@scrthq/runlog 0.0.24

package/README.md

@@ -0,0 +1,23 @@
+# @scrthq/runlog
+
+The command line for [Runlog](https://github.com/SCRT-HQ/runlog) packs:
+validate, lint, bundle and test a rule pack; make a signing key, sign a
+release, and issue sealed copies to buyers.
+
+```bash
+npx @scrthq/runlog validate my-game.yaml --strict
+npx @scrthq/runlog test my-game.yaml
+npx @scrthq/runlog keygen -o my-key.json
+npx @scrthq/runlog sign my-game.yaml --key my-key.json --as "Your Name"
+npx @scrthq/runlog issue my-game.yaml --to "Buyer" --ref order-1 --key my-key.json --seal
+```
+
+`npx @scrthq/runlog help` lists everything.
+
+The same package is a library for a seller's own backend: `seal`, `open`,
+`readHeader`, `isSealed` and `generateLicenseKey`, with no dependencies.
+
+```js
+import { seal, generateLicenseKey } from "@scrthq/runlog";
+``` The authoring guide, the format
+reference and the selling notes live in the repository's `docs/`.

package/dist/index.js

@@ -0,0 +1,141 @@
+// packages/container/src/base64url.ts
+function toBase64Url(bytes2) {
+  let binary = "";
+  for (const byte of bytes2) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+  const padded = text.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const bytes2 = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i++) bytes2[i] = binary.charCodeAt(i);
+  return bytes2;
+}
+
+// packages/container/src/container.ts
+var MAGIC = "RLPACK
";
+var KDF_ITERATIONS = 6e5;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function bytes(n) {
+  const out = new Uint8Array(new ArrayBuffer(n));
+  crypto.getRandomValues(out);
+  return out;
+}
+function generateLicenseKey() {
+  const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  const raw = bytes(20);
+  const chars = [...raw].map((b) => alphabet[b % alphabet.length]).join("");
+  return (chars.match(/.{5}/g) ?? []).join("-");
+}
+var normalizeKey = (key) => key.trim().toUpperCase().replace(/[^A-Z0-9]/g, "");
+async function deriveKey(licenseKey, salt, iterations) {
+  const material = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(normalizeKey(licenseKey)),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return crypto.subtle.deriveKey(
+    { name: "PBKDF2", salt, iterations, hash: "SHA-256" },
+    material,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function seal(document, licenseKey, extra = {}) {
+  const salt = bytes(16);
+  const iv = bytes(12);
+  const key = await deriveKey(licenseKey, salt, KDF_ITERATIONS);
+  const plaintext = encoder.encode(JSON.stringify(document));
+  const sealed = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    plaintext
+  );
+  const header = {
+    v: 1,
+    alg: "aes-256-gcm",
+    kdf: "pbkdf2-sha256",
+    iterations: KDF_ITERATIONS,
+    salt: toBase64Url(salt),
+    iv: toBase64Url(iv),
+    ...extra.ref ? { ref: extra.ref } : {},
+    ...extra.title ? { title: extra.title } : {}
+  };
+  const headerBytes = encoder.encode(JSON.stringify(header));
+  const body = new Uint8Array(sealed);
+  const magic = encoder.encode(MAGIC);
+  const out = new Uint8Array(new ArrayBuffer(magic.length + 4 + headerBytes.length + body.length));
+  let at = 0;
+  out.set(magic, at);
+  at += magic.length;
+  new DataView(out.buffer).setUint32(at, headerBytes.length, false);
+  at += 4;
+  out.set(headerBytes, at);
+  at += headerBytes.length;
+  out.set(body, at);
+  return out;
+}
+function isSealed(data) {
+  const magic = encoder.encode(MAGIC);
+  if (data.length < magic.length) return false;
+  return magic.every((b, i) => data[i] === b);
+}
+function readHeader(data) {
+  if (!isSealed(data)) return null;
+  try {
+    const start = encoder.encode(MAGIC).length;
+    const length = new DataView(data.buffer, data.byteOffset).getUint32(start, false);
+    const header = JSON.parse(
+      decoder.decode(data.subarray(start + 4, start + 4 + length))
+    );
+    return header.v === 1 ? header : null;
+  } catch {
+    return null;
+  }
+}
+async function open(data, licenseKey) {
+  const header = readHeader(data);
+  if (!header) {
+    return { ok: false, reason: "not-sealed", message: "this file is not a sealed pack" };
+  }
+  if (header.alg !== "aes-256-gcm" || header.kdf !== "pbkdf2-sha256") {
+    return {
+      ok: false,
+      reason: "unsupported",
+      message: "this copy was sealed by a newer version of the app"
+    };
+  }
+  try {
+    const start = encoder.encode(MAGIC).length;
+    const length = new DataView(data.buffer, data.byteOffset).getUint32(start, false);
+    const view = data.subarray(start + 4 + length);
+    const body = new Uint8Array(new ArrayBuffer(view.length));
+    body.set(view);
+    const key = await deriveKey(licenseKey, fromBase64Url(header.salt), header.iterations);
+    const plain = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: fromBase64Url(header.iv) },
+      key,
+      body
+    );
+    return { ok: true, document: JSON.parse(decoder.decode(plain)) };
+  } catch {
+    return {
+      ok: false,
+      reason: "wrong-key",
+      message: "that license key does not open this copy"
+    };
+  }
+}
+export {
+  fromBase64Url,
+  generateLicenseKey,
+  isSealed,
+  open,
+  readHeader,
+  seal,
+  toBase64Url
+};