@zanii/core 0.5.6 → 0.5.7

package/README.md

@@ -61,6 +61,7 @@ revocations, and on-chain anchor consistency.
 
 ## Changelog
 
+- **0.5.7**: `signObjectAsync(obj, signer)` and the `RemoteSigner` type: sign with a key held in an HSM, cloud KMS or `@zanii/signerd`, so it never enters the process. Same signed bytes as `signObject`; a remote signature is verified before it is returned. Additive.
 - **0.5.6** — `createSTHAsync`: sign tree heads with a key held outside the process.
 - **0.5.5** — `createReceiptAsync` and `signA2ABodyAsync`: sign receipts with a key held outside the process (HSM, KMS, signing service). Same bytes, same receipts.
 - **0.5.4** — `signObject` / `verifySignedObject`: sign any statement as a did:key over its RFC 8785 bytes (used by the domain packages for device readings, reports and attestations).

package/dist/index.d.ts

@@ -9,5 +9,5 @@ export { createReceipt, createReceiptAsync, receiptHash, hashPayload, payloadByt
 export { createConfirmation, verifyConfirmation, type ActionConfirmation, } from './confirmation.js';
 export { createCoSignature, verifyCoSignature, type ReceiptCoSignature, } from './cosign.js';
 export { verifySwarmReceipt, type SwarmBody, type SwarmLedgerReceipt, type SwarmSignerEnvelope } from './swarm.js';
-export { signObject, verifySignedObject, type SignedObject } from './signed.js';
+export { signObject, signObjectAsync, verifySignedObject, type RemoteSigner, type SignedObject } from './signed.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACrF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,QAAQ,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACrF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,QAAQ,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -9,5 +9,5 @@ export { createReceipt, createReceiptAsync, receiptHash, hashPayload, payloadByt
 export { createConfirmation, verifyConfirmation, } from './confirmation.js';
 export { createCoSignature, verifyCoSignature, } from './cosign.js';
 export { verifySwarmReceipt } from './swarm.js';
-export { signObject, verifySignedObject } from './signed.js';
+export { signObject, signObjectAsync, verifySignedObject } from './signed.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAgB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AACrF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,GAIR,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,WAAW,EAGX,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAqE,MAAM,YAAY,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAqB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAgB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AACrF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,GAIR,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,WAAW,EAGX,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAqE,MAAM,YAAY,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAwC,MAAM,aAAa,CAAC"}

package/dist/signed.d.ts

@@ -11,4 +11,19 @@ export type SignedObject<T extends object> = T & {
 export declare function signObject<T extends object>(obj: T, privateKey: Uint8Array): SignedObject<T>;
 /** Was this object signed by its `signer`, unchanged since? Never throws. */
 export declare function verifySignedObject(obj: unknown): boolean;
+/**
+ * A key held outside the process: an HSM, a cloud KMS, `@zanii/signerd`, a signing service. The same
+ * shape as `@zanii/sdk` `AgentSigner` and `@zanii/kms` `RemoteSigner`.
+ */
+export interface RemoteSigner {
+    publicKey: Uint8Array;
+    /** Returns the raw 64-byte Ed25519 signature over `message`. */
+    sign: (message: Uint8Array) => Uint8Array | Promise<Uint8Array>;
+}
+/**
+ * `signObject` with a raw key or a remote signer, so the key never has to enter this process. The
+ * signed bytes are identical to `signObject`. A remote signature is verified before it is returned:
+ * a misconfigured or substituted signer fails loudly instead of producing records that do not verify.
+ */
+export declare function signObjectAsync<T extends object>(obj: T, signer: Uint8Array | RemoteSigner): Promise<SignedObject<T>>;
 //# sourceMappingURL=signed.d.ts.map

package/dist/signed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signed.d.ts","sourceRoot":"","sources":["../src/signed.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAK5F;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUxD"}
+{"version":3,"file":"signed.d.ts","sourceRoot":"","sources":["../src/signed.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAK5F;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUxD;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,UAAU,CAAC;IACtB,gEAAgE;IAChE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACjE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAQ3H"}

package/dist/signed.js

@@ -23,4 +23,21 @@ export function verifySignedObject(obj) {
         return false;
     }
 }
+/**
+ * `signObject` with a raw key or a remote signer, so the key never has to enter this process. The
+ * signed bytes are identical to `signObject`. A remote signature is verified before it is returned:
+ * a misconfigured or substituted signer fails loudly instead of producing records that do not verify.
+ */
+export async function signObjectAsync(obj, signer) {
+    if (signer instanceof Uint8Array)
+        return signObject(obj, signer);
+    if ('sig' in obj)
+        throw new Error('signObject: the object already carries a sig');
+    const unsigned = { ...obj, signer: didFromPublicKey(signer.publicKey) };
+    const raw = await signer.sign(canonicalBytes(unsigned));
+    const signed = { ...unsigned, sig: encodeSig(raw) };
+    if (!verifySignedObject(signed))
+        throw new Error('signObject: the remote signer returned a signature that does not verify');
+    return signed;
+}
 //# sourceMappingURL=signed.js.map

package/dist/signed.js.map

@@ -1 +1 @@
-{"version":3,"file":"signed.js","sourceRoot":"","sources":["../src/signed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAS/D,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAmB,GAAM,EAAE,UAAsB;IACzE,IAAI,KAAK,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAA8B,CAAC;QAC5D,MAAM,GAAG,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"signed.js","sourceRoot":"","sources":["../src/signed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAS/D,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAmB,GAAM,EAAE,UAAsB;IACzE,IAAI,KAAK,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAA8B,CAAC;QAC5D,MAAM,GAAG,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAmB,GAAM,EAAE,MAAiC;IAC/F,IAAI,MAAM,YAAY,UAAU;QAAE,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,KAAK,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAqB,CAAC;IACvE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC5H,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanii/core",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Zanii protocol: verifiable identity, signed action receipts, Merkle transparency-log proofs. Pure, no I/O.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",

package/src/index.ts

@@ -77,4 +77,4 @@ export {
   type ReceiptCoSignature,
 } from './cosign.js';
 export { verifySwarmReceipt, type SwarmBody, type SwarmLedgerReceipt, type SwarmSignerEnvelope } from './swarm.js';
-export { signObject, verifySignedObject, type SignedObject } from './signed.js';
+export { signObject, signObjectAsync, verifySignedObject, type RemoteSigner, type SignedObject } from './signed.js';

package/src/signed.ts

@@ -29,3 +29,28 @@ export function verifySignedObject(obj: unknown): boolean {
     return false;
   }
 }
+
+/**
+ * A key held outside the process: an HSM, a cloud KMS, `@zanii/signerd`, a signing service. The same
+ * shape as `@zanii/sdk` `AgentSigner` and `@zanii/kms` `RemoteSigner`.
+ */
+export interface RemoteSigner {
+  publicKey: Uint8Array;
+  /** Returns the raw 64-byte Ed25519 signature over `message`. */
+  sign: (message: Uint8Array) => Uint8Array | Promise<Uint8Array>;
+}
+
+/**
+ * `signObject` with a raw key or a remote signer, so the key never has to enter this process. The
+ * signed bytes are identical to `signObject`. A remote signature is verified before it is returned:
+ * a misconfigured or substituted signer fails loudly instead of producing records that do not verify.
+ */
+export async function signObjectAsync<T extends object>(obj: T, signer: Uint8Array | RemoteSigner): Promise<SignedObject<T>> {
+  if (signer instanceof Uint8Array) return signObject(obj, signer);
+  if ('sig' in obj) throw new Error('signObject: the object already carries a sig');
+  const unsigned = { ...obj, signer: didFromPublicKey(signer.publicKey) };
+  const raw = await signer.sign(canonicalBytes(unsigned));
+  const signed = { ...unsigned, sig: encodeSig(raw) } as SignedObject<T>;
+  if (!verifySignedObject(signed)) throw new Error('signObject: the remote signer returned a signature that does not verify');
+  return signed;
+}