@ai-dossier/core 1.3.5 → 1.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +9 -2
- package/dist/index.js.map +1 -1
- package/dist/schema/dossier-schema.json +43 -10
- package/dist/signature.d.ts.map +1 -1
- package/dist/signature.js +9 -2
- package/dist/signature.js.map +1 -1
- package/dist/signers/ed25519.d.ts +1 -1
- package/dist/signers/ed25519.d.ts.map +1 -1
- package/dist/signers/ed25519.js +11 -7
- package/dist/signers/ed25519.js.map +1 -1
- package/dist/signers/index.d.ts +3 -0
- package/dist/signers/index.d.ts.map +1 -1
- package/dist/signers/index.js.map +1 -1
- package/dist/signing-payload.d.ts +59 -0
- package/dist/signing-payload.d.ts.map +1 -0
- package/dist/signing-payload.js +146 -0
- package/dist/signing-payload.js.map +1 -0
- package/dist/types.d.ts +2 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +4 -2
package/README.md
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
[](https://www.npmjs.com/package/@ai-dossier/core)
|
|
5
5
|
[](https://github.com/imboard-ai/ai-dossier/blob/main/LICENSE)
|
|
6
6
|
|
|
7
|
-
Core parsing, verification, and linting logic for
|
|
7
|
+
Core parsing, verification, signing, and linting logic for [Dossier](https://github.com/imboard-ai/ai-dossier) — portable, signed, versioned skills for any LLM tool.
|
|
8
8
|
|
|
9
9
|
## Installation
|
|
10
10
|
|
package/dist/index.d.ts
CHANGED
|
@@ -22,6 +22,8 @@ export type { SecurityCategory, SecurityFinding, SecurityReport, SecurityRule, S
|
|
|
22
22
|
export { buildReport, defaultSecurityRules, SecurityRuleRegistry, scanDossier, scanDossierFile, scanMarkdown, } from './security-scanner';
|
|
23
23
|
export { loadTrustedKeys, verifySignature, verifyWithEd25519, verifyWithKms } from './signature';
|
|
24
24
|
export { Ed25519Signer, Ed25519Verifier, getVerifierRegistry, KmsSigner, KmsVerifier, SignatureResult, Signer, Verifier, VerifierRegistry, VerifyResult, } from './signers';
|
|
25
|
+
export type { SignatureCoverage } from './signing-payload';
|
|
26
|
+
export { buildSignedPayload, canonicalizeFrontmatter, normalizePublicKey, publicKeysMatch, signatureCoverage, toSpkiPem, } from './signing-payload';
|
|
25
27
|
export type { ConfigLayer as TraceConfigLayer, ResolvedTraceConfig, TraceConfigOptions, TraceConfigSource, } from './trace-config';
|
|
26
28
|
export { resolveTraceConfig } from './trace-config';
|
|
27
29
|
export type { DossierTraceInfo, StepInput as TraceStepInput, TraceInput, TraceRecorder, TraceRecorderOptions, TraceStatus, TraceUpdate, } from './trace-recorder';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EACL,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,WAAW,IAAI,gBAAgB,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,gBAAgB,EAChB,SAAS,IAAI,cAAc,EAC3B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EACL,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,WAAW,IAAI,gBAAgB,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,gBAAgB,EAChB,SAAS,IAAI,cAAc,EAC3B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -24,8 +24,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
|
24
24
|
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
25
25
|
};
|
|
26
26
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
27
|
-
exports.
|
|
28
|
-
exports.createDefaultVerificationResult = void 0;
|
|
27
|
+
exports.readFileIfExists = exports.getErrorStack = exports.getErrorMessage = exports.sha256Hex = exports.sha256Hash = exports.VALID_TRACE_STATUSES = exports.createTraceRecorder = exports.resolveTraceConfig = exports.toSpkiPem = exports.signatureCoverage = exports.publicKeysMatch = exports.normalizePublicKey = exports.canonicalizeFrontmatter = exports.buildSignedPayload = exports.VerifierRegistry = exports.KmsVerifier = exports.KmsSigner = exports.getVerifierRegistry = exports.Ed25519Verifier = exports.Ed25519Signer = exports.verifyWithKms = exports.verifyWithEd25519 = exports.verifySignature = exports.loadTrustedKeys = exports.scanMarkdown = exports.scanDossierFile = exports.scanDossier = exports.SecurityRuleRegistry = exports.defaultSecurityRules = exports.buildReport = exports.assessVerificationRisk = exports.assessContentRisk = exports.validateFrontmatter = exports.VALID_STATUSES = exports.VALID_RISK_LEVELS = exports.REQUIRED_FIELDS = exports.RECOMMENDED_FIELDS = exports.parseDossierFile = exports.parseDossierContent = exports.loadLintConfig = exports.lintDossierFile = exports.lintDossier = exports.LintRuleRegistry = exports.defaultRules = exports.formatDossierFile = exports.formatDossierContent = exports.validateStepCoherence = exports.validateCoherence = exports.verifyIntegrity = exports.calculateChecksum = void 0;
|
|
28
|
+
exports.createDefaultVerificationResult = exports.scanBodyForUrls = exports.isUrlCoveredByDeclared = exports.isPlaceholderUrl = exports.findUndeclaredUrls = exports.findStaleReferences = exports.collectDeclaredUrls = void 0;
|
|
29
29
|
// Checksum exports
|
|
30
30
|
var checksum_1 = require("./checksum");
|
|
31
31
|
Object.defineProperty(exports, "calculateChecksum", { enumerable: true, get: function () { return checksum_1.calculateChecksum; } });
|
|
@@ -78,6 +78,13 @@ Object.defineProperty(exports, "getVerifierRegistry", { enumerable: true, get: f
|
|
|
78
78
|
Object.defineProperty(exports, "KmsSigner", { enumerable: true, get: function () { return signers_1.KmsSigner; } });
|
|
79
79
|
Object.defineProperty(exports, "KmsVerifier", { enumerable: true, get: function () { return signers_1.KmsVerifier; } });
|
|
80
80
|
Object.defineProperty(exports, "VerifierRegistry", { enumerable: true, get: function () { return signers_1.VerifierRegistry; } });
|
|
81
|
+
var signing_payload_1 = require("./signing-payload");
|
|
82
|
+
Object.defineProperty(exports, "buildSignedPayload", { enumerable: true, get: function () { return signing_payload_1.buildSignedPayload; } });
|
|
83
|
+
Object.defineProperty(exports, "canonicalizeFrontmatter", { enumerable: true, get: function () { return signing_payload_1.canonicalizeFrontmatter; } });
|
|
84
|
+
Object.defineProperty(exports, "normalizePublicKey", { enumerable: true, get: function () { return signing_payload_1.normalizePublicKey; } });
|
|
85
|
+
Object.defineProperty(exports, "publicKeysMatch", { enumerable: true, get: function () { return signing_payload_1.publicKeysMatch; } });
|
|
86
|
+
Object.defineProperty(exports, "signatureCoverage", { enumerable: true, get: function () { return signing_payload_1.signatureCoverage; } });
|
|
87
|
+
Object.defineProperty(exports, "toSpkiPem", { enumerable: true, get: function () { return signing_payload_1.toSpkiPem; } });
|
|
81
88
|
var trace_config_1 = require("./trace-config");
|
|
82
89
|
Object.defineProperty(exports, "resolveTraceConfig", { enumerable: true, get: function () { return trace_config_1.resolveTraceConfig; } });
|
|
83
90
|
var trace_recorder_1 = require("./trace-recorder");
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;AAEH,mBAAmB;AACnB,uCAAgE;AAAvD,6GAAA,iBAAiB,OAAA;AAAE,2GAAA,eAAe,OAAA;AAU3C,yCAAuE;AAA9D,8GAAA,iBAAiB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAEjD,oBAAoB;AACpB,yCAAsE;AAA7D,iHAAA,oBAAoB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAUhD,iBAAiB;AACjB,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,yGAAA,eAAe,OAAA;AACf,wGAAA,cAAc,OAAA;AAEhB,iBAAiB;AACjB,mCAQkB;AAPhB,6GAAA,mBAAmB,OAAA;AACnB,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,wGAAA,cAAc,OAAA;AACd,6GAAA,mBAAmB,OAAA;AASrB,0BAA0B;AAC1B,qDAA8E;AAArE,oHAAA,iBAAiB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAYlD,uDAO4B;AAN1B,+GAAA,WAAW,OAAA;AACX,wHAAA,oBAAoB,OAAA;AACpB,wHAAA,oBAAoB,OAAA;AACpB,+GAAA,WAAW,OAAA;AACX,mHAAA,eAAe,OAAA;AACf,gHAAA,YAAY,OAAA;AAEd,oBAAoB;AACpB,yCAAiG;AAAxF,4GAAA,eAAe,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,0GAAA,aAAa,OAAA;AAC3E,iDAAiD;AACjD,qCAWmB;AAVjB,wGAAA,aAAa,OAAA;AACb,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AAIX,2GAAA,gBAAgB,OAAA;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;AAEH,mBAAmB;AACnB,uCAAgE;AAAvD,6GAAA,iBAAiB,OAAA;AAAE,2GAAA,eAAe,OAAA;AAU3C,yCAAuE;AAA9D,8GAAA,iBAAiB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAEjD,oBAAoB;AACpB,yCAAsE;AAA7D,iHAAA,oBAAoB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAUhD,iBAAiB;AACjB,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,yGAAA,eAAe,OAAA;AACf,wGAAA,cAAc,OAAA;AAEhB,iBAAiB;AACjB,mCAQkB;AAPhB,6GAAA,mBAAmB,OAAA;AACnB,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,wGAAA,cAAc,OAAA;AACd,6GAAA,mBAAmB,OAAA;AASrB,0BAA0B;AAC1B,qDAA8E;AAArE,oHAAA,iBAAiB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAYlD,uDAO4B;AAN1B,+GAAA,WAAW,OAAA;AACX,wHAAA,oBAAoB,OAAA;AACpB,wHAAA,oBAAoB,OAAA;AACpB,+GAAA,WAAW,OAAA;AACX,mHAAA,eAAe,OAAA;AACf,gHAAA,YAAY,OAAA;AAEd,oBAAoB;AACpB,yCAAiG;AAAxF,4GAAA,eAAe,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,0GAAA,aAAa,OAAA;AAC3E,iDAAiD;AACjD,qCAWmB;AAVjB,wGAAA,aAAa,OAAA;AACb,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AAIX,2GAAA,gBAAgB,OAAA;AAKlB,qDAO2B;AANzB,qHAAA,kBAAkB,OAAA;AAClB,0HAAA,uBAAuB,OAAA;AACvB,qHAAA,kBAAkB,OAAA;AAClB,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,4GAAA,SAAS,OAAA;AASX,+CAAoD;AAA3C,kHAAA,kBAAkB,OAAA;AAW3B,mDAA6E;AAApE,qHAAA,mBAAmB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAClD,eAAe;AACf,0CAAwB;AACxB,mBAAmB;AACnB,yCAAuD;AAA9C,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAC9B,kBAAkB;AAClB,yCAAgE;AAAvD,yGAAA,eAAe,OAAA;AAAE,uGAAA,aAAa,OAAA;AACvC,wBAAwB;AACxB,iCAA8C;AAArC,sGAAA,gBAAgB,OAAA;AACzB,yBAAyB;AACzB,mDAO6B;AAN3B,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AAEjB,yBAAyB;AACzB,qDAAuE;AAA9D,+HAAA,+BAA+B,OAAA"}
|
|
@@ -73,7 +73,12 @@
|
|
|
73
73
|
"monitoring",
|
|
74
74
|
"infrastructure",
|
|
75
75
|
"ci-cd",
|
|
76
|
-
"documentation"
|
|
76
|
+
"documentation",
|
|
77
|
+
"git",
|
|
78
|
+
"review",
|
|
79
|
+
"skills",
|
|
80
|
+
"workflow",
|
|
81
|
+
"orchestration"
|
|
77
82
|
]
|
|
78
83
|
},
|
|
79
84
|
"minItems": 1,
|
|
@@ -145,12 +150,16 @@
|
|
|
145
150
|
"enum": [
|
|
146
151
|
"modifies_files",
|
|
147
152
|
"deletes_files",
|
|
153
|
+
"modifies_directory_structure",
|
|
148
154
|
"modifies_cloud_resources",
|
|
149
155
|
"requires_credentials",
|
|
150
156
|
"network_access",
|
|
151
157
|
"executes_external_code",
|
|
152
158
|
"database_operations",
|
|
153
|
-
"system_configuration"
|
|
159
|
+
"system_configuration",
|
|
160
|
+
"creates_pull_request",
|
|
161
|
+
"merges_code",
|
|
162
|
+
"incurs_cost"
|
|
154
163
|
]
|
|
155
164
|
},
|
|
156
165
|
"uniqueItems": true
|
|
@@ -235,7 +244,7 @@
|
|
|
235
244
|
},
|
|
236
245
|
"signature": {
|
|
237
246
|
"type": "object",
|
|
238
|
-
"description": "Optional cryptographic signature for authenticity verification (dual-signature system: AWS KMS for official,
|
|
247
|
+
"description": "Optional cryptographic signature for authenticity verification (dual-signature system: AWS KMS for official, Ed25519 for community)",
|
|
239
248
|
"required": ["algorithm", "signed_by"],
|
|
240
249
|
"oneOf": [
|
|
241
250
|
{
|
|
@@ -261,35 +270,54 @@
|
|
|
261
270
|
"type": "string",
|
|
262
271
|
"description": "Base64-encoded DER public key from AWS KMS (optional, can be fetched from KMS)"
|
|
263
272
|
},
|
|
273
|
+
"covers": {
|
|
274
|
+
"type": "string",
|
|
275
|
+
"description": "Which bytes the signature covers. 'frontmatter+body' binds the security metadata (risk_level, requires_approval, destructive_operations) to the signature. Absent means the legacy body-only scheme, under which frontmatter is unprotected.",
|
|
276
|
+
"enum": ["body", "frontmatter+body"],
|
|
277
|
+
"default": "body"
|
|
278
|
+
},
|
|
264
279
|
"signed_by": {
|
|
265
280
|
"type": "string",
|
|
266
281
|
"description": "Signer identity",
|
|
267
282
|
"examples": ["Imboard AI Security Team <security@imboard.ai>"]
|
|
268
283
|
},
|
|
269
|
-
"
|
|
284
|
+
"signed_at": {
|
|
270
285
|
"type": "string",
|
|
271
286
|
"description": "When the signature was created (ISO 8601 format)",
|
|
272
287
|
"format": "date-time"
|
|
288
|
+
},
|
|
289
|
+
"timestamp": {
|
|
290
|
+
"type": "string",
|
|
291
|
+
"description": "Deprecated alias for signed_at (ISO 8601 format)",
|
|
292
|
+
"format": "date-time"
|
|
273
293
|
}
|
|
274
294
|
}
|
|
275
295
|
},
|
|
276
296
|
{
|
|
277
|
-
"description": "
|
|
297
|
+
"description": "Ed25519 signature (community dossiers)",
|
|
278
298
|
"required": ["algorithm", "public_key", "signature", "signed_by"],
|
|
279
299
|
"properties": {
|
|
280
300
|
"algorithm": {
|
|
281
301
|
"type": "string",
|
|
282
302
|
"const": "ed25519",
|
|
283
|
-
"description": "Ed25519 signature (
|
|
303
|
+
"description": "Ed25519 signature (Node.js crypto)"
|
|
284
304
|
},
|
|
285
305
|
"public_key": {
|
|
286
306
|
"type": "string",
|
|
287
|
-
"description": "
|
|
288
|
-
"pattern": "^RWT[A-Za-z0-9+/=]
|
|
307
|
+
"description": "Ed25519 public key. Canonical form is the raw 32-byte key, base64-encoded — the form 'dossier keys add' prints and the trusted-key list stores. SPKI PEM (emitted by the signer between 2025-11-18 and 0.8.7) and legacy minisign 'RWT...' keys are still accepted on the read path.",
|
|
308
|
+
"pattern": "^(RWT[A-Za-z0-9+/=]+|[A-Za-z0-9+/]{43}=|-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*)$",
|
|
309
|
+
"examples": ["m97FPrnq/zKlQArLvJl3bTZCUMWWpp/d0UJ/OfUKZeE="]
|
|
289
310
|
},
|
|
290
311
|
"signature": {
|
|
291
312
|
"type": "string",
|
|
292
|
-
"description": "
|
|
313
|
+
"description": "Base64-encoded Ed25519 signature over the payload named by 'covers'",
|
|
314
|
+
"pattern": "^[A-Za-z0-9+/]+=*$"
|
|
315
|
+
},
|
|
316
|
+
"covers": {
|
|
317
|
+
"type": "string",
|
|
318
|
+
"description": "Which bytes the signature covers. 'frontmatter+body' binds the security metadata (risk_level, requires_approval, destructive_operations) to the signature. Absent means the legacy body-only scheme, under which frontmatter is unprotected.",
|
|
319
|
+
"enum": ["body", "frontmatter+body"],
|
|
320
|
+
"default": "body"
|
|
293
321
|
},
|
|
294
322
|
"key_id": {
|
|
295
323
|
"type": "string",
|
|
@@ -301,10 +329,15 @@
|
|
|
301
329
|
"description": "Signer identity",
|
|
302
330
|
"examples": ["Author Name <author@example.com>"]
|
|
303
331
|
},
|
|
304
|
-
"
|
|
332
|
+
"signed_at": {
|
|
305
333
|
"type": "string",
|
|
306
334
|
"description": "When the signature was created (ISO 8601 format)",
|
|
307
335
|
"format": "date-time"
|
|
336
|
+
},
|
|
337
|
+
"timestamp": {
|
|
338
|
+
"type": "string",
|
|
339
|
+
"description": "Deprecated alias for signed_at (ISO 8601 format)",
|
|
340
|
+
"format": "date-time"
|
|
308
341
|
}
|
|
309
342
|
}
|
|
310
343
|
}
|
package/dist/signature.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAM/D;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsCtE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,YAAY,CAkBd;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,SAAc,GACnB,OAAO,CAAC,YAAY,CAAC,CAsBvB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,YAAY,CAAC,CAIvB"}
|
package/dist/signature.js
CHANGED
|
@@ -15,6 +15,7 @@ const node_os_1 = require("node:os");
|
|
|
15
15
|
const node_path_1 = require("node:path");
|
|
16
16
|
const client_kms_1 = require("@aws-sdk/client-kms");
|
|
17
17
|
const signers_1 = require("./signers");
|
|
18
|
+
const signing_payload_1 = require("./signing-payload");
|
|
18
19
|
const crypto_1 = require("./utils/crypto");
|
|
19
20
|
const fs_1 = require("./utils/fs");
|
|
20
21
|
/**
|
|
@@ -42,6 +43,12 @@ function loadTrustedKeys(filePath) {
|
|
|
42
43
|
const publicKey = parts[0];
|
|
43
44
|
const keyId = parts.slice(1).join(' ');
|
|
44
45
|
keys.set(publicKey, keyId);
|
|
46
|
+
// Index the normalized form too, so a key registered in one encoding
|
|
47
|
+
// still matches a signature that carries another.
|
|
48
|
+
const normalized = (0, signing_payload_1.normalizePublicKey)(publicKey);
|
|
49
|
+
if (normalized !== publicKey) {
|
|
50
|
+
keys.set(normalized, keyId);
|
|
51
|
+
}
|
|
45
52
|
}
|
|
46
53
|
}
|
|
47
54
|
}
|
|
@@ -60,9 +67,9 @@ function verifyWithEd25519(content, signature, publicKey) {
|
|
|
60
67
|
try {
|
|
61
68
|
const signatureBuffer = Buffer.from(signature, 'base64');
|
|
62
69
|
const contentBuffer = Buffer.from(content, 'utf8');
|
|
63
|
-
//
|
|
70
|
+
// Accept raw base64 or SPKI PEM — both are in circulation.
|
|
64
71
|
const publicKeyObject = (0, node_crypto_1.createPublicKey)({
|
|
65
|
-
key: publicKey,
|
|
72
|
+
key: (0, signing_payload_1.toSpkiPem)(publicKey),
|
|
66
73
|
format: 'pem',
|
|
67
74
|
type: 'spki',
|
|
68
75
|
});
|
package/dist/signature.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signature.js","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;
|
|
1
|
+
{"version":3,"file":"signature.js","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAiBH,0CAsCC;AAQD,8CAsBC;AAKD,sCA2BC;AASD,0CAOC;AAnID,6CAAsD;AACtD,qCAAkC;AAClC,yCAAiC;AACjC,oDAAqF;AAErF,uCAAgD;AAChD,uDAAkE;AAClE,2CAA4C;AAC5C,mCAA8C;AAE9C;;;;GAIG;AACH,SAAgB,eAAe,CAAC,QAAiB;IAC/C,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAA,qBAAgB,EAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAE5B,gCAAgC;YAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,SAAS;YACX,CAAC;YAED,+BAA+B;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAE3B,qEAAqE;gBACrE,kDAAkD;gBAClD,MAAM,UAAU,GAAG,IAAA,oCAAkB,EAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,0CAA2C,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,OAAe,EACf,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnD,2DAA2D;QAC3D,MAAM,eAAe,GAAG,IAAA,6BAAe,EAAC;YACtC,GAAG,EAAE,IAAA,2BAAS,EAAC,SAAS,CAAC;YACzB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,2DAA2D;QAC3D,MAAM,KAAK,GAAG,IAAA,oBAAM,EAAC,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;QAC5E,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,SAAiB,EACjB,KAAa,EACb,MAAM,GAAG,WAAW;IAEpB,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEzC,kEAAkE;IAClE,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,IAAI,0BAAa,CAAC;QAChC,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,QAAQ;QACrB,SAAS,EAAE,eAAe;QAC1B,gBAAgB,EAAE,iCAAoB,CAAC,aAAa;KACrD,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,SAA0B;IAE1B,MAAM,gBAAgB,GAAG,IAAA,6BAAmB,GAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3D,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC"}
|
|
@@ -5,7 +5,7 @@ import type { SignatureResult, Signer, Verifier, VerifyResult } from './index';
|
|
|
5
5
|
export declare class Ed25519Signer implements Signer {
|
|
6
6
|
readonly algorithm = "ed25519";
|
|
7
7
|
private privateKey;
|
|
8
|
-
private
|
|
8
|
+
private publicKeyBase64;
|
|
9
9
|
constructor(privateKeyPath: string);
|
|
10
10
|
sign(content: string): Promise<SignatureResult>;
|
|
11
11
|
getPublicKey(): Promise<string>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../../src/signers/ed25519.ts"],"names":[],"mappings":"AAAA;;GAEG;
|
|
1
|
+
{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../../src/signers/ed25519.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/E,qBAAa,aAAc,YAAW,MAAM;IAC1C,QAAQ,CAAC,SAAS,aAAa;IAC/B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,eAAe,CAAS;gBAEpB,cAAc,EAAE,MAAM;IAoB5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAY/C,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;CAGtC;AAED,qBAAa,eAAgB,YAAW,QAAQ;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI9B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;CAmBjF"}
|
package/dist/signers/ed25519.js
CHANGED
|
@@ -6,10 +6,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
6
6
|
exports.Ed25519Verifier = exports.Ed25519Signer = void 0;
|
|
7
7
|
const node_crypto_1 = require("node:crypto");
|
|
8
8
|
const node_fs_1 = require("node:fs");
|
|
9
|
+
const signing_payload_1 = require("../signing-payload");
|
|
9
10
|
class Ed25519Signer {
|
|
10
11
|
algorithm = 'ed25519';
|
|
11
12
|
privateKey;
|
|
12
|
-
|
|
13
|
+
publicKeyBase64;
|
|
13
14
|
constructor(privateKeyPath) {
|
|
14
15
|
// Load private key from PEM file
|
|
15
16
|
const privateKeyPem = (0, node_fs_1.readFileSync)(privateKeyPath, 'utf8');
|
|
@@ -18,12 +19,15 @@ class Ed25519Signer {
|
|
|
18
19
|
format: 'pem',
|
|
19
20
|
type: 'pkcs8',
|
|
20
21
|
});
|
|
21
|
-
//
|
|
22
|
+
// Emit raw 32-byte base64 — the form `dossier keys add` prints, the trusted-key
|
|
23
|
+
// list stores, and the published corpus carries. Signing emitted SPKI PEM between
|
|
24
|
+
// 2025-11-18 and this change, which could never match a trusted-key entry.
|
|
22
25
|
const publicKey = (0, node_crypto_1.createPublicKey)(this.privateKey);
|
|
23
|
-
|
|
26
|
+
const publicKeyPem = publicKey.export({
|
|
24
27
|
type: 'spki',
|
|
25
28
|
format: 'pem',
|
|
26
29
|
});
|
|
30
|
+
this.publicKeyBase64 = (0, signing_payload_1.normalizePublicKey)(publicKeyPem);
|
|
27
31
|
}
|
|
28
32
|
async sign(content) {
|
|
29
33
|
const contentBuffer = Buffer.from(content, 'utf8');
|
|
@@ -31,12 +35,12 @@ class Ed25519Signer {
|
|
|
31
35
|
return {
|
|
32
36
|
algorithm: this.algorithm,
|
|
33
37
|
signature: signatureBuffer.toString('base64'),
|
|
34
|
-
public_key: this.
|
|
38
|
+
public_key: this.publicKeyBase64,
|
|
35
39
|
signed_at: new Date().toISOString(),
|
|
36
40
|
};
|
|
37
41
|
}
|
|
38
42
|
async getPublicKey() {
|
|
39
|
-
return this.
|
|
43
|
+
return this.publicKeyBase64;
|
|
40
44
|
}
|
|
41
45
|
}
|
|
42
46
|
exports.Ed25519Signer = Ed25519Signer;
|
|
@@ -48,9 +52,9 @@ class Ed25519Verifier {
|
|
|
48
52
|
try {
|
|
49
53
|
const signatureBuffer = Buffer.from(signature.signature, 'base64');
|
|
50
54
|
const contentBuffer = Buffer.from(content, 'utf8');
|
|
51
|
-
//
|
|
55
|
+
// Accept raw base64 or SPKI PEM — both are in circulation.
|
|
52
56
|
const publicKeyObject = (0, node_crypto_1.createPublicKey)({
|
|
53
|
-
key: signature.public_key,
|
|
57
|
+
key: (0, signing_payload_1.toSpkiPem)(signature.public_key),
|
|
54
58
|
format: 'pem',
|
|
55
59
|
type: 'spki',
|
|
56
60
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../../src/signers/ed25519.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,6CAA8E;AAC9E,qCAAuC;
|
|
1
|
+
{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../../src/signers/ed25519.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,6CAA8E;AAC9E,qCAAuC;AACvC,wDAAmE;AAGnE,MAAa,aAAa;IACf,SAAS,GAAG,SAAS,CAAC;IACvB,UAAU,CAAY;IACtB,eAAe,CAAS;IAEhC,YAAY,cAAsB;QAChC,iCAAiC;QACjC,MAAM,aAAa,GAAG,IAAA,sBAAY,EAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,IAAA,8BAAgB,EAAC;YACjC,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,gFAAgF;QAChF,kFAAkF;QAClF,2EAA2E;QAC3E,MAAM,SAAS,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC;YACpC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,KAAK;SACd,CAAW,CAAC;QACb,IAAI,CAAC,eAAe,GAAG,IAAA,oCAAkB,EAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,IAAA,kBAAI,EAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnE,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAxCD,sCAwCC;AAED,MAAa,eAAe;IAC1B,QAAQ,CAAC,SAAiB;QACxB,OAAO,SAAS,KAAK,SAAS,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,SAA0B;QACtD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAEnD,2DAA2D;YAC3D,MAAM,eAAe,GAAG,IAAA,6BAAe,EAAC;gBACtC,GAAG,EAAE,IAAA,2BAAS,EAAC,SAAS,CAAC,UAAU,CAAC;gBACpC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,2BAA2B;YAC3B,MAAM,KAAK,GAAG,IAAA,oBAAM,EAAC,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;YAC5E,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AAxBD,0CAwBC"}
|
package/dist/signers/index.d.ts
CHANGED
|
@@ -4,10 +4,13 @@
|
|
|
4
4
|
export interface SignatureResult {
|
|
5
5
|
algorithm: string;
|
|
6
6
|
signature: string;
|
|
7
|
+
/** Ed25519 public key, raw 32-byte base64 (canonical) or SPKI PEM (legacy). */
|
|
7
8
|
public_key: string;
|
|
8
9
|
key_id?: string;
|
|
9
10
|
signed_by?: string;
|
|
10
11
|
signed_at: string;
|
|
12
|
+
/** Which bytes the signature covers. Absent means the legacy body-only scheme. */
|
|
13
|
+
covers?: 'body' | 'frontmatter+body';
|
|
11
14
|
}
|
|
12
15
|
export interface Signer {
|
|
13
16
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/signers/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/signers/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEhD;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IACvB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE3E;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC;AAGD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAG/C,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,YAAY,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/signers/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/signers/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAmDH,yBAAyB;AACzB,qCAA2D;AAAlD,wGAAA,aAAa,OAAA;AAAE,0GAAA,eAAe,OAAA;AACvC,6BAA+C;AAAtC,gGAAA,SAAS,OAAA;AAAE,kGAAA,WAAW,OAAA;AAE/B,kBAAkB;AAClB,uCAGoB;AAFlB,+GAAA,mBAAmB,OAAA;AACnB,4GAAA,gBAAgB,OAAA"}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Canonical signing payload and Ed25519 public-key normalization.
|
|
3
|
+
*
|
|
4
|
+
* Two concerns live here because they share one goal: making a signature mean
|
|
5
|
+
* what people assume it means.
|
|
6
|
+
*
|
|
7
|
+
* 1. Key format. Ed25519 public keys circulate in three shapes in this project's
|
|
8
|
+
* history — minisign (`RWT...`, pre-2025-11-18), SPKI PEM (the signer since
|
|
9
|
+
* 2025-11-18), and raw 32-byte base64 (`dossier keys generate`, the trusted-key
|
|
10
|
+
* list, and every dossier published before 2026-03). Raw base64 is canonical:
|
|
11
|
+
* it is what the trust list stores and what the published corpus carries.
|
|
12
|
+
* Everything is normalized to it before comparison, and PEM is still accepted
|
|
13
|
+
* on the read path so signatures made in between keep verifying.
|
|
14
|
+
*
|
|
15
|
+
* 2. Payload coverage. Signatures used to cover the body only, which left
|
|
16
|
+
* `risk_level`, `requires_approval`, `destructive_operations` and the rest of
|
|
17
|
+
* the frontmatter unprotected — exactly the fields the runner gates execution
|
|
18
|
+
* on. v2 payloads cover the frontmatter (minus the signature block itself)
|
|
19
|
+
* together with the body. `signature.covers` records which scheme was used;
|
|
20
|
+
* absent means the legacy body-only scheme.
|
|
21
|
+
*/
|
|
22
|
+
export type SignatureCoverage = 'body' | 'frontmatter+body';
|
|
23
|
+
/**
|
|
24
|
+
* Coverage of a signature block, defaulting to the legacy body-only scheme when
|
|
25
|
+
* the field is absent.
|
|
26
|
+
*/
|
|
27
|
+
export declare function signatureCoverage(signature: {
|
|
28
|
+
covers?: string;
|
|
29
|
+
} | undefined): SignatureCoverage;
|
|
30
|
+
/**
|
|
31
|
+
* Normalize an Ed25519 public key to raw 32-byte base64.
|
|
32
|
+
*
|
|
33
|
+
* Accepts SPKI PEM, raw base64, and base64 SPKI DER. Returns the input trimmed
|
|
34
|
+
* when it cannot be interpreted, so callers can still do an exact-match
|
|
35
|
+
* comparison against whatever the source actually contained.
|
|
36
|
+
*/
|
|
37
|
+
export declare function normalizePublicKey(publicKey: string): string;
|
|
38
|
+
/**
|
|
39
|
+
* Build an SPKI PEM from any accepted public-key form, for use with node:crypto.
|
|
40
|
+
* Returns the input unchanged when it is already PEM.
|
|
41
|
+
*/
|
|
42
|
+
export declare function toSpkiPem(publicKey: string): string;
|
|
43
|
+
/**
|
|
44
|
+
* Compare two public keys across encodings.
|
|
45
|
+
*/
|
|
46
|
+
export declare function publicKeysMatch(a: string | undefined, b: string | undefined): boolean;
|
|
47
|
+
/**
|
|
48
|
+
* Canonical form of the frontmatter for signing: every field except the
|
|
49
|
+
* signature block, serialized deterministically.
|
|
50
|
+
*/
|
|
51
|
+
export declare function canonicalizeFrontmatter(frontmatter: Record<string, unknown>): string;
|
|
52
|
+
/**
|
|
53
|
+
* The exact bytes a v2 signature covers.
|
|
54
|
+
*
|
|
55
|
+
* The version tag is inside the signed payload on purpose: it stops a v2
|
|
56
|
+
* signature from being replayed as a v1 body-only signature, or the reverse.
|
|
57
|
+
*/
|
|
58
|
+
export declare function buildSignedPayload(frontmatter: Record<string, unknown>, body: string, coverage?: SignatureCoverage): string;
|
|
59
|
+
//# sourceMappingURL=signing-payload.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"signing-payload.d.ts","sourceRoot":"","sources":["../src/signing-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAAG,iBAAiB,CAE/F;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAsC5D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAkBnD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKrF;AAuBD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAGpF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,iBAAsC,GAC/C,MAAM,CAKR"}
|
|
@@ -0,0 +1,146 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Canonical signing payload and Ed25519 public-key normalization.
|
|
4
|
+
*
|
|
5
|
+
* Two concerns live here because they share one goal: making a signature mean
|
|
6
|
+
* what people assume it means.
|
|
7
|
+
*
|
|
8
|
+
* 1. Key format. Ed25519 public keys circulate in three shapes in this project's
|
|
9
|
+
* history — minisign (`RWT...`, pre-2025-11-18), SPKI PEM (the signer since
|
|
10
|
+
* 2025-11-18), and raw 32-byte base64 (`dossier keys generate`, the trusted-key
|
|
11
|
+
* list, and every dossier published before 2026-03). Raw base64 is canonical:
|
|
12
|
+
* it is what the trust list stores and what the published corpus carries.
|
|
13
|
+
* Everything is normalized to it before comparison, and PEM is still accepted
|
|
14
|
+
* on the read path so signatures made in between keep verifying.
|
|
15
|
+
*
|
|
16
|
+
* 2. Payload coverage. Signatures used to cover the body only, which left
|
|
17
|
+
* `risk_level`, `requires_approval`, `destructive_operations` and the rest of
|
|
18
|
+
* the frontmatter unprotected — exactly the fields the runner gates execution
|
|
19
|
+
* on. v2 payloads cover the frontmatter (minus the signature block itself)
|
|
20
|
+
* together with the body. `signature.covers` records which scheme was used;
|
|
21
|
+
* absent means the legacy body-only scheme.
|
|
22
|
+
*/
|
|
23
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
24
|
+
exports.signatureCoverage = signatureCoverage;
|
|
25
|
+
exports.normalizePublicKey = normalizePublicKey;
|
|
26
|
+
exports.toSpkiPem = toSpkiPem;
|
|
27
|
+
exports.publicKeysMatch = publicKeysMatch;
|
|
28
|
+
exports.canonicalizeFrontmatter = canonicalizeFrontmatter;
|
|
29
|
+
exports.buildSignedPayload = buildSignedPayload;
|
|
30
|
+
/** SPKI DER prefix for an Ed25519 public key: 12 bytes, then the raw 32-byte key. */
|
|
31
|
+
const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
|
|
32
|
+
const ED25519_RAW_KEY_BYTES = 32;
|
|
33
|
+
/**
|
|
34
|
+
* Coverage of a signature block, defaulting to the legacy body-only scheme when
|
|
35
|
+
* the field is absent.
|
|
36
|
+
*/
|
|
37
|
+
function signatureCoverage(signature) {
|
|
38
|
+
return signature?.covers === 'frontmatter+body' ? 'frontmatter+body' : 'body';
|
|
39
|
+
}
|
|
40
|
+
/**
|
|
41
|
+
* Normalize an Ed25519 public key to raw 32-byte base64.
|
|
42
|
+
*
|
|
43
|
+
* Accepts SPKI PEM, raw base64, and base64 SPKI DER. Returns the input trimmed
|
|
44
|
+
* when it cannot be interpreted, so callers can still do an exact-match
|
|
45
|
+
* comparison against whatever the source actually contained.
|
|
46
|
+
*/
|
|
47
|
+
function normalizePublicKey(publicKey) {
|
|
48
|
+
const trimmed = publicKey.trim();
|
|
49
|
+
if (!trimmed) {
|
|
50
|
+
return trimmed;
|
|
51
|
+
}
|
|
52
|
+
// minisign keys are a different encoding entirely (and carry a key id); nothing
|
|
53
|
+
// has produced them since 2025-11-18. Leave them untouched.
|
|
54
|
+
if (trimmed.startsWith('RWT')) {
|
|
55
|
+
return trimmed;
|
|
56
|
+
}
|
|
57
|
+
const base64Body = trimmed.includes('BEGIN')
|
|
58
|
+
? trimmed
|
|
59
|
+
.replace(/-----BEGIN [^-]+-----/g, '')
|
|
60
|
+
.replace(/-----END [^-]+-----/g, '')
|
|
61
|
+
.replace(/\s+/g, '')
|
|
62
|
+
: trimmed.replace(/\s+/g, '');
|
|
63
|
+
let decoded;
|
|
64
|
+
try {
|
|
65
|
+
decoded = Buffer.from(base64Body, 'base64');
|
|
66
|
+
}
|
|
67
|
+
catch {
|
|
68
|
+
return trimmed;
|
|
69
|
+
}
|
|
70
|
+
if (decoded.length === ED25519_RAW_KEY_BYTES) {
|
|
71
|
+
return decoded.toString('base64');
|
|
72
|
+
}
|
|
73
|
+
if (decoded.length === ED25519_SPKI_PREFIX.length + ED25519_RAW_KEY_BYTES &&
|
|
74
|
+
decoded.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)) {
|
|
75
|
+
return decoded.subarray(ED25519_SPKI_PREFIX.length).toString('base64');
|
|
76
|
+
}
|
|
77
|
+
return trimmed;
|
|
78
|
+
}
|
|
79
|
+
/**
|
|
80
|
+
* Build an SPKI PEM from any accepted public-key form, for use with node:crypto.
|
|
81
|
+
* Returns the input unchanged when it is already PEM.
|
|
82
|
+
*/
|
|
83
|
+
function toSpkiPem(publicKey) {
|
|
84
|
+
const trimmed = publicKey.trim();
|
|
85
|
+
if (trimmed.includes('BEGIN')) {
|
|
86
|
+
return trimmed;
|
|
87
|
+
}
|
|
88
|
+
const raw = Buffer.from(normalizePublicKey(trimmed), 'base64');
|
|
89
|
+
if (raw.length !== ED25519_RAW_KEY_BYTES) {
|
|
90
|
+
// Not something we can rebuild; hand it back and let crypto report the error.
|
|
91
|
+
return trimmed;
|
|
92
|
+
}
|
|
93
|
+
const der = Buffer.concat([ED25519_SPKI_PREFIX, raw]);
|
|
94
|
+
const body = der
|
|
95
|
+
.toString('base64')
|
|
96
|
+
.replace(/(.{64})/g, '$1\n')
|
|
97
|
+
.trimEnd();
|
|
98
|
+
return `-----BEGIN PUBLIC KEY-----\n${body}\n-----END PUBLIC KEY-----\n`;
|
|
99
|
+
}
|
|
100
|
+
/**
|
|
101
|
+
* Compare two public keys across encodings.
|
|
102
|
+
*/
|
|
103
|
+
function publicKeysMatch(a, b) {
|
|
104
|
+
if (!a || !b) {
|
|
105
|
+
return false;
|
|
106
|
+
}
|
|
107
|
+
return normalizePublicKey(a) === normalizePublicKey(b);
|
|
108
|
+
}
|
|
109
|
+
/**
|
|
110
|
+
* Deterministic JSON: object keys sorted recursively, no insignificant whitespace.
|
|
111
|
+
* Array order is meaningful and is preserved.
|
|
112
|
+
*/
|
|
113
|
+
function stableStringify(value) {
|
|
114
|
+
if (value === null || typeof value !== 'object') {
|
|
115
|
+
return JSON.stringify(value) ?? 'null';
|
|
116
|
+
}
|
|
117
|
+
if (Array.isArray(value)) {
|
|
118
|
+
return `[${value.map(stableStringify).join(',')}]`;
|
|
119
|
+
}
|
|
120
|
+
const entries = Object.entries(value)
|
|
121
|
+
.filter(([, v]) => v !== undefined)
|
|
122
|
+
.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
|
|
123
|
+
.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`);
|
|
124
|
+
return `{${entries.join(',')}}`;
|
|
125
|
+
}
|
|
126
|
+
/**
|
|
127
|
+
* Canonical form of the frontmatter for signing: every field except the
|
|
128
|
+
* signature block, serialized deterministically.
|
|
129
|
+
*/
|
|
130
|
+
function canonicalizeFrontmatter(frontmatter) {
|
|
131
|
+
const { signature: _excluded, ...rest } = frontmatter;
|
|
132
|
+
return stableStringify(rest);
|
|
133
|
+
}
|
|
134
|
+
/**
|
|
135
|
+
* The exact bytes a v2 signature covers.
|
|
136
|
+
*
|
|
137
|
+
* The version tag is inside the signed payload on purpose: it stops a v2
|
|
138
|
+
* signature from being replayed as a v1 body-only signature, or the reverse.
|
|
139
|
+
*/
|
|
140
|
+
function buildSignedPayload(frontmatter, body, coverage = 'frontmatter+body') {
|
|
141
|
+
if (coverage === 'body') {
|
|
142
|
+
return body;
|
|
143
|
+
}
|
|
144
|
+
return `dossier-signature-v2\n${canonicalizeFrontmatter(frontmatter)}\n${body}`;
|
|
145
|
+
}
|
|
146
|
+
//# sourceMappingURL=signing-payload.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"signing-payload.js","sourceRoot":"","sources":["../src/signing-payload.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AAaH,8CAEC;AASD,gDAsCC;AAMD,8BAkBC;AAKD,0CAKC;AA2BD,0DAGC;AAQD,gDASC;AA7ID,qFAAqF;AACrF,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAIjC;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,SAA0C;IAC1E,OAAO,SAAS,EAAE,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gFAAgF;IAChF,4DAA4D;IAC5D,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC1C,CAAC,CAAC,OAAO;aACJ,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;aACrC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC;aACnC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEhC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,IACE,OAAO,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,GAAG,qBAAqB;QACrE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAC3E,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,SAAiB;IACzC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACzC,8EAA8E;QAC9E,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,GAAG;SACb,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC;SAC3B,OAAO,EAAE,CAAC;IACb,OAAO,+BAA+B,IAAI,8BAA8B,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,CAAqB,EAAE,CAAqB;IAC1E,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEjE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,WAAoC;IAC1E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC;IACtD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,WAAoC,EACpC,IAAY,EACZ,WAA8B,kBAAkB;IAEhD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,yBAAyB,uBAAuB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;AAClF,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -54,6 +54,8 @@ export interface DossierFrontmatter {
|
|
|
54
54
|
key_id?: string;
|
|
55
55
|
signed_by?: string;
|
|
56
56
|
signed_at?: string;
|
|
57
|
+
/** Which bytes the signature covers. Absent means the legacy body-only scheme. */
|
|
58
|
+
covers?: 'body' | 'frontmatter+body';
|
|
57
59
|
};
|
|
58
60
|
[key: string]: unknown;
|
|
59
61
|
}
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAE/E,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAEpE,MAAM,MAAM,qBAAqB,GAC7B,UAAU,GACV,KAAK,GACL,eAAe,GACf,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAE/E,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAEpE,MAAM,MAAM,qBAAqB,GAC7B,UAAU,GACV,KAAK,GACL,eAAe,GACf,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,mBAAmB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kFAAkF;QAClF,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;KACtC,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,kBAAkB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,eAAe,CAAC;IAC3B,YAAY,EAAE,kBAAkB,CAAC;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-dossier/core",
|
|
3
|
-
"version": "1.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "1.4.0",
|
|
4
|
+
"description": "Parsing, verification, and signing for dossiers — portable, signed, versioned skills for any LLM tool.",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
7
7
|
"files": [
|
|
@@ -18,6 +18,8 @@
|
|
|
18
18
|
},
|
|
19
19
|
"keywords": [
|
|
20
20
|
"dossier",
|
|
21
|
+
"skill",
|
|
22
|
+
"skills",
|
|
21
23
|
"parsing",
|
|
22
24
|
"verification",
|
|
23
25
|
"checksum",
|