shinten-ship 0.1.2 → 0.2.0

package/README.ja.md

@@ -29,7 +29,7 @@ shinten-ship はその誰かの道具です。出荷担当の端末で動き、
 
 ```sh
 npm install -g shinten-ship
-shinten keygen > desk.json          # shinten の鍵。公開側を店舗のフォームの宛先として公開する
+shinten keygen -o desk.json         # shinten の鍵。公開側を店舗のフォームの宛先として公開する
 ```
 
 `ship.json` に差出人と業者のアカウントを書きます。
@@ -38,10 +38,18 @@ shinten keygen > desk.json          # shinten の鍵。公開側を店舗のフ
 {
   "sender": { "name": "株式会社テスト商店", "postalCode": "100-0001", "address": "東京都千代田区千代田1-1", "building": "テストビル3F", "phone": "03-1234-5678" },
   "yamato": { "customerCode": "123456789", "fareCode": "01" },
-  "japanpost": { "mailType": "0" }
+  "japanpost": { "mailType": "0" },
+  "recipients": { "keys": [ { "kty": "EC", "crv": "P-256", "...": "この発送窓口" }, { "kty": "EC", "crv": "P-256", "...": "控えの鍵" } ] }
 }
 ```
 
+`recipients` は、店舗のフォームが封じるはずの公開鍵を、この発送窓口が承認したものです。
+他の鍵にも封じられた注文や、これらの鍵が欠けた注文は、店舗のサイトの鍵一覧が
+差し替えられたことを意味します。ラベルは一つも作られず、`labels` は STOP で終わります。
+同じ鍵で `shinten watch -r` を定期的に店舗の鍵一覧に向けて実行すれば、注文が来る前に
+差し替えを見つけられます。
+
+
 ヤマトの `customerCode` は B2クラウド契約のご請求先顧客コード、`fareCode` は
 運賃管理番号です。請求先コードに3桁の分類がある場合は `classCode` を足します。
 

package/README.md

@@ -32,7 +32,7 @@ alone cannot be opened by anyone.
 
 ```sh
 npm install -g shinten-ship
-shinten keygen > desk.json          # from shinten; publish the public half as a recipient of the store's forms
+shinten keygen -o desk.json         # from shinten; publish the public half as a recipient of the store's forms
 ```
 
 `ship.json` holds the sender and the carrier accounts:
@@ -41,10 +41,18 @@ shinten keygen > desk.json          # from shinten; publish the public half as a
 {
   "sender": { "name": "株式会社テスト商店", "postalCode": "100-0001", "address": "東京都千代田区千代田1-1", "building": "テストビル3F", "phone": "03-1234-5678" },
   "yamato": { "customerCode": "123456789", "fareCode": "01" },
-  "japanpost": { "mailType": "0" }
+  "japanpost": { "mailType": "0" },
+  "recipients": { "keys": [ { "kty": "EC", "crv": "P-256", "...": "this desk" }, { "kty": "EC", "crv": "P-256", "...": "the backup" } ] }
 }
 ```
 
+`recipients` are the public keys the store's forms are meant to seal to, as
+this desk approved them. An order sealed to any other key, or missing one of
+these, means the key list on the store's site was replaced: no labels are
+made, and `labels` exits with STOP. Run `shinten watch -r` on the same keys
+against the store's key list on a schedule, to find a replacement before
+any order.
+
 For Yamato, `customerCode` is the ご請求先顧客コード and `fareCode` the
 運賃管理番号 from your B2 Cloud contract; add `classCode` when the billing
 code has a 3-digit class.

package/dist/src/cli.js

@@ -52,7 +52,15 @@ async function main(argv) {
             const config = parseConfig(await readFile(need(values.config ?? process.env.SHINTEN_SHIP_CONFIG, '--config or SHINTEN_SHIP_CONFIG'), 'utf8'));
             const orders = parseOrders(await readText(positionals[0]));
             const out = values.out ?? `labels-${c.id}-${new Date().toISOString().slice(0, 10)}.csv`;
+            if (!config.recipients)
+                console.error('warning: ship.json has no recipients; orders are not checked against the keys this desk approved');
             const r = await makeLabels({ orders, carrier: c, config, key, recorder: new JsonlRecorder() });
+            if (r.alarm) {
+                for (const p of r.problems)
+                    console.error(`order ${p.order}: ${p.problem}`);
+                console.error(`STOP: ${r.alarm}`);
+                return 3;
+            }
             await writeFile(out, r.file, { mode: 0o600 });
             for (const p of r.problems)
                 console.error(`order ${p.order}: ${p.problem}`);

package/dist/src/config.d.ts

@@ -1,6 +1,13 @@
-/** The desk's configuration: who the parcels are from, and the carrier accounts. */
+import type { JWK } from 'jose';
+/** The desk's configuration: who the parcels are from, the carrier accounts, and the keys the desk approved. */
 export interface Config {
     sender: Sender;
+    /**
+     * The public keys the store's forms are meant to seal to: this desk's and
+     * the backup. An order sealed to any other key, or missing one of these,
+     * means the key list on the store's site was replaced; no labels are made.
+     */
+    recipients?: JWK[];
     yamato?: {
         /** ご請求先顧客コード, 9 to 12 digits. Required by B2 Cloud for imported data. */
         customerCode: string;

package/dist/src/config.js

@@ -1,5 +1,12 @@
 export function parseConfig(json) {
     const c = JSON.parse(json);
+    if (c.recipients !== undefined) {
+        const list = Array.isArray(c.recipients) ? c.recipients : c.recipients.keys;
+        if (!Array.isArray(list) || list.length === 0 || list.some((k) => typeof k !== 'object' || 'd' in k)) {
+            throw new Error('config: recipients must be the approved public keys, a JWK Set or a list');
+        }
+        c.recipients = list;
+    }
     const s = c.sender;
     if (!s || typeof s.name !== 'string' || typeof s.postalCode !== 'string' || typeof s.address !== 'string' || typeof s.phone !== 'string') {
         throw new Error('config: sender needs name, postalCode, address and phone');

package/dist/src/labels.d.ts

@@ -19,6 +19,12 @@ export interface Labels {
     }[];
     /** Orders left out, and why. */
     problems: Problem[];
+    /**
+     * Set when an order was sealed to keys the desk did not approve: the key
+     * list on the store's site was replaced. No labels are written; stop and
+     * check the site before opening anything more.
+     */
+    alarm?: string;
 }
 export interface MakeLabelsOptions {
     orders: Order[];

package/dist/src/labels.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { open } from 'shinten';
+import { open, RecipientError } from 'shinten';
 import { encodeCsv, formatCsv } from './csv.js';
 export function sha256(b) {
     return createHash('sha256').update(b).digest('hex');
@@ -16,11 +16,12 @@ export async function makeLabels(opts) {
     const rows = [opts.carrier.header];
     const written = [];
     const problems = [];
+    const alarmed = [];
     for (const order of opts.orders) {
         const envelope = sha256(JSON.stringify(order.envelope));
         let delivery;
         try {
-            const opened = await open({ clear: { postalCode: order.postalCode }, envelope: order.envelope }, opts.key);
+            const opened = await open({ clear: { postalCode: order.postalCode }, envelope: order.envelope }, opts.key, opts.config.recipients ? { recipients: opts.config.recipients } : {});
             if (opened.profile !== 'shipping')
                 throw new Error(`envelope profile is ${opened.profile}, not shipping`);
             const f = opened.fields;
@@ -28,6 +29,8 @@ export async function makeLabels(opts) {
         }
         catch (e) {
             problems.push({ order: order.id, problem: e.message });
+            if (e instanceof RecipientError)
+                alarmed.push(order.id);
             continue;
         }
         const r = opts.carrier.row(order, delivery, opts.config, today);
@@ -39,6 +42,13 @@ export async function makeLabels(opts) {
         rows.push(r.cells);
         written.push({ id: order.id, envelope });
     }
+    if (alarmed.length) {
+        // One order sealed to a stranger's key means every order since the key
+        // list changed may have been: make nothing, and say so.
+        const alarm = `orders ${alarmed.join(', ')} were sealed to keys this desk did not approve: the key list on the store's site may have been replaced. No labels were made. Check the site's keys (shinten watch) before opening anything more.`;
+        const file = encodeCsv(formatCsv([opts.carrier.header]), opts.carrier.encoding);
+        return { file, digest: sha256(file), written: [], problems, alarm };
+    }
     const file = encodeCsv(formatCsv(rows), opts.carrier.encoding);
     const digest = sha256(file);
     if (opts.recorder && written.length) {

package/dist/src/mcp.js

@@ -52,6 +52,8 @@ export function deskServer(opts) {
         const c = carrier(id);
         const source = orders.trimStart().startsWith('[') || orders.trimStart().startsWith('{') || orders.includes('\n') ? orders : decodeCsv(await readFile(orders));
         const r = await makeLabels({ orders: parseOrders(source), carrier: c, config: await config(), key: await key(), recorder });
+        if (r.alarm)
+            throw new Error(`STOP: ${r.alarm} Tell the person running the desk.`);
         await writeFile(out, r.file, { mode: 0o600 });
         const result = { out, digest: r.digest, written: r.written, problems: r.problems, note: c.note };
         return { ...text(result), structuredContent: result };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shinten-ship",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "The shipping desk for shinten: opens sealed delivery addresses on the desk's own device and writes the carrier's label-import CSV, so the store never holds an address in the clear.",
   "license": "Apache-2.0",
   "repository": "github:eucassoc/shinten-ship",
@@ -25,7 +25,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.2",
     "iconv-lite": "^0.6.3",
-    "shinten": "^0.1.0",
+    "shinten": "^0.2.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {