Next.js Server Actions ShieldPRO

/**
 * client-signer.ts
 * Browser-safe cryptographic payload signer for Next.js Server Actions.
 * Keep this module locally integrated in your client components.
 */

export async function signActionPayload(payload: any, hexSecretKey: string) {
  const ts = Math.floor(Date.now() / 1000);
  const nonce = Array.from(window.crypto.getRandomValues(new Uint8Array(16)))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
    
  const protectedPayload = {
    ...payload,
    _shield: { ts, nonce }
  };
  
  const serialized = JSON.stringify(protectedPayload);
  
  // Convert hex signing key to bytes
  const keyBytes = new Uint8Array(
    hexSecretKey.match(/.{1,2}/g)!.map(byte => parseInt(byte, 16))
  );
  
  // Import the raw secret into SubtleCrypto
  const cryptoKey = await window.crypto.subtle.importKey(
    "raw",
    keyBytes,
    { name: "HMAC", hash: { name: "SHA-256" } },
    false,
    ["sign"]
  );
  
  // Calculate signature
  const signatureBuffer = await window.crypto.subtle.sign(
    "HMAC",
    cryptoKey,
    new TextEncoder().encode(serialized)
  );
  
  const signature = Array.from(new Uint8Array(signatureBuffer))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
    
  return {
    payload: protectedPayload,
    signature
  };
}