@ainize/core 0.1.0

package/dist/teach-auth.js

@@ -0,0 +1,33 @@
+/**
+ * The teaching-key signature — the CLIENT half, in core because everything that signs one is a client.
+ *
+ * A teaching key is the whole identity behind Teach mode: no account, no session, just a key that signs each
+ * request. The CLI signs with it, scripts sign with it, the browser mirrors it, and `@ainize/mcp` used to keep
+ * a hand-copied six-line duplicate rather than import `@ainize/node` and pull express, sqlite and the trainer
+ * into a process that only speaks HTTP. One definition, verified by one test, is what stops those drifting.
+ *
+ * Header: `x-ainize-auth: <address>:<ts>:<sig>[:v2]`
+ * v2 (request-bound, single-use): sig = signMessage("teach:<nodeAddress>:<METHOD>:<path+query>:<ts>[:<sha256(body)>]").
+ *   A captured header cannot be replayed to another route, another node, with another body, or a second time.
+ * Both forms expire after ±5 min (`TEACH_AUTH_SKEW_MS`).
+ *
+ * Verification lives in `@ainize/node` (`TeachAuth`): it needs the request object and the replay cache, which
+ * only a server has.
+ */
+import { createHash } from 'node:crypto';
+import { signMessage } from './identity.js';
+export const TEACH_AUTH_SKEW_MS = 5 * 60_000;
+export const TEACH_AUTH_V2 = 'v2';
+const sha256 = (b) => createHash('sha256').update(b).digest('hex');
+/** The string a v2 client signs. `path` is the request target as sent (path + query); the body hash is appended only when a body is sent. */
+export function teachAuthMessage(t) {
+    const parts = [t.purpose ?? 'teach', t.node, t.method.toUpperCase(), t.path, String(t.ts)];
+    if (t.body !== undefined && t.body !== null && t.body.length > 0)
+        parts.push(sha256(t.body));
+    return parts.join(':');
+}
+/** Build a v2 header for one request (CLI / scripts; the browser helper mirrors this). */
+export function teachAuthHeaderFor(key, t, ts = Date.now()) {
+    return `${key.address}:${ts}:${signMessage(teachAuthMessage({ ...t, ts }), key.privateKey)}:${TEACH_AUTH_V2}`;
+}
+//# sourceMappingURL=teach-auth.js.map

package/dist/teach-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teach-auth.js","sourceRoot":"","sources":["../src/teach-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAIlC,MAAM,MAAM,GAAG,CAAC,CAAsB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAExF,6IAA6I;AAC7I,MAAM,UAAU,gBAAgB,CAAC,CAAmC;IAClE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,GAA4C,EAAE,CAAkB,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;IAClH,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,IAAI,WAAW,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,EAAE,CAAC;AAChH,CAAC"}