calllint 1.0.0 → 1.0.1

package/dist/index.js

@@ -4409,6 +4409,9 @@ function approveCommand(args, deps) {
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
 import { resolve as resolve4 } from "node:path";
 
+// ../../packages/signature/src/ed25519.ts
+import { createHash as createHash2 } from "node:crypto";
+
 // ../../node_modules/.pnpm/@noble+ed25519@2.3.0/node_modules/@noble/ed25519/index.js
 var ed25519_CURVE = {
   p: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,
@@ -4759,8 +4762,8 @@ var hash2extK = (hashed) => {
 };
 var getExtendedPublicKeyAsync = (priv) => sha512a(toU8(priv, L)).then(hash2extK);
 var getExtendedPublicKey = (priv) => hash2extK(sha512s(toU8(priv, L)));
-var getPublicKeyAsync = (priv) => getExtendedPublicKeyAsync(priv).then((p) => p.pointBytes);
-var hashFinishA = (res) => sha512a(res.hashable).then(res.finish);
+var getPublicKey = (priv) => getExtendedPublicKey(priv).pointBytes;
+var hashFinishS = (res) => res.finish(sha512s(res.hashable));
 var _sign = (e, rBytes, msg) => {
   const { pointBytes: P2, scalar: s } = e;
   const r = modL_LE(rBytes);
@@ -4772,11 +4775,11 @@ var _sign = (e, rBytes, msg) => {
   };
   return { hashable, finish };
 };
-var signAsync = async (msg, privKey) => {
+var sign = (msg, privKey) => {
   const m = toU8(msg);
-  const e = await getExtendedPublicKeyAsync(privKey);
-  const rBytes = await sha512a(e.prefix, m);
-  return hashFinishA(_sign(e, rBytes, m));
+  const e = getExtendedPublicKey(privKey);
+  const rBytes = sha512s(e.prefix, m);
+  return hashFinishS(_sign(e, rBytes, m));
 };
 var veriOpts = { zip215: true };
 var _verify = (sig, msg, pub, opts = veriOpts) => {
@@ -4808,7 +4811,7 @@ var _verify = (sig, msg, pub, opts = veriOpts) => {
   };
   return { hashable, finish };
 };
-var verifyAsync = async (s, m, p, opts = veriOpts) => hashFinishA(_verify(s, m, p, opts));
+var verify = (s, m, p, opts = veriOpts) => hashFinishS(_verify(s, m, p, opts));
 var etc = {
   sha512Async: async (...messages) => {
     const s = subtle();
@@ -4899,21 +4902,26 @@ function base64urlDecode(str) {
 }
 
 // ../../packages/signature/src/ed25519.ts
-async function generateKeypair(keyId) {
+etc.sha512Sync = (...messages) => {
+  const hash = createHash2("sha512");
+  hash.update(etc.concatBytes(...messages));
+  return new Uint8Array(hash.digest());
+};
+function generateKeypair(keyId) {
   const privateKey = utils.randomPrivateKey();
-  const publicKey = await getPublicKeyAsync(privateKey);
+  const publicKey = getPublicKey(privateKey);
   return {
     privateKey,
     publicKey,
     keyId
   };
 }
-async function signReceipt(unsignedReceipt, keypair) {
+function signReceipt(unsignedReceipt, keypair) {
   const canonical = stableStringify(unsignedReceipt);
   const hash = sha256(canonical);
   const hashHex = hash.slice(7);
   const hashBytes = Buffer.from(hashHex, "hex");
-  const signatureBytes = await signAsync(hashBytes, keypair.privateKey);
+  const signatureBytes = sign(hashBytes, keypair.privateKey);
   const signatureBase64url = base64urlEncode(signatureBytes);
   return {
     algorithm: "ed25519",
@@ -4922,7 +4930,7 @@ async function signReceipt(unsignedReceipt, keypair) {
     signed_at: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function verifyReceipt2(signedReceipt, publicKey) {
+function verifyReceipt2(signedReceipt, publicKey) {
   try {
     const sig = signedReceipt.signature;
     if (!sig) {
@@ -4944,7 +4952,7 @@ async function verifyReceipt2(signedReceipt, publicKey) {
     const hash = sha256(canonical);
     const hashHex = hash.slice(7);
     const hashBytes = Buffer.from(hashHex, "hex");
-    const valid = await verifyAsync(signatureBytes, hashBytes, publicKeyBytes);
+    const valid = verify(signatureBytes, hashBytes, publicKeyBytes);
     return { valid, key_id: sig.key_id };
   } catch (error) {
     return {
@@ -5043,53 +5051,7 @@ function receiptVerify(args, deps) {
   }
   const receipt = parsed;
   if (receipt.signature) {
-    let cryptoResult = null;
-    let errorMsg = null;
-    try {
-      const promise = verifySignature(receipt, args);
-      let done = false;
-      promise.then(
-        (r) => {
-          cryptoResult = r;
-          done = true;
-        },
-        (e) => {
-          errorMsg = e instanceof Error ? e.message : String(e);
-          done = true;
-        }
-      );
-      const start = Date.now();
-      while (!done && Date.now() - start < 5e3) {
-      }
-      if (!done) {
-        return {
-          stdout: "",
-          stderr: "Signature verification timed out",
-          exitCode: EXIT.ERROR
-        };
-      }
-      if (errorMsg) {
-        return {
-          stdout: "",
-          stderr: `Signature verification failed: ${errorMsg}`,
-          exitCode: EXIT.ERROR
-        };
-      }
-      if (!cryptoResult) {
-        return {
-          stdout: "",
-          stderr: "Signature verification failed (no result)",
-          exitCode: EXIT.ERROR
-        };
-      }
-      return formatVerifyResult(receipt, cryptoResult, args);
-    } catch (e) {
-      return {
-        stdout: "",
-        stderr: `Signature verification error: ${e instanceof Error ? e.message : String(e)}`,
-        exitCode: EXIT.ERROR
-      };
-    }
+    return verifySignature(receipt, args, deps);
   }
   if (flagBool(args.flags, "json")) {
     return {
@@ -5116,34 +5078,39 @@ function receiptVerify(args, deps) {
   ].join("\n");
   return { stdout, exitCode: EXIT.OK };
 }
-async function verifySignature(receipt, args) {
+function verifySignature(receipt, args, deps) {
   const sig = receipt.signature;
   const publicKeyUrl = sig.public_key_url || "https://calllint.com/.well-known/receipt-keys.json";
-  let publicKey;
   const publicKeyFlag = args.flags["public-key"];
-  if (publicKeyFlag && typeof publicKeyFlag === "string") {
-    try {
-      const keyJson = JSON.parse(readFileSync8(publicKeyFlag, "utf8"));
-      publicKey = keyJson.public_key;
-    } catch (e) {
-      throw new Error(
-        `Could not read public key from ${publicKeyFlag}: ${e instanceof Error ? e.message : String(e)}`
-      );
+  if (!publicKeyFlag || typeof publicKeyFlag !== "string") {
+    return {
+      stdout: "",
+      stderr: [
+        "Receipt has a signature but no public key was provided.",
+        `  Signature key_id: ${sig.key_id}`,
+        `  Public key URL:   ${publicKeyUrl}`,
+        "",
+        "Verify offline by passing the public key:",
+        "  calllint receipt verify <receipt.json> --public-key <keyfile>"
+      ].join("\n"),
+      exitCode: EXIT.ERROR
+    };
+  }
+  let publicKey;
+  try {
+    const keyJson = JSON.parse(readFileSync8(resolve4(deps.cwd, publicKeyFlag), "utf8"));
+    publicKey = keyJson.public_key;
+    if (typeof publicKey !== "string") {
+      throw new Error("key file has no string 'public_key' field");
     }
-  } else {
-    throw new Error(
-      `Receipt has signature but public key not available.
-Signature key_id: ${sig.key_id}
-Public key URL: ${publicKeyUrl}
-
-To verify locally, provide public key with --public-key <keyfile>
-Example: calllint receipt verify receipt.json --public-key dev-key.json`
-    );
+  } catch (e) {
+    return {
+      stdout: "",
+      stderr: `Could not read public key from ${publicKeyFlag}: ${e instanceof Error ? e.message : String(e)}`,
+      exitCode: EXIT.ERROR
+    };
   }
-  return await verifyReceipt2(receipt, publicKey);
-}
-function formatVerifyResult(receipt, cryptoResult, args) {
-  const sig = receipt.signature;
+  const cryptoResult = verifyReceipt2(receipt, publicKey);
   if (flagBool(args.flags, "json")) {
     return {
       stdout: JSON.stringify(
@@ -5202,23 +5169,13 @@ function receiptSign(args, deps) {
       exitCode: EXIT.USAGE
     };
   }
-  let receiptRaw;
-  try {
-    receiptRaw = readFileSync8(resolve4(deps.cwd, receiptFile), "utf8");
-  } catch (e) {
-    return {
-      stdout: "",
-      stderr: `Could not read receipt ${receiptFile}: ${e instanceof Error ? e.message : String(e)}`,
-      exitCode: EXIT.ERROR
-    };
-  }
   let unsignedReceipt;
   try {
-    unsignedReceipt = JSON.parse(receiptRaw);
+    unsignedReceipt = JSON.parse(readFileSync8(resolve4(deps.cwd, receiptFile), "utf8"));
   } catch (e) {
     return {
       stdout: "",
-      stderr: `Receipt is not valid JSON: ${e instanceof Error ? e.message : String(e)}`,
+      stderr: `Could not read receipt ${receiptFile}: ${e instanceof Error ? e.message : String(e)}`,
       exitCode: EXIT.ERROR
     };
   }
@@ -5229,69 +5186,21 @@ function receiptSign(args, deps) {
       exitCode: EXIT.ERROR
     };
   }
-  let keyJson;
-  try {
-    const keyRaw = readFileSync8(resolve4(deps.cwd, keyFile), "utf8");
-    keyJson = JSON.parse(keyRaw);
-  } catch (e) {
-    return {
-      stdout: "",
-      stderr: `Could not read key file ${keyFile}: ${e instanceof Error ? e.message : String(e)}`,
-      exitCode: EXIT.ERROR
-    };
-  }
   let keypair;
   try {
+    const keyJson = JSON.parse(readFileSync8(resolve4(deps.cwd, keyFile), "utf8"));
     keypair = importKeypair(keyJson);
   } catch (e) {
     return {
       stdout: "",
-      stderr: `Invalid keypair format: ${e instanceof Error ? e.message : String(e)}`,
-      exitCode: EXIT.ERROR
-    };
-  }
-  let signature = null;
-  let errorMsg = null;
-  const promise = signReceipt(unsignedReceipt, keypair);
-  let done = false;
-  promise.then(
-    (sig) => {
-      signature = sig;
-      done = true;
-    },
-    (e) => {
-      errorMsg = e instanceof Error ? e.message : String(e);
-      done = true;
-    }
-  );
-  const start = Date.now();
-  while (!done && Date.now() - start < 5e3) {
-  }
-  if (!done) {
-    return {
-      stdout: "",
-      stderr: "Signing timed out",
-      exitCode: EXIT.ERROR
-    };
-  }
-  if (errorMsg) {
-    return {
-      stdout: "",
-      stderr: `Signing failed: ${errorMsg}`,
-      exitCode: EXIT.ERROR
-    };
-  }
-  if (!signature) {
-    return {
-      stdout: "",
-      stderr: "Signing failed (no result)",
+      stderr: `Could not read key file ${keyFile}: ${e instanceof Error ? e.message : String(e)}`,
       exitCode: EXIT.ERROR
     };
   }
   try {
+    const signature = signReceipt(unsignedReceipt, keypair);
     const signedReceipt = { ...unsignedReceipt, signature };
-    const outPath = resolve4(deps.cwd, outFile);
-    writeFileSync6(outPath, JSON.stringify(signedReceipt, null, 2) + "\n", "utf8");
+    writeFileSync6(resolve4(deps.cwd, outFile), JSON.stringify(signedReceipt, null, 2) + "\n", "utf8");
     const stdout = [
       "\u2713 Receipt signed successfully",
       `  Key ID: ${signature.key_id}`,
@@ -5303,7 +5212,7 @@ function receiptSign(args, deps) {
   } catch (e) {
     return {
       stdout: "",
-      stderr: `Failed to write signed receipt: ${e instanceof Error ? e.message : String(e)}`,
+      stderr: `Signing failed: ${e instanceof Error ? e.message : String(e)}`,
       exitCode: EXIT.ERROR
     };
   }
@@ -5323,48 +5232,10 @@ function receiptKeygen(args, deps) {
     };
   }
   const keyId = args.flags["key-id"] || "calllint-dev-2026-h2";
-  let keypair = null;
-  let errorMsg = null;
-  const promise = generateKeypair(keyId);
-  let done = false;
-  promise.then(
-    (kp) => {
-      keypair = kp;
-      done = true;
-    },
-    (e) => {
-      errorMsg = e instanceof Error ? e.message : String(e);
-      done = true;
-    }
-  );
-  const start = Date.now();
-  while (!done && Date.now() - start < 5e3) {
-  }
-  if (!done) {
-    return {
-      stdout: "",
-      stderr: "Keygen timed out",
-      exitCode: EXIT.ERROR
-    };
-  }
-  if (errorMsg) {
-    return {
-      stdout: "",
-      stderr: `Keygen failed: ${errorMsg}`,
-      exitCode: EXIT.ERROR
-    };
-  }
-  if (!keypair) {
-    return {
-      stdout: "",
-      stderr: "Keygen failed (no result)",
-      exitCode: EXIT.ERROR
-    };
-  }
   try {
+    const keypair = generateKeypair(keyId);
     const exported = exportKeypair(keypair);
-    const outPath = resolve4(deps.cwd, outFile);
-    writeFileSync6(outPath, JSON.stringify(exported, null, 2) + "\n", "utf8");
+    writeFileSync6(resolve4(deps.cwd, outFile), JSON.stringify(exported, null, 2) + "\n", "utf8");
     const stdout = [
       "\u2713 Keypair generated successfully",
       `  Key ID: ${keyId}`,
@@ -5377,7 +5248,7 @@ function receiptKeygen(args, deps) {
   } catch (e) {
     return {
       stdout: "",
-      stderr: `Failed to write keypair: ${e instanceof Error ? e.message : String(e)}`,
+      stderr: `Keygen failed: ${e instanceof Error ? e.message : String(e)}`,
       exitCode: EXIT.ERROR
     };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",