Class PackageSigner

Sign a package directory in place: embeds publicKeyPem at signature.pub.pem, regenerates security.json (checksums plus digitalSignatures) and writes the raw RSA-SHA256 signature to signature.sig. Returns the signature file path.

Sign an in-memory package file map: returns a new map with the embedded public key, a regenerated security.json (checksums plus digitalSignatures) and signature.sig.

Verify the declared signature of a .cap archive; throws typed errors.

Verify the declared signature of a package directory; throws typed errors.

Verify the declared signature of an in-memory file map. Throws UnsignedPackageError when unsigned, SignatureError on structural problems and SignatureMismatchError on mismatch.

True when the file map's security.json declares digitalSignatures.