@gitgov/core 1.0.0

package/dist/src/crypto/checksum.d.ts

@@ -0,0 +1,6 @@
+import type { GitGovRecordPayload } from "../types";
+/**
+ * Calculates the SHA-256 checksum of a record's payload.
+ */
+export declare function calculatePayloadChecksum(payload: GitGovRecordPayload): string;
+//# sourceMappingURL=checksum.d.ts.map

package/dist/src/crypto/checksum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum.d.ts","sourceRoot":"","sources":["../../../src/crypto/checksum.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAiCpD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAG7E"}

package/dist/src/crypto/checksum.js

@@ -0,0 +1,38 @@
+import { createHash } from "crypto";
+/**
+ * Recursively sorts the keys of an object, including nested objects.
+ * This is the core of canonical serialization.
+ * @param obj The object to sort.
+ * @returns A new object with all keys sorted alphabetically.
+ */
+function sortKeys(obj) {
+    if (typeof obj !== 'object' || obj === null) {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(sortKeys);
+    }
+    const sortedKeys = Object.keys(obj).sort();
+    const newObj = {};
+    for (const key of sortedKeys) {
+        newObj[key] = sortKeys(obj[key]);
+    }
+    return newObj;
+}
+/**
+ * Canonically serializes a payload object.
+ * @param payload The object to serialize.
+ * @returns A deterministic JSON string.
+ */
+function canonicalize(payload) {
+    const sortedPayload = sortKeys(payload);
+    return JSON.stringify(sortedPayload);
+}
+/**
+ * Calculates the SHA-256 checksum of a record's payload.
+ */
+export function calculatePayloadChecksum(payload) {
+    const jsonString = canonicalize(payload);
+    return createHash("sha256").update(jsonString, "utf8").digest("hex");
+}
+//# sourceMappingURL=checksum.js.map

package/dist/src/crypto/checksum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum.js","sourceRoot":"","sources":["../../../src/crypto/checksum.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGpC;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAQ;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA4B;IACnE,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC"}

package/dist/src/crypto/checksum.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=checksum.test.d.ts.map

package/dist/src/crypto/checksum.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum.test.d.ts","sourceRoot":"","sources":["../../../src/crypto/checksum.test.ts"],"names":[],"mappings":""}

package/dist/src/crypto/checksum.test.js

@@ -0,0 +1,167 @@
+import { calculatePayloadChecksum } from "./checksum";
+describe("calculatePayloadChecksum", () => {
+    const testCases = [
+        {
+            name: 'actor',
+            payload: {
+                id: 'actor:test', type: 'human', displayName: 'Test User',
+                publicKey: 'key', roles: ['user'], status: 'active',
+            }
+        },
+        {
+            name: 'agent',
+            payload: {
+                id: 'agent:test-agent', guild: 'design', status: 'active',
+                engine: { type: 'local', runtime: 'typescript', entrypoint: 'test.ts', function: 'run' },
+                triggers: [], knowledge_dependencies: [], prompt_engine_requirements: {}
+            }
+        },
+        {
+            name: 'task',
+            payload: {
+                id: '1752274500-task-test-task', title: 'Test Task',
+                status: 'draft', priority: 'medium', description: 'A test task for checksum validation', tags: ['test']
+            }
+        },
+        {
+            name: 'cycle',
+            payload: {
+                id: '1754400000-cycle-test-cycle', title: 'Test Cycle',
+                status: 'planning', taskIds: ['1752274500-task-test-task'], tags: ['test']
+            }
+        },
+        {
+            name: 'execution',
+            payload: {
+                id: '1752275500-exec-test-execution', taskId: '1752274500-task-test-task',
+                result: 'Successfully implemented the feature', type: 'progress'
+            }
+        },
+        {
+            name: 'changelog',
+            payload: {
+                id: '1752707800-changelog-task-test-task',
+                entityType: 'task',
+                entityId: '1752274500-task-test-task',
+                changeType: 'completion',
+                title: 'Test Task Completion',
+                description: 'Successfully completed the test task with all requirements',
+                timestamp: 1752707800,
+                trigger: 'manual',
+                triggeredBy: 'human:developer',
+                reason: 'All acceptance criteria met and code review passed',
+                riskLevel: 'low'
+            }
+        },
+        {
+            name: 'feedback',
+            payload: {
+                id: '1752788100-feedback-blocking-issue', entityType: 'task', entityId: '1752274500-task-test-task',
+                type: 'blocking', status: 'open', content: 'This task has a blocking issue'
+            }
+        }
+    ];
+    for (const tc of testCases) {
+        it(`[EARS-1] should produce a deterministic checksum for a ${tc.name}`, () => {
+            // Create two versions with disordered keys
+            const payload1 = { ...tc.payload, z: 'last', a: 'first' };
+            const payload2 = { a: 'first', ...tc.payload, z: 'last' };
+            const checksum1 = calculatePayloadChecksum(payload1);
+            const checksum2 = calculatePayloadChecksum(payload2);
+            expect(checksum1).toBe(checksum2);
+        });
+    }
+    describe('ChangelogRecord v2 Enhanced Determinism Tests', () => {
+        it('[EARS-1] should produce deterministic checksum for complex ChangelogRecord with nested objects and arrays', () => {
+            // Create complex changelog v2 with all optional fields
+            const complexChangelog1 = {
+                id: '1752707800-changelog-system-payment-gateway',
+                entityType: 'system',
+                entityId: 'payment-gateway',
+                changeType: 'hotfix',
+                title: 'Critical Payment Gateway Fix',
+                description: 'Fixed critical payment processing issue affecting 15% of transactions',
+                timestamp: 1752707800,
+                trigger: 'emergency',
+                triggeredBy: 'human:on-call-engineer',
+                reason: 'Payment failures spiked to 15% due to third-party API latency',
+                riskLevel: 'critical',
+                // Complex nested structures
+                affectedSystems: ['payment-gateway', 'order-service', 'notification-service'],
+                usersAffected: 25000,
+                downtime: 300,
+                files: ['src/payment/gateway.ts', 'src/payment/processor.ts'],
+                commits: ['abc123def', 'def456ghi'],
+                rollbackInstructions: 'Revert to payment-gateway:v2.1.4 and restart services',
+                references: {
+                    tasks: ['1752274500-task-payment-fix'],
+                    executions: ['1752707750-exec-hotfix-implementation'],
+                    cycles: ['1752600000-cycle-payment-stability']
+                }
+            };
+            // Create same object with keys in different order
+            const complexChangelog2 = {
+                riskLevel: 'critical',
+                references: {
+                    cycles: ['1752600000-cycle-payment-stability'],
+                    tasks: ['1752274500-task-payment-fix'],
+                    executions: ['1752707750-exec-hotfix-implementation']
+                },
+                rollbackInstructions: 'Revert to payment-gateway:v2.1.4 and restart services',
+                commits: ['abc123def', 'def456ghi'],
+                files: ['src/payment/gateway.ts', 'src/payment/processor.ts'],
+                downtime: 300,
+                usersAffected: 25000,
+                affectedSystems: ['payment-gateway', 'order-service', 'notification-service'],
+                reason: 'Payment failures spiked to 15% due to third-party API latency',
+                triggeredBy: 'human:on-call-engineer',
+                trigger: 'emergency',
+                timestamp: 1752707800,
+                description: 'Fixed critical payment processing issue affecting 15% of transactions',
+                title: 'Critical Payment Gateway Fix',
+                changeType: 'hotfix',
+                entityId: 'payment-gateway',
+                entityType: 'system',
+                id: '1752707800-changelog-system-payment-gateway'
+            };
+            const checksum1 = calculatePayloadChecksum(complexChangelog1);
+            const checksum2 = calculatePayloadChecksum(complexChangelog2);
+            expect(checksum1).toBe(checksum2);
+            expect(checksum1).toMatch(/^[a-f0-9]{64}$/); // Valid SHA-256 hex
+        });
+        it('[EARS-1] should produce different checksums for different ChangelogRecord v2 content', () => {
+            const changelog1 = {
+                id: '1752707800-changelog-task-feature-a',
+                entityType: 'task',
+                entityId: '1752274500-task-feature-a',
+                changeType: 'completion',
+                title: 'Feature A Completed',
+                description: 'Successfully implemented feature A',
+                timestamp: 1752707800,
+                trigger: 'manual',
+                triggeredBy: 'human:developer',
+                reason: 'All requirements met',
+                riskLevel: 'low'
+            };
+            const changelog2 = {
+                id: '1752707800-changelog-task-feature-b',
+                entityType: 'task',
+                entityId: '1752274500-task-feature-b',
+                changeType: 'completion',
+                title: 'Feature B Completed',
+                description: 'Successfully implemented feature B',
+                timestamp: 1752707800,
+                trigger: 'manual',
+                triggeredBy: 'human:developer',
+                reason: 'All requirements met',
+                riskLevel: 'low'
+            };
+            const checksum1 = calculatePayloadChecksum(changelog1);
+            const checksum2 = calculatePayloadChecksum(changelog2);
+            expect(checksum1).not.toBe(checksum2);
+            expect(checksum1).toMatch(/^[a-f0-9]{64}$/);
+            expect(checksum2).toMatch(/^[a-f0-9]{64}$/);
+        });
+    });
+});
+//# sourceMappingURL=checksum.test.js.map

package/dist/src/crypto/checksum.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum.test.js","sourceRoot":"","sources":["../../../src/crypto/checksum.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAUtD,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,MAAM,SAAS,GAA+D;QAC5E;YACE,IAAI,EAAE,OAAO;YACb,OAAO,EAAE;gBACP,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW;gBACzD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ;aACrC;SACjB;QACD;YACE,IAAI,EAAE,OAAO;YACb,OAAO,EAAE;gBACP,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;gBACzD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACxF,QAAQ,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE;aAC1D;SACjB;QACD;YACE,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE;gBACP,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,WAAW;gBACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC;aAC1F;SAChB;QACD;YACE,IAAI,EAAE,OAAO;YACb,OAAO,EAAE;gBACP,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,YAAY;gBACtD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC;aAC5D;SACjB;QACD;YACE,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE;gBACP,EAAE,EAAE,gCAAgC,EAAE,MAAM,EAAE,2BAA2B;gBACzE,MAAM,EAAE,sCAAsC,EAAE,IAAI,EAAE,UAAU;aAC9C;SACrB;QACD;YACE,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE;gBACP,EAAE,EAAE,qCAAqC;gBACzC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,2BAA2B;gBACrC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,4DAA4D;gBACzE,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,QAAQ;gBACjB,WAAW,EAAE,iBAAiB;gBAC9B,MAAM,EAAE,oDAAoD;gBAC5D,SAAS,EAAE,KAAK;aACE;SACrB;QACD;YACE,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE;gBACP,EAAE,EAAE,oCAAoC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,2BAA2B;gBACnG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gCAAgC;aAC1D;SACpB;KACF,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,EAAE,CAAC,0DAA0D,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;YAC3E,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;YAE1D,MAAM,SAAS,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAErD,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC7D,EAAE,CAAC,2GAA2G,EAAE,GAAG,EAAE;YACnH,uDAAuD;YACvD,MAAM,iBAAiB,GAAoB;gBACzC,EAAE,EAAE,6CAA6C;gBACjD,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,iBAAiB;gBAC3B,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,8BAA8B;gBACrC,WAAW,EAAE,uEAAuE;gBACpF,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,wBAAwB;gBACrC,MAAM,EAAE,+DAA+D;gBACvE,SAAS,EAAE,UAAU;gBACrB,4BAA4B;gBAC5B,eAAe,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,sBAAsB,CAAC;gBAC7E,aAAa,EAAE,KAAK;gBACpB,QAAQ,EAAE,GAAG;gBACb,KAAK,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;gBAC7D,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;gBACnC,oBAAoB,EAAE,uDAAuD;gBAC7E,UAAU,EAAE;oBACV,KAAK,EAAE,CAAC,6BAA6B,CAAC;oBACtC,UAAU,EAAE,CAAC,uCAAuC,CAAC;oBACrD,MAAM,EAAE,CAAC,oCAAoC,CAAC;iBAC/C;aACF,CAAC;YAEF,kDAAkD;YAClD,MAAM,iBAAiB,GAAoB;gBACzC,SAAS,EAAE,UAAU;gBACrB,UAAU,EAAE;oBACV,MAAM,EAAE,CAAC,oCAAoC,CAAC;oBAC9C,KAAK,EAAE,CAAC,6BAA6B,CAAC;oBACtC,UAAU,EAAE,CAAC,uCAAuC,CAAC;iBACtD;gBACD,oBAAoB,EAAE,uDAAuD;gBAC7E,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;gBACnC,KAAK,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;gBAC7D,QAAQ,EAAE,GAAG;gBACb,aAAa,EAAE,KAAK;gBACpB,eAAe,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,sBAAsB,CAAC;gBAC7E,MAAM,EAAE,+DAA+D;gBACvE,WAAW,EAAE,wBAAwB;gBACrC,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,UAAU;gBACrB,WAAW,EAAE,uEAAuE;gBACpF,KAAK,EAAE,8BAA8B;gBACrC,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,iBAAiB;gBAC3B,UAAU,EAAE,QAAQ;gBACpB,EAAE,EAAE,6CAA6C;aAClD,CAAC;YAEF,MAAM,SAAS,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;YAE9D,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;YAC9F,MAAM,UAAU,GAAoB;gBAClC,EAAE,EAAE,qCAAqC;gBACzC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,2BAA2B;gBACrC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE,qBAAqB;gBAC5B,WAAW,EAAE,oCAAoC;gBACjD,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,QAAQ;gBACjB,WAAW,EAAE,iBAAiB;gBAC9B,MAAM,EAAE,sBAAsB;gBAC9B,SAAS,EAAE,KAAK;aACjB,CAAC;YAEF,MAAM,UAAU,GAAoB;gBAClC,EAAE,EAAE,qCAAqC;gBACzC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,2BAA2B;gBACrC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE,qBAAqB;gBAC5B,WAAW,EAAE,oCAAoC;gBACjD,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,QAAQ;gBACjB,WAAW,EAAE,iBAAiB;gBAC9B,MAAM,EAAE,sBAAsB;gBAC9B,SAAS,EAAE,KAAK;aACjB,CAAC;YAEF,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;YAEvD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC5C,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/crypto/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./checksum";
+export * from "./signatures";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}

package/dist/src/crypto/index.js

@@ -0,0 +1,3 @@
+export * from "./checksum";
+export * from "./signatures";
+//# sourceMappingURL=index.js.map

package/dist/src/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}

package/dist/src/crypto/signatures.d.ts

@@ -0,0 +1,24 @@
+import type { GitGovRecordPayload, Signature } from "../types";
+/**
+ * Generates a new Ed25519 key pair.
+ * @returns A promise that resolves to an object with publicKey and privateKey in base64 format.
+ */
+export declare function generateKeys(): Promise<{
+    publicKey: string;
+    privateKey: string;
+}>;
+/**
+ * Creates a signature for a given payload.
+ */
+export declare function signPayload(payload: GitGovRecordPayload, privateKey: string, keyId: string, role: string): Signature;
+/**
+ * Verifies all signatures on a record.
+ */
+export declare function verifySignatures(record: {
+    header: {
+        payloadChecksum: string;
+        signatures: Signature[];
+    };
+    payload: GitGovRecordPayload;
+}, getActorPublicKey: (keyId: string) => Promise<string | null>): Promise<boolean>;
+//# sourceMappingURL=signatures.d.ts.map

package/dist/src/crypto/signatures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signatures.d.ts","sourceRoot":"","sources":["../../../src/crypto/signatures.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAK/D;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CAAE,CAAC,CASxF;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,SAAS,CAqBX;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE;IAAE,MAAM,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,EACtG,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAC3D,OAAO,CAAC,OAAO,CAAC,CA6BlB"}

package/dist/src/crypto/signatures.js

@@ -0,0 +1,67 @@
+import { generateKeyPair, sign, verify, createHash } from "crypto";
+import { promisify } from "util";
+import { calculatePayloadChecksum } from "./checksum";
+import { createLogger } from "../logger";
+const logger = createLogger("[CryptoModule] ");
+const generateKeyPairAsync = promisify(generateKeyPair);
+/**
+ * Generates a new Ed25519 key pair.
+ * @returns A promise that resolves to an object with publicKey and privateKey in base64 format.
+ */
+export async function generateKeys() {
+    const { publicKey, privateKey } = await generateKeyPairAsync('ed25519', {
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    return {
+        publicKey: Buffer.from(publicKey).toString('base64'),
+        privateKey: Buffer.from(privateKey).toString('base64'),
+    };
+}
+/**
+ * Creates a signature for a given payload.
+ */
+export function signPayload(payload, privateKey, keyId, role) {
+    const payloadChecksum = calculatePayloadChecksum(payload);
+    const timestamp = Math.floor(Date.now() / 1000);
+    const digest = `${payloadChecksum}:${keyId}:${role}:${timestamp}`;
+    // Per the blueprint, sign the SHA-256 hash of the digest
+    const digestHash = createHash('sha256').update(digest).digest();
+    const signature = sign(null, digestHash, {
+        key: Buffer.from(privateKey, 'base64'),
+        type: 'pkcs8',
+        format: 'pem'
+    });
+    return {
+        keyId,
+        role,
+        signature: signature.toString('base64'),
+        timestamp,
+        timestamp_iso: new Date(timestamp * 1000).toISOString(),
+    };
+}
+/**
+ * Verifies all signatures on a record.
+ */
+export async function verifySignatures(record, getActorPublicKey) {
+    for (const signature of record.header.signatures) {
+        const publicKey = await getActorPublicKey(signature.keyId);
+        if (!publicKey) {
+            logger.warn(`Public key not found for actor: ${signature.keyId}`);
+            return false;
+        }
+        const digest = `${record.header.payloadChecksum}:${signature.keyId}:${signature.role}:${signature.timestamp}`;
+        // Per the blueprint, verify against the SHA-256 hash of the digest
+        const digestHash = createHash('sha256').update(digest).digest();
+        const isValid = verify(null, digestHash, {
+            key: Buffer.from(publicKey, 'base64'),
+            type: 'spki',
+            format: 'pem'
+        }, Buffer.from(signature.signature, 'base64'));
+        if (!isValid) {
+            return false;
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=signatures.js.map

package/dist/src/crypto/signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signatures.js","sourceRoot":"","sources":["../../../src/crypto/signatures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAC/C,MAAM,oBAAoB,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE;QACtE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IACH,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,OAA4B,EAC5B,UAAkB,EAClB,KAAa,EACb,IAAY;IAEZ,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,eAAe,IAAI,KAAK,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;IAElE,yDAAyD;IACzD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAEhE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE;QACvC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtC,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,IAAI;QACJ,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,SAAS;QACT,aAAa,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsG,EACtG,iBAA4D;IAE5D,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,mCAAmC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QAE9G,mEAAmE;QACnE,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAEhE,MAAM,OAAO,GAAG,MAAM,CACpB,IAAI,EACJ,UAAU,EACV;YACE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;YACrC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,KAAK;SACd,EACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAC3C,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/crypto/signatures.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signatures.test.d.ts.map

package/dist/src/crypto/signatures.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signatures.test.d.ts","sourceRoot":"","sources":["../../../src/crypto/signatures.test.ts"],"names":[],"mappings":""}