pmsec 0.14.0 → 2026.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmsec",
-  "version": "0.14.0",
+  "version": "2026.6.1",
   "publishConfig": {
     "access": "public"
   },

package/src/cli.mjs

@@ -10,8 +10,9 @@ import * as cargo from "./tools/cargo.mjs";
 import * as mise from "./tools/mise.mjs";
 import * as uv from "./tools/uv.mjs";
 import * as bundler from "./tools/bundler.mjs";
+import * as aube from "./tools/aube.mjs";
 
-const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv, bundler];
+const TOOLS = [npm, pnpm, yarn, bun, cargo, mise, uv, bundler, aube];
 // Default cooldown for the hardening bundle. Override per-invocation with
 // `--days N`; the default tracks the safest value we'd recommend.
 const BUNDLE_DAYS = 1;
@@ -22,7 +23,7 @@ export const VERSION = JSON.parse(
 const USAGE = `pmsec [options]
 
 Zero-config install-time supply-chain hardening across npm, pnpm, yarn,
-bun, cargo, mise, uv, bundler. Default action enables every safe-by-default
+bun, cargo, mise, uv, bundler, aube. Default action enables every safe-by-default
 key each tool exposes (cooldown, audit-level, trust-policy, hardened mode,
 attestation re-verification, ...). No knobs.
 
@@ -30,7 +31,7 @@ Options:
   --check               Verify the bundle is in place (exit 1 if anything missing)
   --disable             Remove the hardening bundle from selected tools
   --doctor              Diagnose effective paths/owner/uid (read-only; for unattended-deployment debugging)
-  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv,bundler)
+  --tool TOOL[,TOOL]    Restrict to specific tools (npm,pnpm,yarn,bun,cargo,mise,uv,bundler,aube)
   --days N              Override cooldown days (default 1)
   --force               Overwrite stricter existing cooldowns (otherwise enable is monotonic)
   --json                Emit JSON output

package/src/tools/aube.mjs

@@ -0,0 +1,45 @@
+import { aubeConfigPath } from "../util/paths.mjs";
+import { readSafe, writeAtomic } from "../util/io.mjs";
+import { readKey, setKey, removeKey } from "../util/lines.mjs";
+import { readExtras, applyExtras, removeExtras } from "../util/extras.mjs";
+
+export const name = "aube";
+export const key = "minimumReleaseAge";
+export const docs = "https://aube.jdx.dev/";
+export const extras = [
+  { key: "paranoid", expected: "true", line: "paranoid = true" },
+];
+
+export function path(ctx) { return aubeConfigPath(ctx.env, ctx.home, ctx.platform); }
+
+function parseDays(value) {
+  if (value === null) return null;
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  return Math.floor(n / 1440);
+}
+
+export async function read(ctx) {
+  const p = path(ctx);
+  const raw = await readSafe(p);
+  const value = readKey(raw, key);
+  return { path: p, configured: value, days: parseDays(value), extras: readExtras(raw, extras) };
+}
+
+export async function write(days, ctx) {
+  const p = path(ctx);
+  let text = setKey(await readSafe(p), key, `${key} = ${days * 1440}`);
+  text = applyExtras(text, extras);
+  await writeAtomic(p, text);
+  return { path: p };
+}
+
+export async function unset(ctx) {
+  const p = path(ctx);
+  const before = await readSafe(p);
+  const cooldown = removeKey(before, key);
+  const ex = removeExtras(cooldown.text, extras);
+  const removed = cooldown.removed || ex.removed;
+  if (removed) await writeAtomic(p, ex.text);
+  return { path: p, removed };
+}

package/src/tools/mise.mjs

@@ -11,6 +11,8 @@ export const minBin = [2026, 4, 22];
 export const extras = [
   { key: "paranoid", expected: "true", line: "paranoid = true", section },
   { key: "gpg_verify", expected: "true", line: "gpg_verify = true", section },
+  { key: "github_attestations", expected: "true", line: "github_attestations = true", section },
+  { key: "slsa", expected: "true", line: "slsa = true", section },
 ];
 
 export function path(ctx) { return miseConfigPath(ctx.env, ctx.home, ctx.platform); }

package/src/util/paths.mjs

@@ -60,3 +60,13 @@ export function miseConfigPath(env = process.env, home = homedir(), platform = p
   const base = env.XDG_CONFIG_HOME || join(home, ".config");
   return join(base, "mise", "config.toml");
 }
+
+export function aubeConfigPath(env = process.env, home = homedir(), platform = process.platform) {
+  if (env.AUBE_CONFIG_FILE) return env.AUBE_CONFIG_FILE;
+  if (platform === "win32") {
+    const base = env.LOCALAPPDATA || join(home, "AppData", "Local");
+    return join(base, "aube", "config.toml");
+  }
+  const base = env.XDG_CONFIG_HOME || join(home, ".config");
+  return join(base, "aube", "config.toml");
+}