@futdevpro/fsm-dynamo 1.20.9 → 1.20.10

package/src/_modules/crypto/_models/artifact-signature.interface.ts

@@ -1,39 +0,0 @@
-/** ECDSA P-256 publication evidence safe to persist and distribute to browsers. */
-export interface DyFM_ArtifactSignature_Evidence_Interface {
-  readonly contractVersion: 'dyfm-artifact-signature/1';
-  readonly subjectChecksum: string;
-  readonly algorithm: 'ECDSA';
-  readonly namedCurve: 'P-256';
-  readonly hash: 'SHA-256';
-  readonly encoding: 'ieee-p1363';
-  readonly keyId: string;
-  readonly publicKeyFingerprint: string;
-  readonly signedAt: string;
-  readonly signature: string;
-}
-
-/** Server-side signing input. Private PKCS#8 material must originate from FDP Keystore. */
-export interface DyFM_ArtifactSignatureSign_Settings_Interface {
-  readonly subjectBytes: Uint8Array;
-  readonly subjectChecksum: string;
-  readonly privateKeyPkcs8Base64Url: string;
-  readonly publicKeyJwk: JsonWebKey;
-  readonly keyId: string;
-  readonly signedAt: string;
-}
-
-/** Browser/server verification input using public material only. */
-export interface DyFM_ArtifactSignatureVerify_Settings_Interface {
-  readonly subjectBytes: Uint8Array;
-  readonly evidence: DyFM_ArtifactSignature_Evidence_Interface;
-  readonly publicKeyJwk: JsonWebKey;
-}
-
-/** Content-free fail-closed verification result. */
-export interface DyFM_ArtifactSignatureVerification_Interface {
-  readonly contractVersion: 'dyfm-artifact-signature-verification/1';
-  readonly isVerified: boolean;
-  readonly code: string;
-  readonly subjectChecksum: string;
-  readonly keyId: string;
-}

package/src/_modules/crypto/_services/artifact-signature.control-service.spec.ts

@@ -1,223 +0,0 @@
-import {
-  DyFM_ArtifactSignature_Evidence_Interface,
-  DyFM_ArtifactSignatureSign_Settings_Interface,
-  DyFM_ArtifactSignatureVerification_Interface
-} from '../_models/artifact-signature.interface';
-import { DyFM_ArtifactSignature_ControlService } from './artifact-signature.control-service';
-
-interface DyFM_ArtifactSignatureSpecKeyMaterial {
-  readonly privateKeyPkcs8Base64Url: string;
-  readonly publicKeyJwk: JsonWebKey;
-}
-
-describe('| DyFM artifact signature', (): void => {
-  const signature_CS: DyFM_ArtifactSignature_ControlService =
-    new DyFM_ArtifactSignature_ControlService();
-  const subjectBytes: Uint8Array<ArrayBuffer> = new TextEncoder().encode(
-    '{"contractVersion":"ctm-artifact-canonical/1","bundleSource":"exact"}'
-  );
-  let keyMaterial: DyFM_ArtifactSignatureSpecKeyMaterial;
-  let subjectChecksum: string;
-
-  beforeAll(async (): Promise<void> => {
-    keyMaterial = await generateKeyMaterial();
-    subjectChecksum = await checksum(subjectBytes);
-  });
-
-  it('| signs and verifies exact bytes with fixed P1363 evidence', async (): Promise<void> => {
-    const evidence: DyFM_ArtifactSignature_Evidence_Interface = await sign();
-    const verification: DyFM_ArtifactSignatureVerification_Interface = await signature_CS.verify({
-      subjectBytes: subjectBytes,
-      evidence: evidence,
-      publicKeyJwk: keyMaterial.publicKeyJwk,
-    });
-
-    expect(verification.isVerified).toBeTrue();
-    expect(verification.code).toBe('DYFM|ARTIFACT_SIGNATURE|VERIFIED');
-    expect(evidence.signature).toMatch(/^[A-Za-z0-9_-]{86}$/u);
-    expect(evidence.publicKeyFingerprint).toMatch(/^[a-f0-9]{64}$/u);
-    expect(Object.keys(evidence)).not.toContain('privateKey');
-    expect(Object.keys(evidence)).not.toContain('d');
-  });
-
-  it('| rejects one-byte subject tampering without reflecting content', async (): Promise<void> => {
-    const evidence: DyFM_ArtifactSignature_Evidence_Interface = await sign();
-    const tamperedBytes: Uint8Array = new Uint8Array(subjectBytes);
-
-    tamperedBytes[tamperedBytes.length - 1] ^= 1;
-
-    const verification: DyFM_ArtifactSignatureVerification_Interface = await signature_CS.verify({
-      subjectBytes: tamperedBytes,
-      evidence: evidence,
-      publicKeyJwk: keyMaterial.publicKeyJwk,
-    });
-
-    expect(verification).toEqual({
-      contractVersion: 'dyfm-artifact-signature-verification/1',
-      isVerified: false,
-      code: 'DYFM|ARTIFACT_SIGNATURE|SUBJECT_CHECKSUM_MISMATCH',
-      subjectChecksum: evidence.subjectChecksum,
-      keyId: evidence.keyId,
-    });
-  });
-
-  it('| rejects a different allowlisted public key before signature verification', async (): Promise<void> => {
-    const evidence: DyFM_ArtifactSignature_Evidence_Interface = await sign();
-    const otherKey: DyFM_ArtifactSignatureSpecKeyMaterial = await generateKeyMaterial();
-    const verification: DyFM_ArtifactSignatureVerification_Interface = await signature_CS.verify({
-      subjectBytes: subjectBytes,
-      evidence: evidence,
-      publicKeyJwk: otherKey.publicKeyJwk,
-    });
-
-    expect(verification.isVerified).toBeFalse();
-    expect(verification.code).toBe('DYFM|ARTIFACT_SIGNATURE|PUBLIC_KEY_FINGERPRINT_MISMATCH');
-  });
-
-  it('| rejects a mutated fixed-length signature after all metadata checks pass', async (): Promise<void> => {
-    const evidence: DyFM_ArtifactSignature_Evidence_Interface = await sign();
-    const mutatedEvidence: DyFM_ArtifactSignature_Evidence_Interface = {
-      ...evidence,
-      signature: `${evidence.signature[0] === 'A' ? 'B' : 'A'}${evidence.signature.slice(1)}`,
-    };
-    const verification: DyFM_ArtifactSignatureVerification_Interface = await signature_CS.verify({
-      subjectBytes: subjectBytes,
-      evidence: mutatedEvidence,
-      publicKeyJwk: keyMaterial.publicKeyJwk,
-    });
-
-    expect(verification.isVerified).toBeFalse();
-    expect(verification.code).toBe('DYFM|ARTIFACT_SIGNATURE|SIGNATURE_MISMATCH');
-  });
-
-  it('| rejects malformed or extended evidence as a strict contract', async (): Promise<void> => {
-    const evidence: DyFM_ArtifactSignature_Evidence_Interface = await sign();
-    const malformedEvidence: DyFM_ArtifactSignature_Evidence_Interface = {
-      ...evidence,
-      signature: `${evidence.signature}=`,
-    };
-    const extendedEvidence = { ...evidence, unexpected: true };
-    const malformed: DyFM_ArtifactSignatureVerification_Interface = await signature_CS.verify({
-      subjectBytes: subjectBytes,
-      evidence: malformedEvidence,
-      publicKeyJwk: keyMaterial.publicKeyJwk,
-    });
-    const extended: DyFM_ArtifactSignatureVerification_Interface = await signature_CS.verify({
-      subjectBytes: subjectBytes,
-      evidence: extendedEvidence,
-      publicKeyJwk: keyMaterial.publicKeyJwk,
-    });
-
-    expect(malformed.code).toBe('DYFM|ARTIFACT_SIGNATURE|SIGNATURE_ENCODING_INVALID');
-    expect(extended.code).toBe('DYFM|ARTIFACT_SIGNATURE|EVIDENCE_SHAPE_INVALID');
-  });
-
-  it('| refuses signing when the caller checksum does not match exact bytes', async (): Promise<void> => {
-    await expectAsync(signature_CS.sign(createSignSettings({
-      subjectChecksum: 'f'.repeat(64),
-    }))).toBeRejectedWithError(/DYFM\|ARTIFACT_SIGNATURE\|SUBJECT_CHECKSUM_MISMATCH/u);
-  });
-
-  it('| refuses a private/public key mismatch before returning evidence', async (): Promise<void> => {
-    const otherKey: DyFM_ArtifactSignatureSpecKeyMaterial = await generateKeyMaterial();
-
-    await expectAsync(signature_CS.sign(createSignSettings({
-      publicKeyJwk: otherKey.publicKeyJwk,
-    }))).toBeRejectedWithError(/DYFM\|ARTIFACT_SIGNATURE\|KEY_PAIR_MISMATCH/u);
-  });
-
-  it('| accepts only strict unpadded Base64URL PKCS8 material', async (): Promise<void> => {
-    await expectAsync(signature_CS.sign(createSignSettings({
-      privateKeyPkcs8Base64Url: `${keyMaterial.privateKeyPkcs8Base64Url}=`,
-    }))).toBeRejectedWithError(/DYFM\|ARTIFACT_SIGNATURE\|BASE64URL_INVALID/u);
-  });
-
-  it('| fingerprints only public curve coordinates and ignores JWK metadata', async (): Promise<void> => {
-    const first: string = await signature_CS.getPublicKeyFingerprint(keyMaterial.publicKeyJwk);
-    const second: string = await signature_CS.getPublicKeyFingerprint({
-      ...keyMaterial.publicKeyJwk,
-      alg: 'arbitrary-metadata',
-      key_ops: [ 'verify', 'deriveBits' ],
-    });
-
-    expect(first).toBe(second);
-  });
-
-  it('| rejects any private coordinate in a purported public JWK', async (): Promise<void> => {
-    await expectAsync(signature_CS.getPublicKeyFingerprint({
-      ...keyMaterial.publicKeyJwk,
-      d: '',
-    })).toBeRejectedWithError(/DYFM\|ARTIFACT_SIGNATURE\|PUBLIC_KEY_INVALID/u);
-  });
-
-  /** Creates one valid signing request with selected deliberate overrides. */
-  function createSignSettings(
-    overrides: Partial<DyFM_ArtifactSignatureSign_Settings_Interface> = {}
-  ): DyFM_ArtifactSignatureSign_Settings_Interface {
-    return {
-      subjectBytes: subjectBytes,
-      subjectChecksum: subjectChecksum,
-      privateKeyPkcs8Base64Url: keyMaterial.privateKeyPkcs8Base64Url,
-      publicKeyJwk: keyMaterial.publicKeyJwk,
-      keyId: 'artifact-signing-2026-08',
-      signedAt: '2026-08-21T12:00:00.000Z',
-      ...overrides,
-    };
-  }
-
-  /** Generates an ephemeral exportable key pair for test-only signing. */
-  async function generateKeyMaterial(): Promise<DyFM_ArtifactSignatureSpecKeyMaterial> {
-    const keyPair: CryptoKeyPair = await globalThis.crypto.subtle.generateKey(
-      { name: 'ECDSA', namedCurve: 'P-256' },
-      true,
-      [ 'sign', 'verify' ]
-    );
-    const privateKeyPkcs8: ArrayBuffer = await globalThis.crypto.subtle.exportKey('pkcs8', keyPair.privateKey);
-    const publicKeyJwk: JsonWebKey = await globalThis.crypto.subtle.exportKey('jwk', keyPair.publicKey);
-
-    return {
-      privateKeyPkcs8Base64Url: encodeBase64Url(new Uint8Array(privateKeyPkcs8)),
-      publicKeyJwk: publicKeyJwk,
-    };
-  }
-
-  /** Calculates lowercase SHA-256 through the same platform boundary as production. */
-  async function checksum(bytes: Uint8Array<ArrayBuffer>): Promise<string> {
-    const digest: ArrayBuffer = await globalThis.crypto.subtle.digest('SHA-256', bytes);
-
-    return [ ...new Uint8Array(digest) ]
-      .map((value: number): string => value.toString(16).padStart(2, '0'))
-      .join('');
-  }
-
-  /** Encodes test key bytes as strict unpadded Base64URL. */
-  function encodeBase64Url(bytes: Uint8Array): string {
-    const alphabet: string = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
-    let encoded: string = '';
-
-    for (let index: number = 0; index < bytes.length; index += 3) {
-      const remaining: number = bytes.length - index;
-      const combined: number = (bytes[index] << 16)
-        | ((remaining > 1 ? bytes[index + 1] : 0) << 8)
-        | (remaining > 2 ? bytes[index + 2] : 0);
-
-      encoded += alphabet[(combined >>> 18) & 63];
-      encoded += alphabet[(combined >>> 12) & 63];
-
-      if (remaining > 1) {
-        encoded += alphabet[(combined >>> 6) & 63];
-      }
-
-      if (remaining > 2) {
-        encoded += alphabet[combined & 63];
-      }
-    }
-
-    return encoded;
-  }
-
-  /** Signs the shared exact test subject. */
-  async function sign(): Promise<DyFM_ArtifactSignature_Evidence_Interface> {
-    return signature_CS.sign(createSignSettings());
-  }
-});

package/src/_modules/crypto/_services/artifact-signature.control-service.ts

@@ -1,395 +0,0 @@
-import {
-  DyFM_ArtifactSignature_Evidence_Interface,
-  DyFM_ArtifactSignatureSign_Settings_Interface,
-  DyFM_ArtifactSignatureVerification_Interface,
-  DyFM_ArtifactSignatureVerify_Settings_Interface
-} from '../_models/artifact-signature.interface';
-
-const dyfm_base64UrlAlphabet: string =
-  'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
-const dyfm_checksumPattern: RegExp = /^[a-f0-9]{64}$/u;
-const dyfm_keyIdPattern: RegExp = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,119}$/u;
-const dyfm_signatureEvidenceKeys: string[] = [
-  'algorithm',
-  'contractVersion',
-  'encoding',
-  'hash',
-  'keyId',
-  'namedCurve',
-  'publicKeyFingerprint',
-  'signature',
-  'signedAt',
-  'subjectChecksum',
-];
-
-/** Cross-runtime ECDSA artifact signing and verification using the platform Web Crypto implementation. */
-export class DyFM_ArtifactSignature_ControlService {
-  /** Signs exact bytes with server-only PKCS#8 material and verifies the configured public/private pair. */
-  public async sign(
-    set: DyFM_ArtifactSignatureSign_Settings_Interface
-  ): Promise<DyFM_ArtifactSignature_Evidence_Interface> {
-    this.validateSubject(set.subjectBytes);
-    this.validateChecksum(set.subjectChecksum, 'SUBJECT_CHECKSUM_INVALID');
-    this.validateKeyId(set.keyId);
-    this.validateTimestamp(set.signedAt);
-
-    const subtle: SubtleCrypto = this.getSubtleCrypto();
-    const subjectBytes: Uint8Array<ArrayBuffer> = new Uint8Array(set.subjectBytes);
-    const actualChecksum: string = await this.checksum(subjectBytes);
-
-    if (actualChecksum !== set.subjectChecksum) {
-      throw this.buildError('SUBJECT_CHECKSUM_MISMATCH');
-    }
-
-    const privateKeyBytes: Uint8Array<ArrayBuffer> = this.decodeBase64UrlStrict(set.privateKeyPkcs8Base64Url);
-
-    if (privateKeyBytes.byteLength < 64 || privateKeyBytes.byteLength > 512) {
-      throw this.buildError('PRIVATE_KEY_LENGTH_INVALID');
-    }
-
-    const publicKeyJwk: JsonWebKey = this.validatePublicJwk(set.publicKeyJwk);
-    const publicKeyFingerprint: string = await this.getPublicKeyFingerprint(publicKeyJwk);
-    let privateKey: CryptoKey;
-    let publicKey: CryptoKey;
-
-    try {
-      privateKey = await subtle.importKey(
-        'pkcs8',
-        privateKeyBytes,
-        { name: 'ECDSA', namedCurve: 'P-256' },
-        false,
-        [ 'sign' ]
-      );
-      publicKey = await subtle.importKey(
-        'jwk',
-        publicKeyJwk,
-        { name: 'ECDSA', namedCurve: 'P-256' },
-        false,
-        [ 'verify' ]
-      );
-    } catch {
-      throw this.buildError('KEY_IMPORT_FAILED');
-    } finally {
-      privateKeyBytes.fill(0);
-    }
-
-    let signatureBytes: Uint8Array<ArrayBuffer>;
-
-    try {
-      signatureBytes = new Uint8Array(await subtle.sign(
-        { name: 'ECDSA', hash: 'SHA-256' },
-        privateKey,
-        subjectBytes
-      ));
-    } catch {
-      throw this.buildError('SIGN_FAILED');
-    }
-
-    if (signatureBytes.byteLength !== 64) {
-      throw this.buildError('SIGNATURE_ENCODING_INVALID');
-    }
-
-    const isPairValid: boolean = await subtle.verify(
-      { name: 'ECDSA', hash: 'SHA-256' },
-      publicKey,
-      signatureBytes,
-      subjectBytes
-    );
-
-    if (!isPairValid) {
-      throw this.buildError('KEY_PAIR_MISMATCH');
-    }
-
-    return Object.freeze({
-      contractVersion: 'dyfm-artifact-signature/1',
-      subjectChecksum: actualChecksum,
-      algorithm: 'ECDSA',
-      namedCurve: 'P-256',
-      hash: 'SHA-256',
-      encoding: 'ieee-p1363',
-      keyId: set.keyId,
-      publicKeyFingerprint: publicKeyFingerprint,
-      signedAt: set.signedAt,
-      signature: this.encodeBase64Url(signatureBytes),
-    });
-  }
-
-  /** Verifies exact bytes and content-free evidence with an allowlisted public JWK. */
-  public async verify(
-    set: DyFM_ArtifactSignatureVerify_Settings_Interface
-  ): Promise<DyFM_ArtifactSignatureVerification_Interface> {
-    const evidenceCode: string = this.getEvidenceValidationCode(set.evidence);
-
-    if (evidenceCode) {
-      return this.result(set.evidence, false, evidenceCode);
-    }
-
-    if (!(set.subjectBytes instanceof Uint8Array) || !set.subjectBytes.byteLength) {
-      return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|SUBJECT_INVALID');
-    }
-
-    const subjectBytes: Uint8Array<ArrayBuffer> = new Uint8Array(set.subjectBytes);
-    const actualChecksum: string = await this.checksum(subjectBytes);
-
-    if (actualChecksum !== set.evidence.subjectChecksum) {
-      return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|SUBJECT_CHECKSUM_MISMATCH');
-    }
-
-    let publicKeyJwk: JsonWebKey;
-    let signatureBytes: Uint8Array<ArrayBuffer>;
-
-    try {
-      publicKeyJwk = this.validatePublicJwk(set.publicKeyJwk);
-      signatureBytes = this.decodeBase64UrlStrict(set.evidence.signature);
-    } catch {
-      return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|PUBLIC_INPUT_INVALID');
-    }
-
-    if (signatureBytes.byteLength !== 64) {
-      return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|SIGNATURE_ENCODING_INVALID');
-    }
-
-    const publicKeyFingerprint: string = await this.getPublicKeyFingerprint(publicKeyJwk);
-
-    if (publicKeyFingerprint !== set.evidence.publicKeyFingerprint) {
-      return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|PUBLIC_KEY_FINGERPRINT_MISMATCH');
-    }
-
-    try {
-      const publicKey: CryptoKey = await this.getSubtleCrypto().importKey(
-        'jwk',
-        publicKeyJwk,
-        { name: 'ECDSA', namedCurve: 'P-256' },
-        false,
-        [ 'verify' ]
-      );
-      const isVerified: boolean = await this.getSubtleCrypto().verify(
-        { name: 'ECDSA', hash: 'SHA-256' },
-        publicKey,
-        signatureBytes,
-        subjectBytes
-      );
-
-      return this.result(
-        set.evidence,
-        isVerified,
-        isVerified ? 'DYFM|ARTIFACT_SIGNATURE|VERIFIED' : 'DYFM|ARTIFACT_SIGNATURE|SIGNATURE_MISMATCH'
-      );
-    } catch {
-      return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|VERIFY_FAILED');
-    }
-  }
-
-  /** Calculates the canonical SHA-256 fingerprint of a public P-256 JWK. */
-  public async getPublicKeyFingerprint(publicKeyJwkValue: JsonWebKey): Promise<string> {
-    const publicKeyJwk: JsonWebKey = this.validatePublicJwk(publicKeyJwkValue);
-    const canonicalJwk: string = JSON.stringify({
-      crv: publicKeyJwk.crv,
-      kty: publicKeyJwk.kty,
-      x: publicKeyJwk.x,
-      y: publicKeyJwk.y,
-    });
-
-    return this.checksum(new TextEncoder().encode(canonicalJwk));
-  }
-
-  private async checksum(bytes: Uint8Array<ArrayBuffer>): Promise<string> {
-    const digest: ArrayBuffer = await this.getSubtleCrypto().digest('SHA-256', bytes);
-
-    return [ ...new Uint8Array(digest) ]
-      .map((value: number): string => value.toString(16).padStart(2, '0'))
-      .join('');
-  }
-
-  private decodeBase64UrlStrict(value: string): Uint8Array<ArrayBuffer> {
-    if (!value || !/^[A-Za-z0-9_-]+$/u.test(value) || value.length % 4 === 1) {
-      throw this.buildError('BASE64URL_INVALID');
-    }
-
-    const bytes: number[] = [];
-
-    for (let index: number = 0; index < value.length; index += 4) {
-      const first: number = dyfm_base64UrlAlphabet.indexOf(value[index]);
-      const second: number = dyfm_base64UrlAlphabet.indexOf(value[index + 1]);
-      const third: number = index + 2 < value.length
-        ? dyfm_base64UrlAlphabet.indexOf(value[index + 2])
-        : 0;
-      const fourth: number = index + 3 < value.length
-        ? dyfm_base64UrlAlphabet.indexOf(value[index + 3])
-        : 0;
-      const combined: number = (first << 18) | (second << 12) | (third << 6) | fourth;
-
-      bytes.push((combined >>> 16) & 255);
-
-      if (index + 2 < value.length) {
-        bytes.push((combined >>> 8) & 255);
-      }
-
-      if (index + 3 < value.length) {
-        bytes.push(combined & 255);
-      }
-    }
-
-    const decoded: Uint8Array<ArrayBuffer> = new Uint8Array(bytes);
-
-    if (this.encodeBase64Url(decoded) !== value) {
-      throw this.buildError('BASE64URL_NON_CANONICAL');
-    }
-
-    return decoded;
-  }
-
-  private encodeBase64Url(bytes: Uint8Array): string {
-    let encoded: string = '';
-
-    for (let index: number = 0; index < bytes.length; index += 3) {
-      const remaining: number = bytes.length - index;
-      const combined: number = (bytes[index] << 16)
-        | ((remaining > 1 ? bytes[index + 1] : 0) << 8)
-        | (remaining > 2 ? bytes[index + 2] : 0);
-
-      encoded += dyfm_base64UrlAlphabet[(combined >>> 18) & 63];
-      encoded += dyfm_base64UrlAlphabet[(combined >>> 12) & 63];
-
-      if (remaining > 1) {
-        encoded += dyfm_base64UrlAlphabet[(combined >>> 6) & 63];
-      }
-
-      if (remaining > 2) {
-        encoded += dyfm_base64UrlAlphabet[combined & 63];
-      }
-    }
-
-    return encoded;
-  }
-
-  private getEvidenceValidationCode(evidence: DyFM_ArtifactSignature_Evidence_Interface): string {
-    if (!evidence || typeof evidence !== 'object') {
-      return 'DYFM|ARTIFACT_SIGNATURE|EVIDENCE_INVALID';
-    }
-
-    const keys: string[] = Object.keys(evidence).sort();
-
-    if (JSON.stringify(keys) !== JSON.stringify(dyfm_signatureEvidenceKeys)) {
-      return 'DYFM|ARTIFACT_SIGNATURE|EVIDENCE_SHAPE_INVALID';
-    }
-
-    if (
-      evidence.contractVersion !== 'dyfm-artifact-signature/1'
-      || evidence.algorithm !== 'ECDSA'
-      || evidence.namedCurve !== 'P-256'
-      || evidence.hash !== 'SHA-256'
-      || evidence.encoding !== 'ieee-p1363'
-    ) {
-      return 'DYFM|ARTIFACT_SIGNATURE|EVIDENCE_CONTRACT_INVALID';
-    }
-
-    if (!dyfm_checksumPattern.test(evidence.subjectChecksum)) {
-      return 'DYFM|ARTIFACT_SIGNATURE|SUBJECT_CHECKSUM_INVALID';
-    }
-
-    if (!dyfm_checksumPattern.test(evidence.publicKeyFingerprint)) {
-      return 'DYFM|ARTIFACT_SIGNATURE|PUBLIC_KEY_FINGERPRINT_INVALID';
-    }
-
-    if (!dyfm_keyIdPattern.test(evidence.keyId)) {
-      return 'DYFM|ARTIFACT_SIGNATURE|KEY_ID_INVALID';
-    }
-
-    if (!this.isCanonicalTimestamp(evidence.signedAt)) {
-      return 'DYFM|ARTIFACT_SIGNATURE|SIGNED_AT_INVALID';
-    }
-
-    if (!/^[A-Za-z0-9_-]{86}$/u.test(evidence.signature)) {
-      return 'DYFM|ARTIFACT_SIGNATURE|SIGNATURE_ENCODING_INVALID';
-    }
-
-    return '';
-  }
-
-  private getSubtleCrypto(): SubtleCrypto {
-    if (!globalThis.crypto?.subtle) {
-      throw this.buildError('WEB_CRYPTO_UNAVAILABLE');
-    }
-
-    return globalThis.crypto.subtle;
-  }
-
-  private isCanonicalTimestamp(value: string): boolean {
-    const timestamp: number = Date.parse(value);
-
-    return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
-  }
-
-  private result(
-    evidence: DyFM_ArtifactSignature_Evidence_Interface,
-    isVerified: boolean,
-    code: string
-  ): DyFM_ArtifactSignatureVerification_Interface {
-    return Object.freeze({
-      contractVersion: 'dyfm-artifact-signature-verification/1',
-      isVerified: isVerified,
-      code: code,
-      subjectChecksum: typeof evidence?.subjectChecksum === 'string' ? evidence.subjectChecksum : '',
-      keyId: typeof evidence?.keyId === 'string' ? evidence.keyId : '',
-    });
-  }
-
-  private validateChecksum(value: string, code: string): void {
-    if (!dyfm_checksumPattern.test(value)) {
-      throw this.buildError(code);
-    }
-  }
-
-  private validateKeyId(value: string): void {
-    if (!dyfm_keyIdPattern.test(value)) {
-      throw this.buildError('KEY_ID_INVALID');
-    }
-  }
-
-  private validatePublicJwk(value: JsonWebKey): JsonWebKey {
-    if (
-      !value
-      || typeof value !== 'object'
-      || value.kty !== 'EC'
-      || value.crv !== 'P-256'
-      || typeof value.x !== 'string'
-      || typeof value.y !== 'string'
-      || Object.prototype.hasOwnProperty.call(value, 'd')
-    ) {
-      throw this.buildError('PUBLIC_KEY_INVALID');
-    }
-
-    const xBytes: Uint8Array<ArrayBuffer> = this.decodeBase64UrlStrict(value.x);
-    const yBytes: Uint8Array<ArrayBuffer> = this.decodeBase64UrlStrict(value.y);
-
-    if (xBytes.byteLength !== 32 || yBytes.byteLength !== 32) {
-      throw this.buildError('PUBLIC_KEY_COORDINATE_INVALID');
-    }
-
-    return Object.freeze({
-      kty: 'EC',
-      crv: 'P-256',
-      x: value.x,
-      y: value.y,
-      ext: true,
-      key_ops: [ 'verify' ],
-    });
-  }
-
-  private validateSubject(value: Uint8Array): void {
-    if (!(value instanceof Uint8Array) || !value.byteLength) {
-      throw this.buildError('SUBJECT_INVALID');
-    }
-  }
-
-  private validateTimestamp(value: string): void {
-    if (!this.isCanonicalTimestamp(value)) {
-      throw this.buildError('SIGNED_AT_INVALID');
-    }
-  }
-
-  private buildError(code: string): TypeError {
-    return new TypeError(`DYFM|ARTIFACT_SIGNATURE|${code}`);
-  }
-}

package/src/_modules/crypto/index.ts

@@ -1,16 +0,0 @@
-
-
-
-/* try {
-  //require.resolve('crypto-js');
-  import('crypto-js');
-} catch {
-  console.log(
-    '❌ crypto-js package not found, please install it with: pnpm add crypto-js'
-  );
-} */
-
-
-export * from './_collections/crypto.util';
-export * from './_models/artifact-signature.interface';
-export * from './_services/artifact-signature.control-service';

package/src/_modules/custom-data/_collections/cud-module-settings.const.ts

@@ -1,21 +0,0 @@
-
-import { DyFM_Route_Settings } from '../../../_models/interfaces/route-settings.interface';
-
-/**
- * Routes available in the Custom Data module.
- */
-export enum DyFM_CustomRoute {
-  getCustomData = 'getCustomData',
-  modifyCustomData = 'modifyCustomData',
-}
-
-/**
- * Default settings for the Custom Data module.
- */
-export const DyFM_customDataModule_settings: DyFM_Route_Settings<DyFM_CustomRoute> = {
-  mainRoute: '/custom',
-  endPoints: {
-    [DyFM_CustomRoute.getCustomData]: '/get/:customId',
-    [DyFM_CustomRoute.modifyCustomData]: '/post',
-  },
-};