@zintrust/core 0.1.26 → 0.1.28

package/src/security/Sanitizer.js

@@ -1,412 +0,0 @@
-/**
- * Input Sanitizer (Character Whitelisting)
- *
- * Provides small utilities to remove unwanted characters from user input.
- *
- * Important:
- * - This is NOT a complete SQL injection defense.
- * - Always use parameterized queries / the ORM / QueryBuilder.
- *
- * Use this for:
- * - Normalizing identifiers (username, slug-ish strings)
- * - Cleaning phone numbers / numeric strings
- * - Reducing unexpected characters before storage/logging
- *
- * Bulletproof Mode:
- * - Enabled by default (`bulletproof=true`) for security-critical methods
- * - Throws SanitizerError instead of returning empty/invalid values
- * - Validates numeric ranges, leading zeros, type coercion attacks
- * - ~5-15% performance overhead; disable for performance-critical paths
- */
-import { ErrorFactory } from '../exceptions/ZintrustError.js';
-const MAX_NUMERIC_INPUT_LEN = 64;
-const MAX_EMAIL_LEN = 254;
-const MAX_NAME_LEN = 200;
-const MAX_PASSWORD_LEN = 256;
-const assertMaxLen = (method, label, value, maxLen) => {
-    if (value.length <= maxLen)
-        return;
-    throw ErrorFactory.createSanitizerError(method, `${label} too long`, value);
-};
-const isEmpty = (value) => {
-    // Preserve legacy semantics: treat 0 and "0" as empty.
-    return (value === null ||
-        value === undefined ||
-        value === false ||
-        value === 0 ||
-        value === '' ||
-        value === '0');
-};
-const toStr = (value) => {
-    return String(value ?? '');
-};
-const stripSpaces = (value) => {
-    return toStr(value).replaceAll(' ', '');
-};
-const sanitize = (value, pattern, stripSpace = false) => {
-    const input = stripSpace ? stripSpaces(value) : toStr(value);
-    return input.replace(pattern, '');
-};
-const isNumericString = (value) => {
-    const trimmed = value.trim();
-    if (trimmed.length === 0)
-        return false;
-    const n = Number(trimmed);
-    return Number.isFinite(n);
-};
-const parseAmount = (value, bulletproof = true) => {
-    if (isEmpty(value))
-        return 0;
-    const cleaned = sanitize(value, /[^0-9.-]/g, true);
-    const num = Number(cleaned);
-    if (bulletproof) {
-        // Handle string edge cases - check original value
-        const str = String(value);
-        const trimmed = str.trim();
-        assertMaxLen('parseAmount', 'Input', trimmed, MAX_NUMERIC_INPUT_LEN);
-        // Reject explicit plus sign prefixes (type confusion)
-        if (trimmed.startsWith('+')) {
-            throw ErrorFactory.createSanitizerError('parseAmount', 'Plus sign not allowed', value);
-        }
-        // Reject "Infinity", "-Infinity", "NaN" explicitly
-        if (/^[+-]?infinity$/i.test(trimmed) || /^nan$/i.test(trimmed)) {
-            throw ErrorFactory.createSanitizerError('parseAmount', 'Non-finite number', value);
-        }
-        // Reject scientific notation (e.g., "1e308", "2.5e10")
-        if (/[eE]/.test(trimmed)) {
-            throw ErrorFactory.createSanitizerError('parseAmount', 'Scientific notation not allowed', value);
-        }
-        assertMaxLen('parseAmount', 'Sanitized numeric', cleaned, MAX_NUMERIC_INPUT_LEN);
-        // Require a strict numeric shape after sanitization (prevents "1-2" -> NaN etc.)
-        if (!/^-?\d+(?:\.\d+)?$/.test(cleaned)) {
-            throw ErrorFactory.createSanitizerError('parseAmount', 'Invalid numeric format', value);
-        }
-        // Reject Infinity, NaN, and overflow attacks
-        if (!Number.isFinite(num)) {
-            throw ErrorFactory.createSanitizerError('parseAmount', 'Non-finite number', value);
-        }
-        if (Math.abs(num) > Number.MAX_SAFE_INTEGER) {
-            throw ErrorFactory.createSanitizerError('parseAmount', 'Number exceeds safe integer range', value);
-        }
-    }
-    return Number.isFinite(num) ? num : 0;
-};
-const alphanumeric = (value) => {
-    if (isEmpty(value))
-        return '';
-    return sanitize(value, /[^A-Za-z0-9]/g, true);
-};
-const alphanumericDotDash = (value) => {
-    if (isEmpty(value))
-        return '';
-    return sanitize(value, /[^A-Za-z0-9\-.]/g, true);
-};
-const validateNonNegativeNumericStringPreSanitization = (trimmed, value) => {
-    assertMaxLen('nonNegativeNumericStringOrNull', 'Input', trimmed, MAX_NUMERIC_INPUT_LEN);
-    // Reject explicit plus sign prefixes (type confusion)
-    if (trimmed.startsWith('+')) {
-        throw ErrorFactory.createSanitizerError('nonNegativeNumericStringOrNull', 'Plus sign not allowed', value);
-    }
-    // Reject scientific notation before sanitization can mask it
-    if (/[eE]/.test(trimmed)) {
-        throw ErrorFactory.createSanitizerError('nonNegativeNumericStringOrNull', 'Scientific notation not allowed', value);
-    }
-};
-const validateNonNegativeNumericStringPostSanitization = (da, value) => {
-    assertMaxLen('nonNegativeNumericStringOrNull', 'Sanitized numeric', da, MAX_NUMERIC_INPUT_LEN);
-    // Strict shape: allow optional leading '-' and optional fractional part.
-    if (!/^-?\d+(?:\.\d+)?$/.test(da)) {
-        throw ErrorFactory.createSanitizerError('nonNegativeNumericStringOrNull', 'Invalid numeric format', value);
-    }
-    // For integers (no decimal point), validate leading zeros
-    if (da.includes('.')) {
-        // For decimals, only check overflow
-        const num = Number(da);
-        if (Math.abs(num) > Number.MAX_SAFE_INTEGER) {
-            throw ErrorFactory.createSanitizerError('nonNegativeNumericStringOrNull', 'Number exceeds safe integer range', value);
-        }
-    }
-    else {
-        const numericId = Number.parseInt(da, 10);
-        if (!Number.isFinite(numericId) ||
-            numericId < 0 ||
-            numericId > Number.MAX_SAFE_INTEGER ||
-            numericId.toString() !== da) {
-            throw ErrorFactory.createSanitizerError('nonNegativeNumericStringOrNull', 'Invalid numeric format (leading zeros, overflow, or type mismatch)', value);
-        }
-    }
-};
-const nonNegativeNumericStringOrNull = (value, bulletproof = true) => {
-    if (isEmpty(value))
-        return 0;
-    const raw = stripSpaces(value);
-    if (bulletproof) {
-        const trimmed = raw.trim();
-        validateNonNegativeNumericStringPreSanitization(trimmed, value);
-    }
-    const da = raw.replaceAll(/[^0-9\-.]/g, '');
-    const numeric = isNumericString(da);
-    if (numeric && Number(da) < 0)
-        return 0;
-    if (!numeric) {
-        return null;
-    }
-    if (bulletproof) {
-        validateNonNegativeNumericStringPostSanitization(da, value);
-    }
-    return da;
-};
-const digitsOnly = (value, bulletproof = true) => {
-    // Special handling for '0' string
-    if (value === '0') {
-        if (bulletproof) {
-            throw ErrorFactory.createSanitizerError('digitsOnly', 'Invalid numeric ID (zero, negative, overflow, or leading zeros)', value);
-        }
-        return '0';
-    }
-    if (isEmpty(value))
-        return '';
-    const da = sanitize(value, /\D/g);
-    if (bulletproof) {
-        assertMaxLen('digitsOnly', 'Sanitized numeric', da, 16);
-        // After removing non-digits, check if result is empty
-        if (da.length === 0) {
-            throw ErrorFactory.createSanitizerError('digitsOnly', 'Empty result after removing non-digits', value);
-        }
-        // Check for special characters that get stripped (like +)
-        const str = String(value);
-        if (/^[+-]/.test(str.trim())) {
-            throw ErrorFactory.createSanitizerError('digitsOnly', 'Invalid numeric ID (starts with +/- sign)', value);
-        }
-        const numericId = Number.parseInt(da, 10);
-        if (!Number.isFinite(numericId) ||
-            numericId <= 0 ||
-            numericId > Number.MAX_SAFE_INTEGER ||
-            numericId.toString() !== da) {
-            throw ErrorFactory.createSanitizerError('digitsOnly', 'Invalid numeric ID (zero, negative, overflow, or leading zeros)', value);
-        }
-    }
-    return da.replaceAll(' ', '');
-};
-const validateDecimalStringPreSanitization = (trimmed, value) => {
-    assertMaxLen('decimalString', 'Input', trimmed, MAX_NUMERIC_INPUT_LEN);
-    // Reject explicit plus/minus prefixes and scientific notation (type confusion)
-    if (/^[+-]/.test(trimmed)) {
-        throw ErrorFactory.createSanitizerError('decimalString', 'Signed values not allowed', value);
-    }
-    if (/[eE]/.test(trimmed)) {
-        throw ErrorFactory.createSanitizerError('decimalString', 'Scientific notation not allowed', value);
-    }
-};
-const validateDecimalStringPostSanitization = (result, cleaned, value) => {
-    assertMaxLen('decimalString', 'Sanitized numeric', cleaned, MAX_NUMERIC_INPUT_LEN);
-    if (result.length === 0) {
-        throw ErrorFactory.createSanitizerError('decimalString', 'Empty result after sanitization', value);
-    }
-    if (!/^\d+(?:\.\d+)?$/.test(result)) {
-        throw ErrorFactory.createSanitizerError('decimalString', 'Invalid decimal format', value);
-    }
-    const num = Number(result);
-    if (!Number.isFinite(num)) {
-        throw ErrorFactory.createSanitizerError('decimalString', 'Non-numeric decimal value', value);
-    }
-    if (Math.abs(num) > Number.MAX_SAFE_INTEGER) {
-        throw ErrorFactory.createSanitizerError('decimalString', 'Decimal value exceeds safe range', value);
-    }
-};
-const decimalString = (value, bulletproof = true) => {
-    if (isEmpty(value))
-        return '';
-    if (bulletproof) {
-        const trimmed = String(value).trim();
-        validateDecimalStringPreSanitization(trimmed, value);
-    }
-    // Allow only valid decimal format: digits and at most one decimal point
-    const cleaned = sanitize(value, /[^0-9.]/g);
-    const parts = cleaned.split('.');
-    // Bulletproof mode: reject multiple decimal points rather than merging.
-    // Legacy/unsafe mode: normalize by keeping the first decimal point.
-    let result;
-    if (parts.length > 2) {
-        result = bulletproof ? '' : `${parts[0]}.${parts.slice(1).join('')}`;
-    }
-    else {
-        result = cleaned;
-    }
-    if (bulletproof) {
-        validateDecimalStringPostSanitization(result, cleaned, value);
-    }
-    return result;
-};
-const numericDotOnly = (value) => {
-    if (isEmpty(value))
-        return '';
-    return sanitize(value, /[^0-9.]/g);
-};
-const createBasicSanitizers = () => {
-    return {
-        parseAmount,
-        alphanumeric,
-        alphanumericDotDash,
-        nonNegativeNumericStringOrNull,
-        digitsOnly,
-        decimalString,
-        numericDotOnly,
-    };
-};
-const addressTextSanitizer = (value) => {
-    if (isEmpty(value))
-        return '';
-    return sanitize(value, /[^A-Za-z0-9\-.@+, _]/g);
-};
-const emailLikeSanitizer = (value) => {
-    if (isEmpty(value))
-        return '';
-    return sanitize(value, /[^A-Za-z0-9\-.@+_]/g);
-};
-const emailSanitizer = (value, bulletproof = true) => {
-    if (isEmpty(value))
-        return '';
-    const result = sanitize(value, /[^A-Za-z0-9\-.@_]/g);
-    if (bulletproof) {
-        const trimmed = result.trim();
-        assertMaxLen('email', 'Email', trimmed, MAX_EMAIL_LEN);
-        if (trimmed.length === 0) {
-            throw ErrorFactory.createSanitizerError('email', 'Empty result after sanitization', value);
-        }
-        if (!trimmed.includes('@')) {
-            throw ErrorFactory.createSanitizerError('email', 'Missing @ symbol in email', value);
-        }
-        // Basic validation: something@something
-        const parts = trimmed.split('@');
-        if (parts.length !== 2 || parts[0].length === 0 || parts[1].length === 0) {
-            throw ErrorFactory.createSanitizerError('email', 'Invalid email format', value);
-        }
-    }
-    return result;
-};
-const messageTextSanitizer = (value) => {
-    if (isEmpty(value))
-        return '';
-    return sanitize(value, /[^A-Za-z0-9\-.@+_&$%!,()? ]/g);
-};
-const nameTextSanitizer = (value, bulletproof = true) => {
-    if (isEmpty(value))
-        return '';
-    const result = sanitize(value, /[^A-Za-z0-9 .]/g);
-    if (bulletproof) {
-        const trimmed = result.trim();
-        assertMaxLen('nameText', 'Name', trimmed, MAX_NAME_LEN);
-        if (trimmed.length === 0) {
-            throw ErrorFactory.createSanitizerError('nameText', 'Empty or whitespace-only result', value);
-        }
-        // Names should have at least one letter
-        if (!/[A-Za-z]/.test(trimmed)) {
-            throw ErrorFactory.createSanitizerError('nameText', 'Name must contain at least one letter', value);
-        }
-    }
-    return result;
-};
-const wordCharsAndSpacesSanitizer = (value) => {
-    if (isEmpty(value))
-        return '';
-    return sanitize(value, /[^A-Za-z0-9_\s]/g);
-};
-const safePasswordCharsSanitizer = (value, bulletproof = true) => {
-    if (isEmpty(value))
-        return '';
-    const result = sanitize(value, /[^!@#$%&*/\sA-Za-z0-9_]/g);
-    if (bulletproof) {
-        const trimmed = result.trim();
-        assertMaxLen('safePasswordChars', 'Password', trimmed, MAX_PASSWORD_LEN);
-        if (trimmed.length === 0) {
-            throw ErrorFactory.createSanitizerError('safePasswordChars', 'Empty result after sanitization', value);
-        }
-    }
-    return result;
-};
-const createTextSanitizers = () => {
-    return {
-        addressText: addressTextSanitizer,
-        emailLike: emailLikeSanitizer,
-        email: emailSanitizer,
-        messageText: messageTextSanitizer,
-        nameText: nameTextSanitizer,
-        wordCharsAndSpaces: wordCharsAndSpacesSanitizer,
-        safePasswordChars: safePasswordCharsSanitizer,
-    };
-};
-const createSpecializedSanitizers = () => {
-    const ipAddressText = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^A-Za-z0-9:.]/g);
-    };
-    const alphaNumericColonDash = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^A-Za-z0-9:-]/g);
-    };
-    const dateSlash = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^0-9/]/g);
-    };
-    const lowercaseAlphanumeric = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^A-Za-z0-9]/g).toLowerCase();
-    };
-    const uppercaseAlphanumeric = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^A-Za-z0-9]/g).toUpperCase();
-    };
-    const alphanumericNoSpaces = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^A-Za-z0-9 ]/g, true);
-    };
-    const dateSlashNoSpaces = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^0-9/]/g, true);
-    };
-    // Legacy naming was misleading; this is closer to a "uuid/token safe" whitelist.
-    const uuidTokenSafe = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^A-Za-z0-9\-=]/g, true);
-    };
-    // Base64url-like (plus "=") token whitelisting.
-    const tokenSafe = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^A-Za-z0-9\-=_]/g, true);
-    };
-    const keyLike = (value) => {
-        if (isEmpty(value))
-            return '';
-        return sanitize(value, /[^A-Za-z0-9\-:. ]/g, true);
-    };
-    return {
-        ipAddressText,
-        alphaNumericColonDash,
-        dateSlash,
-        lowercaseAlphanumeric,
-        uppercaseAlphanumeric,
-        alphanumericNoSpaces,
-        dateSlashNoSpaces,
-        uuidTokenSafe,
-        tokenSafe,
-        keyLike,
-    };
-};
-export const createSanitizer = () => {
-    return Object.freeze({
-        ...createBasicSanitizers(),
-        ...createTextSanitizers(),
-        ...createSpecializedSanitizers(),
-    });
-};
-export const Sanitizer = createSanitizer();

package/src/security/SignedRequest.d.ts

@@ -1,53 +0,0 @@
-export type SignedRequestHeaders = {
-    'x-zt-key-id': string;
-    'x-zt-timestamp': string;
-    'x-zt-nonce': string;
-    'x-zt-body-sha256': string;
-    'x-zt-signature': string;
-};
-export type SignedRequestCreateHeadersParams = {
-    method: string;
-    url: string | URL;
-    body?: string | Uint8Array | null;
-    keyId: string;
-    secret: string;
-    timestampMs?: number;
-    nonce?: string;
-};
-export type SignedRequestVerifyParams = {
-    method: string;
-    url: string | URL;
-    body?: string | Uint8Array | null;
-    headers: Headers | Record<string, string | undefined>;
-    getSecretForKeyId: (keyId: string) => string | undefined | Promise<string | undefined>;
-    nowMs?: number;
-    windowMs?: number;
-    /**
-     * Optional replay protection hook.
-     * Return true if the nonce is accepted and stored; false if replayed/invalid.
-     */
-    verifyNonce?: (keyId: string, nonce: string, ttlMs: number) => Promise<boolean>;
-};
-export type SignedRequestVerifyResult = {
-    ok: true;
-    keyId: string;
-    timestampMs: number;
-    nonce: string;
-} | {
-    ok: false;
-    code: 'MISSING_HEADER' | 'INVALID_TIMESTAMP' | 'EXPIRED' | 'INVALID_BODY_SHA' | 'INVALID_SIGNATURE' | 'UNKNOWN_KEY' | 'REPLAYED';
-    message: string;
-};
-export declare const SignedRequest: Readonly<{
-    sha256Hex: (data: string | Uint8Array) => Promise<string>;
-    canonicalString: (params: {
-        method: string;
-        url: string | URL;
-        timestampMs: number;
-        nonce: string;
-        bodySha256Hex: string;
-    }) => string;
-    createHeaders(params: SignedRequestCreateHeadersParams): Promise<SignedRequestHeaders>;
-    verify(params: SignedRequestVerifyParams): Promise<SignedRequestVerifyResult>;
-}>;
-//# sourceMappingURL=SignedRequest.d.ts.map

package/src/security/SignedRequest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SignedRequest.d.ts","sourceRoot":"","sources":["../../../src/security/SignedRequest.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EACA,gBAAgB,GAChB,mBAAmB,GACnB,SAAS,GACT,kBAAkB,GAClB,mBAAmB,GACnB,aAAa,GACb,UAAU,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAyFN,eAAO,MAAM,aAAa;sBAzBK,MAAM,GAAG,UAAU,KAAG,OAAO,CAAC,MAAM,CAAC;8BAKnC;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;KACvB,KAAG,MAAM;0BAiBoB,gCAAgC,GAAG,OAAO,CAAC,oBAAoB,CAAC;mBAuCvE,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;EAuCnF,CAAC"}

package/src/security/SignedRequest.js

@@ -1,172 +0,0 @@
-import { ErrorFactory } from '../exceptions/ZintrustError.js';
-const getHeader = (headers, name) => {
-    if (typeof headers.get === 'function') {
-        const value = headers.get(name);
-        return value ?? undefined;
-    }
-    return headers[name];
-};
-const timingSafeEquals = (a, b) => {
-    if (a.length !== b.length)
-        return false;
-    let result = 0;
-    for (let i = 0; i < a.length; i++) {
-        result |= (a.codePointAt(i) ?? 0) ^ (b.codePointAt(i) ?? 0);
-    }
-    return result === 0;
-};
-const getCrypto = () => {
-    if (typeof crypto === 'undefined' || crypto.subtle === undefined) {
-        // Some runtimes (or test environments) may not expose WebCrypto.
-        // Keep this as a typed ZinTrust error to satisfy lint rules.
-        throw ErrorFactory.createSecurityError('WebCrypto is not available in this runtime');
-    }
-    return crypto;
-};
-const getSubtle = () => getCrypto().subtle;
-const toBytes = (data) => {
-    const bytes = typeof data === 'string' ? new TextEncoder().encode(data) : data;
-    return new Uint8Array(bytes);
-};
-const toHex = (bytes) => {
-    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-    let out = '';
-    for (const element of view) {
-        out += element.toString(16).padStart(2, '0');
-    }
-    return out;
-};
-const sha256Hex = async (data) => {
-    const digest = await getSubtle().digest('SHA-256', toBytes(data));
-    return toHex(digest);
-};
-const canonicalString = (params) => {
-    const u = typeof params.url === 'string' ? new URL(params.url) : params.url;
-    const method = params.method.toUpperCase();
-    // Keep URL pieces aligned with plan: pathname + search (including leading '?' or '').
-    return [
-        method,
-        u.pathname,
-        u.search,
-        String(params.timestampMs),
-        params.nonce,
-        params.bodySha256Hex,
-    ].join('\n');
-};
-export const SignedRequest = Object.freeze({
-    sha256Hex,
-    canonicalString,
-    async createHeaders(params) {
-        const timestampMs = params.timestampMs ?? Date.now();
-        const webCrypto = getCrypto();
-        const nonce = params.nonce ??
-            (typeof webCrypto.randomUUID === 'function'
-                ? webCrypto.randomUUID()
-                : toHex(webCrypto.getRandomValues(new Uint8Array(16))));
-        const body = params.body ?? '';
-        const bodySha = await sha256Hex(body);
-        const canonical = canonicalString({
-            method: params.method,
-            url: params.url,
-            timestampMs,
-            nonce,
-            bodySha256Hex: bodySha,
-        });
-        const subtle = getSubtle();
-        const key = await subtle.importKey('raw', toBytes(params.secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-        const signatureBytes = await subtle.sign('HMAC', key, toBytes(canonical));
-        const signature = toHex(signatureBytes);
-        return {
-            'x-zt-key-id': params.keyId,
-            'x-zt-timestamp': String(timestampMs),
-            'x-zt-nonce': nonce,
-            'x-zt-body-sha256': bodySha,
-            'x-zt-signature': signature,
-        };
-    },
-    async verify(params) {
-        const parsed = parseAndValidateHeaders(params.headers);
-        if (parsed.ok === false)
-            return parsed;
-        const { keyId, timestampMs, nonce, bodySha, signature } = parsed;
-        const nowMs = params.nowMs ?? Date.now();
-        const windowMs = params.windowMs ?? 60_000;
-        const windowCheck = validateTimestampWindow({ nowMs, timestampMs, windowMs });
-        if (windowCheck.ok === false)
-            return windowCheck;
-        const bodyCheck = await validateBodyHash({ body: params.body ?? '', bodyShaHeader: bodySha });
-        if (bodyCheck.ok === false)
-            return bodyCheck;
-        const secret = await params.getSecretForKeyId(keyId);
-        if (secret === undefined || secret.trim() === '') {
-            return { ok: false, code: 'UNKNOWN_KEY', message: 'Unknown key id' };
-        }
-        const sigCheck = await validateSignature({
-            method: params.method,
-            url: params.url,
-            timestampMs,
-            nonce,
-            bodySha,
-            signature,
-            secret,
-        });
-        if (sigCheck.ok === false)
-            return sigCheck;
-        if (params.verifyNonce !== undefined) {
-            const ok = await params.verifyNonce(keyId, nonce, windowMs);
-            if (ok === false) {
-                return { ok: false, code: 'REPLAYED', message: 'Nonce replayed or rejected' };
-            }
-        }
-        return { ok: true, keyId, timestampMs, nonce };
-    },
-});
-const parseAndValidateHeaders = (headers) => {
-    const keyId = getHeader(headers, 'x-zt-key-id');
-    const ts = getHeader(headers, 'x-zt-timestamp');
-    const nonce = getHeader(headers, 'x-zt-nonce');
-    const bodySha = getHeader(headers, 'x-zt-body-sha256');
-    const signature = getHeader(headers, 'x-zt-signature');
-    if (keyId === undefined ||
-        ts === undefined ||
-        nonce === undefined ||
-        bodySha === undefined ||
-        signature === undefined) {
-        return { ok: false, code: 'MISSING_HEADER', message: 'Missing required signing headers' };
-    }
-    const timestampMs = Number.parseInt(ts, 10);
-    if (!Number.isFinite(timestampMs)) {
-        return { ok: false, code: 'INVALID_TIMESTAMP', message: 'Invalid x-zt-timestamp' };
-    }
-    return { ok: true, keyId, timestampMs, nonce, bodySha, signature };
-};
-const validateTimestampWindow = (params) => {
-    if (Math.abs(params.nowMs - params.timestampMs) > params.windowMs) {
-        return { ok: false, code: 'EXPIRED', message: 'Request timestamp outside allowed window' };
-    }
-    return { ok: true };
-};
-const validateBodyHash = async (params) => {
-    const computedBodySha = await sha256Hex(params.body);
-    if (!timingSafeEquals(computedBodySha, params.bodyShaHeader)) {
-        return { ok: false, code: 'INVALID_BODY_SHA', message: 'Body hash mismatch' };
-    }
-    return { ok: true };
-};
-const validateSignature = async (params) => {
-    const subtle = getSubtle();
-    const canonical = canonicalString({
-        method: params.method,
-        url: params.url,
-        timestampMs: params.timestampMs,
-        nonce: params.nonce,
-        bodySha256Hex: params.bodySha,
-    });
-    const key = await subtle.importKey('raw', toBytes(params.secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-    const expectedBytes = await subtle.sign('HMAC', key, toBytes(canonical));
-    const expected = toHex(expectedBytes);
-    if (!timingSafeEquals(expected, params.signature)) {
-        return { ok: false, code: 'INVALID_SIGNATURE', message: 'Invalid signature' };
-    }
-    return { ok: true };
-};

package/src/security/StartupSecretValidation.d.ts

@@ -1,20 +0,0 @@
-/**
- * Startup Secret Validation
- *
- * Validates critical secrets early at boot time so production misconfiguration
- * fails fast and predictably.
- */
-export type StartupSecretValidationError = {
-    key: string;
-    message: string;
-};
-export type StartupSecretValidationResult = {
-    valid: boolean;
-    errors: StartupSecretValidationError[];
-};
-export declare const StartupSecretValidation: Readonly<{
-    validate(): StartupSecretValidationResult;
-    assertValid(): void;
-}>;
-export default StartupSecretValidation;
-//# sourceMappingURL=StartupSecretValidation.d.ts.map

package/src/security/StartupSecretValidation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"StartupSecretValidation.d.ts","sourceRoot":"","sources":["../../../src/security/StartupSecretValidation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,4BAA4B,EAAE,CAAC;CACxC,CAAC;AAgHF,eAAO,MAAM,uBAAuB;gBACtB,6BAA6B;mBAiB1B,IAAI;EAQnB,CAAC;AAEH,eAAe,uBAAuB,CAAC"}