@playcraft/common 0.0.3 → 0.0.6

package/dist/auth/index.d.ts

@@ -1,4 +1,5 @@
 export * from './types.js';
 export * from './jwt.js';
 export * from './local-dev.js';
+export * from './signature.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC"}

package/dist/auth/index.js

@@ -1,4 +1,5 @@
 export * from './types.js';
 export * from './jwt.js';
 export * from './local-dev.js';
+export * from './signature.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC"}

package/dist/auth/signature.d.ts

@@ -0,0 +1,82 @@
+/**
+ * 签名验证结果
+ */
+export interface SignatureVerificationResult {
+    valid: boolean;
+    error?: string;
+}
+/**
+ * 签名生成选项
+ */
+export interface SignatureOptions {
+    method: string;
+    path: string;
+    timestamp: number;
+    secret: string;
+}
+/**
+ * 时间戳有效期（毫秒）
+ * 默认 5 分钟，容忍一定的时钟偏差
+ */
+export declare const SIGNATURE_VALIDITY_MS: number;
+/**
+ * 生成内部 API 签名
+ *
+ * 使用 HMAC-SHA256 算法生成签名，格式：
+ * HMAC-SHA256(method:path:timestamp, secret)
+ *
+ * @param method HTTP 方法（GET/POST/DELETE 等）
+ * @param path 请求路径（不含 query string）
+ * @param timestamp Unix 时间戳（毫秒）
+ * @param secret 共享密钥
+ * @returns 十六进制签名字符串
+ *
+ * @example
+ * const signature = generateInternalSignature('GET', '/api/assets/internal/123', Date.now(), 'secret');
+ */
+export declare function generateInternalSignature(method: string, path: string, timestamp: number, secret: string): string;
+/**
+ * 验证内部 API 签名
+ *
+ * @param method HTTP 方法
+ * @param path 请求路径
+ * @param timestamp 请求时间戳
+ * @param signature 提供的签名
+ * @param secret 共享密钥
+ * @returns 验证结果
+ *
+ * @example
+ * const result = verifyInternalSignature('GET', '/api/assets/internal/123', 1738645200000, 'abc123...', 'secret');
+ * if (result.valid) {
+ *   // 签名有效
+ * } else {
+ *   console.error(result.error);
+ * }
+ */
+export declare function verifyInternalSignature(method: string, path: string, timestamp: number, signature: string, secret: string): SignatureVerificationResult;
+/**
+ * 常量时间字符串比较
+ *
+ * 防止时序攻击（timing attack）
+ * 无论字符串是否匹配，都会比较所有字符
+ *
+ * @param a 字符串 A
+ * @param b 字符串 B
+ * @returns 是否相等
+ */
+export declare function timingSafeEqual(a: string, b: string): boolean;
+/**
+ * 生成带签名的请求头
+ *
+ * @param method HTTP 方法
+ * @param path 请求路径
+ * @param secret 共享密钥
+ * @param serviceName 服务名称（realtime/messenger/cli）
+ * @returns 包含签名的 headers 对象
+ *
+ * @example
+ * const headers = generateSignedHeaders('GET', '/api/assets/internal/123', 'secret', 'realtime');
+ * fetch(url, { headers });
+ */
+export declare function generateSignedHeaders(method: string, path: string, secret: string, serviceName: string): Record<string, string>;
+//# sourceMappingURL=signature.d.ts.map

package/dist/auth/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/auth/signature.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAgB,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,MAAM,CAeR;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,2BAA2B,CA2D7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAmB7D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB"}

package/dist/auth/signature.js

@@ -0,0 +1,154 @@
+import * as crypto from 'crypto';
+/**
+ * 时间戳有效期（毫秒）
+ * 默认 5 分钟，容忍一定的时钟偏差
+ */
+export const SIGNATURE_VALIDITY_MS = 5 * 60 * 1000;
+/**
+ * 生成内部 API 签名
+ *
+ * 使用 HMAC-SHA256 算法生成签名，格式：
+ * HMAC-SHA256(method:path:timestamp, secret)
+ *
+ * @param method HTTP 方法（GET/POST/DELETE 等）
+ * @param path 请求路径（不含 query string）
+ * @param timestamp Unix 时间戳（毫秒）
+ * @param secret 共享密钥
+ * @returns 十六进制签名字符串
+ *
+ * @example
+ * const signature = generateInternalSignature('GET', '/api/assets/internal/123', Date.now(), 'secret');
+ */
+export function generateInternalSignature(method, path, timestamp, secret) {
+    if (!method || !path || !timestamp || !secret) {
+        throw new Error('Missing required parameters for signature generation');
+    }
+    // 构造签名消息：method:path:timestamp
+    const message = `${method.toUpperCase()}:${path}:${timestamp}`;
+    // 使用 HMAC-SHA256 生成签名
+    const signature = crypto
+        .createHmac('sha256', secret)
+        .update(message)
+        .digest('hex');
+    return signature;
+}
+/**
+ * 验证内部 API 签名
+ *
+ * @param method HTTP 方法
+ * @param path 请求路径
+ * @param timestamp 请求时间戳
+ * @param signature 提供的签名
+ * @param secret 共享密钥
+ * @returns 验证结果
+ *
+ * @example
+ * const result = verifyInternalSignature('GET', '/api/assets/internal/123', 1738645200000, 'abc123...', 'secret');
+ * if (result.valid) {
+ *   // 签名有效
+ * } else {
+ *   console.error(result.error);
+ * }
+ */
+export function verifyInternalSignature(method, path, timestamp, signature, secret) {
+    // 参数验证
+    if (!method || !path || !timestamp || !signature || !secret) {
+        return {
+            valid: false,
+            error: 'Missing required parameters for signature verification'
+        };
+    }
+    // 验证时间戳类型
+    if (typeof timestamp !== 'number' || isNaN(timestamp)) {
+        return {
+            valid: false,
+            error: 'Invalid timestamp format'
+        };
+    }
+    // 验证时间戳有效期（防重放攻击）
+    const now = Date.now();
+    const age = now - timestamp;
+    if (age < 0) {
+        return {
+            valid: false,
+            error: 'Timestamp is in the future'
+        };
+    }
+    if (age > SIGNATURE_VALIDITY_MS) {
+        return {
+            valid: false,
+            error: `Request expired (age: ${Math.floor(age / 1000)}s, max: ${SIGNATURE_VALIDITY_MS / 1000}s)`
+        };
+    }
+    // 重新计算签名
+    let expectedSignature;
+    try {
+        expectedSignature = generateInternalSignature(method, path, timestamp, secret);
+    }
+    catch (error) {
+        return {
+            valid: false,
+            error: `Signature calculation failed: ${error instanceof Error ? error.message : 'Unknown error'}`
+        };
+    }
+    // 使用常量时间比较防止时序攻击
+    const isValid = timingSafeEqual(signature, expectedSignature);
+    if (!isValid) {
+        return {
+            valid: false,
+            error: 'Signature mismatch'
+        };
+    }
+    return {
+        valid: true
+    };
+}
+/**
+ * 常量时间字符串比较
+ *
+ * 防止时序攻击（timing attack）
+ * 无论字符串是否匹配，都会比较所有字符
+ *
+ * @param a 字符串 A
+ * @param b 字符串 B
+ * @returns 是否相等
+ */
+export function timingSafeEqual(a, b) {
+    if (typeof a !== 'string' || typeof b !== 'string') {
+        return false;
+    }
+    // 长度不同直接返回 false，但仍需要进行完整比较以保持常量时间
+    const lengthMatch = a.length === b.length;
+    const compareLength = Math.max(a.length, b.length);
+    let result = lengthMatch ? 0 : 1;
+    // 始终比较相同次数，避免提前退出
+    for (let i = 0; i < compareLength; i++) {
+        const aChar = i < a.length ? a.charCodeAt(i) : 0;
+        const bChar = i < b.length ? b.charCodeAt(i) : 0;
+        result |= aChar ^ bChar;
+    }
+    return result === 0;
+}
+/**
+ * 生成带签名的请求头
+ *
+ * @param method HTTP 方法
+ * @param path 请求路径
+ * @param secret 共享密钥
+ * @param serviceName 服务名称（realtime/messenger/cli）
+ * @returns 包含签名的 headers 对象
+ *
+ * @example
+ * const headers = generateSignedHeaders('GET', '/api/assets/internal/123', 'secret', 'realtime');
+ * fetch(url, { headers });
+ */
+export function generateSignedHeaders(method, path, secret, serviceName) {
+    const timestamp = Date.now();
+    const signature = generateInternalSignature(method, path, timestamp, secret);
+    return {
+        'X-Internal-Timestamp': timestamp.toString(),
+        'X-Internal-Signature': signature,
+        'X-Internal-Service': serviceName
+    };
+}
+//# sourceMappingURL=signature.js.map

package/dist/auth/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/auth/signature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAoBjC;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,+BAA+B;IAC/B,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;IAE/D,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,MAAc;IAEd,OAAO;IACP,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,wDAAwD;SAChE,CAAC;IACJ,CAAC;IAED,UAAU;IACV,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,0BAA0B;SAClC,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC;IAE5B,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,4BAA4B;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,GAAG,qBAAqB,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,yBAAyB,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,WAAW,qBAAqB,GAAG,IAAI,IAAI;SAClG,CAAC;IACJ,CAAC;IAED,SAAS;IACT,IAAI,iBAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,iBAAiB,GAAG,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,iBAAiB;IACjB,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAE9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAEnD,IAAI,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjC,kBAAkB;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,KAAK,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,IAAY,EACZ,MAAc,EACd,WAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAE7E,OAAO;QACL,sBAAsB,EAAE,SAAS,CAAC,QAAQ,EAAE;QAC5C,sBAAsB,EAAE,SAAS;QACjC,oBAAoB,EAAE,WAAW;KAClC,CAAC;AACJ,CAAC"}

package/dist/auth/signature.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signature.spec.d.ts.map

package/dist/auth/signature.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.spec.d.ts","sourceRoot":"","sources":["../../src/auth/signature.spec.ts"],"names":[],"mappings":""}

package/dist/auth/signature.spec.js

@@ -0,0 +1,195 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { generateInternalSignature, verifyInternalSignature, timingSafeEqual, generateSignedHeaders, SIGNATURE_VALIDITY_MS } from './signature.js';
+describe('Signature Utils', () => {
+    const testSecret = 'test-secret-key-12345';
+    const testMethod = 'GET';
+    const testPath = '/api/assets/internal/123';
+    let testTimestamp;
+    beforeEach(() => {
+        testTimestamp = Date.now();
+    });
+    describe('generateInternalSignature', () => {
+        it('should generate a valid signature', () => {
+            const signature = generateInternalSignature(testMethod, testPath, testTimestamp, testSecret);
+            expect(signature).toBeDefined();
+            expect(typeof signature).toBe('string');
+            expect(signature.length).toBe(64); // SHA256 hex = 64 characters
+        });
+        it('should generate consistent signatures for same inputs', () => {
+            const sig1 = generateInternalSignature(testMethod, testPath, testTimestamp, testSecret);
+            const sig2 = generateInternalSignature(testMethod, testPath, testTimestamp, testSecret);
+            expect(sig1).toBe(sig2);
+        });
+        it('should generate different signatures for different methods', () => {
+            const getSig = generateInternalSignature('GET', testPath, testTimestamp, testSecret);
+            const postSig = generateInternalSignature('POST', testPath, testTimestamp, testSecret);
+            expect(getSig).not.toBe(postSig);
+        });
+        it('should generate different signatures for different paths', () => {
+            const path1Sig = generateInternalSignature(testMethod, '/api/assets/internal/123', testTimestamp, testSecret);
+            const path2Sig = generateInternalSignature(testMethod, '/api/scenes/internal/456', testTimestamp, testSecret);
+            expect(path1Sig).not.toBe(path2Sig);
+        });
+        it('should generate different signatures for different timestamps', () => {
+            const sig1 = generateInternalSignature(testMethod, testPath, testTimestamp, testSecret);
+            const sig2 = generateInternalSignature(testMethod, testPath, testTimestamp + 1000, testSecret);
+            expect(sig1).not.toBe(sig2);
+        });
+        it('should normalize method to uppercase', () => {
+            const upperSig = generateInternalSignature('GET', testPath, testTimestamp, testSecret);
+            const lowerSig = generateInternalSignature('get', testPath, testTimestamp, testSecret);
+            expect(upperSig).toBe(lowerSig);
+        });
+        it('should throw error when missing required parameters', () => {
+            expect(() => generateInternalSignature('', testPath, testTimestamp, testSecret)).toThrow();
+            expect(() => generateInternalSignature(testMethod, '', testTimestamp, testSecret)).toThrow();
+            expect(() => generateInternalSignature(testMethod, testPath, 0, testSecret)).toThrow();
+            expect(() => generateInternalSignature(testMethod, testPath, testTimestamp, '')).toThrow();
+        });
+    });
+    describe('verifyInternalSignature', () => {
+        it('should verify valid signature successfully', () => {
+            const signature = generateInternalSignature(testMethod, testPath, testTimestamp, testSecret);
+            const result = verifyInternalSignature(testMethod, testPath, testTimestamp, signature, testSecret);
+            expect(result.valid).toBe(true);
+            expect(result.error).toBeUndefined();
+        });
+        it('should reject invalid signature', () => {
+            const result = verifyInternalSignature(testMethod, testPath, testTimestamp, 'invalid-signature', testSecret);
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe('Signature mismatch');
+        });
+        it('should reject expired timestamp', () => {
+            const oldTimestamp = Date.now() - SIGNATURE_VALIDITY_MS - 1000; // 超过有效期
+            const signature = generateInternalSignature(testMethod, testPath, oldTimestamp, testSecret);
+            const result = verifyInternalSignature(testMethod, testPath, oldTimestamp, signature, testSecret);
+            expect(result.valid).toBe(false);
+            expect(result.error).toContain('Request expired');
+        });
+        it('should reject future timestamp', () => {
+            const futureTimestamp = Date.now() + 10000; // 未来时间
+            const signature = generateInternalSignature(testMethod, testPath, futureTimestamp, testSecret);
+            const result = verifyInternalSignature(testMethod, testPath, futureTimestamp, signature, testSecret);
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe('Timestamp is in the future');
+        });
+        it('should accept timestamp within validity period', () => {
+            const recentTimestamp = Date.now() - 60000; // 1 分钟前
+            const signature = generateInternalSignature(testMethod, testPath, recentTimestamp, testSecret);
+            const result = verifyInternalSignature(testMethod, testPath, recentTimestamp, signature, testSecret);
+            expect(result.valid).toBe(true);
+        });
+        it('should reject missing parameters', () => {
+            const signature = generateInternalSignature(testMethod, testPath, testTimestamp, testSecret);
+            let result = verifyInternalSignature('', testPath, testTimestamp, signature, testSecret);
+            expect(result.valid).toBe(false);
+            expect(result.error).toContain('Missing required parameters');
+            result = verifyInternalSignature(testMethod, '', testTimestamp, signature, testSecret);
+            expect(result.valid).toBe(false);
+            result = verifyInternalSignature(testMethod, testPath, testTimestamp, '', testSecret);
+            expect(result.valid).toBe(false);
+            result = verifyInternalSignature(testMethod, testPath, testTimestamp, signature, '');
+            expect(result.valid).toBe(false);
+        });
+        it('should reject invalid timestamp format', () => {
+            const signature = generateInternalSignature(testMethod, testPath, testTimestamp, testSecret);
+            const result = verifyInternalSignature(testMethod, testPath, NaN, signature, testSecret);
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe('Invalid timestamp format');
+        });
+        it('should reject signature with wrong method', () => {
+            const signature = generateInternalSignature('GET', testPath, testTimestamp, testSecret);
+            const result = verifyInternalSignature('POST', testPath, testTimestamp, signature, testSecret);
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe('Signature mismatch');
+        });
+        it('should reject signature with wrong path', () => {
+            const signature = generateInternalSignature(testMethod, '/api/assets/internal/123', testTimestamp, testSecret);
+            const result = verifyInternalSignature(testMethod, '/api/scenes/internal/456', testTimestamp, signature, testSecret);
+            expect(result.valid).toBe(false);
+            expect(result.error).toBe('Signature mismatch');
+        });
+    });
+    describe('timingSafeEqual', () => {
+        it('should return true for identical strings', () => {
+            expect(timingSafeEqual('abc123', 'abc123')).toBe(true);
+            expect(timingSafeEqual('', '')).toBe(true);
+        });
+        it('should return false for different strings', () => {
+            expect(timingSafeEqual('abc123', 'abc124')).toBe(false);
+            expect(timingSafeEqual('abc', 'def')).toBe(false);
+        });
+        it('should return false for strings of different lengths', () => {
+            expect(timingSafeEqual('abc', 'abcd')).toBe(false);
+            expect(timingSafeEqual('abcd', 'abc')).toBe(false);
+        });
+        it('should return false for non-string inputs', () => {
+            expect(timingSafeEqual(null, 'abc')).toBe(false);
+            expect(timingSafeEqual('abc', undefined)).toBe(false);
+            expect(timingSafeEqual(123, 456)).toBe(false);
+        });
+        it('should take constant time regardless of where strings differ', () => {
+            // 这个测试验证时序安全性的概念
+            // 实际的时序测试需要更复杂的基准测试
+            const str1 = 'a'.repeat(100);
+            const str2Early = 'b' + 'a'.repeat(99); // 第一个字符不同
+            const str2Late = 'a'.repeat(99) + 'b'; // 最后一个字符不同
+            expect(timingSafeEqual(str1, str2Early)).toBe(false);
+            expect(timingSafeEqual(str1, str2Late)).toBe(false);
+        });
+    });
+    describe('generateSignedHeaders', () => {
+        it('should generate all required headers', () => {
+            const headers = generateSignedHeaders(testMethod, testPath, testSecret, 'realtime');
+            expect(headers['X-Internal-Timestamp']).toBeDefined();
+            expect(headers['X-Internal-Signature']).toBeDefined();
+            expect(headers['X-Internal-Service']).toBe('realtime');
+        });
+        it('should generate valid signature in headers', () => {
+            const headers = generateSignedHeaders(testMethod, testPath, testSecret, 'realtime');
+            const timestamp = parseInt(headers['X-Internal-Timestamp'], 10);
+            const signature = headers['X-Internal-Signature'];
+            const result = verifyInternalSignature(testMethod, testPath, timestamp, signature, testSecret);
+            expect(result.valid).toBe(true);
+        });
+        it('should generate headers for different services', () => {
+            const realtimeHeaders = generateSignedHeaders(testMethod, testPath, testSecret, 'realtime');
+            const messengerHeaders = generateSignedHeaders(testMethod, testPath, testSecret, 'messenger');
+            expect(realtimeHeaders['X-Internal-Service']).toBe('realtime');
+            expect(messengerHeaders['X-Internal-Service']).toBe('messenger');
+        });
+        it('should generate headers for different HTTP methods', () => {
+            const getHeaders = generateSignedHeaders('GET', testPath, testSecret, 'realtime');
+            const postHeaders = generateSignedHeaders('POST', testPath, testSecret, 'realtime');
+            expect(getHeaders['X-Internal-Signature']).not.toBe(postHeaders['X-Internal-Signature']);
+        });
+    });
+    describe('Integration scenarios', () => {
+        it('should handle complete request flow', () => {
+            // 1. 服务生成签名头
+            const headers = generateSignedHeaders('GET', '/api/assets/internal/123', testSecret, 'realtime');
+            // 2. Backend 验证签名
+            const timestamp = parseInt(headers['X-Internal-Timestamp'], 10);
+            const result = verifyInternalSignature('GET', '/api/assets/internal/123', timestamp, headers['X-Internal-Signature'], testSecret);
+            expect(result.valid).toBe(true);
+        });
+        it('should reject tampered signature', () => {
+            const headers = generateSignedHeaders('GET', testPath, testSecret, 'realtime');
+            // 篡改签名
+            const tamperedSignature = headers['X-Internal-Signature'].replace(/a/g, 'b');
+            const timestamp = parseInt(headers['X-Internal-Timestamp'], 10);
+            const result = verifyInternalSignature('GET', testPath, timestamp, tamperedSignature, testSecret);
+            expect(result.valid).toBe(false);
+        });
+        it('should reject replay attack with old timestamp', () => {
+            // 生成旧的签名
+            const oldTimestamp = Date.now() - SIGNATURE_VALIDITY_MS - 10000;
+            const oldSignature = generateInternalSignature('GET', testPath, oldTimestamp, testSecret);
+            // 尝试重放
+            const result = verifyInternalSignature('GET', testPath, oldTimestamp, oldSignature, testSecret);
+            expect(result.valid).toBe(false);
+            expect(result.error).toContain('Request expired');
+        });
+    });
+});
+//# sourceMappingURL=signature.spec.js.map

package/dist/auth/signature.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.spec.js","sourceRoot":"","sources":["../../src/auth/signature.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,UAAU,GAAG,uBAAuB,CAAC;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,0BAA0B,CAAC;IAC5C,IAAI,aAAqB,CAAC;IAE1B,UAAU,CAAC,GAAG,EAAE;QACd,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAE7F,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAExF,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAEvF,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,UAAU,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAC9G,MAAM,QAAQ,GAAG,yBAAyB,CAAC,UAAU,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAE9G,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACvE,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/F,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAEvF,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3F,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7F,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACvF,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAEnG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;YAE7G,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,GAAG,IAAI,CAAC,CAAC,QAAQ;YACxE,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAElG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,OAAO;YACnD,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAC/F,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAErG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ;YACpD,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAC/F,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAErG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAE7F,IAAI,MAAM,GAAG,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACzF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;YAE9D,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACvF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEjC,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;YACtF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEjC,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACrF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAEzF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAE/F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAC/G,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAErH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC9D,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,CAAC,eAAe,CAAC,IAAW,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,SAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,CAAC,eAAe,CAAC,GAAU,EAAE,GAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACtE,iBAAiB;YACjB,oBAAoB;YACpB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU;YAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAE,WAAW;YAEnD,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAEpF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAEpF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAElD,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAC/F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,eAAe,GAAG,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5F,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YAE9F,MAAM,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/D,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAClF,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,aAAa;YACb,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAEjG,kBAAkB;YAClB,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,uBAAuB,CACpC,KAAK,EACL,0BAA0B,EAC1B,SAAS,EACT,OAAO,CAAC,sBAAsB,CAAC,EAC/B,UAAU,CACX,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAE/E,OAAO;YACP,MAAM,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC;YAEhE,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;YAClG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,SAAS;YACT,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,GAAG,KAAK,CAAC;YAChE,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAE1F,OAAO;YACP,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAChG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -6,5 +6,6 @@ export * from './sharedb/index.js';
 export * from './messenger/index.js';
 export * from './websocket/index.js';
 export * from './storage/index.js';
+export * from './mcp/index.js';
 export * from './utils/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -6,5 +6,6 @@ export * from './sharedb/index.js';
 export * from './messenger/index.js';
 export * from './websocket/index.js';
 export * from './storage/index.js';
+export * from './mcp/index.js';
 export * from './utils/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}

package/dist/mcp/index.d.ts

@@ -0,0 +1,3 @@
+export { TOOL_NAME_TO_HANDLER, EXECUTOR_ONLY_TOOLS, toolNameToHandler, MCP_TOOL_NAMES, MCP_TOOL_DEFINITIONS, } from './tools.js';
+export type { McpToolDefinition } from './tools.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}

package/dist/mcp/index.js

@@ -0,0 +1,2 @@
+export { TOOL_NAME_TO_HANDLER, EXECUTOR_ONLY_TOOLS, toolNameToHandler, MCP_TOOL_NAMES, MCP_TOOL_DEFINITIONS, } from './tools.js';
+//# sourceMappingURL=index.js.map

package/dist/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/mcp/tools.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Unified MCP tool definitions and name mapping.
+ * Maps tool names (snake_case / pc_*) used by Backend MCP and AI clients
+ * to Editor handler method names (camelCase).
+ */
+/** Map from MCP tool name (as sent by backend/AI) to Editor handler method name */
+export declare const TOOL_NAME_TO_HANDLER: Record<string, string>;
+/** Tool names that are executed by executor directly (no handler) */
+export declare const EXECUTOR_ONLY_TOOLS: Set<string>;
+/**
+ * Resolve MCP tool name to handler method name.
+ * Returns undefined if tool is executor-only or unknown.
+ */
+export declare function toolNameToHandler(tool: string): string | undefined;
+/**
+ * All MCP tool names that can be invoked (handler-based + executor-only).
+ */
+export declare const MCP_TOOL_NAMES: string[];
+export type McpToolDefinition = {
+    name: string;
+    description: string;
+    inputSchema?: Record<string, unknown>;
+};
+/**
+ * Minimal tool definitions for MCP tools/list.
+ * Backend can use this to return full tool list to MCP clients.
+ */
+export declare const MCP_TOOL_DEFINITIONS: McpToolDefinition[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/mcp/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqFvD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,aAAiD,CAAC;AAElF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGlE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,UAK1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EA0EnD,CAAC"}