@compilr-dev/sdk 0.9.20 → 0.9.21

package/dist/entitlements/cache.js

@@ -11,7 +11,36 @@
  * - fetchFn: how to call the server endpoint
  * - store (optional): encrypted persistence for offline grace (IEntitlementStore)
  */
+import { createPublicKey, verify } from 'node:crypto';
 import { UNLIMITED, OFFLINE_FALLBACK_LIMITS } from './types.js';
+/**
+ * Ed25519 public key for verifying entitlement response signatures.
+ * The corresponding private key is stored in Netlify env var ENTITLEMENT_SIGNING_KEY.
+ * This public key cannot forge signatures — it can only verify them.
+ */
+const ENTITLEMENT_PUBLIC_KEY = 'MCowBQYDK2VwAyEAMgDyiGWQVSnZKV6NF1UrDIkWtfH9BAyv93PyEg7AH40=';
+/**
+ * Verify the Ed25519 signature on an entitlement response.
+ * Returns true if valid or if signature verification is not available.
+ */
+function verifySignature(response) {
+    if (!response.signature)
+        return true; // No signature — allow (beta/dev)
+    try {
+        const { signature, ...payload } = response;
+        const publicKey = createPublicKey({
+            key: Buffer.from(ENTITLEMENT_PUBLIC_KEY, 'base64'),
+            format: 'der',
+            type: 'spki',
+        });
+        const payloadBuffer = Buffer.from(JSON.stringify(payload));
+        const signatureBuffer = Buffer.from(signature, 'base64');
+        return verify(null, payloadBuffer, publicKey, signatureBuffer);
+    }
+    catch {
+        return true; // Verification unavailable — fail open (don't break during migration)
+    }
+}
 // =============================================================================
 // Cache Implementation
 // =============================================================================
@@ -146,6 +175,10 @@ export class EntitlementCache {
     async fetchAndCache() {
         try {
             const response = await this.fetchFn();
+            // Verify Ed25519 signature (prevents tampered responses)
+            if (!verifySignature(response)) {
+                throw new Error('Entitlement signature verification failed');
+            }
             this.entitlements = response;
             this.fetchedAtMonotonic = process.hrtime.bigint();
             this.fetchedAtWall = Date.now();
@@ -174,7 +207,7 @@ export class EntitlementCache {
                 if (stored) {
                     const parsed = JSON.parse(stored);
                     const age = Date.now() - parsed.fetchedAtWall;
-                    if (age < this.offlineGraceMs) {
+                    if (age < this.offlineGraceMs && verifySignature(parsed.response)) {
                         this.entitlements = parsed.response;
                         // Compute monotonic offset from wall-clock age so isWithinOfflineGrace()
                         // returns the correct remaining time (not a fresh 24h window on every restart)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compilr-dev/sdk",
-  "version": "0.9.20",
+  "version": "0.9.21",
   "description": "Universal agent runtime for building AI-powered applications",
   "type": "module",
   "main": "dist/index.js",