@drm3/sdk 0.1.2

package/dist/alerts.global.js

@@ -0,0 +1,206 @@
+"use strict";
+var drm3Alerts = (() => {
+  var __defProp = Object.defineProperty;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, { get: all[name], enumerable: true });
+  };
+  var __copyProps = (to, from, except, desc) => {
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (let key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(to, key) && key !== except)
+          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    }
+    return to;
+  };
+  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+  // src/alerts.ts
+  var alerts_exports = {};
+  __export(alerts_exports, {
+    fetchAlerts: () => fetchAlerts,
+    mountAlertsBell: () => mountAlertsBell
+  });
+
+  // src/alerts-fetch.ts
+  var DEFAULT_HUB = "https://drm3.network";
+  function esc(s) {
+    return String(s).replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+  }
+  function safeLink(link) {
+    const l = String(link || "");
+    return /^https?:\/\//i.test(l) || l.startsWith("/") ? l : "";
+  }
+  function timeAgo(iso) {
+    if (!iso) return "";
+    const t = new Date(iso).getTime();
+    if (Number.isNaN(t)) return "";
+    const s = Math.max(0, (Date.now() - t) / 1e3);
+    if (s < 60) return "just now";
+    if (s < 3600) return `${Math.floor(s / 60)}m ago`;
+    if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
+    return `${Math.floor(s / 86400)}d ago`;
+  }
+  function sortNewest(list) {
+    return [...list].sort((a, b) => String(b.created_at || "").localeCompare(String(a.created_at || "")));
+  }
+  function hubOf(opts) {
+    return (opts.hub || DEFAULT_HUB).replace(/\/+$/, "");
+  }
+  async function fetchAlerts(opts = {}) {
+    try {
+      const r = await fetch(`${hubOf(opts)}/api/sso/alerts`, {
+        credentials: "include",
+        headers: opts.ssoToken ? { authorization: `Bearer ${opts.ssoToken}` } : void 0
+      });
+      if (!r.ok) return null;
+      const d = await r.json();
+      if (!Array.isArray(d.alerts)) return null;
+      const unread = typeof d.unread === "number" ? d.unread : d.alerts.filter((a) => !a.read).length;
+      return { alerts: d.alerts, unread };
+    } catch {
+      return null;
+    }
+  }
+
+  // src/alerts-styles.ts
+  var KIND_DOTS = {
+    info: "#60a5fa",
+    success: "#4ade80",
+    warning: "#fbbf24",
+    critical: "#f87171"
+  };
+  var BELL_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M6 8a6 6 0 0 1 12 0c0 7 3 9 3 9H3s3-2 3-9"/><path d="M10.3 21a1.94 1.94 0 0 0 3.4 0"/></svg>`;
+  function injectStyles() {
+    if (typeof document === "undefined" || document.getElementById("drm3al-css")) return;
+    const s = document.createElement("style");
+    s.id = "drm3al-css";
+    s.textContent = `
+.drm3al{position:relative;display:inline-block;font-family:ui-sans-serif,system-ui,sans-serif}
+.drm3al-btn{position:relative;display:grid;place-items:center;width:38px;height:38px;border:0;border-radius:10px;
+  background:transparent;color:inherit;cursor:pointer;opacity:.8}
+.drm3al-btn:hover{opacity:1;background:rgba(127,127,127,.12)}
+.drm3al-btn svg{width:20px;height:20px}
+.drm3al-badge{position:absolute;top:2px;right:2px;min-width:16px;height:16px;padding:0 4px;border-radius:999px;
+  background:#dc2626;color:#fff;font-size:10px;font-weight:700;line-height:16px;text-align:center;pointer-events:none}
+.drm3al-panel{position:absolute;right:0;top:46px;width:340px;max-height:70vh;overflow-y:auto;z-index:9999;
+  background:#0f1318;border:1px solid #1c2530;border-radius:14px;box-shadow:0 18px 50px rgba(0,0,0,.5);
+  display:none;color:#f2f6fa;text-align:left}
+.drm3al[data-open="1"] .drm3al-panel{display:block}
+.drm3al-h{padding:12px 14px 6px;font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.08em;color:#9fb1c4}
+.drm3al-list{padding:0 6px 6px}
+.drm3al-row{display:flex;gap:10px;align-items:flex-start;padding:10px 8px;border-radius:10px;text-decoration:none;color:inherit}
+.drm3al-row+.drm3al-row{margin-top:2px}
+a.drm3al-row:hover{background:#161e28}
+.drm3al-unread{background:rgba(96,165,250,.08)}
+.drm3al-dot{flex:none;width:8px;height:8px;border-radius:50%;margin-top:5px}
+.drm3al-c{flex:1;min-width:0}
+.drm3al-t{font-size:13px;font-weight:600;color:#f2f6fa;line-height:1.35;word-break:break-word}
+.drm3al-b{font-size:12px;color:#9fb1c4;line-height:1.45;margin-top:2px;word-break:break-word}
+.drm3al-ago{font-size:11px;color:#9fb1c4;margin-top:3px}
+.drm3al-empty{padding:18px 14px 22px;color:#9fb1c4;font-size:12px}
+.drm3al-foot{padding:10px 14px;border-top:1px solid #1c2530}
+.drm3al-foot a{color:#7aa7d6;font-size:12px;text-decoration:none}
+.drm3al-foot a:hover{text-decoration:underline}
+@media (max-width:479px){.drm3al-panel{position:fixed;left:10px;right:10px;top:64px;width:auto;max-height:calc(100vh - 84px)}}`;
+    document.head.appendChild(s);
+  }
+
+  // src/alerts-bell.ts
+  function mountAlertsBell(target, opts = {}) {
+    if (!target || typeof document === "undefined") return;
+    if (opts.authed === false) {
+      target.replaceChildren();
+      return;
+    }
+    void fetchAlerts(opts).then((d) => {
+      if (d) buildBell(target, opts, d);
+      else target.replaceChildren();
+    });
+  }
+  function buildBell(target, opts, initial) {
+    injectStyles();
+    const hub = hubOf(opts);
+    target.classList.add("drm3al");
+    target.innerHTML = `<button class="drm3al-btn" type="button" aria-label="Alerts" aria-haspopup="true" aria-expanded="false">${BELL_SVG}<span class="drm3al-badge" hidden></span></button>
+<div class="drm3al-panel" role="menu" aria-label="Alerts">
+  <div class="drm3al-h">Alerts</div>
+  <div class="drm3al-list"></div>
+  <div class="drm3al-foot"><a href="${esc(hub)}/account?tab=alerts">All alerts &rarr;</a></div>
+</div>`;
+    const btn = target.querySelector(".drm3al-btn");
+    const badge = target.querySelector(".drm3al-badge");
+    const list = target.querySelector(".drm3al-list");
+    let alerts = sortNewest(initial.alerts);
+    const setUnread = (n) => {
+      badge.hidden = n <= 0;
+      badge.textContent = n > 9 ? "9+" : String(n);
+      opts.onCount?.(n);
+    };
+    const row = (a) => {
+      const dot = KIND_DOTS[a.kind] || KIND_DOTS.info;
+      const link = safeLink(a.link);
+      const body = a.body ? `<div class="drm3al-b">${esc(a.body)}</div>` : "";
+      const inner = `<span class="drm3al-dot" style="background:${dot}"></span><div class="drm3al-c"><div class="drm3al-t">${esc(a.title || "")}</div>${body}<div class="drm3al-ago">${esc(timeAgo(a.created_at))}</div></div>`;
+      const cls = `drm3al-row${a.read ? "" : " drm3al-unread"}`;
+      return link ? `<a class="${cls}" href="${esc(link)}">${inner}</a>` : `<div class="${cls}">${inner}</div>`;
+    };
+    const render = () => {
+      list.innerHTML = alerts.length ? alerts.map(row).join("") : `<div class="drm3al-empty">No alerts.</div>`;
+    };
+    const refresh = async () => {
+      const d = await fetchAlerts(opts);
+      if (!d) return;
+      alerts = sortNewest(d.alerts);
+      setUnread(d.unread);
+      if (target.getAttribute("data-open") === "1") render();
+    };
+    const markAllRead = async () => {
+      try {
+        await fetch(`${hub}/api/sso/alerts/read`, {
+          method: "POST",
+          credentials: "include",
+          headers: { "content-type": "application/json", ...opts.ssoToken ? { authorization: `Bearer ${opts.ssoToken}` } : {} },
+          body: JSON.stringify({ all: true })
+        });
+      } catch {
+      }
+    };
+    const close = () => {
+      target.removeAttribute("data-open");
+      btn.setAttribute("aria-expanded", "false");
+    };
+    const open = async () => {
+      target.setAttribute("data-open", "1");
+      btn.setAttribute("aria-expanded", "true");
+      render();
+      const d = await fetchAlerts(opts);
+      if (d) {
+        alerts = sortNewest(d.alerts);
+        render();
+      }
+      void markAllRead();
+      setUnread(0);
+      for (const a of alerts) a.read = true;
+    };
+    btn.addEventListener("click", (e) => {
+      e.stopPropagation();
+      if (target.getAttribute("data-open") === "1") return close();
+      void open();
+    });
+    document.addEventListener("click", (e) => {
+      if (!target.contains(e.target)) close();
+    });
+    document.addEventListener("keydown", (e) => {
+      if (e.key === "Escape") close();
+    });
+    setUnread(initial.unread);
+    render();
+    const pollMs = opts.pollMs ?? 12e4;
+    if (pollMs > 0) setInterval(() => void refresh(), pollMs);
+  }
+  return __toCommonJS(alerts_exports);
+})();

package/dist/alerts.global.text.js

@@ -0,0 +1,2 @@
+// AUTO-GENERATED by scripts/wrap-text.mjs from dist/alerts.global.js - do not edit.
+export default "\"use strict\";\nvar drm3Alerts = (() => {\n  var __defProp = Object.defineProperty;\n  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;\n  var __getOwnPropNames = Object.getOwnPropertyNames;\n  var __hasOwnProp = Object.prototype.hasOwnProperty;\n  var __export = (target, all) => {\n    for (var name in all)\n      __defProp(target, name, { get: all[name], enumerable: true });\n  };\n  var __copyProps = (to, from, except, desc) => {\n    if (from && typeof from === \"object\" || typeof from === \"function\") {\n      for (let key of __getOwnPropNames(from))\n        if (!__hasOwnProp.call(to, key) && key !== except)\n          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });\n    }\n    return to;\n  };\n  var __toCommonJS = (mod) => __copyProps(__defProp({}, \"__esModule\", { value: true }), mod);\n\n  // src/alerts.ts\n  var alerts_exports = {};\n  __export(alerts_exports, {\n    fetchAlerts: () => fetchAlerts,\n    mountAlertsBell: () => mountAlertsBell\n  });\n\n  // src/alerts-fetch.ts\n  var DEFAULT_HUB = \"https://drm3.network\";\n  function esc(s) {\n    return String(s).replace(/[&<>\"]/g, (c) => ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\" })[c]);\n  }\n  function safeLink(link) {\n    const l = String(link || \"\");\n    return /^https?:\\/\\//i.test(l) || l.startsWith(\"/\") ? l : \"\";\n  }\n  function timeAgo(iso) {\n    if (!iso) return \"\";\n    const t = new Date(iso).getTime();\n    if (Number.isNaN(t)) return \"\";\n    const s = Math.max(0, (Date.now() - t) / 1e3);\n    if (s < 60) return \"just now\";\n    if (s < 3600) return `${Math.floor(s / 60)}m ago`;\n    if (s < 86400) return `${Math.floor(s / 3600)}h ago`;\n    return `${Math.floor(s / 86400)}d ago`;\n  }\n  function sortNewest(list) {\n    return [...list].sort((a, b) => String(b.created_at || \"\").localeCompare(String(a.created_at || \"\")));\n  }\n  function hubOf(opts) {\n    return (opts.hub || DEFAULT_HUB).replace(/\\/+$/, \"\");\n  }\n  async function fetchAlerts(opts = {}) {\n    try {\n      const r = await fetch(`${hubOf(opts)}/api/sso/alerts`, {\n        credentials: \"include\",\n        headers: opts.ssoToken ? { authorization: `Bearer ${opts.ssoToken}` } : void 0\n      });\n      if (!r.ok) return null;\n      const d = await r.json();\n      if (!Array.isArray(d.alerts)) return null;\n      const unread = typeof d.unread === \"number\" ? d.unread : d.alerts.filter((a) => !a.read).length;\n      return { alerts: d.alerts, unread };\n    } catch {\n      return null;\n    }\n  }\n\n  // src/alerts-styles.ts\n  var KIND_DOTS = {\n    info: \"#60a5fa\",\n    success: \"#4ade80\",\n    warning: \"#fbbf24\",\n    critical: \"#f87171\"\n  };\n  var BELL_SVG = `<svg viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M6 8a6 6 0 0 1 12 0c0 7 3 9 3 9H3s3-2 3-9\"/><path d=\"M10.3 21a1.94 1.94 0 0 0 3.4 0\"/></svg>`;\n  function injectStyles() {\n    if (typeof document === \"undefined\" || document.getElementById(\"drm3al-css\")) return;\n    const s = document.createElement(\"style\");\n    s.id = \"drm3al-css\";\n    s.textContent = `\n.drm3al{position:relative;display:inline-block;font-family:ui-sans-serif,system-ui,sans-serif}\n.drm3al-btn{position:relative;display:grid;place-items:center;width:38px;height:38px;border:0;border-radius:10px;\n  background:transparent;color:inherit;cursor:pointer;opacity:.8}\n.drm3al-btn:hover{opacity:1;background:rgba(127,127,127,.12)}\n.drm3al-btn svg{width:20px;height:20px}\n.drm3al-badge{position:absolute;top:2px;right:2px;min-width:16px;height:16px;padding:0 4px;border-radius:999px;\n  background:#dc2626;color:#fff;font-size:10px;font-weight:700;line-height:16px;text-align:center;pointer-events:none}\n.drm3al-panel{position:absolute;right:0;top:46px;width:340px;max-height:70vh;overflow-y:auto;z-index:9999;\n  background:#0f1318;border:1px solid #1c2530;border-radius:14px;box-shadow:0 18px 50px rgba(0,0,0,.5);\n  display:none;color:#f2f6fa;text-align:left}\n.drm3al[data-open=\"1\"] .drm3al-panel{display:block}\n.drm3al-h{padding:12px 14px 6px;font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.08em;color:#9fb1c4}\n.drm3al-list{padding:0 6px 6px}\n.drm3al-row{display:flex;gap:10px;align-items:flex-start;padding:10px 8px;border-radius:10px;text-decoration:none;color:inherit}\n.drm3al-row+.drm3al-row{margin-top:2px}\na.drm3al-row:hover{background:#161e28}\n.drm3al-unread{background:rgba(96,165,250,.08)}\n.drm3al-dot{flex:none;width:8px;height:8px;border-radius:50%;margin-top:5px}\n.drm3al-c{flex:1;min-width:0}\n.drm3al-t{font-size:13px;font-weight:600;color:#f2f6fa;line-height:1.35;word-break:break-word}\n.drm3al-b{font-size:12px;color:#9fb1c4;line-height:1.45;margin-top:2px;word-break:break-word}\n.drm3al-ago{font-size:11px;color:#9fb1c4;margin-top:3px}\n.drm3al-empty{padding:18px 14px 22px;color:#9fb1c4;font-size:12px}\n.drm3al-foot{padding:10px 14px;border-top:1px solid #1c2530}\n.drm3al-foot a{color:#7aa7d6;font-size:12px;text-decoration:none}\n.drm3al-foot a:hover{text-decoration:underline}\n@media (max-width:479px){.drm3al-panel{position:fixed;left:10px;right:10px;top:64px;width:auto;max-height:calc(100vh - 84px)}}`;\n    document.head.appendChild(s);\n  }\n\n  // src/alerts-bell.ts\n  function mountAlertsBell(target, opts = {}) {\n    if (!target || typeof document === \"undefined\") return;\n    if (opts.authed === false) {\n      target.replaceChildren();\n      return;\n    }\n    void fetchAlerts(opts).then((d) => {\n      if (d) buildBell(target, opts, d);\n      else target.replaceChildren();\n    });\n  }\n  function buildBell(target, opts, initial) {\n    injectStyles();\n    const hub = hubOf(opts);\n    target.classList.add(\"drm3al\");\n    target.innerHTML = `<button class=\"drm3al-btn\" type=\"button\" aria-label=\"Alerts\" aria-haspopup=\"true\" aria-expanded=\"false\">${BELL_SVG}<span class=\"drm3al-badge\" hidden></span></button>\n<div class=\"drm3al-panel\" role=\"menu\" aria-label=\"Alerts\">\n  <div class=\"drm3al-h\">Alerts</div>\n  <div class=\"drm3al-list\"></div>\n  <div class=\"drm3al-foot\"><a href=\"${esc(hub)}/account?tab=alerts\">All alerts &rarr;</a></div>\n</div>`;\n    const btn = target.querySelector(\".drm3al-btn\");\n    const badge = target.querySelector(\".drm3al-badge\");\n    const list = target.querySelector(\".drm3al-list\");\n    let alerts = sortNewest(initial.alerts);\n    const setUnread = (n) => {\n      badge.hidden = n <= 0;\n      badge.textContent = n > 9 ? \"9+\" : String(n);\n      opts.onCount?.(n);\n    };\n    const row = (a) => {\n      const dot = KIND_DOTS[a.kind] || KIND_DOTS.info;\n      const link = safeLink(a.link);\n      const body = a.body ? `<div class=\"drm3al-b\">${esc(a.body)}</div>` : \"\";\n      const inner = `<span class=\"drm3al-dot\" style=\"background:${dot}\"></span><div class=\"drm3al-c\"><div class=\"drm3al-t\">${esc(a.title || \"\")}</div>${body}<div class=\"drm3al-ago\">${esc(timeAgo(a.created_at))}</div></div>`;\n      const cls = `drm3al-row${a.read ? \"\" : \" drm3al-unread\"}`;\n      return link ? `<a class=\"${cls}\" href=\"${esc(link)}\">${inner}</a>` : `<div class=\"${cls}\">${inner}</div>`;\n    };\n    const render = () => {\n      list.innerHTML = alerts.length ? alerts.map(row).join(\"\") : `<div class=\"drm3al-empty\">No alerts.</div>`;\n    };\n    const refresh = async () => {\n      const d = await fetchAlerts(opts);\n      if (!d) return;\n      alerts = sortNewest(d.alerts);\n      setUnread(d.unread);\n      if (target.getAttribute(\"data-open\") === \"1\") render();\n    };\n    const markAllRead = async () => {\n      try {\n        await fetch(`${hub}/api/sso/alerts/read`, {\n          method: \"POST\",\n          credentials: \"include\",\n          headers: { \"content-type\": \"application/json\", ...opts.ssoToken ? { authorization: `Bearer ${opts.ssoToken}` } : {} },\n          body: JSON.stringify({ all: true })\n        });\n      } catch {\n      }\n    };\n    const close = () => {\n      target.removeAttribute(\"data-open\");\n      btn.setAttribute(\"aria-expanded\", \"false\");\n    };\n    const open = async () => {\n      target.setAttribute(\"data-open\", \"1\");\n      btn.setAttribute(\"aria-expanded\", \"true\");\n      render();\n      const d = await fetchAlerts(opts);\n      if (d) {\n        alerts = sortNewest(d.alerts);\n        render();\n      }\n      void markAllRead();\n      setUnread(0);\n      for (const a of alerts) a.read = true;\n    };\n    btn.addEventListener(\"click\", (e) => {\n      e.stopPropagation();\n      if (target.getAttribute(\"data-open\") === \"1\") return close();\n      void open();\n    });\n    document.addEventListener(\"click\", (e) => {\n      if (!target.contains(e.target)) close();\n    });\n    document.addEventListener(\"keydown\", (e) => {\n      if (e.key === \"Escape\") close();\n    });\n    setUnread(initial.unread);\n    render();\n    const pollMs = opts.pollMs ?? 12e4;\n    if (pollMs > 0) setInterval(() => void refresh(), pollMs);\n  }\n  return __toCommonJS(alerts_exports);\n})();\n";

package/dist/alerts.js

@@ -0,0 +1,21 @@
+// @drm3/sdk/alerts - the DRM3 cross-app alerts bell, as a one-call drop-in.
+//
+//   import { mountAlertsBell } from "@drm3/sdk/alerts";
+//   mountAlertsBell(document.getElementById("drm3-alerts"));
+//
+// Framework-agnostic, zero deps. Injects its own scoped styles (.drm3al* namespace)
+// and renders a bell with an unread badge plus a dropdown feed of the signed-in
+// user's platform alerts from the DRM3 account hub. Opening the panel acknowledges
+// the feed (POST /api/sso/alerts/read) and clears the badge.
+//
+// Signed-in-only, fail closed: when the feed is not readable (no session, a 401, a
+// network failure) NOTHING is rendered, the same posture as the app switcher.
+//
+// Self-contained by design (zero internal imports beyond the ./alerts-* siblings) so
+// it bundles to a tiny standalone browser global. This is a thin barrel: the
+// implementation lives in ./alerts-fetch (feed client + helpers), ./alerts-bell (the
+// bell UI), and ./alerts-styles (injected CSS + SVG). The browser build runs
+// `esbuild src/alerts.ts`, which bundles all three transitively.
+export { fetchAlerts } from "./alerts-fetch.js";
+export { mountAlertsBell } from "./alerts-bell.js";
+//# sourceMappingURL=alerts.js.map

package/dist/alerts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.js","sourceRoot":"","sources":["../src/alerts.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,wDAAwD;AACxD,6DAA6D;AAC7D,EAAE;AACF,oFAAoF;AACpF,gFAAgF;AAChF,mFAAmF;AACnF,6DAA6D;AAC7D,EAAE;AACF,mFAAmF;AACnF,8EAA8E;AAC9E,EAAE;AACF,qFAAqF;AACrF,6EAA6E;AAC7E,qFAAqF;AACrF,6EAA6E;AAC7E,iEAAiE;AACjE,OAAO,EAAsC,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,64 @@
+export declare const ACCOUNT_HUB = "https://drm3.network";
+export declare const STATUS_HUB = "https://status.drm3.network";
+/** A DRM3 network app, as published by the canonical SKU registry on status.drm3.network. */
+export interface DRM3App {
+    id: string;
+    name: string;
+    url: string;
+    tagline?: string;
+    /** Brand accent (hex) used by the switcher tile gradient. */
+    color?: string;
+    /** Live rollup of the app's health: "up" | "degraded" | "down" | "unknown". */
+    health?: "up" | "degraded" | "down" | "unknown";
+}
+/** Live credit balance for the signed-in user, as returned by /api/sso/balance. */
+export interface DRM3Balance {
+    available: number;
+    credits: number;
+}
+/** Send the user to the DRM3 account hub to sign in, returning here afterward. */
+export declare function signInUrl(returnTo?: string): string;
+/** Sign the user out of DRM3 everywhere, returning here afterward. */
+export declare function signOutUrl(returnTo?: string): string;
+/** Deep-link to the user's DRM3 account hub (credits, keys, apps, activity). */
+export declare function accountUrl(): string;
+/**
+ * The canonical DRM3 app catalog with live health, from status.drm3.network.
+ * Single source of truth - the same list the account hub and every switcher render.
+ */
+export declare function fetchApps(): Promise<DRM3App[]>;
+/**
+ * The signed-in user's live DRM3 credit balance.
+ * Pass the `drm3_sso` token (Bearer) if you have it; otherwise the hub reads the cookie.
+ * Returns null when not signed in or the hub is unreachable - never throws.
+ */
+export declare function fetchBalance(ssoToken?: string): Promise<DRM3Balance | null>;
+/** Result of an app-namespaced Data Passport write. Never thrown - inspect `.ok`. */
+export interface PassportWriteResult {
+    ok: boolean;
+    /** The full stored key on success, e.g. `app.<clientId>.<slug>`. */
+    key?: string;
+    /** Human-readable reason on failure (HTTP status or the hub's error message). */
+    error?: string;
+}
+/**
+ * Read the audience (the app's client id) out of a passport token without verifying it.
+ * The hub re-verifies on every call - this is only used to namespace the write key locally.
+ */
+export declare function passportAudience(passportToken: string): string | null;
+/**
+ * Write one field into the user's Data Passport, in YOUR app's namespace.
+ *
+ * The app holds an audience-bound passport token (scope `app:write`, granted at the hub's consent
+ * flow). Pass a bare `slug` ([a-z0-9_], <=40 chars) and it is namespaced automatically to
+ * `app.<yourClientId>.<slug>` (the client id is read from the token); pass an already-qualified
+ * `app.<id>.<slug>` key and it is sent as-is. `value` is any JSON-serialisable value
+ * (<=4KB stringified). Never throws - inspect `.ok`/`.error`.
+ *
+ *   await appWrite(token, "favorite_topic", "ai-policy");
+ */
+export declare function appWrite(passportToken: string, slug: string, value: unknown): Promise<PassportWriteResult>;
+export { verifySsoToken, verifyActiveSsoToken, mintSsoToken, readSsoCookie, createRevocationGate, type SsoClaims, type RevocationGate, type RevocationFeed, } from "./sso/index.js";
+/** The hub's revocation feed URL - pass to createRevocationGate(). */
+export declare const REVOCATIONS_URL = "https://drm3.network/api/sso/revocations";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,WAAW,yBAAyB,CAAC;AAClD,eAAO,MAAM,UAAU,gCAAgC,CAAC;AAExD,6FAA6F;AAC7F,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,MAAM,CAAC,EAAE,IAAI,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;CACjD;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,QAAQ,GAAE,MAAqB,GAAG,MAAM,CAEjE;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,QAAQ,GAAE,MAAqB,GAAG,MAAM,CAElE;AAED,gFAAgF;AAChF,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;;GAGG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CASpD;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAajF;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAarE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAehH;AAUD,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AAExB,sEAAsE;AACtE,eAAO,MAAM,eAAe,6CAAuC,CAAC"}

package/dist/index.js

@@ -0,0 +1,117 @@
+// @drm3/sdk - used to integrate apps with the DRM3 network.
+//
+// Wires DRM3's own apps to shared identity, the user's credit balance, a cross-app switcher, and
+// (server-side) offline SSO-token verification, so each app doesn't re-implement them. Identity is
+// verified offline via @drm3/sdk/sso; everything else is a thin fetch to the DRM3 hubs.
+export const ACCOUNT_HUB = "https://drm3.network";
+export const STATUS_HUB = "https://status.drm3.network";
+/** Send the user to the DRM3 account hub to sign in, returning here afterward. */
+export function signInUrl(returnTo = currentUrl()) {
+    return `${ACCOUNT_HUB}/account?login&next=${encodeURIComponent(returnTo)}`;
+}
+/** Sign the user out of DRM3 everywhere, returning here afterward. */
+export function signOutUrl(returnTo = currentUrl()) {
+    return `${ACCOUNT_HUB}/account/signout?next=${encodeURIComponent(returnTo)}`;
+}
+/** Deep-link to the user's DRM3 account hub (credits, keys, apps, activity). */
+export function accountUrl() {
+    return `${ACCOUNT_HUB}/account`;
+}
+/**
+ * The canonical DRM3 app catalog with live health, from status.drm3.network.
+ * Single source of truth - the same list the account hub and every switcher render.
+ */
+export async function fetchApps() {
+    try {
+        const r = await fetch(`${STATUS_HUB}/api/apps`, { credentials: "omit" });
+        if (!r.ok)
+            return [];
+        const d = (await r.json());
+        return Array.isArray(d.apps) ? d.apps : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The signed-in user's live DRM3 credit balance.
+ * Pass the `drm3_sso` token (Bearer) if you have it; otherwise the hub reads the cookie.
+ * Returns null when not signed in or the hub is unreachable - never throws.
+ */
+export async function fetchBalance(ssoToken) {
+    try {
+        const r = await fetch(`${ACCOUNT_HUB}/api/sso/balance`, {
+            credentials: "include",
+            headers: ssoToken ? { authorization: `Bearer ${ssoToken}` } : undefined,
+        });
+        if (!r.ok)
+            return null;
+        const d = (await r.json());
+        if (typeof d.available !== "number")
+            return null;
+        return { available: d.available, credits: d.credits ?? d.available };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read the audience (the app's client id) out of a passport token without verifying it.
+ * The hub re-verifies on every call - this is only used to namespace the write key locally.
+ */
+export function passportAudience(passportToken) {
+    try {
+        const payload = passportToken.split(".")[1];
+        if (!payload)
+            return null;
+        const b64 = payload
+            .replace(/-/g, "+")
+            .replace(/_/g, "/")
+            .padEnd(Math.ceil(payload.length / 4) * 4, "=");
+        const claims = JSON.parse(atob(b64));
+        return typeof claims.aud === "string" ? claims.aud : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write one field into the user's Data Passport, in YOUR app's namespace.
+ *
+ * The app holds an audience-bound passport token (scope `app:write`, granted at the hub's consent
+ * flow). Pass a bare `slug` ([a-z0-9_], <=40 chars) and it is namespaced automatically to
+ * `app.<yourClientId>.<slug>` (the client id is read from the token); pass an already-qualified
+ * `app.<id>.<slug>` key and it is sent as-is. `value` is any JSON-serialisable value
+ * (<=4KB stringified). Never throws - inspect `.ok`/`.error`.
+ *
+ *   await appWrite(token, "favorite_topic", "ai-policy");
+ */
+export async function appWrite(passportToken, slug, value) {
+    const aud = passportAudience(passportToken);
+    const key = slug.startsWith("app.") || !aud ? slug : `app.${aud}.${slug}`;
+    try {
+        const r = await fetch(`${ACCOUNT_HUB}/api/passport/app-write`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${passportToken}`, "content-type": "application/json" },
+            body: JSON.stringify({ key, value }),
+        });
+        const d = (await r.json().catch(() => ({})));
+        if (!r.ok || d.ok !== true)
+            return { ok: false, error: d.error ?? `HTTP ${r.status}` };
+        return { ok: true, key: d.key ?? key };
+    }
+    catch (e) {
+        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+    }
+}
+function currentUrl() {
+    return typeof location !== "undefined" ? location.href : ACCOUNT_HUB;
+}
+// Re-export the offline SSO verifier so a server app gets identity from one import. Includes the
+// revocation gate: verifyActiveSsoToken() = verify + not-revoked, so a banned account loses access
+// across every app within the cache TTL (~60s) without a per-request call-home. Point a gate at
+// `${ACCOUNT_HUB}/api/sso/revocations`.
+export { verifySsoToken, verifyActiveSsoToken, mintSsoToken, readSsoCookie, createRevocationGate, } from "./sso/index.js";
+/** The hub's revocation feed URL - pass to createRevocationGate(). */
+export const REVOCATIONS_URL = `${ACCOUNT_HUB}/api/sso/revocations`;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,wFAAwF;AAExF,MAAM,CAAC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAClD,MAAM,CAAC,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAoBxD,kFAAkF;AAClF,MAAM,UAAU,SAAS,CAAC,WAAmB,UAAU,EAAE;IACvD,OAAO,GAAG,WAAW,uBAAuB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,WAAmB,UAAU,EAAE;IACxD,OAAO,GAAG,WAAW,yBAAyB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU;IACxB,OAAO,GAAG,WAAW,UAAU,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,WAAW,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAyB,CAAC;QACnD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAiB;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,kBAAkB,EAAE;YACtD,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAyB,CAAC;QACnD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO;aAChB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAsB,CAAC;QAC1D,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,aAAqB,EAAE,IAAY,EAAE,KAAc;IAChF,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,yBAAyB,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,aAAa,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsD,CAAC;QAClG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACvE,CAAC;AAED,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,wCAAwC;AACxC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,oBAAoB,GAIrB,MAAM,gBAAgB,CAAC;AAExB,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,WAAW,sBAAsB,CAAC"}

package/dist/keys-canonical.d.ts

@@ -0,0 +1,7 @@
+export declare function canonicalize(obj: unknown): string;
+export declare function bytesToHex(b: Uint8Array): string;
+export declare function b64(bytes: Uint8Array): string;
+export declare function unb64(s: string): Uint8Array;
+export declare function verifySig(publicKey: string, signature: string, payload: string): Promise<boolean>;
+export declare function signPayload(privateKey: CryptoKey, payload: string): Promise<string>;
+//# sourceMappingURL=keys-canonical.d.ts.map

package/dist/keys-canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-canonical.d.ts","sourceRoot":"","sources":["../src/keys-canonical.ts"],"names":[],"mappings":"AAQA,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMjD;AASD,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAEhD;AACD,wBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI7C;AACD,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAK3C;AAKD,wBAAsB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvG;AACD,wBAAsB,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzF"}

package/dist/keys-canonical.js

@@ -0,0 +1,57 @@
+// DRM3 partner signing keys - byte-for-byte canonicalization plus the low-level
+// Ed25519 / hex / base64 helpers shared by ./keys-generate and ./keys-verify.
+// MOVED verbatim from ./keys: do NOT change any byte order, constant, or check.
+//
+// Framework-agnostic, zero deps: stdlib WebCrypto (Ed25519) only.
+// ── canonicalization (byte-for-byte the provenance discipline: recursively sorted keys,
+//    compact separators, UTF-8) - deliberately duplicated, pinned by test ──
+export function canonicalize(obj) {
+    if (obj === null || typeof obj !== "object")
+        return JSON.stringify(obj);
+    if (Array.isArray(obj))
+        return `[${obj.map(canonicalize).join(",")}]`;
+    const keys = Object.keys(obj).sort();
+    const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`);
+    return `{${parts.join(",")}}`;
+}
+const enc = new TextEncoder();
+function hexToBytes(hex) {
+    const clean = hex.replace(/^ed25519:/, "");
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    return out;
+}
+export function bytesToHex(b) {
+    return [...b].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+export function b64(bytes) {
+    let s = "";
+    for (const x of bytes)
+        s += String.fromCharCode(x);
+    return btoa(s);
+}
+export function unb64(s) {
+    const raw = atob(s);
+    const out = new Uint8Array(raw.length);
+    for (let i = 0; i < raw.length; i++)
+        out[i] = raw.charCodeAt(i);
+    return out;
+}
+async function importVerifyKey(publicKey) {
+    return crypto.subtle.importKey("raw", hexToBytes(publicKey), { name: "Ed25519" }, false, ["verify"]);
+}
+export async function verifySig(publicKey, signature, payload) {
+    try {
+        const key = await importVerifyKey(publicKey);
+        return await crypto.subtle.verify("Ed25519", key, hexToBytes(signature), enc.encode(payload));
+    }
+    catch {
+        return false;
+    }
+}
+export async function signPayload(privateKey, payload) {
+    const sig = new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, enc.encode(payload)));
+    return `ed25519:${bytesToHex(sig)}`;
+}
+//# sourceMappingURL=keys-canonical.js.map

package/dist/keys-canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-canonical.js","sourceRoot":"","sources":["../src/keys-canonical.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,kEAAkE;AAElE,yFAAyF;AACzF,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,CAAE,GAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,CAAa;IACtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrE,CAAC;AACD,MAAM,UAAU,GAAG,CAAC,KAAiB;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AACD,MAAM,UAAU,KAAK,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,SAAiB,EAAE,OAAe;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,SAAS,CAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAiB,CAAC,CAAC;IAChI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAqB,EAAE,OAAe;IACtE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAiB,CAAC,CAAC,CAAC;IACjH,OAAO,WAAW,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;AACtC,CAAC"}

package/dist/keys-generate.d.ts

@@ -0,0 +1,39 @@
+/** A locally generated Ed25519 signing key. The private key exists ONLY here. */
+export interface GeneratedSigningKey {
+    /** Public key, `ed25519:<64 hex>` - the only part DRM3 ever receives. */
+    publicKey: string;
+    /** Private key, PKCS8 base64 - store it yourself (env var / secret manager), never send it. */
+    privateKeyPkcs8: string;
+    /** The live WebCrypto pair, usable for signing in-process without re-import. */
+    keyPair: CryptoKeyPair;
+}
+/** A certificate signing request (`drm3-csr/1`) - self-signed proof-of-possession. */
+export interface Csr {
+    schema: "drm3-csr/1";
+    /** The subject name being requested (e.g. "acme" / "truth-foundry"). */
+    subject: string;
+    /** The public key to certify, `ed25519:<hex>`. */
+    subject_key: string;
+    /** What the key will sign (default: receipts). */
+    purposes: string[];
+    requested_valid_days: number;
+    /** Random nonce so a CSR can't be replayed. */
+    nonce: string;
+    signed_at: string;
+    /** Self-signature by subject_key over canonicalize(this object minus signature). */
+    signature: string;
+}
+/** Generate an Ed25519 signing keypair locally. DRM3 never sees the private half. */
+export declare function generateSigningKey(): Promise<GeneratedSigningKey>;
+/** Re-import a stored PKCS8-base64 private key (from generateSigningKey) for signing. */
+export declare function importPrivateKeyPkcs8(privateKeyPkcs8: string): Promise<CryptoKey>;
+/** Build and self-sign a `drm3-csr/1`. The self-signature proves you hold the private key. */
+export declare function buildCSR(opts: {
+    subject: string;
+    keyPair: CryptoKeyPair;
+    purposes?: string[];
+    requestedValidDays?: number;
+}): Promise<Csr>;
+/** Verify a CSR's self-signature (the CA-side proof-of-possession check). */
+export declare function verifyCsr(csr: Csr): Promise<boolean>;
+//# sourceMappingURL=keys-generate.d.ts.map

package/dist/keys-generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-generate.d.ts","sourceRoot":"","sources":["../src/keys-generate.ts"],"names":[],"mappings":"AAKA,iFAAiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,eAAe,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qFAAqF;AACrF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAKvE;AAED,yFAAyF;AACzF,wBAAsB,qBAAqB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEvF;AAED,8FAA8F;AAC9F,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,CAcf;AAED,6EAA6E;AAC7E,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAI1D"}

package/dist/keys-generate.js

@@ -0,0 +1,39 @@
+// DRM3 partner signing keys - local Ed25519 keygen + CSR (drm3-csr/1) build & verify.
+// The partner generates the key and keeps the private half; DRM3 only ever sees the
+// public key. MOVED verbatim from ./keys: do NOT change any byte order or check.
+import { b64, bytesToHex, canonicalize, signPayload, unb64, verifySig } from "./keys-canonical.js";
+/** Generate an Ed25519 signing keypair locally. DRM3 never sees the private half. */
+export async function generateSigningKey() {
+    const keyPair = (await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]));
+    const rawPub = new Uint8Array(await crypto.subtle.exportKey("raw", keyPair.publicKey));
+    const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", keyPair.privateKey));
+    return { publicKey: `ed25519:${bytesToHex(rawPub)}`, privateKeyPkcs8: b64(pkcs8), keyPair };
+}
+/** Re-import a stored PKCS8-base64 private key (from generateSigningKey) for signing. */
+export async function importPrivateKeyPkcs8(privateKeyPkcs8) {
+    return crypto.subtle.importKey("pkcs8", unb64(privateKeyPkcs8), { name: "Ed25519" }, false, ["sign"]);
+}
+/** Build and self-sign a `drm3-csr/1`. The self-signature proves you hold the private key. */
+export async function buildCSR(opts) {
+    const rawPub = new Uint8Array(await crypto.subtle.exportKey("raw", opts.keyPair.publicKey));
+    const nonce = bytesToHex(crypto.getRandomValues(new Uint8Array(16)));
+    const unsigned = {
+        schema: "drm3-csr/1",
+        subject: opts.subject,
+        subject_key: `ed25519:${bytesToHex(rawPub)}`,
+        purposes: opts.purposes ?? ["receipt.sign"],
+        requested_valid_days: opts.requestedValidDays ?? 365,
+        nonce,
+        signed_at: new Date().toISOString(),
+    };
+    const signature = await signPayload(opts.keyPair.privateKey, canonicalize(unsigned));
+    return { ...unsigned, signature };
+}
+/** Verify a CSR's self-signature (the CA-side proof-of-possession check). */
+export async function verifyCsr(csr) {
+    const { signature, ...unsigned } = csr;
+    if (!signature || !csr.subject_key || csr.schema !== "drm3-csr/1")
+        return false;
+    return verifySig(csr.subject_key, signature, canonicalize(unsigned));
+}
+//# sourceMappingURL=keys-generate.js.map

package/dist/keys-generate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-generate.js","sourceRoot":"","sources":["../src/keys-generate.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,oFAAoF;AACpF,iFAAiF;AACjF,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA6BnG,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAkB,CAAC;IAClH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,OAAO,EAAE,SAAS,EAAE,WAAW,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC9F,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,eAAuB;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAK9B;IACC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,YAAqB;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,WAAW,UAAU,CAAC,MAAM,CAAC,EAAE;QAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC;QAC3C,oBAAoB,EAAE,IAAI,CAAC,kBAAkB,IAAI,GAAG;QACpD,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ;IACtC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC;IACvC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvE,CAAC"}