@vivipilot/render-manifest 0.1.0

package/README.md

@@ -0,0 +1,13 @@
+# @vivipilot/render-manifest
+
+Shared schema and cryptographic helpers for Vivipilot signed render manifests.
+
+This package is the trust boundary between Vivipilot Cloud and local rendering:
+
+- Cloud generates and signs `vivipilot.renderManifest.v1` manifests.
+- CLI/MCP/browser renderers verify signatures with public keys.
+- Large assets are referenced by immutable URLs plus SHA-256 integrity metadata.
+- Paid CLI/MCP manifests do not expire unless an `expiresAt` field is explicitly set for internal/test use.
+
+The package intentionally has no runtime dependencies. It uses WebCrypto Ed25519 so the same verifier can run in browsers, Node CLI code, and server runtimes.
+

package/dist/index.d.ts

@@ -0,0 +1,113 @@
+export declare const RENDER_MANIFEST_SCHEMA_VERSION: "vivipilot.renderManifest.v1";
+export declare const RENDER_MANIFEST_SIGNATURE_ALG: "Ed25519";
+export type JsonPrimitive = null | boolean | number | string;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export type RenderManifestResolution = "720p" | "1080p" | "2k" | "4k";
+export type RenderManifestFormat = "mp4" | "webm" | "gif" | "mov";
+export type RenderManifestEngine = "pixi-dw-scene-v1" | "three-scene-v1" | "mixed";
+export type RenderManifestCreditSource = "paid_topup" | "paid_enterprise" | "internal_test";
+export type RenderManifestAsset = {
+    assetId: string;
+    url: string;
+    sha256: string;
+    mimeType: string;
+    byteLength: number;
+    role?: string;
+    cacheKey?: string;
+};
+export type RenderManifestEntitlement = {
+    maxResolution: RenderManifestResolution;
+    watermark: boolean;
+    commercialUse: boolean;
+    allowedFormats?: RenderManifestFormat[];
+};
+export type RenderManifestBilling = {
+    creditTransactionId: string;
+    creditsCharged: number;
+    idempotencyKey: string;
+    creditSource: RenderManifestCreditSource;
+};
+export type RenderManifestCanvas = {
+    width: number;
+    height: number;
+    fps: number;
+};
+export type RenderManifestRenderPayload = {
+    engine: RenderManifestEngine;
+    canvas: RenderManifestCanvas;
+    durationFrames: number;
+    backgroundColor?: string;
+    overlays: JsonValue[];
+    assets?: RenderManifestAsset[];
+    metadata?: JsonObject;
+};
+export type RenderManifestIntegrity = {
+    canonicalPayloadHash: string;
+    sceneHash: string;
+};
+export type RenderManifestSignature = {
+    alg: typeof RENDER_MANIFEST_SIGNATURE_ALG;
+    keyId: string;
+    value: string;
+};
+export type VivipilotRenderManifestV1 = {
+    schema: typeof RENDER_MANIFEST_SCHEMA_VERSION;
+    manifestId: string;
+    generationId: string;
+    userId: string;
+    projectId?: string;
+    createdAt: string;
+    expiresAt?: string;
+    engineVersion: string;
+    entitlement: RenderManifestEntitlement;
+    billing: RenderManifestBilling;
+    render: RenderManifestRenderPayload;
+    integrity: RenderManifestIntegrity;
+    signature: RenderManifestSignature;
+};
+export type UnsignedVivipilotRenderManifestV1 = Omit<VivipilotRenderManifestV1, "signature">;
+export type RenderManifestPublicKey = {
+    keyId: string;
+    publicKey: string;
+};
+export type PublicKeyResolver = Record<string, string> | RenderManifestPublicKey[] | ((keyId: string) => string | undefined | Promise<string | undefined>);
+export type SignRenderManifestOptions = {
+    keyId: string;
+    privateKey: CryptoKey | JsonWebKey | string;
+    crypto?: Crypto;
+};
+export type VerifyRenderManifestOptions = {
+    publicKeys: PublicKeyResolver;
+    crypto?: Crypto;
+    now?: Date;
+    checkExpiry?: boolean;
+};
+export type RenderManifestVerificationSuccess = {
+    ok: true;
+    manifest: VivipilotRenderManifestV1;
+    canonicalPayloadHash: string;
+};
+export type RenderManifestVerificationFailure = {
+    ok: false;
+    reason: "invalid_shape" | "invalid_canonical_payload_hash" | "invalid_signature" | "missing_public_key" | "expired" | "crypto_unavailable" | "invalid_key";
+    message: string;
+};
+export type RenderManifestVerificationResult = RenderManifestVerificationSuccess | RenderManifestVerificationFailure;
+export declare function canonicalizeJson(value: unknown): string;
+export declare function bytesToBase64Url(bytes: Uint8Array): string;
+export declare function base64UrlToBytes(value: string): Uint8Array;
+export declare function sha256Hex(value: string | Uint8Array, cryptoImpl?: Crypto): Promise<string>;
+export declare function canonicalizeManifestForSigning(manifest: VivipilotRenderManifestV1 | UnsignedVivipilotRenderManifestV1): string;
+export declare function computeCanonicalPayloadHash(manifest: VivipilotRenderManifestV1 | UnsignedVivipilotRenderManifestV1, cryptoImpl?: Crypto): Promise<string>;
+export declare function withCanonicalPayloadHash(manifest: UnsignedVivipilotRenderManifestV1, cryptoImpl?: Crypto): Promise<UnsignedVivipilotRenderManifestV1>;
+export declare function signRenderManifest(manifest: UnsignedVivipilotRenderManifestV1, options: SignRenderManifestOptions): Promise<VivipilotRenderManifestV1>;
+export declare function validateRenderManifestShape(value: unknown): RenderManifestVerificationResult;
+export declare function isManifestExpired(manifest: VivipilotRenderManifestV1, now?: Date): boolean;
+export declare function verifyRenderManifest(value: unknown, options: VerifyRenderManifestOptions): Promise<RenderManifestVerificationResult>;
+export declare function verifyAssetDigest(asset: RenderManifestAsset, bytes: Uint8Array, cryptoImpl?: Crypto): Promise<boolean>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,8BAA8B,EAAG,6BAAsC,CAAC;AACrF,eAAO,MAAM,6BAA6B,EAAG,SAAkB,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AACnF,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;AACtE,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;AAClE,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,OAAO,CAAC;AACnF,MAAM,MAAM,0BAA0B,GAAG,YAAY,GAAG,iBAAiB,GAAG,eAAe,CAAC;AAE5F,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,aAAa,EAAE,wBAAwB,CAAC;IACxC,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,0BAA0B,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,EAAE,OAAO,6BAA6B,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,OAAO,8BAA8B,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,yBAAyB,CAAC;IACvC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,EAAE,uBAAuB,CAAC;IACnC,SAAS,EAAE,uBAAuB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;AAE7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtB,uBAAuB,EAAE,GACzB,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAE1E,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,yBAAyB,CAAC;IACpC,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,eAAe,GACf,gCAAgC,GAChC,mBAAmB,GACnB,oBAAoB,GACpB,SAAS,GACT,oBAAoB,GACpB,aAAa,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,gCAAgC,GACxC,iCAAiC,GACjC,iCAAiC,CAAC;AA2CtC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAavD;AAgBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAE1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAO1D;AAkBD,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhG;AAmBD,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,yBAAyB,GAAG,iCAAiC,GAAG,MAAM,CAE9H;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,yBAAyB,GAAG,iCAAiC,EACvE,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,iCAAiC,EAC3C,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,iCAAiC,CAAC,CAS5C;AA8BD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,iCAAiC,EAC3C,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAiBpC;AAYD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,gCAAgC,CAgD5F;AAQD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,yBAAyB,EAAE,GAAG,OAAa,GAAG,OAAO,CAEhG;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,gCAAgC,CAAC,CAyC3C;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI5H"}

package/dist/index.js

@@ -0,0 +1,289 @@
+export const RENDER_MANIFEST_SCHEMA_VERSION = "vivipilot.renderManifest.v1";
+export const RENDER_MANIFEST_SIGNATURE_ALG = "Ed25519";
+const ED25519_ALGORITHM = { name: RENDER_MANIFEST_SIGNATURE_ALG };
+const HEX_SHA256_PATTERN = /^[a-f0-9]{64}$/i;
+function fail(reason, message) {
+    return { ok: false, reason, message };
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function isFinitePositiveNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function assertJsonCompatible(value, path = "$") {
+    if (value === null)
+        return;
+    const kind = typeof value;
+    if (kind === "string" || kind === "boolean")
+        return;
+    if (kind === "number") {
+        if (!Number.isFinite(value))
+            throw new Error(`Non-finite number at ${path}`);
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => assertJsonCompatible(item, `${path}[${index}]`));
+        return;
+    }
+    if (kind === "object") {
+        for (const [key, entryValue] of Object.entries(value)) {
+            if (entryValue === undefined)
+                throw new Error(`Undefined value at ${path}.${key}`);
+            assertJsonCompatible(entryValue, `${path}.${key}`);
+        }
+        return;
+    }
+    throw new Error(`Unsupported JSON value at ${path}`);
+}
+export function canonicalizeJson(value) {
+    assertJsonCompatible(value);
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map((item) => canonicalizeJson(item)).join(",")}]`;
+    const entries = Object.entries(value)
+        .filter(([, entryValue]) => entryValue !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right));
+    return `{${entries
+        .map(([key, entryValue]) => `${JSON.stringify(key)}:${canonicalizeJson(entryValue)}`)
+        .join(",")}}`;
+}
+function utf8ToBytes(value) {
+    return new TextEncoder().encode(value);
+}
+function bytesToBinary(bytes) {
+    const chunkSize = 0x8000;
+    let binary = "";
+    for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+        const chunk = bytes.slice(offset, offset + chunkSize);
+        binary += String.fromCharCode(...chunk);
+    }
+    return binary;
+}
+export function bytesToBase64Url(bytes) {
+    return btoa(bytesToBinary(bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+export function base64UrlToBytes(value) {
+    const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), "=");
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index++)
+        bytes[index] = binary.charCodeAt(index);
+    return bytes;
+}
+function toArrayBuffer(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function getCrypto(cryptoImpl) {
+    return cryptoImpl ?? globalThis.crypto ?? null;
+}
+async function sha256Bytes(value, cryptoImpl) {
+    const cryptoRuntime = getCrypto(cryptoImpl);
+    if (!cryptoRuntime?.subtle)
+        throw new Error("crypto_unavailable");
+    const input = typeof value === "string" ? utf8ToBytes(value) : value;
+    const digest = await cryptoRuntime.subtle.digest("SHA-256", input);
+    return new Uint8Array(digest);
+}
+export async function sha256Hex(value, cryptoImpl) {
+    const bytes = await sha256Bytes(value, cryptoImpl);
+    return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function stripSignature(manifest) {
+    const unsigned = { ...manifest };
+    delete unsigned.signature;
+    return unsigned;
+}
+function payloadForCanonicalHash(manifest) {
+    const unsigned = stripSignature(manifest);
+    return {
+        ...unsigned,
+        integrity: {
+            ...unsigned.integrity,
+            canonicalPayloadHash: "",
+        },
+    };
+}
+export function canonicalizeManifestForSigning(manifest) {
+    return canonicalizeJson(stripSignature(manifest));
+}
+export async function computeCanonicalPayloadHash(manifest, cryptoImpl) {
+    return sha256Hex(canonicalizeJson(payloadForCanonicalHash(manifest)), cryptoImpl);
+}
+export async function withCanonicalPayloadHash(manifest, cryptoImpl) {
+    const canonicalPayloadHash = await computeCanonicalPayloadHash(manifest, cryptoImpl);
+    return {
+        ...manifest,
+        integrity: {
+            ...manifest.integrity,
+            canonicalPayloadHash,
+        },
+    };
+}
+async function importPrivateKey(privateKey, cryptoRuntime) {
+    if (privateKey instanceof CryptoKey)
+        return privateKey;
+    if (typeof privateKey === "string") {
+        return cryptoRuntime.subtle.importKey("pkcs8", toArrayBuffer(base64UrlToBytes(privateKey)), ED25519_ALGORITHM, false, ["sign"]);
+    }
+    return cryptoRuntime.subtle.importKey("jwk", privateKey, ED25519_ALGORITHM, false, ["sign"]);
+}
+async function importPublicKey(publicKey, cryptoRuntime) {
+    if (publicKey instanceof CryptoKey)
+        return publicKey;
+    if (typeof publicKey === "string") {
+        return cryptoRuntime.subtle.importKey("raw", toArrayBuffer(base64UrlToBytes(publicKey)), ED25519_ALGORITHM, false, ["verify"]);
+    }
+    return cryptoRuntime.subtle.importKey("jwk", publicKey, ED25519_ALGORITHM, false, ["verify"]);
+}
+export async function signRenderManifest(manifest, options) {
+    const cryptoRuntime = getCrypto(options.crypto);
+    if (!cryptoRuntime?.subtle)
+        throw new Error("crypto_unavailable");
+    const preparedManifest = await withCanonicalPayloadHash(manifest, cryptoRuntime);
+    const signingPayload = utf8ToBytes(canonicalizeManifestForSigning(preparedManifest));
+    const privateKey = await importPrivateKey(options.privateKey, cryptoRuntime);
+    const signature = await cryptoRuntime.subtle.sign(ED25519_ALGORITHM, privateKey, signingPayload);
+    return {
+        ...preparedManifest,
+        signature: {
+            alg: RENDER_MANIFEST_SIGNATURE_ALG,
+            keyId: options.keyId,
+            value: bytesToBase64Url(new Uint8Array(signature)),
+        },
+    };
+}
+function validateAssetShape(asset) {
+    if (!isRecord(asset))
+        return false;
+    return isNonEmptyString(asset.assetId)
+        && isNonEmptyString(asset.url)
+        && isNonEmptyString(asset.sha256)
+        && HEX_SHA256_PATTERN.test(asset.sha256)
+        && isNonEmptyString(asset.mimeType)
+        && isFinitePositiveNumber(asset.byteLength);
+}
+export function validateRenderManifestShape(value) {
+    if (!isRecord(value))
+        return fail("invalid_shape", "Manifest must be an object.");
+    if (value.schema !== RENDER_MANIFEST_SCHEMA_VERSION)
+        return fail("invalid_shape", "Unsupported render manifest schema.");
+    if (!isNonEmptyString(value.manifestId))
+        return fail("invalid_shape", "manifestId is required.");
+    if (!isNonEmptyString(value.generationId))
+        return fail("invalid_shape", "generationId is required.");
+    if (!isNonEmptyString(value.userId))
+        return fail("invalid_shape", "userId is required.");
+    if (!isNonEmptyString(value.createdAt) || Number.isNaN(Date.parse(value.createdAt)))
+        return fail("invalid_shape", "createdAt must be an ISO date string.");
+    if (value.expiresAt !== undefined && (!isNonEmptyString(value.expiresAt) || Number.isNaN(Date.parse(value.expiresAt)))) {
+        return fail("invalid_shape", "expiresAt must be an ISO date string when provided.");
+    }
+    if (!isNonEmptyString(value.engineVersion))
+        return fail("invalid_shape", "engineVersion is required.");
+    if (!isRecord(value.entitlement))
+        return fail("invalid_shape", "entitlement is required.");
+    if (!isRecord(value.billing))
+        return fail("invalid_shape", "billing is required.");
+    if (!isNonEmptyString(value.billing.creditTransactionId))
+        return fail("invalid_shape", "billing.creditTransactionId is required.");
+    if (!isFinitePositiveNumber(value.billing.creditsCharged))
+        return fail("invalid_shape", "billing.creditsCharged must be positive.");
+    if (!isNonEmptyString(value.billing.idempotencyKey))
+        return fail("invalid_shape", "billing.idempotencyKey is required.");
+    if (!isNonEmptyString(value.billing.creditSource))
+        return fail("invalid_shape", "billing.creditSource is required.");
+    if (!isRecord(value.render))
+        return fail("invalid_shape", "render payload is required.");
+    if (!isRecord(value.render.canvas))
+        return fail("invalid_shape", "render.canvas is required.");
+    if (!isFinitePositiveNumber(value.render.canvas.width) || !isFinitePositiveNumber(value.render.canvas.height) || !isFinitePositiveNumber(value.render.canvas.fps)) {
+        return fail("invalid_shape", "render.canvas dimensions and fps must be positive.");
+    }
+    if (!isFinitePositiveNumber(value.render.durationFrames))
+        return fail("invalid_shape", "render.durationFrames must be positive.");
+    if (!Array.isArray(value.render.overlays))
+        return fail("invalid_shape", "render.overlays must be an array.");
+    if (value.render.assets !== undefined && (!Array.isArray(value.render.assets) || !value.render.assets.every(validateAssetShape))) {
+        return fail("invalid_shape", "render.assets must contain immutable asset references with SHA-256 hashes.");
+    }
+    if (!isRecord(value.integrity))
+        return fail("invalid_shape", "integrity is required.");
+    if (!isNonEmptyString(value.integrity.canonicalPayloadHash) || !HEX_SHA256_PATTERN.test(value.integrity.canonicalPayloadHash)) {
+        return fail("invalid_shape", "integrity.canonicalPayloadHash must be a SHA-256 hex digest.");
+    }
+    if (!isNonEmptyString(value.integrity.sceneHash) || !HEX_SHA256_PATTERN.test(value.integrity.sceneHash)) {
+        return fail("invalid_shape", "integrity.sceneHash must be a SHA-256 hex digest.");
+    }
+    if (!isRecord(value.signature))
+        return fail("invalid_shape", "signature is required.");
+    if (value.signature.alg !== RENDER_MANIFEST_SIGNATURE_ALG)
+        return fail("invalid_shape", "Unsupported signature algorithm.");
+    if (!isNonEmptyString(value.signature.keyId))
+        return fail("invalid_shape", "signature.keyId is required.");
+    if (!isNonEmptyString(value.signature.value))
+        return fail("invalid_shape", "signature.value is required.");
+    return {
+        ok: true,
+        manifest: value,
+        canonicalPayloadHash: value.integrity.canonicalPayloadHash,
+    };
+}
+async function resolvePublicKey(keyId, resolver) {
+    if (typeof resolver === "function")
+        return resolver(keyId);
+    if (Array.isArray(resolver))
+        return resolver.find((entry) => entry.keyId === keyId)?.publicKey;
+    return resolver[keyId];
+}
+export function isManifestExpired(manifest, now = new Date()) {
+    return typeof manifest.expiresAt === "string" && Date.parse(manifest.expiresAt) <= now.getTime();
+}
+export async function verifyRenderManifest(value, options) {
+    const shape = validateRenderManifestShape(value);
+    if (!shape.ok)
+        return shape;
+    const manifest = shape.manifest;
+    const checkExpiry = options.checkExpiry ?? true;
+    if (checkExpiry && isManifestExpired(manifest, options.now ?? new Date())) {
+        return fail("expired", "Render manifest has expired.");
+    }
+    let canonicalPayloadHash;
+    try {
+        canonicalPayloadHash = await computeCanonicalPayloadHash(manifest, options.crypto);
+    }
+    catch (error) {
+        return fail("crypto_unavailable", error instanceof Error ? error.message : "Unable to hash manifest payload.");
+    }
+    if (canonicalPayloadHash !== manifest.integrity.canonicalPayloadHash) {
+        return fail("invalid_canonical_payload_hash", "Manifest canonical payload hash does not match payload.");
+    }
+    const publicKeyMaterial = await resolvePublicKey(manifest.signature.keyId, options.publicKeys);
+    if (!publicKeyMaterial)
+        return fail("missing_public_key", `No public key registered for keyId ${manifest.signature.keyId}.`);
+    const cryptoRuntime = getCrypto(options.crypto);
+    if (!cryptoRuntime?.subtle)
+        return fail("crypto_unavailable", "WebCrypto subtle crypto is unavailable.");
+    try {
+        const publicKey = await importPublicKey(publicKeyMaterial, cryptoRuntime);
+        const isValid = await cryptoRuntime.subtle.verify(ED25519_ALGORITHM, publicKey, toArrayBuffer(base64UrlToBytes(manifest.signature.value)), utf8ToBytes(canonicalizeManifestForSigning(manifest)));
+        if (!isValid)
+            return fail("invalid_signature", "Manifest signature is invalid.");
+    }
+    catch (error) {
+        return fail("invalid_key", error instanceof Error ? error.message : "Unable to import or verify public key.");
+    }
+    return { ok: true, manifest, canonicalPayloadHash };
+}
+export async function verifyAssetDigest(asset, bytes, cryptoImpl) {
+    if (asset.byteLength !== bytes.byteLength)
+        return false;
+    const digest = await sha256Hex(bytes, cryptoImpl);
+    return digest.toLowerCase() === asset.sha256.toLowerCase();
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,8BAA8B,GAAG,6BAAsC,CAAC;AACrF,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAkB,CAAC;AA8HhE,MAAM,iBAAiB,GAAc,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC;AAC7E,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C,SAAS,IAAI,CAAC,MAAmD,EAAE,OAAe;IAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC;IAC1B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IACpD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACjF,IAAI,UAAU,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACnF,oBAAoB,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAE9F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC;SACpD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD,OAAO,IAAI,OAAO;SACf,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;SACpF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC;IACzB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAQ,KAAK,CAAC,MAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,SAAS,CAAC,UAAmB;IACpC,OAAO,UAAU,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAA0B,EAAE,UAAmB;IACxE,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,aAAa,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAY,CAAC,CAAC;IAC1E,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAA0B,EAAE,UAAmB;IAC7E,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,QAAuE;IAC7F,MAAM,QAAQ,GAAG,EAAE,GAAI,QAAsC,EAAE,CAAC;IAChE,OAAQ,QAA+C,CAAC,SAAS,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAuE;IACtG,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,GAAG,QAAQ,CAAC,SAAS;YACrB,oBAAoB,EAAE,EAAE;SACzB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,QAAuE;IACpH,OAAO,gBAAgB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAuE,EACvE,UAAmB;IAEnB,OAAO,SAAS,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAA2C,EAC3C,UAAmB;IAEnB,MAAM,oBAAoB,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrF,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,GAAG,QAAQ,CAAC,SAAS;YACrB,oBAAoB;SACrB;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAA2C,EAAE,aAAqB;IAChG,IAAI,UAAU,YAAY,SAAS;QAAE,OAAO,UAAU,CAAC;IACvD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CACnC,OAAO,EACP,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAC3C,iBAAiB,EACjB,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAA0C,EAAE,aAAqB;IAC9F,IAAI,SAAS,YAAY,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CACnC,KAAK,EACL,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAC1C,iBAAiB,EACjB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAA2C,EAC3C,OAAkC;IAElC,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,aAAa,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAElE,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,WAAW,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,cAAqB,CAAC,CAAC;IAExG,OAAO;QACL,GAAG,gBAAgB;QACnB,SAAS,EAAE;YACT,GAAG,EAAE,6BAA6B;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;WACjC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;WAC3B,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC;WAC9B,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;WACrC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;WAChC,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,KAAK,8BAA8B;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;IACzH,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACjG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACrG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACzF,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IAC3J,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,OAAO,IAAI,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAEvG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IAC3F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IACnF,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACnI,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACpI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;IACzH,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAErH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAC/F,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClK,OAAO,IAAI,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;IAClI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC7G,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACjI,OAAO,IAAI,CAAC,eAAe,EAAE,4EAA4E,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACvF,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9H,OAAO,IAAI,CAAC,eAAe,EAAE,8DAA8D,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACxG,OAAO,IAAI,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,KAAK,6BAA6B;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IAC5H,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAC3G,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAE3G,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,KAAkC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,SAAS,CAAC,oBAAoB;KAC3D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAA2B;IACxE,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,SAAS,CAAC;IAC/F,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAmC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACrF,OAAO,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAc,EACd,OAAoC;IAEpC,MAAM,KAAK,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAChD,IAAI,WAAW,IAAI,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,oBAA4B,CAAC;IACjC,IAAI,CAAC;QACH,oBAAoB,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,oBAAoB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,oBAAoB,KAAK,QAAQ,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,gCAAgC,EAAE,yDAAyD,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC,oBAAoB,EAAE,sCAAsC,QAAQ,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC;IAE7H,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,aAAa,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC,oBAAoB,EAAE,yCAAyC,CAAC,CAAC;IAEzG,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,MAAM,CAC/C,iBAAiB,EACjB,SAAS,EACT,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EACzD,WAAW,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAQ,CAC7D,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC;IAChH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA0B,EAAE,KAAiB,EAAE,UAAmB;IACxG,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@vivipilot/render-manifest",
+  "version": "0.1.0",
+  "description": "Signed Vivipilot render manifest schema and verification helpers",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "keywords": [
+    "vivipilot",
+    "render-manifest",
+    "signature",
+    "local-rendering"
+  ],
+  "author": "",
+  "license": "ISC",
+  "devDependencies": {
+    "@types/node": "^25.2.0",
+    "typescript": "^5.3.0",
+    "vitest": "4.0.18"
+  }
+}

package/src/index.test.ts

@@ -0,0 +1,186 @@
+import { describe, expect, it } from "vitest";
+import {
+  RENDER_MANIFEST_SCHEMA_VERSION,
+  base64UrlToBytes,
+  bytesToBase64Url,
+  canonicalizeJson,
+  computeCanonicalPayloadHash,
+  sha256Hex,
+  signRenderManifest,
+  verifyAssetDigest,
+  verifyRenderManifest,
+  type UnsignedVivipilotRenderManifestV1,
+} from "./index";
+
+async function createTestKeyPair() {
+  const keyPair = await crypto.subtle.generateKey(
+    { name: "Ed25519" },
+    true,
+    ["sign", "verify"],
+  ) as CryptoKeyPair;
+
+  const publicKey = bytesToBase64Url(new Uint8Array(await crypto.subtle.exportKey("raw", keyPair.publicKey)));
+  const privateKey = bytesToBase64Url(new Uint8Array(await crypto.subtle.exportKey("pkcs8", keyPair.privateKey)));
+  return { publicKey, privateKey };
+}
+
+function baseManifest(): UnsignedVivipilotRenderManifestV1 {
+  return {
+    schema: RENDER_MANIFEST_SCHEMA_VERSION,
+    manifestId: "manifest_123",
+    generationId: "gen_123",
+    userId: "user_123",
+    projectId: "project_123",
+    createdAt: "2026-06-27T10:00:00.000Z",
+    engineVersion: "vivipilot-renderer@0.1.0",
+    entitlement: {
+      maxResolution: "1080p",
+      watermark: false,
+      commercialUse: true,
+      allowedFormats: ["mp4", "webm"],
+    },
+    billing: {
+      creditTransactionId: "txn_123",
+      creditsCharged: 40,
+      idempotencyKey: "idem_123",
+      creditSource: "paid_topup",
+    },
+    render: {
+      engine: "pixi-dw-scene-v1",
+      canvas: { width: 1280, height: 720, fps: 30 },
+      durationFrames: 120,
+      backgroundColor: "#ffffff",
+      overlays: [
+        {
+          id: "overlay_1",
+          type: "motion_graphics",
+          pixiScene: {
+            type: "pixi_scene",
+            schema: "vivipilot.pixi-motion.v1",
+            content: "Test scene",
+          },
+        },
+      ],
+      assets: [
+        {
+          assetId: "asset_1",
+          url: "https://cdn.example.com/immutable/asset_1.png",
+          sha256: "a".repeat(64),
+          mimeType: "image/png",
+          byteLength: 4,
+        },
+      ],
+    },
+    integrity: {
+      canonicalPayloadHash: "",
+      sceneHash: "b".repeat(64),
+    },
+  };
+}
+
+describe("render manifest canonicalization", () => {
+  it("canonicalizes object keys deterministically", () => {
+    expect(canonicalizeJson({ b: 1, a: { d: false, c: true } })).toBe('{"a":{"c":true,"d":false},"b":1}');
+    expect(canonicalizeJson({ a: { c: true, d: false }, b: 1 })).toBe('{"a":{"c":true,"d":false},"b":1}');
+  });
+
+  it("round-trips base64url bytes", () => {
+    const bytes = new Uint8Array([0, 1, 2, 250, 251, 252, 253, 254, 255]);
+    expect(base64UrlToBytes(bytesToBase64Url(bytes))).toEqual(bytes);
+  });
+});
+
+describe("render manifest signing", () => {
+  it("signs and verifies an untampered manifest", async () => {
+    const keys = await createTestKeyPair();
+    const signed = await signRenderManifest(baseManifest(), {
+      keyId: "test-key",
+      privateKey: keys.privateKey,
+    });
+
+    const result = await verifyRenderManifest(signed, {
+      publicKeys: { "test-key": keys.publicKey },
+      now: new Date("2026-06-27T10:01:00.000Z"),
+    });
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.canonicalPayloadHash).toBe(signed.integrity.canonicalPayloadHash);
+      expect(result.manifest.signature.keyId).toBe("test-key");
+    }
+  });
+
+  it("rejects a tampered manifest payload", async () => {
+    const keys = await createTestKeyPair();
+    const signed = await signRenderManifest(baseManifest(), {
+      keyId: "test-key",
+      privateKey: keys.privateKey,
+    });
+    const tampered = {
+      ...signed,
+      render: {
+        ...signed.render,
+        durationFrames: signed.render.durationFrames + 1,
+      },
+    };
+
+    const result = await verifyRenderManifest(tampered, {
+      publicKeys: { "test-key": keys.publicKey },
+      now: new Date("2026-06-27T10:01:00.000Z"),
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.reason).toBe("invalid_canonical_payload_hash");
+  });
+
+  it("rejects expired internal/test manifests when expiresAt is present", async () => {
+    const keys = await createTestKeyPair();
+    const signed = await signRenderManifest({
+      ...baseManifest(),
+      expiresAt: "2026-06-27T10:10:00.000Z",
+    }, {
+      keyId: "test-key",
+      privateKey: keys.privateKey,
+    });
+
+    const result = await verifyRenderManifest(signed, {
+      publicKeys: { "test-key": keys.publicKey },
+      now: new Date("2026-06-27T10:11:00.000Z"),
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.reason).toBe("expired");
+  });
+
+  it("hashes asset bytes for immutable media checks", async () => {
+    const bytes = new TextEncoder().encode("asset");
+    const asset = {
+      assetId: "asset_1",
+      url: "https://cdn.example.com/immutable/asset_1.txt",
+      sha256: await sha256Hex(bytes),
+      mimeType: "text/plain",
+      byteLength: bytes.byteLength,
+    };
+
+    expect(await verifyAssetDigest(asset, bytes)).toBe(true);
+    expect(await verifyAssetDigest(asset, new TextEncoder().encode("tampered"))).toBe(false);
+  });
+
+  it("computes a stable hash that excludes the signature and current hash field", async () => {
+    const keys = await createTestKeyPair();
+    const unsigned = baseManifest();
+    const signed = await signRenderManifest(unsigned, {
+      keyId: "test-key",
+      privateKey: keys.privateKey,
+    });
+
+    expect(await computeCanonicalPayloadHash(unsigned)).toBe(signed.integrity.canonicalPayloadHash);
+    expect(await computeCanonicalPayloadHash({
+      ...signed,
+      integrity: {
+        ...signed.integrity,
+        canonicalPayloadHash: "c".repeat(64),
+      },
+    })).toBe(signed.integrity.canonicalPayloadHash);
+  });
+});

package/src/index.ts

@@ -0,0 +1,444 @@
+export const RENDER_MANIFEST_SCHEMA_VERSION = "vivipilot.renderManifest.v1" as const;
+export const RENDER_MANIFEST_SIGNATURE_ALG = "Ed25519" as const;
+
+export type JsonPrimitive = null | boolean | number | string;
+export type JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue };
+export type JsonObject = { [key: string]: JsonValue };
+
+export type RenderManifestResolution = "720p" | "1080p" | "2k" | "4k";
+export type RenderManifestFormat = "mp4" | "webm" | "gif" | "mov";
+export type RenderManifestEngine = "pixi-dw-scene-v1" | "three-scene-v1" | "mixed";
+export type RenderManifestCreditSource = "paid_topup" | "paid_enterprise" | "internal_test";
+
+export type RenderManifestAsset = {
+  assetId: string;
+  url: string;
+  sha256: string;
+  mimeType: string;
+  byteLength: number;
+  role?: string;
+  cacheKey?: string;
+};
+
+export type RenderManifestEntitlement = {
+  maxResolution: RenderManifestResolution;
+  watermark: boolean;
+  commercialUse: boolean;
+  allowedFormats?: RenderManifestFormat[];
+};
+
+export type RenderManifestBilling = {
+  creditTransactionId: string;
+  creditsCharged: number;
+  idempotencyKey: string;
+  creditSource: RenderManifestCreditSource;
+};
+
+export type RenderManifestCanvas = {
+  width: number;
+  height: number;
+  fps: number;
+};
+
+export type RenderManifestRenderPayload = {
+  engine: RenderManifestEngine;
+  canvas: RenderManifestCanvas;
+  durationFrames: number;
+  backgroundColor?: string;
+  overlays: JsonValue[];
+  assets?: RenderManifestAsset[];
+  metadata?: JsonObject;
+};
+
+export type RenderManifestIntegrity = {
+  canonicalPayloadHash: string;
+  sceneHash: string;
+};
+
+export type RenderManifestSignature = {
+  alg: typeof RENDER_MANIFEST_SIGNATURE_ALG;
+  keyId: string;
+  value: string;
+};
+
+export type VivipilotRenderManifestV1 = {
+  schema: typeof RENDER_MANIFEST_SCHEMA_VERSION;
+  manifestId: string;
+  generationId: string;
+  userId: string;
+  projectId?: string;
+  createdAt: string;
+  expiresAt?: string;
+  engineVersion: string;
+  entitlement: RenderManifestEntitlement;
+  billing: RenderManifestBilling;
+  render: RenderManifestRenderPayload;
+  integrity: RenderManifestIntegrity;
+  signature: RenderManifestSignature;
+};
+
+export type UnsignedVivipilotRenderManifestV1 = Omit<VivipilotRenderManifestV1, "signature">;
+
+export type RenderManifestPublicKey = {
+  keyId: string;
+  publicKey: string;
+};
+
+export type PublicKeyResolver =
+  | Record<string, string>
+  | RenderManifestPublicKey[]
+  | ((keyId: string) => string | undefined | Promise<string | undefined>);
+
+export type SignRenderManifestOptions = {
+  keyId: string;
+  privateKey: CryptoKey | JsonWebKey | string;
+  crypto?: Crypto;
+};
+
+export type VerifyRenderManifestOptions = {
+  publicKeys: PublicKeyResolver;
+  crypto?: Crypto;
+  now?: Date;
+  checkExpiry?: boolean;
+};
+
+export type RenderManifestVerificationSuccess = {
+  ok: true;
+  manifest: VivipilotRenderManifestV1;
+  canonicalPayloadHash: string;
+};
+
+export type RenderManifestVerificationFailure = {
+  ok: false;
+  reason:
+    | "invalid_shape"
+    | "invalid_canonical_payload_hash"
+    | "invalid_signature"
+    | "missing_public_key"
+    | "expired"
+    | "crypto_unavailable"
+    | "invalid_key";
+  message: string;
+};
+
+export type RenderManifestVerificationResult =
+  | RenderManifestVerificationSuccess
+  | RenderManifestVerificationFailure;
+
+const ED25519_ALGORITHM: Algorithm = { name: RENDER_MANIFEST_SIGNATURE_ALG };
+const HEX_SHA256_PATTERN = /^[a-f0-9]{64}$/i;
+
+function fail(reason: RenderManifestVerificationFailure["reason"], message: string): RenderManifestVerificationFailure {
+  return { ok: false, reason, message };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0;
+}
+
+function isFinitePositiveNumber(value: unknown): value is number {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+
+function assertJsonCompatible(value: unknown, path = "$"): asserts value is JsonValue {
+  if (value === null) return;
+  const kind = typeof value;
+  if (kind === "string" || kind === "boolean") return;
+  if (kind === "number") {
+    if (!Number.isFinite(value)) throw new Error(`Non-finite number at ${path}`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => assertJsonCompatible(item, `${path}[${index}]`));
+    return;
+  }
+  if (kind === "object") {
+    for (const [key, entryValue] of Object.entries(value as Record<string, unknown>)) {
+      if (entryValue === undefined) throw new Error(`Undefined value at ${path}.${key}`);
+      assertJsonCompatible(entryValue, `${path}.${key}`);
+    }
+    return;
+  }
+  throw new Error(`Unsupported JSON value at ${path}`);
+}
+
+export function canonicalizeJson(value: unknown): string {
+  assertJsonCompatible(value);
+
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map((item) => canonicalizeJson(item)).join(",")}]`;
+
+  const entries = Object.entries(value)
+    .filter(([, entryValue]) => entryValue !== undefined)
+    .sort(([left], [right]) => left.localeCompare(right));
+
+  return `{${entries
+    .map(([key, entryValue]) => `${JSON.stringify(key)}:${canonicalizeJson(entryValue)}`)
+    .join(",")}}`;
+}
+
+function utf8ToBytes(value: string): Uint8Array {
+  return new TextEncoder().encode(value);
+}
+
+function bytesToBinary(bytes: Uint8Array): string {
+  const chunkSize = 0x8000;
+  let binary = "";
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    const chunk = bytes.slice(offset, offset + chunkSize);
+    binary += String.fromCharCode(...chunk);
+  }
+  return binary;
+}
+
+export function bytesToBase64Url(bytes: Uint8Array): string {
+  return btoa(bytesToBinary(bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+export function base64UrlToBytes(value: string): Uint8Array {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return (bytes.buffer as ArrayBuffer).slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+
+function getCrypto(cryptoImpl?: Crypto): Crypto | null {
+  return cryptoImpl ?? globalThis.crypto ?? null;
+}
+
+async function sha256Bytes(value: string | Uint8Array, cryptoImpl?: Crypto): Promise<Uint8Array> {
+  const cryptoRuntime = getCrypto(cryptoImpl);
+  if (!cryptoRuntime?.subtle) throw new Error("crypto_unavailable");
+  const input = typeof value === "string" ? utf8ToBytes(value) : value;
+  const digest = await cryptoRuntime.subtle.digest("SHA-256", input as any);
+  return new Uint8Array(digest);
+}
+
+export async function sha256Hex(value: string | Uint8Array, cryptoImpl?: Crypto): Promise<string> {
+  const bytes = await sha256Bytes(value, cryptoImpl);
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function stripSignature(manifest: VivipilotRenderManifestV1 | UnsignedVivipilotRenderManifestV1): UnsignedVivipilotRenderManifestV1 {
+  const unsigned = { ...(manifest as VivipilotRenderManifestV1) };
+  delete (unsigned as Partial<VivipilotRenderManifestV1>).signature;
+  return unsigned;
+}
+
+function payloadForCanonicalHash(manifest: VivipilotRenderManifestV1 | UnsignedVivipilotRenderManifestV1): UnsignedVivipilotRenderManifestV1 {
+  const unsigned = stripSignature(manifest);
+  return {
+    ...unsigned,
+    integrity: {
+      ...unsigned.integrity,
+      canonicalPayloadHash: "",
+    },
+  };
+}
+
+export function canonicalizeManifestForSigning(manifest: VivipilotRenderManifestV1 | UnsignedVivipilotRenderManifestV1): string {
+  return canonicalizeJson(stripSignature(manifest));
+}
+
+export async function computeCanonicalPayloadHash(
+  manifest: VivipilotRenderManifestV1 | UnsignedVivipilotRenderManifestV1,
+  cryptoImpl?: Crypto,
+): Promise<string> {
+  return sha256Hex(canonicalizeJson(payloadForCanonicalHash(manifest)), cryptoImpl);
+}
+
+export async function withCanonicalPayloadHash(
+  manifest: UnsignedVivipilotRenderManifestV1,
+  cryptoImpl?: Crypto,
+): Promise<UnsignedVivipilotRenderManifestV1> {
+  const canonicalPayloadHash = await computeCanonicalPayloadHash(manifest, cryptoImpl);
+  return {
+    ...manifest,
+    integrity: {
+      ...manifest.integrity,
+      canonicalPayloadHash,
+    },
+  };
+}
+
+async function importPrivateKey(privateKey: CryptoKey | JsonWebKey | string, cryptoRuntime: Crypto): Promise<CryptoKey> {
+  if (privateKey instanceof CryptoKey) return privateKey;
+  if (typeof privateKey === "string") {
+    return cryptoRuntime.subtle.importKey(
+      "pkcs8",
+      toArrayBuffer(base64UrlToBytes(privateKey)),
+      ED25519_ALGORITHM,
+      false,
+      ["sign"],
+    );
+  }
+  return cryptoRuntime.subtle.importKey("jwk", privateKey, ED25519_ALGORITHM, false, ["sign"]);
+}
+
+async function importPublicKey(publicKey: CryptoKey | JsonWebKey | string, cryptoRuntime: Crypto): Promise<CryptoKey> {
+  if (publicKey instanceof CryptoKey) return publicKey;
+  if (typeof publicKey === "string") {
+    return cryptoRuntime.subtle.importKey(
+      "raw",
+      toArrayBuffer(base64UrlToBytes(publicKey)),
+      ED25519_ALGORITHM,
+      false,
+      ["verify"],
+    );
+  }
+  return cryptoRuntime.subtle.importKey("jwk", publicKey, ED25519_ALGORITHM, false, ["verify"]);
+}
+
+export async function signRenderManifest(
+  manifest: UnsignedVivipilotRenderManifestV1,
+  options: SignRenderManifestOptions,
+): Promise<VivipilotRenderManifestV1> {
+  const cryptoRuntime = getCrypto(options.crypto);
+  if (!cryptoRuntime?.subtle) throw new Error("crypto_unavailable");
+
+  const preparedManifest = await withCanonicalPayloadHash(manifest, cryptoRuntime);
+  const signingPayload = utf8ToBytes(canonicalizeManifestForSigning(preparedManifest));
+  const privateKey = await importPrivateKey(options.privateKey, cryptoRuntime);
+  const signature = await cryptoRuntime.subtle.sign(ED25519_ALGORITHM, privateKey, signingPayload as any);
+
+  return {
+    ...preparedManifest,
+    signature: {
+      alg: RENDER_MANIFEST_SIGNATURE_ALG,
+      keyId: options.keyId,
+      value: bytesToBase64Url(new Uint8Array(signature)),
+    },
+  };
+}
+
+function validateAssetShape(asset: unknown): boolean {
+  if (!isRecord(asset)) return false;
+  return isNonEmptyString(asset.assetId)
+    && isNonEmptyString(asset.url)
+    && isNonEmptyString(asset.sha256)
+    && HEX_SHA256_PATTERN.test(asset.sha256)
+    && isNonEmptyString(asset.mimeType)
+    && isFinitePositiveNumber(asset.byteLength);
+}
+
+export function validateRenderManifestShape(value: unknown): RenderManifestVerificationResult {
+  if (!isRecord(value)) return fail("invalid_shape", "Manifest must be an object.");
+  if (value.schema !== RENDER_MANIFEST_SCHEMA_VERSION) return fail("invalid_shape", "Unsupported render manifest schema.");
+  if (!isNonEmptyString(value.manifestId)) return fail("invalid_shape", "manifestId is required.");
+  if (!isNonEmptyString(value.generationId)) return fail("invalid_shape", "generationId is required.");
+  if (!isNonEmptyString(value.userId)) return fail("invalid_shape", "userId is required.");
+  if (!isNonEmptyString(value.createdAt) || Number.isNaN(Date.parse(value.createdAt))) return fail("invalid_shape", "createdAt must be an ISO date string.");
+  if (value.expiresAt !== undefined && (!isNonEmptyString(value.expiresAt) || Number.isNaN(Date.parse(value.expiresAt)))) {
+    return fail("invalid_shape", "expiresAt must be an ISO date string when provided.");
+  }
+  if (!isNonEmptyString(value.engineVersion)) return fail("invalid_shape", "engineVersion is required.");
+
+  if (!isRecord(value.entitlement)) return fail("invalid_shape", "entitlement is required.");
+  if (!isRecord(value.billing)) return fail("invalid_shape", "billing is required.");
+  if (!isNonEmptyString(value.billing.creditTransactionId)) return fail("invalid_shape", "billing.creditTransactionId is required.");
+  if (!isFinitePositiveNumber(value.billing.creditsCharged)) return fail("invalid_shape", "billing.creditsCharged must be positive.");
+  if (!isNonEmptyString(value.billing.idempotencyKey)) return fail("invalid_shape", "billing.idempotencyKey is required.");
+  if (!isNonEmptyString(value.billing.creditSource)) return fail("invalid_shape", "billing.creditSource is required.");
+
+  if (!isRecord(value.render)) return fail("invalid_shape", "render payload is required.");
+  if (!isRecord(value.render.canvas)) return fail("invalid_shape", "render.canvas is required.");
+  if (!isFinitePositiveNumber(value.render.canvas.width) || !isFinitePositiveNumber(value.render.canvas.height) || !isFinitePositiveNumber(value.render.canvas.fps)) {
+    return fail("invalid_shape", "render.canvas dimensions and fps must be positive.");
+  }
+  if (!isFinitePositiveNumber(value.render.durationFrames)) return fail("invalid_shape", "render.durationFrames must be positive.");
+  if (!Array.isArray(value.render.overlays)) return fail("invalid_shape", "render.overlays must be an array.");
+  if (value.render.assets !== undefined && (!Array.isArray(value.render.assets) || !value.render.assets.every(validateAssetShape))) {
+    return fail("invalid_shape", "render.assets must contain immutable asset references with SHA-256 hashes.");
+  }
+
+  if (!isRecord(value.integrity)) return fail("invalid_shape", "integrity is required.");
+  if (!isNonEmptyString(value.integrity.canonicalPayloadHash) || !HEX_SHA256_PATTERN.test(value.integrity.canonicalPayloadHash)) {
+    return fail("invalid_shape", "integrity.canonicalPayloadHash must be a SHA-256 hex digest.");
+  }
+  if (!isNonEmptyString(value.integrity.sceneHash) || !HEX_SHA256_PATTERN.test(value.integrity.sceneHash)) {
+    return fail("invalid_shape", "integrity.sceneHash must be a SHA-256 hex digest.");
+  }
+
+  if (!isRecord(value.signature)) return fail("invalid_shape", "signature is required.");
+  if (value.signature.alg !== RENDER_MANIFEST_SIGNATURE_ALG) return fail("invalid_shape", "Unsupported signature algorithm.");
+  if (!isNonEmptyString(value.signature.keyId)) return fail("invalid_shape", "signature.keyId is required.");
+  if (!isNonEmptyString(value.signature.value)) return fail("invalid_shape", "signature.value is required.");
+
+  return {
+    ok: true,
+    manifest: value as VivipilotRenderManifestV1,
+    canonicalPayloadHash: value.integrity.canonicalPayloadHash,
+  };
+}
+
+async function resolvePublicKey(keyId: string, resolver: PublicKeyResolver): Promise<string | undefined> {
+  if (typeof resolver === "function") return resolver(keyId);
+  if (Array.isArray(resolver)) return resolver.find((entry) => entry.keyId === keyId)?.publicKey;
+  return resolver[keyId];
+}
+
+export function isManifestExpired(manifest: VivipilotRenderManifestV1, now = new Date()): boolean {
+  return typeof manifest.expiresAt === "string" && Date.parse(manifest.expiresAt) <= now.getTime();
+}
+
+export async function verifyRenderManifest(
+  value: unknown,
+  options: VerifyRenderManifestOptions,
+): Promise<RenderManifestVerificationResult> {
+  const shape = validateRenderManifestShape(value);
+  if (!shape.ok) return shape;
+
+  const manifest = shape.manifest;
+  const checkExpiry = options.checkExpiry ?? true;
+  if (checkExpiry && isManifestExpired(manifest, options.now ?? new Date())) {
+    return fail("expired", "Render manifest has expired.");
+  }
+
+  let canonicalPayloadHash: string;
+  try {
+    canonicalPayloadHash = await computeCanonicalPayloadHash(manifest, options.crypto);
+  } catch (error) {
+    return fail("crypto_unavailable", error instanceof Error ? error.message : "Unable to hash manifest payload.");
+  }
+
+  if (canonicalPayloadHash !== manifest.integrity.canonicalPayloadHash) {
+    return fail("invalid_canonical_payload_hash", "Manifest canonical payload hash does not match payload.");
+  }
+
+  const publicKeyMaterial = await resolvePublicKey(manifest.signature.keyId, options.publicKeys);
+  if (!publicKeyMaterial) return fail("missing_public_key", `No public key registered for keyId ${manifest.signature.keyId}.`);
+
+  const cryptoRuntime = getCrypto(options.crypto);
+  if (!cryptoRuntime?.subtle) return fail("crypto_unavailable", "WebCrypto subtle crypto is unavailable.");
+
+  try {
+    const publicKey = await importPublicKey(publicKeyMaterial, cryptoRuntime);
+    const isValid = await cryptoRuntime.subtle.verify(
+      ED25519_ALGORITHM,
+      publicKey,
+      toArrayBuffer(base64UrlToBytes(manifest.signature.value)),
+      utf8ToBytes(canonicalizeManifestForSigning(manifest)) as any,
+    );
+    if (!isValid) return fail("invalid_signature", "Manifest signature is invalid.");
+  } catch (error) {
+    return fail("invalid_key", error instanceof Error ? error.message : "Unable to import or verify public key.");
+  }
+
+  return { ok: true, manifest, canonicalPayloadHash };
+}
+
+export async function verifyAssetDigest(asset: RenderManifestAsset, bytes: Uint8Array, cryptoImpl?: Crypto): Promise<boolean> {
+  if (asset.byteLength !== bytes.byteLength) return false;
+  const digest = await sha256Hex(bytes, cryptoImpl);
+  return digest.toLowerCase() === asset.sha256.toLowerCase();
+}

package/tsconfig.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2020", "DOM"],
+    "strict": true,
+    "noImplicitAny": true,
+    "strictNullChecks": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "isolatedModules": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/*.test.ts", "**/*.spec.ts"]
+}