{"_id":"@bolthub/verify","_rev":"5-bc4d6c63752244ad767f106256b2c1d4","name":"@bolthub/verify","dist-tags":{"latest":"0.1.2"},"versions":{"0.1.0":{"name":"@bolthub/verify","version":"0.1.0","keywords":["bolthub","l402","gateway","hmac","origin-protection","middleware","express","fastify"],"license":"MIT","_id":"@bolthub/verify@0.1.0","maintainers":[{"name":"bolthub.ai","email":"contact@bolthub.ai"}],"homepage":"https://github.com/signaltech-org/bolthub.ai#readme","bugs":{"url":"https://github.com/signaltech-org/bolthub.ai/issues"},"dist":{"shasum":"4b01807bdcc1c0b4760e089e5eed44e0c9af278e","tarball":"https://registry.npmjs.org/@bolthub/verify/-/verify-0.1.0.tgz","fileCount":6,"integrity":"sha512-o7AgK/fPiIBh1rLu3NAKZBu6C4cOkjrauu+olYnEHHF9zW2GvVAo3knoyvq3oQDBsvS3SLRJ1slZGqwWIV2Y8Q==","signatures":[{"sig":"MEUCIClsUKou9Eo00k5ykvgGagbD2FhnhGVnUT15owUlYAo3AiEAlvoeIO9w2+Zfdmj9adytg9jxRom8nM8MAZRzdr+of64=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":14160},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"gitHead":"957d33f2c37a1df1f892d8965a4516e59934e7a8","scripts":{"test":"bun test","build":"bun build src/index.ts --outdir dist --target node --format esm && cp dist/index.js dist/index.mjs && bun build src/index.ts --outdir dist --target node --format cjs && bun x tsc --emitDeclarationOnly --outDir dist --declaration --project tsconfig.build.json","prepublishOnly":"bun run build"},"_npmUser":{"name":"bolthub.ai","email":"contact@bolthub.ai"},"deprecated":"Pre-provenance build — upgrade. Releases now ship with verified npm provenance from github.com/signaltech-org/bolthub-sdk","repository":{"url":"git+https://github.com/signaltech-org/bolthub.ai.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.7","description":"Verify bolthub gateway signatures on your origin server — Express, Fastify, or generic Node.js middleware","directories":{},"_nodeVersion":"22.22.2","_hasShrinkwrap":false,"devDependencies":{"@types/node":"^22"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.0_1778827156984_0.28702456489413275","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@bolthub/verify","version":"0.1.1","keywords":["bolthub","l402","gateway","hmac","origin-protection","middleware","express","fastify"],"license":"MIT","_id":"@bolthub/verify@0.1.1","maintainers":[{"name":"bolthub.ai","email":"contact@bolthub.ai"}],"homepage":"https://github.com/signaltech-org/bolthub.ai#readme","bugs":{"url":"https://github.com/signaltech-org/bolthub.ai/issues"},"dist":{"shasum":"da4353f45e3f4cf2aa00b325a27b6a9dd886dd57","tarball":"https://registry.npmjs.org/@bolthub/verify/-/verify-0.1.1.tgz","fileCount":6,"integrity":"sha512-H6RYeofXRO9w0O4PuidU6JLvzCuQrbgX5myok0caML4oE+7PQD8LPPPL4cHzVyuKhb8mcgzujicdOUcecrBiNg==","signatures":[{"sig":"MEUCIAhLRfwQmTQP9wZ9+Tja3I1vGUdXwegs3DOh0Q9vNhBQAiEA/DseG1rTWZLt3ZNyNsau43dXD3xxUBxpbL32nkMtx+A=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":14200},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"},"./package.json":"./package.json"},"gitHead":"08e39312ea232f6e479bfad8c8aef5947e08abd2","scripts":{"test":"bun test","build":"bun build src/index.ts --outdir dist --target node --format esm && cp dist/index.js dist/index.mjs && bun build src/index.ts --outdir dist --target node --format cjs && bun x tsc --emitDeclarationOnly --outDir dist --declaration --project tsconfig.build.json","prepublishOnly":"bun run build"},"_npmUser":{"name":"bolthub.ai","email":"contact@bolthub.ai"},"deprecated":"Pre-provenance build — upgrade. Releases now ship with verified npm provenance from github.com/signaltech-org/bolthub-sdk","repository":{"url":"git+https://github.com/signaltech-org/bolthub.ai.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.7","description":"Verify bolthub gateway signatures on your origin server — Express, Fastify, or generic Node.js middleware","directories":{},"_nodeVersion":"22.22.2","_hasShrinkwrap":false,"devDependencies":{"@types/node":"^22"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.1_1778831354123_0.827998703164627","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"name":"@bolthub/verify","version":"0.1.2","keywords":["bolthub","l402","gateway","hmac","origin-protection","middleware","express","fastify"],"license":"MIT","_id":"@bolthub/verify@0.1.2","maintainers":[{"name":"bolthub.ai","email":"contact@bolthub.ai"}],"homepage":"https://docs.bolthub.ai","bugs":{"url":"https://github.com/signaltech-org/bolthub-sdk/issues"},"dist":{"shasum":"8f4efe9626772713d1532e864773dd473c36c83e","tarball":"https://registry.npmjs.org/@bolthub/verify/-/verify-0.1.2.tgz","fileCount":6,"integrity":"sha512-upmaHrwOn0DMbnzyWCpr8JqiVSVpKYO80UgLQVGQj/med3bjEc6fWi8fMqq33ouXUIoZyQlQAAfrqXH0XKXFNA==","signatures":[{"sig":"MEYCIQCTWZrQfrugN2NP/z/q+tn85weeZLGt7PPZR476rDzFsAIhAO3dRS+vxPWBiKFlQ9K1/Ulyrt3cuqWOcYbCRhbN0Yi/","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@bolthub%2fverify@0.1.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":14376},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"},"./package.json":"./package.json"},"gitHead":"2c200f6319c2f8b7c3a3379e6c525a9eb9ab7534","scripts":{"test":"bun test","build":"bun build src/index.ts --outdir dist --target node --format esm && cp dist/index.js dist/index.mjs && bun build src/index.ts --outdir dist --target node --format cjs && bun x tsc --emitDeclarationOnly --outDir dist --declaration --project tsconfig.build.json","prepublishOnly":"bun run build"},"_npmUser":{"name":"bolthub.ai","email":"contact@bolthub.ai"},"repository":{"url":"git+https://github.com/signaltech-org/bolthub-sdk.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.8","description":"Verify bolthub gateway signatures on your origin server — Express, Fastify, or generic Node.js middleware","directories":{},"_nodeVersion":"22.22.3","_hasShrinkwrap":false,"devDependencies":{"@types/node":"^22"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.2_1781075615712_0.28471712238001157","host":"s3://npm-registry-packages-npm-production"}}},"time":{"created":"2026-05-15T06:39:16.868Z","modified":"2026-06-12T04:35:55.599Z","0.1.0":"2026-05-15T06:39:17.130Z","0.1.1":"2026-05-15T07:49:14.247Z","0.1.2":"2026-06-10T07:13:35.908Z"},"bugs":{"url":"https://github.com/signaltech-org/bolthub-sdk/issues"},"license":"MIT","homepage":"https://docs.bolthub.ai","keywords":["bolthub","l402","gateway","hmac","origin-protection","middleware","express","fastify"],"repository":{"url":"git+https://github.com/signaltech-org/bolthub-sdk.git","type":"git","directory":"packages/verify"},"description":"Verify bolthub gateway signatures on your origin server — Express, Fastify, or generic Node.js middleware","maintainers":[{"name":"bolthub.ai","email":"contact@bolthub.ai"}],"readme":"# @bolthub/verify\n\nVerify that incoming requests to your origin server were proxied through the BoltHub gateway. Zero dependencies; uses only Node.js built-in `crypto`.\n\n## Install\n\n```bash\nnpm install @bolthub/verify\n```\n\n## Quick Start (Express)\n\n```typescript\nimport { expressHmacMiddleware } from \"@bolthub/verify\";\n\napp.use(\n  expressHmacMiddleware({\n    secrets: [process.env.HMAC_SECRET!],\n  })\n);\n```\n\nRequests without a valid `X-Gateway-Signature` header are rejected with `403`.\n\n## Verification Methods\n\nBoltHub supports two verification methods:\n\n### HMAC Signature (recommended)\n\nThe gateway signs every request with HMAC-SHA256 over the canonical payload\n`METHOD\\nPATH\\nTIMESTAMP\\nNONCE\\nBODY`. This prevents replay attacks and\nbody tampering.\n\n```typescript\nimport { verifyGatewaySignature } from \"@bolthub/verify\";\n\nconst result = verifyGatewaySignature(\n  {\n    method: req.method,\n    path: req.path,\n    headers: req.headers,\n    body: rawBody,\n  },\n  { secrets: [process.env.HMAC_SECRET!] }\n);\n\nif (!result.valid) {\n  return res.status(403).json({ error: result.error });\n}\n```\n\n### Shared Secret\n\nA simpler method where the gateway sends a static `X-Gateway-Secret` header.\nNo replay protection, but easier to set up.\n\n```typescript\nimport { verifyGatewaySecret } from \"@bolthub/verify\";\n\nconst result = verifyGatewaySecret(\n  { method: req.method, path: req.path, headers: req.headers },\n  { secrets: [process.env.GATEWAY_SECRET!] }\n);\n```\n\n## Secret Rotation\n\nBoth methods accept an array of secrets, allowing zero-downtime rotation:\n\n```typescript\nexpressHmacMiddleware({\n  secrets: [currentSecret, previousSecret],\n  maxAgeMs: 30_000,\n});\n```\n\nThe library tries each secret in order and accepts the first match.\n\n## API Reference\n\n| Export | Description |\n|--------|-------------|\n| `verifyGatewaySignature(request, options)` | Verify HMAC-SHA256 signature headers |\n| `verifyGatewaySecret(request, options)` | Verify shared secret header |\n| `expressHmacMiddleware(options)` | Express/Connect middleware for HMAC verification |\n| `expressSecretMiddleware(options)` | Express/Connect middleware for shared secret verification |\n| `VerifyOptions` | Options: `secrets`, `maxAgeMs` |\n| `VerifyResult` | Result: `{ valid: boolean; error?: string }` |\n| `RequestLike` | Minimal request shape accepted by verify functions |\n\n## License\n\nMIT\n","readmeFilename":"README.md"}