spell-runtime 1.0.0 → 1.2.0

package/dist/signature/trustStore.js

@@ -0,0 +1,173 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publisherFromId = publisherFromId;
+exports.toPublisherKey = toPublisherKey;
+exports.publisherTrustFilePath = publisherTrustFilePath;
+exports.loadPublisherTrust = loadPublisherTrust;
+exports.upsertTrustedPublisherKey = upsertTrustedPublisherKey;
+exports.removeTrustedPublisher = removeTrustedPublisher;
+exports.listTrustedPublishers = listTrustedPublishers;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const errors_1 = require("../util/errors");
+const paths_1 = require("../util/paths");
+function publisherFromId(id) {
+    const idx = id.indexOf("/");
+    return idx === -1 ? id : id.slice(0, idx);
+}
+function toPublisherKey(publisher) {
+    return Buffer.from(publisher, "utf8").toString("base64url");
+}
+function publisherTrustFilePath(publisher) {
+    const key = toPublisherKey(publisher);
+    return node_path_1.default.join((0, paths_1.trustedPublishersRoot)(), `${key}.json`);
+}
+async function loadPublisherTrust(publisher) {
+    const filePath = publisherTrustFilePath(publisher);
+    let raw;
+    try {
+        raw = await (0, promises_1.readFile)(filePath, "utf8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new errors_1.SpellError(`failed to parse trust file: ${filePath}`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new errors_1.SpellError(`trust file must be a JSON object: ${filePath}`);
+    }
+    const obj = parsed;
+    const version = readRequiredString(obj, "version");
+    if (version !== "v1") {
+        throw new errors_1.SpellError(`unsupported trust file version: ${version}`);
+    }
+    const publisherValue = readRequiredString(obj, "publisher");
+    if (publisherValue !== publisher) {
+        throw new errors_1.SpellError(`trust file publisher mismatch: expected '${publisher}', got '${publisherValue}'`);
+    }
+    const keysRaw = obj.keys;
+    if (!Array.isArray(keysRaw) || keysRaw.length === 0) {
+        throw new errors_1.SpellError("trust file keys must be a non-empty array");
+    }
+    const keys = keysRaw.map((entry, idx) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            throw new errors_1.SpellError(`trust file keys[${idx}] must be an object`);
+        }
+        const e = entry;
+        const keyId = readRequiredString(e, "key_id");
+        const algorithm = readRequiredString(e, "algorithm");
+        if (algorithm !== "ed25519") {
+            throw new errors_1.SpellError(`unsupported trust key algorithm: ${algorithm}`);
+        }
+        const publicKey = readRequiredString(e, "public_key");
+        if (!/^[A-Za-z0-9_-]+$/.test(publicKey)) {
+            throw new errors_1.SpellError("trust key public_key must be base64url");
+        }
+        return { key_id: keyId, algorithm: "ed25519", public_key: publicKey };
+    });
+    assertUniqueKeyIds(keys);
+    return {
+        version: "v1",
+        publisher,
+        keys
+    };
+}
+async function upsertTrustedPublisherKey(publisher, key) {
+    await (0, promises_1.mkdir)((0, paths_1.trustedPublishersRoot)(), { recursive: true });
+    const existing = await loadPublisherTrust(publisher);
+    const next = existing ?? { version: "v1", publisher, keys: [] };
+    const filtered = next.keys.filter((entry) => entry.key_id !== key.key_id);
+    filtered.push(key);
+    filtered.sort((a, b) => a.key_id.localeCompare(b.key_id));
+    const payload = {
+        version: "v1",
+        publisher,
+        keys: filtered
+    };
+    const filePath = publisherTrustFilePath(publisher);
+    await (0, promises_1.writeFile)(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+}
+async function removeTrustedPublisher(publisher) {
+    const filePath = publisherTrustFilePath(publisher);
+    const existed = await (0, promises_1.access)(filePath).then(() => true).catch(() => false);
+    if (!existed)
+        return false;
+    await (0, promises_1.rm)(filePath, { force: true });
+    return true;
+}
+async function listTrustedPublishers() {
+    const dir = (0, paths_1.trustedPublishersRoot)();
+    const entries = await (0, promises_1.readdir)(dir).catch(() => []);
+    const out = [];
+    for (const entry of entries) {
+        if (!entry.endsWith(".json"))
+            continue;
+        const filePath = node_path_1.default.join(dir, entry);
+        let raw;
+        try {
+            raw = await (0, promises_1.readFile)(filePath, "utf8");
+        }
+        catch {
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            continue;
+        }
+        const obj = parsed;
+        if (obj.version !== "v1")
+            continue;
+        if (typeof obj.publisher !== "string" || !obj.publisher.trim())
+            continue;
+        if (!Array.isArray(obj.keys))
+            continue;
+        const publisher = obj.publisher.trim();
+        const keys = [];
+        for (const k of obj.keys) {
+            if (!k || typeof k !== "object" || Array.isArray(k))
+                continue;
+            const kk = k;
+            if (typeof kk.key_id !== "string" || typeof kk.public_key !== "string")
+                continue;
+            if (kk.algorithm !== "ed25519")
+                continue;
+            keys.push({ key_id: kk.key_id, algorithm: "ed25519", public_key: kk.public_key });
+        }
+        if (keys.length === 0)
+            continue;
+        out.push({ publisher, keys });
+    }
+    out.sort((a, b) => a.publisher.localeCompare(b.publisher));
+    return out;
+}
+function readRequiredString(obj, key) {
+    const value = obj[key];
+    if (typeof value !== "string" || !value.trim()) {
+        throw new errors_1.SpellError(`missing '${key}' string`);
+    }
+    return value.trim();
+}
+function assertUniqueKeyIds(keys) {
+    const seen = new Set();
+    for (const key of keys) {
+        if (seen.has(key.key_id)) {
+            throw new errors_1.SpellError(`duplicate trust key_id: ${key.key_id}`);
+        }
+        seen.add(key.key_id);
+    }
+}
+//# sourceMappingURL=trustStore.js.map

package/dist/signature/trustStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustStore.js","sourceRoot":"","sources":["../../src/signature/trustStore.ts"],"names":[],"mappings":";;;;;AAiBA,0CAGC;AAED,wCAEC;AAED,wDAGC;AAED,gDA4DC;AAED,8DAqBC;AAED,wDAMC;AAED,sDA+CC;AA3KD,+CAAmF;AACnF,0DAA6B;AAC7B,2CAA4C;AAC5C,yCAAsD;AActD,SAAgB,eAAe,CAAC,EAAU;IACxC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED,SAAgB,sBAAsB,CAAC,SAAiB;IACtD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,mBAAI,CAAC,IAAI,CAAC,IAAA,6BAAqB,GAAE,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;AAC3D,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACxD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAU,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,mBAAU,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAU,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAU,CAAC,4CAA4C,SAAS,WAAW,cAAc,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAU,CAAC,2CAA2C,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAA0B,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,mBAAU,CAAC,mBAAmB,GAAG,qBAAqB,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAU,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAU,CAAC,wCAAwC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAEzB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,GAAwB;IAExB,MAAM,IAAA,gBAAK,EAAC,IAAA,6BAAqB,GAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,IAAI,GAAqB,QAAQ,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAElF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE1D,MAAM,OAAO,GAAqB;QAChC,OAAO,EAAE,IAAI;QACb,SAAS;QACT,IAAI,EAAE,QAAQ;KACf,CAAC;IAEF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IAC5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,IAAA,iBAAM,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,IAAA,aAAE,EAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,qBAAqB;IACzC,MAAM,GAAG,GAAG,IAAA,6BAAqB,GAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAA8D,EAAE,CAAC;IAE1E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;YAAE,SAAS;QACnC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;YAAE,SAAS;QACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAEvC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAA0B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC9D,MAAM,EAAE,GAAG,CAA4B,CAAC;YACxC,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ;gBAAE,SAAS;YACjF,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YACzC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA4B,EAAE,GAAW;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,mBAAU,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA2B;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAU,CAAC,2BAA2B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/signature/verify.d.ts

@@ -0,0 +1,12 @@
+import { SpellBundleManifest } from "../types";
+export type SignatureStatus = "verified" | "unsigned" | "untrusted" | "invalid";
+export interface SignatureVerificationResult {
+    ok: boolean;
+    status: SignatureStatus;
+    publisher: string;
+    key_id?: string;
+    digest?: string;
+    message: string;
+}
+export declare function verifyBundleSignature(manifest: SpellBundleManifest, bundlePath: string): Promise<SignatureVerificationResult>;
+export declare function enforceSignatureOrThrow(result: SignatureVerificationResult): void;

package/dist/signature/verify.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyBundleSignature = verifyBundleSignature;
+exports.enforceSignatureOrThrow = enforceSignatureOrThrow;
+const node_crypto_1 = require("node:crypto");
+const errors_1 = require("../util/errors");
+const bundleDigest_1 = require("./bundleDigest");
+const signatureFile_1 = require("./signatureFile");
+const trustStore_1 = require("./trustStore");
+async function verifyBundleSignature(manifest, bundlePath) {
+    const publisher = (0, trustStore_1.publisherFromId)(manifest.id);
+    const sig = await (0, signatureFile_1.readSignatureFile)(bundlePath);
+    if (!sig) {
+        return {
+            ok: false,
+            status: "unsigned",
+            publisher,
+            message: "spell.sig.json not found"
+        };
+    }
+    if (sig.publisher !== publisher) {
+        return {
+            ok: false,
+            status: "invalid",
+            publisher,
+            key_id: sig.key_id,
+            digest: sig.digest.value,
+            message: `signature publisher mismatch: expected '${publisher}', got '${sig.publisher}'`
+        };
+    }
+    const trust = await (0, trustStore_1.loadPublisherTrust)(publisher);
+    if (!trust) {
+        return {
+            ok: false,
+            status: "untrusted",
+            publisher,
+            key_id: sig.key_id,
+            digest: sig.digest.value,
+            message: `no trusted key for publisher: ${publisher}`
+        };
+    }
+    const key = trust.keys.find((entry) => entry.key_id === sig.key_id);
+    if (!key) {
+        return {
+            ok: false,
+            status: "untrusted",
+            publisher,
+            key_id: sig.key_id,
+            digest: sig.digest.value,
+            message: `trusted key_id not found: ${sig.key_id}`
+        };
+    }
+    const digest = await (0, bundleDigest_1.computeBundleDigest)(bundlePath);
+    if (digest.valueHex !== sig.digest.value) {
+        return {
+            ok: false,
+            status: "invalid",
+            publisher,
+            key_id: sig.key_id,
+            digest: digest.valueHex,
+            message: "digest mismatch"
+        };
+    }
+    const signatureBytes = decodeBase64Url(sig.signature, "spell.sig.json.signature");
+    const publicKeyDer = decodeBase64Url(key.public_key, "trust public_key");
+    let publicKey;
+    try {
+        publicKey = (0, node_crypto_1.createPublicKey)({ key: publicKeyDer, format: "der", type: "spki" });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            status: "untrusted",
+            publisher,
+            key_id: sig.key_id,
+            digest: digest.valueHex,
+            message: `invalid trusted public key: ${error.message}`
+        };
+    }
+    const ok = (0, node_crypto_1.verify)(null, digest.value, publicKey, signatureBytes);
+    if (!ok) {
+        return {
+            ok: false,
+            status: "invalid",
+            publisher,
+            key_id: sig.key_id,
+            digest: digest.valueHex,
+            message: "signature verification failed"
+        };
+    }
+    return {
+        ok: true,
+        status: "verified",
+        publisher,
+        key_id: sig.key_id,
+        digest: digest.valueHex,
+        message: "verified"
+    };
+}
+function enforceSignatureOrThrow(result) {
+    if (result.ok)
+        return;
+    if (result.status === "unsigned") {
+        throw new errors_1.SpellError("signature required: spell.sig.json not found");
+    }
+    if (result.status === "untrusted") {
+        throw new errors_1.SpellError(`signature required: ${result.message}`);
+    }
+    throw new errors_1.SpellError(`signature required: ${result.message}`);
+}
+function decodeBase64Url(value, label) {
+    try {
+        return Buffer.from(value, "base64url");
+    }
+    catch (error) {
+        throw new errors_1.SpellError(`invalid base64url for ${label}: ${error.message}`);
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/signature/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/signature/verify.ts"],"names":[],"mappings":";;AAkBA,sDAoGC;AAED,0DAYC;AApID,6CAAsD;AAEtD,2CAA4C;AAC5C,iDAAqD;AACrD,mDAAoD;AACpD,6CAAmE;AAa5D,KAAK,UAAU,qBAAqB,CACzC,QAA6B,EAC7B,UAAkB;IAElB,MAAM,SAAS,GAAG,IAAA,4BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAG,MAAM,IAAA,iCAAiB,EAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,SAAS;YACT,OAAO,EAAE,0BAA0B;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,2CAA2C,SAAS,WAAW,GAAG,CAAC,SAAS,GAAG;SACzF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,+BAAkB,EAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,iCAAiC,SAAS,EAAE;SACtD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,6BAA6B,GAAG,CAAC,MAAM,EAAE;SACnD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAmB,EAAC,UAAU,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,OAAO,EAAE,iBAAiB;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAEzE,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;YACnB,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,OAAO,EAAE,+BAAgC,KAAe,CAAC,OAAO,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,IAAA,oBAAM,EAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,OAAO,EAAE,+BAA+B;SACzC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,UAAU;QAClB,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,OAAO,EAAE,UAAU;KACpB,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,MAAmC;IACzE,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO;IAEtB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAU,CAAC,8CAA8C,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,mBAAU,CAAC,uBAAuB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,mBAAU,CAAC,uBAAuB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAU,CAAC,yBAAyB,KAAK,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -81,6 +81,13 @@ export interface ExecutionLog {
     id: string;
     version: string;
     input: Record<string, unknown>;
+    signature?: {
+        required: boolean;
+        status: "skipped" | "verified" | "unsigned" | "untrusted" | "invalid";
+        publisher?: string;
+        key_id?: string;
+        digest?: string;
+    };
     summary: {
         risk: SpellRisk;
         billing: SpellBilling;
@@ -100,6 +107,7 @@ export interface CastOptions {
     dryRun: boolean;
     yes: boolean;
     allowBilling: boolean;
+    requireSignature: boolean;
     verbose: boolean;
     profile?: string;
 }

package/dist/util/paths.d.ts

@@ -1,4 +1,6 @@
 export declare function spellHome(): string;
 export declare function spellsRoot(): string;
 export declare function logsRoot(): string;
+export declare function trustRoot(): string;
+export declare function trustedPublishersRoot(): string;
 export declare function ensureSpellDirs(): Promise<void>;

package/dist/util/paths.js

@@ -6,6 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.spellHome = spellHome;
 exports.spellsRoot = spellsRoot;
 exports.logsRoot = logsRoot;
+exports.trustRoot = trustRoot;
+exports.trustedPublishersRoot = trustedPublishersRoot;
 exports.ensureSpellDirs = ensureSpellDirs;
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
@@ -19,8 +21,15 @@ function spellsRoot() {
 function logsRoot() {
     return node_path_1.default.join(spellHome(), "logs");
 }
+function trustRoot() {
+    return node_path_1.default.join(spellHome(), "trust");
+}
+function trustedPublishersRoot() {
+    return node_path_1.default.join(trustRoot(), "publishers");
+}
 async function ensureSpellDirs() {
     await (0, promises_1.mkdir)(spellsRoot(), { recursive: true });
     await (0, promises_1.mkdir)(logsRoot(), { recursive: true });
+    await (0, promises_1.mkdir)(trustedPublishersRoot(), { recursive: true });
 }
 //# sourceMappingURL=paths.js.map

package/dist/util/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/util/paths.ts"],"names":[],"mappings":";;;;;AAIA,8BAEC;AAED,gCAEC;AAED,4BAEC;AAED,0CAGC;AAnBD,+CAAyC;AACzC,qCAAkC;AAClC,0DAA6B;AAE7B,SAAgB,SAAS;IACvB,OAAO,mBAAI,CAAC,IAAI,CAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,UAAU;IACxB,OAAO,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,QAAQ;IACtB,OAAO,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAEM,KAAK,UAAU,eAAe;IACnC,MAAM,IAAA,gBAAK,EAAC,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAA,gBAAK,EAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/util/paths.ts"],"names":[],"mappings":";;;;;AAIA,8BAEC;AAED,gCAEC;AAED,4BAEC;AAED,8BAEC;AAED,sDAEC;AAED,0CAIC;AA5BD,+CAAyC;AACzC,qCAAkC;AAClC,0DAA6B;AAE7B,SAAgB,SAAS;IACvB,OAAO,mBAAI,CAAC,IAAI,CAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,UAAU;IACxB,OAAO,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,QAAQ;IACtB,OAAO,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,SAAS;IACvB,OAAO,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,qBAAqB;IACnC,OAAO,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAEM,KAAK,UAAU,eAAe;IACnC,MAAM,IAAA,gBAAK,EAAC,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAA,gBAAK,EAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAA,gBAAK,EAAC,qBAAqB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/dist/util/platform.d.ts

@@ -1 +1,3 @@
 export declare function detectHostPlatform(): string;
+export declare function detectDockerPlatformForHost(): string;
+export declare function platformMatches(supported: string[], target: string): boolean;

package/dist/util/platform.js

@@ -1,7 +1,45 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectHostPlatform = detectHostPlatform;
+exports.detectDockerPlatformForHost = detectDockerPlatformForHost;
+exports.platformMatches = platformMatches;
 function detectHostPlatform() {
     return `${process.platform}/${process.arch}`;
 }
+function detectDockerPlatformForHost() {
+    // Docker execution runs in a linux container even on darwin/win32 hosts.
+    return `linux/${normalizeArch(process.arch)}`;
+}
+function platformMatches(supported, target) {
+    const expanded = expandPlatformAliases(target);
+    return supported.some((entry) => expanded.includes(entry));
+}
+function expandPlatformAliases(platform) {
+    const trimmed = platform.trim();
+    if (!trimmed.includes("/")) {
+        return [trimmed];
+    }
+    const [os, archRaw] = trimmed.split("/", 2);
+    const arch = normalizeArch(archRaw);
+    const out = new Set();
+    out.add(`${os}/${archRaw}`);
+    out.add(`${os}/${arch}`);
+    // Treat x64 and amd64 as aliases across OSes.
+    if (arch === "amd64") {
+        out.add(`${os}/x64`);
+    }
+    if (arch === "x64") {
+        out.add(`${os}/amd64`);
+    }
+    return Array.from(out);
+}
+function normalizeArch(arch) {
+    if (arch === "x64") {
+        return "amd64";
+    }
+    if (arch === "amd64") {
+        return "amd64";
+    }
+    return arch;
+}
 //# sourceMappingURL=platform.js.map

package/dist/util/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/util/platform.ts"],"names":[],"mappings":";;AAAA,gDAEC;AAFD,SAAgB,kBAAkB;IAChC,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/util/platform.ts"],"names":[],"mappings":";;AAAA,gDAEC;AAED,kEAGC;AAED,0CAGC;AAZD,SAAgB,kBAAkB;IAChC,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,SAAgB,2BAA2B;IACzC,yEAAyE;IACzE,OAAO,SAAS,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAgB,eAAe,CAAC,SAAmB,EAAE,MAAc;IACjE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAEzB,8CAA8C;IAC9C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/util/redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redactSecrets<T>(value: T, env?: NodeJS.ProcessEnv): T;
+export declare function collectSensitiveEnvValues(env?: NodeJS.ProcessEnv): string[];

package/dist/util/redact.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSecrets = redactSecrets;
+exports.collectSensitiveEnvValues = collectSensitiveEnvValues;
+const REDACTED = "[REDACTED]";
+const SENSITIVE_KEY_RE = /(authorization|token|secret|password|api[-_]?key|private[-_]?key|cookie|set-cookie)/i;
+const SENSITIVE_ENV_NAME_RE = /(TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|ACCESS_KEY|AUTH|COOKIE|SESSION|CREDENTIAL)/i;
+const TOKEN_LIKE_RE = /\b(?:ghp|github_pat|npm|sk_live|sk_test|xoxb|xoxp)_[A-Za-z0-9_-]+\b/g;
+const BEARER_RE = /(Bearer\s+)[^\s"']+/gi;
+function redactSecrets(value, env = process.env) {
+    const secrets = collectSensitiveEnvValues(env);
+    const seen = new WeakSet();
+    return redactValue(value, secrets, seen);
+}
+function collectSensitiveEnvValues(env = process.env) {
+    const set = new Set();
+    for (const [name, rawValue] of Object.entries(env)) {
+        if (!SENSITIVE_ENV_NAME_RE.test(name)) {
+            continue;
+        }
+        if (typeof rawValue !== "string" || rawValue.trim() === "") {
+            continue;
+        }
+        set.add(rawValue);
+    }
+    return Array.from(set).sort((a, b) => b.length - a.length);
+}
+function redactValue(value, secrets, seen) {
+    if (typeof value === "string") {
+        return redactString(value, secrets);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactValue(entry, secrets, seen));
+    }
+    if (!value || typeof value !== "object") {
+        return value;
+    }
+    if (seen.has(value)) {
+        return REDACTED;
+    }
+    seen.add(value);
+    const out = {};
+    for (const [key, raw] of Object.entries(value)) {
+        if (SENSITIVE_KEY_RE.test(key)) {
+            out[key] = REDACTED;
+            continue;
+        }
+        out[key] = redactValue(raw, secrets, seen);
+    }
+    return out;
+}
+function redactString(value, secrets) {
+    let out = value;
+    for (const secret of secrets) {
+        if (secret.length < 4) {
+            continue;
+        }
+        if (out.includes(secret)) {
+            out = out.split(secret).join(REDACTED);
+        }
+    }
+    out = out.replace(BEARER_RE, `$1${REDACTED}`);
+    out = out.replace(TOKEN_LIKE_RE, REDACTED);
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/dist/util/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/util/redact.ts"],"names":[],"mappings":";;AAOA,sCAIC;AAED,8DAcC;AA3BD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,gBAAgB,GAAG,sFAAsF,CAAC;AAChH,MAAM,qBAAqB,GAAG,wFAAwF,CAAC;AACvH,MAAM,aAAa,GAAG,sEAAsE,CAAC;AAC7F,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAE1C,SAAgB,aAAa,CAAI,KAAQ,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7E,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAM,CAAC;AAChD,CAAC;AAED,SAAgB,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,OAAiB,EAAE,IAAqB;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC1E,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACpB,SAAS;QACX,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,OAAiB;IACpD,IAAI,GAAG,GAAG,KAAK,CAAC;IAEhB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC9C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAE3C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spell-runtime",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Minimal CLI runtime for SpellBundle v1",
   "license": "MIT",
   "type": "commonjs",
@@ -10,13 +10,16 @@
     "LICENSE"
   ],
   "bin": {
-    "spell": "dist/cli/index.js"
+    "spell": "dist/cli/index.js",
+    "spell-runner": "dist/runner/spell-runner.js"
   },
   "engines": {
     "node": ">=20"
   },
   "scripts": {
     "dev": "tsx src/cli/index.ts",
+    "api:dev": "tsx src/api/index.ts",
+    "api:start": "node dist/api/index.js",
     "build": "tsc -p tsconfig.json",
     "prepare": "npm run build",
     "test": "vitest run",