@cruba/crubal-host 0.0.0-stage → 0.3.0

package/dist/src/signatures.js

@@ -0,0 +1,53 @@
+// signatures.ts: signed requests between owners (docs/design/host.md, "Between owners"): HTTP message
+// signatures (RFC 9421) over the method, the target, the body's digest and the date, made with the domain's
+// Ed25519 key and verified against the key its well-known file publishes. The subset here is what two
+// hosts need to prove who is calling; nothing more.
+import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from "node:crypto";
+export const COMPONENTS = ["@method", "@target-uri", "content-digest", "date"];
+export function contentDigest(body) {
+    return `sha-256=:${createHash("sha256").update(body, "utf8").digest("base64")}:`;
+}
+function base(method, target, digest, date, params) {
+    return [`"@method": ${method.toUpperCase()}`, `"@target-uri": ${target}`, `"content-digest": ${digest}`, `"date": ${date}`, `"@signature-params": ${params}`].join("\n");
+}
+/** The headers a signed request carries: Content-Digest, Date, Signature-Input and Signature. */
+export function signRequest(o) {
+    const body = o.body ?? "";
+    const digest = contentDigest(body);
+    const created = o.created ?? Math.floor(Date.now() / 1000);
+    const date = new Date(created * 1000).toUTCString();
+    const params = `(${COMPONENTS.map((c) => `"${c}"`).join(" ")});created=${created};keyid="${o.keyid}";alg="ed25519"`;
+    const key = createPrivateKey({ key: { kty: "OKP", crv: "Ed25519", x: o.publicX, d: o.privateD }, format: "jwk" });
+    const sig = edSign(null, Buffer.from(base(o.method, o.url, digest, date, params), "utf8"), key).toString("base64");
+    return { "content-digest": digest, date, "signature-input": `sig1=${params}`, signature: `sig1=:${sig}:` };
+}
+/** Verify a request's signature with the signer's public key (its JWK `x`). Null when absent or invalid. */
+export function verifyRequest(o) {
+    return (async () => {
+        const h = (n) => { const v = o.headers[n] ?? o.headers[n.toLowerCase()]; return Array.isArray(v) ? v[0] : v; };
+        const input = h("signature-input");
+        const signature = h("signature");
+        const date = h("date");
+        const digest = h("content-digest");
+        if (!input || !signature || !date || !digest)
+            return null;
+        const m = input.match(/^sig1=(\((?:"[^"]+" ?)+\);created=(\d+);keyid="([^"]+)";alg="ed25519")$/);
+        const s = signature.match(/^sig1=:([A-Za-z0-9+/=]+):$/);
+        if (!m || !s)
+            return null;
+        const [, params, createdText, keyid] = m;
+        const created = Number(createdText);
+        const now = o.now ?? Math.floor(Date.now() / 1000);
+        if (Math.abs(now - created) > (o.skew ?? 300))
+            return null;
+        if (contentDigest(o.body ?? "") !== digest)
+            return null;
+        const x = await o.publicX(keyid);
+        if (!x)
+            return null;
+        const key = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x }, format: "jwk" });
+        const ok = edVerify(null, Buffer.from(base(o.method, o.url, digest, date, params), "utf8"), key, Buffer.from(s[1], "base64"));
+        return ok ? { keyid, created } : null;
+    })();
+}
+//# sourceMappingURL=signatures.js.map

package/dist/src/signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signatures.js","sourceRoot":"","sources":["../../src/signatures.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,4GAA4G;AAC5G,sGAAsG;AACtG,oDAAoD;AAEpD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEhH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,CAAU,CAAC;AAExF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,YAAY,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;AACnF,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAE,IAAY,EAAE,MAAc;IACxF,OAAO,CAAC,cAAc,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,kBAAkB,MAAM,EAAE,EAAE,qBAAqB,MAAM,EAAE,EAAE,WAAW,IAAI,EAAE,EAAE,wBAAwB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3K,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,CAAqH;IAC/I,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,OAAO,WAAW,CAAC,CAAC,KAAK,iBAAiB,CAAC;IACpH,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnH,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,EAAE,CAAC;AAC7G,CAAC;AAID,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAAC,CAAgM;IAC5N,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvH,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAgD,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}

package/dist/src/terms.d.ts

@@ -0,0 +1,21 @@
+export type Terms = {
+    [audience: string]: {
+        [use: string]: boolean;
+    };
+};
+/** `search yes, answer yes, train no` → `{search: true, answer: true, train: false}`. */
+export declare function readTerms(text: {
+    [audience: string]: string;
+}): Terms;
+/** The user agents that fetch pages to train models, as they name themselves. */
+export declare const TRAINING_BOTS: string[];
+/** robots.txt for an owner's public terms. */
+export declare function robotsTxt(terms: Terms, prefix?: string): string;
+/** Response headers for a public page under these terms. */
+export declare function termsHeaders(terms: Terms): {
+    [header: string]: string;
+};
+/** The machine-readable terms file, by audience. */
+export declare function termsJson(owner: string, terms: Terms): {
+    [k: string]: unknown;
+};

package/dist/src/terms.js

@@ -0,0 +1,55 @@
+// terms.ts: a package's terms per audience (spec 12.5.1) turned into what crawlers and agents read: robots
+// rules for the bots that train, a machine-readable terms file, and response headers. CRUBAL states the
+// terms; the host turns them into these. Nothing here is a visibility decision: that stayed in the views.
+/** `search yes, answer yes, train no` → `{search: true, answer: true, train: false}`. */
+export function readTerms(text) {
+    const out = {};
+    for (const [audience, line] of Object.entries(text)) {
+        const uses = {};
+        for (const piece of line.split(",")) {
+            const [use, yn] = piece.trim().split(/\s+/);
+            if (use)
+                uses[use] = yn !== "no";
+        }
+        out[audience] = uses;
+    }
+    return out;
+}
+/** The user agents that fetch pages to train models, as they name themselves. */
+export const TRAINING_BOTS = ["GPTBot", "ChatGPT-User", "CCBot", "Google-Extended", "anthropic-ai", "ClaudeBot", "Claude-Web", "Bytespider", "Applebot-Extended", "cohere-ai", "PerplexityBot", "Meta-ExternalAgent", "Amazonbot"];
+/** robots.txt for an owner's public terms. */
+export function robotsTxt(terms, prefix = "/") {
+    const pub = terms.public ?? {};
+    const lines = [];
+    if (pub.search === false) {
+        lines.push("User-agent: *", `Disallow: ${prefix}`, "");
+    }
+    else {
+        if (pub.train === false)
+            for (const bot of TRAINING_BOTS)
+                lines.push(`User-agent: ${bot}`, `Disallow: ${prefix}`, "");
+        lines.push("User-agent: *", "Allow: /", "");
+    }
+    return `${lines.join("\n").trimEnd()}\n`;
+}
+/** Response headers for a public page under these terms. */
+export function termsHeaders(terms) {
+    const pub = terms.public ?? {};
+    const robots = [];
+    if (pub.search === false)
+        robots.push("noindex");
+    if (pub.answer === false)
+        robots.push("nosnippet");
+    if (pub.train === false)
+        robots.push("noai", "noimageai");
+    const out = {};
+    if (robots.length)
+        out["x-robots-tag"] = robots.join(", ");
+    out["x-crubal-terms"] = Object.entries(pub).map(([u, ok]) => `${u}=${ok ? "yes" : "no"}`).join("; ") || "search=yes; answer=yes; train=yes";
+    return out;
+}
+/** The machine-readable terms file, by audience. */
+export function termsJson(owner, terms) {
+    return { crubal: "2", owner, terms: Object.keys(terms).length ? terms : { public: { search: true, answer: true, train: true } } };
+}
+//# sourceMappingURL=terms.js.map

package/dist/src/terms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.js","sourceRoot":"","sources":["../../src/terms.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,wGAAwG;AACxG,0GAA0G;AAI1G,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,IAAoC;IAC5D,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAA+B,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC;QACnC,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,eAAe,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;AAEnO,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,KAAY,EAAE,MAAM,GAAG,GAAG;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;YAAE,KAAK,MAAM,GAAG,IAAI,aAAa;gBAAE,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,EAAE,aAAa,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACtH,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;AAC3C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,KAAY;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM;QAAE,GAAG,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mCAAmC,CAAC;IAC5I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,KAAY;IACnD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACpI,CAAC"}

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@cruba/crubal-host",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0",
+  "description": "The reference CRUBAL host: identity, secrets, adapters, signing, the loops, the platform index and the HTTP surface over the Postgres store.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    }
+  },
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
+  "bin": {
+    "crubal-host": "dist/bin/crubal-host.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.ts",
+    "typecheck": "tsc --noEmit",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && cp src/schema.sql dist/src/",
+    "prepublishOnly": "npm run typecheck && npm run build"
+  },
+  "dependencies": {
+    "@cruba/crubal": "0.3.0",
+    "@cruba/crubal-postgres": "0.3.0",
+    "pg": "^8.13.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "@types/pg": "^8.11.0",
+    "typescript": "^5.6.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nes4less/crubal.git",
+    "directory": "packages/crubal-host"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "author": "Chris Thompson"
+}