var R=Object.defineProperty;var p=(e,t)=>R(e,"name",{value:t,configurable:!0});import{createRequire as I}from"node:module";import{loadOptionalSigstore as h}from"./loader.js";const b=I(import.meta.url),u=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,_=p(e=>{if(typeof u<"u"&&u.versions&&u.versions.node){const[t,n]=u.versions.node.split(".").map(Number);if(t>22||t===22&&n>=3||t===20&&n>=16)return u.getBuiltinModule(e)}return b(e)},"__cjs_getBuiltinModule"),{createHash:v}=_("node:crypto"),{createReadStream:x}=_("node:fs");var O=Object.defineProperty,s=p((e,t)=>O(e,"name",{value:t,configurable:!0}),"r");const S="https://token.actions.githubusercontent.com",m=s(e=>e.replaceAll(/[$()*+.?[\\\]^{|}]/g,String.raw`\$&`),"escapeRegex"),$=s(e=>{if("github"in e){const{ref:t,repo:n,workflow:r}=e.github;return{issuer:S,sanPattern:`^${m(`https://github.com/${n}/${r}@${t}`)}$`}}return"sanRegex"in e?{issuer:e.oidcIssuer,sanPattern:e.sanRegex}:{issuer:e.oidcIssuer,sanPattern:`^${m(e.san)}$`}},"normalizeExpectedIdentity"),P=s(()=>process.env.CI==="true"||typeof process.env.ACTIONS_ID_TOKEN_REQUEST_URL=="string"||typeof process.env.SIGSTORE_ID_TOKEN=="string","hasAmbientOidc"),w=s(e=>new Promise((t,n)=>{const r=v("sha256"),a=x(e);a.on("error",n),a.on("data",i=>r.update(i)),a.on("end",()=>{t(Buffer.from(r.digest("hex")))})}),"digestFile"),A=1024,T=s(e=>{const{issuer:t,sanPattern:n}=$(e.expectedIdentity),r=new Map,a=s((i,o)=>{let f;try{f=JSON.parse(o)}catch{return Promise.resolve(!1)}return(async()=>{let c;try{c=await w(i)}catch{return!1}const l=`${c.toString("utf8")}:${v("sha256").update(o).digest("hex")}`,g=r.get(l);if(g)return g;const y=(async()=>{try{return await(await h({workspaceRoot:e.workspaceRoot})).verify(f,c,{certificateIdentityURI:n,certificateIssuer:t}),!0}catch(d){return e.onVerifyFailure?.(d instanceof Error?d.message:String(d)),!1}})();return r.size>=A&&r.clear(),r.set(l,y),y})()},"verifyOnce");return{expectedIdentity:e.expectedIdentity,onReject:e.onReject,requireOnDownload:e.requireOnDownload??!1,signArtifact:s(async({archivePath:i})=>{if(!P())return null;const o=await h({workspaceRoot:e.workspaceRoot}),f=await w(i),c=await o.sign(f);return JSON.stringify(c)},"signArtifact"),verifyArtifact:s(({archivePath:i,attestation:o})=>a(i,o),"verifyArtifact")}},"buildCacheAttestationHooks");export{T as buildCacheAttestationHooks,$ as normalizeExpectedIdentity};
