{"version":3,"sources":["../src/canonical-json.ts","../src/signing.ts"],"names":["createHash","_signature","unsigned","generateKeyPairSync","Effect","nodeSign","nodeVerify"],"mappings":";;;;;;;;AAAO,IAAM,YAAA,GAAe,CAAC,KAAA,KAA2B;AACtD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/C,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,CAAA,CAAA,EAAI,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC9D;AAEA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAA,CAAK,MAAM,EAC1B,MAAA,CAAO,CAAC,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA,KAAM,MAAS,CAAA,CACzC,MAAK,CACL,GAAA,CAAI,CAAC,GAAA,KAAQ,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,EAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA,CAAE,CAAA,CAClE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AACd,CAAA;;;ACMO,IAAM,MAAA,GAAS,CAAC,KAAA,KACrBA,mBAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA,CAAO,KAAK;AAE1C,IAAM,cAAc,CAAC,OAAA,KAC1B,MAAA,CAAO,YAAA,CAAa,OAAO,CAAC;AAE9B,IAAM,gBAAA,GAAmB,CACvB,aAAA,KACkC;AAClC,EAAA,IAAI,aAAA,CAAc,WAAW,UAAA,EAAY;AACvC,IAAA,MAAM,EAAE,SAAA,EAAWC,WAAAA,EAAY,GAAGC,WAAS,GAAI,aAAA;AAC/C,IAAA,OAAOA,SAAAA;AAAA,EACT;AAEA,EAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAY,GAAG,UAAS,GAAI,aAAA;AAC/C,EAAA,OAAO,QAAA;AACT,CAAA;AAEA,IAAM,aAAA,GAAgB,CACpB,OAAA,EACA,aAAA,EACA,YAEA,YAAA,CAAa;AAAA,EACX,aAAA;AAAA,EACA,UAAU,OAAA,CAAQ,QAAA;AAAA,EAClB,OAAO,OAAA,CAAQ,KAAA;AAAA,EACf,OAAO,OAAA,CAAQ,KAAA;AAAA,EACf,WAAA,EAAa,YAAY,OAAO;AAClC,CAAC,CAAA;AAEI,IAAM,oBAAA,GAAuB,CAAC,KAAA,KAAgC;AACnE,EAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAU,GAAIC,6BAAoB,SAAS,CAAA;AAC/D,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA,EAAc,UAAU,MAAA,CAAO,EAAE,QAAQ,KAAA,EAAO,IAAA,EAAM,QAAQ;AAAA,GAChE;AACF;AAEO,IAAM,oBAAoB,CAC/B,OAAA,EACA,eACA,OAAA,KAEAC,aAAA,CAAO,KAAK,MAAM;AAChB,EAAA,MAAM,WAAA,GAAc;AAAA,IAClB,QAAA,EAAA,iBAAU,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IACjC,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,KAAA,EAAO,OAAO,UAAA;AAAW,GAC3B;AACA,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,OAAA,EAAS,aAAA,EAAe,WAAW,CAAA;AACjE,EAAA,MAAM,SAAA,GAAYC,aAAA;AAAA,IAChB,IAAA;AAAA,IACA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,IACnB,OAAA,CAAQ;AAAA,GACV;AAEA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,OAAA;AAAA,IACL,MAAA,EAAQ,eAAA;AAAA,IACR,GAAG,WAAA;AAAA,IACH,WAAA,EAAa,YAAY,OAAO,CAAA;AAAA,IAChC,WAAA,EAAa,OAAO,OAAO,CAAA;AAAA,IAC3B,SAAA,EAAW,SAAA,CAAU,QAAA,CAAS,WAAW;AAAA,GAC3C;AACF,CAAC;AAEI,IAAM,mBAAA,GAAsB,CACjC,OAAA,EACA,aAAA,EACA,YAAA,KACY;AACZ,EAAA,MAAM,QAAA,GAAW,iBAAiB,aAAa,CAAA;AAC/C,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,OAAA,EAAS,QAAA,EAAU,cAAc,SAAS,CAAA;AAExE,EAAA,IAAI,WAAA,CAAY,OAAO,CAAA,KAAM,aAAA,CAAc,UAAU,WAAA,EAAa;AAChE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,CAAO,OAAO,CAAA,KAAM,aAAA,CAAc,UAAU,WAAA,EAAa;AAC3D,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAOC,eAAA;AAAA,IACL,IAAA;AAAA,IACA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,IACnB,YAAA;AAAA,IACA,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,SAAA,CAAU,WAAW,WAAW;AAAA,GAC5D;AACF;AAEO,IAAM,oBAAoB,CAC/B,aAAA,KACW,MAAA,CAAO,YAAA,CAAa,aAAa,CAAC","file":"signing.cjs","sourcesContent":["export const canonicalize = (value: unknown): string => {\n  if (value === null || typeof value !== \"object\") {\n    return JSON.stringify(value);\n  }\n\n  if (Array.isArray(value)) {\n    return `[${value.map((item) => canonicalize(item)).join(\",\")}]`;\n  }\n\n  const record = value as Record<string, unknown>;\n  return `{${Object.keys(record)\n    .filter((key) => record[key] !== undefined)\n    .sort()\n    .map((key) => `${JSON.stringify(key)}:${canonicalize(record[key])}`)\n    .join(\",\")}}`;\n};\n","import {\n  createHash,\n  generateKeyPairSync,\n  sign as nodeSign,\n  verify as nodeVerify\n} from \"node:crypto\";\nimport { Effect } from \"effect\";\nimport { canonicalize } from \"./canonical-json.js\";\nimport type {\n  AuthorizationRequest,\n  SignatureReceipt,\n  TerminalDetermination,\n  UnsignedTerminalDetermination\n} from \"./domain.js\";\n\nexport interface PayerKeyPair {\n  readonly keyId: string;\n  readonly privateKey: unknown;\n  readonly publicKeyPem: string;\n}\n\nexport const sha256 = (value: string): string =>\n  createHash(\"sha256\").update(value).digest(\"hex\");\n\nexport const requestHash = (request: AuthorizationRequest): string =>\n  sha256(canonicalize(request));\n\nconst withoutSignature = (\n  determination: TerminalDetermination\n): UnsignedTerminalDetermination => {\n  if (determination.status === \"approved\") {\n    const { signature: _signature, ...unsigned } = determination;\n    return unsigned;\n  }\n\n  const { signature: _signature, ...unsigned } = determination;\n  return unsigned;\n};\n\nconst signedPayload = (\n  request: AuthorizationRequest,\n  determination: UnsignedTerminalDetermination,\n  receipt: Pick<SignatureReceipt, \"issuedAt\" | \"keyId\" | \"nonce\">\n) =>\n  canonicalize({\n    determination,\n    issuedAt: receipt.issuedAt,\n    keyId: receipt.keyId,\n    nonce: receipt.nonce,\n    requestHash: requestHash(request)\n  });\n\nexport const generatePayerKeyPair = (keyId: string): PayerKeyPair => {\n  const { privateKey, publicKey } = generateKeyPairSync(\"ed25519\");\n  return {\n    keyId,\n    privateKey,\n    publicKeyPem: publicKey.export({ format: \"pem\", type: \"spki\" }) as string\n  };\n};\n\nexport const signDetermination = (\n  request: AuthorizationRequest,\n  determination: UnsignedTerminalDetermination,\n  keyPair: PayerKeyPair\n): Effect.Effect<SignatureReceipt> =>\n  Effect.sync(() => {\n    const receiptBase = {\n      issuedAt: new Date().toISOString(),\n      keyId: keyPair.keyId,\n      nonce: crypto.randomUUID()\n    };\n    const payload = signedPayload(request, determination, receiptBase);\n    const signature = nodeSign(\n      null,\n      Buffer.from(payload),\n      keyPair.privateKey as Parameters<typeof nodeSign>[2]\n    );\n\n    return {\n      alg: \"EdDSA\",\n      format: \"detached-json\",\n      ...receiptBase,\n      requestHash: requestHash(request),\n      payloadHash: sha256(payload),\n      signature: signature.toString(\"base64url\")\n    };\n  });\n\nexport const verifyDetermination = (\n  request: AuthorizationRequest,\n  determination: TerminalDetermination,\n  publicKeyPem: string\n): boolean => {\n  const unsigned = withoutSignature(determination);\n  const payload = signedPayload(request, unsigned, determination.signature);\n\n  if (requestHash(request) !== determination.signature.requestHash) {\n    return false;\n  }\n\n  if (sha256(payload) !== determination.signature.payloadHash) {\n    return false;\n  }\n\n  return nodeVerify(\n    null,\n    Buffer.from(payload),\n    publicKeyPem,\n    Buffer.from(determination.signature.signature, \"base64url\")\n  );\n};\n\nexport const determinationHash = (\n  determination: TerminalDetermination\n): string => sha256(canonicalize(determination));\n"]}