@secondlayer/shared 11.1.0 → 11.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The archive signing key, compiled into every release.
|
|
3
|
+
*
|
|
4
|
+
* `secondlayer bootstrap`, `verify`, and `repair` refuse a manifest they
|
|
5
|
+
* cannot verify, so a self-hosted instance with no network path to the hosted
|
|
6
|
+
* API still needs a key it can trust. Shipping it here means the trust root
|
|
7
|
+
* travels with the CLI rather than with whichever host answers
|
|
8
|
+
* `/public/streams/signing-key`.
|
|
9
|
+
*
|
|
10
|
+
* Tradeoff: rotating this key is a CLI release until a root-signed key
|
|
11
|
+
* ceremony lands. Operators who want a different root pin one with
|
|
12
|
+
* `ARCHIVE_SIGNING_PUBLIC_KEY` or `--public-key`, which win over this value.
|
|
13
|
+
*
|
|
14
|
+
* Value: `GET https://api.secondlayer.tools/public/streams/signing-key`,
|
|
15
|
+
* key_id `fHQWzs9ML2WIYakf`, ed25519, fetched 2026-08-27.
|
|
16
|
+
*/
|
|
17
|
+
declare const ARCHIVE_ROOT_PUBLIC_KEY_PEM: string;
|
|
18
|
+
declare const ARCHIVE_ROOT_KEY_ID: string;
|
|
19
|
+
export { ARCHIVE_ROOT_PUBLIC_KEY_PEM, ARCHIVE_ROOT_KEY_ID };
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
import { createRequire } from "node:module";
|
|
2
|
+
var __defProp = Object.defineProperty;
|
|
3
|
+
var __returnValue = (v) => v;
|
|
4
|
+
function __exportSetter(name, newValue) {
|
|
5
|
+
this[name] = __returnValue.bind(null, newValue);
|
|
6
|
+
}
|
|
7
|
+
var __export = (target, all) => {
|
|
8
|
+
for (var name in all)
|
|
9
|
+
__defProp(target, name, {
|
|
10
|
+
get: all[name],
|
|
11
|
+
enumerable: true,
|
|
12
|
+
configurable: true,
|
|
13
|
+
set: __exportSetter.bind(all, name)
|
|
14
|
+
});
|
|
15
|
+
};
|
|
16
|
+
|
|
17
|
+
// src/archive/root-key.ts
|
|
18
|
+
var ARCHIVE_ROOT_PUBLIC_KEY_PEM = [
|
|
19
|
+
"-----BEGIN PUBLIC KEY-----",
|
|
20
|
+
"MCowBQYDK2VwAyEAq7wXm235JkFbElDmTVdNtmTKqRLx4PzjBgZhyREUFis=",
|
|
21
|
+
"-----END PUBLIC KEY-----",
|
|
22
|
+
""
|
|
23
|
+
].join(`
|
|
24
|
+
`);
|
|
25
|
+
var ARCHIVE_ROOT_KEY_ID = "fHQWzs9ML2WIYakf";
|
|
26
|
+
export {
|
|
27
|
+
ARCHIVE_ROOT_PUBLIC_KEY_PEM,
|
|
28
|
+
ARCHIVE_ROOT_KEY_ID
|
|
29
|
+
};
|
|
30
|
+
|
|
31
|
+
//# debugId=D3C1DBD1F4B11A3F64756E2164756E21
|
|
32
|
+
//# sourceMappingURL=root-key.js.map
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
{
|
|
2
|
+
"version": 3,
|
|
3
|
+
"sources": ["../src/archive/root-key.ts"],
|
|
4
|
+
"sourcesContent": [
|
|
5
|
+
"/**\n * The archive signing key, compiled into every release.\n *\n * `secondlayer bootstrap`, `verify`, and `repair` refuse a manifest they\n * cannot verify, so a self-hosted instance with no network path to the hosted\n * API still needs a key it can trust. Shipping it here means the trust root\n * travels with the CLI rather than with whichever host answers\n * `/public/streams/signing-key`.\n *\n * Tradeoff: rotating this key is a CLI release until a root-signed key\n * ceremony lands. Operators who want a different root pin one with\n * `ARCHIVE_SIGNING_PUBLIC_KEY` or `--public-key`, which win over this value.\n *\n * Value: `GET https://api.secondlayer.tools/public/streams/signing-key`,\n * key_id `fHQWzs9ML2WIYakf`, ed25519, fetched 2026-08-27.\n */\nexport const ARCHIVE_ROOT_PUBLIC_KEY_PEM: string = [\n\t\"-----BEGIN PUBLIC KEY-----\",\n\t\"MCowBQYDK2VwAyEAq7wXm235JkFbElDmTVdNtmTKqRLx4PzjBgZhyREUFis=\",\n\t\"-----END PUBLIC KEY-----\",\n\t\"\",\n].join(\"\\n\");\n\nexport const ARCHIVE_ROOT_KEY_ID: string = \"fHQWzs9ML2WIYakf\";\n"
|
|
6
|
+
],
|
|
7
|
+
"mappings": ";;;;;;;;;;;;;;;;;AAgBO,IAAM,8BAAsC;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,EAAE,KAAK;AAAA,CAAI;AAEJ,IAAM,sBAA8B;",
|
|
8
|
+
"debugId": "D3C1DBD1F4B11A3F64756E2164756E21",
|
|
9
|
+
"names": []
|
|
10
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@secondlayer/shared",
|
|
3
|
-
"version": "11.
|
|
3
|
+
"version": "11.2.0",
|
|
4
4
|
"description": "Internal building blocks shared across Secondlayer packages.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
@@ -133,6 +133,10 @@
|
|
|
133
133
|
"types": "./dist/src/archive/status.d.ts",
|
|
134
134
|
"import": "./dist/src/archive/status.js"
|
|
135
135
|
},
|
|
136
|
+
"./archive/root-key": {
|
|
137
|
+
"types": "./dist/src/archive/root-key.d.ts",
|
|
138
|
+
"import": "./dist/src/archive/root-key.js"
|
|
139
|
+
},
|
|
136
140
|
"./archive/key-registry": {
|
|
137
141
|
"types": "./dist/src/archive/key-registry.d.ts",
|
|
138
142
|
"import": "./dist/src/archive/key-registry.js"
|
|
@@ -221,7 +225,7 @@
|
|
|
221
225
|
"prepublishOnly": "bun run build"
|
|
222
226
|
},
|
|
223
227
|
"dependencies": {
|
|
224
|
-
"@secondlayer/stacks": "^
|
|
228
|
+
"@secondlayer/stacks": "^5.0.0",
|
|
225
229
|
"kysely": "0.28.17",
|
|
226
230
|
"kysely-postgres-js": "3.0.0",
|
|
227
231
|
"postgres": "^3.4.6",
|