everything-dev/dist/services/deploy/manifest-verify.mjs

A consolidated product package for building Module Federation apps with oRPC APIs.

import { createHash } from "node:crypto";

//#region src/services/deploy/manifest-verify.ts
function manifestDocumentUrl(base, manifest) {
	return `${base.replace(/\/$/, "")}/${manifest.replace(/^\//, "")}`;
}
function computeManifestSri(text) {
	return `sha384-${createHash("sha384").update(text).digest("base64")}`;
}
/** Fetch the pinned manifest and verify its SRI — never throws; callers map
* the failure reason to their own result shapes (a slot check, a thrown
* resolution error, …). */
async function fetchVerifiedManifest(input) {
	const manifestUrl = manifestDocumentUrl(input.base, input.pin.manifest);
	let response;
	try {
		response = await (input.fetchImpl ?? fetch)(manifestUrl);
	} catch (error) {
		return {
			ok: false,
			reason: `manifest fetch failed: ${error instanceof Error ? error.message : String(error)}`
		};
	}
	if (!response.ok) return {
		ok: false,
		reason: `manifest fetch failed: ${response.status}`
	};
	const text = await response.text();
	const computed = computeManifestSri(text);
	if (computed !== input.pin.integrity) return {
		ok: false,
		reason: `integrity mismatch for ${manifestUrl} (expected ${input.pin.integrity}, computed ${computed})`
	};
	return {
		ok: true,
		text
	};
}

//#endregion
export { computeManifestSri, fetchVerifiedManifest, manifestDocumentUrl };
//# sourceMappingURL=manifest-verify.mjs.map