| 1 | /** |
| 2 | * Ed25519 verifying keys for the CodeWhale cloud facts channel (facts/v1). |
| 3 | * |
| 4 | * Mirror of `crates/config/src/cloud_facts/keys.rs` — `check:facts` fails if |
| 5 | * the two diverge. Keys are pinned here (and in the binary); the Supabase |
| 6 | * `facts_key` table is informational and never a trust root. |
| 7 | * |
| 8 | * The pinned anchor below is the trust root for delivery. Tests supply their |
| 9 | * own public fixture keys; those keys never belong in this table. |
| 10 | */ |
| 11 | export type KeyStatus = "active" | "retired"; |
| 12 | |
| 13 | export interface TrustedKey { |
| 14 | keyId: string; |
| 15 | /** Standard base64 of the raw 32-byte Ed25519 public key. */ |
| 16 | publicKey: string; |
| 17 | status: KeyStatus; |
| 18 | } |
| 19 | |
| 20 | export const DOMAIN = "codewhale-facts/v1\0"; |
| 21 | export const ENVELOPE_VERSION = 1; |
| 22 | export const SUPPORTED_SCHEMA_VERSION = 1; |
| 23 | export const MAX_PAYLOAD_BYTES = 512 * 1024; |
| 24 | |
| 25 | export const TRUSTED_KEYS: readonly TrustedKey[] = [ |
| 26 | { |
| 27 | // Approved 2026-09-10. Mirrors crates/config/src/cloud_facts/keys.rs. |
| 28 | // Private half held by the founder outside any repository. |
| 29 | keyId: "cwf-2026-09", |
| 30 | publicKey: "5d1syIWzufnSTlVrfFVb7CePHL6B3Ol92IhS15QaBoU=", |
| 31 | status: "active", |
| 32 | }, |
| 33 | ]; |
| 34 | |
| 35 | export function trustedKey(keyId: string): TrustedKey | undefined { |
| 36 | return TRUSTED_KEYS.find((key) => key.keyId === keyId); |
| 37 | } |
| 38 |