Device Exchange Signing Utility (cloudclient/device.go)

Generates deterministic signing input for device registration exchanges, ensuring secure, replay‑protected Ed25519 signatures.

// Source: https://github.com/superbasedapp/observer | License: Apache-2.0 | Copyright 2026 Gaja AI
// Provided via justclaw.it.com; keep this notice with the code.
package cloudclient

import (
	"crypto/ed25519"
	"crypto/sha256"
	"encoding/base64"
	"errors"
	"fmt"

	"github.com/marmutapp/superbased-observer/internal/cloudcred"
	"github.com/marmutapp/superbased-observer/internal/cloudpop"
)

// b64 is the padding-free base64url encoding used on the exchange wire.
var b64 = base64.RawURLEncoding

// exchangeSigningContext is the fixed domain-separation prefix over which the
// device key signs during registration/exchange. It stops an exchange signature
// from being replayable as any other Ed25519 signature the device makes.
const exchangeSigningContext = "sbo-device-exchange.v1"

// Excha

... (truncated -- full source via MCP)