@naylence/advanced-security 0.3.7-test.114 → 0.3.7-test.116

package/dist/cjs/naylence/fame/security/register-advanced-security-factories.js

@@ -0,0 +1,286 @@
+import { Registry } from "@naylence/factory";
+import { MODULES, MODULE_LOADERS, } from "../factory-manifest.js";
+import { getEncryptionManagerFactoryRegistry } from "./encryption/encryption-manager-registry.js";
+const SECURITY_PREFIX = "./security/";
+const SECURITY_MODULES = MODULES.filter((spec) => spec.startsWith(SECURITY_PREFIX));
+const EXTRA_MODULES = MODULES.filter((spec) => !spec.startsWith(SECURITY_PREFIX));
+const NODE_ONLY_MODULES = new Set([
+    "./security/cert/default-ca-service-factory.js",
+    "./security/cert/trust-store/node-trust-store-provider-factory.js",
+]);
+const FACTORY_MODULE_PREFIX = "@naylence/advanced-security/naylence/fame/";
+const BROWSER_DIST_SEGMENT = "/dist/browser/";
+function detectModuleUrl() {
+    if (typeof __filename === "string") {
+        try {
+            return __filename.startsWith("file://")
+                ? __filename
+                : `file://${__filename}`;
+        }
+        catch {
+            // fall through to stack parsing
+        }
+    }
+    try {
+        throw new Error();
+    }
+    catch (error) {
+        const stack = typeof error === "object" && error && "stack" in error
+            ? String(error.stack ?? "")
+            : "";
+        const lines = stack.split("\n");
+        for (const line of lines) {
+            const match = line.match(/(https?:\/\/[^\s)]+|file:\/\/[^\s)]+\.(?:js|ts)|\/(?:[^\s)]+\.(?:js|ts)))/u);
+            const candidate = match?.[1];
+            if (!candidate) {
+                continue;
+            }
+            if (candidate.startsWith("http://") || candidate.startsWith("https://")) {
+                return candidate;
+            }
+            if (candidate.startsWith("file://")) {
+                return candidate;
+            }
+            return `file://${candidate}`;
+        }
+    }
+    return null;
+}
+function computeBrowserFactoryBase(rawUrl) {
+    if (!rawUrl) {
+        return null;
+    }
+    const sanitized = rawUrl.split("?")[0]?.split("#")[0] ?? rawUrl;
+    const esmMarker = "/dist/esm/naylence/fame/";
+    const distMarker = "/dist/";
+    if (sanitized.includes(esmMarker)) {
+        return sanitized.slice(0, sanitized.indexOf(esmMarker) + esmMarker.length);
+    }
+    if (rawUrl.includes(BROWSER_DIST_SEGMENT)) {
+        return new URL("../esm/naylence/fame/", rawUrl).href;
+    }
+    if (sanitized.includes(BROWSER_DIST_SEGMENT)) {
+        const base = sanitized.slice(0, sanitized.indexOf(BROWSER_DIST_SEGMENT) + BROWSER_DIST_SEGMENT.length);
+        return `${base.replace(/browser\/?$/u, "")}esm/naylence/fame/`;
+    }
+    if (sanitized.includes(distMarker)) {
+        const index = sanitized.indexOf(distMarker);
+        const base = sanitized.slice(0, index + distMarker.length);
+        return `${base}esm/naylence/fame/`;
+    }
+    const srcMarker = "/src/naylence/fame/";
+    if (sanitized.includes(srcMarker)) {
+        const index = sanitized.indexOf(srcMarker);
+        const projectRoot = sanitized.slice(0, index);
+        return `${projectRoot}/dist/esm/naylence/fame/`;
+    }
+    if (sanitized.startsWith("http://") || sanitized.startsWith("https://")) {
+        try {
+            const parsed = new URL(rawUrl);
+            const viteDepsSegment = "/node_modules/.vite/deps/";
+            if (parsed.pathname.includes(viteDepsSegment)) {
+                const baseOrigin = `${parsed.protocol}//${parsed.host}`;
+                return `${baseOrigin}/node_modules/@naylence/advanced-security/dist/esm/naylence/fame/`;
+            }
+        }
+        catch {
+            // ignore
+        }
+    }
+    return null;
+}
+const moduleUrl = detectModuleUrl();
+const browserFactoryBase = computeBrowserFactoryBase(moduleUrl);
+const prefersSource = typeof moduleUrl === "string" && moduleUrl.includes("/src/");
+function resolveFactoryModuleSpecifier(specifier) {
+    if (specifier.startsWith("../")) {
+        return `${FACTORY_MODULE_PREFIX}${specifier.slice("../".length)}`;
+    }
+    if (specifier.startsWith("./")) {
+        return `${FACTORY_MODULE_PREFIX}${specifier.slice("./".length)}`;
+    }
+    return null;
+}
+function resolveModuleCandidates(spec) {
+    const candidates = [];
+    const seen = new Set();
+    const addCandidate = (candidate) => {
+        if (!candidate) {
+            return;
+        }
+        if (!seen.has(candidate)) {
+            seen.add(candidate);
+            candidates.push(candidate);
+        }
+    };
+    if (prefersSource && spec.startsWith("./")) {
+        const sourceCandidate = `../${spec.slice(2)}`;
+        addCandidate(sourceCandidate);
+        if (sourceCandidate.endsWith(".js")) {
+            addCandidate(sourceCandidate.replace(/\.js$/u, ".ts"));
+        }
+    }
+    if (browserFactoryBase && spec.startsWith("./")) {
+        try {
+            const browserCandidate = new URL(spec.slice("./".length), browserFactoryBase).href;
+            addCandidate(browserCandidate);
+            if (browserCandidate.endsWith(".js")) {
+                addCandidate(browserCandidate.replace(/\.js$/u, ".ts"));
+            }
+        }
+        catch {
+            // ignore resolution failures for browser base
+        }
+    }
+    const packageCandidate = resolveFactoryModuleSpecifier(spec);
+    addCandidate(packageCandidate);
+    if (packageCandidate?.endsWith(".js")) {
+        addCandidate(packageCandidate.replace(/\.js$/u, ".ts"));
+    }
+    const fallback = spec.startsWith("./") ? `../${spec.slice(2)}` : spec;
+    addCandidate(fallback);
+    if (fallback.endsWith(".js")) {
+        addCandidate(fallback.replace(/\.js$/u, ".ts"));
+    }
+    addCandidate(spec);
+    if (spec.endsWith(".js")) {
+        addCandidate(spec.replace(/\.js$/u, ".ts"));
+    }
+    return candidates;
+}
+const registeredModules = new Set();
+const inflightModules = new Map();
+const browserSkippedModules = new Set();
+function isNodeEnvironment() {
+    return (typeof process !== "undefined" &&
+        typeof process.release !== "undefined" &&
+        process.release?.name === "node");
+}
+function shouldSkipModule(spec) {
+    if (isNodeEnvironment()) {
+        return false;
+    }
+    if (!NODE_ONLY_MODULES.has(spec)) {
+        return false;
+    }
+    if (!browserSkippedModules.has(spec)) {
+        // console.warn(
+        //   "[advanced-security:factory-manifest] skipped browser-incompatible module",
+        //   spec,
+        // );
+        browserSkippedModules.add(spec);
+    }
+    return true;
+}
+function getDynamicImporter() {
+    if (typeof globalThis === "undefined") {
+        return null;
+    }
+    const candidate = globalThis.__naylenceFactoryDynamicImporter;
+    if (typeof candidate === "function") {
+        return candidate;
+    }
+    return null;
+}
+async function registerModule(spec, registrar) {
+    const candidates = resolveModuleCandidates(spec);
+    const dynamicImporter = getDynamicImporter();
+    const loader = dynamicImporter
+        ? (specifier) => dynamicImporter(specifier)
+        : (specifier) => import(/* @vite-ignore */ specifier);
+    const attempts = [];
+    const staticLoader = MODULE_LOADERS?.[spec];
+    if (staticLoader) {
+        attempts.push({ load: () => staticLoader(), candidate: spec });
+    }
+    for (const candidate of candidates) {
+        attempts.push({ load: () => loader(candidate), candidate });
+    }
+    const registerFromModule = (mod) => {
+        const meta = mod.FACTORY_META;
+        const Ctor = mod.default;
+        if (!meta?.base || !meta?.key || typeof Ctor !== "function") {
+            console.warn("[debug] invalid factory module", spec, {
+                meta,
+                hasCtor: typeof Ctor === "function",
+            });
+            console.warn("[advanced-security:factory-manifest] skipped", spec, "— missing FACTORY_META or default export ctor");
+            return false;
+        }
+        const { base, key, ...metadata } = meta;
+        const extraMetadata = Object.keys(metadata).length > 0 ? metadata : undefined;
+        // console.log("[debug] registering module", { spec, base, key, metadata: extraMetadata });
+        registrar.registerFactory(base, key, Ctor, extraMetadata);
+        return true;
+    };
+    for (const [index, { candidate, load }] of attempts.entries()) {
+        try {
+            const mod = await load();
+            return registerFromModule(mod);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const moduleNotFound = message.includes("Cannot find module") ||
+                message.includes("ERR_MODULE_NOT_FOUND") ||
+                message.includes("Unknown file extension") ||
+                message.includes("Failed to fetch dynamically imported module") ||
+                message.includes("Failed to resolve module specifier") ||
+                message.includes("Importing a module script failed");
+            const isLastAttempt = index === attempts.length - 1;
+            if (!moduleNotFound || isLastAttempt) {
+                console.warn("[debug] failed to import candidate", {
+                    spec,
+                    candidate,
+                    message,
+                });
+                console.warn("[advanced-security:factory-manifest] skipped", spec, "-", message);
+                return false;
+            }
+        }
+    }
+    return false;
+}
+async function registerModuleOnce(spec, registrar) {
+    if (registeredModules.has(spec)) {
+        return false;
+    }
+    const inflight = inflightModules.get(spec);
+    if (inflight) {
+        return inflight;
+    }
+    const registration = (async () => {
+        const registered = await registerModule(spec, registrar);
+        if (registered) {
+            registeredModules.add(spec);
+        }
+        return registered;
+    })();
+    inflightModules.set(spec, registration);
+    try {
+        return await registration;
+    }
+    finally {
+        inflightModules.delete(spec);
+    }
+}
+async function registerModules(modules, registrar) {
+    if (modules.length === 0) {
+        return 0;
+    }
+    const eligibleModules = modules.filter((spec) => !shouldSkipModule(spec));
+    if (eligibleModules.length === 0) {
+        return 0;
+    }
+    const results = await Promise.all(eligibleModules.map((spec) => registerModuleOnce(spec, registrar)));
+    return results.reduce((count, registered) => (registered ? count + 1 : count), 0);
+}
+export async function registerAdvancedSecurityFactories(registrar = Registry, options) {
+    const newlyRegisteredSecurity = await registerModules(SECURITY_MODULES, registrar);
+    if (newlyRegisteredSecurity > 0) {
+        getEncryptionManagerFactoryRegistry().forceRediscovery();
+    }
+    if (options?.includeExtras === true) {
+        await registerModules(EXTRA_MODULES, registrar);
+    }
+}
+//# sourceMappingURL=register-advanced-security-factories.js.map

package/dist/cjs/naylence/fame/security/register-advanced-security-factories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-advanced-security-factories.js","sourceRoot":"","sources":["../../../../../src/naylence/fame/security/register-advanced-security-factories.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EACL,OAAO,EACP,cAAc,GAGf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mCAAmC,EAAE,MAAM,6CAA6C,CAAC;AAgBlG,MAAM,eAAe,GAAG,aAAsB,CAAC;AAC/C,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CACjC,CAAC;AACF,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAC5C,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAoB;IACnD,+CAA+C;IAC/C,kEAAkE;CACnE,CAAC,CAAC;AAEH,MAAM,qBAAqB,GACzB,4CAAqD,CAAC;AACxD,MAAM,oBAAoB,GAAG,gBAAyB,CAAC;AAEvD,SAAS,eAAe;IACtB,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;gBACrC,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,UAAU,UAAU,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,KAAK,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK;YACpD,CAAC,CAAC,MAAM,CAAE,KAAe,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,4EAA4E,CAC7E,CAAC;YACF,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,UAAU,SAAS,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAqB;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAChE,MAAM,SAAS,GAAG,0BAA0B,CAAC;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC;IAE5B,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAC1B,CAAC,EACD,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,oBAAoB,CAAC,MAAM,CACtE,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,oBAAoB,CAAC;IACjE,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,GAAG,IAAI,oBAAoB,CAAC;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC;IACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,GAAG,WAAW,0BAA0B,CAAC;IAClD,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,eAAe,GAAG,2BAA2B,CAAC;YACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9C,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBACxD,OAAO,GAAG,UAAU,mEAAmE,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;AACpC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;AAChE,MAAM,aAAa,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAEnF,SAAS,6BAA6B,CAAC,SAAiB;IACtD,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAuB;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,YAAY,GAAG,CAAC,SAAwB,EAAQ,EAAE;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,YAAY,CAAC,eAAe,CAAC,CAAC;QAC9B,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EACvB,kBAAkB,CACnB,CAAC,IAAI,CAAC;YACP,YAAY,CAAC,gBAAgB,CAAC,CAAC;YAC/B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAC7D,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC/B,IAAI,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAqB,CAAC;AACvD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuC,CAAC;AACvE,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAqB,CAAC;AAE3D,SAAS,iBAAiB;IACxB,OAAO,CACL,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,OAAO,CAAC,OAAO,KAAK,WAAW;QACtC,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,gBAAgB;QAChB,gFAAgF;QAChF,UAAU;QACV,KAAK;QACL,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAS,kBAAkB;IACzB,IAAI,OAAO,UAAU,KAAK,WAAW,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAI,UAEjB,CAAC,gCAAgC,CAAC;IAEpC,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,SAA4B,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAuB,EACvB,SAA2B;IAE3B,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,eAAe;QAC5B,CAAC,CAAC,CAAC,SAAiB,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,CAAC,SAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAGT,EAAE,CAAC;IAER,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC,IAAI,CAE7B,CAAC;IACd,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAW,EAAE;QACnD,MAAM,IAAI,GAAI,GAA+B,CAAC,YAEjC,CAAC;QACd,MAAM,IAAI,GAAI,GAA+B,CAAC,OAEjC,CAAC;QAEd,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE,IAAI,EAAE;gBACnD,IAAI;gBACJ,OAAO,EAAE,OAAO,IAAI,KAAK,UAAU;aACpC,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CACV,8CAA8C,EAC9C,IAAI,EACJ,+CAA+C,CAChD,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,aAAa,GACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1D,2FAA2F;QAC3F,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,cAAc,GAClB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBACtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBACxC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;gBAC1C,OAAO,CAAC,QAAQ,CAAC,6CAA6C,CAAC;gBAC/D,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC;gBACtD,OAAO,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;YAEvD,MAAM,aAAa,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE;oBACjD,IAAI;oBACJ,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CACV,8CAA8C,EAC9C,IAAI,EACJ,GAAG,EACH,OAAO,CACR,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAuB,EACvB,SAA2B;IAE3B,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;QAC/B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YACf,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,EAAE,CAAC;IAEL,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAqC,EACrC,SAA2B;IAE3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CACnE,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EACvD,CAAC,CACF,CAAC;AACJ,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,YAA8B,QAAQ,EACtC,OAAkD;IAElD,MAAM,uBAAuB,GAAG,MAAM,eAAe,CACnD,gBAAgB,EAChB,SAAS,CACV,CAAC;IAEF,IAAI,uBAAuB,GAAG,CAAC,EAAE,CAAC;QAChC,mCAAmC,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,OAAO,EAAE,aAAa,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/cjs/naylence/fame/security/signing/eddsa-envelope-signer-factory.js

@@ -0,0 +1,34 @@
+import { ENVELOPE_SIGNER_FACTORY_BASE_TYPE, EnvelopeSignerFactory, } from "@naylence/runtime";
+export const FACTORY_META = {
+    base: ENVELOPE_SIGNER_FACTORY_BASE_TYPE,
+    key: "EdDSAEnvelopeSigner",
+    isDefault: true,
+    priority: 100,
+};
+let eddsaEnvelopeSignerModulePromise = null;
+async function getEdDSAEnvelopeSignerModule() {
+    if (!eddsaEnvelopeSignerModulePromise) {
+        eddsaEnvelopeSignerModulePromise = import("@naylence/runtime/naylence/fame/security/signing/eddsa-envelope-signer.js");
+    }
+    return eddsaEnvelopeSignerModulePromise;
+}
+export class AdvancedEdDSAEnvelopeSignerFactory extends EnvelopeSignerFactory {
+    constructor() {
+        super(...arguments);
+        this.type = "EdDSAEnvelopeSigner";
+        this.isDefault = true;
+        this.priority = 100;
+    }
+    async create(_config, options) {
+        const resolved = {
+            cryptoProvider: options?.cryptoProvider ?? null,
+            signingConfig: options?.signingConfig ?? null,
+            privateKeyPem: options?.privateKeyPem,
+            keyId: options?.keyId,
+        };
+        const { EdDSAEnvelopeSigner } = await getEdDSAEnvelopeSignerModule();
+        return new EdDSAEnvelopeSigner(resolved);
+    }
+}
+export default AdvancedEdDSAEnvelopeSignerFactory;
+//# sourceMappingURL=eddsa-envelope-signer-factory.js.map

package/dist/cjs/naylence/fame/security/signing/eddsa-envelope-signer-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eddsa-envelope-signer-factory.js","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/signing/eddsa-envelope-signer-factory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iCAAiC,EACjC,qBAAqB,GAEtB,MAAM,mBAAmB,CAAC;AAQ3B,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,iCAAiC;IACvC,GAAG,EAAE,qBAAqB;IAC1B,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,GAAG;CACL,CAAC;AAKX,IAAI,gCAAgC,GAClC,IAAI,CAAC;AAEP,KAAK,UAAU,4BAA4B;IACzC,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACtC,gCAAgC,GAAG,MAAM,CACvC,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,kCAAmC,SAAQ,qBAAgD;IAAxG;;QACkB,SAAI,GAAG,qBAAqB,CAAC;QAC7B,cAAS,GAAG,IAAI,CAAC;QACjB,aAAQ,GAAG,GAAG,CAAC;IAiBjC,CAAC;IAfQ,KAAK,CAAC,MAAM,CACjB,OAAoE,EACpE,OAA2C;QAE3C,MAAM,QAAQ,GAA+B;YAC3C,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,IAAI;YAC/C,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,IAAI;YAC7C,aAAa,EAAE,OAAO,EAAE,aAAa;YACrC,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC;QAEF,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,4BAA4B,EAAE,CAAC;QAErE,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,eAAe,kCAAkC,CAAC"}

package/dist/cjs/naylence/fame/security/signing/eddsa-envelope-verifier-factory.js

@@ -0,0 +1,33 @@
+import { ENVELOPE_VERIFIER_FACTORY_BASE_TYPE, EnvelopeVerifierFactory, SigningConfigClass, } from "@naylence/runtime";
+import { EdDSAEnvelopeVerifier, } from "./eddsa-envelope-verifier.js";
+import { TrustStoreProviderFactory } from "../cert/trust-store/trust-store-provider-factory.js";
+export const FACTORY_META = {
+    base: ENVELOPE_VERIFIER_FACTORY_BASE_TYPE,
+    key: "EdDSAEnvelopeVerifier",
+    isDefault: true,
+    priority: 100,
+};
+export class AdvancedEdDSAEnvelopeVerifierFactory extends EnvelopeVerifierFactory {
+    constructor() {
+        super(...arguments);
+        this.type = "EdDSAEnvelopeVerifier";
+        this.isDefault = true;
+        this.priority = 100;
+    }
+    async create(_config, keyProvider, signingConfig, options = {}) {
+        if (!keyProvider) {
+            throw new Error("EdDSAEnvelopeVerifierFactory requires a key provider");
+        }
+        let trustStoreProvider = options.trustStoreProvider ?? null;
+        if (!trustStoreProvider) {
+            trustStoreProvider = await TrustStoreProviderFactory.createTrustStoreProvider();
+        }
+        const resolved = {
+            signingConfig: options.signingConfig ?? signingConfig ?? new SigningConfigClass(),
+            trustStoreProvider,
+        };
+        return new EdDSAEnvelopeVerifier(keyProvider, resolved);
+    }
+}
+export default AdvancedEdDSAEnvelopeVerifierFactory;
+//# sourceMappingURL=eddsa-envelope-verifier-factory.js.map

package/dist/cjs/naylence/fame/security/signing/eddsa-envelope-verifier-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eddsa-envelope-verifier-factory.js","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/signing/eddsa-envelope-verifier-factory.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mCAAmC,EACnC,uBAAuB,EACvB,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,GAGtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAMhG,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,mCAAmC;IACzC,GAAG,EAAE,uBAAuB;IAC5B,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,GAAG;CACL,CAAC;AAIX,MAAM,OAAO,oCAAqC,SAAQ,uBAAoD;IAA9G;;QACkB,SAAI,GAAG,uBAAuB,CAAC;QAC/B,cAAS,GAAG,IAAI,CAAC;QACjB,aAAQ,GAAG,GAAG,CAAC;IAyBjC,CAAC;IAvBQ,KAAK,CAAC,MAAM,CACjB,OAAsE,EACtE,WAAgC,EAChC,aAAoC,EACpC,UAAwC,EAAE;QAE1C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,wBAAwB,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,QAAQ,GAAiC;YAC7C,aAAa,EACX,OAAO,CAAC,aAAa,IAAI,aAAa,IAAI,IAAI,kBAAkB,EAAE;YACpE,kBAAkB;SACnB,CAAC;QAEF,OAAO,IAAI,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,eAAe,oCAAoC,CAAC"}

package/dist/cjs/naylence/fame/security/signing/eddsa-envelope-verifier.js

@@ -0,0 +1,189 @@
+import { etc as edEtc, verify } from "@noble/ed25519";
+import { sha512 } from "@noble/hashes/sha2.js";
+import { SigningMaterial } from "@naylence/core";
+import { SigningConfigClass, secureDigest, } from "@naylence/runtime";
+import { canonicalJson, decodeBase64Url, frameDigest, immutableHeaders, } from "@naylence/runtime/naylence/fame/security/signing/eddsa-signer-verifier.js";
+import { encodeUtf8 } from "@naylence/runtime/naylence/fame/security/signing/eddsa-utils.js";
+import { JWKValidationError, validateSigningKey } from "@naylence/runtime";
+import { publicKeyFromX5c } from "../cert/util.js";
+function assertString(value, field) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`${field} must be a non-empty string`);
+    }
+    return value;
+}
+function isDataFrame(frame) {
+    return frame.type === "Data";
+}
+function encodeBase64Url(value) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(value)
+            .toString("base64")
+            .replace(/\+/gu, "-")
+            .replace(/\//gu, "_")
+            .replace(/=+$/u, "");
+    }
+    let binary = "";
+    for (const byte of value) {
+        binary += String.fromCharCode(byte);
+    }
+    if (typeof btoa === "function") {
+        return btoa(binary)
+            .replace(/\+/gu, "-")
+            .replace(/\//gu, "_")
+            .replace(/=+$/u, "");
+    }
+    throw new Error("No base64 encoder available in this environment");
+}
+function ensureNobleSha512Fallback() {
+    const etcPatch = edEtc;
+    if (!etcPatch.sha512) {
+        etcPatch.sha512 = (message) => sha512(message);
+    }
+    if (!etcPatch.sha512Sync) {
+        etcPatch.sha512Sync = (...messages) => {
+            if (messages.length === 1) {
+                return sha512(messages[0]);
+            }
+            const combined = edEtc.concatBytes(...messages);
+            return sha512(combined);
+        };
+    }
+}
+function normalizeCertificateKey(jwk, signingConfig, trustStorePem) {
+    if (!Array.isArray(jwk.x5c) || jwk.x5c.length === 0) {
+        return null;
+    }
+    if (signingConfig.signingMaterial !== SigningMaterial.X509_CHAIN) {
+        throw new Error("Certificate keys are disabled by signing policy");
+    }
+    if (!trustStorePem) {
+        throw new Error("Certificate-based verification requires a configured trust store provider (for example, configure FAME_CA_CERTS).");
+    }
+    const publicKey = publicKeyFromX5c(jwk.x5c, {
+        enforceNameConstraints: signingConfig.validateCertNameConstraints,
+        trustStorePem,
+    });
+    if (publicKey.length !== 32) {
+        throw new Error("Certificate public key must be 32 bytes for Ed25519");
+    }
+    return encodeBase64Url(publicKey);
+}
+export class EdDSAEnvelopeVerifier {
+    constructor(keyProvider, options = {}) {
+        this.keyProvider = keyProvider;
+        this.signingConfig = options.signingConfig ?? new SigningConfigClass();
+        this.trustStoreProvider = options.trustStoreProvider ?? null;
+        ensureNobleSha512Fallback();
+    }
+    async loadTrustStorePem() {
+        if (!this.trustStoreProvider) {
+            return null;
+        }
+        if (typeof this.trustStoreProvider.initialize === "function") {
+            await this.trustStoreProvider.initialize();
+        }
+        const pem = await this.trustStoreProvider.getTrustStorePem();
+        const normalized = pem.replace(/\r/gu, "").trim();
+        return normalized.length > 0 ? normalized : null;
+    }
+    async resolveVerificationKey(kid, jwk) {
+        const trustStorePem = await this.loadTrustStorePem();
+        const certificateKey = normalizeCertificateKey(jwk, this.signingConfig, trustStorePem);
+        const candidate = certificateKey ??
+            (typeof jwk.x === "string"
+                ? jwk.x
+                : typeof jwk.crv_x === "string"
+                    ? jwk.crv_x
+                    : jwk.pub);
+        if (typeof candidate !== "string") {
+            throw new Error("JWK missing public key material");
+        }
+        const normalizedJwk = { ...jwk };
+        if (certificateKey || typeof normalizedJwk.x !== "string") {
+            normalizedJwk.x = certificateKey ?? candidate;
+        }
+        try {
+            validateSigningKey(normalizedJwk);
+        }
+        catch (error) {
+            if (error instanceof JWKValidationError) {
+                throw new Error(`Key ${kid} is not valid for signing: ${error.message}`);
+            }
+            throw error;
+        }
+        const publicKey = decodeBase64Url(candidate);
+        return { normalizedJwk, publicKey };
+    }
+    async verifyEnvelope(envelope, options = {}) {
+        const signatureHeader = envelope.sec?.sig;
+        if (!signatureHeader) {
+            throw new Error("Missing envelope.sec.sig header");
+        }
+        const kid = assertString(signatureHeader.kid, "Signature header missing 'kid'");
+        const signatureValue = assertString(signatureHeader.val, "Signature header missing 'val'");
+        const jwk = (await this.keyProvider.getKey(kid));
+        if (!jwk) {
+            throw new Error(`Unknown key id: ${kid}`);
+        }
+        const { normalizedJwk, publicKey } = await this.resolveVerificationKey(kid, jwk);
+        const checkPayload = options.checkPayload ?? true;
+        let trustedDigest;
+        if (isDataFrame(envelope.frame)) {
+            if (checkPayload) {
+                if (!envelope.frame.pd) {
+                    throw new Error("DataFrame missing payload digest (pd field)");
+                }
+                const payload = envelope.frame.payload ?? "";
+                const payloadString = payload === "" ? "" : canonicalJson(payload);
+                const actualDigest = secureDigest(payloadString);
+                if (actualDigest !== envelope.frame.pd) {
+                    throw new Error("Payload digest mismatch in DataFrame");
+                }
+                trustedDigest = actualDigest;
+            }
+            else {
+                if (!envelope.frame.pd) {
+                    throw new Error("DataFrame missing payload digest (pd field) for intermediate verification");
+                }
+                trustedDigest = envelope.frame.pd;
+            }
+        }
+        else {
+            trustedDigest = frameDigest(envelope.frame);
+        }
+        const sid = assertString(normalizedJwk.sid, "Signing key missing sid");
+        const immutable = canonicalJson(immutableHeaders(envelope));
+        const tbs = new Uint8Array(encodeUtf8(sid).length +
+            1 +
+            encodeUtf8(immutable).length +
+            1 +
+            encodeUtf8(trustedDigest).length);
+        const sidBytes = encodeUtf8(sid);
+        const immBytes = encodeUtf8(immutable);
+        const digestBytes = encodeUtf8(trustedDigest);
+        let offset = 0;
+        tbs.set(sidBytes, offset);
+        offset += sidBytes.length;
+        tbs[offset] = 0x1f;
+        offset += 1;
+        tbs.set(immBytes, offset);
+        offset += immBytes.length;
+        tbs[offset] = 0x1f;
+        offset += 1;
+        tbs.set(digestBytes, offset);
+        const signatureBytes = decodeBase64Url(signatureValue);
+        if (signatureBytes.length !== 64) {
+            throw new Error("Signature must be 64 bytes for Ed25519");
+        }
+        if (publicKey.length !== 32) {
+            throw new Error("Ed25519 public key must be 32 bytes");
+        }
+        const valid = await verify(signatureBytes, tbs, publicKey);
+        if (!valid) {
+            throw new Error("Envelope signature verification failed");
+        }
+        return true;
+    }
+}
+//# sourceMappingURL=eddsa-envelope-verifier.js.map

package/dist/cjs/naylence/fame/security/signing/eddsa-envelope-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eddsa-envelope-verifier.js","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/signing/eddsa-envelope-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,IAAI,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,kBAAkB,EAClB,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,2EAA2E,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,iEAAiE,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAcnD,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAA4B;IAC/C,OAAQ,KAA2B,CAAC,IAAI,KAAK,MAAM,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aACtB,QAAQ,CAAC,QAAQ,CAAC;aAClB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC;aAChB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,QAAQ,GAAG,KAGhB,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,QAAQ,CAAC,MAAM,GAAG,CAAC,OAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,QAAQ,CAAC,UAAU,GAAG,CAAC,GAAG,QAAsB,EAAc,EAAE;YAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;YAC9B,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAgB,EAChB,aAA4B,EAC5B,aAA4B;IAE5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,aAAa,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAe,EAAE;QACtD,sBAAsB,EAAE,aAAa,CAAC,2BAA2B;QACjE,aAAa;KACd,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAOD,MAAM,OAAO,qBAAqB;IAMhC,YACE,WAAwB,EACxB,UAAwC,EAAE;QAE1C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACvE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAC7D,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,GAAW,EACX,GAAgB;QAEhB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,cAAc,GAAG,uBAAuB,CAC5C,GAAG,EACH,IAAI,CAAC,aAAa,EAClB,aAAa,CACd,CAAC;QAEF,MAAM,SAAS,GACb,cAAc;YACd,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;gBACxB,CAAC,CAAC,GAAG,CAAC,CAAC;gBACP,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;oBAC7B,CAAC,CAAC,GAAG,CAAC,KAAK;oBACX,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjB,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,aAAa,GAAgB,EAAE,GAAG,GAAG,EAAE,CAAC;QAC9C,IAAI,cAAc,IAAI,OAAO,aAAa,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1D,aAAa,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,OAAO,GAAG,8BAA8B,KAAK,CAAC,OAAO,EAAE,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,QAAsB,EACtB,UAAwD,EAAE;QAE1D,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;QAC1C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CACtB,eAAe,CAAC,GAAG,EACnB,gCAAgC,CACjC,CAAC;QACF,MAAM,cAAc,GAAG,YAAY,CACjC,eAAe,CAAC,GAAG,EACnB,gCAAgC,CACjC,CAAC;QAEF,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAuB,CAAC;QACvE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACpE,GAAG,EACH,GAAG,CACJ,CAAC;QAEF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QAElD,IAAI,aAAqB,CAAC;QAC1B,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC7C,MAAM,aAAa,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACnE,MAAM,YAAY,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;gBACjD,IAAI,YAAY,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAC1D,CAAC;gBACD,aAAa,GAAG,YAAY,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;gBACJ,CAAC;gBACD,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAEH,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CACxB,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM;YACpB,CAAC;YACD,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM;YAC5B,CAAC;YACD,UAAU,CAAC,aAAa,CAAC,CAAC,MAAM,CACnC,CAAC;QAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC;QAEZ,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC;QAEZ,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE7B,MAAM,cAAc,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/cjs/naylence/fame/stickiness/aft-helper.js

@@ -0,0 +1,72 @@
+import { getLogger } from "@naylence/runtime";
+import { createAftSigner } from "./aft-signer.js";
+import { StickinessMode } from "./stickiness-mode.js";
+const logger = getLogger("naylence.fame.stickiness.aft_helper");
+export class AFTHelper {
+    constructor(options) {
+        this.signer = options.signer;
+        this.nodeSid = options.nodeSid;
+        this.maxTtlSec = options.maxTtlSec;
+    }
+    async requestStickiness(envelope, options = {}) {
+        const ttlSec = options.ttlSec ?? this.maxTtlSec;
+        const scope = options.scope ?? null;
+        const context = options.context ?? null;
+        let clientSid;
+        if (context?.stickySid) {
+            clientSid = context.stickySid;
+            logger.debug("client_sticky_sid_extracted", { client_sid: clientSid });
+        }
+        const signOptions = {
+            sid: this.nodeSid,
+            ttlSec,
+            scope,
+            clientSid: clientSid ?? null,
+        };
+        try {
+            const aftToken = await this.signer.signAft(signOptions);
+            if (!aftToken) {
+                return false;
+            }
+            if (!envelope.meta) {
+                envelope.meta = {};
+            }
+            let setMeta = envelope.meta.set;
+            if (!setMeta || typeof setMeta !== "object") {
+                setMeta = {};
+                envelope.meta.set = setMeta;
+            }
+            setMeta.aft = aftToken;
+            logger.debug("aft_instruction_added", {
+                envelope_id: envelope.id,
+                ttl_sec: ttlSec,
+                scope,
+                security_level: this.signer.securityLevel,
+            });
+            return true;
+        }
+        catch (error) {
+            logger.error("aft_generation_failed", {
+                envelope_id: envelope.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        }
+    }
+    requestNodeStickiness(envelope, options = {}) {
+        return this.requestStickiness(envelope, { ...options, scope: "node" });
+    }
+    requestFlowStickiness(envelope, options = {}) {
+        return this.requestStickiness(envelope, { ...options, scope: "flow" });
+    }
+    requestSessionStickiness(envelope, options = {}) {
+        return this.requestStickiness(envelope, { ...options, scope: "sess" });
+    }
+}
+export function createAftHelper(options) {
+    const { nodeSid, maxTtlSec = 7200 } = options;
+    const signer = createAftSigner(options);
+    return new AFTHelper({ signer, nodeSid, maxTtlSec });
+}
+export const DEFAULT_STICKINESS_SECURITY_LEVEL = StickinessMode.SIGNED_OPTIONAL;
+//# sourceMappingURL=aft-helper.js.map