@join-pantheon/cli 0.29.1 → 0.31.0

package/dist/home-guard.js

@@ -0,0 +1,565 @@
+import { createHash } from "node:crypto";
+import { chmodSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parseJsonText } from "./text-file.js";
+import { withFileLock } from "./file-lock.js";
+import { writeWhole } from "./pins.js";
+export const POLICY_FILE = "worker-policy.json";
+export const PROFILE_FILE = "profile.json";
+export const HUD_FILE = join("bin", ".hud-action.json");
+export const CONFIG_FILE = "config.json";
+export const CONTINUED_FILE = "continued.json";
+export const CURSOR_FILE = "worker-cursor.json";
+export const PINS_FILE = "keys.json";
+export const NONCES_FILE = "nonces.json";
+export const GUARDED_FILES = [POLICY_FILE, CONFIG_FILE, PROFILE_FILE, HUD_FILE, CONTINUED_FILE, CURSOR_FILE, PINS_FILE, NONCES_FILE];
+const sha = (b) => createHash("sha256").update(b).digest("hex");
+const read = (f) => { try {
+    return statSync(f).isFile() ? readFileSync(f) : null;
+}
+catch {
+    return null;
+} };
+const parse = (b) => {
+    try {
+        const v = b ? parseJsonText(b.toString("utf8")) : undefined;
+        return v && typeof v === "object" && !Array.isArray(v) ? v : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const trusted = new Map();
+const runBaseline = new Map();
+export function trustWrite(file, prev) {
+    const k = resolve(file);
+    if (prev !== undefined && runBaseline.has(k)) {
+        const ph = prev ? sha(prev) : null;
+        if (ph !== runBaseline.get(k) && !trusted.get(k)?.has(ph ?? "absent"))
+            return;
+    }
+    const b = read(file);
+    const set = trusted.get(k) ?? new Set();
+    set.add(b ? sha(b) : "absent");
+    if (set.size > 50)
+        set.delete(set.values().next().value);
+    trusted.set(k, set);
+}
+export function snapshotHome(home, files = GUARDED_FILES) {
+    const s = { home, at: Date.now(), files: files.map((rel) => { const b = read(join(home, rel)); return { rel, bytes: b, hash: b ? sha(b) : null }; }) };
+    for (const f of s.files)
+        runBaseline.set(resolve(join(home, f.rel)), f.hash);
+    return s;
+}
+export function changedKeys(a, b, prefix = "", depth = 0) {
+    const isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+    if (!isObj(a) || !isObj(b) || depth >= 4)
+        return JSON.stringify(a) === JSON.stringify(b) ? [] : [prefix || "(the whole file)"];
+    const out = [];
+    for (const k of new Set([...Object.keys(a), ...Object.keys(b)])) {
+        const p = prefix ? `${prefix}.${k}` : k;
+        if (!(k in a))
+            out.push(`${p} added`);
+        else if (!(k in b))
+            out.push(`${p} removed`);
+        else
+            out.push(...changedKeys(a[k], b[k], p, depth + 1));
+    }
+    return out;
+}
+const obj = (x) => (x && typeof x === "object" && !Array.isArray(x) ? x : {});
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+export const askedHere = new Set();
+export function narrowPolicy(before, now, keepAsks = askedHere) {
+    const b = obj(before);
+    const keys = [];
+    const out = { ...now };
+    const bg = obj(b.grants), ng = obj(now.grants);
+    const grants = {};
+    for (const [cap, g] of Object.entries(ng)) {
+        if (!(cap in bg)) {
+            keys.push(`grants.${cap} added`);
+            continue;
+        }
+        if (!same(bg[cap], g)) {
+            keys.push(`grants.${cap} changed`);
+            grants[cap] = bg[cap];
+            continue;
+        }
+        grants[cap] = g;
+    }
+    out.grants = grants;
+    const bw = obj(b.wakers), nw = obj(now.wakers);
+    const wakers = {};
+    for (const [team, list] of Object.entries(nw)) {
+        const had = new Set(Array.isArray(bw[team]) ? bw[team].filter((x) => typeof x === "string") : []);
+        const keep = (Array.isArray(list) ? list : []).filter((m) => typeof m === "string" && had.has(m));
+        const added = (Array.isArray(list) ? list : []).filter((m) => typeof m === "string" && !had.has(m));
+        if (added.length)
+            keys.push(`wakers.${team} added ${added.length}`);
+        if (keep.length)
+            wakers[team] = keep;
+    }
+    if (Object.keys(wakers).length || "wakers" in now)
+        out.wakers = wakers;
+    const bd = obj(b.denied), nd = obj(now.denied);
+    const denied = { ...nd };
+    for (const [cap, at] of Object.entries(bd))
+        if (!(cap in nd)) {
+            denied[cap] = at;
+            keys.push(`denied.${cap} removed`);
+        }
+    out.denied = denied;
+    const bk = obj(b.asks), nk = obj(now.asks);
+    const pending = {};
+    for (const [cap, q] of Object.entries(nk)) {
+        if (!(cap in bk)) {
+            keys.push(`asks.${cap} added`);
+            continue;
+        }
+        if (!same(bk[cap], q)) {
+            keys.push(`asks.${cap} changed`);
+            pending[cap] = bk[cap];
+            continue;
+        }
+        pending[cap] = q;
+    }
+    if ("asks" in now || Object.keys(pending).length)
+        out.asks = pending;
+    const bo = obj(b.wakeOnce), no = obj(now.wakeOnce);
+    const once = {};
+    for (const [k, n] of Object.entries(no)) {
+        const was = typeof bo[k] === "number" ? bo[k] : 0;
+        if (typeof n === "number" && n > was) {
+            keys.push(`wakeOnce.${k} raised`);
+            if (was > 0)
+                once[k] = was;
+            continue;
+        }
+        once[k] = n;
+    }
+    if ("wakeOnce" in now || Object.keys(once).length)
+        out.wakeOnce = once;
+    const bn = obj(b.wakeNo), nn = obj(now.wakeNo);
+    const wakeNo = { ...nn };
+    for (const [k, at] of Object.entries(bn)) {
+        if (!(k in nn) || (typeof at === "number" && typeof nn[k] === "number" && nn[k] < at)) {
+            wakeNo[k] = at;
+            keys.push(`wakeNo.${k} lifted`);
+        }
+    }
+    const ba = obj(b.wakeAsks), na = obj(now.wakeAsks);
+    const asks = {};
+    for (const [id, q] of Object.entries(na)) {
+        if (!(id in ba)) {
+            if (keepAsks.has(id)) {
+                asks[id] = q;
+                continue;
+            }
+            keys.push(`wakeAsks.${id} added`);
+            continue;
+        }
+        if (!same(ba[id], q)) {
+            keys.push(`wakeAsks.${id} changed`);
+            asks[id] = ba[id];
+            continue;
+        }
+        asks[id] = q;
+    }
+    if ("wakeAsks" in now || Object.keys(asks).length)
+        out.wakeAsks = asks;
+    for (const f of ["wakersCarried", "wakersDeferred"]) {
+        const bf = obj(b[f]), nf = obj(now[f]);
+        const merged = { ...nf };
+        let lost = 0;
+        for (const [k, v] of Object.entries(bf))
+            if (!(k in nf) || !same(nf[k], v)) {
+                merged[k] = v;
+                lost++;
+            }
+        if (lost) {
+            out[f] = merged;
+            keys.push(`${f}: ${lost} removed`);
+        }
+    }
+    const bt = obj(b.wakeTeamFlag), nt = obj(now.wakeTeamFlag);
+    const flags = {};
+    for (const [k, v] of Object.entries(nt)) {
+        if (!(k in bt)) {
+            keys.push(`wakeTeamFlag.${k} added`);
+            continue;
+        }
+        flags[k] = v;
+    }
+    if ("wakeTeamFlag" in now)
+        out.wakeTeamFlag = flags;
+    if ("wakeNo" in now || Object.keys(wakeNo).length)
+        out.wakeNo = wakeNo;
+    return { policy: out, keys };
+}
+export function narrowConfig(before, now) {
+    const keys = [];
+    const out = { ...now };
+    if (typeof before.relay === "string" && now.relay !== before.relay) {
+        out.relay = before.relay;
+        keys.push("relay changed");
+    }
+    const bs = obj(before.spaces), ns = obj(now.spaces);
+    const spaces = { ...ns };
+    for (const [id, m] of Object.entries(ns)) {
+        const was = obj(bs[id]);
+        if (typeof was.relay === "string" && obj(m).relay !== was.relay) {
+            spaces[id] = { ...obj(m), relay: was.relay };
+            keys.push(`spaces.${id}.relay changed`);
+        }
+    }
+    for (const [id, was] of Object.entries(bs)) {
+        const w = obj(was), m = obj(spaces[id]);
+        if (id in spaces && w.since !== undefined && m.since !== w.since) {
+            spaces[id] = { ...m, since: w.since };
+            keys.push(`spaces.${id}.since changed`);
+        }
+    }
+    const ids = new Set(Object.values(bs).map((m) => obj(m).id).filter((x) => typeof x === "string"));
+    for (const id of Object.keys(spaces))
+        if (!(id in bs)) {
+            delete spaces[id];
+            keys.push(`spaces.${id} added${ids.has(obj(ns[id]).id) ? " (a second entry for an existing team)" : ""}`);
+        }
+    for (const [id, m] of Object.entries(spaces)) {
+        const w = obj(bs[id]);
+        if (w.id !== undefined && obj(m).id !== w.id) {
+            spaces[id] = { ...obj(m), id: w.id };
+            keys.push(`spaces.${id}.id changed`);
+        }
+        if (w.name !== undefined && obj(spaces[id]).name !== w.name) {
+            spaces[id] = { ...obj(spaces[id]), name: w.name };
+            keys.push(`spaces.${id}.name changed`);
+        }
+    }
+    if ("spaces" in now)
+        out.spaces = spaces;
+    if (now.default_space !== before.default_space) {
+        out.default_space = before.default_space;
+        keys.push("default_space changed");
+    }
+    if (!same(obj(now.network).proxy, obj(before.network).proxy)) {
+        out.network = { ...obj(now.network), proxy: obj(before.network).proxy };
+        if (obj(before.network).proxy === undefined)
+            delete out.network.proxy;
+        keys.push("network.proxy changed");
+    }
+    const bb = obj(before.bindings), nb = obj(now.bindings);
+    const bindings = {};
+    for (const [k, v] of Object.entries(nb)) {
+        if (!(k in bb)) {
+            keys.push(`bindings.${k} added`);
+            continue;
+        }
+        if (!same(bb[k], v)) {
+            keys.push(`bindings.${k} changed`);
+            bindings[k] = bb[k];
+            continue;
+        }
+        bindings[k] = v;
+    }
+    if ("bindings" in now || Object.keys(bindings).length)
+        out.bindings = bindings;
+    const bu = Array.isArray(before.unbound) ? before.unbound : [];
+    const nu = Array.isArray(now.unbound) ? now.unbound : [];
+    const lifted = bu.filter((x) => !nu.includes(x));
+    if (lifted.length) {
+        out.unbound = [...nu, ...lifted];
+        keys.push(`unbound: ${lifted.length} taken off`);
+    }
+    return { config: out, keys };
+}
+export function narrowPins(before, now) {
+    const b = obj(before), n = obj(now);
+    const keys = [];
+    const bt = obj(b.teams), nt = obj(n.teams);
+    const teams = {};
+    for (const id of new Set([...Object.keys(bt), ...Object.keys(nt)])) {
+        const was = obj(bt[id]), is = obj(nt[id]);
+        const wm = obj(was.members), im = obj(is.members);
+        const members = {};
+        for (const [m, pin] of Object.entries(im)) {
+            if (!(m in wm)) {
+                keys.push(`${id}.${m} pinned during the run`);
+                continue;
+            }
+            const w = obj(wm[m]), p = obj(pin);
+            const pendingOk = same(p.pending ?? null, w.pending ?? null);
+            if (p.fp !== w.fp || p.key !== w.key) {
+                members[m] = { ...w };
+                keys.push(`${id}.${m} key changed`);
+                continue;
+            }
+            if (!pendingOk) {
+                const { pending: _p, ...rest } = obj(pin);
+                members[m] = { ...rest, ...(w.pending ? { pending: w.pending } : {}) };
+                keys.push(`${id}.${m} held-back key changed during the run`);
+                continue;
+            }
+            if (w.signs && !p.signs) {
+                members[m] = { ...p, signs: w.signs };
+                keys.push(`${id}.${m} signing forgotten`);
+                continue;
+            }
+            members[m] = pin;
+        }
+        for (const [m, pin] of Object.entries(wm))
+            if (!(m in im)) {
+                members[m] = pin;
+                keys.push(`${id}.${m} unpinned`);
+            }
+        const t = { ...is, members };
+        if (was.sigs && !is.sigs) {
+            t.sigs = was.sigs;
+            keys.push(`${id}: signatures turned off`);
+        }
+        if (is.spaceId !== was.spaceId) {
+            if (was.spaceId === undefined)
+                delete t.spaceId;
+            else
+                t.spaceId = was.spaceId;
+            keys.push(`${id}: team id changed`);
+        }
+        teams[id] = t;
+    }
+    return { value: { ...n, v: 1, teams }, keys };
+}
+export function narrowNonces(before, now) {
+    const b = obj(before), n = obj(now);
+    const out = { ...n };
+    let lost = 0;
+    for (const [team, entries] of Object.entries(b)) {
+        const cur = { ...obj(n[team]) };
+        const forward = (c, w) => same(c, w) || (Array.isArray(c) && Array.isArray(w) && c[0] === w[0] && c[1] === w[1]
+            && (c[2] ?? null) === (w[2] ?? null) && typeof c[3] === "number" && (w[3] === undefined || w[3] === c[3]));
+        for (const [k, v] of Object.entries(obj(entries)))
+            if (!(k in cur) || !forward(cur[k], v)) {
+                cur[k] = v;
+                lost++;
+            }
+        out[team] = cur;
+    }
+    return { value: out, keys: lost ? [`${lost} seen request${lost === 1 ? "" : "s"} forgotten`] : [] };
+}
+const WAKE_ORDER = { no: 0, approved: 1, anyone: 2 };
+export function narrowProfile(before, now) {
+    const bw = obj(obj(before).agent).wake_default, nw = obj(now.agent).wake_default;
+    const rank = (v) => (typeof v === "string" && v in WAKE_ORDER ? WAKE_ORDER[v] : WAKE_ORDER.anyone);
+    const agent = { ...obj(now.agent) };
+    const keys = [];
+    const ba = obj(obj(before).agent);
+    if (bw !== undefined && nw === undefined) {
+        agent.wake_default = bw;
+        keys.push("agent.wake_default removed");
+    }
+    else if (rank(nw) > rank(bw)) {
+        if (bw === undefined)
+            delete agent.wake_default;
+        else
+            agent.wake_default = bw;
+        keys.push(`agent.wake_default loosened to ${String(nw)}`);
+    }
+    if (agent.allow_bash === true && ba.allow_bash !== true) {
+        if (ba.allow_bash === undefined)
+            delete agent.allow_bash;
+        else
+            agent.allow_bash = ba.allow_bash;
+        keys.push("agent.allow_bash turned on");
+    }
+    else if (ba.allow_bash === false && agent.allow_bash !== false) {
+        agent.allow_bash = false;
+        keys.push("agent.allow_bash no removed");
+    }
+    if (agent.wake_enabled === true && ba.wake_enabled === false) {
+        agent.wake_enabled = false;
+        keys.push("agent.wake_enabled turned on");
+    }
+    if (!same(agent.primary_surface, ba.primary_surface) && ba.primary_surface !== undefined) {
+        agent.primary_surface = ba.primary_surface;
+        keys.push("agent.primary_surface changed");
+    }
+    return keys.length ? { profile: { ...now, agent }, keys } : { profile: now, keys: [] };
+}
+export function restoreHome(s) {
+    const out = [];
+    const takesFiles = () => { const p = join(s.home, `.write-check.${process.pid}.${Date.now()}`); try {
+        writeFileSync(p, "", { flag: "wx", mode: 0o600 });
+        rmSync(p, { force: true });
+        return true;
+    }
+    catch {
+        return false;
+    } };
+    if (!takesFiles()) {
+        try {
+            chmodSync(s.home, 0o700);
+        }
+        catch { }
+        out.push(takesFiles() ? { rel: "the Pantheon folder", what: "reverted", keys: ["made read-only"] } : { rel: "the Pantheon folder", what: "reported", keys: ["cannot take new files — fix its permissions"] });
+    }
+    for (const f of s.files)
+        runBaseline.delete(resolve(join(s.home, f.rel)));
+    for (const f of s.files) {
+        const file = join(s.home, f.rel);
+        const now = read(file);
+        const hashNow = now ? sha(now) : null;
+        if (hashNow === f.hash)
+            continue;
+        const alwaysNarrow = f.rel === POLICY_FILE || f.rel === PROFILE_FILE || f.rel === CONFIG_FILE || f.rel === CONTINUED_FILE || f.rel === CURSOR_FILE || f.rel === PINS_FILE || f.rel === NONCES_FILE;
+        if (!alwaysNarrow && trusted.get(resolve(file))?.has(hashNow ?? "absent"))
+            continue;
+        try {
+            if (f.rel === HUD_FILE) {
+                if (now) {
+                    rmSync(file, { force: true });
+                    out.push({ rel: f.rel, what: "removed", keys: [] });
+                }
+                continue;
+            }
+            try {
+                if (!statSync(file).isFile())
+                    rmSync(file, { recursive: true, force: true });
+            }
+            catch { }
+            const a = parse(f.bytes), b = parse(now);
+            if (f.rel === POLICY_FILE) {
+                if (!b) {
+                    if (f.bytes) {
+                        writeFileSync(file, f.bytes, { mode: 0o600 });
+                        out.push({ rel: f.rel, what: "reverted", keys: ["(the whole file)"] });
+                    }
+                    continue;
+                }
+                const n = narrowPolicy(a, b);
+                if (n.keys.length) {
+                    writeFileSync(file, JSON.stringify(n.policy, null, 2) + "\n", { mode: 0o600 });
+                    trustWrite(file);
+                    out.push({ rel: f.rel, what: "reverted", keys: n.keys });
+                }
+                continue;
+            }
+            const locked = (fn) => {
+                if (!(f.rel === PINS_FILE || f.rel === NONCES_FILE || f.rel === CONTINUED_FILE))
+                    return fn();
+                let ran = false;
+                try {
+                    withFileLock(file, () => { ran = true; fn(); });
+                }
+                catch (e) {
+                    if (ran)
+                        throw e;
+                    fn();
+                }
+            };
+            const put = (text) => { try {
+                writeWhole(file, text);
+            }
+            catch {
+                writeFileSync(file, text, { mode: 0o600 });
+            } };
+            if (f.rel === PINS_FILE || f.rel === NONCES_FILE) {
+                locked(() => {
+                    const cur = parse(read(file));
+                    const n = f.rel === PINS_FILE ? narrowPins(a, cur) : narrowNonces(a, cur);
+                    if (n.keys.length) {
+                        put(JSON.stringify(n.value, null, 2) + "\n");
+                        trustWrite(file);
+                        out.push({ rel: f.rel, what: "reverted", keys: n.keys });
+                    }
+                });
+                continue;
+            }
+            if (f.rel === CONTINUED_FILE || f.rel === CURSOR_FILE)
+                locked(() => {
+                    const before = obj(a), now = obj(parse(read(file)));
+                    const merged = { ...now };
+                    let lost = 0;
+                    for (const [k, v] of Object.entries(before)) {
+                        if (f.rel === CURSOR_FILE) {
+                            if (typeof v === "number" && !(typeof now[k] === "number" && now[k] >= v)) {
+                                merged[k] = v;
+                                lost++;
+                            }
+                        }
+                        else if (Array.isArray(v)) {
+                            const cur = Array.isArray(now[k]) ? now[k] : [];
+                            const back = v.filter((x) => !cur.includes(x));
+                            if (back.length) {
+                                merged[k] = [...back, ...cur];
+                                lost += back.length;
+                            }
+                        }
+                    }
+                    let sentDropped = 0;
+                    if (f.rel === CONTINUED_FILE)
+                        for (const [k, v] of Object.entries(merged)) {
+                            if (!k.endsWith(" sent") || !Array.isArray(v))
+                                continue;
+                            const was = Array.isArray(before[k]) ? before[k] : [];
+                            const kept = v.filter((x) => was.includes(x));
+                            if (kept.length !== v.length) {
+                                merged[k] = kept;
+                                sentDropped += v.length - kept.length;
+                            }
+                        }
+                    if (sentDropped && !lost) {
+                        put(JSON.stringify(merged) + "\n");
+                        trustWrite(file);
+                    }
+                    if (lost) {
+                        put(JSON.stringify(merged) + "\n");
+                        trustWrite(file);
+                        out.push({ rel: f.rel, what: "reverted", keys: [f.rel === CURSOR_FILE ? "read position moved back" : `${lost} handled request${lost === 1 ? "" : "s"} unmarked`] });
+                    }
+                });
+            if (f.rel === CONTINUED_FILE || f.rel === CURSOR_FILE)
+                continue;
+            if (f.rel === PROFILE_FILE) {
+                if (!b)
+                    continue;
+                const n = narrowProfile(a, b);
+                if (n.keys.length) {
+                    writeFileSync(file, JSON.stringify(n.profile, null, 2) + "\n", { mode: 0o600 });
+                    trustWrite(file);
+                    out.push({ rel: f.rel, what: "reverted", keys: n.keys });
+                }
+                continue;
+            }
+            if (a && b) {
+                const n = narrowConfig(a, b);
+                if (n.keys.length) {
+                    writeFileSync(file, JSON.stringify(n.config, null, 2) + "\n", { mode: 0o600 });
+                    trustWrite(file);
+                    out.push({ rel: f.rel, what: "reverted", keys: n.keys });
+                }
+                const rest = changedKeys(a, n.config).filter((k) => !/privateKey|token/i.test(k) && !/^spaces\.[^.]+\.repos\b/.test(k)).slice(0, 20);
+                if (rest.length)
+                    out.push({ rel: f.rel, what: "reported", keys: rest });
+            }
+            else if (a && !b && now) {
+                writeFileSync(file, f.bytes, { mode: 0o600 });
+                trustWrite(file);
+                out.push({ rel: f.rel, what: "reverted", keys: ["(the whole file)"] });
+            }
+            else
+                out.push({ rel: f.rel, what: "reported", keys: [] });
+        }
+        catch {
+            out.push({ rel: f.rel, what: "reported", keys: ["(could not be checked)"] });
+        }
+    }
+    return out;
+}
+export function describeChange(c) {
+    if (c.what === "removed")
+        return `${c.rel} was written while the run could write it — removed, not acted on`;
+    if (c.what === "reported")
+        return `${c.rel} changed while the run was going${c.keys.length ? ` (${c.keys.join(", ")})` : ""} — left as it is; if you did not change it, check it`;
+    return `${c.rel}: what was widened while the run was going was taken back (${c.keys.join(", ")}) — if you did that yourself, do it again`;
+}
+//# sourceMappingURL=home-guard.js.map

package/dist/hooks-install.js

@@ -3,6 +3,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { MAX_CONSECUTIVE_BLOCKS, isOurHookCommand } from "./notify.js";
 import { copilotHome, kiroHome } from "./agents.js";
+import { parseJsonText } from "./text-file.js";
 import { KIRO_AGENT_NAME, kiroAgentFile, kiroAgentDoc, readKiroAgent, writeKiroAgent, kiroDefaultIsPantheon, gitTracks } from "./kiro-files.js";
 function ours(cmd) {
     return isOurHookCommand(cmd);
@@ -11,7 +12,7 @@ function readJson(file) {
     if (!existsSync(file))
         return null;
     try {
-        return JSON.parse(readFileSync(file, "utf8"));
+        return parseJsonText(readFileSync(file, "utf8"));
     }
     catch {
         return null;

package/dist/identity.js

@@ -1,4 +1,4 @@
-import { generateKeyPairSync, sign, verify, createPublicKey, randomBytes } from "node:crypto";
+import { generateKeyPairSync, sign, verify, createPublicKey, randomBytes, createHash } from "node:crypto";
 export function newKeypair() {
     const { publicKey, privateKey } = generateKeyPairSync("ed25519");
     return {
@@ -64,8 +64,108 @@ export function verifyAccount(publicKeyB64, method, path, params, ts, signatureB
         return false;
     }
 }
+function readPayload(method, path, canonical) {
+    return Buffer.from(`pantheon-read/1\n${method}\n${path}\n${canonical}`, "utf8");
+}
+export function canonicalQuery(params) {
+    return Object.entries(params)
+        .filter(([k, v]) => v !== undefined && k !== "sig")
+        .map(([k, v]) => [encodeURIComponent(k), encodeURIComponent(String(v))])
+        .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))
+        .map(([k, v]) => `${k}=${v}`)
+        .join("&");
+}
+export function signRead(privateKeyB64, method, path, params) {
+    const key = { key: Buffer.from(privateKeyB64, "base64"), format: "der", type: "pkcs8" };
+    return sign(null, readPayload(method, path, canonicalQuery(params)), key).toString("base64");
+}
+export function verifyRead(publicKeyB64, method, path, params, signatureB64) {
+    try {
+        const key = createPublicKey({ key: Buffer.from(publicKeyB64, "base64"), format: "der", type: "spki" });
+        return verify(null, readPayload(method, path, canonicalQuery(params)), key, Buffer.from(signatureB64, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+export function canonicalKey(publicKeyB64) {
+    if (typeof publicKeyB64 !== "string" || publicKeyB64.length > 200)
+        return null;
+    try {
+        const raw = Buffer.from(publicKeyB64, "base64");
+        if (raw.length !== 44 || raw.toString("base64") !== publicKeyB64)
+            return null;
+        const k = createPublicKey({ key: raw, format: "der", type: "spki" });
+        if (k.asymmetricKeyType !== "ed25519")
+            return null;
+        const again = k.export({ type: "spki", format: "der" });
+        return again.equals(raw) ? publicKeyB64 : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function fingerprint(publicKeyB64) {
     const raw = Buffer.from(publicKeyB64, "base64").subarray(-16).toString("hex");
     return (raw.match(/.{4}/g) ?? []).join("-");
 }
+const sha256hex = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+export function canonicalJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v ?? null);
+    if (Array.isArray(v))
+        return `[${v.map(canonicalJson).join(",")}]`;
+    const o = v;
+    return `{${Object.keys(o).filter((k) => o[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+}
+export function newActId() { return `a_${Date.now().toString(36)}${randomBytes(9).toString("hex")}`; }
+export function actPayload(f) {
+    const list = (a, none) => (a && a.length ? [...a].sort().join(",") : none);
+    return Buffer.from([
+        "pantheon-act/1", f.id, f.team, f.member, f.keyRole, f.nonce, String(f.ts),
+        f.act, f.goal ?? "-", f.ref ?? "-", f.to === null ? "*" : list(f.to, "*"),
+        f.defers_to ?? "-", list(f.affects, "-"), f.repo ?? "-",
+        f.summary ? sha256hex(f.summary) : "-",
+        sha256hex(f.body),
+        sha256hex(canonicalJson(f.meta ?? {})),
+    ].join("\n"), "utf8");
+}
+export function goalPayload(f) {
+    return Buffer.from([
+        "pantheon-goal/1", f.id, f.team, f.member, f.keyRole, f.nonce, String(f.ts),
+        sha256hex(f.title), sha256hex(f.acceptance), f.invite === null ? "*" : [...new Set(f.invite)].sort().join(",") || "-",
+        f.budget == null ? "-" : String(f.budget), f.deadline == null ? "-" : String(f.deadline), f.kind ?? "-",
+    ].join("\n"), "utf8");
+}
+export function delegatePayload(team, member, subFp, run, expires) {
+    return Buffer.from(`pantheon-delegate/1\n${team}\n${member}\nrun\n${subFp}\n${run}\n${expires}`, "utf8");
+}
+function privKey(b64) { return { key: Buffer.from(b64, "base64"), format: "der", type: "pkcs8" }; }
+function pubKey(b64) { return createPublicKey({ key: Buffer.from(b64, "base64"), format: "der", type: "spki" }); }
+export function signBytes(privateKeyB64, payload) {
+    return sign(null, payload, privKey(privateKeyB64)).toString("base64");
+}
+export function verifyBytes(publicKeyB64, payload, signatureB64) {
+    try {
+        return verify(null, payload, pubKey(publicKeyB64), Buffer.from(signatureB64, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+export function signDelegate(memberPrivateKeyB64, team, member, subPub, run, expires) {
+    return { pub: subPub, run, expires, sig: signBytes(memberPrivateKeyB64, delegatePayload(team, member, fingerprint(subPub), run, expires)) };
+}
+export function verifyDelegate(memberPublicKeyB64, team, member, cert, at = Date.now(), skewMs = 10 * 60_000) {
+    if (!cert || typeof cert.pub !== "string" || typeof cert.sig !== "string" || typeof cert.run !== "string" || !Number.isFinite(cert.expires))
+        return false;
+    if (!canonicalKey(cert.pub) || !canonicalKey(memberPublicKeyB64))
+        return false;
+    if (at > cert.expires + skewMs)
+        return false;
+    return verifyBytes(memberPublicKeyB64, delegatePayload(team, member, fingerprint(cert.pub), cert.run, cert.expires), cert.sig);
+}
+export function newActNonce() {
+    return randomBytes(16).toString("base64url");
+}
 //# sourceMappingURL=identity.js.map