Packages

@paramira/signed-request

Sign HTTP requests (method, path, time, nonce, body hash) with a did:iwacu Ed25519 key, instead of trusting a bare DID header.

License: MIT

Source: packages/signed-request

What it does

Signed HTTP requests from a did:iwacu identity, instead of trusting a bare X-User-Did header. The caller signs the method, the path with its query, a timestamp, a single-use nonce and the body's hash with its Ed25519 key; the server checks the signature against the DID, that the time is close, and that it hasn't seen the nonce before.

There's a WebSocket variant for relays. The board's partner feeds and the directory's per-community routes use it.

MIT.

Used by

Apps: abantu, companion, isoko, playground

Services: directory

Packages: inquiry-board, isoko-client

Uses

@noble/hashes

requirements

Requirements a protocol sets before an act between two communities (a tree link, a clan admission): a fixed vocabulary, composition where the stricter wins, and an evaluator over the signed records of a link room that says what is met, what is still missing, and why.

storage

A minimal async KeyValueStore contract (get/set of string values) plus an in-memory implementation for tests and throwaway node services. No opinion on where any real app actually persists data.