import { preload, sibling } from './preload.ts';
import type * as Provider from './provider.ts';
import type * as Plugins from './plugin-verifier.ts';

// The preload entry point: registering the signed-archive provider is all this
// does, so `--vfs-load` finds it already in place when it picks a provider for
// its source.
//
//   node --experimental-vfs -r @pipobscure/bundle/register --vfs-load=app.nzip
//
// `--import @pipobscure/bundle/register` works just as well: mounting is
// deferred until both `-r` and `--import` preloads have run, and this module
// imports cleanly from ESM. Either way the point is that registering is a
// preload flag and nothing more — no module of your own to write.
//
// Configure it through the environment — a preload takes no arguments:
//
//   BUNDLE_ROOTS            extra trusted root certificates, as a
//                           path-delimiter-separated list of PEM files
//   BUNDLE_ALLOW_UNTRUSTED  accept a good signature whose chain is not anchored
//                           in the trust store
//   BUNDLE_IDENTITY         require this sigstore signing identity
//   BUNDLE_ISSUER           require this sigstore OIDC issuer
//   BUNDLE_SIGSTORE_ROOT    path to the sigstore trust root to check against
//   BUNDLE_ATTESTERS        require attestations from these, as space- or
//                           comma-separated `[kind@]did`; checked against the
//                           cache `bundle trust` fills, never the network
//   BUNDLE_QUORUM           how many of them (default: all)
//   BUNDLE_ATTESTATION_MAX_AGE  how stale a cached proof may be (default: 7d)
//   BUNDLE_BLOCK            refuse an archive any of these DIDs has marked bad
//   BUNDLE_ATTESTATIONS     where that cache is
//
// For anything more, import `@pipobscure/bundle/provider` and call `register()`
// with options from a preload module of your own.

preload(() => {
    const settings = sibling<typeof Provider>(import.meta.filename, 'provider').register();
    // Plugins this process loads are verified too, with what carries over
    // from this runtime to code someone else wrote (see plugin-verifier.ts).
    const plugins = sibling<typeof Plugins>(import.meta.filename, 'plugin-verifier');
    plugins.enforce(plugins.carriedFrom(settings));
});