@fabricorg/experiments-manifest-signing 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabric
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/dist/index.cjs

@@ -0,0 +1,235 @@
+'use strict';
+
+// src/canonical.ts
+function canonicalSignedPayload(m) {
+  return JSON.stringify(
+    {
+      contentHash: m.contentHash,
+      manifestVersion: m.manifestVersion,
+      schemaVersion: m.schemaVersion,
+      tenantId: m.tenantId
+    },
+    null,
+    0
+  );
+}
+function canonicalSignedBytes(m) {
+  return new TextEncoder().encode(canonicalSignedPayload(m));
+}
+
+// src/hash.ts
+async function sha256(data) {
+  const subtle = await getSubtle();
+  const buf = await subtle.digest("SHA-256", data);
+  return new Uint8Array(buf);
+}
+function hexEncode(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += bytes[i].toString(16).padStart(2, "0");
+  return s;
+}
+async function getSubtle() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+
+// src/sign.ts
+async function signManifest(manifest, key) {
+  const subtle = await getSubtle2();
+  const payload = canonicalSignedBytes(manifest);
+  const signedHash = await sha256(payload);
+  const pkcs8 = ed25519PrivateKeyToPkcs8(hexDecode(key.privateKeyHex));
+  const cryptoKey = await subtle.importKey(
+    "pkcs8",
+    pkcs8,
+    { name: "Ed25519" },
+    false,
+    ["sign"]
+  );
+  const sigBuf = await subtle.sign({ name: "Ed25519" }, cryptoKey, payload);
+  return {
+    keyId: key.keyId,
+    alg: "ed25519",
+    sig: hexEncode(new Uint8Array(sigBuf)),
+    signedHash: hexEncode(signedHash)
+  };
+}
+async function getSubtle2() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+function hexDecode(hex) {
+  if (hex.length % 2 !== 0) throw new Error("hexDecode: odd length");
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function ed25519PrivateKeyToPkcs8(seed) {
+  if (seed.length !== 32) throw new Error("ed25519 seed must be 32 bytes");
+  const prefix = new Uint8Array([
+    48,
+    46,
+    2,
+    1,
+    0,
+    48,
+    5,
+    6,
+    3,
+    43,
+    101,
+    112,
+    4,
+    34,
+    4,
+    32
+  ]);
+  const out = new Uint8Array(prefix.length + 32);
+  out.set(prefix, 0);
+  out.set(seed, prefix.length);
+  return out;
+}
+
+// src/verify.ts
+async function verifyManifest(manifest, options) {
+  if (manifest.signature.keyId !== options.expectedKeyId) {
+    return { ok: false, reason: "keyId-mismatch" };
+  }
+  const payload = canonicalSignedBytes(manifest);
+  const expectedHash = hexEncode(await sha256(payload));
+  if (expectedHash !== manifest.signature.signedHash) {
+    return { ok: false, reason: "signedHash-mismatch" };
+  }
+  const subtle = await getSubtle3();
+  const pubKey = await subtle.importKey(
+    "raw",
+    hexDecode2(options.publicKeyHex),
+    { name: "Ed25519" },
+    false,
+    ["verify"]
+  );
+  const valid = await subtle.verify(
+    { name: "Ed25519" },
+    pubKey,
+    hexDecode2(manifest.signature.sig),
+    payload
+  );
+  return valid ? { ok: true } : { ok: false, reason: "sig-invalid" };
+}
+async function getSubtle3() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+function hexDecode2(hex) {
+  if (hex.length % 2 !== 0) throw new Error("hexDecode: odd length");
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+
+// src/keypair.ts
+async function generateKeypair(keyId) {
+  const subtle = await getSubtle4();
+  const kp = await subtle.generateKey({ name: "Ed25519" }, true, [
+    "sign",
+    "verify"
+  ]);
+  const rawPub = new Uint8Array(await subtle.exportKey("raw", kp.publicKey));
+  const pkcs8Priv = new Uint8Array(await subtle.exportKey("pkcs8", kp.privateKey));
+  const seed = pkcs8Priv.slice(pkcs8Priv.length - 32);
+  return {
+    publicKeyHex: hexEncode(rawPub),
+    privateKeyHex: hexEncode(seed),
+    keyId
+  };
+}
+async function getSubtle4() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+
+// src/jwks.ts
+function jwksFromKeys(keys) {
+  return {
+    keys: keys.map((k) => ({
+      kid: k.keyId,
+      kty: "OKP",
+      crv: "Ed25519",
+      x: hexToBase64Url(k.publicKeyHex),
+      alg: "EdDSA",
+      use: "sig",
+      status: k.status
+    }))
+  };
+}
+async function verifyAgainstJwks(manifest, options) {
+  const sig = manifest.signature;
+  if (options.expectedKeyIds && !options.expectedKeyIds.includes(sig.keyId)) {
+    return { ok: false, reason: "pinned-key-mismatch" };
+  }
+  const entry = options.jwks.keys.find((k) => k.kid === sig.keyId);
+  if (!entry) return { ok: false, reason: "unknown-key" };
+  if (entry.status === "retired") return { ok: false, reason: "retired-key" };
+  if (options.maxAgeMs && manifest.builtAt) {
+    const age = (options.now ?? (() => /* @__PURE__ */ new Date()))().getTime() - new Date(manifest.builtAt).getTime();
+    if (age > options.maxAgeMs) return { ok: false, reason: "replay-window" };
+  }
+  const payload = canonicalSignedBytes(manifest);
+  const expectedHash = hexEncode(await sha256(payload));
+  if (expectedHash !== sig.signedHash) return { ok: false, reason: "signedHash-mismatch" };
+  const subtle = await getSubtle5();
+  const pubKey = await subtle.importKey(
+    "raw",
+    base64UrlToBytes(entry.x),
+    { name: "Ed25519" },
+    false,
+    ["verify"]
+  );
+  const valid = await subtle.verify(
+    { name: "Ed25519" },
+    pubKey,
+    hexToBytes(sig.sig),
+    payload
+  );
+  return valid ? { ok: true } : { ok: false, reason: "sig-invalid" };
+}
+async function getSubtle5() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function hexToBase64Url(hex) {
+  return bytesToBase64Url(hexToBytes(hex));
+}
+function bytesToBase64Url(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s).replace(/=+$/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function base64UrlToBytes(s) {
+  const pad = "=".repeat((4 - s.length % 4) % 4);
+  const b64 = (s + pad).replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+exports.canonicalSignedBytes = canonicalSignedBytes;
+exports.canonicalSignedPayload = canonicalSignedPayload;
+exports.generateKeypair = generateKeypair;
+exports.jwksFromKeys = jwksFromKeys;
+exports.signManifest = signManifest;
+exports.verifyAgainstJwks = verifyAgainstJwks;
+exports.verifyManifest = verifyManifest;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/canonical.ts","../src/hash.ts","../src/sign.ts","../src/verify.ts","../src/keypair.ts","../src/jwks.ts"],"names":["getSubtle","hexDecode"],"mappings":";;;AASO,SAAS,uBAAuB,CAAA,EAA6B;AAClE,EAAA,OAAO,IAAA,CAAK,SAAA;AAAA,IACV;AAAA,MACE,aAAa,CAAA,CAAE,WAAA;AAAA,MACf,iBAAiB,CAAA,CAAE,eAAA;AAAA,MACnB,eAAe,CAAA,CAAE,aAAA;AAAA,MACjB,UAAU,CAAA,CAAE;AAAA,KACd;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAEO,SAAS,qBAAqB,CAAA,EAAiC;AACpE,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,sBAAA,CAAuB,CAAC,CAAC,CAAA;AAC3D;;;ACxBA,eAAsB,OAAO,IAAA,EAAuC;AAClE,EAAA,MAAM,MAAA,GAAS,MAAM,SAAA,EAAU;AAC/B,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAW,IAAoB,CAAA;AAC/D,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC3B;AAEO,SAAS,UAAU,KAAA,EAA2B;AACnD,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,CAAA,IAAK,KAAA,CAAM,CAAC,EAAG,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAClF,EAAA,OAAO,CAAA;AACT;AAEA,eAAe,SAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;;;ACJA,eAAsB,YAAA,CACpB,UACA,GAAA,EAC4B;AAC5B,EAAA,MAAM,MAAA,GAAS,MAAMA,UAAAA,EAAU;AAC/B,EAAA,MAAM,OAAA,GAAU,qBAAqB,QAAQ,CAAA;AAC7C,EAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,OAAO,CAAA;AAEvC,EAAA,MAAM,KAAA,GAAQ,wBAAA,CAAyB,SAAA,CAAU,GAAA,CAAI,aAAa,CAAC,CAAA;AACnE,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,SAAA;AAAA,IAC7B,OAAA;AAAA,IACA,KAAA;AAAA,IACA,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,SAAA,EAAU,EAAG,SAAA,EAAW,OAAuB,CAAA;AACxF,EAAA,OAAO;AAAA,IACL,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,GAAA,EAAK,SAAA;AAAA,IACL,GAAA,EAAK,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,IACrC,UAAA,EAAY,UAAU,UAAU;AAAA,GAClC;AACF;AAEA,eAAeA,UAAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;AAEA,SAAS,UAAU,GAAA,EAAyB;AAC1C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,uBAAuB,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,MAAA,EAAQ,CAAA,EAAA,MAAS,CAAC,CAAA,GAAI,OAAO,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,GAAI,CAAA,EAAG,IAAI,CAAA,GAAI,CAAC,GAAG,EAAE,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,yBAAyB,IAAA,EAA8B;AAC9D,EAAA,IAAI,KAAK,MAAA,KAAW,EAAA,EAAI,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACvE,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW;AAAA,IAC5B,EAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAAM,GAAA;AAAA,IAAM,GAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM;AAAA,GAC3F,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,SAAS,EAAE,CAAA;AAC7C,EAAA,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAC,CAAA;AACjB,EAAA,GAAA,CAAI,GAAA,CAAI,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AAC3B,EAAA,OAAO,GAAA;AACT;;;AC7CA,eAAsB,cAAA,CACpB,UACA,OAAA,EACuB;AACvB,EAAA,IAAI,QAAA,CAAS,SAAA,CAAU,KAAA,KAAU,OAAA,CAAQ,aAAA,EAAe;AACtD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EAC/C;AACA,EAAA,MAAM,OAAA,GAAU,qBAAqB,QAAQ,CAAA;AAC7C,EAAA,MAAM,YAAA,GAAe,SAAA,CAAU,MAAM,MAAA,CAAO,OAAO,CAAC,CAAA;AACpD,EAAA,IAAI,YAAA,KAAiB,QAAA,CAAS,SAAA,CAAU,UAAA,EAAY;AAClD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB;AAAA,EACpD;AAEA,EAAA,MAAM,MAAA,GAAS,MAAMA,UAAAA,EAAU;AAC/B,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAA;AAAA,IAC1B,KAAA;AAAA,IACAC,UAAAA,CAAU,QAAQ,YAAY,CAAA;AAAA,IAC9B,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,KAAA;AAAA,IACA,CAAC,QAAQ;AAAA,GACX;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA;AAAA,IACzB,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,MAAA;AAAA,IACAA,UAAAA,CAAU,QAAA,CAAS,SAAA,CAAU,GAAG,CAAA;AAAA,IAChC;AAAA,GACF;AACA,EAAA,OAAO,KAAA,GAAQ,EAAE,EAAA,EAAI,IAAA,KAAS,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AACnE;AAEA,eAAeD,UAAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;AAEA,SAASC,WAAU,GAAA,EAAyB;AAC1C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,uBAAuB,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,MAAA,EAAQ,CAAA,EAAA,MAAS,CAAC,CAAA,GAAI,OAAO,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,GAAI,CAAA,EAAG,IAAI,CAAA,GAAI,CAAC,GAAG,EAAE,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;;;AC5CA,eAAsB,gBAAgB,KAAA,EAAwC;AAC5E,EAAA,MAAM,MAAA,GAAS,MAAMD,UAAAA,EAAU;AAC/B,EAAA,MAAM,EAAA,GAAM,MAAM,MAAA,CAAO,WAAA,CAAY,EAAE,IAAA,EAAM,SAAA,IAAa,IAAA,EAAM;AAAA,IAC9D,MAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW,MAAM,OAAO,SAAA,CAAU,KAAA,EAAO,EAAA,CAAG,SAAS,CAAC,CAAA;AACzE,EAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,MAAM,OAAO,SAAA,CAAU,OAAA,EAAS,EAAA,CAAG,UAAU,CAAC,CAAA;AAE/E,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,SAAS,EAAE,CAAA;AAClD,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,UAAU,MAAM,CAAA;AAAA,IAC9B,aAAA,EAAe,UAAU,IAAI,CAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAEA,eAAeA,UAAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;;;ACTO,SAAS,aACd,IAAA,EAKM;AACN,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACrB,KAAK,CAAA,CAAE,KAAA;AAAA,MACP,GAAA,EAAK,KAAA;AAAA,MACL,GAAA,EAAK,SAAA;AAAA,MACL,CAAA,EAAG,cAAA,CAAe,CAAA,CAAE,YAAY,CAAA;AAAA,MAChC,GAAA,EAAK,OAAA;AAAA,MACL,GAAA,EAAK,KAAA;AAAA,MACL,QAAQ,CAAA,CAAE;AAAA,KACZ,CAAE;AAAA,GACJ;AACF;AA6BA,eAAsB,iBAAA,CACpB,UACA,OAAA,EAC2B;AAC3B,EAAA,MAAM,MAAM,QAAA,CAAS,SAAA;AACrB,EAAA,IAAI,OAAA,CAAQ,kBAAkB,CAAC,OAAA,CAAQ,eAAe,QAAA,CAAS,GAAA,CAAI,KAAK,CAAA,EAAG;AACzE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB;AAAA,EACpD;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAA,CAAI,KAAK,CAAA;AAC/D,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,aAAA,EAAc;AACtD,EAAA,IAAI,KAAA,CAAM,WAAW,SAAA,EAAW,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,aAAA,EAAc;AAE1E,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,QAAA,CAAS,OAAA,EAAS;AACxC,IAAA,MAAM,GAAA,GAAA,CACH,OAAA,CAAQ,GAAA,KAAQ,0BAAU,IAAA,EAAK,CAAA,GAAI,CAAE,OAAA,KAAY,IAAI,IAAA,CAAK,QAAA,CAAS,OAAO,EAAE,OAAA,EAAQ;AACvF,IAAA,IAAI,GAAA,GAAM,QAAQ,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,eAAA,EAAgB;AAAA,EAC1E;AAEA,EAAA,MAAM,OAAA,GAAU,qBAAqB,QAAQ,CAAA;AAC7C,EAAA,MAAM,YAAA,GAAe,SAAA,CAAU,MAAM,MAAA,CAAO,OAAO,CAAC,CAAA;AACpD,EAAA,IAAI,YAAA,KAAiB,IAAI,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,qBAAA,EAAsB;AAEvF,EAAA,MAAM,MAAA,GAAS,MAAMA,UAAAA,EAAU;AAC/B,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAA;AAAA,IAC1B,KAAA;AAAA,IACA,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAAA,IACxB,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,KAAA;AAAA,IACA,CAAC,QAAQ;AAAA,GACX;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA;AAAA,IACzB,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,MAAA;AAAA,IACA,UAAA,CAAW,IAAI,GAAG,CAAA;AAAA,IAClB;AAAA,GACF;AACA,EAAA,OAAO,KAAA,GAAQ,EAAE,EAAA,EAAI,IAAA,KAAS,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AACnE;AAEA,eAAeA,UAAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;AAEA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,MAAA,EAAQ,CAAA,EAAA,MAAS,CAAC,CAAA,GAAI,OAAO,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,GAAI,CAAA,EAAG,IAAI,CAAA,GAAI,CAAC,GAAG,EAAE,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,eAAe,GAAA,EAAqB;AAC3C,EAAA,OAAO,gBAAA,CAAiB,UAAA,CAAW,GAAG,CAAC,CAAA;AACzC;AAEA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,IAAK,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAE,CAAA;AACzE,EAAA,OAAO,IAAA,CAAK,CAAC,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AAC3E;AAEA,SAAS,iBAAiB,CAAA,EAAuB;AAC/C,EAAA,MAAM,MAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,CAAA,CAAE,MAAA,GAAS,KAAM,CAAC,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAA,CAAO,IAAI,GAAA,EAAK,OAAA,CAAQ,MAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA;AAC1D,EAAA,MAAM,MAAA,GAAS,KAAK,GAAG,CAAA;AACvB,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACpE,EAAA,OAAO,GAAA;AACT","file":"index.cjs","sourcesContent":["import type { SignableManifest } from './types.js';\n\n/**\n * Canonical JSON of the signed payload — sorted keys, no whitespace.\n *\n * The payload is intentionally NOT the full manifest. It is the minimum that\n * binds a (manifestVersion, contentHash) pair to a tenant under a schema. See\n * ADR-0002.\n */\nexport function canonicalSignedPayload(m: SignableManifest): string {\n  return JSON.stringify(\n    {\n      contentHash: m.contentHash,\n      manifestVersion: m.manifestVersion,\n      schemaVersion: m.schemaVersion,\n      tenantId: m.tenantId,\n    },\n    null,\n    0,\n  );\n}\n\nexport function canonicalSignedBytes(m: SignableManifest): Uint8Array {\n  return new TextEncoder().encode(canonicalSignedPayload(m));\n}\n","export async function sha256(data: Uint8Array): Promise<Uint8Array> {\n  const subtle = await getSubtle();\n  const buf = await subtle.digest('SHA-256', data as BufferSource);\n  return new Uint8Array(buf);\n}\n\nexport function hexEncode(bytes: Uint8Array): string {\n  let s = '';\n  for (let i = 0; i < bytes.length; i++) s += bytes[i]!.toString(16).padStart(2, '0');\n  return s;\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n","import { canonicalSignedBytes } from './canonical.js';\nimport { hexEncode, sha256 } from './hash.js';\nimport type { ManifestSignature, SignableManifest } from './types.js';\n\n/** Universal-runtime Ed25519 signer (Node + Edge + browsers via crypto.subtle). */\nexport interface SignKey {\n  /** Raw 32-byte Ed25519 private key as hex. */\n  privateKeyHex: string;\n  /** Identifier for the key — included in the signature for rotation tracking. */\n  keyId: string;\n}\n\nexport async function signManifest(\n  manifest: SignableManifest,\n  key: SignKey,\n): Promise<ManifestSignature> {\n  const subtle = await getSubtle();\n  const payload = canonicalSignedBytes(manifest);\n  const signedHash = await sha256(payload);\n\n  const pkcs8 = ed25519PrivateKeyToPkcs8(hexDecode(key.privateKeyHex));\n  const cryptoKey = await subtle.importKey(\n    'pkcs8',\n    pkcs8 as BufferSource,\n    { name: 'Ed25519' },\n    false,\n    ['sign'],\n  );\n  const sigBuf = await subtle.sign({ name: 'Ed25519' }, cryptoKey, payload as BufferSource);\n  return {\n    keyId: key.keyId,\n    alg: 'ed25519',\n    sig: hexEncode(new Uint8Array(sigBuf)),\n    signedHash: hexEncode(signedHash),\n  };\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\nfunction hexDecode(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error('hexDecode: odd length');\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  return out;\n}\n\n/** Wrap a raw 32-byte Ed25519 seed into a minimal PKCS#8 envelope (RFC 8410). */\nfunction ed25519PrivateKeyToPkcs8(seed: Uint8Array): Uint8Array {\n  if (seed.length !== 32) throw new Error('ed25519 seed must be 32 bytes');\n  const prefix = new Uint8Array([\n    0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20,\n  ]);\n  const out = new Uint8Array(prefix.length + 32);\n  out.set(prefix, 0);\n  out.set(seed, prefix.length);\n  return out;\n}\n","import { canonicalSignedBytes } from './canonical.js';\nimport { hexEncode, sha256 } from './hash.js';\nimport type { ManifestSignature, SignableManifest } from './types.js';\n\nexport interface VerifyOptions {\n  /** Hex-encoded raw 32-byte Ed25519 public key. */\n  publicKeyHex: string;\n  /** Required keyId — caller pins this at SDK init time. */\n  expectedKeyId: string;\n}\n\nexport type VerifyResult =\n  | { ok: true }\n  | { ok: false; reason: 'keyId-mismatch' | 'signedHash-mismatch' | 'sig-invalid' };\n\nexport async function verifyManifest(\n  manifest: SignableManifest & { signature: ManifestSignature },\n  options: VerifyOptions,\n): Promise<VerifyResult> {\n  if (manifest.signature.keyId !== options.expectedKeyId) {\n    return { ok: false, reason: 'keyId-mismatch' };\n  }\n  const payload = canonicalSignedBytes(manifest);\n  const expectedHash = hexEncode(await sha256(payload));\n  if (expectedHash !== manifest.signature.signedHash) {\n    return { ok: false, reason: 'signedHash-mismatch' };\n  }\n\n  const subtle = await getSubtle();\n  const pubKey = await subtle.importKey(\n    'raw',\n    hexDecode(options.publicKeyHex) as BufferSource,\n    { name: 'Ed25519' },\n    false,\n    ['verify'],\n  );\n  const valid = await subtle.verify(\n    { name: 'Ed25519' },\n    pubKey,\n    hexDecode(manifest.signature.sig) as BufferSource,\n    payload as BufferSource,\n  );\n  return valid ? { ok: true } : { ok: false, reason: 'sig-invalid' };\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\nfunction hexDecode(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error('hexDecode: odd length');\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  return out;\n}\n","/**\n * Ed25519 keypair generation for `fx dev` and tests. Production keys are\n * generated offline and stored in a secrets manager.\n */\nimport { hexEncode } from './hash.js';\n\nexport interface Ed25519Keypair {\n  publicKeyHex: string;\n  privateKeyHex: string;\n  keyId: string;\n}\n\nexport async function generateKeypair(keyId: string): Promise<Ed25519Keypair> {\n  const subtle = await getSubtle();\n  const kp = (await subtle.generateKey({ name: 'Ed25519' }, true, [\n    'sign',\n    'verify',\n  ])) as CryptoKeyPair;\n  const rawPub = new Uint8Array(await subtle.exportKey('raw', kp.publicKey));\n  const pkcs8Priv = new Uint8Array(await subtle.exportKey('pkcs8', kp.privateKey));\n  // PKCS#8 ed25519 = 16-byte prefix + 32-byte seed. Strip the prefix.\n  const seed = pkcs8Priv.slice(pkcs8Priv.length - 32);\n  return {\n    publicKeyHex: hexEncode(rawPub),\n    privateKeyHex: hexEncode(seed),\n    keyId,\n  };\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n","import { canonicalSignedBytes } from './canonical.js';\nimport { hexEncode, sha256 } from './hash.js';\nimport type { ManifestSignature, SignableManifest } from './types.js';\n\n/**\n * JWKS-style key set for a single org. Each entry is an Ed25519 public key\n * with a kid that matches a `manifest_keys.key_id` in the control plane.\n */\nexport interface JwksEntry {\n  kid: string;\n  kty: 'OKP';\n  crv: 'Ed25519';\n  /** Base64url-encoded raw 32-byte public key. */\n  x: string;\n  alg: 'EdDSA';\n  use: 'sig';\n  /** Lifecycle status — extension on top of the JWKS standard. */\n  status: 'active' | 'retiring' | 'retired';\n}\n\nexport interface Jwks {\n  keys: JwksEntry[];\n}\n\nexport function jwksFromKeys(\n  keys: readonly {\n    keyId: string;\n    publicKeyHex: string;\n    status: 'active' | 'retiring' | 'retired';\n  }[],\n): Jwks {\n  return {\n    keys: keys.map((k) => ({\n      kid: k.keyId,\n      kty: 'OKP',\n      crv: 'Ed25519',\n      x: hexToBase64Url(k.publicKeyHex),\n      alg: 'EdDSA',\n      use: 'sig',\n      status: k.status,\n    })),\n  };\n}\n\nexport interface VerifyAgainstJwksOptions {\n  jwks: Jwks;\n  /** Optional pinning. If set, rejects keys whose kid is not in this list. */\n  expectedKeyIds?: string[];\n  /** Reject manifests older than this many milliseconds (replay window). */\n  maxAgeMs?: number;\n  /** Override clock for tests. */\n  now?: () => Date;\n}\n\nexport type JwksVerifyResult =\n  | { ok: true }\n  | {\n      ok: false;\n      reason:\n        | 'unknown-key'\n        | 'retired-key'\n        | 'pinned-key-mismatch'\n        | 'signedHash-mismatch'\n        | 'sig-invalid'\n        | 'replay-window';\n    };\n\n/**\n * Verify a signed manifest against a JWKS document. Replaces ADR-0002's\n * single-key verifier when SDKs run in M3+ hosted mode.\n */\nexport async function verifyAgainstJwks(\n  manifest: SignableManifest & { signature: ManifestSignature; builtAt?: string },\n  options: VerifyAgainstJwksOptions,\n): Promise<JwksVerifyResult> {\n  const sig = manifest.signature;\n  if (options.expectedKeyIds && !options.expectedKeyIds.includes(sig.keyId)) {\n    return { ok: false, reason: 'pinned-key-mismatch' };\n  }\n  const entry = options.jwks.keys.find((k) => k.kid === sig.keyId);\n  if (!entry) return { ok: false, reason: 'unknown-key' };\n  if (entry.status === 'retired') return { ok: false, reason: 'retired-key' };\n\n  if (options.maxAgeMs && manifest.builtAt) {\n    const age =\n      (options.now ?? (() => new Date()))().getTime() - new Date(manifest.builtAt).getTime();\n    if (age > options.maxAgeMs) return { ok: false, reason: 'replay-window' };\n  }\n\n  const payload = canonicalSignedBytes(manifest);\n  const expectedHash = hexEncode(await sha256(payload));\n  if (expectedHash !== sig.signedHash) return { ok: false, reason: 'signedHash-mismatch' };\n\n  const subtle = await getSubtle();\n  const pubKey = await subtle.importKey(\n    'raw',\n    base64UrlToBytes(entry.x) as BufferSource,\n    { name: 'Ed25519' },\n    false,\n    ['verify'],\n  );\n  const valid = await subtle.verify(\n    { name: 'Ed25519' },\n    pubKey,\n    hexToBytes(sig.sig) as BufferSource,\n    payload as BufferSource,\n  );\n  return valid ? { ok: true } : { ok: false, reason: 'sig-invalid' };\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  return out;\n}\n\nfunction hexToBase64Url(hex: string): string {\n  return bytesToBase64Url(hexToBytes(hex));\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let s = '';\n  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]!);\n  return btoa(s).replace(/=+$/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n\nfunction base64UrlToBytes(s: string): Uint8Array {\n  const pad = '='.repeat((4 - (s.length % 4)) % 4);\n  const b64 = (s + pad).replace(/-/g, '+').replace(/_/g, '/');\n  const binary = atob(b64);\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n  return out;\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,115 @@
+/**
+ * Re-declared structurally to keep this package free of `@fabricorg/experiments-domain`
+ * and `@fabricorg/experiments-manifest` imports — see boundary rules.
+ *
+ * The fields below are the subset that participates in the signed payload.
+ * See docs/adr/0002-manifest-signing.md for the protocol.
+ */
+interface SignableManifest {
+    schemaVersion: number;
+    manifestVersion: number;
+    tenantId: string;
+    contentHash: string;
+}
+interface ManifestSignature {
+    keyId: string;
+    alg: 'ed25519';
+    /** Hex-encoded 64-byte Ed25519 signature. */
+    sig: string;
+    /** Hex-encoded SHA-256 of the canonical signed payload. */
+    signedHash: string;
+}
+interface SignedManifest extends SignableManifest {
+    signature: ManifestSignature;
+}
+
+/**
+ * Canonical JSON of the signed payload — sorted keys, no whitespace.
+ *
+ * The payload is intentionally NOT the full manifest. It is the minimum that
+ * binds a (manifestVersion, contentHash) pair to a tenant under a schema. See
+ * ADR-0002.
+ */
+declare function canonicalSignedPayload(m: SignableManifest): string;
+declare function canonicalSignedBytes(m: SignableManifest): Uint8Array;
+
+/** Universal-runtime Ed25519 signer (Node + Edge + browsers via crypto.subtle). */
+interface SignKey {
+    /** Raw 32-byte Ed25519 private key as hex. */
+    privateKeyHex: string;
+    /** Identifier for the key — included in the signature for rotation tracking. */
+    keyId: string;
+}
+declare function signManifest(manifest: SignableManifest, key: SignKey): Promise<ManifestSignature>;
+
+interface VerifyOptions {
+    /** Hex-encoded raw 32-byte Ed25519 public key. */
+    publicKeyHex: string;
+    /** Required keyId — caller pins this at SDK init time. */
+    expectedKeyId: string;
+}
+type VerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'keyId-mismatch' | 'signedHash-mismatch' | 'sig-invalid';
+};
+declare function verifyManifest(manifest: SignableManifest & {
+    signature: ManifestSignature;
+}, options: VerifyOptions): Promise<VerifyResult>;
+
+interface Ed25519Keypair {
+    publicKeyHex: string;
+    privateKeyHex: string;
+    keyId: string;
+}
+declare function generateKeypair(keyId: string): Promise<Ed25519Keypair>;
+
+/**
+ * JWKS-style key set for a single org. Each entry is an Ed25519 public key
+ * with a kid that matches a `manifest_keys.key_id` in the control plane.
+ */
+interface JwksEntry {
+    kid: string;
+    kty: 'OKP';
+    crv: 'Ed25519';
+    /** Base64url-encoded raw 32-byte public key. */
+    x: string;
+    alg: 'EdDSA';
+    use: 'sig';
+    /** Lifecycle status — extension on top of the JWKS standard. */
+    status: 'active' | 'retiring' | 'retired';
+}
+interface Jwks {
+    keys: JwksEntry[];
+}
+declare function jwksFromKeys(keys: readonly {
+    keyId: string;
+    publicKeyHex: string;
+    status: 'active' | 'retiring' | 'retired';
+}[]): Jwks;
+interface VerifyAgainstJwksOptions {
+    jwks: Jwks;
+    /** Optional pinning. If set, rejects keys whose kid is not in this list. */
+    expectedKeyIds?: string[];
+    /** Reject manifests older than this many milliseconds (replay window). */
+    maxAgeMs?: number;
+    /** Override clock for tests. */
+    now?: () => Date;
+}
+type JwksVerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'unknown-key' | 'retired-key' | 'pinned-key-mismatch' | 'signedHash-mismatch' | 'sig-invalid' | 'replay-window';
+};
+/**
+ * Verify a signed manifest against a JWKS document. Replaces ADR-0002's
+ * single-key verifier when SDKs run in M3+ hosted mode.
+ */
+declare function verifyAgainstJwks(manifest: SignableManifest & {
+    signature: ManifestSignature;
+    builtAt?: string;
+}, options: VerifyAgainstJwksOptions): Promise<JwksVerifyResult>;
+
+export { type Ed25519Keypair, type Jwks, type JwksEntry, type JwksVerifyResult, type ManifestSignature, type SignKey, type SignableManifest, type SignedManifest, type VerifyAgainstJwksOptions, type VerifyOptions, type VerifyResult, canonicalSignedBytes, canonicalSignedPayload, generateKeypair, jwksFromKeys, signManifest, verifyAgainstJwks, verifyManifest };

package/dist/index.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Re-declared structurally to keep this package free of `@fabricorg/experiments-domain`
+ * and `@fabricorg/experiments-manifest` imports — see boundary rules.
+ *
+ * The fields below are the subset that participates in the signed payload.
+ * See docs/adr/0002-manifest-signing.md for the protocol.
+ */
+interface SignableManifest {
+    schemaVersion: number;
+    manifestVersion: number;
+    tenantId: string;
+    contentHash: string;
+}
+interface ManifestSignature {
+    keyId: string;
+    alg: 'ed25519';
+    /** Hex-encoded 64-byte Ed25519 signature. */
+    sig: string;
+    /** Hex-encoded SHA-256 of the canonical signed payload. */
+    signedHash: string;
+}
+interface SignedManifest extends SignableManifest {
+    signature: ManifestSignature;
+}
+
+/**
+ * Canonical JSON of the signed payload — sorted keys, no whitespace.
+ *
+ * The payload is intentionally NOT the full manifest. It is the minimum that
+ * binds a (manifestVersion, contentHash) pair to a tenant under a schema. See
+ * ADR-0002.
+ */
+declare function canonicalSignedPayload(m: SignableManifest): string;
+declare function canonicalSignedBytes(m: SignableManifest): Uint8Array;
+
+/** Universal-runtime Ed25519 signer (Node + Edge + browsers via crypto.subtle). */
+interface SignKey {
+    /** Raw 32-byte Ed25519 private key as hex. */
+    privateKeyHex: string;
+    /** Identifier for the key — included in the signature for rotation tracking. */
+    keyId: string;
+}
+declare function signManifest(manifest: SignableManifest, key: SignKey): Promise<ManifestSignature>;
+
+interface VerifyOptions {
+    /** Hex-encoded raw 32-byte Ed25519 public key. */
+    publicKeyHex: string;
+    /** Required keyId — caller pins this at SDK init time. */
+    expectedKeyId: string;
+}
+type VerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'keyId-mismatch' | 'signedHash-mismatch' | 'sig-invalid';
+};
+declare function verifyManifest(manifest: SignableManifest & {
+    signature: ManifestSignature;
+}, options: VerifyOptions): Promise<VerifyResult>;
+
+interface Ed25519Keypair {
+    publicKeyHex: string;
+    privateKeyHex: string;
+    keyId: string;
+}
+declare function generateKeypair(keyId: string): Promise<Ed25519Keypair>;
+
+/**
+ * JWKS-style key set for a single org. Each entry is an Ed25519 public key
+ * with a kid that matches a `manifest_keys.key_id` in the control plane.
+ */
+interface JwksEntry {
+    kid: string;
+    kty: 'OKP';
+    crv: 'Ed25519';
+    /** Base64url-encoded raw 32-byte public key. */
+    x: string;
+    alg: 'EdDSA';
+    use: 'sig';
+    /** Lifecycle status — extension on top of the JWKS standard. */
+    status: 'active' | 'retiring' | 'retired';
+}
+interface Jwks {
+    keys: JwksEntry[];
+}
+declare function jwksFromKeys(keys: readonly {
+    keyId: string;
+    publicKeyHex: string;
+    status: 'active' | 'retiring' | 'retired';
+}[]): Jwks;
+interface VerifyAgainstJwksOptions {
+    jwks: Jwks;
+    /** Optional pinning. If set, rejects keys whose kid is not in this list. */
+    expectedKeyIds?: string[];
+    /** Reject manifests older than this many milliseconds (replay window). */
+    maxAgeMs?: number;
+    /** Override clock for tests. */
+    now?: () => Date;
+}
+type JwksVerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'unknown-key' | 'retired-key' | 'pinned-key-mismatch' | 'signedHash-mismatch' | 'sig-invalid' | 'replay-window';
+};
+/**
+ * Verify a signed manifest against a JWKS document. Replaces ADR-0002's
+ * single-key verifier when SDKs run in M3+ hosted mode.
+ */
+declare function verifyAgainstJwks(manifest: SignableManifest & {
+    signature: ManifestSignature;
+    builtAt?: string;
+}, options: VerifyAgainstJwksOptions): Promise<JwksVerifyResult>;
+
+export { type Ed25519Keypair, type Jwks, type JwksEntry, type JwksVerifyResult, type ManifestSignature, type SignKey, type SignableManifest, type SignedManifest, type VerifyAgainstJwksOptions, type VerifyOptions, type VerifyResult, canonicalSignedBytes, canonicalSignedPayload, generateKeypair, jwksFromKeys, signManifest, verifyAgainstJwks, verifyManifest };

package/dist/index.js

@@ -0,0 +1,227 @@
+// src/canonical.ts
+function canonicalSignedPayload(m) {
+  return JSON.stringify(
+    {
+      contentHash: m.contentHash,
+      manifestVersion: m.manifestVersion,
+      schemaVersion: m.schemaVersion,
+      tenantId: m.tenantId
+    },
+    null,
+    0
+  );
+}
+function canonicalSignedBytes(m) {
+  return new TextEncoder().encode(canonicalSignedPayload(m));
+}
+
+// src/hash.ts
+async function sha256(data) {
+  const subtle = await getSubtle();
+  const buf = await subtle.digest("SHA-256", data);
+  return new Uint8Array(buf);
+}
+function hexEncode(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += bytes[i].toString(16).padStart(2, "0");
+  return s;
+}
+async function getSubtle() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+
+// src/sign.ts
+async function signManifest(manifest, key) {
+  const subtle = await getSubtle2();
+  const payload = canonicalSignedBytes(manifest);
+  const signedHash = await sha256(payload);
+  const pkcs8 = ed25519PrivateKeyToPkcs8(hexDecode(key.privateKeyHex));
+  const cryptoKey = await subtle.importKey(
+    "pkcs8",
+    pkcs8,
+    { name: "Ed25519" },
+    false,
+    ["sign"]
+  );
+  const sigBuf = await subtle.sign({ name: "Ed25519" }, cryptoKey, payload);
+  return {
+    keyId: key.keyId,
+    alg: "ed25519",
+    sig: hexEncode(new Uint8Array(sigBuf)),
+    signedHash: hexEncode(signedHash)
+  };
+}
+async function getSubtle2() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+function hexDecode(hex) {
+  if (hex.length % 2 !== 0) throw new Error("hexDecode: odd length");
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function ed25519PrivateKeyToPkcs8(seed) {
+  if (seed.length !== 32) throw new Error("ed25519 seed must be 32 bytes");
+  const prefix = new Uint8Array([
+    48,
+    46,
+    2,
+    1,
+    0,
+    48,
+    5,
+    6,
+    3,
+    43,
+    101,
+    112,
+    4,
+    34,
+    4,
+    32
+  ]);
+  const out = new Uint8Array(prefix.length + 32);
+  out.set(prefix, 0);
+  out.set(seed, prefix.length);
+  return out;
+}
+
+// src/verify.ts
+async function verifyManifest(manifest, options) {
+  if (manifest.signature.keyId !== options.expectedKeyId) {
+    return { ok: false, reason: "keyId-mismatch" };
+  }
+  const payload = canonicalSignedBytes(manifest);
+  const expectedHash = hexEncode(await sha256(payload));
+  if (expectedHash !== manifest.signature.signedHash) {
+    return { ok: false, reason: "signedHash-mismatch" };
+  }
+  const subtle = await getSubtle3();
+  const pubKey = await subtle.importKey(
+    "raw",
+    hexDecode2(options.publicKeyHex),
+    { name: "Ed25519" },
+    false,
+    ["verify"]
+  );
+  const valid = await subtle.verify(
+    { name: "Ed25519" },
+    pubKey,
+    hexDecode2(manifest.signature.sig),
+    payload
+  );
+  return valid ? { ok: true } : { ok: false, reason: "sig-invalid" };
+}
+async function getSubtle3() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+function hexDecode2(hex) {
+  if (hex.length % 2 !== 0) throw new Error("hexDecode: odd length");
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+
+// src/keypair.ts
+async function generateKeypair(keyId) {
+  const subtle = await getSubtle4();
+  const kp = await subtle.generateKey({ name: "Ed25519" }, true, [
+    "sign",
+    "verify"
+  ]);
+  const rawPub = new Uint8Array(await subtle.exportKey("raw", kp.publicKey));
+  const pkcs8Priv = new Uint8Array(await subtle.exportKey("pkcs8", kp.privateKey));
+  const seed = pkcs8Priv.slice(pkcs8Priv.length - 32);
+  return {
+    publicKeyHex: hexEncode(rawPub),
+    privateKeyHex: hexEncode(seed),
+    keyId
+  };
+}
+async function getSubtle4() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+
+// src/jwks.ts
+function jwksFromKeys(keys) {
+  return {
+    keys: keys.map((k) => ({
+      kid: k.keyId,
+      kty: "OKP",
+      crv: "Ed25519",
+      x: hexToBase64Url(k.publicKeyHex),
+      alg: "EdDSA",
+      use: "sig",
+      status: k.status
+    }))
+  };
+}
+async function verifyAgainstJwks(manifest, options) {
+  const sig = manifest.signature;
+  if (options.expectedKeyIds && !options.expectedKeyIds.includes(sig.keyId)) {
+    return { ok: false, reason: "pinned-key-mismatch" };
+  }
+  const entry = options.jwks.keys.find((k) => k.kid === sig.keyId);
+  if (!entry) return { ok: false, reason: "unknown-key" };
+  if (entry.status === "retired") return { ok: false, reason: "retired-key" };
+  if (options.maxAgeMs && manifest.builtAt) {
+    const age = (options.now ?? (() => /* @__PURE__ */ new Date()))().getTime() - new Date(manifest.builtAt).getTime();
+    if (age > options.maxAgeMs) return { ok: false, reason: "replay-window" };
+  }
+  const payload = canonicalSignedBytes(manifest);
+  const expectedHash = hexEncode(await sha256(payload));
+  if (expectedHash !== sig.signedHash) return { ok: false, reason: "signedHash-mismatch" };
+  const subtle = await getSubtle5();
+  const pubKey = await subtle.importKey(
+    "raw",
+    base64UrlToBytes(entry.x),
+    { name: "Ed25519" },
+    false,
+    ["verify"]
+  );
+  const valid = await subtle.verify(
+    { name: "Ed25519" },
+    pubKey,
+    hexToBytes(sig.sig),
+    payload
+  );
+  return valid ? { ok: true } : { ok: false, reason: "sig-invalid" };
+}
+async function getSubtle5() {
+  if (typeof crypto !== "undefined" && crypto.subtle) return crypto.subtle;
+  const { webcrypto } = await import('crypto');
+  return webcrypto.subtle;
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function hexToBase64Url(hex) {
+  return bytesToBase64Url(hexToBytes(hex));
+}
+function bytesToBase64Url(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s).replace(/=+$/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function base64UrlToBytes(s) {
+  const pad = "=".repeat((4 - s.length % 4) % 4);
+  const b64 = (s + pad).replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+export { canonicalSignedBytes, canonicalSignedPayload, generateKeypair, jwksFromKeys, signManifest, verifyAgainstJwks, verifyManifest };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/canonical.ts","../src/hash.ts","../src/sign.ts","../src/verify.ts","../src/keypair.ts","../src/jwks.ts"],"names":["getSubtle","hexDecode"],"mappings":";AASO,SAAS,uBAAuB,CAAA,EAA6B;AAClE,EAAA,OAAO,IAAA,CAAK,SAAA;AAAA,IACV;AAAA,MACE,aAAa,CAAA,CAAE,WAAA;AAAA,MACf,iBAAiB,CAAA,CAAE,eAAA;AAAA,MACnB,eAAe,CAAA,CAAE,aAAA;AAAA,MACjB,UAAU,CAAA,CAAE;AAAA,KACd;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAEO,SAAS,qBAAqB,CAAA,EAAiC;AACpE,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,sBAAA,CAAuB,CAAC,CAAC,CAAA;AAC3D;;;ACxBA,eAAsB,OAAO,IAAA,EAAuC;AAClE,EAAA,MAAM,MAAA,GAAS,MAAM,SAAA,EAAU;AAC/B,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAW,IAAoB,CAAA;AAC/D,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC3B;AAEO,SAAS,UAAU,KAAA,EAA2B;AACnD,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,CAAA,IAAK,KAAA,CAAM,CAAC,EAAG,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAClF,EAAA,OAAO,CAAA;AACT;AAEA,eAAe,SAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;;;ACJA,eAAsB,YAAA,CACpB,UACA,GAAA,EAC4B;AAC5B,EAAA,MAAM,MAAA,GAAS,MAAMA,UAAAA,EAAU;AAC/B,EAAA,MAAM,OAAA,GAAU,qBAAqB,QAAQ,CAAA;AAC7C,EAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,OAAO,CAAA;AAEvC,EAAA,MAAM,KAAA,GAAQ,wBAAA,CAAyB,SAAA,CAAU,GAAA,CAAI,aAAa,CAAC,CAAA;AACnE,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,SAAA;AAAA,IAC7B,OAAA;AAAA,IACA,KAAA;AAAA,IACA,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,SAAA,EAAU,EAAG,SAAA,EAAW,OAAuB,CAAA;AACxF,EAAA,OAAO;AAAA,IACL,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,GAAA,EAAK,SAAA;AAAA,IACL,GAAA,EAAK,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,IACrC,UAAA,EAAY,UAAU,UAAU;AAAA,GAClC;AACF;AAEA,eAAeA,UAAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;AAEA,SAAS,UAAU,GAAA,EAAyB;AAC1C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,uBAAuB,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,MAAA,EAAQ,CAAA,EAAA,MAAS,CAAC,CAAA,GAAI,OAAO,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,GAAI,CAAA,EAAG,IAAI,CAAA,GAAI,CAAC,GAAG,EAAE,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,yBAAyB,IAAA,EAA8B;AAC9D,EAAA,IAAI,KAAK,MAAA,KAAW,EAAA,EAAI,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACvE,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW;AAAA,IAC5B,EAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAAM,GAAA;AAAA,IAAM,GAAA;AAAA,IAAM,CAAA;AAAA,IAAM,EAAA;AAAA,IAAM,CAAA;AAAA,IAAM;AAAA,GAC3F,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,SAAS,EAAE,CAAA;AAC7C,EAAA,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAC,CAAA;AACjB,EAAA,GAAA,CAAI,GAAA,CAAI,IAAA,EAAM,MAAA,CAAO,MAAM,CAAA;AAC3B,EAAA,OAAO,GAAA;AACT;;;AC7CA,eAAsB,cAAA,CACpB,UACA,OAAA,EACuB;AACvB,EAAA,IAAI,QAAA,CAAS,SAAA,CAAU,KAAA,KAAU,OAAA,CAAQ,aAAA,EAAe;AACtD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EAC/C;AACA,EAAA,MAAM,OAAA,GAAU,qBAAqB,QAAQ,CAAA;AAC7C,EAAA,MAAM,YAAA,GAAe,SAAA,CAAU,MAAM,MAAA,CAAO,OAAO,CAAC,CAAA;AACpD,EAAA,IAAI,YAAA,KAAiB,QAAA,CAAS,SAAA,CAAU,UAAA,EAAY;AAClD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB;AAAA,EACpD;AAEA,EAAA,MAAM,MAAA,GAAS,MAAMA,UAAAA,EAAU;AAC/B,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAA;AAAA,IAC1B,KAAA;AAAA,IACAC,UAAAA,CAAU,QAAQ,YAAY,CAAA;AAAA,IAC9B,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,KAAA;AAAA,IACA,CAAC,QAAQ;AAAA,GACX;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA;AAAA,IACzB,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,MAAA;AAAA,IACAA,UAAAA,CAAU,QAAA,CAAS,SAAA,CAAU,GAAG,CAAA;AAAA,IAChC;AAAA,GACF;AACA,EAAA,OAAO,KAAA,GAAQ,EAAE,EAAA,EAAI,IAAA,KAAS,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AACnE;AAEA,eAAeD,UAAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;AAEA,SAASC,WAAU,GAAA,EAAyB;AAC1C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,uBAAuB,CAAA;AACjE,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,MAAA,EAAQ,CAAA,EAAA,MAAS,CAAC,CAAA,GAAI,OAAO,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,GAAI,CAAA,EAAG,IAAI,CAAA,GAAI,CAAC,GAAG,EAAE,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;;;AC5CA,eAAsB,gBAAgB,KAAA,EAAwC;AAC5E,EAAA,MAAM,MAAA,GAAS,MAAMD,UAAAA,EAAU;AAC/B,EAAA,MAAM,EAAA,GAAM,MAAM,MAAA,CAAO,WAAA,CAAY,EAAE,IAAA,EAAM,SAAA,IAAa,IAAA,EAAM;AAAA,IAC9D,MAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW,MAAM,OAAO,SAAA,CAAU,KAAA,EAAO,EAAA,CAAG,SAAS,CAAC,CAAA;AACzE,EAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,MAAM,OAAO,SAAA,CAAU,OAAA,EAAS,EAAA,CAAG,UAAU,CAAC,CAAA;AAE/E,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,SAAS,EAAE,CAAA;AAClD,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,UAAU,MAAM,CAAA;AAAA,IAC9B,aAAA,EAAe,UAAU,IAAI,CAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAEA,eAAeA,UAAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;;;ACTO,SAAS,aACd,IAAA,EAKM;AACN,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACrB,KAAK,CAAA,CAAE,KAAA;AAAA,MACP,GAAA,EAAK,KAAA;AAAA,MACL,GAAA,EAAK,SAAA;AAAA,MACL,CAAA,EAAG,cAAA,CAAe,CAAA,CAAE,YAAY,CAAA;AAAA,MAChC,GAAA,EAAK,OAAA;AAAA,MACL,GAAA,EAAK,KAAA;AAAA,MACL,QAAQ,CAAA,CAAE;AAAA,KACZ,CAAE;AAAA,GACJ;AACF;AA6BA,eAAsB,iBAAA,CACpB,UACA,OAAA,EAC2B;AAC3B,EAAA,MAAM,MAAM,QAAA,CAAS,SAAA;AACrB,EAAA,IAAI,OAAA,CAAQ,kBAAkB,CAAC,OAAA,CAAQ,eAAe,QAAA,CAAS,GAAA,CAAI,KAAK,CAAA,EAAG;AACzE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB;AAAA,EACpD;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAA,CAAI,KAAK,CAAA;AAC/D,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,aAAA,EAAc;AACtD,EAAA,IAAI,KAAA,CAAM,WAAW,SAAA,EAAW,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,aAAA,EAAc;AAE1E,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,QAAA,CAAS,OAAA,EAAS;AACxC,IAAA,MAAM,GAAA,GAAA,CACH,OAAA,CAAQ,GAAA,KAAQ,0BAAU,IAAA,EAAK,CAAA,GAAI,CAAE,OAAA,KAAY,IAAI,IAAA,CAAK,QAAA,CAAS,OAAO,EAAE,OAAA,EAAQ;AACvF,IAAA,IAAI,GAAA,GAAM,QAAQ,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,eAAA,EAAgB;AAAA,EAC1E;AAEA,EAAA,MAAM,OAAA,GAAU,qBAAqB,QAAQ,CAAA;AAC7C,EAAA,MAAM,YAAA,GAAe,SAAA,CAAU,MAAM,MAAA,CAAO,OAAO,CAAC,CAAA;AACpD,EAAA,IAAI,YAAA,KAAiB,IAAI,UAAA,EAAY,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,qBAAA,EAAsB;AAEvF,EAAA,MAAM,MAAA,GAAS,MAAMA,UAAAA,EAAU;AAC/B,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAA;AAAA,IAC1B,KAAA;AAAA,IACA,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAAA,IACxB,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,KAAA;AAAA,IACA,CAAC,QAAQ;AAAA,GACX;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA;AAAA,IACzB,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,MAAA;AAAA,IACA,UAAA,CAAW,IAAI,GAAG,CAAA;AAAA,IAClB;AAAA,GACF;AACA,EAAA,OAAO,KAAA,GAAQ,EAAE,EAAA,EAAI,IAAA,KAAS,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AACnE;AAEA,eAAeA,UAAAA,GAAmC;AAChD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,MAAA,SAAe,MAAA,CAAO,MAAA;AAClE,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,QAAa,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,MAAA;AACnB;AAEA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,MAAA,EAAQ,CAAA,EAAA,MAAS,CAAC,CAAA,GAAI,OAAO,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,GAAI,CAAA,EAAG,IAAI,CAAA,GAAI,CAAC,GAAG,EAAE,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,eAAe,GAAA,EAAqB;AAC3C,EAAA,OAAO,gBAAA,CAAiB,UAAA,CAAW,GAAG,CAAC,CAAA;AACzC;AAEA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,CAAA,EAAA,EAAK,CAAA,IAAK,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAE,CAAA;AACzE,EAAA,OAAO,IAAA,CAAK,CAAC,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AAC3E;AAEA,SAAS,iBAAiB,CAAA,EAAuB;AAC/C,EAAA,MAAM,MAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,CAAA,CAAE,MAAA,GAAS,KAAM,CAAC,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAA,CAAO,IAAI,GAAA,EAAK,OAAA,CAAQ,MAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA;AAC1D,EAAA,MAAM,MAAA,GAAS,KAAK,GAAG,CAAA;AACvB,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACpE,EAAA,OAAO,GAAA;AACT","file":"index.js","sourcesContent":["import type { SignableManifest } from './types.js';\n\n/**\n * Canonical JSON of the signed payload — sorted keys, no whitespace.\n *\n * The payload is intentionally NOT the full manifest. It is the minimum that\n * binds a (manifestVersion, contentHash) pair to a tenant under a schema. See\n * ADR-0002.\n */\nexport function canonicalSignedPayload(m: SignableManifest): string {\n  return JSON.stringify(\n    {\n      contentHash: m.contentHash,\n      manifestVersion: m.manifestVersion,\n      schemaVersion: m.schemaVersion,\n      tenantId: m.tenantId,\n    },\n    null,\n    0,\n  );\n}\n\nexport function canonicalSignedBytes(m: SignableManifest): Uint8Array {\n  return new TextEncoder().encode(canonicalSignedPayload(m));\n}\n","export async function sha256(data: Uint8Array): Promise<Uint8Array> {\n  const subtle = await getSubtle();\n  const buf = await subtle.digest('SHA-256', data as BufferSource);\n  return new Uint8Array(buf);\n}\n\nexport function hexEncode(bytes: Uint8Array): string {\n  let s = '';\n  for (let i = 0; i < bytes.length; i++) s += bytes[i]!.toString(16).padStart(2, '0');\n  return s;\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n","import { canonicalSignedBytes } from './canonical.js';\nimport { hexEncode, sha256 } from './hash.js';\nimport type { ManifestSignature, SignableManifest } from './types.js';\n\n/** Universal-runtime Ed25519 signer (Node + Edge + browsers via crypto.subtle). */\nexport interface SignKey {\n  /** Raw 32-byte Ed25519 private key as hex. */\n  privateKeyHex: string;\n  /** Identifier for the key — included in the signature for rotation tracking. */\n  keyId: string;\n}\n\nexport async function signManifest(\n  manifest: SignableManifest,\n  key: SignKey,\n): Promise<ManifestSignature> {\n  const subtle = await getSubtle();\n  const payload = canonicalSignedBytes(manifest);\n  const signedHash = await sha256(payload);\n\n  const pkcs8 = ed25519PrivateKeyToPkcs8(hexDecode(key.privateKeyHex));\n  const cryptoKey = await subtle.importKey(\n    'pkcs8',\n    pkcs8 as BufferSource,\n    { name: 'Ed25519' },\n    false,\n    ['sign'],\n  );\n  const sigBuf = await subtle.sign({ name: 'Ed25519' }, cryptoKey, payload as BufferSource);\n  return {\n    keyId: key.keyId,\n    alg: 'ed25519',\n    sig: hexEncode(new Uint8Array(sigBuf)),\n    signedHash: hexEncode(signedHash),\n  };\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\nfunction hexDecode(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error('hexDecode: odd length');\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  return out;\n}\n\n/** Wrap a raw 32-byte Ed25519 seed into a minimal PKCS#8 envelope (RFC 8410). */\nfunction ed25519PrivateKeyToPkcs8(seed: Uint8Array): Uint8Array {\n  if (seed.length !== 32) throw new Error('ed25519 seed must be 32 bytes');\n  const prefix = new Uint8Array([\n    0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20,\n  ]);\n  const out = new Uint8Array(prefix.length + 32);\n  out.set(prefix, 0);\n  out.set(seed, prefix.length);\n  return out;\n}\n","import { canonicalSignedBytes } from './canonical.js';\nimport { hexEncode, sha256 } from './hash.js';\nimport type { ManifestSignature, SignableManifest } from './types.js';\n\nexport interface VerifyOptions {\n  /** Hex-encoded raw 32-byte Ed25519 public key. */\n  publicKeyHex: string;\n  /** Required keyId — caller pins this at SDK init time. */\n  expectedKeyId: string;\n}\n\nexport type VerifyResult =\n  | { ok: true }\n  | { ok: false; reason: 'keyId-mismatch' | 'signedHash-mismatch' | 'sig-invalid' };\n\nexport async function verifyManifest(\n  manifest: SignableManifest & { signature: ManifestSignature },\n  options: VerifyOptions,\n): Promise<VerifyResult> {\n  if (manifest.signature.keyId !== options.expectedKeyId) {\n    return { ok: false, reason: 'keyId-mismatch' };\n  }\n  const payload = canonicalSignedBytes(manifest);\n  const expectedHash = hexEncode(await sha256(payload));\n  if (expectedHash !== manifest.signature.signedHash) {\n    return { ok: false, reason: 'signedHash-mismatch' };\n  }\n\n  const subtle = await getSubtle();\n  const pubKey = await subtle.importKey(\n    'raw',\n    hexDecode(options.publicKeyHex) as BufferSource,\n    { name: 'Ed25519' },\n    false,\n    ['verify'],\n  );\n  const valid = await subtle.verify(\n    { name: 'Ed25519' },\n    pubKey,\n    hexDecode(manifest.signature.sig) as BufferSource,\n    payload as BufferSource,\n  );\n  return valid ? { ok: true } : { ok: false, reason: 'sig-invalid' };\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\nfunction hexDecode(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error('hexDecode: odd length');\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  return out;\n}\n","/**\n * Ed25519 keypair generation for `fx dev` and tests. Production keys are\n * generated offline and stored in a secrets manager.\n */\nimport { hexEncode } from './hash.js';\n\nexport interface Ed25519Keypair {\n  publicKeyHex: string;\n  privateKeyHex: string;\n  keyId: string;\n}\n\nexport async function generateKeypair(keyId: string): Promise<Ed25519Keypair> {\n  const subtle = await getSubtle();\n  const kp = (await subtle.generateKey({ name: 'Ed25519' }, true, [\n    'sign',\n    'verify',\n  ])) as CryptoKeyPair;\n  const rawPub = new Uint8Array(await subtle.exportKey('raw', kp.publicKey));\n  const pkcs8Priv = new Uint8Array(await subtle.exportKey('pkcs8', kp.privateKey));\n  // PKCS#8 ed25519 = 16-byte prefix + 32-byte seed. Strip the prefix.\n  const seed = pkcs8Priv.slice(pkcs8Priv.length - 32);\n  return {\n    publicKeyHex: hexEncode(rawPub),\n    privateKeyHex: hexEncode(seed),\n    keyId,\n  };\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n","import { canonicalSignedBytes } from './canonical.js';\nimport { hexEncode, sha256 } from './hash.js';\nimport type { ManifestSignature, SignableManifest } from './types.js';\n\n/**\n * JWKS-style key set for a single org. Each entry is an Ed25519 public key\n * with a kid that matches a `manifest_keys.key_id` in the control plane.\n */\nexport interface JwksEntry {\n  kid: string;\n  kty: 'OKP';\n  crv: 'Ed25519';\n  /** Base64url-encoded raw 32-byte public key. */\n  x: string;\n  alg: 'EdDSA';\n  use: 'sig';\n  /** Lifecycle status — extension on top of the JWKS standard. */\n  status: 'active' | 'retiring' | 'retired';\n}\n\nexport interface Jwks {\n  keys: JwksEntry[];\n}\n\nexport function jwksFromKeys(\n  keys: readonly {\n    keyId: string;\n    publicKeyHex: string;\n    status: 'active' | 'retiring' | 'retired';\n  }[],\n): Jwks {\n  return {\n    keys: keys.map((k) => ({\n      kid: k.keyId,\n      kty: 'OKP',\n      crv: 'Ed25519',\n      x: hexToBase64Url(k.publicKeyHex),\n      alg: 'EdDSA',\n      use: 'sig',\n      status: k.status,\n    })),\n  };\n}\n\nexport interface VerifyAgainstJwksOptions {\n  jwks: Jwks;\n  /** Optional pinning. If set, rejects keys whose kid is not in this list. */\n  expectedKeyIds?: string[];\n  /** Reject manifests older than this many milliseconds (replay window). */\n  maxAgeMs?: number;\n  /** Override clock for tests. */\n  now?: () => Date;\n}\n\nexport type JwksVerifyResult =\n  | { ok: true }\n  | {\n      ok: false;\n      reason:\n        | 'unknown-key'\n        | 'retired-key'\n        | 'pinned-key-mismatch'\n        | 'signedHash-mismatch'\n        | 'sig-invalid'\n        | 'replay-window';\n    };\n\n/**\n * Verify a signed manifest against a JWKS document. Replaces ADR-0002's\n * single-key verifier when SDKs run in M3+ hosted mode.\n */\nexport async function verifyAgainstJwks(\n  manifest: SignableManifest & { signature: ManifestSignature; builtAt?: string },\n  options: VerifyAgainstJwksOptions,\n): Promise<JwksVerifyResult> {\n  const sig = manifest.signature;\n  if (options.expectedKeyIds && !options.expectedKeyIds.includes(sig.keyId)) {\n    return { ok: false, reason: 'pinned-key-mismatch' };\n  }\n  const entry = options.jwks.keys.find((k) => k.kid === sig.keyId);\n  if (!entry) return { ok: false, reason: 'unknown-key' };\n  if (entry.status === 'retired') return { ok: false, reason: 'retired-key' };\n\n  if (options.maxAgeMs && manifest.builtAt) {\n    const age =\n      (options.now ?? (() => new Date()))().getTime() - new Date(manifest.builtAt).getTime();\n    if (age > options.maxAgeMs) return { ok: false, reason: 'replay-window' };\n  }\n\n  const payload = canonicalSignedBytes(manifest);\n  const expectedHash = hexEncode(await sha256(payload));\n  if (expectedHash !== sig.signedHash) return { ok: false, reason: 'signedHash-mismatch' };\n\n  const subtle = await getSubtle();\n  const pubKey = await subtle.importKey(\n    'raw',\n    base64UrlToBytes(entry.x) as BufferSource,\n    { name: 'Ed25519' },\n    false,\n    ['verify'],\n  );\n  const valid = await subtle.verify(\n    { name: 'Ed25519' },\n    pubKey,\n    hexToBytes(sig.sig) as BufferSource,\n    payload as BufferSource,\n  );\n  return valid ? { ok: true } : { ok: false, reason: 'sig-invalid' };\n}\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (typeof crypto !== 'undefined' && crypto.subtle) return crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  return out;\n}\n\nfunction hexToBase64Url(hex: string): string {\n  return bytesToBase64Url(hexToBytes(hex));\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let s = '';\n  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]!);\n  return btoa(s).replace(/=+$/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n\nfunction base64UrlToBytes(s: string): Uint8Array {\n  const pad = '='.repeat((4 - (s.length % 4)) % 4);\n  const b64 = (s + pad).replace(/-/g, '+').replace(/_/g, '/');\n  const binary = atob(b64);\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n  return out;\n}\n"]}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@fabricorg/experiments-manifest-signing",
+  "version": "0.0.1",
+  "description": "Ed25519 sign + verify utilities for Fabric Experiments manifests. Works in Node, Edge, and browsers.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.ts",
+  "module": "./dist/index.js",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "tsup": "^8.3.5",
+    "typescript": "^5.8.3",
+    "vitest": "^2.1.8"
+  },
+  "scripts": {
+    "build": "tsup",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
+  }
+}