@calimero-network/mero-js 15.0.0 → 15.2.0

package/dist/warrant/warrant.d.ts

@@ -21,6 +21,7 @@
  * this producing well-formed warrants whose signatures verify nowhere, surfacing
  * at a relay as a 403: an authorization refusal, nowhere near the cause.
  */
+/** Ed25519 PKCS#8 prefix, so a raw 32-byte seed can be imported by WebCrypto. */
 /** What a warrant authorises. */
 export interface WarrantInput {
     /**

package/dist/warrant/warrant.js

@@ -21,56 +21,9 @@
  * this producing well-formed warrants whose signatures verify nowhere, surfacing
  * at a relay as a 403: an authorization refusal, nowhere near the cause.
  */
+import { concat, derivePublicKey, domainHash, fromHex, hex, importSigningKey, u64le, } from '../crypto/internal.js';
 const SIGN_DOMAIN = new TextEncoder().encode('calimero.warrant.v1');
 const INTENT_DOMAIN = new TextEncoder().encode('calimero.warrant.intent.v1');
-/** Ed25519 PKCS#8 prefix, so a raw 32-byte seed can be imported by WebCrypto. */
-const PKCS8_ED25519_PREFIX = new Uint8Array([
-    0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04,
-    0x22, 0x04, 0x20,
-]);
-function hex(bytes) {
-    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
-}
-function fromHex(value, label, expectedBytes) {
-    const clean = value.trim();
-    if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length !== expectedBytes * 2) {
-        throw new Error(`${label} must be ${expectedBytes * 2} hex characters, got ${clean.length}`);
-    }
-    // Indexed rather than `match(/../g)!`: the length is already validated above,
-    // so the assertion would only be telling the compiler what the guard proved,
-    // and this needs no assertion at all.
-    const bytes = new Uint8Array(expectedBytes);
-    for (let i = 0; i < expectedBytes; i += 1) {
-        bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
-    }
-    return bytes;
-}
-function u64le(value) {
-    const out = new Uint8Array(8);
-    new DataView(out.buffer).setBigUint64(0, BigInt(value), true);
-    return out;
-}
-function concat(...parts) {
-    const out = new Uint8Array(parts.reduce((total, p) => total + p.length, 0));
-    let offset = 0;
-    for (const part of parts) {
-        out.set(part, offset);
-        offset += part.length;
-    }
-    return out;
-}
-/**
- * core's `domain_hash`: SHA-256 over the length-prefixed domain, then each
- * length-prefixed part. The lengths are what stop two different field splits from
- * hashing alike.
- */
-async function domainHash(domain, parts) {
-    const chunks = [u64le(domain.length), domain];
-    for (const part of parts) {
-        chunks.push(u64le(part.length), part);
-    }
-    return new Uint8Array(await crypto.subtle.digest('SHA-256', concat(...chunks)));
-}
 /**
  * The commitment a warrant carries in place of the intent itself.
  *
@@ -81,22 +34,6 @@ export async function intentHash(method, argsJson) {
     const args = new TextEncoder().encode(JSON.stringify(argsJson));
     return domainHash(INTENT_DOMAIN, [new TextEncoder().encode(method), args]);
 }
-async function importSigningKey(secretHex) {
-    const seed = fromHex(secretHex, 'deviceSecret', 32);
-    const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
-    try {
-        return await crypto.subtle.importKey('pkcs8', pkcs8, { name: 'Ed25519' }, false, ['sign']);
-    }
-    catch (cause) {
-        // The original message is folded in rather than passed as `cause`: this
-        // package targets ES2020, where `Error` has no `cause` option.
-        const detail = cause instanceof Error ? `: ${cause.message}` : '';
-        throw new Error('this runtime has no WebCrypto Ed25519, so a warrant cannot be signed ' +
-            'here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it; ' +
-            'otherwise mint the warrant with `merod account warrant`' +
-            detail);
-    }
-}
 /**
  * Sign a warrant and return it hex-encoded, ready for `performIntent`.
  *
@@ -126,18 +63,3 @@ export async function signWarrant(input) {
     const signature = new Uint8Array(await crypto.subtle.sign({ name: 'Ed25519' }, key, preimage));
     return hex(concat(context, authorAccount, publicKey, executor, commitment, nonce, notAfter, signature));
 }
-/**
- * The public half of an ed25519 seed.
- *
- * Derived rather than taken as an argument, for the reason core does the same: a
- * caller able to name a key it does not hold could produce a warrant it cannot
- * sign, and the field would stop meaning "who authorised this".
- */
-async function derivePublicKey(secretHex) {
-    const seed = fromHex(secretHex, 'deviceSecret', 32);
-    const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
-    const key = await crypto.subtle.importKey('pkcs8', pkcs8, { name: 'Ed25519' }, true, ['sign']);
-    const jwk = await crypto.subtle.exportKey('jwk', key);
-    const raw = jwk.x;
-    return Uint8Array.from(atob(raw.replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0));
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "15.0.0",
+  "version": "15.2.0",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {