@cocreate/api 1.25.0 → 1.27.0

package/.github/workflows/automated.yml

@@ -9,33 +9,36 @@ jobs:
   about:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: 16
-      - name: Jaid/action-sync-node-meta
-        uses: jaid/action-sync-node-meta@v1.4.0
-        with:
-          direction: overwrite-github
-          githubToken: "${{ secrets.GITHUB }}"
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Sync package.json description to GitHub About
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB }}
+        run: |
+          DESC=$(jq -r '.description // empty' package.json)
+          if [ -n "$DESC" ]; then
+            echo "Updating repository description to: $DESC"
+            gh api -X PATCH repos/${{ github.repository }} -f description="$DESC"
+          else
+            echo "No description found in package.json."
+          fi
 
   release:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v7
         with:
-          fetch-depth: 0 # Required so semantic-release can trace git tags/history
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB }} # Authenticates git CLI for tag/commit pushes
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: '24'
 
       - name: Install Semantic Release & Plugins
-        # Installs semantic-release and its plugins on the runner
         run: |
           npm install -g semantic-release \
             @semantic-release/changelog \
@@ -43,12 +46,11 @@ jobs:
             @semantic-release/github \
             @semantic-release/git
 
-      - name: Run Semantic Release (Native)
+      - name: Run Semantic Release
         id: semantic
-        # This will automatically pick up your export default config file in the repository root
         run: npx semantic-release
         env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          GITHUB_TOKEN: "${{ secrets.GITHUB }}"
           NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
 
     outputs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocreate/api",
-  "version": "1.25.0",
+  "version": "1.27.0",
   "description": "A secure, multi-tenant API execution gateway and proxy layer that dynamically resolves endpoint actions, processes AST micro-operators, handles webhooks, and manages third-party integrations with strict tenant environment isolation.",
   "keywords": [
     "api-orchestration",
@@ -51,15 +51,15 @@
     }
   },
   "dependencies": {
-    "@cocreate/actions": "^1.22.3",
-    "@cocreate/crud-client": "^1.35.2",
-    "@cocreate/element-prototype": "^1.33.2",
-    "@cocreate/render": "^1.48.2",
-    "@cocreate/socket-client": "^1.41.2",
-    "@cocreate/utils": "^1.44.3"
+    "@cocreate/actions": "^1.23.0",
+    "@cocreate/crud-client": "^1.36.0",
+    "@cocreate/element-prototype": "^1.34.0",
+    "@cocreate/render": "^1.49.0",
+    "@cocreate/socket-client": "^1.42.0",
+    "@cocreate/utils": "^1.46.0"
   },
   "devDependencies": {
-    "@cocreate/webpack": "^1.6.2"
+    "@cocreate/webpack": "^1.7.0"
   },
   "allowScripts": {
     "@cocreate/actions@1.21.4": true,

package/src/server.js

@@ -21,9 +21,8 @@
 // you must obtain a commercial license from CoCreate LLC.
 // For details, visit <https://cocreate.app/licenses/> or contact us at sales@cocreate.app.
 
-import crypto from 'node:crypto';
 import { URL } from 'node:url';
-import { getValueFromObject, objectToSearchParams, astAsync } from '@cocreate/utils';
+import { getValueFromObject, objectToSearchParams, astAsync, generateJWT, verifySignature, buildAuthHeaders } from '@cocreate/utils';
 
 // Core module references bound dynamically upon initialization
 let server = null;
@@ -162,9 +161,9 @@ function createSandbox(context) {
             }
         },
         jwt: (args) => {
-            const privateKey = args?.privateKey;
+            const privateKey = args?.privateKey || args?.secret;
             if (!privateKey) throw new Error("Missing cryptographic signing key inside $jwt context parameters");
-            return generateJWT(args, privateKey);
+            return generateJWT(args, privateKey, args.alg || 'HS256');
         }
     };
 
@@ -449,52 +448,8 @@ export async function request(req, res) {
     }
 }
 
-export function generateJWT(config, secret) {
-    try {
-        const header = config.header || { alg: 'HS256', typ: 'JWT' };
-        const payload = config.payload || {};
-        
-        const encodedHeader = Buffer.from(JSON.stringify(header)).toString('base64url');
-        const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url');
-        
-        const signatureInput = `${encodedHeader}.${encodedPayload}`;
-        
-        const hmac = crypto.createHmac('sha256', secret);
-        hmac.update(signatureInput);
-        const signature = hmac.digest('base64url');
-        
-        return `${signatureInput}.${signature}`;
-    } catch (err) {
-        console.error('[@cocreate/api] Failed to generate JWT:', err);
-        throw err;
-    }
-}
-
-export function verifySignature(payload, signature, secret, algorithm = 'sha256') {
-    try {
-        if (!payload || !signature || !secret) return false;
-
-        const hmac = crypto.createHmac(algorithm, secret);
-        hmac.update(payload);
-        
-        const expectedSignature = hmac.digest();
-        let receivedSignature = Buffer.isBuffer(signature) ? signature : Buffer.from(signature, 'hex');
-
-        if (receivedSignature.length !== expectedSignature.length) {
-            receivedSignature = Buffer.from(signature, 'base64');
-        }
-
-        if (receivedSignature.length !== expectedSignature.length) {
-            console.warn('[@cocreate/api] Signature verification rejected immediately due to byte-length mismatch.');
-            return false;
-        }
-        
-        return crypto.timingSafeEqual(expectedSignature, receivedSignature);
-    } catch (err) {
-        console.error('[@cocreate/api] Failed signature verification:', err.message);
-        return false;
-    }
-}
+// Unified re-exports from security helper module to prevent duplicate function definitions
+export { generateJWT, verifySignature, buildAuthHeaders };
 
 export async function makeHttpRequest(url, options) {
     let controller, timeoutId;