jschoubben
19666ff054
The manager reseals a rotated refresh token to the node key with crypto_box_seal. That seal was a full inline transcription of TweetNaCl's XSalsa20-Poly1305 and blakejs' BLAKE2b (dependency-free, ~440 lines). Replace the internals with the audited tweetnacl-sealedbox-js library — the same crypto_box_seal, on the same tweetnacl and blakejs the mesh used to validate the seal during Phase C. The exported API is unchanged: seal(value, recipientPublicB64) -> base64. The wire format is unchanged too — ephemeralPub(32) followed by the box, nonce = blake2b(ephemeralPub + recipientPub, 24) — so the host's Go box.OpenAnonymous still opens it. The mesh-control cross-check fixture is regenerated from this seal(). The library and tweetnacl are added to the module's package.json dependencies so the runtime image bundles them (blakejs arrives transitively). A local ambient .d.ts types the untyped CJS bundle; it is imported as a default import because Node's ESM loader cannot see a UMD bundle's named exports. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
20 lines
368 B
JSON
20 lines
368 B
JSON
{
|
|
"compilerOptions": {
|
|
"target": "ES2022",
|
|
"module": "NodeNext",
|
|
"moduleResolution": "NodeNext",
|
|
"strict": true,
|
|
"esModuleInterop": true,
|
|
"skipLibCheck": true,
|
|
"noEmit": true
|
|
},
|
|
"include": [
|
|
"tweetnacl-sealedbox-js.d.ts",
|
|
"sealedbox.ts",
|
|
"grantfile.ts",
|
|
"client.ts",
|
|
"adopt/index.ts",
|
|
"refresh/index.ts"
|
|
]
|
|
}
|