@dnsid-ai/sdk 0.32.0 → 0.33.0

package/dist/node.cjs

@@ -38,6 +38,7 @@ __export(node_exports, {
   createNodeIdentityManagerFromFile: () => createNodeIdentityManagerFromFile,
   createNodeIdentityVerifier: () => createNodeIdentityVerifier,
   createRegistryClientFromEnvironment: () => createRegistryClientFromEnvironment,
+  createResponseSigningMiddleware: () => createResponseSigningMiddleware,
   loadCliDirectory: () => loadCliDirectory,
   loadEnvironment: () => loadEnvironment,
   loadFile: () => loadFile,
@@ -321,6 +322,124 @@ async function importPrivateKey(key) {
   );
 }
 
+// src/node-response-signing.ts
+var MAX_BUFFERED_BYTES = 8 * 1024 * 1024;
+var SIGNED_FIELDS = ["content-digest", "cache-control", "signature-input", "signature"];
+function createResponseSigningMiddleware(profile, options = {}) {
+  return (req, res, next) => {
+    if (req.headers["accept-signature"] === void 0) return next();
+    if (res.headersSent) return next(new Error("response headers already sent; register response signing first"));
+    const writeHead = res.writeHead.bind(res);
+    const end = res.end.bind(res);
+    const chunks = [];
+    let size = 0;
+    let overflow = false;
+    let ended = false;
+    let done = false;
+    let releasing = false;
+    const collect = (chunk, encoding) => {
+      if (chunk === void 0 || chunk === null || typeof chunk === "function") return true;
+      const bytes = typeof chunk === "string" ? Buffer.from(chunk, typeof encoding === "string" ? encoding : "utf8") : Buffer.from(chunk);
+      size += bytes.length;
+      if (size > MAX_BUFFERED_BYTES) {
+        overflow = true;
+        chunks.length = 0;
+        return false;
+      }
+      chunks.push(bytes);
+      return true;
+    };
+    const send = (body) => {
+      done = true;
+      releasing = true;
+      end(body);
+    };
+    const fail = () => {
+      if (done) return;
+      for (const name of res.getHeaderNames()) res.removeHeader(name);
+      res.statusCode = 500;
+      send();
+    };
+    res.writeHead = ((status, ...args) => {
+      if (releasing) return writeHead(status);
+      res.statusCode = status;
+      if (typeof args[0] === "string") res.statusMessage = args.shift();
+      setHeaders(res, args[0]);
+      return res;
+    });
+    res.flushHeaders = () => fail();
+    res.write = ((chunk, encoding, callback) => {
+      const cb = typeof encoding === "function" ? encoding : callback;
+      if (ended || done || !collect(chunk, encoding)) {
+        if (typeof cb === "function") process.nextTick(cb, new Error("response not writable"));
+        return false;
+      }
+      if (typeof cb === "function") process.nextTick(cb);
+      return true;
+    });
+    res.end = ((chunk, encoding, callback) => {
+      if (ended || done) return res;
+      ended = true;
+      const cb = [chunk, encoding, callback].find((arg) => typeof arg === "function");
+      if (typeof cb === "function") res.once("finish", cb);
+      collect(chunk, encoding);
+      void release();
+      return res;
+    });
+    async function release() {
+      if (done) return;
+      if (overflow) return fail();
+      try {
+        const noContent = req.method === "HEAD" || [204, 205, 304].includes(res.statusCode);
+        const body = Buffer.concat(chunks);
+        const signed = await profile.signRequestedHttpResponse(
+          toRequest(req, options.origin),
+          new Response(noContent ? null : body, { status: res.statusCode, headers: toHeaders(res.getHeaders()) })
+        );
+        if (done) return;
+        for (const name of SIGNED_FIELDS) {
+          const value = signed.headers.get(name);
+          if (value !== null) res.setHeader(name, value);
+        }
+        send(noContent ? void 0 : body);
+      } catch {
+        fail();
+      }
+    }
+    next();
+  };
+}
+function toRequest(req, origin) {
+  const path3 = req.originalUrl ?? req.url ?? "";
+  if (!path3.startsWith("/")) throw new Error("only origin-form request targets can be signed");
+  const scheme = req.socket.encrypted ? "https" : "http";
+  const base = origin ?? `${scheme}://${req.headers.host ?? ""}`;
+  return new Request(`${new URL(base).origin}${path3}`, { method: req.method, headers: toHeaders(req.headers) });
+}
+function toHeaders(fields) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(fields)) {
+    for (const item of Array.isArray(value) ? value : [value]) {
+      if (item !== void 0) headers.append(name, String(item));
+    }
+  }
+  return headers;
+}
+function setHeaders(res, headers) {
+  if (Array.isArray(headers)) {
+    const grouped = /* @__PURE__ */ new Map();
+    for (let i = 0; i + 1 < headers.length; i += 2) {
+      const name = String(headers[i]).toLowerCase();
+      grouped.set(name, [...grouped.get(name) ?? [], String(headers[i + 1])]);
+    }
+    for (const [name, values] of grouped) res.setHeader(name, values);
+  } else if (typeof headers === "object" && headers !== null) {
+    for (const [name, value] of Object.entries(headers)) {
+      if (value !== void 0) res.setHeader(name, value);
+    }
+  }
+}
+
 // src/node-identity-manager.ts
 var import_protocol2 = require("@dnsid-ai/protocol");
 async function createNodeIdentityManager(config, deps = {}) {
@@ -736,6 +855,7 @@ function optional(raw, key, type, source) {
   createNodeIdentityManagerFromFile,
   createNodeIdentityVerifier,
   createRegistryClientFromEnvironment,
+  createResponseSigningMiddleware,
   loadCliDirectory,
   loadEnvironment,
   loadFile,

package/dist/node.d.cts

@@ -1,9 +1,10 @@
 export { CreateIdentityManagerDependencies } from './index.cjs';
 import * as _dnsid_ai_protocol from '@dnsid-ai/protocol';
 import { KeyProvider, DnsIdJWK, DnsidConfig, IdentityManagerDependencies, IdentityManager, IdentityConfig } from '@dnsid-ai/protocol';
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { HttpSignaturesProfile } from '@dnsid-ai/http-signatures';
 import { RegistryClientOptions, RegistryClient } from '@dnsid-ai/registry';
 import '@dnsid-ai/jose';
-import '@dnsid-ai/http-signatures';
 import '@dnsid-ai/web-bot-auth';
 
 type LocalKeyAlgorithm = 'EdDSA' | 'ES256';
@@ -45,6 +46,29 @@ declare class LocalKeyProvider implements KeyProvider {
     private mutate;
 }
 
+/** Options for {@link createResponseSigningMiddleware}. */
+interface ResponseSigningMiddlewareOptions {
+    /**
+     * Public origin the client used, such as `https://bob.test`. Set it behind a
+     * TLS-terminating proxy. Default: the socket's scheme and the Host header.
+     */
+    origin?: string;
+}
+/** Connect-style middleware, usable with Express, Connect, or a plain `node:http` handler. */
+type NodeMiddleware = (req: IncomingMessage, res: ServerResponse, next: (err?: unknown) => void) => void;
+/**
+ * Signs responses to requests that carry Accept-Signature, for `node:http` servers.
+ * Requests without negotiation pass through unbuffered. Negotiated responses are
+ * buffered up to 8 MiB and signed with `signRequestedHttpResponse` before any header
+ * is sent. On a signing failure, an exceeded bound, or a `flushHeaders()` call
+ * (streaming, such as SSE) it sends an empty 500; it never sends the unsigned
+ * response. Register it before request verification, compression, and handlers
+ * so that it sees their final status, headers, and content coding.
+ * Informational responses written with `writeContinue` or `writeEarlyHints` are
+ * sent directly and are not signed.
+ */
+declare function createResponseSigningMiddleware(profile: HttpSignaturesProfile, options?: ResponseSigningMiddlewareOptions): NodeMiddleware;
+
 /**
  * Creates an IdentityManager with Node.js DNS and HTTPS defaults.
  *
@@ -150,4 +174,4 @@ declare function createNodeIdentityManagerFromFile(filePath: string, overlay?: L
 /** `RegistryClient` from `DNSID_REGISTRY_URL` and `DNSID_API_KEY`; explicit options win, including transport overrides. The constructor defaults to the local registry. */
 declare function createRegistryClientFromEnvironment(env?: EnvironmentSource, options?: RegistryClientOptions): Promise<RegistryClient>;
 
-export { type EnvironmentSource, type KeySource, type LoadedConfig, type LoadedDnsidConfig, type LoadedRegistryConfig, type LocalKeyAlgorithm, LocalKeyProvider, type LogTrust, type ManagedRegistrationConfig, constructIdentityManager, createNodeIdentityManager, createNodeIdentityManagerFromDnsid, createNodeIdentityManagerFromEnvironment, createNodeIdentityManagerFromFile, createNodeIdentityVerifier, createRegistryClientFromEnvironment, loadCliDirectory, loadEnvironment, loadFile, mergeLoadedConfig };
+export { type EnvironmentSource, type KeySource, type LoadedConfig, type LoadedDnsidConfig, type LoadedRegistryConfig, type LocalKeyAlgorithm, LocalKeyProvider, type LogTrust, type ManagedRegistrationConfig, type NodeMiddleware, type ResponseSigningMiddlewareOptions, constructIdentityManager, createNodeIdentityManager, createNodeIdentityManagerFromDnsid, createNodeIdentityManagerFromEnvironment, createNodeIdentityManagerFromFile, createNodeIdentityVerifier, createRegistryClientFromEnvironment, createResponseSigningMiddleware, loadCliDirectory, loadEnvironment, loadFile, mergeLoadedConfig };

package/dist/node.d.ts

@@ -1,9 +1,10 @@
 export { CreateIdentityManagerDependencies } from './index.js';
 import * as _dnsid_ai_protocol from '@dnsid-ai/protocol';
 import { KeyProvider, DnsIdJWK, DnsidConfig, IdentityManagerDependencies, IdentityManager, IdentityConfig } from '@dnsid-ai/protocol';
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { HttpSignaturesProfile } from '@dnsid-ai/http-signatures';
 import { RegistryClientOptions, RegistryClient } from '@dnsid-ai/registry';
 import '@dnsid-ai/jose';
-import '@dnsid-ai/http-signatures';
 import '@dnsid-ai/web-bot-auth';
 
 type LocalKeyAlgorithm = 'EdDSA' | 'ES256';
@@ -45,6 +46,29 @@ declare class LocalKeyProvider implements KeyProvider {
     private mutate;
 }
 
+/** Options for {@link createResponseSigningMiddleware}. */
+interface ResponseSigningMiddlewareOptions {
+    /**
+     * Public origin the client used, such as `https://bob.test`. Set it behind a
+     * TLS-terminating proxy. Default: the socket's scheme and the Host header.
+     */
+    origin?: string;
+}
+/** Connect-style middleware, usable with Express, Connect, or a plain `node:http` handler. */
+type NodeMiddleware = (req: IncomingMessage, res: ServerResponse, next: (err?: unknown) => void) => void;
+/**
+ * Signs responses to requests that carry Accept-Signature, for `node:http` servers.
+ * Requests without negotiation pass through unbuffered. Negotiated responses are
+ * buffered up to 8 MiB and signed with `signRequestedHttpResponse` before any header
+ * is sent. On a signing failure, an exceeded bound, or a `flushHeaders()` call
+ * (streaming, such as SSE) it sends an empty 500; it never sends the unsigned
+ * response. Register it before request verification, compression, and handlers
+ * so that it sees their final status, headers, and content coding.
+ * Informational responses written with `writeContinue` or `writeEarlyHints` are
+ * sent directly and are not signed.
+ */
+declare function createResponseSigningMiddleware(profile: HttpSignaturesProfile, options?: ResponseSigningMiddlewareOptions): NodeMiddleware;
+
 /**
  * Creates an IdentityManager with Node.js DNS and HTTPS defaults.
  *
@@ -150,4 +174,4 @@ declare function createNodeIdentityManagerFromFile(filePath: string, overlay?: L
 /** `RegistryClient` from `DNSID_REGISTRY_URL` and `DNSID_API_KEY`; explicit options win, including transport overrides. The constructor defaults to the local registry. */
 declare function createRegistryClientFromEnvironment(env?: EnvironmentSource, options?: RegistryClientOptions): Promise<RegistryClient>;
 
-export { type EnvironmentSource, type KeySource, type LoadedConfig, type LoadedDnsidConfig, type LoadedRegistryConfig, type LocalKeyAlgorithm, LocalKeyProvider, type LogTrust, type ManagedRegistrationConfig, constructIdentityManager, createNodeIdentityManager, createNodeIdentityManagerFromDnsid, createNodeIdentityManagerFromEnvironment, createNodeIdentityManagerFromFile, createNodeIdentityVerifier, createRegistryClientFromEnvironment, loadCliDirectory, loadEnvironment, loadFile, mergeLoadedConfig };
+export { type EnvironmentSource, type KeySource, type LoadedConfig, type LoadedDnsidConfig, type LoadedRegistryConfig, type LocalKeyAlgorithm, LocalKeyProvider, type LogTrust, type ManagedRegistrationConfig, type NodeMiddleware, type ResponseSigningMiddlewareOptions, constructIdentityManager, createNodeIdentityManager, createNodeIdentityManagerFromDnsid, createNodeIdentityManagerFromEnvironment, createNodeIdentityManagerFromFile, createNodeIdentityVerifier, createRegistryClientFromEnvironment, createResponseSigningMiddleware, loadCliDirectory, loadEnvironment, loadFile, mergeLoadedConfig };

package/dist/node.js

@@ -274,6 +274,124 @@ async function importPrivateKey(key) {
   );
 }
 
+// src/node-response-signing.ts
+var MAX_BUFFERED_BYTES = 8 * 1024 * 1024;
+var SIGNED_FIELDS = ["content-digest", "cache-control", "signature-input", "signature"];
+function createResponseSigningMiddleware(profile, options = {}) {
+  return (req, res, next) => {
+    if (req.headers["accept-signature"] === void 0) return next();
+    if (res.headersSent) return next(new Error("response headers already sent; register response signing first"));
+    const writeHead = res.writeHead.bind(res);
+    const end = res.end.bind(res);
+    const chunks = [];
+    let size = 0;
+    let overflow = false;
+    let ended = false;
+    let done = false;
+    let releasing = false;
+    const collect = (chunk, encoding) => {
+      if (chunk === void 0 || chunk === null || typeof chunk === "function") return true;
+      const bytes = typeof chunk === "string" ? Buffer.from(chunk, typeof encoding === "string" ? encoding : "utf8") : Buffer.from(chunk);
+      size += bytes.length;
+      if (size > MAX_BUFFERED_BYTES) {
+        overflow = true;
+        chunks.length = 0;
+        return false;
+      }
+      chunks.push(bytes);
+      return true;
+    };
+    const send = (body) => {
+      done = true;
+      releasing = true;
+      end(body);
+    };
+    const fail = () => {
+      if (done) return;
+      for (const name of res.getHeaderNames()) res.removeHeader(name);
+      res.statusCode = 500;
+      send();
+    };
+    res.writeHead = ((status, ...args) => {
+      if (releasing) return writeHead(status);
+      res.statusCode = status;
+      if (typeof args[0] === "string") res.statusMessage = args.shift();
+      setHeaders(res, args[0]);
+      return res;
+    });
+    res.flushHeaders = () => fail();
+    res.write = ((chunk, encoding, callback) => {
+      const cb = typeof encoding === "function" ? encoding : callback;
+      if (ended || done || !collect(chunk, encoding)) {
+        if (typeof cb === "function") process.nextTick(cb, new Error("response not writable"));
+        return false;
+      }
+      if (typeof cb === "function") process.nextTick(cb);
+      return true;
+    });
+    res.end = ((chunk, encoding, callback) => {
+      if (ended || done) return res;
+      ended = true;
+      const cb = [chunk, encoding, callback].find((arg) => typeof arg === "function");
+      if (typeof cb === "function") res.once("finish", cb);
+      collect(chunk, encoding);
+      void release();
+      return res;
+    });
+    async function release() {
+      if (done) return;
+      if (overflow) return fail();
+      try {
+        const noContent = req.method === "HEAD" || [204, 205, 304].includes(res.statusCode);
+        const body = Buffer.concat(chunks);
+        const signed = await profile.signRequestedHttpResponse(
+          toRequest(req, options.origin),
+          new Response(noContent ? null : body, { status: res.statusCode, headers: toHeaders(res.getHeaders()) })
+        );
+        if (done) return;
+        for (const name of SIGNED_FIELDS) {
+          const value = signed.headers.get(name);
+          if (value !== null) res.setHeader(name, value);
+        }
+        send(noContent ? void 0 : body);
+      } catch {
+        fail();
+      }
+    }
+    next();
+  };
+}
+function toRequest(req, origin) {
+  const path3 = req.originalUrl ?? req.url ?? "";
+  if (!path3.startsWith("/")) throw new Error("only origin-form request targets can be signed");
+  const scheme = req.socket.encrypted ? "https" : "http";
+  const base = origin ?? `${scheme}://${req.headers.host ?? ""}`;
+  return new Request(`${new URL(base).origin}${path3}`, { method: req.method, headers: toHeaders(req.headers) });
+}
+function toHeaders(fields) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(fields)) {
+    for (const item of Array.isArray(value) ? value : [value]) {
+      if (item !== void 0) headers.append(name, String(item));
+    }
+  }
+  return headers;
+}
+function setHeaders(res, headers) {
+  if (Array.isArray(headers)) {
+    const grouped = /* @__PURE__ */ new Map();
+    for (let i = 0; i + 1 < headers.length; i += 2) {
+      const name = String(headers[i]).toLowerCase();
+      grouped.set(name, [...grouped.get(name) ?? [], String(headers[i + 1])]);
+    }
+    for (const [name, values] of grouped) res.setHeader(name, values);
+  } else if (typeof headers === "object" && headers !== null) {
+    for (const [name, value] of Object.entries(headers)) {
+      if (value !== void 0) res.setHeader(name, value);
+    }
+  }
+}
+
 // src/node-identity-manager.ts
 import { IdentityManager, ArgumentError as ArgumentError2, validateDnsidConfig } from "@dnsid-ai/protocol";
 async function createNodeIdentityManager(config, deps = {}) {
@@ -699,6 +817,7 @@ export {
   createNodeIdentityManagerFromFile,
   createNodeIdentityVerifier,
   createRegistryClientFromEnvironment,
+  createResponseSigningMiddleware,
   loadCliDirectory,
   loadEnvironment,
   loadFile,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dnsid-ai/sdk",
   "author": "Known Systems AI, Inc.",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Runtime-neutral DNSid SDK entrypoint with optional Node.js convenience helpers.",
   "type": "module",
   "types": "./dist/index.d.ts",
@@ -42,16 +42,16 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@dnsid-ai/protocol": "^0.32.0",
-    "@dnsid-ai/http-signatures": "^0.32.0",
-    "@dnsid-ai/jose": "^0.32.0",
-    "@dnsid-ai/log-c2sp-tlog": "^0.32.0",
-    "@dnsid-ai/registry": "^0.32.0",
-    "@dnsid-ai/web-bot-auth": "^0.32.0"
+    "@dnsid-ai/protocol": "^0.33.0",
+    "@dnsid-ai/http-signatures": "^0.33.0",
+    "@dnsid-ai/jose": "^0.33.0",
+    "@dnsid-ai/log-c2sp-tlog": "^0.33.0",
+    "@dnsid-ai/registry": "^0.33.0",
+    "@dnsid-ai/web-bot-auth": "^0.33.0"
   },
   "peerDependencies": {
-    "@dnsid-ai/key-aws": "^0.32.0",
-    "@dnsid-ai/transport": "^0.32.0"
+    "@dnsid-ai/key-aws": "^0.33.0",
+    "@dnsid-ai/transport": "^0.33.0"
   },
   "peerDependenciesMeta": {
     "@dnsid-ai/key-aws": {