Hmac

_archivesourcetypescript
Path: _archive/loom-stale-pre-sprint-snapshot/src/lib/hmac.tsRelative: loom-stale-pre-sprint-snapshot/src/lib/hmac.tsSubproject: _archiveCategory: archived
Lines: 94Bytes: 3,290Imports: 0Exports: 4
_archivesourcetypescriptloom-stale-pre-sprint-snapshotsrclib

Content Preview

  1. /**
  2. * HMAC-SHA256 approval tokens for destructive actions (H1.5 mint / H3.3 verify).
  3. * Web Crypto only — identical on workerd and Bun.
  4. *
  5. * Token = b64url(payloadJSON) + "." + b64url(hmacSig)
  6. * Payload binds: goal_id, stage_id, expiry, single-use jti.
  7. *
  8. * Replay protection layers:
  9. * - Sprint 1: the execution harness tracks consumed jti per dispatch run (in-run single-use).
  10. * - Sprint 2: OrchestratorDO (the mint) adds durable cross-dispatch replay rejection.
  11. */
  13. export interface Approv