{"_id":"@buildtovalue/identity","_rev":"2-529c727c7c88189c01f33550996eda88","name":"@buildtovalue/identity","dist-tags":{"latest":"1.1.0-next.0"},"versions":{"1.0.1":{"name":"@buildtovalue/identity","version":"1.0.1","keywords":["bpmn","identity","signature","ed25519","rbac","governance"],"license":"Apache-2.0","_id":"@buildtovalue/identity@1.0.1","maintainers":[{"name":"danzeroum","email":"danzeroum@gmail.com"}],"homepage":"https://github.com/danzeroum/bpmn#readme","bugs":{"url":"https://github.com/danzeroum/bpmn/issues"},"dist":{"shasum":"44d4151d211bc83fab1e538d7be5725b3e0c10e9","tarball":"https://registry.npmjs.org/@buildtovalue/identity/-/identity-1.0.1.tgz","fileCount":52,"integrity":"sha512-fk1Ubliemj03tL3ZQapy08PszWCdnGXuVP4ZObpum5sNaESF9ggs80dmb8q1Ti5xIlJSYvPGgj9w6FKlAothbA==","signatures":[{"sig":"MEYCIQDeMSUOHwH3H0n1/J+PKL95AcZrioILrfmEY3Pi+K1o4AIhAJke00qqzYWN712D6U6BTrs4iWqPV8ch/AoUs0iVwuJL","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":60304},"main":"./dist/cjs/index.js","type":"module","_from":"file:buildtovalue-identity-1.0.1.tgz","types":"./dist/esm/index.d.ts","module":"./dist/esm/index.js","engines":{"node":">=20"},"exports":{".":{"types":"./dist/esm/index.d.ts","import":"./dist/esm/index.js","require":"./dist/cjs/index.js"}},"scripts":{"build":"tsc -p tsconfig.build.json && tsc -p tsconfig.cjs.json && node ../../scripts/write-cjs-package.mjs dist/cjs","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"danzeroum","email":"danzeroum@gmail.com"},"_resolved":"C:\\Users\\danni\\AppData\\Local\\Temp\\42eb4752acce58a3a5294b7a3e365423\\buildtovalue-identity-1.0.1.tgz","_integrity":"sha512-fk1Ubliemj03tL3ZQapy08PszWCdnGXuVP4ZObpum5sNaESF9ggs80dmb8q1Ti5xIlJSYvPGgj9w6FKlAothbA==","repository":{"url":"git+https://github.com/danzeroum/bpmn.git","type":"git","directory":"packages/identity"},"_npmVersion":"10.9.3","description":"Headless identity, signature and RBAC-verification layer (Handoff 8): Ed25519 approval signatures over the canonical payload (WebCrypto, offline verification), and role-requirement evaluation. NEVER generates, stores or manages keys — the Signer is always","directories":{},"sideEffects":false,"_nodeVersion":"22.20.0","dependencies":{"@buildtovalue/core":"1.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/identity_1.0.1_1784345281050_0.922806433673879","host":"s3://npm-registry-packages-npm-production"}},"1.1.0-next.0":{"name":"@buildtovalue/identity","version":"1.1.0-next.0","description":"Headless identity, signature and RBAC-verification layer (Handoff 8): Ed25519 approval signatures over the canonical payload (WebCrypto, offline verification), and role-requirement evaluation. NEVER generates, stores or manages keys — the Signer is always","license":"Apache-2.0","type":"module","sideEffects":false,"engines":{"node":">=20"},"main":"./dist/cjs/index.js","module":"./dist/esm/index.js","types":"./dist/esm/index.d.ts","exports":{".":{"types":"./dist/esm/index.d.ts","import":"./dist/esm/index.js","require":"./dist/cjs/index.js"}},"dependencies":{"@buildtovalue/core":"1.2.0-next.0"},"keywords":["bpmn","identity","signature","ed25519","rbac","governance"],"repository":{"type":"git","url":"git+https://github.com/danzeroum/bpmn.git","directory":"packages/identity"},"publishConfig":{"access":"public"},"scripts":{"build":"tsc -p tsconfig.build.json && tsc -p tsconfig.cjs.json && node ../../scripts/write-cjs-package.mjs dist/cjs","typecheck":"tsc -p tsconfig.json --noEmit"},"_id":"@buildtovalue/identity@1.1.0-next.0","bugs":{"url":"https://github.com/danzeroum/bpmn/issues"},"homepage":"https://github.com/danzeroum/bpmn#readme","_integrity":"sha512-dCHs6FKcRKohLohxudezWCh6HxAeKXLIjUujSz3vsbOk7aboNK7bWq6zEfpurheq/PASzYQBzSDOpPhKxMYMOQ==","_resolved":"/tmp/ff3e3af660bf398272d5d2aecd7d5054/buildtovalue-identity-1.1.0-next.0.tgz","_from":"file:buildtovalue-identity-1.1.0-next.0.tgz","_nodeVersion":"22.23.1","_npmVersion":"10.9.8","dist":{"integrity":"sha512-dCHs6FKcRKohLohxudezWCh6HxAeKXLIjUujSz3vsbOk7aboNK7bWq6zEfpurheq/PASzYQBzSDOpPhKxMYMOQ==","shasum":"7f991400005ae92648d7c1f7f55e1ceec97411de","tarball":"https://registry.npmjs.org/@buildtovalue/identity/-/identity-1.1.0-next.0.tgz","fileCount":52,"unpackedSize":60043,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDDN3pNoA2X9EImEpd5/q4zkD00YMXFeENeIBhyjQeLJwIhAKVSjNE+4uBpSSV9ApwyhgBKnw7TTH5Le2AL8JeSUwYG"}]},"_npmUser":{"name":"danzeroum","email":"danzeroum@gmail.com"},"directories":{},"maintainers":[{"name":"danzeroum","email":"danzeroum@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/identity_1.1.0-next.0_1784725560752_0.8862295195976466"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-18T03:28:00.880Z","modified":"2026-07-22T13:06:01.088Z","1.0.1":"2026-07-18T03:28:01.198Z","1.1.0-next.0":"2026-07-22T13:06:00.905Z"},"bugs":{"url":"https://github.com/danzeroum/bpmn/issues"},"license":"Apache-2.0","homepage":"https://github.com/danzeroum/bpmn#readme","keywords":["bpmn","identity","signature","ed25519","rbac","governance"],"repository":{"type":"git","url":"git+https://github.com/danzeroum/bpmn.git","directory":"packages/identity"},"description":"Headless identity, signature and RBAC-verification layer (Handoff 8): Ed25519 approval signatures over the canonical payload (WebCrypto, offline verification), and role-requirement evaluation. NEVER generates, stores or manages keys — the Signer is always","maintainers":[{"name":"danzeroum","email":"danzeroum@gmail.com"}],"readme":"# @buildtovalue/identity\n\nHeadless **identity, signature and RBAC-verification** layer for BPMN governance\n(Handoff 8): Ed25519 approval signatures over the canonical payload, offline\nverification via WebCrypto, and role-requirement evaluation.\n\n## The library never touches your keys (cerca §1.1 — nunca PKI)\n\n**This library does not generate, store or manage keys.** There is no key\ngeneration, no private-key storage, no key export anywhere in this package. A\n`Signer` is always **implemented and injected by the host** (corporate SSO/IdP,\nYubiKey, git key). Only the payload bytes cross the boundary into `sign()`; the\nprivate key stays with the host. This package does exactly three things: **sign\nvia the injected handle, verify signatures, and evaluate role requirements.**\nKey management — issuance, rotation, revocation, custody — is the host's\nresponsibility.\n\n## RBAC is verification, not enforcement (cerca §1.2)\n\n`evaluateRoleRequirement` answers *\"does approval #y satisfy the roles this\npromotion requires?\"* — a statement any third party can re-check against the\nsignatures. It does **not** block actions: whoever controls the client can\nignore local rules. Enforcement belongs to the anchor and whoever hosts it.\n(This is line 1 of `docs/limitations.md`.)\n\n```ts\nimport {\n  buildApprovalPayload,\n  signApproval,\n  verifySignature,\n  evaluateRoleRequirement,\n} from '@buildtovalue/identity';\n\n// The host implements Signer — the private key never enters the library.\nconst payload = buildApprovalPayload({\n  diagramId: 'onboarding',\n  version: '2.1.0',\n  xmlHash,        // SHA-256 of the canonical BPMN XML\n  ledgerHead,     // the ledger head hash the approval binds to\n  decision: 'approve',\n  role: 'compliance',\n});\n\nconst approval = await signApproval(hostSigner, payload, new Date().toISOString());\n\nawait verifySignature(approval, publicKey);          // 'valid' | 'invalid' — offline\nevaluateRoleRequirement(['compliance', 'architecture'], [approval]); // { satisfied, missing }\n```\n\n## What a signature covers\n\nThe signature binds `diagramId + version + xmlHash + ledgerHead + decision +\nrole`, serialized deterministically with `canonicalJson` from `@buildtovalue/core`\n(the same input as the attestation). Any later change to those fields makes\nverification return `invalid` — with `expected × obtained` surfaced by the host UI.\n\n## Three-state verification\n\n- `valid` — signature verifies against the public key.\n- `invalid` — payload altered or wrong key (detectable by any third party).\n- `legacy` — no signature present (pre-Handoff-8 history). The lesser guarantee\n  is **declared**, never signed retroactively (cerca §1.5).\n\n## Decoupling\n\nConsumes **only** `@buildtovalue/core` (`canonicalJson` + types) — pinned by\n`tests/independence.test.ts`. Zero network, zero react, zero anchor code (anchor\nadapters live in separate packages, injected by the host). **Zero runtime\ndependencies** beyond the workspace core link.\n\n> Runtime note: WebCrypto Ed25519 is stable in Node ≥ 20 and in recent browsers\n> (Chrome 137+, Safari 17+). Older browsers need a host-provided verifier — see\n> `docs/limitations.md`.\n","readmeFilename":"README.md"}