@evumi/berth 0.0.0-stage → 0.0.3

package/dist/esm/signature.js

@@ -0,0 +1,70 @@
+import { hmacSha256, toHex } from './sha256.js';
+const utf8 = new TextEncoder();
+const bytes = (v) => (typeof v === 'string' ? utf8.encode(v) : v instanceof Uint8Array ? v : new Uint8Array(v));
+const INT64_MAX = (1n << 63n) - 1n;
+const INT64_MIN = -(1n << 63n);
+/**
+ * Checks a Berth-Signature header (`t=<unix>,v1=<hex>`) against the raw request body and says
+ * why it fails, or null when it is valid. Synchronous; never throws. Several v1 values are
+ * accepted (one must match), so the secret can be rotated; unknown keys are ignored.
+ */
+export function checkSignature(secret, header, rawBody, opts = {}) {
+    try {
+        if (typeof header !== 'string' || header.trim() === '')
+            return 'missing';
+        let t;
+        const sigs = [];
+        for (const part of header.split(',')) {
+            const p = part.trim();
+            const i = p.indexOf('=');
+            if (i < 0)
+                return 'malformed';
+            const k = p.slice(0, i);
+            const v = p.slice(i + 1);
+            if (k === 't') {
+                if (t !== undefined || !/^[+-]?[0-9]+$/.test(v))
+                    return 'malformed';
+                t = BigInt(v);
+                if (t > INT64_MAX || t < INT64_MIN)
+                    return 'malformed';
+            }
+            else if (k === 'v1') {
+                sigs.push(v);
+            }
+        }
+        if (t === undefined || sigs.length === 0)
+            return 'malformed';
+        const nowOpt = opts.now ?? Date.now() / 1000;
+        const now = BigInt(Math.floor(nowOpt instanceof Date ? nowOpt.getTime() / 1000 : nowOpt));
+        const tolerance = BigInt(Math.floor(opts.toleranceSeconds ?? 300));
+        const d = now - t;
+        if ((d < 0n ? -d : d) > tolerance)
+            return 'expired';
+        const key = typeof secret === 'string' ? utf8.encode(secret) : secret;
+        const want = toHex(hmacSha256(key, utf8.encode(t.toString() + '.'), bytes(rawBody)));
+        let ok = false;
+        for (const s of sigs)
+            if (equal(s.toLowerCase(), want))
+                ok = true;
+        return ok ? null : 'mismatch';
+    }
+    catch {
+        return 'malformed';
+    }
+}
+/** Constant time for equal lengths; the length of a hex HMAC is public. */
+function equal(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/**
+ * Whether a Berth-Signature header is valid for the raw request body. Verify the bytes as they
+ * arrived, before any JSON parsing. Synchronous; never throws.
+ */
+export function verifySignature(secret, header, rawBody, opts) {
+    return checkSignature(secret, header, rawBody, opts) === null;
+}

package/dist/esm/util.d.ts

@@ -0,0 +1,3 @@
+export declare function env(name: string): string | undefined;
+export declare function toBase64(b: Uint8Array): string;
+export declare function fromBase64(s: string): Uint8Array;

package/dist/esm/util.js

@@ -0,0 +1,22 @@
+export function env(name) {
+    const g = globalThis;
+    try {
+        return g.process?.env?.[name] ?? g.Deno?.env.get(name) ?? undefined;
+    }
+    catch {
+        return undefined; // Deno without --allow-env
+    }
+}
+export function toBase64(b) {
+    let s = '';
+    for (let i = 0; i < b.length; i += 0x8000)
+        s += String.fromCharCode(...b.subarray(i, i + 0x8000));
+    return btoa(s);
+}
+export function fromBase64(s) {
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@evumi/berth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.3",
+  "description": "Client for Berth project Queues and Alarms, and the verifier for signed push deliveries.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evumi/berth.git",
+    "directory": "sdk/js-berth"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/esm/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.esm.json && tsc -p tsconfig.cjs.json && node scripts/cjs-package.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm run build && vitest run"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "typescript": "6.0.3",
+    "vitest": "^5.0.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}