@xemahq/edition-tooling 0.0.0-stage → 0.1.1

package/edition/produce-distribution-completeness-evidence.mjs

@@ -0,0 +1,317 @@
+#!/usr/bin/env node
+// The distribution completeness statement and the evidence set it seals.
+//
+//   xema-edition evidence statement completeness stage …   (the bytes to sign)
+//   xema-edition evidence assemble-set …                    (evidence-set.json)
+//
+// `stage` resolves the edition's producer evidence into a NEW staging
+// directory, writes the canonical completeness statement there and prints the
+// signing plan. The caller signs it (`cosign attest-blob`). `assemble-set`
+// re-derives everything from the same flags, refuses staged bytes that differ,
+// verifies the signed bundle with cosign against the declared signer, writes
+// `evidence-set.json` and seals the evidence root (built from the re-derived
+// files, never renamed from the staging).
+// This module never signs and never requests an OIDC token.
+
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+
+import {
+  acceptSignedEvidenceStatement,
+  assertPinnedCosignVersion,
+  buildDistributionImageEvidenceSet,
+  buildDistributionImagesStatement,
+  evidenceChannelOfSigner,
+  loadPinnedTrustPolicy,
+  parseEvidenceCliFlags,
+  resolveProducerEvidence,
+  stageEvidenceStatement,
+  stageProducerEvidence,
+  stagedProducerFiles,
+} from './distribution-evidence-set.mjs';
+import {
+  WorkspaceRoot,
+  configureEditionWorkspaceFromArgv,
+  dataRoot,
+  editionsRoot,
+  isEntryModule,
+} from './edition-workspace.mjs';
+import { canonicalJsonBytes } from './image-evidence.mjs';
+import { oidcCertificateSignerKind } from './kernel-signer-kind.mjs';
+import { serializeJson } from './lib.mjs';
+import {
+  assertGitHubProducerContext,
+  createCosignVerifier,
+  loadProducerKernelSchemas,
+} from './produce-image-source-evidence.mjs';
+import { assertStagedExactly, discardStaging, reserveSealing, sealAccepted } from './sealed-evidence-accept.mjs';
+
+const EVIDENCE_SET_FILE = 'evidence-set.json';
+const COMPLETENESS_STATEMENT_PATH = 'completeness/statement.json';
+const COMPLETENESS_BUNDLE_PATH = 'completeness/bundle.sigstore.json';
+
+/** The keyless signer a GitHub workflow is: its certificate identity and issuer. */
+export function githubWorkflowSigner({ repository, ref, path }) {
+  return {
+    kind: oidcCertificateSignerKind(),
+    certificateIdentity: `https://github.com/${repository}/${path}@${ref}`,
+    oidcIssuer: 'https://token.actions.githubusercontent.com',
+    githubWorkflow: { repository, ref, path },
+  };
+}
+
+/** The producer evidence and the completeness statement these inputs resolve to; deterministic. */
+async function deriveCompleteness(options, { outputRoot }) {
+  // The channel the signer signs for is the channel the completeness statement states.
+  const channel = evidenceChannelOfSigner(options.signer, options.schemas);
+  const resolution = {
+    distributionId: options.distributionId,
+    dataRoot: options.dataRoot,
+    editionsRoot: options.editionsRoot,
+    schemas: options.schemas,
+    expectedContractAuthority: options.expectedContractAuthority,
+    registryClientFactory: options.registryClientFactory,
+  };
+  const staged = outputRoot === null
+    ? await resolveProducerEvidence(resolution)
+    : await stageProducerEvidence({ ...resolution, outputRoot });
+  const completenessStatement = buildDistributionImagesStatement({
+    distributionLock: staged.distributionLock,
+    imageLock: staged.imageLock,
+    images: staged.images,
+    channel,
+    releaseSequence: options.releaseSequence,
+    releaseSourceCommit: options.releaseSourceCommit,
+    runId: options.runId,
+    runAttempt: options.runAttempt,
+    issuedAt: options.issuedAt,
+    expiresAt: options.expiresAt,
+    maxTtlSeconds: options.policy.maxCompletenessTtlSeconds,
+    schemas: options.schemas,
+  });
+  return { staged, completenessStatement };
+}
+
+function signingArguments(options, statement) {
+  return {
+    statement,
+    root: options.stagingDirectory,
+    statementPath: COMPLETENESS_STATEMENT_PATH,
+    bundlePath: COMPLETENESS_BUNDLE_PATH,
+    signer: options.signer,
+    certificateWorkflowSha: options.releaseSourceCommit,
+    predicateType: options.schemas.DISTRIBUTION_IMAGES_PREDICATE_TYPE,
+  };
+}
+
+/**
+ * Stage the producer evidence of one edition and its completeness statement
+ * for signing. Returns the signing plan and the statement.
+ */
+export async function stageDistributionCompletenessEvidence(options) {
+  const { stagingDirectory } = options;
+  if (typeof stagingDirectory !== 'string' || !isAbsolute(stagingDirectory)) {
+    throw new Error('the staging directory must be an absolute path');
+  }
+  if (existsSync(stagingDirectory)) {
+    throw new Error(`evidence staging directory already exists: ${stagingDirectory}`);
+  }
+  assertGitHubProducerContext(
+    { signer: options.signer, producerWorkflowSha: options.releaseSourceCommit },
+    options.githubContext,
+  );
+  mkdirSync(stagingDirectory, { recursive: true, mode: 0o700 });
+  try {
+    const { completenessStatement } = await deriveCompleteness(options, { outputRoot: options.stagingDirectory });
+    const plan = stageEvidenceStatement(signingArguments(options, completenessStatement));
+    return {
+      plan: { ...plan, kind: 'completeness', distributionId: options.distributionId },
+      completenessStatement,
+    };
+  } catch (error) {
+    rmSync(stagingDirectory, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+/**
+ * Accept the signed completeness bundle of a staged directory, write
+ * `evidence-set.json` and seal `evidenceRoot`.
+ *
+ * `evidenceRoot` is BUILT, never renamed from the staging: the producer
+ * evidence is re-resolved from the registry and must be byte-identical to what
+ * was staged, the completeness statement is re-derived and the signed bundle
+ * canonicalized and verified, and only those derived files are written. The
+ * staging must hold exactly what stage recorded and does not outlive the
+ * accept (see `sealed-evidence-accept.mjs`).
+ */
+export async function assembleDistributionEvidenceSet(options) {
+  const { evidenceRoot, stagingDirectory, readCosignVersion, runCosign } = options;
+  if (
+    typeof evidenceRoot !== 'string' ||
+    !isAbsolute(evidenceRoot) ||
+    typeof stagingDirectory !== 'string' ||
+    !isAbsolute(stagingDirectory)
+  ) {
+    throw new Error('the evidence root and the staging directory must be absolute paths');
+  }
+  if (typeof readCosignVersion !== 'function' || typeof runCosign !== 'function') {
+    throw new Error('cosign seams are required');
+  }
+  const sealing = reserveSealing(evidenceRoot, 'evidence');
+  let derived;
+  try {
+    assertGitHubProducerContext(
+      { signer: options.signer, producerWorkflowSha: options.releaseSourceCommit },
+      options.githubContext,
+    );
+    assertPinnedCosignVersion(readCosignVersion(), options.policy?.cosignVersion);
+    derived = await deriveCompleteness(options, { outputRoot: null });
+  } catch (error) {
+    discardStaging(stagingDirectory);
+    throw error;
+  }
+  const { staged, completenessStatement } = derived;
+  return sealAccepted({
+    stagingDirectory,
+    sealing,
+    outputDirectory: evidenceRoot,
+    build: () => {
+      assertStagedExactly(stagingDirectory, [
+        ...staged.producers.flatMap((producer) => stagedProducerFiles(producer).map(([path]) => path)),
+        COMPLETENESS_STATEMENT_PATH,
+        COMPLETENESS_BUNDLE_PATH,
+      ]);
+      for (const producer of staged.producers) {
+        for (const [path, bytes] of stagedProducerFiles(producer)) {
+          if (!readFileSync(join(stagingDirectory, path)).equals(bytes)) {
+            throw new Error(`staged ${path} is not the producer evidence this edition resolves to`);
+          }
+          mkdirSync(dirname(join(sealing, path)), { recursive: true, mode: 0o755 });
+          writeFileSync(join(sealing, path), bytes, { flag: 'wx', mode: 0o644 });
+        }
+      }
+      const completeness = acceptSignedEvidenceStatement({
+        ...signingArguments(options, completenessStatement),
+        sealingRoot: sealing,
+        runCosign,
+      });
+      const evidenceSet = buildDistributionImageEvidenceSet({
+        distributionId: options.distributionId,
+        producerEvidence: staged.producerEvidence,
+        completeness,
+        schemas: options.schemas,
+      });
+      writeFileSync(join(sealing, EVIDENCE_SET_FILE), canonicalJsonBytes(evidenceSet), {
+        flag: 'wx',
+        mode: 0o644,
+      });
+      return {
+        evidenceRoot,
+        evidenceSet,
+        completeness,
+        completenessStatement,
+        completenessStatementDigest: completeness.statementDigest,
+      };
+    },
+  });
+}
+
+function requireInteger(raw, label, { positive }) {
+  const value = Number(raw);
+  if (!/^\d+$/.test(String(raw)) || !Number.isSafeInteger(value) || (positive && value <= 0)) {
+    throw new Error(`--${label} must be a ${positive ? 'positive' : 'non-negative'} integer`);
+  }
+  return value;
+}
+
+const SHARED_FLAGS = Object.freeze([
+  'distribution',
+  'staging',
+  'release-sequence',
+  'release-source-commit',
+  'run-id',
+  'run-attempt',
+  'issued-at',
+  'expires-at',
+  'signer-repository',
+  'signer-ref',
+  'signer-workflow-path',
+  'github-repository',
+  'github-ref',
+  'github-sha',
+  'github-workflow-ref',
+]);
+
+async function main() {
+  const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
+    WorkspaceRoot.Data,
+    WorkspaceRoot.Editions,
+    WorkspaceRoot.Kernel,
+  ]);
+  if (phase !== 'stage' && phase !== 'accept') {
+    throw new Error(
+      'usage: xema-edition evidence statement completeness stage … | xema-edition evidence assemble-set …',
+    );
+  }
+  const flags = parseEvidenceCliFlags(args, {
+    single: phase === 'stage' ? SHARED_FLAGS : [...SHARED_FLAGS, 'evidence-root', 'cosign'],
+  });
+  const { schemas, contractAuthority } = await loadProducerKernelSchemas({ dataRoot: dataRoot() });
+  const options = {
+    distributionId: flags.require('distribution'),
+    dataRoot: dataRoot(),
+    editionsRoot: editionsRoot(),
+    stagingDirectory: resolve(flags.require('staging')),
+    schemas,
+    expectedContractAuthority: contractAuthority,
+    policy: loadPinnedTrustPolicy({ dataRoot: dataRoot(), schemas }),
+    signer: githubWorkflowSigner({
+      repository: flags.require('signer-repository'),
+      ref: flags.require('signer-ref'),
+      path: flags.require('signer-workflow-path'),
+    }),
+    githubContext: {
+      repository: flags.require('github-repository'),
+      ref: flags.require('github-ref'),
+      sha: flags.require('github-sha'),
+      workflowRef: flags.require('github-workflow-ref'),
+    },
+    releaseSequence: requireInteger(flags.require('release-sequence'), 'release-sequence', {
+      positive: false,
+    }),
+    releaseSourceCommit: flags.require('release-source-commit'),
+    runId: flags.require('run-id'),
+    runAttempt: requireInteger(flags.require('run-attempt'), 'run-attempt', { positive: false }),
+    issuedAt: flags.require('issued-at'),
+    expiresAt: flags.require('expires-at'),
+  };
+  if (phase === 'stage') {
+    const { plan } = await stageDistributionCompletenessEvidence(options);
+    process.stdout.write(serializeJson(plan));
+    return;
+  }
+  const result = await assembleDistributionEvidenceSet({
+    ...options,
+    evidenceRoot: resolve(flags.require('evidence-root')),
+    ...createCosignVerifier(resolve(flags.require('cosign'))),
+  });
+  process.stdout.write(
+    serializeJson({
+      schemaVersion: 1,
+      kind: 'evidence-set',
+      distributionId: options.distributionId,
+      evidenceRoot: result.evidenceRoot,
+      evidenceSetPath: EVIDENCE_SET_FILE,
+      producerBundles: result.evidenceSet.producerEvidence.length,
+      completenessStatementDigest: result.completenessStatementDigest,
+    }),
+  );
+}
+
+if (isEntryModule(import.meta.url)) {
+  main().catch((error) => {
+    console.error(`[distribution-completeness-evidence] ${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/edition/produce-edition-catalogue-evidence.mjs

@@ -0,0 +1,252 @@
+#!/usr/bin/env node
+// The edition catalogue statement (E4): "this offering artifact's catalogue layer and lock layer are these digests, on this
+// channel", signed by the vendor's release workflow and attached to the artifact as an `oras attach` referrer.
+//
+//   xema-edition evidence statement catalogue stage|accept …
+//
+// `stage` reads the artifact manifest by digest, derives the statement from its catalogue layer and lock layer and writes
+// the canonical statement into a NEW staging directory, printing the signing plan; the caller signs it (`cosign
+// attest-blob`); `accept` re-derives the statement from the same flags, refuses staged bytes that differ, verifies the
+// signed bundle with cosign against the declared signer, seals the output (built from the re-derived files, never renamed
+// from the staging) and ATTACHES statement.json and bundle.sigstore.json to the artifact digest as a referrer carrying the
+// signing workflow's commit. A customer's pinned verifier reads exactly that referrer (catalogue-evidence.mjs).
+// This module never signs and never requests an OIDC token.
+
+import { existsSync, mkdirSync, rmSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+
+import {
+  CATALOGUE_EVIDENCE_BUNDLE_TITLE,
+  CATALOGUE_EVIDENCE_STATEMENT_MEDIA_TYPE,
+  CATALOGUE_EVIDENCE_STATEMENT_TITLE,
+  CATALOGUE_EVIDENCE_WORKFLOW_SHA_ANNOTATION,
+} from './catalogue-evidence.mjs';
+import { layerTitled, parseCatalogueRef } from './catalogue-fetch.mjs';
+import { CATALOGUE_FILE } from './catalogue.mjs';
+import {
+  acceptSignedEvidenceStatement,
+  assertPinnedCosignVersion,
+  evidenceChannelOfSigner,
+  loadPinnedTrustPolicy,
+  parseEvidenceCliFlags,
+  stageEvidenceStatement,
+} from './distribution-evidence-set.mjs';
+import { EDITION_ARTIFACT_TYPE, EditionLockFile } from './edition-constants.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromArgv, dataRoot, isEntryModule } from './edition-workspace.mjs';
+import { serializeJson } from './lib.mjs';
+import { EDITION_CATALOGUE_EVIDENCE_ARTIFACT_TYPE, createRegistryClientResolver } from './oci-image-source-evidence.mjs';
+import { githubWorkflowSigner } from './produce-distribution-completeness-evidence.mjs';
+import {
+  BUNDLE_MEDIA_TYPE,
+  assertGitHubProducerContext,
+  createCosignVerifier,
+  loadProducerKernelSchemas,
+} from './produce-image-source-evidence.mjs';
+import { assertStagedExactly, discardStaging, reserveSealing, sealAccepted } from './sealed-evidence-accept.mjs';
+
+const STATEMENT_TYPE = 'https://in-toto.io/Statement/v1';
+const hexOf = (digest) => digest.slice('sha256:'.length);
+
+const SHARED_FLAGS = Object.freeze([
+  'artifact',
+  'offering',
+  'staging',
+  'signer-repository',
+  'signer-ref',
+  'signer-workflow-path',
+  'github-repository',
+  'github-ref',
+  'github-sha',
+  'github-workflow-ref',
+]);
+
+/**
+ * The E4 statement of the offering artifact `artifact` (`oci://<repository>@sha256:<d>`), derived from the manifest the
+ * registry serves for that digest: its catalogue layer and lock layer, exactly as a customer's `fetchCatalogue` reads them.
+ * The channel is the signer's, and must be the repository's.
+ */
+export async function deriveEditionCatalogueStatement({ artifact, offeringId, signer, schemas, client }) {
+  const { repository, digest, edition } = parseCatalogueRef(artifact);
+  const channel = evidenceChannelOfSigner(signer, schemas);
+  if (edition.distributionId !== offeringId) {
+    throw new Error(`--offering ${offeringId} is not the offering of ${artifact} (its repository is the offering ${edition.distributionId})`);
+  }
+  if (edition.channel !== channel) {
+    throw new Error(`${artifact} is in a ${edition.channel} repository, but the signer signs for the ${channel} channel`);
+  }
+  const manifest = await client.getManifestByDigest(repository, digest);
+  if (manifest.isIndex || manifest.document.artifactType !== EDITION_ARTIFACT_TYPE) {
+    throw new Error(`${artifact} is not an edition artifact (artifactType ${JSON.stringify(manifest.document.artifactType)}, expected ${EDITION_ARTIFACT_TYPE})`);
+  }
+  const catalogueLayer = layerTitled(manifest, CATALOGUE_FILE, artifact);
+  const lockLayer = layerTitled(manifest, EditionLockFile.Distribution, artifact);
+  const statement = {
+    _type: STATEMENT_TYPE,
+    subject: [{ name: `xema-edition-${offeringId}`, digest: { sha256: hexOf(digest) } }],
+    predicateType: schemas.EDITION_CATALOGUE_PREDICATE_TYPE,
+    predicate: {
+      schemaVersion: 1,
+      offeringId,
+      channel,
+      catalogueDigest: catalogueLayer.digest,
+      lockDigest: hexOf(lockLayer.digest),
+    },
+  };
+  schemas.parseEditionCatalogueStatement(statement);
+  return { statement, channel, repository, subjectDigest: digest };
+}
+
+function signingOf({ derived, options }) {
+  return {
+    statement: derived.statement,
+    root: options.stagingDirectory,
+    statementPath: CATALOGUE_EVIDENCE_STATEMENT_TITLE,
+    bundlePath: CATALOGUE_EVIDENCE_BUNDLE_TITLE,
+    signer: options.signer,
+    certificateWorkflowSha: options.signingWorkflowSha,
+    predicateType: options.schemas.EDITION_CATALOGUE_PREDICATE_TYPE,
+  };
+}
+
+/** Stage the catalogue statement of an artifact for signing. Returns the signing plan and the statement. */
+export async function stageEditionCatalogueEvidence(options) {
+  const { stagingDirectory } = options;
+  if (typeof stagingDirectory !== 'string' || !isAbsolute(stagingDirectory)) {
+    throw new Error('the catalogue staging directory must be absolute');
+  }
+  if (existsSync(stagingDirectory)) {
+    throw new Error(`catalogue staging directory already exists: ${stagingDirectory}`);
+  }
+  assertGitHubProducerContext({ signer: options.signer, producerWorkflowSha: options.signingWorkflowSha }, options.githubContext);
+  const derived = await deriveEditionCatalogueStatement(options);
+  mkdirSync(stagingDirectory, { recursive: true, mode: 0o700 });
+  try {
+    const plan = stageEvidenceStatement(signingOf({ derived, options }));
+    return {
+      plan: { ...plan, kind: 'edition-catalogue', offeringId: options.offeringId, channel: derived.channel, subjectDigest: derived.subjectDigest },
+      statement: derived.statement,
+    };
+  } catch (error) {
+    rmSync(stagingDirectory, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+/**
+ * Accept the signed catalogue bundle, seal `outputDirectory` and attach its two files to the artifact digest as an
+ * `EDITION_CATALOGUE_EVIDENCE_ARTIFACT_TYPE` referrer. The output is BUILT from the re-derived statement and the
+ * canonicalized bundle, never renamed from the staging, which must hold exactly what stage recorded and does not outlive
+ * the accept.
+ */
+export async function acceptEditionCatalogueEvidence(options) {
+  const { outputDirectory, stagingDirectory, readCosignVersion, runCosign, client } = options;
+  if (
+    typeof outputDirectory !== 'string' ||
+    !isAbsolute(outputDirectory) ||
+    typeof stagingDirectory !== 'string' ||
+    !isAbsolute(stagingDirectory)
+  ) {
+    throw new Error('the catalogue output and staging directories must be absolute');
+  }
+  if (typeof readCosignVersion !== 'function' || typeof runCosign !== 'function') {
+    throw new Error('cosign seams are required');
+  }
+  const sealing = reserveSealing(outputDirectory, 'catalogue');
+  let derived;
+  try {
+    assertGitHubProducerContext({ signer: options.signer, producerWorkflowSha: options.signingWorkflowSha }, options.githubContext);
+    assertPinnedCosignVersion(readCosignVersion(), options.policy?.cosignVersion);
+    derived = await deriveEditionCatalogueStatement(options);
+  } catch (error) {
+    discardStaging(stagingDirectory);
+    throw error;
+  }
+  const descriptor = sealAccepted({
+    stagingDirectory,
+    sealing,
+    outputDirectory,
+    build: () => {
+      assertStagedExactly(stagingDirectory, [CATALOGUE_EVIDENCE_STATEMENT_TITLE, CATALOGUE_EVIDENCE_BUNDLE_TITLE]);
+      return acceptSignedEvidenceStatement({ ...signingOf({ derived, options }), sealingRoot: sealing, runCosign });
+    },
+  });
+  const referrerDigest = await client.attach(derived.repository, derived.subjectDigest, {
+    artifactType: EDITION_CATALOGUE_EVIDENCE_ARTIFACT_TYPE,
+    files: [
+      { path: descriptor.statementPath, mediaType: CATALOGUE_EVIDENCE_STATEMENT_MEDIA_TYPE },
+      { path: descriptor.bundlePath, mediaType: BUNDLE_MEDIA_TYPE },
+    ],
+    annotations: { [CATALOGUE_EVIDENCE_WORKFLOW_SHA_ANNOTATION]: options.signingWorkflowSha },
+    cwd: outputDirectory,
+  });
+  return {
+    outputDirectory,
+    statement: derived.statement,
+    channel: derived.channel,
+    subjectDigest: derived.subjectDigest,
+    referrerDigest,
+    descriptor,
+  };
+}
+
+async function main() {
+  const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [WorkspaceRoot.Data, WorkspaceRoot.Kernel]);
+  if (phase !== 'stage' && phase !== 'accept') {
+    throw new Error('usage: xema-edition evidence statement catalogue <stage|accept> …');
+  }
+  const flags = parseEvidenceCliFlags(args, {
+    single: phase === 'stage' ? SHARED_FLAGS : [...SHARED_FLAGS, 'output', 'cosign'],
+    repeated: [],
+  });
+  const { schemas } = await loadProducerKernelSchemas({ dataRoot: dataRoot() });
+  const artifact = flags.require('artifact');
+  const githubSha = flags.require('github-sha');
+  const { authority } = parseCatalogueRef(artifact);
+  const options = {
+    artifact,
+    offeringId: flags.require('offering'),
+    stagingDirectory: resolve(flags.require('staging')),
+    schemas,
+    policy: loadPinnedTrustPolicy({ dataRoot: dataRoot(), schemas }),
+    client: createRegistryClientResolver({ dataRoot: dataRoot() })(authority),
+    signer: githubWorkflowSigner({
+      repository: flags.require('signer-repository'),
+      ref: flags.require('signer-ref'),
+      path: flags.require('signer-workflow-path'),
+    }),
+    githubContext: {
+      repository: flags.require('github-repository'),
+      ref: flags.require('github-ref'),
+      sha: githubSha,
+      workflowRef: flags.require('github-workflow-ref'),
+    },
+    signingWorkflowSha: githubSha,
+  };
+  if (phase === 'stage') {
+    process.stdout.write(serializeJson((await stageEditionCatalogueEvidence(options)).plan));
+    return;
+  }
+  const result = await acceptEditionCatalogueEvidence({
+    ...options,
+    outputDirectory: resolve(flags.require('output')),
+    ...createCosignVerifier(resolve(flags.require('cosign'))),
+  });
+  process.stdout.write(
+    serializeJson({
+      schemaVersion: 1,
+      kind: 'edition-catalogue',
+      offeringId: options.offeringId,
+      channel: result.channel,
+      subjectDigest: result.subjectDigest,
+      referrerDigest: result.referrerDigest,
+      evidence: result.descriptor,
+    }),
+  );
+}
+
+if (isEntryModule(import.meta.url)) {
+  main().catch((error) => {
+    console.error(`[edition-catalogue] ${error.message}`);
+    process.exitCode = 1;
+  });
+}