@xemahq/edition-tooling 0.0.0-stage → 0.1.1

package/edition/built-verifier.mjs

@@ -0,0 +1,55 @@
+// Where this CLI's built evidence verifier sits. The verifier is ONE bundle,
+// built at CLI build time from the CLI's own sources and its locked
+// dependencies, and shipped in the npm tarball beside a provenance record.
+//
+// The package directory is the one place the library derives a location from
+// where it sits: the bundle is a property of the installed CLI, not of any
+// workspace root. Callers that need another location (tests) pass it.
+
+import { lstatSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { verifierDigests } from './evidence-trust-pin.mjs';
+import {
+  VERIFIER_BUNDLE_FILE,
+  VERIFIER_DIST_SUBPATH,
+  VERIFIER_PROVENANCE_FILE,
+} from './verifier-files.mjs';
+
+const PACKAGE_DIR = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** The built verifier's two files under `packageDir` (this package by default). */
+export function locateBuiltVerifier(packageDir = PACKAGE_DIR) {
+  const directory = join(packageDir, ...VERIFIER_DIST_SUBPATH);
+  return Object.freeze({
+    bundlePath: join(directory, VERIFIER_BUNDLE_FILE),
+    provenancePath: join(directory, VERIFIER_PROVENANCE_FILE),
+  });
+}
+
+/**
+ * The digests of the built verifier a pin records. A missing file is refused,
+ * naming the path - never skipped.
+ */
+export function readBuiltVerifierDigests(locateVerifier = locateBuiltVerifier) {
+  const { bundlePath, provenancePath } = locateVerifier();
+  for (const path of [bundlePath, provenancePath]) {
+    let regular = false;
+    try {
+      regular = lstatSync(path).isFile();
+    } catch (error) {
+      if (error.code !== 'ENOENT') {throw error;}
+    }
+    if (!regular) {
+      throw new Error(
+        `this CLI's built evidence verifier is missing: ${path} is not a regular file ` +
+          `(it is produced by the package build)`,
+      );
+    }
+  }
+  return verifierDigests({
+    bundleBytes: readFileSync(bundlePath),
+    provenanceBytes: readFileSync(provenancePath),
+  });
+}