@dzhechkov/harness-core 0.3.120 → 0.3.121

package/dist/provenance.d.ts

@@ -0,0 +1,102 @@
+export interface ManifestEntry {
+    /** pack-relative file path — the stable sort/identity key. */
+    readonly path: string;
+    /** lowercase hex SHA-256 of the file contents. */
+    readonly sha256: string;
+}
+/** The signed payload. */
+export interface Manifest {
+    readonly version: 1;
+    readonly pack: string;
+    readonly packVersion: string;
+    /** caller-supplied ISO timestamp (part of the signed payload; no wall-clock inside → deterministic). */
+    readonly createdAt?: string;
+    /** file digests, sorted by path for a canonical, reproducible payload. */
+    readonly entries: readonly ManifestEntry[];
+}
+/** The on-disk `witness.json`: the manifest + its attached verification anchor + signature. */
+export interface Witness extends Manifest {
+    /** spki PEM public key (the verification anchor). */
+    readonly publicKey: string;
+    /** base64 Ed25519 signature over `canonicalPayload(manifest)`. */
+    readonly signature: string;
+}
+export interface KeyPairPem {
+    readonly publicKey: string;
+    readonly privateKey: string;
+}
+/** A file to include in a manifest — content injected, so hashing stays pure. */
+export interface FileInput {
+    readonly path: string;
+    readonly content: string | Buffer;
+}
+/** Generate an Ed25519 keypair as PEM strings (spki public / pkcs8 private). */
+export declare function generateKeyPairPem(): KeyPairPem;
+/** SHA-256 (lowercase hex) of a buffer or string. */
+export declare function sha256Hex(data: Buffer | string): string;
+/**
+ * Build a canonical manifest over injected file contents. Entries are sorted by path so the signed payload is
+ * stable regardless of input order. Duplicate paths collapse to the last one seen (after sort, deterministic).
+ */
+export declare function buildManifest(input: {
+    pack: string;
+    packVersion: string;
+    createdAt?: string;
+    files: readonly FileInput[];
+}): Manifest;
+/** Sign a manifest with an Ed25519 private-key PEM. Returns a base64 signature. Ed25519 uses a null algorithm. */
+export declare function signManifest(m: Manifest, privateKeyPem: string): string;
+/** Verify a base64 Ed25519 signature over a manifest. Fail-safe: malformed sig/key ⇒ false, never throws. */
+export declare function verifyManifest(m: Manifest, signatureBase64: string, publicKeyPem: string): boolean;
+/** Build + sign into an on-disk witness. */
+export declare function signWitness(input: {
+    pack: string;
+    packVersion: string;
+    createdAt?: string;
+    files: readonly FileInput[];
+}, keys: {
+    privateKey: string;
+    publicKey: string;
+}): Witness;
+export interface DriftEntry {
+    readonly path: string;
+    readonly expected: string;
+    /** current on-disk hash, or null if the file is missing/unreadable. */
+    readonly actual: string | null;
+}
+export interface VerifyResult {
+    readonly signatureValid: boolean;
+    readonly filesIntact: boolean;
+    readonly drift: readonly DriftEntry[];
+    /** true when an anchor was supplied AND matches the witness's public key; null when no anchor was supplied. */
+    readonly anchorMatches: boolean | null;
+}
+/**
+ * Verify a witness against the CURRENT on-disk files (injected as {path, content|null}) and, when a trusted
+ * anchor public key is supplied, that the witness was signed by THAT key. Pure + fail-safe.
+ */
+export declare function verifyWitness(witness: Witness, currentFiles: readonly {
+    path: string;
+    content: string | Buffer | null;
+}[], opts?: {
+    anchorPublicKey?: string;
+}): VerifyResult;
+export type VerifyStatus = 'pass' | 'block' | 'warn';
+export interface GateVerdict {
+    readonly status: VerifyStatus;
+    readonly reason: string;
+}
+/**
+ * Classify a verify outcome into the ADR gate posture:
+ *  - no witness at all            → WARN  (transitional: the existing unsigned packs must not break)
+ *  - signature invalid            → BLOCK (tamper / corruption)
+ *  - anchor supplied + mismatch   → BLOCK (signed by the wrong key — a re-signed tampered pack)
+ *  - files drifted                → BLOCK (on-disk files differ from what was signed)
+ *  - signature valid + intact + (no anchor OR anchor matches) → PASS
+ * NEVER throws; a hostile/partial input degrades to BLOCK (safe default) rather than a false PASS.
+ */
+export declare function classifyVerify(input: {
+    hasWitness: boolean;
+    result?: VerifyResult | null;
+}): GateVerdict;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,0BAA0B;AAC1B,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C;AAED,+FAA+F;AAC/F,MAAM,WAAW,OAAQ,SAAQ,QAAQ;IACvC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,IAAI,UAAU,CAM/C;AAED,qDAAqD;AACrD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;CAC7B,GAAG,QAAQ,CAgBX;AAaD,kHAAkH;AAClH,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,6GAA6G;AAC7G,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAMlG;AAED,4CAA4C;AAC5C,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;CAC7B,EAAE,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAG3D;AAoBD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,+GAA+G;IAC/G,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,EAC1E,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAO,GACtC,YAAY,CAcd;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAYxG"}

package/dist/provenance.js

@@ -0,0 +1,141 @@
+// Ed25519 witness signing + verification for skill packs (rUv-scout #4).
+//
+// Ported near-verbatim from the shipped TypeScript `agentic-flow/src/harness/provenance.ts` (RuvNet, ADR-075),
+// adapted to a per-pack witness. Ed25519 (Edwards-curve Digital Signature Algorithm) + SHA-256 come from Node's
+// built-in `crypto` — ZERO new dependencies. This module is PURE: build/sign/verify operate over INJECTED file
+// contents (not the filesystem), so they are deterministic and unit-testable without a keypair on disk. The
+// CLI (`dz sign` / `dz verify`) does the filesystem + key I/O. Same pure-engine shape as discrimination-gate.ts.
+//
+// A witness is `{ version, pack, packVersion, createdAt?, entries:[{path, sha256}], publicKey, signature }`. The
+// SIGNED payload is the manifest (everything except publicKey + signature); the publicKey is the attached
+// verification anchor. Because a tamperer could swap the publicKey AND re-sign with their own key, verification
+// ALSO cross-checks the witness's publicKey against a trusted anchor (the committed `keys/dz.pub`) — without
+// that anchor a re-signed tampered pack would verify clean. That cross-check is the load-bearing guard.
+import { generateKeyPairSync, sign as cryptoSign, verify as cryptoVerify, createHash } from 'node:crypto';
+/** Generate an Ed25519 keypair as PEM strings (spki public / pkcs8 private). */
+export function generateKeyPairPem() {
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+    return {
+        publicKey: publicKey.export({ type: 'spki', format: 'pem' }).toString(),
+        privateKey: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+    };
+}
+/** SHA-256 (lowercase hex) of a buffer or string. */
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/**
+ * Build a canonical manifest over injected file contents. Entries are sorted by path so the signed payload is
+ * stable regardless of input order. Duplicate paths collapse to the last one seen (after sort, deterministic).
+ */
+export function buildManifest(input) {
+    const byPath = new Map();
+    for (const f of Array.isArray(input.files) ? input.files : []) {
+        if (!f || typeof f.path !== 'string' || f.path.length === 0)
+            continue;
+        byPath.set(f.path, sha256Hex(f.content ?? ''));
+    }
+    const entries = [...byPath.entries()]
+        .map(([path, sha256]) => ({ path, sha256 }))
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return {
+        version: 1,
+        pack: input.pack,
+        packVersion: input.packVersion,
+        ...(input.createdAt ? { createdAt: input.createdAt } : {}),
+        entries,
+    };
+}
+/** Canonical bytes that get signed/verified — stable JSON with a fixed key order; entries already sorted. */
+function canonicalPayload(m) {
+    return JSON.stringify({
+        version: m.version,
+        pack: m.pack,
+        packVersion: m.packVersion,
+        createdAt: m.createdAt ?? null,
+        entries: m.entries.map((e) => ({ path: e.path, sha256: e.sha256 })),
+    });
+}
+/** Sign a manifest with an Ed25519 private-key PEM. Returns a base64 signature. Ed25519 uses a null algorithm. */
+export function signManifest(m, privateKeyPem) {
+    return cryptoSign(null, Buffer.from(canonicalPayload(m), 'utf8'), privateKeyPem).toString('base64');
+}
+/** Verify a base64 Ed25519 signature over a manifest. Fail-safe: malformed sig/key ⇒ false, never throws. */
+export function verifyManifest(m, signatureBase64, publicKeyPem) {
+    try {
+        return cryptoVerify(null, Buffer.from(canonicalPayload(m), 'utf8'), publicKeyPem, Buffer.from(signatureBase64, 'base64'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Build + sign into an on-disk witness. */
+export function signWitness(input, keys) {
+    const manifest = buildManifest(input);
+    return { ...manifest, publicKey: keys.publicKey, signature: signManifest(manifest, keys.privateKey) };
+}
+/** Strip the witness wrapper back to the signed manifest (for re-verification). */
+function manifestOf(w) {
+    return {
+        version: w.version,
+        pack: w.pack,
+        packVersion: w.packVersion,
+        ...(w.createdAt ? { createdAt: w.createdAt } : {}),
+        entries: w.entries,
+    };
+}
+/** Normalise two PEM keys for comparison (ignore surrounding whitespace / line-ending differences). */
+function samePem(a, b) {
+    if (typeof a !== 'string' || typeof b !== 'string')
+        return false;
+    const norm = (s) => s.replace(/\s+/g, '');
+    return norm(a).length > 0 && norm(a) === norm(b);
+}
+/**
+ * Verify a witness against the CURRENT on-disk files (injected as {path, content|null}) and, when a trusted
+ * anchor public key is supplied, that the witness was signed by THAT key. Pure + fail-safe.
+ */
+export function verifyWitness(witness, currentFiles, opts = {}) {
+    const signatureValid = verifyManifest(manifestOf(witness), witness.signature, witness.publicKey);
+    const current = new Map();
+    for (const f of Array.isArray(currentFiles) ? currentFiles : []) {
+        if (f && typeof f.path === 'string')
+            current.set(f.path, f.content);
+    }
+    const drift = [];
+    for (const e of witness.entries) {
+        const c = current.has(e.path) ? current.get(e.path) : null;
+        const actual = c === null || c === undefined ? null : sha256Hex(c);
+        if (actual !== e.sha256)
+            drift.push({ path: e.path, expected: e.sha256, actual });
+    }
+    const anchorMatches = opts.anchorPublicKey === undefined ? null : samePem(witness.publicKey, opts.anchorPublicKey);
+    return { signatureValid, filesIntact: drift.length === 0, drift, anchorMatches };
+}
+/**
+ * Classify a verify outcome into the ADR gate posture:
+ *  - no witness at all            → WARN  (transitional: the existing unsigned packs must not break)
+ *  - signature invalid            → BLOCK (tamper / corruption)
+ *  - anchor supplied + mismatch   → BLOCK (signed by the wrong key — a re-signed tampered pack)
+ *  - files drifted                → BLOCK (on-disk files differ from what was signed)
+ *  - signature valid + intact + (no anchor OR anchor matches) → PASS
+ * NEVER throws; a hostile/partial input degrades to BLOCK (safe default) rather than a false PASS.
+ */
+export function classifyVerify(input) {
+    if (!input.hasWitness)
+        return { status: 'warn', reason: 'no witness.json — pack is unsigned (transitional; not blocked)' };
+    const r = input.result;
+    if (!r || typeof r !== 'object')
+        return { status: 'block', reason: 'witness present but could not be verified' };
+    if (!r.signatureValid)
+        return { status: 'block', reason: 'Ed25519 signature does not verify — tampered or corrupt witness' };
+    if (r.anchorMatches === false)
+        return { status: 'block', reason: 'witness public key does not match the trusted keys/dz.pub anchor — signed by the wrong key' };
+    if (!r.filesIntact) {
+        const n = r.drift.length;
+        const missing = r.drift.filter((d) => d.actual === null).length;
+        return { status: 'block', reason: `${n} file(s) differ from the signed manifest${missing ? ` (${missing} missing)` : ''} — tampered` };
+    }
+    return { status: 'pass', reason: r.anchorMatches === true ? 'signature valid, files intact, anchor matches' : 'signature valid, files intact (no anchor supplied)' };
+}
+//# sourceMappingURL=provenance.js.map

package/dist/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,+GAA+G;AAC/G,gHAAgH;AAChH,+GAA+G;AAC/G,4GAA4G;AAC5G,iHAAiH;AACjH,EAAE;AACF,iHAAiH;AACjH,0GAA0G;AAC1G,gHAAgH;AAChH,6GAA6G;AAC7G,wGAAwG;AAExG,OAAO,EAAE,mBAAmB,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuC1G,gFAAgF;AAChF,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3E,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAK7B;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAoB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO;QACL,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO;KACR,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,SAAS,gBAAgB,CAAC,CAAW;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,YAAY,CAAC,CAAW,EAAE,aAAqB;IAC7D,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtG,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,cAAc,CAAC,CAAW,EAAE,eAAuB,EAAE,YAAoB;IACvF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,WAAW,CAAC,KAK3B,EAAE,IAA+C;IAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;AACxG,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,SAAS,OAAO,CAAC,CAAqB,EAAE,CAAqB;IAC3D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAiBD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,YAA0E,EAC1E,OAAqC,EAAE;IAEvC,MAAM,cAAc,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACnH,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACnF,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAA4D;IACzF,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gEAAgE,EAAE,CAAC;IAC3H,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACjH,IAAI,CAAC,CAAC,CAAC,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAC7H,IAAI,CAAC,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,4FAA4F,EAAE,CAAC;IAChK,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,2CAA2C,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;IACzI,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,oDAAoD,EAAE,CAAC;AACvK,CAAC"}

package/dist/sbom.d.ts

@@ -0,0 +1,42 @@
+export interface SbomPackage {
+    readonly SPDXID: string;
+    readonly name: string;
+    readonly versionInfo: string;
+    readonly downloadLocation: string;
+    readonly licenseConcluded: string;
+    readonly licenseDeclared: string;
+    readonly externalRefs: readonly {
+        referenceCategory: string;
+        referenceType: string;
+        referenceLocator: string;
+    }[];
+}
+export interface SpdxDocument {
+    readonly spdxVersion: 'SPDX-2.3';
+    readonly dataLicense: 'CC0-1.0';
+    readonly SPDXID: 'SPDXRef-DOCUMENT';
+    readonly name: string;
+    readonly documentNamespace: string;
+    readonly creationInfo: {
+        readonly created: string;
+        readonly creators: readonly string[];
+    };
+    readonly packages: readonly SbomPackage[];
+    readonly relationships: readonly {
+        spdxElementId: string;
+        relationshipType: string;
+        relatedSpdxElement: string;
+    }[];
+}
+/** Build an SPDX-2.3 SBOM document. Pure + deterministic (injected `created`; packages sorted by name+version). */
+export declare function buildSbom(input: {
+    name: string;
+    lock?: unknown;
+    pkg?: unknown;
+    includeDev?: boolean;
+    created: string;
+    namespace?: string;
+}): SpdxDocument;
+/** Shape check for `--validate-only`: returns the problems (empty ⇒ valid SPDX-2.3 skeleton). */
+export declare function validateSbom(doc: unknown): string[];
+//# sourceMappingURL=sbom.d.ts.map

package/dist/sbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../src/sbom.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAClH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC1F,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,SAAS;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACpH;AA+ED,mHAAmH;AACnH,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,YAAY,CAwBf;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CASnD"}

package/dist/sbom.js

@@ -0,0 +1,120 @@
+// SPDX-2.3 (Software Package Data Exchange) SBOM (Software Bill of Materials) generator for a pack.
+//
+// Ported from `agent-harness-generator/scripts/sbom.mjs` (RuvNet, MIT). Emits an SPDX-2.3 dependency inventory
+// from a `package-lock.json` (npm v1 or v2/v3), falling back to `package.json` dependency ranges when no lockfile
+// is present. PURE: operates over injected JSON + an injected `created` timestamp (no wall-clock → deterministic;
+// packages sorted by name). The CLI (`dz sbom`) reads the files and writes the output.
+/** A valid SPDXID tail is `[a-zA-Z0-9.-]+`; map `@scope/name` → `scope-name`. */
+function spdxId(name) {
+    return 'SPDXRef-Package-' + name.replace(/^@/, '').replace(/[^a-zA-Z0-9.-]+/g, '-');
+}
+/** purl (package URL) for an npm dep: scope becomes a url-encoded namespace. */
+function npmPurl(name, version) {
+    const v = version && version !== 'NOASSERTION' ? `@${version}` : '';
+    if (name.startsWith('@')) {
+        const slash = name.indexOf('/');
+        if (slash > 0) {
+            const scope = encodeURIComponent(name.slice(0, slash)); // %40scope
+            return `pkg:npm/${scope}/${name.slice(slash + 1)}${v}`;
+        }
+    }
+    return `pkg:npm/${name}${v}`;
+}
+function licenseOf(v) {
+    if (typeof v === 'string' && v.length > 0)
+        return v;
+    if (v && typeof v === 'object' && typeof v.type === 'string')
+        return v.type;
+    return 'NOASSERTION';
+}
+/** Extract deps from a lockfile (npm v2/v3 `packages` map, or v1 `dependencies` tree) or a package.json. */
+function extractDeps(input) {
+    const out = new Map();
+    const add = (name, version, license, dev) => {
+        if (!name)
+            return;
+        const key = `${name}@${version}`;
+        if (!out.has(key))
+            out.set(key, { name, version, license, dev });
+    };
+    const lock = input.lock;
+    // npm v2/v3: flat `packages` map keyed by node_modules path ("" = root, skip it).
+    if (lock && lock.packages && typeof lock.packages === 'object') {
+        for (const [path, meta] of Object.entries(lock.packages)) {
+            if (path === '' || !path.includes('node_modules/'))
+                continue;
+            const m = meta;
+            if (m.dev && !input.includeDev)
+                continue;
+            const name = path.slice(path.lastIndexOf('node_modules/') + 'node_modules/'.length);
+            add(name, typeof m.version === 'string' ? m.version : 'NOASSERTION', licenseOf(m.license), !!m.dev);
+        }
+        return [...out.values()];
+    }
+    // npm v1: nested `dependencies` tree.
+    if (lock && lock.dependencies && typeof lock.dependencies === 'object') {
+        const walk = (deps) => {
+            for (const [name, meta] of Object.entries(deps)) {
+                const m = meta;
+                if (m.dev && !input.includeDev)
+                    continue;
+                add(name, typeof m.version === 'string' ? m.version : 'NOASSERTION', licenseOf(m.license), !!m.dev);
+                if (m.dependencies)
+                    walk(m.dependencies);
+            }
+        };
+        walk(lock.dependencies);
+        return [...out.values()];
+    }
+    // fallback: package.json ranges (no resolved versions).
+    const pkg = input.pkg;
+    if (pkg) {
+        for (const [name, range] of Object.entries(pkg.dependencies ?? {}))
+            add(name, String(range), 'NOASSERTION', false);
+        if (input.includeDev)
+            for (const [name, range] of Object.entries(pkg.devDependencies ?? {}))
+                add(name, String(range), 'NOASSERTION', true);
+    }
+    return [...out.values()];
+}
+/** Build an SPDX-2.3 SBOM document. Pure + deterministic (injected `created`; packages sorted by name+version). */
+export function buildSbom(input) {
+    const deps = extractDeps({ lock: input.lock, pkg: input.pkg, includeDev: !!input.includeDev })
+        .sort((a, b) => (a.name === b.name ? (a.version < b.version ? -1 : 1) : a.name < b.name ? -1 : 1));
+    const packages = deps.map((d) => ({
+        SPDXID: spdxId(`${d.name}-${d.version}`),
+        name: d.name,
+        versionInfo: d.version,
+        downloadLocation: 'NOASSERTION',
+        licenseConcluded: d.license,
+        licenseDeclared: d.license,
+        externalRefs: [{ referenceCategory: 'PACKAGE-MANAGER', referenceType: 'purl', referenceLocator: npmPurl(d.name, d.version) }],
+    }));
+    return {
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: 'SPDXRef-DOCUMENT',
+        name: `${input.name}-sbom`,
+        documentNamespace: input.namespace ?? `urn:dz:sbom:${input.name.replace(/^@/, '').replace(/[^a-zA-Z0-9.-]+/g, '-')}`,
+        creationInfo: { created: input.created, creators: ['Tool: dz-sbom'] },
+        packages,
+        relationships: packages.map((p) => ({ spdxElementId: 'SPDXRef-DOCUMENT', relationshipType: 'DESCRIBES', relatedSpdxElement: p.SPDXID })),
+    };
+}
+/** Shape check for `--validate-only`: returns the problems (empty ⇒ valid SPDX-2.3 skeleton). */
+export function validateSbom(doc) {
+    const problems = [];
+    const d = doc;
+    if (!d || typeof d !== 'object')
+        return ['not an object'];
+    if (d.spdxVersion !== 'SPDX-2.3')
+        problems.push('spdxVersion must be SPDX-2.3');
+    if (d.SPDXID !== 'SPDXRef-DOCUMENT')
+        problems.push('SPDXID must be SPDXRef-DOCUMENT');
+    if (!Array.isArray(d.packages))
+        problems.push('packages must be an array');
+    if (!d.creationInfo || typeof d.creationInfo.created !== 'string')
+        problems.push('creationInfo.created missing');
+    return problems;
+}
+//# sourceMappingURL=sbom.js.map

package/dist/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../src/sbom.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,+GAA+G;AAC/G,kHAAkH;AAClH,kHAAkH;AAClH,uFAAuF;AA8BvF,iFAAiF;AACjF,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,MAAM,CAAC,GAAG,OAAO,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW;YACnE,OAAO,WAAW,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,WAAW,IAAI,GAAG,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAQ,CAAsB,CAAC,IAAI,CAAC;IAC1H,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,4GAA4G;AAC5G,SAAS,WAAW,CAAC,KAA6D;IAChF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAe,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAkG,CAAC;IAEtH,kFAAkF;IAClF,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,SAAS;YAC7D,MAAM,CAAC,GAAG,IAAkF,CAAC;YAC7F,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU;gBAAE,SAAS;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpF,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,EAAE;YAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,IAAsG,CAAC;gBACjH,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU;oBAAE,SAAS;gBACzC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACpG,IAAI,CAAC,CAAC,YAAY;oBAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,YAAuC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAsG,CAAC;IACzH,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACnH,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC7I,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,SAAS,CAAC,KAOzB;IACC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;SAC3F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,MAAM,QAAQ,GAAkB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,OAAO;QACtB,gBAAgB,EAAE,aAAa;QAC/B,gBAAgB,EAAE,CAAC,CAAC,OAAO;QAC3B,eAAe,EAAE,CAAC,CAAC,OAAO;QAC1B,YAAY,EAAE,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9H,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO;QAC1B,iBAAiB,EAAE,KAAK,CAAC,SAAS,IAAI,eAAe,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE;QACpH,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE;QACrE,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACzI,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAAE,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,KAAK,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACjH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/sign.d.ts

@@ -65,6 +65,19 @@ export declare function canonicalizeManifest(files: readonly ManifestEntry[]): B
 export declare function canonicalizeSigned(manifest: Manifest): Buffer;
 /** Build a manifest for `files` (paths relative to `root`, POSIX separators). */
 export declare function buildManifest(root: string, pack: string, files: readonly string[]): Manifest;
+/** A freshly-generated Ed25519 signing keypair as PEM strings (pkcs8 private / spki public). */
+export interface SigningKeypair {
+    /** pkcs8 PEM — the PRIVATE key. NEVER commit this; it belongs OUTSIDE the repo (~/.dz/keys/dz.key). */
+    readonly privateKey: string;
+    /** spki PEM — the PUBLIC key. Commit this as the `keys/dz.pub` trust root. */
+    readonly publicKey: string;
+}
+/**
+ * Generate a fresh Ed25519 keypair for `dz sign --init`. The private key is returned for the CLI to write
+ * OUTSIDE the repo (the CLI enforces `assertKeyOutsideTree`); the public key is printed for the operator to
+ * commit as `keys/dz.pub`. Ed25519 gives tamper-evidence, never truthfulness (the recalled scope lesson).
+ */
+export declare function generateSigningKeypair(): SigningKeypair;
 export declare function signManifest(manifest: Manifest, privateKeyPem: string): SignedManifest;
 /**
  * FR-8 / risk R1: every degenerate input FAILS CLOSED. Absence must never read as success — that is the

package/dist/sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtE;AAeD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAK1D;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBlE;AAED,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAapD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAI5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAG7D;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAM5F;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,CAWtF;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACzC,SAAS,EAAE,MAAM,GAChB,YAAY,CA8Dd;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAYlD;AAaD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,mBAAmB,CAiB9E;AAOD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAKzE;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,GAAG,cAAc,CAehG"}
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtE;AAeD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAK1D;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBlE;AAED,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAapD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAI5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAG7D;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAM5F;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CAMvD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,CAWtF;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACzC,SAAS,EAAE,MAAM,GAChB,YAAY,CA8Dd;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAYlD;AAaD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,mBAAmB,CAiB9E;AAOD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAKzE;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,GAAG,cAAc,CAehG"}

package/dist/sign.js

@@ -11,7 +11,7 @@
  *
  * Zero dependencies: `node:crypto`, `node:fs`, `node:path`.
  */
-import { createHash, sign as cryptoSign, verify as cryptoVerify, createPrivateKey, createPublicKey } from 'node:crypto';
+import { createHash, sign as cryptoSign, verify as cryptoVerify, createPrivateKey, createPublicKey, generateKeyPairSync } from 'node:crypto';
 import { readFileSync, existsSync, readdirSync, openSync, fstatSync, closeSync, constants as fsConstants } from 'node:fs';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 export const MANIFEST_NAME = '.dz-manifest.json';
@@ -136,6 +136,18 @@ export function buildManifest(root, pack, files) {
     }));
     return { version: MANIFEST_VERSION, pack, files: entries };
 }
+/**
+ * Generate a fresh Ed25519 keypair for `dz sign --init`. The private key is returned for the CLI to write
+ * OUTSIDE the repo (the CLI enforces `assertKeyOutsideTree`); the public key is printed for the operator to
+ * commit as `keys/dz.pub`. Ed25519 gives tamper-evidence, never truthfulness (the recalled scope lesson).
+ */
+export function generateSigningKeypair() {
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+    return {
+        privateKey: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+        publicKey: publicKey.export({ type: 'spki', format: 'pem' }).toString(),
+    };
+}
 export function signManifest(manifest, privateKeyPem) {
     // Defence in depth (round-2 review): `pack` is interpolated into a newline-delimited signed header.
     // `verifyManifest` already refuses an unsafe pack name, so an ambiguous header could never verify —

package/dist/sign.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErE,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AA6BlC,uGAAuG;AACvG,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,uDAAuD;IACtE,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAU,+CAA+C;IACvG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAyC,CAAC;QACxE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;YAAE,OAAO,qCAAqC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjG,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,4CAA4C,GAAG,GAAG,CAAC;QACtH,+FAA+F;QAC/F,mGAAmG;QACnG,iGAAiG;QACjG,qEAAqE;QACrE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,oEAAoE,CAAC;QAC1H,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5C,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;;gBAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,MAAM,MAAM,GAAG,uBAAuB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,KAAwB;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;KAClC,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,aAAqB;IACpE,oGAAoG;IACpG,oGAAoG;IACpG,yFAAyF;IACzF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAClI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC5G,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,UAAU,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,MAAyC,EACzC,SAAiB;IAEjB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE3G,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACjG,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,EAAE,gCAAgC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;IAC5E,CAAC;IAED,4FAA4F;IAC5F,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,kBAAkB,CAAC,QAAQ,CAAC,EAC5B,eAAe,CAAC,SAAS,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,iGAAiG;QACjG,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC,CAAC;YACxG,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,8FAA8F;IAC9F,qEAAqE;IACrE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IACpE,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,OAAO,CAAC,OAAO,CAAC;YAChB,2FAA2F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAgBD,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,QAAkB;IAC1C,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;QACjE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,MAAe;YACrB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SACzD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AA2BD,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;QACrG,CAAC;QACD,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;AAC5F,CAAC;AAuBD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAsB;IACrD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,cAAuB;IAC9E,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,cAAc;YACnB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0DAA0D,EAAE;YACxF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,cAAc;QACnB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,EAAE;QACjF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;AACtE,CAAC"}
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7I,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErE,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AA6BlC,uGAAuG;AACvG,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,uDAAuD;IACtE,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAU,+CAA+C;IACvG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAyC,CAAC;QACxE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;YAAE,OAAO,qCAAqC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjG,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,4CAA4C,GAAG,GAAG,CAAC;QACtH,+FAA+F;QAC/F,mGAAmG;QACnG,iGAAiG;QACjG,qEAAqE;QACrE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,oEAAoE,CAAC;QAC1H,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5C,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;;gBAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,MAAM,MAAM,GAAG,uBAAuB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,KAAwB;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;KAClC,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,aAAqB;IACpE,oGAAoG;IACpG,oGAAoG;IACpG,yFAAyF;IACzF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAClI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC5G,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,UAAU,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,MAAyC,EACzC,SAAiB;IAEjB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE3G,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACjG,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,EAAE,gCAAgC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;IAC5E,CAAC;IAED,4FAA4F;IAC5F,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,kBAAkB,CAAC,QAAQ,CAAC,EAC5B,eAAe,CAAC,SAAS,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,iGAAiG;QACjG,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC,CAAC;YACxG,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,8FAA8F;IAC9F,qEAAqE;IACrE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IACpE,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,OAAO,CAAC,OAAO,CAAC;YAChB,2FAA2F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAgBD,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,QAAkB;IAC1C,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;QACjE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,MAAe;YACrB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SACzD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AA2BD,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;QACrG,CAAC;QACD,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;AAC5F,CAAC;AAuBD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAsB;IACrD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,cAAuB;IAC9E,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,cAAc;YACnB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0DAA0D,EAAE;YACxF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,cAAc;QACnB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,EAAE;QACjF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;AACtE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-core",
-  "version": "0.3.120",
+  "version": "0.3.121",
   "description": "Shared harness logic - skill loading, additive apply, and the init/sync/verify/doctor operations.",
   "type": "module",
   "license": "MIT",
@@ -30,11 +30,11 @@
     "@dzhechkov/adapter-openclaude": "^0.1.0",
     "@dzhechkov/adapter-opencode": "^0.2.0",
     "yaml": "^2.0.0",
-    "@dzhechkov/adapter-agents-md": "0.1.1",
     "@dzhechkov/adapter-gemini": "0.1.1",
-    "@dzhechkov/adapter-windsurf": "0.1.1",
     "@dzhechkov/adapter-copilot": "0.1.1",
+    "@dzhechkov/adapter-agents-md": "0.1.1",
     "@dzhechkov/adapter-cursor": "0.1.1",
+    "@dzhechkov/adapter-windsurf": "0.1.1",
     "@dzhechkov/core": "0.2.14",
     "@dzhechkov/memory": "0.2.9"
   },

package/src/sign.ts

@@ -12,7 +12,7 @@
  * Zero dependencies: `node:crypto`, `node:fs`, `node:path`.
  */
 
-import { createHash, sign as cryptoSign, verify as cryptoVerify, createPrivateKey, createPublicKey } from 'node:crypto';
+import { createHash, sign as cryptoSign, verify as cryptoVerify, createPrivateKey, createPublicKey, generateKeyPairSync } from 'node:crypto';
 import { readFileSync, existsSync, readdirSync, openSync, fstatSync, closeSync, constants as fsConstants } from 'node:fs';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 
@@ -159,6 +159,27 @@ export function buildManifest(root: string, pack: string, files: readonly string
   return { version: MANIFEST_VERSION, pack, files: entries };
 }
 
+/** A freshly-generated Ed25519 signing keypair as PEM strings (pkcs8 private / spki public). */
+export interface SigningKeypair {
+  /** pkcs8 PEM — the PRIVATE key. NEVER commit this; it belongs OUTSIDE the repo (~/.dz/keys/dz.key). */
+  readonly privateKey: string;
+  /** spki PEM — the PUBLIC key. Commit this as the `keys/dz.pub` trust root. */
+  readonly publicKey: string;
+}
+
+/**
+ * Generate a fresh Ed25519 keypair for `dz sign --init`. The private key is returned for the CLI to write
+ * OUTSIDE the repo (the CLI enforces `assertKeyOutsideTree`); the public key is printed for the operator to
+ * commit as `keys/dz.pub`. Ed25519 gives tamper-evidence, never truthfulness (the recalled scope lesson).
+ */
+export function generateSigningKeypair(): SigningKeypair {
+  const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+  return {
+    privateKey: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+    publicKey: publicKey.export({ type: 'spki', format: 'pem' }).toString(),
+  };
+}
+
 export function signManifest(manifest: Manifest, privateKeyPem: string): SignedManifest {
   // Defence in depth (round-2 review): `pack` is interpolated into a newline-delimited signed header.
   // `verifyManifest` already refuses an unsafe pack name, so an ambiguous header could never verify —