${escapeText(article.content)}
`;
+ const contentHash = computeContentHashFromHtml(innerContentHtml, article.url);
+ const expectedClaimsHash = computeClaimsHash(signedClaims);
// Sign the canonical binding via the trust server
const sig = await trustClient.signContent(author.authorApiKey, {
- contentHash, claimsHash, signedAt,
- domain: publicationOrigin,
- claims: signedClaims,
+ contentHash,
+ sourceURL: article.url,
+ scope: "url",
+ signedAt,
+ claims: signedClaimRecords,
});
+ if (sig.claimsHash !== expectedClaimsHash) {
+ throw new Error(`claims hash mismatch for ${article.url}: local=${expectedClaimsHash} directory=${sig.claimsHash}`);
+ }
const keyId = sig.keyid;
@@ -272,6 +327,8 @@ export async function runPhase2(
// We replace the Hugo-generated standalone signed-section with our
// wrapped version.
const newSignedSection = buildSignedSectionHtml({
+ profile: sig.profile,
+ scope: sig.scope,
signature: sig.signature,
keyId,
contentHash,
diff --git a/src/prepare-nginx.ts b/src/prepare-nginx.ts
new file mode 100644
index 0000000..34a5436
--- /dev/null
+++ b/src/prepare-nginx.ts
@@ -0,0 +1,13 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { generateNginxConfig } from "./lib/nginx-config.js";
+import { generateAuthorProfiles, loadScenario } from "./lib/scenario.js";
+
+const directory = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const scenario = path.resolve(directory, process.argv[2] || "scenario-small.yaml");
+const config = await loadScenario(scenario);
+const authors = generateAuthorProfiles(config);
+const output = path.join(directory, ".runtime", "nginx.conf");
+
+await generateNginxConfig(authors, output);
+console.log(`Generated ${output} for ${authors.length} authors`);
diff --git a/src/run-phases-3-5.ts b/src/run-phases-3-5.ts
index 882a7d9..efbbd6d 100644
--- a/src/run-phases-3-5.ts
+++ b/src/run-phases-3-5.ts
@@ -51,11 +51,11 @@ async function main(): Promise