignature`, `verifyCosignAttestation`, `verifyCosignBlob`), and
-- the signature / provenance verdict vocabulary (`SignatureVerdict`,
-  `ProvenanceVerdict`, `CosignErrorCode`, `CosignVerifyOutcome`).
+Use it to verify a biome OCI reference or a detached blob against trusted identities or public keys. Fetching the artifact stays with the caller. Needs the `cosign` binary on the path.
 
-It shells out to the `cosign` binary and uses only Node built-ins — no NestJS,
-no framework, no external runtime dependencies — so it is safe to import from a
-service runtime image and from a build-time CLI alike.
+## Installation
+
+```bash
+pnpm add @xemahq/biome-supply-chain
+```
 
 ## Usage
 
 ```ts
 import {
   ensureCosignAvailable,
-  verifyCosignSignature,
   verifyCosignBlob,
   CosignTrustAnchorKind,
-  SignatureVerdict,
   CosignVerifyOutcome,
 } from '@xemahq/biome-supply-chain';
 
 await ensureCosignAvailable();
 
-// OCI ref (keyless identity allowlist)
-await verifyCosignSignature({
-  ociRef: 'oci://registry/biome:1.2.0',
-  trustedIdentities: ['https://github.com/xema-dev/...'],
-  oidcIssuer: 'https://token.actions.githubusercontent.com',
-});
-
-// Detached blob (caller owns artifact/bundle/public-key files on disk).
-// A trust anchor is EITHER a keyless certificate-identity pattern OR a NAMED
-// public key; both kinds share one list and one result shape, and the anchors
-// are tried in order until one verifies.
 const { outcome, matchedAnchor } = await verifyCosignBlob({
-  artifactPath: '/tmp/remoteEntry.js',
-  bundlePath: '/tmp/remoteEntry.js.bundle',
+  artifactPath: './remoteEntry.js',
+  bundlePath: './remoteEntry.js.bundle',
   anchors: [
-    {
-      kind: CosignTrustAnchorKind.KeylessIdentity,
-      name: '^https://github.com/xema-dev/.*$', // the name IS the regexp
-    },
-    {
-      kind: CosignTrustAnchorKind.PublicKey,
-      name: 'release-2026',
-      publicKeyPath: '/etc/cosign/release.pub',
-    },
+    { kind: CosignTrustAnchorKind.PublicKey, name: 'release-key', publicKeyPath: './release.pub' },
   ],
-  // Optional: pin the Sigstore trusted root so KEYLESS anchors verify with
-  // `--offline --trusted-root` (air-gap capable). A missing, unreadable or
-  // digest-mismatched root THROWS `CosignTrustedRootError` before cosign is
-  // spawned — it never falls back to cosign's online default.
-  trustedRoot: { path: '/etc/sigstore/trusted-root.json', sha256: '<64 hex>' },
 });
 if (outcome === CosignVerifyOutcome.Verified) {
-  // matchedAnchor is { kind, name } — WHICH anchor vouched for the bytes
+  // matchedAnchor names the anchor that vouched for the bytes
 }
 ```
 
-An empty `anchors` list resolves to `Failed` without spawning cosign, and a
-failed verification is a neutral outcome rather than a throw.
-
-Artifact resolution (resolving an OCI ref, or fetching + writing a blob to a
-temp file) stays with each consumer; this package owns only the cosign exec,
-the trust-anchor vocabulary and the verdict enums.
+Other exports: `verifyCosignSignature`, `verifyCosignAttestation`, `SignatureVerdict`, `ProvenanceVerdict`, `CosignErrorCode`. A failed verification returns an outcome; an empty `anchors` list returns `Failed`. A pinned `trustedRoot` that is missing or has the wrong digest throws `CosignTrustedRootError`.
 
 ## License
 
-Business Source License 1.1 (BSL-1.1) — source-available; converts to MPL-2.0
-four years after each release. &copy; Xema — [xema.dev](https://xema.dev). See
-the [repository LICENSE](../../../LICENSE).
+LicenseRef-Xema-BSL-1.1 &copy; Xema — [xema.dev](https://xema.dev)

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './lib/verdicts';
 export * from './lib/trust-anchors';
+export * from './lib/registry-auth';
 export * from './lib/cosign-exec';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./lib/verdicts"), exports);
 __exportStar(require("./lib/trust-anchors"), exports);
+__exportStar(require("./lib/registry-auth"), exports);
 __exportStar(require("./lib/cosign-exec"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,oDAAkC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,sDAAoC;AACpC,oDAAkC"}

package/dist/lib/cosign-exec.d.ts

@@ -1,5 +1,24 @@
+import { type RegistryCredential } from './registry-auth';
 import { type CosignBlobTrustAnchor, type CosignMatchedAnchor, type CosignPinnedTrustedRoot } from './trust-anchors';
-import { CosignVerifyOutcome } from './verdicts';
+import { CosignFailureKind, CosignVerifyOutcome } from './verdicts';
+interface CosignRunResult {
+    readonly code: number;
+    readonly stderr: string;
+}
+export declare function stderrTail(stderr: string, limits?: {
+    readonly maxLines?: number;
+    readonly maxChars?: number;
+}): string;
+export declare const REGISTRY_AUTH_FAILURE_PATTERNS: readonly RegExp[];
+export declare function classifyCosignFailure(stderr: string): CosignFailureKind;
+export declare class CosignCommandError extends Error {
+    readonly command: string;
+    readonly exitCode: number;
+    readonly kind: CosignFailureKind;
+    readonly stderrTail: string;
+    constructor(command: string, exitCode: number, kind: CosignFailureKind, stderrTail: string);
+    static fromRun(command: string, run: CosignRunResult): CosignCommandError;
+}
 export declare function ensureCosignAvailable(bin?: string): Promise<void>;
 export interface VerifyCosignSignatureInput {
     readonly ociRef: string;
@@ -7,6 +26,7 @@ export interface VerifyCosignSignatureInput {
     readonly oidcIssuer?: string | undefined;
     readonly keyPath?: string | undefined;
     readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
+    readonly registryCredential?: RegistryCredential | undefined;
     readonly bin?: string | undefined;
 }
 export declare function verifyCosignSignature(input: VerifyCosignSignatureInput): Promise<void>;
@@ -17,6 +37,7 @@ export interface VerifyCosignAttestationInput {
     readonly oidcIssuer?: string | undefined;
     readonly keyPath?: string | undefined;
     readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
+    readonly registryCredential?: RegistryCredential | undefined;
     readonly bin?: string | undefined;
 }
 export declare function verifyCosignAttestation(input: VerifyCosignAttestationInput): Promise<void>;
@@ -33,4 +54,5 @@ export interface VerifyCosignBlobResult {
     readonly matchedAnchor?: CosignMatchedAnchor | undefined;
 }
 export declare function verifyCosignBlob(input: VerifyCosignBlobInput): Promise<VerifyCosignBlobResult>;
+export {};
 //# sourceMappingURL=cosign-exec.d.ts.map

package/dist/lib/cosign-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAqDD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAO5B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAKnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAWzC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAOtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1D;AA8DD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAoBjC"}
+{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAKpE,UAAU,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgED,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,MAAM,CAYR;AAiBD,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAM3D,CAAC;AAGF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAIvE;AAQD,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,OAAO,EAAE,MAAM;aACf,QAAQ,EAAE,MAAM;aAChB,IAAI,EAAE,iBAAiB;aACvB,UAAU,EAAE,MAAM;gBAHlB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,UAAU,EAAE,MAAM;IAMpC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,kBAAkB;CAQ1E;AAGD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAqDD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAO3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAE3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAO5B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAKnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAWzC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAOtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1D;AA8DD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAoBjC"}

package/dist/lib/cosign-exec.js

@@ -1,17 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CosignCommandError = exports.REGISTRY_AUTH_FAILURE_PATTERNS = void 0;
+exports.stderrTail = stderrTail;
+exports.classifyCosignFailure = classifyCosignFailure;
 exports.ensureCosignAvailable = ensureCosignAvailable;
 exports.verifyCosignSignature = verifyCosignSignature;
 exports.verifyCosignAttestation = verifyCosignAttestation;
 exports.verifyCosignBlob = verifyCosignBlob;
 const node_child_process_1 = require("node:child_process");
+const registry_auth_1 = require("./registry-auth");
 const trust_anchors_1 = require("./trust-anchors");
 const verdicts_1 = require("./verdicts");
 const DEFAULT_COSIGN_BIN = 'cosign';
-function runCosign(bin, args) {
+function runCosign(bin, args, env = {}) {
     return new Promise((resolve, reject) => {
         const child = (0, node_child_process_1.spawn)(bin, [...args], {
             stdio: ['ignore', 'pipe', 'pipe'],
+            env: { ...process.env, ...env },
         });
         let stderr = '';
         child.stderr?.on('data', (chunk) => {
@@ -23,11 +28,59 @@ function runCosign(bin, args) {
         });
     });
 }
+function runCosignAgainstRegistry(bin, args, credential) {
+    return (0, registry_auth_1.withRegistryAuth)(credential, (env) => runCosign(bin, args, env));
+}
+const STDERR_TAIL_MAX_LINES = 4;
+const STDERR_TAIL_MAX_CHARS = 2048;
+function stderrTail(stderr, limits = {}) {
+    const maxLines = limits.maxLines ?? STDERR_TAIL_MAX_LINES;
+    const maxChars = limits.maxChars ?? STDERR_TAIL_MAX_CHARS;
+    const lines = stderr
+        .split(/\r?\n/u)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    const tail = lines.slice(-maxLines).join(' | ');
+    if (tail.length <= maxChars) {
+        return tail;
+    }
+    return `${tail.slice(0, maxChars)}… [+${tail.length - maxChars} chars]`;
+}
+exports.REGISTRY_AUTH_FAILURE_PATTERNS = [
+    /\bUNAUTHORIZED\b/iu,
+    /\bDENIED\b/iu,
+    /\bauthentication required\b/iu,
+    /\bstatus code 40[13]\b/iu,
+    /\b40[13] (?:unauthorized|forbidden)\b/iu,
+];
+function classifyCosignFailure(stderr) {
+    return exports.REGISTRY_AUTH_FAILURE_PATTERNS.some((pattern) => pattern.test(stderr))
+        ? verdicts_1.CosignFailureKind.RegistryUnauthenticated
+        : verdicts_1.CosignFailureKind.Rejected;
+}
+class CosignCommandError extends Error {
+    command;
+    exitCode;
+    kind;
+    stderrTail;
+    constructor(command, exitCode, kind, stderrTail) {
+        super(`${command} failed (code=${exitCode}, kind=${kind}): ${stderrTail}`);
+        this.command = command;
+        this.exitCode = exitCode;
+        this.kind = kind;
+        this.stderrTail = stderrTail;
+        this.name = 'CosignCommandError';
+    }
+    static fromRun(command, run) {
+        return new CosignCommandError(command, run.code, classifyCosignFailure(run.stderr), stderrTail(run.stderr));
+    }
+}
+exports.CosignCommandError = CosignCommandError;
 async function ensureCosignAvailable(bin = DEFAULT_COSIGN_BIN) {
     try {
         const { code, stderr } = await runCosign(bin, ['version']);
         if (code !== 0) {
-            throw new Error(`\`${bin} version\` exited ${code}: ${stderr.slice(-200)}`);
+            throw new Error(`\`${bin} version\` exited ${code}: ${stderrTail(stderr)}`);
         }
     }
     catch (cause) {
@@ -65,9 +118,9 @@ async function verifyCosignSignature(input) {
     }
     args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
     args.push(input.ociRef);
-    const { code, stderr } = await runCosign(bin, args);
-    if (code !== 0) {
-        throw new Error(`${bin} verify failed (code=${code}): ${stderr.slice(-200)}`);
+    const run = await runCosignAgainstRegistry(bin, args, input.registryCredential);
+    if (run.code !== 0) {
+        throw CosignCommandError.fromRun(`${bin} verify`, run);
     }
 }
 async function verifyCosignAttestation(input) {
@@ -92,9 +145,9 @@ async function verifyCosignAttestation(input) {
     }
     args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
     args.push(input.ociRef);
-    const { code, stderr } = await runCosign(bin, args);
-    if (code !== 0) {
-        throw new Error(`${bin} verify-attestation failed (code=${code}): ${stderr.slice(-200)}`);
+    const run = await runCosignAgainstRegistry(bin, args, input.registryCredential);
+    if (run.code !== 0) {
+        throw CosignCommandError.fromRun(`${bin} verify-attestation`, run);
     }
 }
 function buildBlobVerifyArgs(anchor, input) {

package/dist/lib/cosign-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;AA6CA,sDAcC;AA2ED,sDAgCC;AAiBD,0DA+BC;AAwGD,4CAsBC;AApVD,2DAA2C;AAE3C,mDAMyB;AACzB,yCAAiD;AAGjD,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAapC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAyCD,SAAS,cAAc,CACrB,WAAgD,EAChD,KAAc;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;QACV,CAAC,CAAC,CAAC,WAAW,CAAC;QACf,CAAC,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAwBM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAI5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,wBAAwB,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAiBM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAwDD,SAAS,mBAAmB,CAC1B,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,+BAA+B,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAMtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAaM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAGtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8BAAmB,CAAC,QAAQ;gBACrC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;;AAkFA,gCAeC;AA0BD,sDAIC;AA+BD,sDAcC;AAkFD,sDAgCC;AAmBD,0DA6BC;AAwGD,4CAsBC;AA5cD,2DAA2C;AAE3C,mDAA4E;AAC5E,mDAMyB;AACzB,yCAAoE;AAGpE,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAkBpC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB,EACvB,MAAwC,EAAE;IAE1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AASD,SAAS,wBAAwB,CAC/B,GAAW,EACX,IAAuB,EACvB,UAA0C;IAE1C,OAAO,IAAA,gCAAgB,EAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC;AAGD,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAanC,SAAgB,UAAU,CACxB,MAAc,EACd,SAAqE,EAAE;IAEvE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM;SACjB,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,GAAG,QAAQ,SAAS,CAAC;AAC1E,CAAC;AAiBY,QAAA,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,cAAc;IACd,+BAA+B;IAC/B,0BAA0B;IAC1B,yCAAyC;CAC1C,CAAC;AAGF,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,sCAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC,CAAC,4BAAiB,CAAC,uBAAuB;QAC3C,CAAC,CAAC,4BAAiB,CAAC,QAAQ,CAAC;AACjC,CAAC;AAQD,MAAa,kBAAmB,SAAQ,KAAK;IAGzB;IACA;IACA;IACA;IALlB,YAEkB,OAAe,EACf,QAAgB,EAChB,IAAuB,EACvB,UAAkB;QAElC,KAAK,CAAC,GAAG,OAAO,iBAAiB,QAAQ,UAAU,IAAI,MAAM,UAAU,EAAE,CAAC,CAAC;QAL3D,YAAO,GAAP,OAAO,CAAQ;QACf,aAAQ,GAAR,QAAQ,CAAQ;QAChB,SAAI,GAAJ,IAAI,CAAmB;QACvB,eAAU,GAAV,UAAU,CAAQ;QAGlC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,OAAe,EAAE,GAAoB;QAClD,OAAO,IAAI,kBAAkB,CAC3B,OAAO,EACP,GAAG,CAAC,IAAI,EACR,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EACjC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CACvB,CAAC;IACJ,CAAC;CACF;AApBD,gDAoBC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAyCD,SAAS,cAAc,CACrB,WAAgD,EAChD,KAAc;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;QACV,CAAC,CAAC,CAAC,WAAW,CAAC;QACf,CAAC,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AA+BM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAI5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAmBM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAwDD,SAAS,mBAAmB,CAC1B,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,+BAA+B,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAMtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAaM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAGtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8BAAmB,CAAC,QAAQ;gBACrC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}

package/dist/lib/registry-auth.d.ts

@@ -0,0 +1,16 @@
+export interface RegistryCredential {
+    readonly registry: string;
+    readonly auth: string;
+}
+export declare class RegistryCredentialError extends Error {
+    constructor(message: string);
+}
+export declare function normalizeRegistryAuthority(raw: string): string;
+export declare function registryAuthorityOf(ociRef: string): string;
+export declare function parseDockerConfigCredentials(documentText: string, source: string): ReadonlyMap<string, RegistryCredential>;
+export declare function selectRegistryCredential(ociRef: string, credentials: ReadonlyMap<string, RegistryCredential>): RegistryCredential | undefined;
+export interface RegistryAuthEnv {
+    readonly DOCKER_CONFIG: string;
+}
+export declare function withRegistryAuth<T>(credential: RegistryCredential | undefined, fn: (env: Partial<RegistryAuthEnv>) => Promise<T>): Promise<T>;
+//# sourceMappingURL=registry-auth.d.ts.map

package/dist/lib/registry-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-auth.d.ts","sourceRoot":"","sources":["../../src/lib/registry-auth.ts"],"names":[],"mappings":"AA4CA,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAoBD,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9D;AASD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAa1D;AAuBD,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA2CzC;AA0BD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACnD,kBAAkB,GAAG,SAAS,CAEhC;AAGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAcD,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAgBZ"}

package/dist/lib/registry-auth.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RegistryCredentialError = void 0;
+exports.normalizeRegistryAuthority = normalizeRegistryAuthority;
+exports.registryAuthorityOf = registryAuthorityOf;
+exports.parseDockerConfigCredentials = parseDockerConfigCredentials;
+exports.selectRegistryCredential = selectRegistryCredential;
+exports.withRegistryAuth = withRegistryAuth;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+class RegistryCredentialError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RegistryCredentialError';
+    }
+}
+exports.RegistryCredentialError = RegistryCredentialError;
+const DOCKER_HUB_AUTHORITY = 'docker.io';
+const DOCKER_HUB_CONFIG_ALIASES = new Set([
+    'index.docker.io',
+    'index.docker.io/v1',
+    'registry-1.docker.io',
+]);
+function normalizeRegistryAuthority(raw) {
+    const stripped = raw
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//u, '')
+        .replace(/\/+$/u, '');
+    return DOCKER_HUB_CONFIG_ALIASES.has(stripped) ? DOCKER_HUB_AUTHORITY : stripped;
+}
+function registryAuthorityOf(ociRef) {
+    const ref = ociRef.trim();
+    if (ref.length === 0) {
+        throw new RegistryCredentialError('registryAuthorityOf: empty OCI reference');
+    }
+    const slash = ref.indexOf('/');
+    if (slash === -1) {
+        return DOCKER_HUB_AUTHORITY;
+    }
+    const first = ref.slice(0, slash);
+    const looksLikeRegistry = first.includes('.') || first.includes(':') || first === 'localhost';
+    return looksLikeRegistry ? normalizeRegistryAuthority(first) : DOCKER_HUB_AUTHORITY;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseDockerConfigCredentials(documentText, source) {
+    let parsed;
+    try {
+        parsed = JSON.parse(documentText);
+    }
+    catch (cause) {
+        throw new RegistryCredentialError(`${source} is not a JSON document (${cause instanceof Error ? cause.message : String(cause)}); ` +
+            'expected a Docker config.json of the shape {"auths":{"<registry>":{"auth":"<base64 user:secret>"}}}');
+    }
+    if (!isRecord(parsed) || !isRecord(parsed['auths'])) {
+        throw new RegistryCredentialError(`${source} carries no "auths" object; expected a Docker config.json of the shape ` +
+            '{"auths":{"<registry>":{"auth":"<base64 user:secret>"}}}');
+    }
+    const credentials = new Map();
+    for (const [rawRegistry, rawEntry] of Object.entries(parsed['auths'])) {
+        const registry = normalizeRegistryAuthority(rawRegistry);
+        if (registry.length === 0) {
+            throw new RegistryCredentialError(`${source}: "auths" has an empty registry key`);
+        }
+        if (!isRecord(rawEntry)) {
+            throw new RegistryCredentialError(`${source}: auths["${rawRegistry}"] is not an object`);
+        }
+        const entry = rawEntry;
+        const auth = credentialAuthOf(entry, `${source}: auths["${rawRegistry}"]`);
+        if (credentials.has(registry)) {
+            throw new RegistryCredentialError(`${source}: registry "${registry}" is declared twice (one of the spellings is "${rawRegistry}")`);
+        }
+        credentials.set(registry, { registry, auth });
+    }
+    if (credentials.size === 0) {
+        throw new RegistryCredentialError(`${source} declares an "auths" object with no registry in it — unset the variable ` +
+            'to declare no credential, or declare at least one registry');
+    }
+    return credentials;
+}
+function credentialAuthOf(entry, where) {
+    if (typeof entry.auth === 'string' && entry.auth.length > 0) {
+        return entry.auth;
+    }
+    if (typeof entry.username === 'string' &&
+        entry.username.length > 0 &&
+        typeof entry.password === 'string' &&
+        entry.password.length > 0) {
+        return Buffer.from(`${entry.username}:${entry.password}`, 'utf8').toString('base64');
+    }
+    throw new RegistryCredentialError(`${where} carries neither a non-empty "auth" nor a "username"+"password" pair`);
+}
+function selectRegistryCredential(ociRef, credentials) {
+    return credentials.get(registryAuthorityOf(ociRef));
+}
+async function withRegistryAuth(credential, fn) {
+    if (credential === undefined) {
+        return fn({});
+    }
+    const dir = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'xema-cosign-auth-'));
+    try {
+        await node_fs_1.promises.chmod(dir, 0o700);
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(dir, 'config.json'), JSON.stringify({ auths: { [credential.registry]: { auth: credential.auth } } }), { mode: 0o600 });
+        return await fn({ DOCKER_CONFIG: dir });
+    }
+    finally {
+        await node_fs_1.promises.rm(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=registry-auth.js.map

package/dist/lib/registry-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-auth.js","sourceRoot":"","sources":["../../src/lib/registry-auth.ts"],"names":[],"mappings":";;;AA6EA,gEAOC;AASD,kDAaC;AAuBD,oEA8CC;AA0BD,4DAKC;AAmBD,4CAmBC;AApPD,qCAAyC;AACzC,qCAAiC;AACjC,yCAAiC;AAkDjC,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAQD,MAAM,oBAAoB,GAAG,WAAW,CAAC;AACzC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,iBAAiB;IACjB,oBAAoB;IACpB,sBAAsB;CACvB,CAAC,CAAC;AAOH,SAAgB,0BAA0B,CAAC,GAAW;IACpD,MAAM,QAAQ,GAAG,GAAG;SACjB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxB,OAAO,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnF,CAAC;AASD,SAAgB,mBAAmB,CAAC,MAAc;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,iBAAiB,GACrB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,WAAW,CAAC;IACtE,OAAO,iBAAiB,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;AACtF,CAAC;AAQD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAaD,SAAgB,4BAA4B,CAC1C,YAAoB,EACpB,MAAc;IAEd,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,GAAG,MAAM,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK;YAC9F,qGAAqG,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,GAAG,MAAM,yEAAyE;YAChF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC1D,KAAK,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,uBAAuB,CAAC,GAAG,MAAM,qCAAqC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,MAAM,YAAY,WAAW,qBAAqB,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,QAAiC,CAAC;QAChD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,MAAM,YAAY,WAAW,IAAI,CAAC,CAAC;QAC3E,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,MAAM,eAAe,QAAQ,iDAAiD,WAAW,IAAI,CACjG,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,MAAM,0EAA0E;YACjF,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA4B,EAAE,KAAa;IACnE,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EACzB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,GAAG,KAAK,sEAAsE,CAC/E,CAAC;AACJ,CAAC;AASD,SAAgB,wBAAwB,CACtC,MAAc,EACd,WAAoD;IAEpD,OAAO,WAAW,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC;AAmBM,KAAK,UAAU,gBAAgB,CACpC,UAA0C,EAC1C,EAAiD;IAEjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,kBAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,kBAAE,CAAC,SAAS,CAChB,IAAA,gBAAI,EAAC,GAAG,EAAE,aAAa,CAAC,EACxB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAC/E,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,OAAO,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,MAAM,kBAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/lib/verdicts.d.ts

@@ -14,7 +14,12 @@ export declare enum CosignErrorCode {
     IdentityNotTrusted = "BIOME_SIGNATURE_IDENTITY_NOT_TRUSTED",
     ProvenanceMissing = "BIOME_PROVENANCE_MISSING",
     ProvenanceInvalid = "BIOME_PROVENANCE_INVALID",
-    CosignUnavailable = "BIOME_COSIGN_UNAVAILABLE"
+    CosignUnavailable = "BIOME_COSIGN_UNAVAILABLE",
+    RegistryUnauthenticated = "BIOME_REGISTRY_UNAUTHENTICATED"
+}
+export declare enum CosignFailureKind {
+    RegistryUnauthenticated = "registry-unauthenticated",
+    Rejected = "rejected"
 }
 export declare enum CosignVerifyOutcome {
     Verified = "verified",

package/dist/lib/verdicts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAqBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;CAC/C;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}
+{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAqBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAS9C,uBAAuB,mCAAmC;CAC3D;AAgBD,oBAAY,iBAAiB;IAE3B,uBAAuB,6BAA6B;IAEpD,QAAQ,aAAa;CACtB;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}

package/dist/lib/verdicts.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SLSA_PROVENANCE_PREDICATE_TYPE = exports.CosignVerifyOutcome = exports.CosignErrorCode = exports.ProvenanceVerdict = exports.SignatureVerdict = void 0;
+exports.SLSA_PROVENANCE_PREDICATE_TYPE = exports.CosignVerifyOutcome = exports.CosignFailureKind = exports.CosignErrorCode = exports.ProvenanceVerdict = exports.SignatureVerdict = void 0;
 var SignatureVerdict;
 (function (SignatureVerdict) {
     SignatureVerdict["Valid"] = "valid";
@@ -21,7 +21,13 @@ var CosignErrorCode;
     CosignErrorCode["ProvenanceMissing"] = "BIOME_PROVENANCE_MISSING";
     CosignErrorCode["ProvenanceInvalid"] = "BIOME_PROVENANCE_INVALID";
     CosignErrorCode["CosignUnavailable"] = "BIOME_COSIGN_UNAVAILABLE";
+    CosignErrorCode["RegistryUnauthenticated"] = "BIOME_REGISTRY_UNAUTHENTICATED";
 })(CosignErrorCode || (exports.CosignErrorCode = CosignErrorCode = {}));
+var CosignFailureKind;
+(function (CosignFailureKind) {
+    CosignFailureKind["RegistryUnauthenticated"] = "registry-unauthenticated";
+    CosignFailureKind["Rejected"] = "rejected";
+})(CosignFailureKind || (exports.CosignFailureKind = CosignFailureKind = {}));
 var CosignVerifyOutcome;
 (function (CosignVerifyOutcome) {
     CosignVerifyOutcome["Verified"] = "verified";

package/dist/lib/verdicts.js.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAqBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;AAChD,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}
+{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAqBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAgBX;AAhBD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAS9C,6EAA0D,CAAA;AAC5D,CAAC,EAhBW,eAAe,+BAAf,eAAe,QAgB1B;AAgBD,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAE3B,yEAAoD,CAAA;IAEpD,0CAAqB,CAAA;AACvB,CAAC,EALW,iBAAiB,iCAAjB,iBAAiB,QAK5B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-supply-chain",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
   "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",