open-index/open-npm huggingface dataset:
npm package: @ralalabs/manifest-signer
Description: Runtime-agnostic signed URL generator for manifest-restreamer
Latest version: 0.2.1

# @ralalabs/manifest-signer

Runtime-agnostic signed URL generator for manifest-restreamer.

Works in Node.js 18+, Browsers, Cloudflare Workers, and any edge runtime with WebCrypto. Zero runtime dependencies.

## What it does

Generates deterministic restreamer URLs:

```
https://<publicHost>/manifest/<sid>.<ext>?u=<sealed>
```

**Compatibility contract** with manifest-restreamer:

- `sid = HMAC-SHA256(key, originUrl)` truncated to 16 hex chars (first 8 bytes)
- `u = AES-256-GCM( { u: originUrl, iat }, AAD: "u:manifest:<sid>" )`
- Wire format (base64url): `[12B IV][16B TAG][CIPHERTEXT]`

## Installation

```bash
pnpm add @ralalabs/manifest-signer
```

## Usage

### Standalone function

```ts
import { signManifest } from '@ralalabs/manifest-signer';

const result = await signManifest({
  originUrl: 'https://cdn.example.com/master.m3u8',
  proxySecretHex: process.env.PROXY_SECRET_HEX!,
  publicHost: 'https://manifest.domain.com',
});

console.log(result.url);
```

### Class (recommended for bulk signing)

Caches CryptoKeys per instance for fast repeated signing.

```ts
import { ManifestSigner } from '@ralalabs/manifest-signer';

const signer = new ManifestSigner(process.env.PROXY_SECRET_HEX!);

const signed = await signer.sign(
  'https://cdn.example.com/master.m3u8',
  'https://manifest.domain.com',
);

console.log(signed.url);
```

## API

### `signManifest(input)`

| Field          | Type              | Required |
| -------------- | ----------------- | -------- |
| originUrl      | `string`          | yes      |
| proxySecretHex | `string` (64hex)  | yes      |
| publicHost     | `string`          | yes      |
| ext            | `'mpd' \| 'm3u8'` | optional |

Returns `{ url, sid, ext, originUrl }`

### `new ManifestSigner(proxySecretHex)`

- `sign(originUrl, publicHost, ext?)` — fast path with cached keys
- `signManifest({ originUrl, publicHost, ext? })` — object-style wrapper

## Runtime compatibility

Node.js 18+, Browsers, Cloudflare Workers, Bun, Deno. Uses only standard WebCrypto API.

## License

MIT