npm - @blod-nm/ak - Versions diffs - 0.0.0-stage → 0.1.0 - Mend

@blod-nm/ak 0.0.0-stage → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/dist/crypto.d.ts ADDED Viewed

@@ -0,0 +1,20 @@
+/**
+ * Web Crypto 封装 —— 唯一的运行时依赖面。
+ * 不 import node:crypto,因此在 Node 18+ / Bun / Deno /
+ * Cloudflare Workers / Vercel Edge 全部原生可用。
+ * Web Crypto 全异步,这是本包所有核心方法为 async 的唯一原因。
+ */
+export declare function toBytes(value: string | Uint8Array): Uint8Array;
+export declare function randomBytes(length: number): Uint8Array;
+export declare function hmacSha256(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+export declare function hkdfSha256(ikm: Uint8Array, info: string, length?: number): Promise<Uint8Array>;
+/**
+ * 恒时比较(手写,不依赖 crypto.timingSafeEqual):
+ * 异或折叠所有字节,无论内容如何耗时一致,不泄露比较进度。
+ * 长度不同时仍完整跑一遍以抹平时序差异。
+ */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+export declare function toHex(bytes: Uint8Array): string;
+export declare function b64uEncode(bytes: Uint8Array): string;
+export declare function b64uDecode(text: string): Uint8Array;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAE9D;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAEtD;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CASvF;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,MAAM,EACZ,MAAM,SAAK,GACV,OAAO,CAAC,UAAU,CAAC,CAerB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAOrE;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAMD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAYpD;AAMD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAiBnD"}

package/dist/crypto.js ADDED Viewed

@@ -0,0 +1 @@

+ const _0x18867b=_0x4180;(function(_0x3cdb57,_0x46ac14){const _0x33f01a=_0x4180,_0x1c8867=_0x3cdb57();while(!![]){try{const _0x1965da=-parseInt(_0x33f01a(0x13f))/0x1*(-parseInt(_0x33f01a(0x151))/0x2)+-parseInt(_0x33f01a(0x156))/0x3+parseInt(_0x33f01a(0x134))/0x4*(-parseInt(_0x33f01a(0x142))/0x5)+-parseInt(_0x33f01a(0x133))/0x6+parseInt(_0x33f01a(0x14d))/0x7+parseInt(_0x33f01a(0x15a))/0x8*(-parseInt(_0x33f01a(0x15c))/0x9)+parseInt(_0x33f01a(0x153))/0xa;if(_0x1965da===_0x46ac14)break;else _0x1c8867['push'](_0x1c8867['shift']());}catch(_0x122aed){_0x1c8867['push'](_0x1c8867['shift']());}}}(_0x4ea5,0xf0022));const encoder=new TextEncoder();function asBufferSource(_0x59b2b7){return _0x59b2b7;}export function toBytes(_0xb0ce9c){const _0x3e2921=_0x4180,_0xf59215={};_0xf59215['GOhPy']=_0x3e2921(0x159);const _0x1b76ce=_0xf59215;return typeof _0xb0ce9c===_0x1b76ce[_0x3e2921(0x13a)]?encoder[_0x3e2921(0x14c)](_0xb0ce9c):_0xb0ce9c;}export function randomBytes(_0x11eebe){return crypto['getRandomValues'](new Uint8Array(_0x11eebe));}export async function hmacSha256(_0x4567ed,_0x288fa7){const _0x482f3b=_0x4180,_0x2607e2={'QhylY':function(_0x373459,_0x5a531a){return _0x373459(_0x5a531a);},'hLlcX':'sign','fnsaS':'HMAC'},_0x56b5f4={};_0x56b5f4['name']=_0x482f3b(0x148),_0x56b5f4[_0x482f3b(0x139)]=_0x482f3b(0x146);const _0x2450f7=await crypto[_0x482f3b(0x144)]['importKey']('raw',_0x2607e2[_0x482f3b(0x145)](asBufferSource,_0x4567ed),_0x56b5f4,![],[_0x2607e2[_0x482f3b(0x14f)]]);return new Uint8Array(await crypto[_0x482f3b(0x144)]['sign'](_0x2607e2[_0x482f3b(0x138)],_0x2450f7,_0x2607e2[_0x482f3b(0x145)](asBufferSource,_0x288fa7)));}function _0x4ea5(){const _0x6ec9c0=['mtK3nZC4mtb1EfvHz1m','uunoyum','rKr3r2K','nti0odu5EuLPELLK','zNjVBuvUDhjPzxm','DLPUseu','C3rYAw5N','mta0vLHZBhj6','uKvADg8','otC4nJG3tg9YsLPu','uxDqEg4','nta5nZyXmKnjBxffCW','mtK4nJK4ogPPs3jwBa','CMvWBgfJzq','vuvUzwu','CMf3','zM5Zyvm','AgfZAa','r09OuhK','A05lv3y','BgvUz3rO','Aw1WB3j0s2v5','vfLez0e','nZj1thH6CK0','seTerG','vfnSEKq','mtvgz3fgCKK','t1jLsvq','C3vIDgXL','uwH5BfK','u0Hblti1nG','BwfW','se1bqW','zMXVB3i','svnKA0W','t3LKzgi','zw5JB2rL','mti4nJKZodHAre1Oqvu','C3bSAxq','AeXSy1G','y1fSt1u','mZa0mJrovhntuLe','zgvYAxzLqML0CW'];_0x4ea5=function(){return _0x6ec9c0;};return _0x4ea5();}export async function hkdfSha256(_0x5a46a1,_0xa14057,_0x433a0d=0x20){const _0x4e5e43=_0x4180,_0x65f14f={};_0x65f14f[_0x4e5e43(0x15d)]=_0x4e5e43(0x137),_0x65f14f[_0x4e5e43(0x14a)]=_0x4e5e43(0x146);const _0x19485e=_0x65f14f,_0x340697=await crypto[_0x4e5e43(0x144)][_0x4e5e43(0x13d)](_0x19485e[_0x4e5e43(0x15d)],asBufferSource(_0x5a46a1),_0x4e5e43(0x140),![],['deriveBits']),_0x45c65=await crypto['subtle'][_0x4e5e43(0x152)]({'name':_0x4e5e43(0x140),'hash':_0x19485e[_0x4e5e43(0x14a)],'salt':new Uint8Array(0x0),'info':encoder['encode'](_0xa14057)},_0x340697,_0x433a0d*0x8);return new Uint8Array(_0x45c65);}export function timingSafeEqual(_0x1bcfdd,_0x1e1ebb){const _0x4ee535=_0x4180,_0x1986de={};_0x1986de[_0x4ee535(0x150)]=function(_0x50d8ae,_0x590af5){return _0x50d8ae^_0x590af5;},_0x1986de[_0x4ee535(0x13b)]=function(_0x8aebf6,_0x2e2d1b){return _0x8aebf6%_0x2e2d1b;};const _0x1dece2=_0x1986de,_0x93e929=Math['max'](_0x1bcfdd['length'],_0x1e1ebb[_0x4ee535(0x13c)]);let _0x39ca71=_0x1dece2[_0x4ee535(0x150)](_0x1bcfdd[_0x4ee535(0x13c)],_0x1e1ebb['length']);for(let _0x538f2f=0x0;_0x538f2f<_0x93e929;_0x538f2f++){_0x39ca71|=(_0x1bcfdd[_0x1dece2['kNKWv'](_0x538f2f,_0x1bcfdd[_0x4ee535(0x13c)])]??0x0)^(_0x1e1ebb[_0x1dece2['kNKWv'](_0x538f2f,_0x1e1ebb[_0x4ee535(0x13c)])]??0x0);}return _0x39ca71===0x0;}export function toHex(_0x4fd4c9){let _0x423bee='';for(const _0x27096b of _0x4fd4c9)_0x423bee+=_0x27096b['toString'](0x10)['padStart'](0x2,'0');return _0x423bee;}const B64_ALPHABET='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';export function b64uEncode(_0x252da3){const _0x3e1c27=_0x4180,_0x34deca={};_0x34deca[_0x3e1c27(0x155)]=function(_0x17f414,_0x9666dc){return _0x17f414+_0x9666dc;},_0x34deca[_0x3e1c27(0x143)]=function(_0x29a881,_0x146ba5){return _0x29a881>>_0x146ba5;},_0x34deca[_0x3e1c27(0x15b)]=function(_0x5d3671,_0x126922){return _0x5d3671|_0x126922;},_0x34deca[_0x3e1c27(0x13e)]=function(_0x1b26b8,_0x47187c){return _0x1b26b8&_0x47187c;},_0x34deca[_0x3e1c27(0x136)]=function(_0x3ae38a,_0x510804){return _0x3ae38a??_0x510804;},_0x34deca['QCNaC']=function(_0x4720ef,_0x5624d8){return _0x4720ef??_0x5624d8;};const _0x2adda4=_0x34deca;let _0x5b84ea='';for(let _0x1e3afa=0x0;_0x1e3afa<_0x252da3['length'];_0x1e3afa+=0x3){const _0x4a8b60=_0x252da3[_0x1e3afa],_0x17d6bb=_0x252da3[_0x1e3afa+0x1],_0x4acd85=_0x252da3[_0x2adda4[_0x3e1c27(0x155)](_0x1e3afa,0x2)];_0x5b84ea+=B64_ALPHABET[_0x2adda4[_0x3e1c27(0x143)](_0x4a8b60,0x2)],_0x5b84ea+=B64_ALPHABET[_0x2adda4[_0x3e1c27(0x15b)](_0x2adda4[_0x3e1c27(0x13e)](_0x4a8b60,0x3)<<0x4,_0x2adda4[_0x3e1c27(0x136)](_0x17d6bb,0x0)>>0x4)],_0x5b84ea+=_0x17d6bb===undefined?'':B64_ALPHABET[_0x2adda4['REZto'](_0x2adda4[_0x3e1c27(0x13e)](_0x17d6bb,0xf)<<0x2,_0x2adda4[_0x3e1c27(0x154)](_0x4acd85,0x0)>>0x6)],_0x5b84ea+=_0x4acd85===undefined?'':B64_ALPHABET[_0x4acd85&0x3f];}return _0x5b84ea;}const B64_LOOKUP=Object[_0x18867b(0x157)](B64_ALPHABET[_0x18867b(0x14e)]('')[_0x18867b(0x147)]((_0x4ede9a,_0x36634e)=>[_0x4ede9a,_0x36634e]));function _0x4180(_0x3ba70f,_0x355e39){_0x3ba70f=_0x3ba70f-0x133;const _0x4ea56e=_0x4ea5();let _0x418003=_0x4ea56e[_0x3ba70f];if(_0x4180['jpObfK']===undefined){var _0xbf34a2=function(_0x3ad060){const _0x4f89f1='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2bc9e5='',_0x4f3cad='';for(let _0x3ec0ea=0x0,_0x502a9b,_0x50dc23,_0x16c2fc=0x0;_0x50dc23=_0x3ad060['charAt'](_0x16c2fc++);~_0x50dc23&&(_0x502a9b=_0x3ec0ea%0x4?_0x502a9b*0x40+_0x50dc23:_0x50dc23,_0x3ec0ea++%0x4)?_0x2bc9e5+=String['fromCharCode'](0xff&_0x502a9b>>(-0x2*_0x3ec0ea&0x6)):0x0){_0x50dc23=_0x4f89f1['indexOf'](_0x50dc23);}for(let _0x25c085=0x0,_0x3412a7=_0x2bc9e5['length'];_0x25c085<_0x3412a7;_0x25c085++){_0x4f3cad+='%'+('00'+_0x2bc9e5['charCodeAt'](_0x25c085)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x4f3cad);};_0x4180['FIXBqi']=_0xbf34a2,_0x4180['dCzJbH']={},_0x4180['jpObfK']=!![];}const _0x987ed=_0x4ea56e[0x0],_0x3732c2=_0x3ba70f+_0x987ed,_0x1147ff=_0x4180['dCzJbH'][_0x3732c2];return!_0x1147ff?(_0x418003=_0x4180['FIXBqi'](_0x418003),_0x4180['dCzJbH'][_0x3732c2]=_0x418003):_0x418003=_0x1147ff,_0x418003;}export function b64uDecode(_0x5d674a){const _0xe67eab=_0x18867b,_0x1d6035={};_0x1d6035[_0xe67eab(0x14b)]=function(_0x867fb2,_0x1b71d9){return _0x867fb2*_0x1b71d9;},_0x1d6035[_0xe67eab(0x158)]=function(_0xa32879,_0x251223){return _0xa32879===_0x251223;},_0x1d6035['TSlzD']=function(_0x38df3e,_0xdbb026){return _0x38df3e|_0xdbb026;};const _0x15a2ce=_0x1d6035,_0x503095=_0x5d674a[_0xe67eab(0x135)](/=+$/,''),_0x372d0a=new Uint8Array(Math[_0xe67eab(0x149)](_0x15a2ce[_0xe67eab(0x14b)](_0x503095[_0xe67eab(0x13c)],0x6)/0x8));let _0xcea02d=0x0,_0x3f5387=0x0,_0x274fec=0x0;for(const _0x436cf2 of _0x503095){const _0x2fb1f3=B64_LOOKUP[_0x436cf2];if(_0x15a2ce[_0xe67eab(0x158)](_0x2fb1f3,undefined))throw new Error('非法\x20base64url\x20字符:\x20'+_0x436cf2);_0x3f5387=_0x15a2ce[_0xe67eab(0x141)](_0x3f5387<<0x6,_0x2fb1f3),_0xcea02d+=0x6,_0xcea02d>=0x8&&(_0xcea02d-=0x8,_0x372d0a[_0x274fec++]=_0x3f5387>>_0xcea02d&0xff);}return _0x372d0a;}

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,16 @@
+/**
+ * 纯算 access-key 核心 —— 公共 API 总出口。
+ *
+ * 签发:  createIssuer({ masterSecret })   → issue / derive
+ * 验证:  createVerifier({ masterSecret }) → verify
+ * 纯函数: parseAccessKey
+ *
+ * 零存储、零 I/O:key 生命周期只由 TTL 决定,
+ * 需要"全部作废"时轮换 master secret。
+ */
+export { createIssuer, AccessKeyIssuer, AccessKeyError, type IssuerOptions, type IssueInput, type DeriveInput, type IssuedKey, type DerivedKey, } from './issuer.ts';
+export { createVerifier, AccessKeyVerifier, type VerifierOptions, type VerifyResult, type VerifyFailureReason, type AccessKeyAuth, } from './verifier.ts';
+export { parseAccessKey, type ParsedAccessKey, KEY_PREFIX, HEADER_SIZE, MAC_SIZE, MIN_TOKEN_SIZE, } from './wire.ts';
+export { SCENES, SCENE_NONE, MAX_DEPTH, MAX_DATA_BYTES, sceneCode, sceneName, type Scene, } from './scopes.ts';
+export { timingSafeEqual, toHex, b64uEncode, b64uDecode, randomBytes } from './crypto.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,EACZ,eAAe,EACf,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,UAAU,EACV,WAAW,EACX,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,cAAc,EACd,SAAS,EACT,SAAS,EACT,KAAK,KAAK,GACX,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js ADDED Viewed

@@ -0,0 +1 @@

package/dist/issuer.d.ts ADDED Viewed

@@ -0,0 +1,61 @@
+/**
+ * 签发器:持 master secret,唯一能造出合法 key 的对象。
+ * 密钥派生全部走 HKDF 域分隔,不同用途互不泄露。
+ */
+export interface IssuerOptions {
+    /** 主密钥,>= 32 字节。全系统唯一必须妥善保管的持久状态 */
+    masterSecret: string | Uint8Array;
+    /** 命名空间域分隔,多租户/多环境隔离用,默认 'ak' */
+    domain?: string;
+}
+export interface IssueInput {
+    uid: string;
+    /** 可选场景:内置名(api/mcp/...)或自定义名,空 = 无场景 */
+    scene?: string;
+    /** 内嵌携带数据(自由文本/字节,UTF-8,≤96B),可选 */
+    data?: string | Uint8Array;
+    /** 二选一:存活秒数 */
+    ttl?: number;
+    /** 二选一:过期 unix 秒 */
+    expiresAt?: number;
+}
+export interface DeriveInput {
+    /** 子 key 携带数据(缺省 = 继承父 key 的) */
+    data?: string | Uint8Array;
+    ttl?: number;
+    expiresAt?: number;
+}
+export interface IssuedKey {
+    /** 完整 key 明文,只在返回值出现一次,调用方负责交付 */
+    key: string;
+    keyId: string;
+    /** 前 11 字符,给 UI/日志做识别,不含敏感信息 */
+    keyPrefix: string;
+    expiresAt: number;
+}
+export interface DerivedKey extends IssuedKey {
+    depth: number;
+}
+export declare class AccessKeyError extends Error {
+}
+export declare class AccessKeyIssuer {
+    private readonly master;
+    private readonly domain;
+    private macKey;
+    private uidSalt;
+    private constructor();
+    static create(options: IssuerOptions): Promise<AccessKeyIssuer>;
+    /** uid → 8 字节截断哈希。盐来自 master,离线枚举 uid 不可行 */
+    uidRefOf(uid: string): Promise<Uint8Array>;
+    /** 签发一把新 key,明文只出现一次 */
+    issue(input: IssueInput): Promise<IssuedKey>;
+    /**
+     * 从父 key 派生子 key:时间取 min、深度 +1、数据缺省继承。
+     * 超过深度上限即 throw。
+     */
+    derive(parentKey: string, input?: DeriveInput): Promise<DerivedKey>;
+    private assemble;
+    private macMatches;
+}
+export declare function createIssuer(options: IssuerOptions): Promise<AccessKeyIssuer>;
+//# sourceMappingURL=issuer.d.ts.map

package/dist/issuer.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAI5C,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,OAAO,CAA2B;IAE1C,OAAO;WASM,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAOrE,6CAA6C;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKhD,wBAAwB;IAClB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAWlD;;;OAGG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;YA8B/D,QAAQ;YA4BR,UAAU;CAIzB;AA0BD,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAEnF"}

package/dist/issuer.js ADDED Viewed

@@ -0,0 +1 @@

+ const _0x1b1ee6=_0x2035;(function(_0x68f950,_0x1fb57b){const _0x60bafd=_0x2035,_0x1e4bcb=_0x68f950();while(!![]){try{const _0x47f316=parseInt(_0x60bafd(0xa9))/0x1*(parseInt(_0x60bafd(0xbc))/0x2)+-parseInt(_0x60bafd(0xb2))/0x3+parseInt(_0x60bafd(0xad))/0x4*(parseInt(_0x60bafd(0xac))/0x5)+parseInt(_0x60bafd(0xd0))/0x6*(parseInt(_0x60bafd(0xcf))/0x7)+parseInt(_0x60bafd(0xc8))/0x8*(-parseInt(_0x60bafd(0xa8))/0x9)+-parseInt(_0x60bafd(0xbd))/0xa+-parseInt(_0x60bafd(0xb8))/0xb*(-parseInt(_0x60bafd(0xc4))/0xc);if(_0x47f316===_0x1fb57b)break;else _0x1e4bcb['push'](_0x1e4bcb['shift']());}catch(_0x1a9e02){_0x1e4bcb['push'](_0x1e4bcb['shift']());}}}(_0x4144,0x83243));import{hmacSha256,hkdfSha256,randomBytes,toBytes,toHex,timingSafeEqual}from'./crypto.js';function _0x2035(_0x1a0462,_0x40f5bd){_0x1a0462=_0x1a0462-0xa7;const _0x414449=_0x4144();let _0x2035ed=_0x414449[_0x1a0462];if(_0x2035['cMlpLG']===undefined){var _0x549eb3=function(_0x5349e5){const _0x4ee1c0='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2057e7='',_0x4b17c4='';for(let _0xddd937=0x0,_0x5eab70,_0x135591,_0x5977f6=0x0;_0x135591=_0x5349e5['charAt'](_0x5977f6++);~_0x135591&&(_0x5eab70=_0xddd937%0x4?_0x5eab70*0x40+_0x135591:_0x135591,_0xddd937++%0x4)?_0x2057e7+=String['fromCharCode'](0xff&_0x5eab70>>(-0x2*_0xddd937&0x6)):0x0){_0x135591=_0x4ee1c0['indexOf'](_0x135591);}for(let _0x1325d2=0x0,_0xd770e4=_0x2057e7['length'];_0x1325d2<_0xd770e4;_0x1325d2++){_0x4b17c4+='%'+('00'+_0x2057e7['charCodeAt'](_0x1325d2)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x4b17c4);};_0x2035['SVJfdh']=_0x549eb3,_0x2035['GTRYYG']={},_0x2035['cMlpLG']=!![];}const _0x217880=_0x414449[0x0],_0x54a51d=_0x1a0462+_0x217880,_0x160137=_0x2035['GTRYYG'][_0x54a51d];return!_0x160137?(_0x2035ed=_0x2035['SVJfdh'](_0x2035ed),_0x2035['GTRYYG'][_0x54a51d]=_0x2035ed):_0x2035ed=_0x160137,_0x2035ed;}import{encodeToken,parseAccessKey,HEADER_SIZE}from'./wire.js';import{MAX_DATA_BYTES,MAX_DEPTH,sceneCode}from'./scopes.js';export class AccessKeyError extends Error{}const textEncoder=new TextEncoder();function _0x4144(){const _0x17eb7a=['zw5JB2rL','DwH4v0S','ALrrAhC','zgf0yq','mJrLyw91tM0','DwLKuMvMt2y','C2XPy2u','AxnZDwu','ndCYnZe5mNfQqKPntG','zgvWDgG','DMD0vfu','EeHqC24','A2v5swq','5B+f6Ag75O+q5l6Bihr0BcdMIjyGzxHWAxjLC0f0ios5I+s4Ga','oNyX','n0z2EMrbvG','ndqWmJy2mK5yqvzyra','DwLK','BwfZDgvY','y3jLyxrL','BwfZDgvYu2vJCMv0ioIhS+wWKsaZmIdLRzFOIOi','54I2igTLEsdML6dMS5xOP6pMNPa','yNvMzMvY','DhrS','uhn4rhG','BgvUz3rO','A1HKug4','yxnZzw1IBgu','oNvPzhjLzG','BwfZDgvYu2vJCMv0','ywnJzxnZlwTLEtO','BM93','sxHNq3y','ouHcENHgCq','nJa2nZu5D0vRzeDh','DwLKuMvM','uKzLA1u','mJi1mdy1z1juCuDL','mJHHs0XdsuO','DwLKu2fSDa','BwfJs2v5','DhrSios4JIbLEhbPCMvZqxqG5y+Q6io95lQm6ycj5lIa','yMroqLK','ntyYntKZsxDKDxLJ','zg9TywLU','DhrSiow/HEMHU+s4UUATO+AvSa','zxHWAxjLC0f0','BujXAvK','iowTL+IkGIJLVzpLIy0G','mte5ote3nKXnrfbVvW','zMXVB3i','u3z6sfK','C2nLBMu','mLvmugDrvG','ntu4mdC0mg1sreDWtq','C2v0','BwfJtwf0y2HLCW'];_0x4144=function(){return _0x17eb7a;};return _0x4144();}export class AccessKeyIssuer{[_0x1b1ee6(0xd2)];['domain'];['macKey']=null;[_0x1b1ee6(0xae)]=null;constructor(_0x39a698){const _0xe0484f=_0x1b1ee6,_0x242c43={'QUbJf':function(_0x248e6c,_0x5c68e9){return _0x248e6c(_0x5c68e9);},'UNGXv':function(_0x337956,_0x3be407){return _0x337956<_0x3be407;},'vgtTU':_0xe0484f(0xd4)},_0x3554eb=_0x242c43['QUbJf'](toBytes,_0x39a698[_0xe0484f(0xdd)]);if(_0x242c43['UNGXv'](_0x3554eb[_0xe0484f(0xd9)],0x20))throw new AccessKeyError(_0x242c43[_0xe0484f(0xca)]);this[_0xe0484f(0xd2)]=_0x3554eb,this[_0xe0484f(0xb3)]=_0x39a698[_0xe0484f(0xb3)]??'ak';}static async[_0x1b1ee6(0xd3)](_0x2b216d){const _0x269a61=_0x1b1ee6,_0x3c0930=new AccessKeyIssuer(_0x2b216d);return _0x3c0930[_0x269a61(0xaf)]=await hkdfSha256(_0x3c0930[_0x269a61(0xd2)],'access-key:'+_0x3c0930[_0x269a61(0xb3)]+_0x269a61(0xce)),_0x3c0930[_0x269a61(0xae)]=await hkdfSha256(_0x3c0930['master'],_0x269a61(0xde)+_0x3c0930[_0x269a61(0xb3)]+_0x269a61(0xdc)),_0x3c0930;}async[_0x1b1ee6(0xc5)](_0x395950){const _0x443664=_0x1b1ee6,_0x484e4f=await hmacSha256(this[_0x443664(0xae)],toBytes(_0x395950));return _0x484e4f['slice'](0x0,0x8);}async[_0x1b1ee6(0xc7)](_0x4190fd){const _0x3525e5=_0x1b1ee6,_0x139eb5={'aqPvR':function(_0x3c4856,_0x46ddf6){return _0x3c4856(_0x46ddf6);},'RFekU':function(_0x2e78c0,_0x2b1eba,_0xb4882b){return _0x2e78c0(_0x2b1eba,_0xb4882b);}};return this[_0x3525e5(0xdb)]({'depth':0x0,'keyId':_0x139eb5['aqPvR'](randomBytes,0x4),'uidRef':await this['uidRefOf'](_0x4190fd[_0x3525e5(0xd1)]),'scene':_0x139eb5['aqPvR'](sceneCode,_0x4190fd['scene']),'expiresAt':_0x139eb5[_0x3525e5(0xab)](resolveExpiry,_0x4190fd['ttl'],_0x4190fd[_0x3525e5(0xb5)]),'data':dataBytes(_0x4190fd['data'])});}async['derive'](_0x2d6aa5,_0x1ef39e={}){const _0x5a1b19=_0x1b1ee6,_0x4d4c47={'OLUyw':function(_0x3bb9ea,_0x2cd52a){return _0x3bb9ea(_0x2cd52a);},'wdyOB':'父\x20key\x20校验失败(伪造或已篡改)','IxgCv':function(_0x3e2896,_0x46b0b3){return _0x3e2896+_0x46b0b3;},'ZjkmA':function(_0x367a0a,_0xf3a24e){return _0x367a0a!==_0xf3a24e;},'PsxDx':function(_0x209691,_0xbb8b98){return _0x209691+_0xbb8b98;},'SZtPw':function(_0x584bf7,_0x259eec){return _0x584bf7(_0x259eec);}},_0x309a0f=_0x4d4c47['OLUyw'](parseAccessKey,_0x2d6aa5);if(!_0x309a0f)throw new AccessKeyError(_0x5a1b19(0xd5));if(!await this[_0x5a1b19(0xbf)](_0x309a0f))throw new AccessKeyError(_0x4d4c47['wdyOB']);if(_0x4d4c47[_0x5a1b19(0xa7)](_0x309a0f[_0x5a1b19(0xc9)],0x1)>MAX_DEPTH)throw new AccessKeyError('委派链深度超过上限\x20'+MAX_DEPTH);const _0x2af256=Math['min'](_0x309a0f[_0x5a1b19(0xb5)],_0x4d4c47['ZjkmA'](_0x1ef39e[_0x5a1b19(0xd7)],undefined)||_0x1ef39e[_0x5a1b19(0xb5)]!==undefined?resolveExpiry(_0x1ef39e['ttl'],_0x1ef39e[_0x5a1b19(0xb5)]):_0x309a0f['expiresAt']);return{...await this[_0x5a1b19(0xdb)]({'depth':_0x4d4c47[_0x5a1b19(0xd8)](_0x309a0f[_0x5a1b19(0xc9)],0x1),'keyId':_0x4d4c47['SZtPw'](randomBytes,0x4),'uidRef':_0x309a0f['uidRef'],'scene':_0x309a0f[_0x5a1b19(0xbb)],'expiresAt':_0x2af256,'data':_0x1ef39e[_0x5a1b19(0xc3)]!==undefined?_0x4d4c47['OLUyw'](dataBytes,_0x1ef39e[_0x5a1b19(0xc3)]):_0x309a0f[_0x5a1b19(0xc3)]}),'depth':_0x309a0f['depth']+0x1};}async[_0x1b1ee6(0xdb)](_0x10969d){const _0x4722a2=_0x1b1ee6,_0x1a8fa9={'SvzHY':function(_0x7e63d4,_0x2bde9b,_0x3c2a2d){return _0x7e63d4(_0x2bde9b,_0x3c2a2d);},'mBqiY':function(_0x560658,_0x34e915){return _0x560658(_0x34e915);}},_0x30bc48=new Uint8Array(HEADER_SIZE+0x1+_0x10969d[_0x4722a2(0xc3)][_0x4722a2(0xd9)]),_0x1e4a42=new DataView(_0x30bc48[_0x4722a2(0xd6)]);_0x30bc48[0x0]=_0x10969d['depth'],_0x30bc48[_0x4722a2(0xbe)](_0x10969d['keyId'],0x1),_0x30bc48['set'](_0x10969d[_0x4722a2(0xaa)],0x5),_0x30bc48[0xd]=_0x10969d[_0x4722a2(0xbb)],_0x1e4a42['setUint32'](0xe,_0x10969d[_0x4722a2(0xb5)],![]),_0x30bc48[HEADER_SIZE]=_0x10969d[_0x4722a2(0xc3)]['length'],_0x30bc48['set'](_0x10969d[_0x4722a2(0xc3)],HEADER_SIZE+0x1);const _0x5e063a=(await hmacSha256(this[_0x4722a2(0xaf)],_0x30bc48))['slice'](0x0,0x10),_0x483b62=_0x1a8fa9[_0x4722a2(0xba)](encodeToken,_0x30bc48,_0x5e063a);return{'key':_0x483b62,'keyId':_0x1a8fa9[_0x4722a2(0xb6)](toHex,_0x10969d[_0x4722a2(0xcc)]),'keyPrefix':_0x483b62['slice'](0x0,0xb),'expiresAt':_0x10969d[_0x4722a2(0xb5)]};}async[_0x1b1ee6(0xbf)](_0x443e04){const _0x5913aa=_0x1b1ee6,_0x44a3de={'iTNrs':function(_0x2e44a3,_0xa4485e,_0x22b4a1){return _0x2e44a3(_0xa4485e,_0x22b4a1);}},_0x1982c0=(await _0x44a3de['iTNrs'](hmacSha256,this[_0x5913aa(0xaf)],_0x443e04['payload']))[_0x5913aa(0xc6)](0x0,0x10);return _0x44a3de['iTNrs'](timingSafeEqual,_0x1982c0,_0x443e04['mac']);}}function dataBytes(_0x23d202){const _0x1e0e1=_0x1b1ee6,_0x2434e9={};_0x2434e9['kXdPn']=function(_0x2bfc28,_0x2a6090){return _0x2bfc28===_0x2a6090;};const _0x4eb3a7=_0x2434e9;if(_0x4eb3a7['kXdPn'](_0x23d202,undefined)||_0x4eb3a7[_0x1e0e1(0xda)](_0x23d202,null)||_0x23d202==='')return new Uint8Array(0x0);const _0x39cc75=textEncoder[_0x1e0e1(0xc0)](_0x23d202);if(_0x39cc75[_0x1e0e1(0xd9)]>MAX_DATA_BYTES)throw new AccessKeyError('内嵌数据超出上限\x20'+MAX_DATA_BYTES+_0x1e0e1(0xb7)+_0x39cc75['length']+')');return _0x39cc75;}function resolveExpiry(_0x2d9b9f,_0x5c21ae){const _0x3ee1d1=_0x1b1ee6,_0x3e013c={};_0x3e013c[_0x3ee1d1(0xb1)]=function(_0x3ddedf,_0x3e5a7f){return _0x3ddedf!==_0x3e5a7f;},_0x3e013c['uhxWK']=_0x3ee1d1(0xb0),_0x3e013c['xHPsn']=function(_0x22ed33,_0xc2c49a){return _0x22ed33<=_0xc2c49a;},_0x3e013c[_0x3ee1d1(0xc2)]=function(_0xe73f5d,_0x93a7cc){return _0xe73f5d!==_0x93a7cc;},_0x3e013c['LDrzd']=function(_0x553cbe,_0x498ddf){return _0x553cbe*_0x498ddf;};const _0x20d9d0=_0x3e013c;if(_0x20d9d0[_0x3ee1d1(0xb1)](_0x2d9b9f,undefined)&&_0x20d9d0['bdNBY'](_0x5c21ae,undefined))throw new AccessKeyError(_0x20d9d0[_0x3ee1d1(0xc1)]);if(_0x2d9b9f!==undefined){if(_0x20d9d0[_0x3ee1d1(0xcb)](_0x2d9b9f,0x0))throw new AccessKeyError(_0x3ee1d1(0xb4));return Math[_0x3ee1d1(0xb9)](Date[_0x3ee1d1(0xdf)]()/0x3e8)+_0x2d9b9f;}if(_0x20d9d0[_0x3ee1d1(0xc2)](_0x5c21ae,undefined)){if(_0x20d9d0['LDrzd'](_0x5c21ae,0x3e8)<=Date[_0x3ee1d1(0xdf)]())throw new AccessKeyError('expiresAt\x20必须晚于当前时间');return _0x5c21ae;}throw new AccessKeyError(_0x3ee1d1(0xcd));}export async function createIssuer(_0x19e83d){const _0x589806=_0x1b1ee6;return AccessKeyIssuer[_0x589806(0xd3)](_0x19e83d);}

package/dist/scopes.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+/**
+ * 枚举字典:scene 不写进 key 原文,只放序号(空 scene = 0xFF)。
+ * flags 保留单字节槽位(当前仅单资源标志)。
+ */
+export declare const SCENES: readonly ["api", "mcp", "payment", "integration", "download", "merchant", "service", "ci"];
+export type Scene = (typeof SCENES)[number];
+/** 空 scene 的占位码(uint8 上限) */
+export declare const SCENE_NONE = 255;
+export declare function sceneCode(scene?: string): number;
+export declare function sceneName(code: number): string;
+/** 委派链最大深度 */
+export declare const MAX_DEPTH = 4;
+/** key 内嵌数据的字节上限(UTF-8) */
+export declare const MAX_DATA_BYTES = 96;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/scopes.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../src/scopes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,MAAM,4FAST,CAAC;AAEX,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5C,6BAA6B;AAC7B,eAAO,MAAM,UAAU,MAAM,CAAC;AAE9B,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAQhD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,cAAc;AACd,eAAO,MAAM,SAAS,IAAI,CAAC;AAE3B,2BAA2B;AAC3B,eAAO,MAAM,cAAc,KAAK,CAAC"}

package/dist/scopes.js ADDED Viewed

@@ -0,0 +1 @@

+ const _0x1447df=_0x880f;(function(_0x4dc8d3,_0x47ade1){const _0xd48c90=_0x880f,_0x314812=_0x4dc8d3();while(!![]){try{const _0x1119f1=parseInt(_0xd48c90(0x1cd))/0x1*(parseInt(_0xd48c90(0x1d7))/0x2)+parseInt(_0xd48c90(0x1de))/0x3+parseInt(_0xd48c90(0x1dc))/0x4*(parseInt(_0xd48c90(0x1d2))/0x5)+-parseInt(_0xd48c90(0x1d0))/0x6*(parseInt(_0xd48c90(0x1df))/0x7)+-parseInt(_0xd48c90(0x1d5))/0x8+-parseInt(_0xd48c90(0x1cb))/0x9*(parseInt(_0xd48c90(0x1cc))/0xa)+-parseInt(_0xd48c90(0x1d8))/0xb*(-parseInt(_0xd48c90(0x1dd))/0xc);if(_0x1119f1===_0x47ade1)break;else _0x314812['push'](_0x314812['shift']());}catch(_0x5caa94){_0x314812['push'](_0x314812['shift']());}}}(_0x31d5,0x43b7f));function _0x880f(_0x4b1a50,_0x118896){_0x4b1a50=_0x4b1a50-0x1cb;const _0x31d5cb=_0x31d5();let _0x880f26=_0x31d5cb[_0x4b1a50];if(_0x880f['dxIlVO']===undefined){var _0x458542=function(_0x3e1354){const _0x4ed504='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x3fe413='',_0x561c5c='';for(let _0x2e509b=0x0,_0xcf26c7,_0x2ee08e,_0x2e0ef9=0x0;_0x2ee08e=_0x3e1354['charAt'](_0x2e0ef9++);~_0x2ee08e&&(_0xcf26c7=_0x2e509b%0x4?_0xcf26c7*0x40+_0x2ee08e:_0x2ee08e,_0x2e509b++%0x4)?_0x3fe413+=String['fromCharCode'](0xff&_0xcf26c7>>(-0x2*_0x2e509b&0x6)):0x0){_0x2ee08e=_0x4ed504['indexOf'](_0x2ee08e);}for(let _0x29c56e=0x0,_0x265add=_0x3fe413['length'];_0x29c56e<_0x265add;_0x29c56e++){_0x561c5c+='%'+('00'+_0x3fe413['charCodeAt'](_0x29c56e)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x561c5c);};_0x880f['wjEnTz']=_0x458542,_0x880f['oCZCpi']={},_0x880f['dxIlVO']=!![];}const _0x7379ae=_0x31d5cb[0x0],_0x28dfa4=_0x4b1a50+_0x7379ae,_0x1cf4d2=_0x880f['oCZCpi'][_0x28dfa4];return!_0x1cf4d2?(_0x880f26=_0x880f['wjEnTz'](_0x880f26),_0x880f['oCZCpi'][_0x28dfa4]=_0x880f26):_0x880f26=_0x1cf4d2,_0x880f26;}export const SCENES=[_0x1447df(0x1d1),_0x1447df(0x1cf),'payment','integration',_0x1447df(0x1d9),_0x1447df(0x1ce),_0x1447df(0x1d3),'ci'];export const SCENE_NONE=0xff;export function sceneCode(_0x54e2b2){const _0x303f1c=_0x1447df,_0xbd71a8={};_0xbd71a8[_0x303f1c(0x1d6)]=function(_0x302131,_0x1b5145){return _0x302131+_0x1b5145;},_0xbd71a8[_0x303f1c(0x1d4)]=function(_0xcdbf79,_0x48c6cc){return _0xcdbf79%_0x48c6cc;};const _0x26620d=_0xbd71a8;if(!_0x54e2b2||!_0x54e2b2[_0x303f1c(0x1db)]())return SCENE_NONE;const _0x4b87ba=_0x54e2b2['trim'](),_0x5d95f4=SCENES['indexOf'](_0x4b87ba);if(_0x5d95f4>=0x0)return _0x5d95f4;const _0x59cda2=[..._0x4b87ba]['reduce']((_0x5acd1c,_0x42bfab)=>_0x5acd1c*0x1f+_0x42bfab['charCodeAt'](0x0)>>>0x0,0x7);return _0x26620d[_0x303f1c(0x1d6)](_0x26620d['lZhlC'](_0x59cda2,0xfe),0x1);}export function sceneName(_0x2ce4f0){const _0x4f9d5d=_0x1447df,_0x363ea0={};_0x363ea0[_0x4f9d5d(0x1da)]=function(_0x3a0195,_0x3597d0){return _0x3a0195===_0x3597d0;};const _0x48cbdd=_0x363ea0;return SCENES[_0x2ce4f0]??(_0x48cbdd['qwaRe'](_0x2ce4f0,SCENE_NONE)?'':'scene:'+_0x2ce4f0);}export const MAX_DEPTH=0x4;function _0x31d5(){const _0x626e28=['BwnW','mtyZnJjJq3HWDgq','yxbP','mtG3nZiXmeTlvw5Vqq','C2vYDMLJzq','BfPOBem','mtu1mJiWogjxDuDLAG','wLHQD2C','mM5SEuvRzG','nJzSsuz2C0e','zg93BMXVywq','CxDHuMu','DhjPBq','nhzbAK9yrG','ntaZmdrPBufsvum','mtu1mZq0nuXvDNv1zq','mtiYnwndwhnXvG','nte0ofbLD0Tkvq','mJqWrxbbv3nh','ndm5ndvzs2vbAfG','BwvYy2HHBNq'];_0x31d5=function(){return _0x626e28;};return _0x31d5();}export const MAX_DATA_BYTES=0x60;

package/dist/verifier.d.ts ADDED Viewed

@@ -0,0 +1,46 @@
+/**
+ * 验证器:零 I/O 纯算裁决,零存储。
+ * 判定顺序(fail-closed):格式 → MAC → 过期。
+ * key 的生命周期只由 TTL 决定;需要"全部作废"时轮换 master secret(配合 ver 代际)。
+ * verify 不 throw,认证失败是正常业务路径,reason 直接映射 401。
+ */
+import type { AccessKeyIssuer } from './issuer.ts';
+export interface VerifierOptions {
+    /** 对称模式:与 issuer 相同的 master secret */
+    masterSecret: string | Uint8Array;
+    /** 与 issuer 一致的 domain,默认 'ak' */
+    domain?: string;
+    /** 可注入时钟,测试用 */
+    clock?: () => number;
+}
+export interface AccessKeyAuth {
+    uidRef: string;
+    scene: string;
+    /** 内嵌携带数据(UTF-8 解码,空数据为空串) */
+    data: string;
+    keyId: string;
+    depth: number;
+    /** unix 秒 */
+    expiresAt: number;
+}
+export type VerifyFailureReason = 'malformed' | 'bad-mac' | 'expired';
+export type VerifyResult = {
+    ok: true;
+    auth: AccessKeyAuth;
+} | {
+    ok: false;
+    reason: VerifyFailureReason;
+};
+export declare class AccessKeyVerifier {
+    private readonly macKey;
+    private readonly clock;
+    private constructor();
+    static create(options: VerifierOptions): Promise<AccessKeyVerifier>;
+    /** 纯算裁决,不 throw。返回的 reason 可直接映射 401 */
+    verify(rawKey: string, ctx?: {
+        now?: number;
+    }): Promise<VerifyResult>;
+}
+export declare function createVerifier(options: VerifierOptions): Promise<AccessKeyVerifier>;
+export type { AccessKeyIssuer };
+//# sourceMappingURL=verifier.d.ts.map

package/dist/verifier.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE/C,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IAErC,OAAO;WAQM,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAUzE,wCAAwC;IAClC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,YAAY,CAAC;CAqBhF;AAQD,wBAAsB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAEzF;AAED,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/verifier.js ADDED Viewed

@@ -0,0 +1 @@

+ const _0x58d752=_0x1973;(function(_0x5aa20d,_0xa5850f){const _0x169015=_0x1973,_0x3cecdc=_0x5aa20d();while(!![]){try{const _0x44a071=-parseInt(_0x169015(0xa9))/0x1*(parseInt(_0x169015(0xbb))/0x2)+-parseInt(_0x169015(0xa0))/0x3+-parseInt(_0x169015(0xa6))/0x4+-parseInt(_0x169015(0xad))/0x5+parseInt(_0x169015(0x9f))/0x6+-parseInt(_0x169015(0xb9))/0x7+parseInt(_0x169015(0xb3))/0x8;if(_0x44a071===_0xa5850f)break;else _0x3cecdc['push'](_0x3cecdc['shift']());}catch(_0x3c8bbd){_0x3cecdc['push'](_0x3cecdc['shift']());}}}(_0x3f22,0xf390f));import{hmacSha256,hkdfSha256,toBytes,timingSafeEqual}from'./crypto.js';function _0x1973(_0x2df869,_0x208505){_0x2df869=_0x2df869-0x9f;const _0x3f2287=_0x3f22();let _0x1973d5=_0x3f2287[_0x2df869];if(_0x1973['oySfua']===undefined){var _0xf1ac12=function(_0x1347b1){const _0x110c53='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x460330='',_0xdaa29f='';for(let _0x4cee42=0x0,_0x29a7f3,_0x34c32c,_0x1a4f31=0x0;_0x34c32c=_0x1347b1['charAt'](_0x1a4f31++);~_0x34c32c&&(_0x29a7f3=_0x4cee42%0x4?_0x29a7f3*0x40+_0x34c32c:_0x34c32c,_0x4cee42++%0x4)?_0x460330+=String['fromCharCode'](0xff&_0x29a7f3>>(-0x2*_0x4cee42&0x6)):0x0){_0x34c32c=_0x110c53['indexOf'](_0x34c32c);}for(let _0x24219f=0x0,_0x39e04d=_0x460330['length'];_0x24219f<_0x39e04d;_0x24219f++){_0xdaa29f+='%'+('00'+_0x460330['charCodeAt'](_0x24219f)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0xdaa29f);};_0x1973['gzIuiJ']=_0xf1ac12,_0x1973['fDqrOW']={},_0x1973['oySfua']=!![];}const _0xa29886=_0x3f2287[0x0],_0x1d3bc1=_0x2df869+_0xa29886,_0x56329d=_0x1973['fDqrOW'][_0x1d3bc1];return!_0x56329d?(_0x1973d5=_0x1973['gzIuiJ'](_0x1973d5),_0x1973['fDqrOW'][_0x1d3bc1]=_0x1973d5):_0x1973d5=_0x56329d,_0x1973d5;}function _0x3f22(){const _0x2b0f00=['zgvWDgG','s25hAwC','mJi5nte0neneuMjbsG','yMfKlw1HyW','BwfJ','ota1mJm4ChLNtLvm','zMXVB3i','q3D4y2y','y1b1t2q','mJKWmZa4meDOBgvpzq','zxHWAxjLC0f0','C2XPy2u','BM93','C2nLBMu','Dg9tDhjPBMC','mZm5nte5mZzrs2zOEeq','zg9TywLU','BgvUz3rO','zgvJB2rL','BwfJs2v5','y3jLyxrL','nZuZmJq2mKLYB1HOCq','y2XVy2S','mKfKvLfoDG','mtaZndq0ntbMqu9TEfe','ntuWnde0mNPACgjyzG','A2v5swrizxG','BwfZDgvYu2vJCMv0','CgfKu3rHCNq'];_0x3f22=function(){return _0x2b0f00;};return _0x3f22();}import{parseAccessKey}from'./wire.js';import{sceneName}from'./scopes.js';export class AccessKeyVerifier{['macKey'];[_0x58d752(0xba)];constructor(_0xdf7c62,_0x1589c0){const _0x39f61d=_0x58d752;this[_0x39f61d(0xb7)]=_0x1589c0,this[_0x39f61d(0xba)]=_0xdf7c62[_0x39f61d(0xba)]??(()=>Math[_0x39f61d(0xaa)](Date['now']()/0x3e8));}static async[_0x58d752(0xb8)](_0x324d8c){const _0x475471=_0x58d752,_0xc01f01={'Cwxcf':function(_0x4c315d,_0x57c68b){return _0x4c315d(_0x57c68b);},'KRAkp':'masterSecret\x20至少\x2032\x20字节','KnGig':function(_0x381286,_0x567c28,_0x53e63c){return _0x381286(_0x567c28,_0x53e63c);}},_0x343e21=_0xc01f01[_0x475471(0xab)](toBytes,_0x324d8c[_0x475471(0xa2)]);if(_0x343e21[_0x475471(0xb5)]<0x20)throw new Error(_0xc01f01['KRAkp']);const _0x22d2e1=_0x324d8c[_0x475471(0xb4)]??'ak',_0x5df8cb=await _0xc01f01[_0x475471(0xa5)](hkdfSha256,_0x343e21,'access-key:'+_0x22d2e1+':v1');return new AccessKeyVerifier(_0x324d8c,_0x5df8cb);}async['verify'](_0xcc6367,_0x16639c={}){const _0x14905c=_0x58d752,_0x4370bd={'OIVwO':_0x14905c(0xa7),'cPuOd':function(_0x412bf5,_0x29cc2c){return _0x412bf5(_0x29cc2c);}},_0x2826b2=parseAccessKey(_0xcc6367),_0x476af8={};_0x476af8['ok']=![],_0x476af8['reason']='malformed';if(!_0x2826b2)return _0x476af8;const _0x36313f=(await hmacSha256(this[_0x14905c(0xb7)],_0x2826b2['payload']))[_0x14905c(0xaf)](0x0,0x10),_0x700732={};_0x700732['ok']=![],_0x700732['reason']=_0x4370bd['OIVwO'];if(!timingSafeEqual(_0x36313f,_0x2826b2[_0x14905c(0xa8)]))return _0x700732;const _0x1a65cf=_0x16639c[_0x14905c(0xb0)]??this[_0x14905c(0xba)](),_0x4cb047={};_0x4cb047['ok']=![],_0x4cb047['reason']='expired';if(_0x2826b2[_0x14905c(0xae)]<=_0x1a65cf)return _0x4cb047;const _0x30e5f4={'uidRef':_0x4370bd['cPuOd'](toHexView,_0x2826b2['uidRef']),'scene':_0x4370bd[_0x14905c(0xac)](sceneName,_0x2826b2[_0x14905c(0xb1)]),'data':new TextDecoder()[_0x14905c(0xb6)](_0x2826b2['data']),'keyId':_0x2826b2[_0x14905c(0xa1)],'depth':_0x2826b2[_0x14905c(0xa4)],'expiresAt':_0x2826b2[_0x14905c(0xae)]},_0x7a0459={};return _0x7a0459['ok']=!![],_0x7a0459['auth']=_0x30e5f4,_0x7a0459;}}function toHexView(_0x192c5b){const _0x3a8f06=_0x58d752;let _0x3f5e7f='';for(const _0x567ea9 of _0x192c5b)_0x3f5e7f+=_0x567ea9[_0x3a8f06(0xb2)](0x10)[_0x3a8f06(0xa3)](0x2,'0');return _0x3f5e7f;}export async function createVerifier(_0x1e6994){return AccessKeyVerifier['create'](_0x1e6994);}

package/dist/wire.d.ts ADDED Viewed

@@ -0,0 +1,40 @@
+/**
+ * 线上格式(wire format):a1_ + base64url(变长二进制)
+ *
+ *   ┌─────┬────────┬────────┬─────┬────────┬─────────┬──────────┐
+ *   │depth│ key_id │ uid_ref│scene│ expiry │ data    │ MAC(16B) │
+ *   │ 1B  │  4B    │  8B    │ 1B  │ 4B     │1B+0..96 │ 截断128位 │
+ *   └─────┴────────┴────────┴─────┴────────┴─────────┴──────────┘
+ *
+ *   payload = 18B 固定头 + 1B dataLen + data(0..96B)
+ *   空 data:35B → 50 字符;满 96B:131B → 178 字符
+ *
+ * 布局是公开的:凭证的安全承诺是完整性(不可伪造/篡改),不是机密性。
+ */
+export declare const KEY_PREFIX = "a1_";
+export declare const HEADER_SIZE = 18;
+export declare const MAC_SIZE = 16;
+export declare const MIN_TOKEN_SIZE: number;
+export interface ParsedAccessKey {
+    /** 委派深度,0 = 直接签发 */
+    depth: number;
+    /** 4 字节,十六进制字符串(日志定位 / 吊销索引) */
+    keyIdHex: string;
+    keyId: Uint8Array;
+    /** uid 的 8 字节截断哈希(不含 uid 原文) */
+    uidRef: Uint8Array;
+    /** scene 序号(255 = 空) */
+    scene: number;
+    /** unix 秒 */
+    expiresAt: number;
+    /** 内嵌数据(0..96B) */
+    data: Uint8Array;
+    /** 18+1+dataLen 字节原始 payload(重算 MAC 用) */
+    payload: Uint8Array;
+    /** 16 字节 MAC */
+    mac: Uint8Array;
+}
+export declare function encodeToken(payload: Uint8Array, mac: Uint8Array): string;
+/** 只解码不判断 —— 返回 null 表示格式坏,不区分原因 */
+export declare function parseAccessKey(raw: string): ParsedAccessKey | null;
+//# sourceMappingURL=wire.d.ts.map

package/dist/wire.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,eAAO,MAAM,UAAU,QAAQ,CAAC;AAChC,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,eAAO,MAAM,cAAc,QAA6B,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,gCAAgC;IAChC,MAAM,EAAE,UAAU,CAAC;IACnB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,UAAU,CAAC;IACpB,gBAAgB;IAChB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAKxE;AAED,oCAAoC;AACpC,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAgClE"}

package/dist/wire.js ADDED Viewed

@@ -0,0 +1 @@

package/package.json CHANGED Viewed

@@ -1,6 +1,46 @@
 {
   "name": "@blod-nm/ak",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Stateless compute-verified access keys: variable-length binary layout, HMAC-SHA256 truncated MAC, zero I/O verification, zero storage. Edge-runtime compatible (Web Crypto only).",
+  "license": "MIT",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && bun scripts/build.mjs",
+    "test": "bun test test/",
+    "check-types": "tsc --noEmit",
+    "prepack": "bun run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "access-key",
+    "api-key",
+    "stateless",
+    "authentication",
+    "hmac",
+    "zero-trust",
+    "edge"
+  ],
+  "devDependencies": {
+    "@types/bun": "^1.4.4",
+    "@types/node": "^26.6.6",
+    "javascript-obfuscator": "^4.2.2"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  }
+}

package/README.md DELETED Viewed

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.