@gitpagedocs/tools 1.1.49 → 1.1.51

package/package.json

@@ -1,37 +1,37 @@
-{
-  "name": "@gitpagedocs/tools",
-  "version": "1.1.49",
-  "type": "module",
-  "description": "Shared business-logic core for Git Page Docs (consumed by frontend, cli and mcp). Ships TypeScript source; consume via tsx or a TS-aware bundler.",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
-  "exports": {
-    ".": "./src/index.ts",
-    "./ai": "./src/ai/index.ts",
-    "./errors": "./src/errors/index.ts",
-    "./ports": "./src/ports/index.ts",
-    "./crypto/web": "./src/crypto/web.ts",
-    "./security/web": "./src/security/web.ts",
-    "./cache/web": "./src/cache/web-storage-cache.ts"
-  },
-  "files": [
-    "src",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "scripts": {
-    "typecheck": "tsc --noEmit -p tsconfig.json"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Vidigal-code/git-page-docs.git",
-    "directory": "tools"
-  },
-  "author": "Vidigal-code",
-  "license": "ISC",
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@gitpagedocs/tools",
+  "version": "1.1.51",
+  "type": "module",
+  "description": "Shared business-logic core for Git Page Docs (consumed by frontend, cli and mcp). Ships TypeScript source; consume via tsx or a TS-aware bundler.",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./ai": "./src/ai/index.ts",
+    "./errors": "./src/errors/index.ts",
+    "./ports": "./src/ports/index.ts",
+    "./crypto/web": "./src/crypto/web.ts",
+    "./security/web": "./src/security/web.ts",
+    "./cache/web": "./src/cache/web-storage-cache.ts"
+  },
+  "files": [
+    "src",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Vidigal-code/git-page-docs.git",
+    "directory": "tools"
+  },
+  "author": "Vidigal-code",
+  "license": "ISC",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/crypto/doc-access.ts

@@ -0,0 +1,62 @@
+/**
+ * Documentation password-gate key scheme (runtime-agnostic).
+ *
+ * Double-hash so config.json can ship a non-reversible verifier while the user
+ * keeps a copyable credential:
+ *   privateKey = sha256(password)     // printed by the CLI, shareable
+ *   publicKey  = sha256(privateKey)   // stored in config.json
+ * Unlock succeeds when the supplied input is the password OR the private key.
+ *
+ * Pure: depends only on a { sha256 } service, so the SAME code runs in the CLI
+ * (NodeCryptoService) and the browser (WebCryptoService). It must NOT import
+ * node:crypto (e.g. safeHexEqual) so it stays safe to bundle for the web.
+ */
+
+/** Minimal hashing surface — satisfied by both Node and Web CryptoService. */
+export interface Sha256Service {
+  sha256(input: string): Promise<string>;
+}
+
+export interface DocAccessKeys {
+  /** sha256(password) — printed for the user to copy/share. */
+  readonly privateKey: string;
+  /** sha256(privateKey) — safe to commit in config.json. */
+  readonly publicKey: string;
+}
+
+/** Derive the { privateKey, publicKey } pair from a plaintext password. */
+export async function deriveDocAccessKeys(
+  password: string,
+  crypto: Sha256Service,
+): Promise<DocAccessKeys> {
+  const privateKey = await crypto.sha256(password);
+  const publicKey = await crypto.sha256(privateKey);
+  return { privateKey, publicKey };
+}
+
+/**
+ * Verify a user-supplied credential (password OR private key) against the stored
+ * public key. Returns false when either side is empty.
+ */
+export async function verifyDocAccess(
+  input: string,
+  publicKey: string,
+  crypto: Sha256Service,
+): Promise<boolean> {
+  if (!input || !publicKey) return false;
+  const once = await crypto.sha256(input);
+  if (hexEqual(once, publicKey)) return true; // input is the private key
+  const twice = await crypto.sha256(once);
+  return hexEqual(twice, publicKey); // input is the password
+}
+
+/**
+ * Length-checked, constant-time hex comparison. Local (not safeHexEqual) so this
+ * module never imports node:crypto and stays browser-bundle-safe.
+ */
+function hexEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}

package/src/crypto/index.ts

@@ -1,2 +1,4 @@
 export { NodeCryptoService, safeHexEqual } from "./node-crypto-service";
 export { WebCryptoService } from "./web-crypto-service";
+export { deriveDocAccessKeys, verifyDocAccess } from "./doc-access";
+export type { DocAccessKeys, Sha256Service } from "./doc-access";

package/src/crypto/web.ts

@@ -1,2 +1,4 @@
 // Browser-safe crypto entry: Web Crypto only (no node:crypto).
 export { WebCryptoService } from "./web-crypto-service";
+export { deriveDocAccessKeys, verifyDocAccess } from "./doc-access";
+export type { DocAccessKeys, Sha256Service } from "./doc-access";