@caelo-cms/provisioning 0.10.47 → 0.10.48

package/src/install-state.ts

@@ -0,0 +1,583 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Per-install state — every Caelo install gets its own
+ * `~/.caelo-<install-id>/` directory with:
+ *
+ *   secrets/                — mode-700 dir for the install's secrets
+ *     anthropic-api-key       (mode 600) — Anthropic API key (one-time prompt)
+ *     pulumi-passphrase       (mode 600) — Pulumi local-backend passphrase
+ *     (no service-account key: GCP installs impersonate `caelo-provisioner`
+ *      with the operator's own Google login, CLAUDE.md §11.C. An
+ *      `sa-key.json` minted by installers before #696 is deleted —
+ *      locally and in IAM — on the next `upgrade` or installer run;
+ *      provisioner-identity.ts)
+ *   state/                  — Pulumi local backend state (per-install isolated);
+ *                             absent once the install's state lives in its
+ *                             own cloud (#696, state-backend.ts)
+ *   progress.json           — wizard checkpoint so re-runs resume cleanly
+ *   install.json            — install metadata (provider, project id, region,
+ *                             domain, owner email, install id, created_at,
+ *                             where the state lives)
+ *
+ * #696 — for an install whose `stateBackend` is `gcs`, install.json and
+ * progress.json live in the install's ops bucket; the copies here are a
+ * mirror (state-store.ts). Every read/write below goes through
+ * {@link stateStoreFor}.
+ *
+ * Only `secrets/` (and Pulumi's encrypted state) hold secrets. progress.json
+ * and install.json are read by tooling, backups and agents, so writes to
+ * them refuse secret material (checkpoint-secrets.ts, #656).
+ *
+ * The CLAUDE.md §11.C contract: end-users never reach into this directory
+ * by hand. The wizard + lifecycle commands wrap every read + write.
+ */
+
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import {
+  assertNoSecrets,
+  rotationHints,
+  type ScrubReport,
+  scrubProgressFile,
+} from "./checkpoint-secrets.js";
+import { defaultStagingHost } from "./stack-contract.js";
+import { parseStateBackend, type StateBackendRecord } from "./state-backend.js";
+import {
+  GcsStateStore,
+  LocalStateStore,
+  realSyncGcloud,
+  type StateStore,
+  type SyncGcloud,
+} from "./state-store.js";
+
+export type Provider = "self-hosted" | "gcp" | "gcp-firebase" | "aws" | "azure";
+
+export interface InstallMetadata {
+  installId: string;
+  provider: Provider;
+  /** Cloud-side project / account / subscription id. NULL for self-hosted. */
+  projectId: string | null;
+  domain: string;
+  ownerEmail: string;
+  region: string | null;
+  createdAt: string;
+  /**
+   * sha256 digests of the release images the install runs, recorded by the
+   * wizard after `pulumi up` and by `upgrade` after a roll. A wizard re-run
+   * deploys these instead of re-resolving `:latest`, so it never undoes a
+   * pinned or rc upgrade; versions change through `upgrade` only. Absent on
+   * installs that predate it.
+   */
+  imageDigests?: ImageDigests;
+  /**
+   * #696 — the Caelo release (`0.11.0`) those digests belong to, recorded
+   * next to them by `upgrade` and the upgrader job. The upgrader job reads
+   * the installed version from here, not from the running admin: a
+   * compromised admin could claim an older version to get a downgrade
+   * past the "newer than installed" check. Absent until the first upgrade
+   * that knew it; the job refuses to run without it.
+   */
+  releaseVersion?: string;
+  /**
+   * #650 — the protected staging site's host (wizard / `--staging-domain`,
+   * default `staging.<domain>`). Absent on installs that predate it;
+   * `upgrade` records the default ({@link installStagingHost}).
+   */
+  stagingDomain?: string;
+  /**
+   * #696 — where Pulumi's state and this metadata live (state-backend.ts).
+   * Absent on installs that predate it: those are `local`.
+   */
+  stateBackend?: StateBackendRecord;
+  /**
+   * #696 — the infrastructure contract version (infra-contract.ts) the last
+   * successful converge brought this install to. Absent until the first
+   * `upgrade` that converged completely; an app-roll-only upgrade refuses to
+   * run while it is lower than the release's (upgrade/converge.ts).
+   */
+  infraContractVersion?: number;
+}
+
+/** The install's staging host: its recorded setting, else the default. */
+export function installStagingHost(
+  meta: Pick<InstallMetadata, "domain" | "stagingDomain">,
+): string {
+  return meta.stagingDomain ?? defaultStagingHost(meta.domain);
+}
+
+/**
+ * A bare, lower-case fully-qualified host name: dot-separated labels of
+ * `a-z0-9-` (no leading/trailing hyphen, at most 63 characters each), a
+ * letter-led top-level label. Deliberately free of `.`-wildcards and
+ * lookaheads so the check reads as a strict allow-list.
+ */
+const RECORDABLE_HOST =
+  /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/** DNS limit on a full host name. */
+const MAX_HOST_LENGTH = 253;
+
+/**
+ * The staging host exactly as install.json may record it, or null when
+ * `host` is anything but a bare host name. The host can come from the
+ * admin's HTTP answer (`staging-domain enable` reads the stored host), so
+ * only a value that passes this allow-list is written to disk — never a
+ * URL, path, port, whitespace or other payload.
+ *
+ * @example recordableStagingHost("staging.example.com") // → "staging.example.com"
+ * @example recordableStagingHost("https://x.example.com/") // → null
+ */
+export function recordableStagingHost(host: string): string | null {
+  if (host.length > MAX_HOST_LENGTH) return null;
+  return RECORDABLE_HOST.test(host) ? host : null;
+}
+
+/** Release image digest per Cloud Run service. */
+export interface ImageDigests {
+  readonly admin: string;
+  readonly gateway: string;
+}
+
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+
+/**
+ * The image digests recorded for an install, or null when none are. Throws
+ * on a malformed record rather than deploying a guess.
+ */
+export function recordedImageDigests(meta: InstallMetadata): ImageDigests | null {
+  const d = meta.imageDigests;
+  if (d === undefined) return null;
+  if (!DIGEST.test(d.admin ?? "") || !DIGEST.test(d.gateway ?? "")) {
+    throw new Error(
+      `install.json imageDigests is malformed (${JSON.stringify(d)}); fix or remove it, then re-run.`,
+    );
+  }
+  return d;
+}
+
+/**
+ * The metadata a non-interactive re-run of an existing install writes: the
+ * inputs it was given over what install.json already holds. Everything else
+ * (createdAt, region, the recorded `imageDigests`) survives, so the re-run
+ * keeps the release the install runs instead of looking like a new install.
+ */
+export function resumedMetadata(
+  existing: InstallMetadata,
+  inputs: { domain: string; ownerEmail: string; projectId: string | null },
+): InstallMetadata {
+  return {
+    ...existing,
+    domain: inputs.domain,
+    ownerEmail: inputs.ownerEmail,
+    projectId: inputs.projectId ?? existing.projectId,
+  };
+}
+
+/** Record the image digests an install now runs (see {@link InstallMetadata.imageDigests}). */
+export function recordImageDigests(
+  installId: string,
+  digests: ImageDigests,
+  releaseVersion?: string | null,
+): void {
+  const meta = readMetadata(installId);
+  if (!meta) throw new Error(`No install.json for install '${installId}'.`);
+  // A version belongs to its digests: unchanged digests keep the recorded
+  // version unless a new one is given; new digests without a known version
+  // drop it — a stale one would be worse than none (the upgrader job
+  // refuses on none and judges downgrades by it).
+  const same =
+    meta.imageDigests?.admin === digests.admin && meta.imageDigests?.gateway === digests.gateway;
+  const { releaseVersion: previous, ...rest } = meta;
+  const version = releaseVersion ?? (same ? previous : undefined);
+  writeMetadata(installId, {
+    ...rest,
+    imageDigests: { admin: digests.admin, gateway: digests.gateway },
+    ...(version ? { releaseVersion: version } : {}),
+  });
+}
+
+/**
+ * Record the infrastructure contract version a converge just brought the
+ * install to (see {@link InstallMetadata.infraContractVersion}).
+ */
+export function recordInfraContractVersion(installId: string, version: number): void {
+  const meta = readMetadata(installId);
+  if (!meta) throw new Error(`No install.json for install '${installId}'.`);
+  writeMetadata(installId, { ...meta, infraContractVersion: version });
+}
+
+export interface ProgressCheckpoint {
+  /** Last completed wizard step. Used for resume-after-failure. */
+  lastCompletedStep: string | null;
+  /** Per-step state (e.g. createdProjectId, billingAccountId, etc.). */
+  steps: Record<string, unknown>;
+  /** ISO timestamp of last successful update. */
+  updatedAt: string;
+}
+
+const ROOT_PREFIX = ".caelo-";
+
+export function installRoot(installId: string): string {
+  return join(homedir(), `${ROOT_PREFIX}${installId}`);
+}
+
+/**
+ * Stable install id from the (provider, projectId-or-domain) pair so a re-run
+ * with the same inputs always lands on the same `~/.caelo-<id>/` directory.
+ * The id is short + readable — `gcp-caelo-website` / `self-hosted-mysite-com`.
+ */
+export function deriveInstallId(provider: Provider, projectIdOrDomain: string): string {
+  const slug = projectIdOrDomain
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 40);
+  return `${provider}-${slug}`;
+}
+
+/**
+ * Ensure the install directory exists with the right mode + sub-dirs.
+ * Idempotent.
+ */
+export function ensureInstallDir(installId: string): {
+  root: string;
+  secretsDir: string;
+  stateDir: string;
+} {
+  const root = installRoot(installId);
+  const secretsDir = join(root, "secrets");
+  const stateDir = join(root, "state");
+
+  if (!existsSync(root)) mkdirSync(root, { recursive: true, mode: 0o700 });
+  if (!existsSync(secretsDir)) mkdirSync(secretsDir, { recursive: true, mode: 0o700 });
+  // An install whose state lives in its ops bucket gets no local state dir:
+  // an empty one would read as "the state is here".
+  const remote = readLocalMetadata(installId)?.stateBackend?.kind === "gcs";
+  if (!remote && !existsSync(stateDir)) mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+
+  // chmod every time in case the dirs existed with looser perms.
+  chmodSync(root, 0o700);
+  chmodSync(secretsDir, 0o700);
+  if (existsSync(stateDir)) chmodSync(stateDir, 0o700);
+
+  return { root, secretsDir, stateDir };
+}
+
+/**
+ * Scan `~/.caelo-*` for every install with a readable `install.json` (the
+ * local copy; see {@link currentMetadata}).
+ * Used by the wizard to offer "resume X" before prompting for the
+ * domain / owner / project again. Silently skips dirs that fail to
+ * parse — partial / orphaned dirs don't block the new-install flow.
+ */
+export function listInstalls(): InstallMetadata[] {
+  const home = homedir();
+  let entries: string[];
+  try {
+    entries = readdirSync(home);
+  } catch {
+    return [];
+  }
+  const out: InstallMetadata[] = [];
+  for (const entry of entries) {
+    if (!entry.startsWith(ROOT_PREFIX)) continue;
+    const installId = entry.slice(ROOT_PREFIX.length);
+    // The local copy, so one unreachable bucket (a revoked grant, a deleted
+    // project) can't block commands for every other install. A command
+    // re-reads the install it picked with {@link currentMetadata}.
+    const meta = readLocalMetadata(installId);
+    if (meta) out.push(meta);
+  }
+  out.sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1));
+  return out;
+}
+
+/**
+ * The install a command names on its argv: `--install <id or domain>` or
+ * `--install=<…>`. `--install-id` is accepted as an alias, the spelling
+ * older docs and code comments used.
+ *
+ * @returns the value, or undefined when no flag is given
+ * @throws when the flag is given without a value
+ */
+export function installFlag(argv: readonly string[]): string | undefined {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i] ?? "";
+    for (const name of ["--install", "--install-id"]) {
+      if (a === name) {
+        const v = argv[i + 1];
+        if (v === undefined || v.startsWith("-")) {
+          throw new Error(
+            `${name} needs a value: the install id or domain (e.g. ${name} example.com)`,
+          );
+        }
+        return v;
+      }
+      if (a.startsWith(`${name}=`)) {
+        const v = a.slice(name.length + 1);
+        if (v === "") throw new Error(`${name} needs a value: the install id or domain`);
+        return v;
+      }
+    }
+  }
+  return undefined;
+}
+
+/** Outcome of {@link selectInstall}. */
+export type InstallSelection = { ok: true; meta: InstallMetadata } | { ok: false; message: string };
+
+/**
+ * Pick the install a lifecycle command acts on. `wanted` (from `--install`)
+ * matches an install id or its domain. Without it, exactly one install may
+ * exist: with several, guessing would upgrade, back up or destroy the wrong
+ * site, so the operator is asked to name one instead.
+ *
+ * @param installs every install on this machine (see {@link listInstalls})
+ * @param wanted the `--install` value, if given
+ */
+export function selectInstall(
+  installs: readonly InstallMetadata[],
+  wanted: string | undefined,
+): InstallSelection {
+  const listed = (ms: readonly InstallMetadata[]): string =>
+    ms.map((m) => `  ${m.installId}  (${m.domain}, ${m.provider})`).join("\n");
+  if (wanted !== undefined) {
+    const hits = installs.filter((m) => m.installId === wanted || m.domain === wanted);
+    if (hits.length === 1 && hits[0]) return { ok: true, meta: hits[0] };
+    if (hits.length === 0) {
+      return {
+        ok: false,
+        message:
+          installs.length === 0
+            ? `No install "${wanted}" on this machine (no ~/.caelo-<install-id>/install.json found).`
+            : `No install "${wanted}" on this machine. Installs found:\n${listed(installs)}\nPass one of these ids (or its domain) with --install.`,
+      };
+    }
+    return {
+      ok: false,
+      message: `"${wanted}" matches several installs:\n${listed(hits)}\nPass the install id with --install.`,
+    };
+  }
+  if (installs.length === 1 && installs[0]) return { ok: true, meta: installs[0] };
+  if (installs.length === 0) {
+    return { ok: false, message: "No Caelo install found on this machine." };
+  }
+  return {
+    ok: false,
+    message: `Several Caelo installs on this machine:\n${listed(installs)}\nPick one with --install <install-id or domain>.`,
+  };
+}
+
+let syncGcloud: SyncGcloud = realSyncGcloud;
+const gcsStores = new Map<string, GcsStateStore>();
+
+/**
+ * Replace the gcloud runner bucket-backed stores use. Test seam only: the
+ * CLI always uses the real `gcloud`.
+ */
+export function setStateStoreGcloud(run: SyncGcloud): void {
+  syncGcloud = run;
+  gcsStores.clear();
+}
+
+function parseMetadata(text: string, where: string): InstallMetadata {
+  const meta = JSON.parse(text) as InstallMetadata;
+  if (typeof meta !== "object" || meta === null || typeof meta.installId !== "string") {
+    throw new Error(`${where} is not an install.json (no installId).`);
+  }
+  const stateBackend = parseStateBackend(meta.stateBackend);
+  return stateBackend ? { ...meta, stateBackend } : meta;
+}
+
+/**
+ * The install.json copy in `~/.caelo-<id>/`, without consulting the bucket.
+ * For listing installs and for deciding which store to use.
+ */
+export function readLocalMetadata(installId: string): InstallMetadata | null {
+  const text = new LocalStateStore(installRoot(installId)).read("install.json");
+  return text === null ? null : parseMetadata(text, `~/.caelo-${installId}/install.json`);
+}
+
+/**
+ * The store holding the install's metadata: its ops bucket when the local
+ * install.json says the install's state lives there, else `~/.caelo-<id>/`.
+ * One bucket store per install and process, so a run reads each document
+ * from the bucket once.
+ */
+export function stateStoreFor(installId: string): StateStore {
+  const root = installRoot(installId);
+  const backend = readLocalMetadata(installId)?.stateBackend;
+  if (backend?.kind !== "gcs") return new LocalStateStore(root);
+  const key = `${installId}\0${backend.bucket}`;
+  let store = gcsStores.get(key);
+  if (!store) {
+    store = new GcsStateStore(backend.bucket, root, syncGcloud);
+    gcsStores.set(key, store);
+  }
+  return store;
+}
+
+/**
+ * The authoritative metadata of an install picked from {@link listInstalls}:
+ * for an install whose state lives in its ops bucket, the bucket's copy
+ * (another machine may have upgraded it since). Throws when that copy can't
+ * be read — acting on a stale mirror could roll an install back.
+ */
+export function currentMetadata(meta: InstallMetadata): InstallMetadata {
+  if (meta.stateBackend?.kind !== "gcs") return meta;
+  const fresh = readMetadata(meta.installId);
+  if (!fresh) {
+    throw new Error(
+      `gs://${meta.stateBackend.bucket} has no install.json for ${meta.installId}; the install may have been destroyed.`,
+    );
+  }
+  return fresh;
+}
+
+export function readMetadata(installId: string): InstallMetadata | null {
+  const store = stateStoreFor(installId);
+  const text = store.read("install.json");
+  return text === null ? null : parseMetadata(text, `${store.kind} install.json of ${installId}`);
+}
+
+/**
+ * Write install.json. Never changes where the state lives — only
+ * {@link adoptStateBackend} (behind `state migrate`'s checks) does: the
+ * recorded `stateBackend` is kept whatever `meta` carries, so a caller
+ * holding metadata read before a migration can't switch it back. For a
+ * bucket-backed install the bucket's current record is checked first
+ * (uncached): if another machine moved the state off the bucket meanwhile,
+ * the write is refused.
+ */
+export function writeMetadata(installId: string, meta: InstallMetadata): void {
+  const store = stateStoreFor(installId);
+  const recorded = readLocalMetadata(installId)?.stateBackend;
+  const { stateBackend: _ignored, ...rest } = meta;
+  const next: InstallMetadata = recorded ? { ...rest, stateBackend: recorded } : rest;
+  if (store instanceof GcsStateStore) {
+    const live = store.peek("install.json");
+    const liveBackend =
+      live === null ? undefined : parseStateBackend(JSON.parse(live).stateBackend);
+    if (live !== null && liveBackend?.kind !== "gcs") {
+      throw new Error(
+        `${installId}'s state was moved off its bucket by another machine (state migrate --to local); this run's metadata is out of date. Nothing was written; manage the install from that machine.`,
+      );
+    }
+  }
+  store.write("install.json", next);
+}
+
+/**
+ * Move the install's metadata to `backend`'s store and record the backend
+ * in install.json (#696). progress.json is written first and install.json
+ * last: install.json naming the new backend is the commit point, so an
+ * interrupted switch leaves the install on its old store. When the install
+ * leaves the bucket, the bucket's install.json is updated too, so a machine
+ * that attaches later learns where the state went.
+ *
+ * @returns the metadata as now recorded
+ */
+export function adoptStateBackend(installId: string, backend: StateBackendRecord): InstallMetadata {
+  const current = readMetadata(installId);
+  if (!current) throw new Error(`No install.json for install '${installId}'.`);
+  const progress = readProgress(installId);
+  const next: InstallMetadata = { ...current, stateBackend: backend };
+  const root = installRoot(installId);
+  const previous = current.stateBackend;
+  gcsStores.clear();
+  if (backend.kind === "gcs") {
+    const gcs = new GcsStateStore(backend.bucket, root, syncGcloud);
+    gcs.write("progress.json", progress);
+    gcs.write("install.json", next);
+  } else {
+    if (previous?.kind === "gcs") {
+      new GcsStateStore(previous.bucket, root, syncGcloud).write("install.json", next);
+    }
+    const local = new LocalStateStore(root);
+    local.write("progress.json", progress);
+    local.write("install.json", next);
+  }
+  return next;
+}
+
+export function readProgress(installId: string): ProgressCheckpoint {
+  const text = stateStoreFor(installId).read("progress.json");
+  if (text === null) {
+    return { lastCompletedStep: null, steps: {}, updatedAt: new Date().toISOString() };
+  }
+  return JSON.parse(text) as ProgressCheckpoint;
+}
+
+export function writeProgress(installId: string, checkpoint: ProgressCheckpoint): void {
+  stateStoreFor(installId).write("progress.json", {
+    ...checkpoint,
+    updatedAt: new Date().toISOString(),
+  });
+}
+
+/**
+ * Mark a step complete. Wizard re-runs check `isStepDone(installId, name)` to
+ * skip already-done steps. The payload is bookkeeping only: one holding a
+ * password, a credential URL or a secret-named key is refused (#656) —
+ * store an identifier and read the secret at the moment of use.
+ */
+export function markStepDone(installId: string, stepName: string, payload?: unknown): void {
+  if (payload !== undefined) assertNoSecrets(payload, `progress.json step "${stepName}"`);
+  const cur = readProgress(installId);
+  cur.lastCompletedStep = stepName;
+  if (payload !== undefined) cur.steps[stepName] = payload;
+  writeProgress(installId, cur);
+}
+
+export function isStepDone(installId: string, stepName: string): boolean {
+  return readProgress(installId).steps[stepName] !== undefined;
+}
+
+export function getStepPayload<T>(installId: string, stepName: string): T | null {
+  const v = readProgress(installId).steps[stepName];
+  return (v ?? null) as T | null;
+}
+
+/**
+ * Remove secret material an older CLI checkpointed into the install's
+ * progress.json (#656). Idempotent; completed steps stay completed.
+ *
+ * @returns the lines to show the operator: what was removed and which
+ *   secret to rotate with which command; empty when the file was clean
+ */
+export function scrubInstallProgress(installId: string): string[] {
+  const { removed }: ScrubReport = scrubProgressFile(join(installRoot(installId), "progress.json"));
+  if (removed.length === 0) return [];
+  return [
+    `Removed ${removed.length} secret value(s) an earlier installer stored in ~/.caelo-${installId}/progress.json. Copies may remain in backups or synced copies of that file.`,
+    ...rotationHints(removed, installId),
+  ];
+}
+
+/**
+ * Read a secret file from the install's `secrets/` dir. Returns null if the
+ * file doesn't exist; throws if the file exists but has the wrong mode (a
+ * defence against the user copy-pasting a key into a 644 file by mistake).
+ */
+export function readSecret(installId: string, name: string): string | null {
+  const path = join(installRoot(installId), "secrets", name);
+  if (!existsSync(path)) return null;
+  const contents = readFileSync(path, "utf8").trim();
+  if (contents.length === 0) return null;
+  return contents;
+}
+
+export function writeSecret(installId: string, name: string, value: string): void {
+  ensureInstallDir(installId);
+  const path = join(installRoot(installId), "secrets", name);
+  writeFileSync(path, value.endsWith("\n") ? value : `${value}\n`, { mode: 0o600 });
+}

package/src/internal-token.ts

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The CLI's side of the admin's /api/internal/* token
+ * (apps/admin/src/lib/server/internal-jwt.ts): HMAC-SHA256 over
+ * `"<iat>:<exp>:<scope>"` with the install's internal secret, valid for the
+ * admin's 5-minute replay window. One token per call.
+ */
+
+/** Replay window the admin enforces; tokens never outlive it. */
+const TOKEN_TTL_MS = 5 * 60 * 1000;
+
+/**
+ * Mint a token for `scope`.
+ *
+ * @param secret - the install's internal secret (≥32 chars; Secret Manager
+ *   `<prefix>-internal-secret` on cloud installs, never written to disk).
+ * @param now - ms since epoch; tests pin it.
+ */
+export async function mintInternalToken(
+  secret: string,
+  scope: string,
+  now: number = Date.now(),
+): Promise<string> {
+  const message = `${now}:${now + TOKEN_TTL_MS}:${scope}`;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
+  return `${Buffer.from(message).toString("base64url")}.${Buffer.from(sig).toString("base64url")}`;
+}