@vritti/api-sdk 0.3.2 → 0.3.3

package/dist/document-BoS0NIbf.d.cts

@@ -0,0 +1,12 @@
+interface SignedDocument<T> {
+    payload: T;
+    signature: string;
+}
+declare function generateSigningKeyPair(): {
+    privateKey: string;
+    publicKey: string;
+};
+declare function signDocument<T>(payload: T, privateKeyBase64: string): SignedDocument<T>;
+declare function verifyDocument<T>(doc: SignedDocument<T>, publicKeyBase64: string): boolean;
+
+export { type SignedDocument as S, generateSigningKeyPair as g, signDocument as s, verifyDocument as v };

package/dist/document-BoS0NIbf.d.ts

@@ -0,0 +1,12 @@
+interface SignedDocument<T> {
+    payload: T;
+    signature: string;
+}
+declare function generateSigningKeyPair(): {
+    privateKey: string;
+    publicKey: string;
+};
+declare function signDocument<T>(payload: T, privateKeyBase64: string): SignedDocument<T>;
+declare function verifyDocument<T>(doc: SignedDocument<T>, publicKeyBase64: string): boolean;
+
+export { type SignedDocument as S, generateSigningKeyPair as g, signDocument as s, verifyDocument as v };

package/dist/license.cjs

@@ -21,24 +21,18 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/license/index.ts
 var license_exports = {};
 __export(license_exports, {
-  canonicalStringify: () => canonicalStringify,
-  generateLicenseKeyPair: () => generateLicenseKeyPair,
-  hashSnapshot: () => hashSnapshot,
-  signDocument: () => signDocument,
-  verifyDocument: () => verifyDocument
+  hashSnapshot: () => hashSnapshot
 });
 module.exports = __toCommonJS(license_exports);
 
-// src/license/canonical.ts
+// src/license/hash.ts
 var import_node_crypto = require("crypto");
+
+// src/signing/canonical.ts
 function canonicalStringify(value) {
   return JSON.stringify(sortKeysDeep(value));
 }
 __name(canonicalStringify, "canonicalStringify");
-function hashSnapshot(value) {
-  return (0, import_node_crypto.createHash)("sha256").update(canonicalStringify(value), "utf8").digest("hex");
-}
-__name(hashSnapshot, "hashSnapshot");
 function sortKeysDeep(value) {
   if (Array.isArray(value)) return value.map(sortKeysDeep);
   if (value !== null && typeof value === "object") {
@@ -51,54 +45,13 @@ function sortKeysDeep(value) {
 }
 __name(sortKeysDeep, "sortKeysDeep");
 
-// src/license/signing.ts
-var import_node_crypto2 = require("crypto");
-function generateLicenseKeyPair() {
-  const { privateKey, publicKey } = (0, import_node_crypto2.generateKeyPairSync)("ed25519");
-  return {
-    privateKey: privateKey.export({
-      type: "pkcs8",
-      format: "der"
-    }).toString("base64"),
-    publicKey: publicKey.export({
-      type: "spki",
-      format: "der"
-    }).toString("base64")
-  };
-}
-__name(generateLicenseKeyPair, "generateLicenseKeyPair");
-function signDocument(payload, privateKeyBase64) {
-  const key = (0, import_node_crypto2.createPrivateKey)({
-    key: Buffer.from(privateKeyBase64, "base64"),
-    format: "der",
-    type: "pkcs8"
-  });
-  const signature = (0, import_node_crypto2.sign)(null, Buffer.from(canonicalStringify(payload), "utf8"), key).toString("base64");
-  return {
-    payload,
-    signature
-  };
-}
-__name(signDocument, "signDocument");
-function verifyDocument(doc, publicKeyBase64) {
-  try {
-    const key = (0, import_node_crypto2.createPublicKey)({
-      key: Buffer.from(publicKeyBase64, "base64"),
-      format: "der",
-      type: "spki"
-    });
-    return (0, import_node_crypto2.verify)(null, Buffer.from(canonicalStringify(doc.payload), "utf8"), key, Buffer.from(doc.signature, "base64"));
-  } catch {
-    return false;
-  }
+// src/license/hash.ts
+function hashSnapshot(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(canonicalStringify(value), "utf8").digest("hex");
 }
-__name(verifyDocument, "verifyDocument");
+__name(hashSnapshot, "hashSnapshot");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  canonicalStringify,
-  generateLicenseKeyPair,
-  hashSnapshot,
-  signDocument,
-  verifyDocument
+  hashSnapshot
 });
 //# sourceMappingURL=license.cjs.map

package/dist/license.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/license/index.ts","../src/license/canonical.ts","../src/license/signing.ts"],"sourcesContent":["// License module — Ed25519-signed catalog + entitlement documents over canonical JSON\nexport { canonicalStringify, hashSnapshot } from './canonical';\nexport { generateLicenseKeyPair, signDocument, verifyDocument } from './signing';\nexport type { CatalogLicense, OrgEntitlement, SignedDocument } from './types';\n","import { createHash } from 'node:crypto';\n\n// Serializes a value as deterministic JSON: object keys recursively sorted, arrays keep their order\nexport function canonicalStringify(value: unknown): string {\n  return JSON.stringify(sortKeysDeep(value));\n}\n\n// Computes the sha256 hex digest of a value's canonical JSON\nexport function hashSnapshot(value: unknown): string {\n  return createHash('sha256').update(canonicalStringify(value), 'utf8').digest('hex');\n}\n\n// Recursively rebuilds objects with sorted keys so JSON.stringify output is order-independent\nfunction sortKeysDeep(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortKeysDeep);\n  if (value !== null && typeof value === 'object') {\n    const record = value as Record<string, unknown>;\n    const sorted: Record<string, unknown> = {};\n    for (const key of Object.keys(record).sort()) sorted[key] = sortKeysDeep(record[key]);\n    return sorted;\n  }\n  return value;\n}\n","import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from 'node:crypto';\nimport { canonicalStringify } from './canonical';\nimport type { SignedDocument } from './types';\n\n// Generates an Ed25519 key pair as base64 DER strings (pkcs8 private / spki public)\nexport function generateLicenseKeyPair(): { privateKey: string; publicKey: string } {\n  const { privateKey, publicKey } = generateKeyPairSync('ed25519');\n  return {\n    privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }).toString('base64'),\n    publicKey: publicKey.export({ type: 'spki', format: 'der' }).toString('base64'),\n  };\n}\n\n// Signs a payload's canonical JSON with an Ed25519 private key (base64 pkcs8 DER)\nexport function signDocument<T>(payload: T, privateKeyBase64: string): SignedDocument<T> {\n  const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, 'base64'), format: 'der', type: 'pkcs8' });\n  const signature = sign(null, Buffer.from(canonicalStringify(payload), 'utf8'), key).toString('base64');\n  return { payload, signature };\n}\n\n// Verifies a signed document against an Ed25519 public key (base64 spki DER); malformed input ⇒ false\nexport function verifyDocument<T>(doc: SignedDocument<T>, publicKeyBase64: string): boolean {\n  try {\n    const key = createPublicKey({ key: Buffer.from(publicKeyBase64, 'base64'), format: 'der', type: 'spki' });\n    return verify(\n      null,\n      Buffer.from(canonicalStringify(doc.payload), 'utf8'),\n      key,\n      Buffer.from(doc.signature, 'base64'),\n    );\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;ACAA,yBAA2B;AAGpB,SAASA,mBAAmBC,OAAc;AAC/C,SAAOC,KAAKC,UAAUC,aAAaH,KAAAA,CAAAA;AACrC;AAFgBD;AAKT,SAASK,aAAaJ,OAAc;AACzC,aAAOK,+BAAW,QAAA,EAAUC,OAAOP,mBAAmBC,KAAAA,GAAQ,MAAA,EAAQO,OAAO,KAAA;AAC/E;AAFgBH;AAKhB,SAASD,aAAaH,OAAc;AAClC,MAAIQ,MAAMC,QAAQT,KAAAA,EAAQ,QAAOA,MAAMU,IAAIP,YAAAA;AAC3C,MAAIH,UAAU,QAAQ,OAAOA,UAAU,UAAU;AAC/C,UAAMW,SAASX;AACf,UAAMY,SAAkC,CAAC;AACzC,eAAWC,OAAOC,OAAOC,KAAKJ,MAAAA,EAAQK,KAAI,EAAIJ,QAAOC,GAAAA,IAAOV,aAAaQ,OAAOE,GAAAA,CAAI;AACpF,WAAOD;EACT;AACA,SAAOZ;AACT;AATSG;;;ACbT,IAAAc,sBAAqF;AAK9E,SAASC,yBAAAA;AACd,QAAM,EAAEC,YAAYC,UAAS,QAAKC,yCAAoB,SAAA;AACtD,SAAO;IACLF,YAAYA,WAAWG,OAAO;MAAEC,MAAM;MAASC,QAAQ;IAAM,CAAA,EAAGC,SAAS,QAAA;IACzEL,WAAWA,UAAUE,OAAO;MAAEC,MAAM;MAAQC,QAAQ;IAAM,CAAA,EAAGC,SAAS,QAAA;EACxE;AACF;AANgBP;AAST,SAASQ,aAAgBC,SAAYC,kBAAwB;AAClE,QAAMC,UAAMC,sCAAiB;IAAED,KAAKE,OAAOC,KAAKJ,kBAAkB,QAAA;IAAWJ,QAAQ;IAAOD,MAAM;EAAQ,CAAA;AAC1G,QAAMU,gBAAYC,0BAAK,MAAMH,OAAOC,KAAKG,mBAAmBR,OAAAA,GAAU,MAAA,GAASE,GAAAA,EAAKJ,SAAS,QAAA;AAC7F,SAAO;IAAEE;IAASM;EAAU;AAC9B;AAJgBP;AAOT,SAASU,eAAkBC,KAAwBC,iBAAuB;AAC/E,MAAI;AACF,UAAMT,UAAMU,qCAAgB;MAAEV,KAAKE,OAAOC,KAAKM,iBAAiB,QAAA;MAAWd,QAAQ;MAAOD,MAAM;IAAO,CAAA;AACvG,eAAOiB,4BACL,MACAT,OAAOC,KAAKG,mBAAmBE,IAAIV,OAAO,GAAG,MAAA,GAC7CE,KACAE,OAAOC,KAAKK,IAAIJ,WAAW,QAAA,CAAA;EAE/B,QAAQ;AACN,WAAO;EACT;AACF;AAZgBG;","names":["canonicalStringify","value","JSON","stringify","sortKeysDeep","hashSnapshot","createHash","update","digest","Array","isArray","map","record","sorted","key","Object","keys","sort","import_node_crypto","generateLicenseKeyPair","privateKey","publicKey","generateKeyPairSync","export","type","format","toString","signDocument","payload","privateKeyBase64","key","createPrivateKey","Buffer","from","signature","sign","canonicalStringify","verifyDocument","doc","publicKeyBase64","createPublicKey","verify"]}
+{"version":3,"sources":["../src/license/index.ts","../src/license/hash.ts","../src/signing/canonical.ts"],"sourcesContent":["// License module — licensing artifacts: signed catalog/entitlement document types and snapshot hashing\nexport { hashSnapshot } from './hash';\nexport type { CatalogLicense, OrgEntitlement, SignedDocument } from './types';\n","import { createHash } from 'node:crypto';\nimport { canonicalStringify } from '../signing/canonical';\n\n// Computes the sha256 hex digest of a value's canonical JSON — idempotency key for catalog snapshots\nexport function hashSnapshot(value: unknown): string {\n  return createHash('sha256').update(canonicalStringify(value), 'utf8').digest('hex');\n}\n","// Serializes a value as deterministic JSON: object keys recursively sorted, arrays keep their order\nexport function canonicalStringify(value: unknown): string {\n  return JSON.stringify(sortKeysDeep(value));\n}\n\n// Recursively rebuilds objects with sorted keys so JSON.stringify output is order-independent\nfunction sortKeysDeep(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortKeysDeep);\n  if (value !== null && typeof value === 'object') {\n    const record = value as Record<string, unknown>;\n    const sorted: Record<string, unknown> = {};\n    for (const key of Object.keys(record).sort()) sorted[key] = sortKeysDeep(record[key]);\n    return sorted;\n  }\n  return value;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACAA,yBAA2B;;;ACCpB,SAASA,mBAAmBC,OAAc;AAC/C,SAAOC,KAAKC,UAAUC,aAAaH,KAAAA,CAAAA;AACrC;AAFgBD;AAKhB,SAASI,aAAaH,OAAc;AAClC,MAAII,MAAMC,QAAQL,KAAAA,EAAQ,QAAOA,MAAMM,IAAIH,YAAAA;AAC3C,MAAIH,UAAU,QAAQ,OAAOA,UAAU,UAAU;AAC/C,UAAMO,SAASP;AACf,UAAMQ,SAAkC,CAAC;AACzC,eAAWC,OAAOC,OAAOC,KAAKJ,MAAAA,EAAQK,KAAI,EAAIJ,QAAOC,GAAAA,IAAON,aAAaI,OAAOE,GAAAA,CAAI;AACpF,WAAOD;EACT;AACA,SAAOR;AACT;AATSG;;;ADFF,SAASU,aAAaC,OAAc;AACzC,aAAOC,+BAAW,QAAA,EAAUC,OAAOC,mBAAmBH,KAAAA,GAAQ,MAAA,EAAQI,OAAO,KAAA;AAC/E;AAFgBL;","names":["canonicalStringify","value","JSON","stringify","sortKeysDeep","Array","isArray","map","record","sorted","key","Object","keys","sort","hashSnapshot","value","createHash","update","canonicalStringify","digest"]}

package/dist/license.d.cts

@@ -1,12 +1,8 @@
 import { V as VersionSnapshot } from './types-DQRwj5rr.cjs';
+export { S as SignedDocument } from './document-BoS0NIbf.cjs';
 
-declare function canonicalStringify(value: unknown): string;
 declare function hashSnapshot(value: unknown): string;
 
-interface SignedDocument<T> {
-    payload: T;
-    signature: string;
-}
 interface CatalogLicense {
     deploymentId: string;
     version: string;
@@ -22,11 +18,4 @@ interface OrgEntitlement {
     issuedAt: string;
 }
 
-declare function generateLicenseKeyPair(): {
-    privateKey: string;
-    publicKey: string;
-};
-declare function signDocument<T>(payload: T, privateKeyBase64: string): SignedDocument<T>;
-declare function verifyDocument<T>(doc: SignedDocument<T>, publicKeyBase64: string): boolean;
-
-export { type CatalogLicense, type OrgEntitlement, type SignedDocument, canonicalStringify, generateLicenseKeyPair, hashSnapshot, signDocument, verifyDocument };
+export { type CatalogLicense, type OrgEntitlement, hashSnapshot };

package/dist/license.d.ts

@@ -1,12 +1,8 @@
 import { V as VersionSnapshot } from './types-DQRwj5rr.js';
+export { S as SignedDocument } from './document-BoS0NIbf.js';
 
-declare function canonicalStringify(value: unknown): string;
 declare function hashSnapshot(value: unknown): string;
 
-interface SignedDocument<T> {
-    payload: T;
-    signature: string;
-}
 interface CatalogLicense {
     deploymentId: string;
     version: string;
@@ -22,11 +18,4 @@ interface OrgEntitlement {
     issuedAt: string;
 }
 
-declare function generateLicenseKeyPair(): {
-    privateKey: string;
-    publicKey: string;
-};
-declare function signDocument<T>(payload: T, privateKeyBase64: string): SignedDocument<T>;
-declare function verifyDocument<T>(doc: SignedDocument<T>, publicKeyBase64: string): boolean;
-
-export { type CatalogLicense, type OrgEntitlement, type SignedDocument, canonicalStringify, generateLicenseKeyPair, hashSnapshot, signDocument, verifyDocument };
+export { type CatalogLicense, type OrgEntitlement, hashSnapshot };

package/dist/license.js

@@ -1,16 +1,14 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
-// src/license/canonical.ts
+// src/license/hash.ts
 import { createHash } from "crypto";
+
+// src/signing/canonical.ts
 function canonicalStringify(value) {
   return JSON.stringify(sortKeysDeep(value));
 }
 __name(canonicalStringify, "canonicalStringify");
-function hashSnapshot(value) {
-  return createHash("sha256").update(canonicalStringify(value), "utf8").digest("hex");
-}
-__name(hashSnapshot, "hashSnapshot");
 function sortKeysDeep(value) {
   if (Array.isArray(value)) return value.map(sortKeysDeep);
   if (value !== null && typeof value === "object") {
@@ -23,53 +21,12 @@ function sortKeysDeep(value) {
 }
 __name(sortKeysDeep, "sortKeysDeep");
 
-// src/license/signing.ts
-import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "crypto";
-function generateLicenseKeyPair() {
-  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
-  return {
-    privateKey: privateKey.export({
-      type: "pkcs8",
-      format: "der"
-    }).toString("base64"),
-    publicKey: publicKey.export({
-      type: "spki",
-      format: "der"
-    }).toString("base64")
-  };
-}
-__name(generateLicenseKeyPair, "generateLicenseKeyPair");
-function signDocument(payload, privateKeyBase64) {
-  const key = createPrivateKey({
-    key: Buffer.from(privateKeyBase64, "base64"),
-    format: "der",
-    type: "pkcs8"
-  });
-  const signature = sign(null, Buffer.from(canonicalStringify(payload), "utf8"), key).toString("base64");
-  return {
-    payload,
-    signature
-  };
-}
-__name(signDocument, "signDocument");
-function verifyDocument(doc, publicKeyBase64) {
-  try {
-    const key = createPublicKey({
-      key: Buffer.from(publicKeyBase64, "base64"),
-      format: "der",
-      type: "spki"
-    });
-    return verify(null, Buffer.from(canonicalStringify(doc.payload), "utf8"), key, Buffer.from(doc.signature, "base64"));
-  } catch {
-    return false;
-  }
+// src/license/hash.ts
+function hashSnapshot(value) {
+  return createHash("sha256").update(canonicalStringify(value), "utf8").digest("hex");
 }
-__name(verifyDocument, "verifyDocument");
+__name(hashSnapshot, "hashSnapshot");
 export {
-  canonicalStringify,
-  generateLicenseKeyPair,
-  hashSnapshot,
-  signDocument,
-  verifyDocument
+  hashSnapshot
 };
 //# sourceMappingURL=license.js.map

package/dist/license.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/license/canonical.ts","../src/license/signing.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\n// Serializes a value as deterministic JSON: object keys recursively sorted, arrays keep their order\nexport function canonicalStringify(value: unknown): string {\n  return JSON.stringify(sortKeysDeep(value));\n}\n\n// Computes the sha256 hex digest of a value's canonical JSON\nexport function hashSnapshot(value: unknown): string {\n  return createHash('sha256').update(canonicalStringify(value), 'utf8').digest('hex');\n}\n\n// Recursively rebuilds objects with sorted keys so JSON.stringify output is order-independent\nfunction sortKeysDeep(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortKeysDeep);\n  if (value !== null && typeof value === 'object') {\n    const record = value as Record<string, unknown>;\n    const sorted: Record<string, unknown> = {};\n    for (const key of Object.keys(record).sort()) sorted[key] = sortKeysDeep(record[key]);\n    return sorted;\n  }\n  return value;\n}\n","import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from 'node:crypto';\nimport { canonicalStringify } from './canonical';\nimport type { SignedDocument } from './types';\n\n// Generates an Ed25519 key pair as base64 DER strings (pkcs8 private / spki public)\nexport function generateLicenseKeyPair(): { privateKey: string; publicKey: string } {\n  const { privateKey, publicKey } = generateKeyPairSync('ed25519');\n  return {\n    privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }).toString('base64'),\n    publicKey: publicKey.export({ type: 'spki', format: 'der' }).toString('base64'),\n  };\n}\n\n// Signs a payload's canonical JSON with an Ed25519 private key (base64 pkcs8 DER)\nexport function signDocument<T>(payload: T, privateKeyBase64: string): SignedDocument<T> {\n  const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, 'base64'), format: 'der', type: 'pkcs8' });\n  const signature = sign(null, Buffer.from(canonicalStringify(payload), 'utf8'), key).toString('base64');\n  return { payload, signature };\n}\n\n// Verifies a signed document against an Ed25519 public key (base64 spki DER); malformed input ⇒ false\nexport function verifyDocument<T>(doc: SignedDocument<T>, publicKeyBase64: string): boolean {\n  try {\n    const key = createPublicKey({ key: Buffer.from(publicKeyBase64, 'base64'), format: 'der', type: 'spki' });\n    return verify(\n      null,\n      Buffer.from(canonicalStringify(doc.payload), 'utf8'),\n      key,\n      Buffer.from(doc.signature, 'base64'),\n    );\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;AAAA,SAASA,kBAAkB;AAGpB,SAASC,mBAAmBC,OAAc;AAC/C,SAAOC,KAAKC,UAAUC,aAAaH,KAAAA,CAAAA;AACrC;AAFgBD;AAKT,SAASK,aAAaJ,OAAc;AACzC,SAAOK,WAAW,QAAA,EAAUC,OAAOP,mBAAmBC,KAAAA,GAAQ,MAAA,EAAQO,OAAO,KAAA;AAC/E;AAFgBH;AAKhB,SAASD,aAAaH,OAAc;AAClC,MAAIQ,MAAMC,QAAQT,KAAAA,EAAQ,QAAOA,MAAMU,IAAIP,YAAAA;AAC3C,MAAIH,UAAU,QAAQ,OAAOA,UAAU,UAAU;AAC/C,UAAMW,SAASX;AACf,UAAMY,SAAkC,CAAC;AACzC,eAAWC,OAAOC,OAAOC,KAAKJ,MAAAA,EAAQK,KAAI,EAAIJ,QAAOC,GAAAA,IAAOV,aAAaQ,OAAOE,GAAAA,CAAI;AACpF,WAAOD;EACT;AACA,SAAOZ;AACT;AATSG;;;ACbT,SAASc,kBAAkBC,iBAAiBC,qBAAqBC,MAAMC,cAAc;AAK9E,SAASC,yBAAAA;AACd,QAAM,EAAEC,YAAYC,UAAS,IAAKC,oBAAoB,SAAA;AACtD,SAAO;IACLF,YAAYA,WAAWG,OAAO;MAAEC,MAAM;MAASC,QAAQ;IAAM,CAAA,EAAGC,SAAS,QAAA;IACzEL,WAAWA,UAAUE,OAAO;MAAEC,MAAM;MAAQC,QAAQ;IAAM,CAAA,EAAGC,SAAS,QAAA;EACxE;AACF;AANgBP;AAST,SAASQ,aAAgBC,SAAYC,kBAAwB;AAClE,QAAMC,MAAMC,iBAAiB;IAAED,KAAKE,OAAOC,KAAKJ,kBAAkB,QAAA;IAAWJ,QAAQ;IAAOD,MAAM;EAAQ,CAAA;AAC1G,QAAMU,YAAYC,KAAK,MAAMH,OAAOC,KAAKG,mBAAmBR,OAAAA,GAAU,MAAA,GAASE,GAAAA,EAAKJ,SAAS,QAAA;AAC7F,SAAO;IAAEE;IAASM;EAAU;AAC9B;AAJgBP;AAOT,SAASU,eAAkBC,KAAwBC,iBAAuB;AAC/E,MAAI;AACF,UAAMT,MAAMU,gBAAgB;MAAEV,KAAKE,OAAOC,KAAKM,iBAAiB,QAAA;MAAWd,QAAQ;MAAOD,MAAM;IAAO,CAAA;AACvG,WAAOiB,OACL,MACAT,OAAOC,KAAKG,mBAAmBE,IAAIV,OAAO,GAAG,MAAA,GAC7CE,KACAE,OAAOC,KAAKK,IAAIJ,WAAW,QAAA,CAAA;EAE/B,QAAQ;AACN,WAAO;EACT;AACF;AAZgBG;","names":["createHash","canonicalStringify","value","JSON","stringify","sortKeysDeep","hashSnapshot","createHash","update","digest","Array","isArray","map","record","sorted","key","Object","keys","sort","createPrivateKey","createPublicKey","generateKeyPairSync","sign","verify","generateLicenseKeyPair","privateKey","publicKey","generateKeyPairSync","export","type","format","toString","signDocument","payload","privateKeyBase64","key","createPrivateKey","Buffer","from","signature","sign","canonicalStringify","verifyDocument","doc","publicKeyBase64","createPublicKey","verify"]}
+{"version":3,"sources":["../src/license/hash.ts","../src/signing/canonical.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { canonicalStringify } from '../signing/canonical';\n\n// Computes the sha256 hex digest of a value's canonical JSON — idempotency key for catalog snapshots\nexport function hashSnapshot(value: unknown): string {\n  return createHash('sha256').update(canonicalStringify(value), 'utf8').digest('hex');\n}\n","// Serializes a value as deterministic JSON: object keys recursively sorted, arrays keep their order\nexport function canonicalStringify(value: unknown): string {\n  return JSON.stringify(sortKeysDeep(value));\n}\n\n// Recursively rebuilds objects with sorted keys so JSON.stringify output is order-independent\nfunction sortKeysDeep(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortKeysDeep);\n  if (value !== null && typeof value === 'object') {\n    const record = value as Record<string, unknown>;\n    const sorted: Record<string, unknown> = {};\n    for (const key of Object.keys(record).sort()) sorted[key] = sortKeysDeep(record[key]);\n    return sorted;\n  }\n  return value;\n}\n"],"mappings":";;;;AAAA,SAASA,kBAAkB;;;ACCpB,SAASC,mBAAmBC,OAAc;AAC/C,SAAOC,KAAKC,UAAUC,aAAaH,KAAAA,CAAAA;AACrC;AAFgBD;AAKhB,SAASI,aAAaH,OAAc;AAClC,MAAII,MAAMC,QAAQL,KAAAA,EAAQ,QAAOA,MAAMM,IAAIH,YAAAA;AAC3C,MAAIH,UAAU,QAAQ,OAAOA,UAAU,UAAU;AAC/C,UAAMO,SAASP;AACf,UAAMQ,SAAkC,CAAC;AACzC,eAAWC,OAAOC,OAAOC,KAAKJ,MAAAA,EAAQK,KAAI,EAAIJ,QAAOC,GAAAA,IAAON,aAAaI,OAAOE,GAAAA,CAAI;AACpF,WAAOD;EACT;AACA,SAAOR;AACT;AATSG;;;ADFF,SAASU,aAAaC,OAAc;AACzC,SAAOC,WAAW,QAAA,EAAUC,OAAOC,mBAAmBH,KAAAA,GAAQ,MAAA,EAAQI,OAAO,KAAA;AAC/E;AAFgBL;","names":["createHash","canonicalStringify","value","JSON","stringify","sortKeysDeep","Array","isArray","map","record","sorted","key","Object","keys","sort","hashSnapshot","value","createHash","update","canonicalStringify","digest"]}

package/dist/signing.cjs

@@ -0,0 +1,159 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/signing/index.ts
+var signing_exports = {};
+__export(signing_exports, {
+  buildRequestCanonical: () => buildRequestCanonical,
+  canonicalStringify: () => canonicalStringify,
+  generateSigningKeyPair: () => generateSigningKeyPair,
+  signDocument: () => signDocument,
+  signRequestHeaders: () => signRequestHeaders,
+  verifyDocument: () => verifyDocument,
+  verifySignedRequest: () => verifySignedRequest
+});
+module.exports = __toCommonJS(signing_exports);
+
+// src/signing/canonical.ts
+function canonicalStringify(value) {
+  return JSON.stringify(sortKeysDeep(value));
+}
+__name(canonicalStringify, "canonicalStringify");
+function sortKeysDeep(value) {
+  if (Array.isArray(value)) return value.map(sortKeysDeep);
+  if (value !== null && typeof value === "object") {
+    const record = value;
+    const sorted = {};
+    for (const key of Object.keys(record).sort()) sorted[key] = sortKeysDeep(record[key]);
+    return sorted;
+  }
+  return value;
+}
+__name(sortKeysDeep, "sortKeysDeep");
+
+// src/signing/document.ts
+var import_node_crypto = require("crypto");
+function generateSigningKeyPair() {
+  const { privateKey, publicKey } = (0, import_node_crypto.generateKeyPairSync)("ed25519");
+  return {
+    privateKey: privateKey.export({
+      type: "pkcs8",
+      format: "der"
+    }).toString("base64"),
+    publicKey: publicKey.export({
+      type: "spki",
+      format: "der"
+    }).toString("base64")
+  };
+}
+__name(generateSigningKeyPair, "generateSigningKeyPair");
+function signDocument(payload, privateKeyBase64) {
+  const key = (0, import_node_crypto.createPrivateKey)({
+    key: Buffer.from(privateKeyBase64, "base64"),
+    format: "der",
+    type: "pkcs8"
+  });
+  const signature = (0, import_node_crypto.sign)(null, Buffer.from(canonicalStringify(payload), "utf8"), key).toString("base64");
+  return {
+    payload,
+    signature
+  };
+}
+__name(signDocument, "signDocument");
+function verifyDocument(doc, publicKeyBase64) {
+  try {
+    const key = (0, import_node_crypto.createPublicKey)({
+      key: Buffer.from(publicKeyBase64, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return (0, import_node_crypto.verify)(null, Buffer.from(canonicalStringify(doc.payload), "utf8"), key, Buffer.from(doc.signature, "base64"));
+  } catch {
+    return false;
+  }
+}
+__name(verifyDocument, "verifyDocument");
+
+// src/signing/request.ts
+var import_node_crypto2 = require("crypto");
+function buildRequestCanonical(input) {
+  const bodyHash = (0, import_node_crypto2.createHash)("sha256").update(input.body ?? "").digest("hex");
+  return [
+    input.method.toUpperCase(),
+    input.path,
+    input.orgId ?? "",
+    bodyHash,
+    String(input.timestamp)
+  ].join("\n");
+}
+__name(buildRequestCanonical, "buildRequestCanonical");
+function signRequestHeaders(input, privateKeyBase64) {
+  const timestamp = Math.floor(Date.now() / 1e3);
+  const canonical = buildRequestCanonical({
+    ...input,
+    timestamp
+  });
+  const key = (0, import_node_crypto2.createPrivateKey)({
+    key: Buffer.from(privateKeyBase64, "base64"),
+    format: "der",
+    type: "pkcs8"
+  });
+  const signature = (0, import_node_crypto2.sign)(null, Buffer.from(canonical, "utf8"), key).toString("base64");
+  return {
+    "x-timestamp": String(timestamp),
+    "x-signature": signature
+  };
+}
+__name(signRequestHeaders, "signRequestHeaders");
+function verifySignedRequest(input) {
+  try {
+    const timestamp = Number(input.timestamp);
+    if (!Number.isFinite(timestamp)) return false;
+    const maxSkew = input.maxSkewSeconds ?? 300;
+    if (Math.abs(Math.floor(Date.now() / 1e3) - timestamp) > maxSkew) return false;
+    const canonical = buildRequestCanonical({
+      method: input.method,
+      path: input.path,
+      orgId: input.orgId,
+      body: input.rawBody,
+      timestamp
+    });
+    const key = (0, import_node_crypto2.createPublicKey)({
+      key: Buffer.from(input.publicKey, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return (0, import_node_crypto2.verify)(null, Buffer.from(canonical, "utf8"), key, Buffer.from(input.signature, "base64"));
+  } catch {
+    return false;
+  }
+}
+__name(verifySignedRequest, "verifySignedRequest");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildRequestCanonical,
+  canonicalStringify,
+  generateSigningKeyPair,
+  signDocument,
+  signRequestHeaders,
+  verifyDocument,
+  verifySignedRequest
+});
+//# sourceMappingURL=signing.cjs.map

package/dist/signing.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/signing/index.ts","../src/signing/canonical.ts","../src/signing/document.ts","../src/signing/request.ts"],"sourcesContent":["// Signing module — Ed25519 primitives: keypairs, canonical-JSON document signing, and signed control-plane requests\nexport { canonicalStringify } from './canonical';\nexport { generateSigningKeyPair, type SignedDocument, signDocument, verifyDocument } from './document';\nexport {\n  buildRequestCanonical,\n  type RequestCanonicalInput,\n  type SignRequestInput,\n  signRequestHeaders,\n  type VerifySignedRequestInput,\n  verifySignedRequest,\n} from './request';\n","// Serializes a value as deterministic JSON: object keys recursively sorted, arrays keep their order\nexport function canonicalStringify(value: unknown): string {\n  return JSON.stringify(sortKeysDeep(value));\n}\n\n// Recursively rebuilds objects with sorted keys so JSON.stringify output is order-independent\nfunction sortKeysDeep(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortKeysDeep);\n  if (value !== null && typeof value === 'object') {\n    const record = value as Record<string, unknown>;\n    const sorted: Record<string, unknown> = {};\n    for (const key of Object.keys(record).sort()) sorted[key] = sortKeysDeep(record[key]);\n    return sorted;\n  }\n  return value;\n}\n","import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from 'node:crypto';\nimport { canonicalStringify } from './canonical';\n\nexport interface SignedDocument<T> {\n  payload: T;\n  signature: string;\n}\n\n// Generates an Ed25519 key pair as base64 DER strings (pkcs8 private / spki public)\nexport function generateSigningKeyPair(): { privateKey: string; publicKey: string } {\n  const { privateKey, publicKey } = generateKeyPairSync('ed25519');\n  return {\n    privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }).toString('base64'),\n    publicKey: publicKey.export({ type: 'spki', format: 'der' }).toString('base64'),\n  };\n}\n\n// Signs a payload's canonical JSON with an Ed25519 private key (base64 pkcs8 DER)\nexport function signDocument<T>(payload: T, privateKeyBase64: string): SignedDocument<T> {\n  const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, 'base64'), format: 'der', type: 'pkcs8' });\n  const signature = sign(null, Buffer.from(canonicalStringify(payload), 'utf8'), key).toString('base64');\n  return { payload, signature };\n}\n\n// Verifies a signed document against an Ed25519 public key (base64 spki DER); malformed input ⇒ false\nexport function verifyDocument<T>(doc: SignedDocument<T>, publicKeyBase64: string): boolean {\n  try {\n    const key = createPublicKey({ key: Buffer.from(publicKeyBase64, 'base64'), format: 'der', type: 'spki' });\n    return verify(\n      null,\n      Buffer.from(canonicalStringify(doc.payload), 'utf8'),\n      key,\n      Buffer.from(doc.signature, 'base64'),\n    );\n  } catch {\n    return false;\n  }\n}\n","import { createHash, createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';\n\nexport interface RequestCanonicalInput {\n  method: string;\n  path: string;\n  orgId?: string;\n  body?: string | Buffer;\n  timestamp: number;\n}\n\nexport interface SignRequestInput {\n  method: string;\n  path: string;\n  orgId?: string;\n  body?: string | Buffer;\n}\n\nexport interface VerifySignedRequestInput {\n  method: string;\n  path: string;\n  orgId?: string;\n  rawBody?: string | Buffer;\n  timestamp: string | number;\n  signature: string;\n  publicKey: string;\n  maxSkewSeconds?: number;\n}\n\n// Builds the canonical string signed for a control-plane request: METHOD\\npath\\norgId\\nsha256hex(body)\\ntimestamp\nexport function buildRequestCanonical(input: RequestCanonicalInput): string {\n  const bodyHash = createHash('sha256')\n    .update(input.body ?? '')\n    .digest('hex');\n  return [input.method.toUpperCase(), input.path, input.orgId ?? '', bodyHash, String(input.timestamp)].join('\\n');\n}\n\n// Signs a request with an Ed25519 private key (base64 pkcs8 DER), stamping the current unix time\nexport function signRequestHeaders(\n  input: SignRequestInput,\n  privateKeyBase64: string,\n): { 'x-timestamp': string; 'x-signature': string } {\n  const timestamp = Math.floor(Date.now() / 1000);\n  const canonical = buildRequestCanonical({ ...input, timestamp });\n  const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, 'base64'), format: 'der', type: 'pkcs8' });\n  const signature = sign(null, Buffer.from(canonical, 'utf8'), key).toString('base64');\n  return { 'x-timestamp': String(timestamp), 'x-signature': signature };\n}\n\n// Verifies a signed request (signature + timestamp skew) against an Ed25519 public key; malformed input ⇒ false\nexport function verifySignedRequest(input: VerifySignedRequestInput): boolean {\n  try {\n    const timestamp = Number(input.timestamp);\n    if (!Number.isFinite(timestamp)) return false;\n    const maxSkew = input.maxSkewSeconds ?? 300;\n    if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > maxSkew) return false;\n    const canonical = buildRequestCanonical({\n      method: input.method,\n      path: input.path,\n      orgId: input.orgId,\n      body: input.rawBody,\n      timestamp,\n    });\n    const key = createPublicKey({ key: Buffer.from(input.publicKey, 'base64'), format: 'der', type: 'spki' });\n    return verify(null, Buffer.from(canonical, 'utf8'), key, Buffer.from(input.signature, 'base64'));\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;ACCO,SAASA,mBAAmBC,OAAc;AAC/C,SAAOC,KAAKC,UAAUC,aAAaH,KAAAA,CAAAA;AACrC;AAFgBD;AAKhB,SAASI,aAAaH,OAAc;AAClC,MAAII,MAAMC,QAAQL,KAAAA,EAAQ,QAAOA,MAAMM,IAAIH,YAAAA;AAC3C,MAAIH,UAAU,QAAQ,OAAOA,UAAU,UAAU;AAC/C,UAAMO,SAASP;AACf,UAAMQ,SAAkC,CAAC;AACzC,eAAWC,OAAOC,OAAOC,KAAKJ,MAAAA,EAAQK,KAAI,EAAIJ,QAAOC,GAAAA,IAAON,aAAaI,OAAOE,GAAAA,CAAI;AACpF,WAAOD;EACT;AACA,SAAOR;AACT;AATSG;;;ACNT,yBAAqF;AAS9E,SAASU,yBAAAA;AACd,QAAM,EAAEC,YAAYC,UAAS,QAAKC,wCAAoB,SAAA;AACtD,SAAO;IACLF,YAAYA,WAAWG,OAAO;MAAEC,MAAM;MAASC,QAAQ;IAAM,CAAA,EAAGC,SAAS,QAAA;IACzEL,WAAWA,UAAUE,OAAO;MAAEC,MAAM;MAAQC,QAAQ;IAAM,CAAA,EAAGC,SAAS,QAAA;EACxE;AACF;AANgBP;AAST,SAASQ,aAAgBC,SAAYC,kBAAwB;AAClE,QAAMC,UAAMC,qCAAiB;IAAED,KAAKE,OAAOC,KAAKJ,kBAAkB,QAAA;IAAWJ,QAAQ;IAAOD,MAAM;EAAQ,CAAA;AAC1G,QAAMU,gBAAYC,yBAAK,MAAMH,OAAOC,KAAKG,mBAAmBR,OAAAA,GAAU,MAAA,GAASE,GAAAA,EAAKJ,SAAS,QAAA;AAC7F,SAAO;IAAEE;IAASM;EAAU;AAC9B;AAJgBP;AAOT,SAASU,eAAkBC,KAAwBC,iBAAuB;AAC/E,MAAI;AACF,UAAMT,UAAMU,oCAAgB;MAAEV,KAAKE,OAAOC,KAAKM,iBAAiB,QAAA;MAAWd,QAAQ;MAAOD,MAAM;IAAO,CAAA;AACvG,eAAOiB,2BACL,MACAT,OAAOC,KAAKG,mBAAmBE,IAAIV,OAAO,GAAG,MAAA,GAC7CE,KACAE,OAAOC,KAAKK,IAAIJ,WAAW,QAAA,CAAA;EAE/B,QAAQ;AACN,WAAO;EACT;AACF;AAZgBG;;;ACzBhB,IAAAK,sBAA4E;AA6BrE,SAASC,sBAAsBC,OAA4B;AAChE,QAAMC,eAAWC,gCAAW,QAAA,EACzBC,OAAOH,MAAMI,QAAQ,EAAA,EACrBC,OAAO,KAAA;AACV,SAAO;IAACL,MAAMM,OAAOC,YAAW;IAAIP,MAAMQ;IAAMR,MAAMS,SAAS;IAAIR;IAAUS,OAAOV,MAAMW,SAAS;IAAGC,KAAK,IAAA;AAC7G;AALgBb;AAQT,SAASc,mBACdb,OACAc,kBAAwB;AAExB,QAAMH,YAAYI,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;AAC1C,QAAMC,YAAYpB,sBAAsB;IAAE,GAAGC;IAAOW;EAAU,CAAA;AAC9D,QAAMS,UAAMC,sCAAiB;IAAED,KAAKE,OAAOC,KAAKT,kBAAkB,QAAA;IAAWU,QAAQ;IAAOC,MAAM;EAAQ,CAAA;AAC1G,QAAMC,gBAAYC,0BAAK,MAAML,OAAOC,KAAKJ,WAAW,MAAA,GAASC,GAAAA,EAAKQ,SAAS,QAAA;AAC3E,SAAO;IAAE,eAAelB,OAAOC,SAAAA;IAAY,eAAee;EAAU;AACtE;AATgBb;AAYT,SAASgB,oBAAoB7B,OAA+B;AACjE,MAAI;AACF,UAAMW,YAAYmB,OAAO9B,MAAMW,SAAS;AACxC,QAAI,CAACmB,OAAOC,SAASpB,SAAAA,EAAY,QAAO;AACxC,UAAMqB,UAAUhC,MAAMiC,kBAAkB;AACxC,QAAIlB,KAAKmB,IAAInB,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA,IAAQP,SAAAA,IAAaqB,QAAS,QAAO;AAC1E,UAAMb,YAAYpB,sBAAsB;MACtCO,QAAQN,MAAMM;MACdE,MAAMR,MAAMQ;MACZC,OAAOT,MAAMS;MACbL,MAAMJ,MAAMmC;MACZxB;IACF,CAAA;AACA,UAAMS,UAAMgB,qCAAgB;MAAEhB,KAAKE,OAAOC,KAAKvB,MAAMqC,WAAW,QAAA;MAAWb,QAAQ;MAAOC,MAAM;IAAO,CAAA;AACvG,eAAOa,4BAAO,MAAMhB,OAAOC,KAAKJ,WAAW,MAAA,GAASC,KAAKE,OAAOC,KAAKvB,MAAM0B,WAAW,QAAA,CAAA;EACxF,QAAQ;AACN,WAAO;EACT;AACF;AAlBgBG;","names":["canonicalStringify","value","JSON","stringify","sortKeysDeep","Array","isArray","map","record","sorted","key","Object","keys","sort","generateSigningKeyPair","privateKey","publicKey","generateKeyPairSync","export","type","format","toString","signDocument","payload","privateKeyBase64","key","createPrivateKey","Buffer","from","signature","sign","canonicalStringify","verifyDocument","doc","publicKeyBase64","createPublicKey","verify","import_node_crypto","buildRequestCanonical","input","bodyHash","createHash","update","body","digest","method","toUpperCase","path","orgId","String","timestamp","join","signRequestHeaders","privateKeyBase64","Math","floor","Date","now","canonical","key","createPrivateKey","Buffer","from","format","type","signature","sign","toString","verifySignedRequest","Number","isFinite","maxSkew","maxSkewSeconds","abs","rawBody","createPublicKey","publicKey","verify"]}

package/dist/signing.d.cts

@@ -0,0 +1,35 @@
+export { S as SignedDocument, g as generateSigningKeyPair, s as signDocument, v as verifyDocument } from './document-BoS0NIbf.cjs';
+
+declare function canonicalStringify(value: unknown): string;
+
+interface RequestCanonicalInput {
+    method: string;
+    path: string;
+    orgId?: string;
+    body?: string | Buffer;
+    timestamp: number;
+}
+interface SignRequestInput {
+    method: string;
+    path: string;
+    orgId?: string;
+    body?: string | Buffer;
+}
+interface VerifySignedRequestInput {
+    method: string;
+    path: string;
+    orgId?: string;
+    rawBody?: string | Buffer;
+    timestamp: string | number;
+    signature: string;
+    publicKey: string;
+    maxSkewSeconds?: number;
+}
+declare function buildRequestCanonical(input: RequestCanonicalInput): string;
+declare function signRequestHeaders(input: SignRequestInput, privateKeyBase64: string): {
+    'x-timestamp': string;
+    'x-signature': string;
+};
+declare function verifySignedRequest(input: VerifySignedRequestInput): boolean;
+
+export { type RequestCanonicalInput, type SignRequestInput, type VerifySignedRequestInput, buildRequestCanonical, canonicalStringify, signRequestHeaders, verifySignedRequest };

package/dist/signing.d.ts

@@ -0,0 +1,35 @@
+export { S as SignedDocument, g as generateSigningKeyPair, s as signDocument, v as verifyDocument } from './document-BoS0NIbf.js';
+
+declare function canonicalStringify(value: unknown): string;
+
+interface RequestCanonicalInput {
+    method: string;
+    path: string;
+    orgId?: string;
+    body?: string | Buffer;
+    timestamp: number;
+}
+interface SignRequestInput {
+    method: string;
+    path: string;
+    orgId?: string;
+    body?: string | Buffer;
+}
+interface VerifySignedRequestInput {
+    method: string;
+    path: string;
+    orgId?: string;
+    rawBody?: string | Buffer;
+    timestamp: string | number;
+    signature: string;
+    publicKey: string;
+    maxSkewSeconds?: number;
+}
+declare function buildRequestCanonical(input: RequestCanonicalInput): string;
+declare function signRequestHeaders(input: SignRequestInput, privateKeyBase64: string): {
+    'x-timestamp': string;
+    'x-signature': string;
+};
+declare function verifySignedRequest(input: VerifySignedRequestInput): boolean;
+
+export { type RequestCanonicalInput, type SignRequestInput, type VerifySignedRequestInput, buildRequestCanonical, canonicalStringify, signRequestHeaders, verifySignedRequest };

package/dist/signing.js

@@ -0,0 +1,128 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/signing/canonical.ts
+function canonicalStringify(value) {
+  return JSON.stringify(sortKeysDeep(value));
+}
+__name(canonicalStringify, "canonicalStringify");
+function sortKeysDeep(value) {
+  if (Array.isArray(value)) return value.map(sortKeysDeep);
+  if (value !== null && typeof value === "object") {
+    const record = value;
+    const sorted = {};
+    for (const key of Object.keys(record).sort()) sorted[key] = sortKeysDeep(record[key]);
+    return sorted;
+  }
+  return value;
+}
+__name(sortKeysDeep, "sortKeysDeep");
+
+// src/signing/document.ts
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "crypto";
+function generateSigningKeyPair() {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  return {
+    privateKey: privateKey.export({
+      type: "pkcs8",
+      format: "der"
+    }).toString("base64"),
+    publicKey: publicKey.export({
+      type: "spki",
+      format: "der"
+    }).toString("base64")
+  };
+}
+__name(generateSigningKeyPair, "generateSigningKeyPair");
+function signDocument(payload, privateKeyBase64) {
+  const key = createPrivateKey({
+    key: Buffer.from(privateKeyBase64, "base64"),
+    format: "der",
+    type: "pkcs8"
+  });
+  const signature = sign(null, Buffer.from(canonicalStringify(payload), "utf8"), key).toString("base64");
+  return {
+    payload,
+    signature
+  };
+}
+__name(signDocument, "signDocument");
+function verifyDocument(doc, publicKeyBase64) {
+  try {
+    const key = createPublicKey({
+      key: Buffer.from(publicKeyBase64, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return verify(null, Buffer.from(canonicalStringify(doc.payload), "utf8"), key, Buffer.from(doc.signature, "base64"));
+  } catch {
+    return false;
+  }
+}
+__name(verifyDocument, "verifyDocument");
+
+// src/signing/request.ts
+import { createHash, createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, sign as sign2, verify as verify2 } from "crypto";
+function buildRequestCanonical(input) {
+  const bodyHash = createHash("sha256").update(input.body ?? "").digest("hex");
+  return [
+    input.method.toUpperCase(),
+    input.path,
+    input.orgId ?? "",
+    bodyHash,
+    String(input.timestamp)
+  ].join("\n");
+}
+__name(buildRequestCanonical, "buildRequestCanonical");
+function signRequestHeaders(input, privateKeyBase64) {
+  const timestamp = Math.floor(Date.now() / 1e3);
+  const canonical = buildRequestCanonical({
+    ...input,
+    timestamp
+  });
+  const key = createPrivateKey2({
+    key: Buffer.from(privateKeyBase64, "base64"),
+    format: "der",
+    type: "pkcs8"
+  });
+  const signature = sign2(null, Buffer.from(canonical, "utf8"), key).toString("base64");
+  return {
+    "x-timestamp": String(timestamp),
+    "x-signature": signature
+  };
+}
+__name(signRequestHeaders, "signRequestHeaders");
+function verifySignedRequest(input) {
+  try {
+    const timestamp = Number(input.timestamp);
+    if (!Number.isFinite(timestamp)) return false;
+    const maxSkew = input.maxSkewSeconds ?? 300;
+    if (Math.abs(Math.floor(Date.now() / 1e3) - timestamp) > maxSkew) return false;
+    const canonical = buildRequestCanonical({
+      method: input.method,
+      path: input.path,
+      orgId: input.orgId,
+      body: input.rawBody,
+      timestamp
+    });
+    const key = createPublicKey2({
+      key: Buffer.from(input.publicKey, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return verify2(null, Buffer.from(canonical, "utf8"), key, Buffer.from(input.signature, "base64"));
+  } catch {
+    return false;
+  }
+}
+__name(verifySignedRequest, "verifySignedRequest");
+export {
+  buildRequestCanonical,
+  canonicalStringify,
+  generateSigningKeyPair,
+  signDocument,
+  signRequestHeaders,
+  verifyDocument,
+  verifySignedRequest
+};
+//# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/signing/canonical.ts","../src/signing/document.ts","../src/signing/request.ts"],"sourcesContent":["// Serializes a value as deterministic JSON: object keys recursively sorted, arrays keep their order\nexport function canonicalStringify(value: unknown): string {\n  return JSON.stringify(sortKeysDeep(value));\n}\n\n// Recursively rebuilds objects with sorted keys so JSON.stringify output is order-independent\nfunction sortKeysDeep(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortKeysDeep);\n  if (value !== null && typeof value === 'object') {\n    const record = value as Record<string, unknown>;\n    const sorted: Record<string, unknown> = {};\n    for (const key of Object.keys(record).sort()) sorted[key] = sortKeysDeep(record[key]);\n    return sorted;\n  }\n  return value;\n}\n","import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from 'node:crypto';\nimport { canonicalStringify } from './canonical';\n\nexport interface SignedDocument<T> {\n  payload: T;\n  signature: string;\n}\n\n// Generates an Ed25519 key pair as base64 DER strings (pkcs8 private / spki public)\nexport function generateSigningKeyPair(): { privateKey: string; publicKey: string } {\n  const { privateKey, publicKey } = generateKeyPairSync('ed25519');\n  return {\n    privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }).toString('base64'),\n    publicKey: publicKey.export({ type: 'spki', format: 'der' }).toString('base64'),\n  };\n}\n\n// Signs a payload's canonical JSON with an Ed25519 private key (base64 pkcs8 DER)\nexport function signDocument<T>(payload: T, privateKeyBase64: string): SignedDocument<T> {\n  const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, 'base64'), format: 'der', type: 'pkcs8' });\n  const signature = sign(null, Buffer.from(canonicalStringify(payload), 'utf8'), key).toString('base64');\n  return { payload, signature };\n}\n\n// Verifies a signed document against an Ed25519 public key (base64 spki DER); malformed input ⇒ false\nexport function verifyDocument<T>(doc: SignedDocument<T>, publicKeyBase64: string): boolean {\n  try {\n    const key = createPublicKey({ key: Buffer.from(publicKeyBase64, 'base64'), format: 'der', type: 'spki' });\n    return verify(\n      null,\n      Buffer.from(canonicalStringify(doc.payload), 'utf8'),\n      key,\n      Buffer.from(doc.signature, 'base64'),\n    );\n  } catch {\n    return false;\n  }\n}\n","import { createHash, createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';\n\nexport interface RequestCanonicalInput {\n  method: string;\n  path: string;\n  orgId?: string;\n  body?: string | Buffer;\n  timestamp: number;\n}\n\nexport interface SignRequestInput {\n  method: string;\n  path: string;\n  orgId?: string;\n  body?: string | Buffer;\n}\n\nexport interface VerifySignedRequestInput {\n  method: string;\n  path: string;\n  orgId?: string;\n  rawBody?: string | Buffer;\n  timestamp: string | number;\n  signature: string;\n  publicKey: string;\n  maxSkewSeconds?: number;\n}\n\n// Builds the canonical string signed for a control-plane request: METHOD\\npath\\norgId\\nsha256hex(body)\\ntimestamp\nexport function buildRequestCanonical(input: RequestCanonicalInput): string {\n  const bodyHash = createHash('sha256')\n    .update(input.body ?? '')\n    .digest('hex');\n  return [input.method.toUpperCase(), input.path, input.orgId ?? '', bodyHash, String(input.timestamp)].join('\\n');\n}\n\n// Signs a request with an Ed25519 private key (base64 pkcs8 DER), stamping the current unix time\nexport function signRequestHeaders(\n  input: SignRequestInput,\n  privateKeyBase64: string,\n): { 'x-timestamp': string; 'x-signature': string } {\n  const timestamp = Math.floor(Date.now() / 1000);\n  const canonical = buildRequestCanonical({ ...input, timestamp });\n  const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, 'base64'), format: 'der', type: 'pkcs8' });\n  const signature = sign(null, Buffer.from(canonical, 'utf8'), key).toString('base64');\n  return { 'x-timestamp': String(timestamp), 'x-signature': signature };\n}\n\n// Verifies a signed request (signature + timestamp skew) against an Ed25519 public key; malformed input ⇒ false\nexport function verifySignedRequest(input: VerifySignedRequestInput): boolean {\n  try {\n    const timestamp = Number(input.timestamp);\n    if (!Number.isFinite(timestamp)) return false;\n    const maxSkew = input.maxSkewSeconds ?? 300;\n    if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > maxSkew) return false;\n    const canonical = buildRequestCanonical({\n      method: input.method,\n      path: input.path,\n      orgId: input.orgId,\n      body: input.rawBody,\n      timestamp,\n    });\n    const key = createPublicKey({ key: Buffer.from(input.publicKey, 'base64'), format: 'der', type: 'spki' });\n    return verify(null, Buffer.from(canonical, 'utf8'), key, Buffer.from(input.signature, 'base64'));\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;AACO,SAASA,mBAAmBC,OAAc;AAC/C,SAAOC,KAAKC,UAAUC,aAAaH,KAAAA,CAAAA;AACrC;AAFgBD;AAKhB,SAASI,aAAaH,OAAc;AAClC,MAAII,MAAMC,QAAQL,KAAAA,EAAQ,QAAOA,MAAMM,IAAIH,YAAAA;AAC3C,MAAIH,UAAU,QAAQ,OAAOA,UAAU,UAAU;AAC/C,UAAMO,SAASP;AACf,UAAMQ,SAAkC,CAAC;AACzC,eAAWC,OAAOC,OAAOC,KAAKJ,MAAAA,EAAQK,KAAI,EAAIJ,QAAOC,GAAAA,IAAON,aAAaI,OAAOE,GAAAA,CAAI;AACpF,WAAOD;EACT;AACA,SAAOR;AACT;AATSG;;;ACNT,SAASU,kBAAkBC,iBAAiBC,qBAAqBC,MAAMC,cAAc;AAS9E,SAASC,yBAAAA;AACd,QAAM,EAAEC,YAAYC,UAAS,IAAKC,oBAAoB,SAAA;AACtD,SAAO;IACLF,YAAYA,WAAWG,OAAO;MAAEC,MAAM;MAASC,QAAQ;IAAM,CAAA,EAAGC,SAAS,QAAA;IACzEL,WAAWA,UAAUE,OAAO;MAAEC,MAAM;MAAQC,QAAQ;IAAM,CAAA,EAAGC,SAAS,QAAA;EACxE;AACF;AANgBP;AAST,SAASQ,aAAgBC,SAAYC,kBAAwB;AAClE,QAAMC,MAAMC,iBAAiB;IAAED,KAAKE,OAAOC,KAAKJ,kBAAkB,QAAA;IAAWJ,QAAQ;IAAOD,MAAM;EAAQ,CAAA;AAC1G,QAAMU,YAAYC,KAAK,MAAMH,OAAOC,KAAKG,mBAAmBR,OAAAA,GAAU,MAAA,GAASE,GAAAA,EAAKJ,SAAS,QAAA;AAC7F,SAAO;IAAEE;IAASM;EAAU;AAC9B;AAJgBP;AAOT,SAASU,eAAkBC,KAAwBC,iBAAuB;AAC/E,MAAI;AACF,UAAMT,MAAMU,gBAAgB;MAAEV,KAAKE,OAAOC,KAAKM,iBAAiB,QAAA;MAAWd,QAAQ;MAAOD,MAAM;IAAO,CAAA;AACvG,WAAOiB,OACL,MACAT,OAAOC,KAAKG,mBAAmBE,IAAIV,OAAO,GAAG,MAAA,GAC7CE,KACAE,OAAOC,KAAKK,IAAIJ,WAAW,QAAA,CAAA;EAE/B,QAAQ;AACN,WAAO;EACT;AACF;AAZgBG;;;ACzBhB,SAASK,YAAYC,oBAAAA,mBAAkBC,mBAAAA,kBAAiBC,QAAAA,OAAMC,UAAAA,eAAc;AA6BrE,SAASC,sBAAsBC,OAA4B;AAChE,QAAMC,WAAWC,WAAW,QAAA,EACzBC,OAAOH,MAAMI,QAAQ,EAAA,EACrBC,OAAO,KAAA;AACV,SAAO;IAACL,MAAMM,OAAOC,YAAW;IAAIP,MAAMQ;IAAMR,MAAMS,SAAS;IAAIR;IAAUS,OAAOV,MAAMW,SAAS;IAAGC,KAAK,IAAA;AAC7G;AALgBb;AAQT,SAASc,mBACdb,OACAc,kBAAwB;AAExB,QAAMH,YAAYI,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;AAC1C,QAAMC,YAAYpB,sBAAsB;IAAE,GAAGC;IAAOW;EAAU,CAAA;AAC9D,QAAMS,MAAMC,kBAAiB;IAAED,KAAKE,OAAOC,KAAKT,kBAAkB,QAAA;IAAWU,QAAQ;IAAOC,MAAM;EAAQ,CAAA;AAC1G,QAAMC,YAAYC,MAAK,MAAML,OAAOC,KAAKJ,WAAW,MAAA,GAASC,GAAAA,EAAKQ,SAAS,QAAA;AAC3E,SAAO;IAAE,eAAelB,OAAOC,SAAAA;IAAY,eAAee;EAAU;AACtE;AATgBb;AAYT,SAASgB,oBAAoB7B,OAA+B;AACjE,MAAI;AACF,UAAMW,YAAYmB,OAAO9B,MAAMW,SAAS;AACxC,QAAI,CAACmB,OAAOC,SAASpB,SAAAA,EAAY,QAAO;AACxC,UAAMqB,UAAUhC,MAAMiC,kBAAkB;AACxC,QAAIlB,KAAKmB,IAAInB,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA,IAAQP,SAAAA,IAAaqB,QAAS,QAAO;AAC1E,UAAMb,YAAYpB,sBAAsB;MACtCO,QAAQN,MAAMM;MACdE,MAAMR,MAAMQ;MACZC,OAAOT,MAAMS;MACbL,MAAMJ,MAAMmC;MACZxB;IACF,CAAA;AACA,UAAMS,MAAMgB,iBAAgB;MAAEhB,KAAKE,OAAOC,KAAKvB,MAAMqC,WAAW,QAAA;MAAWb,QAAQ;MAAOC,MAAM;IAAO,CAAA;AACvG,WAAOa,QAAO,MAAMhB,OAAOC,KAAKJ,WAAW,MAAA,GAASC,KAAKE,OAAOC,KAAKvB,MAAM0B,WAAW,QAAA,CAAA;EACxF,QAAQ;AACN,WAAO;EACT;AACF;AAlBgBG;","names":["canonicalStringify","value","JSON","stringify","sortKeysDeep","Array","isArray","map","record","sorted","key","Object","keys","sort","createPrivateKey","createPublicKey","generateKeyPairSync","sign","verify","generateSigningKeyPair","privateKey","publicKey","generateKeyPairSync","export","type","format","toString","signDocument","payload","privateKeyBase64","key","createPrivateKey","Buffer","from","signature","sign","canonicalStringify","verifyDocument","doc","publicKeyBase64","createPublicKey","verify","createHash","createPrivateKey","createPublicKey","sign","verify","buildRequestCanonical","input","bodyHash","createHash","update","body","digest","method","toUpperCase","path","orgId","String","timestamp","join","signRequestHeaders","privateKeyBase64","Math","floor","Date","now","canonical","key","createPrivateKey","Buffer","from","format","type","signature","sign","toString","verifySignedRequest","Number","isFinite","maxSkew","maxSkewSeconds","abs","rawBody","createPublicKey","publicKey","verify"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vritti/api-sdk",
   "type": "module",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -126,6 +126,16 @@
         "default": "./dist/license.cjs"
       }
     },
+    "./signing": {
+      "import": {
+        "types": "./dist/signing.d.ts",
+        "default": "./dist/signing.js"
+      },
+      "require": {
+        "types": "./dist/signing.d.cts",
+        "default": "./dist/signing.cjs"
+      }
+    },
     "./cache": {
       "import": {
         "types": "./dist/cache.d.ts",