@stopnetic/js 0.0.1-pilot → 0.0.3-pilot

package/dist/signing-keys.js

@@ -1,29 +1,40 @@
-import { createPublicKey } from 'node:crypto';
-
+import { createPublicKey } from 'node:crypto';
+
 function publicKey(value) {
-  if (typeof value !== 'string' || value.length > 2048
-    || !/^-----BEGIN PUBLIC KEY-----\r?\n[A-Za-z0-9+/=\r\n]+-----END PUBLIC KEY-----\s*$/.test(value)) {
+  if (typeof value !== 'string' || value.length > 2048) {
     throw new Error('Signing verification keys must be public PEMs');
   }
-  const key = createPublicKey(value);
-  if (key.asymmetricKeyType !== 'ed25519') throw new Error('Signing verification keys must be Ed25519');
-  return key;
-}
-
-export function trustedSigningKeys(primary, additional) {
-  if (!Array.isArray(additional) || additional.length > 2) throw new Error('Use at most two additional signing public keys');
-  const keys = [primary, ...additional].map(publicKey);
-  return [...new Map(keys.map(key => [key.export({ type: 'spki', format: 'der' }).toString('hex'), key])).values()];
-}
-
-/** Parse a server environment JSON array without exposing malformed values. */
-export function parseAdditionalDecisionPublicKeys(value) {
-  if (value === undefined || value === '') return [];
-  try {
-    if (typeof value !== 'string' || value.length > 8192) throw new Error();
-    const keys = JSON.parse(value);
-    if (!Array.isArray(keys) || keys.length > 2) throw new Error();
-    keys.forEach(publicKey);
-    return keys;
-  } catch { throw new Error('Invalid additional signing public keys'); }
-}
+  // Hosting value fields may receive the quoted/escaped dotenv representation.
+  // Normalize only formatting; retain bounded, public-only Ed25519 trust checks.
+  let pem = value.trim();
+  try { if (pem.startsWith('"')) pem = JSON.parse(pem); }
+  catch { throw new Error('Signing verification keys must be public PEMs'); }
+  if (typeof pem !== 'string') throw new Error('Signing verification keys must be public PEMs');
+  pem = pem.replaceAll('\\r\\n', '\n').replaceAll('\\n', '\n');
+  if (!/^-----BEGIN PUBLIC KEY-----\r?\n[A-Za-z0-9+/=\r\n]+-----END PUBLIC KEY-----\s*$/.test(pem)) {
+    throw new Error('Signing verification keys must be public PEMs');
+  }
+  let key;
+  try { key = createPublicKey(pem); }
+  catch { throw new Error('Signing verification keys must be public PEMs'); }
+  if (key.asymmetricKeyType !== 'ed25519') throw new Error('Signing verification keys must be Ed25519');
+  return key;
+}
+
+export function trustedSigningKeys(primary, additional) {
+  if (!Array.isArray(additional) || additional.length > 2) throw new Error('Use at most two additional signing public keys');
+  const keys = [primary, ...additional].map(publicKey);
+  return [...new Map(keys.map(key => [key.export({ type: 'spki', format: 'der' }).toString('hex'), key])).values()];
+}
+
+/** Parse a server environment JSON array without exposing malformed values. */
+export function parseAdditionalDecisionPublicKeys(value) {
+  if (value === undefined || value === '') return [];
+  try {
+    if (typeof value !== 'string' || value.length > 8192) throw new Error();
+    const keys = JSON.parse(value);
+    if (!Array.isArray(keys) || keys.length > 2) throw new Error();
+    keys.forEach(publicKey);
+    return keys;
+  } catch { throw new Error('Invalid additional signing public keys'); }
+}

package/package.json

@@ -1,47 +1,54 @@
-{
-  "name": "@stopnetic/js",
-  "version": "0.0.1-pilot",
-  "description": "Server-side Stopnetic guard for JavaScript websites, Node.js and Express-compatible servers.",
-  "type": "module",
-  "license": "MIT",
-  "author": "Stopnetic",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/KlimentSidorov/stopin.git",
-    "directory": "integrations/javascript"
-  },
-  "keywords": [
-    "stopnetic",
-    "javascript",
-    "nodejs",
-    "express",
-    "access-control"
-  ],
-  "files": [
-    "dist"
-  ],
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
-  },
-  "engines": {
-    "node": ">=22"
-  },
-  "publishConfig": {
-    "access": "public",
-    "tag": "pilot",
-    "registry": "https://registry.npmjs.org/"
-  },
-  "scripts": {
-    "build": "node scripts/build.mjs",
-    "prepack": "npm run build",
-    "test": "npm run build && node --test tests/*.test.mjs",
-    "test:package": "npm run build && node tests/package-check.mjs"
-  },
-  "devDependencies": {
-    "express": "^4.22.3",
-    "express5": "npm:express@^5.2.1"
-  }
-}
+{
+  "name": "@stopnetic/js",
+  "version": "0.0.3-pilot",
+  "description": "Server-side Stopnetic guard for JavaScript websites, Node.js and Express-compatible servers.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Stopnetic",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/KlimentSidorov/stopin.git",
+    "directory": "integrations/javascript"
+  },
+  "keywords": [
+    "stopnetic",
+    "javascript",
+    "nodejs",
+    "express",
+    "access-control"
+  ],
+  "files": [
+    "dist",
+    "bin"
+  ],
+  "bin": { "stopnetic-js": "./bin/stopnetic-js.js" },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": { "types": "./dist/server.d.ts", "default": "./dist/server.js" },
+    "./browser": { "types": "./dist/browser.d.ts", "default": "./dist/browser.js" },
+    "./react": { "types": "./dist/react.d.ts", "default": "./dist/react.js" }
+  },
+  "peerDependencies": { "react": "*" },
+  "peerDependenciesMeta": { "react": { "optional": true } },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "pilot",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "prepack": "npm run build",
+    "test": "npm run build && node --test tests/*.test.mjs",
+    "test:package": "npm run build && node tests/package-check.mjs"
+  },
+  "devDependencies": {
+    "express": "^4.22.3",
+    "express5": "npm:express@^5.2.1"
+  }
+}