@canonmsg/agent-sdk 12.5.1 → 13.0.2

package/dist/chunks/chunk-YHDDOADK.js

@@ -0,0 +1,118 @@
+import {
+  __name,
+  decodeCanonicalMlsBase64Url,
+  isMlsEnvironmentId,
+  mlsEnvironmentOfIssuerKeyVersion,
+  mlsEnvironmentOfReceiptKeyVersion,
+  parseMlsDevCredentialReceipt,
+  parseMlsDevCredentialToken,
+  parseMlsDevEnrollmentPrincipal,
+  parseMlsDevIssuerKeyVersion,
+  parseMlsDevReceiptKeyVersion
+} from "./chunk-5WPAB5MB.js";
+
+// ../endpoint/src/mls-crypto.ts
+import { ed25519 } from "@noble/curves/ed25519.js";
+
+// ../endpoint/src/runtime-api-origins.generated.ts
+var RUNTIME_API_ORIGINS = {
+  "canon-dev-v1": "https://dev.api.canonmail.com",
+  "canon-prod-v1": "https://api.canonmail.com"
+};
+
+// ../endpoint/src/mls-crypto.ts
+function mlsDevDeviceHttpConfiguration(environmentId) {
+  if (!isMlsEnvironmentId(environmentId)) invalid();
+  const origin = RUNTIME_API_ORIGINS[environmentId];
+  return Object.freeze({
+    enrollmentUrl: `${origin}/mls/enrollment`,
+    credentialUrl: `${origin}/mls/credential`,
+    reconciliationUrl: `${origin}/mls/reconciliation`,
+    keyPackagesUrl: `${origin}/mls/key-packages`,
+    trustedOrigins: Object.freeze([origin])
+  });
+}
+__name(mlsDevDeviceHttpConfiguration, "mlsDevDeviceHttpConfiguration");
+function invalid() {
+  throw new Error("MLS_DEV_CLIENT_CONFIGURATION_INVALID");
+}
+__name(invalid, "invalid");
+function record(value, keys) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) invalid();
+  const fields = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(fields).length !== keys.length || keys.some((key) => !Object.hasOwn(fields, key) || !Object.hasOwn(fields[key], "value"))) invalid();
+  return value;
+}
+__name(record, "record");
+function primeOrderPoint(value) {
+  const point = ed25519.Point.fromBytes(value, false);
+  return !point.isSmallOrder() && point.isTorsionFree();
+}
+__name(primeOrderPoint, "primeOrderPoint");
+function issuerKeys(value, environmentId, receipt = false) {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 8) invalid();
+  const seen = /* @__PURE__ */ new Set();
+  let environment = environmentId;
+  return Object.freeze(Array.from(value, (item) => {
+    const key = record(item, ["keyVersion", "signaturePublicKey"]);
+    const keyVersion = receipt ? parseMlsDevReceiptKeyVersion(key.keyVersion, environment) : parseMlsDevIssuerKeyVersion(key.keyVersion, environment);
+    environment ??= receipt ? mlsEnvironmentOfReceiptKeyVersion(keyVersion) : mlsEnvironmentOfIssuerKeyVersion(keyVersion);
+    if (seen.has(keyVersion) || typeof key.signaturePublicKey !== "string" || !primeOrderPoint(decodeCanonicalMlsBase64Url(key.signaturePublicKey, 32))) invalid();
+    seen.add(keyVersion);
+    return Object.freeze({ keyVersion, signaturePublicKey: key.signaturePublicKey });
+  }));
+}
+__name(issuerKeys, "issuerKeys");
+function parseMlsDevClientConfiguration(value) {
+  try {
+    const listed = !!value && typeof value === "object" && Object.hasOwn(value, "principalIds");
+    const input = record(value, ["version", "environmentId", "enabled", ...listed ? ["principalIds"] : [], "issuerKeys", "receiptKeys"]);
+    if (input.version !== 1 || !isMlsEnvironmentId(input.environmentId) || input.enabled !== true || listed && (!Array.isArray(input.principalIds) || input.principalIds.length < 1 || input.principalIds.length > 100)) invalid();
+    const environmentId = input.environmentId;
+    const principalIds = listed ? Array.from(input.principalIds, (id) => parseMlsDevEnrollmentPrincipal({ type: "human", id }).id) : void 0;
+    if (principalIds && new Set(principalIds).size !== principalIds.length) invalid();
+    return Object.freeze({
+      version: 1,
+      environmentId,
+      enabled: true,
+      ...principalIds ? { principalIds: Object.freeze(principalIds) } : {},
+      issuerKeys: issuerKeys(input.issuerKeys, environmentId),
+      receiptKeys: issuerKeys(input.receiptKeys, environmentId, true)
+    });
+  } catch {
+    return invalid();
+  }
+}
+__name(parseMlsDevClientConfiguration, "parseMlsDevClientConfiguration");
+function createMlsDevCredentialVerifier(options) {
+  let trusted;
+  try {
+    trusted = new Map(issuerKeys(options.issuerKeys).map((key) => [key.keyVersion, key.signaturePublicKey]));
+  } catch {
+    return invalid();
+  }
+  const clock = options.clock ?? Date.now;
+  return async (value) => {
+    try {
+      const receipt = parseMlsDevCredentialReceipt(value);
+      const parsed = parseMlsDevCredentialToken(receipt.credential);
+      const key = trusted.get(parsed.unsigned.keyVersion);
+      const now = clock();
+      const { issuedAtMs, expiresAtMs } = parsed.unsigned.claims;
+      if (!key || !Number.isSafeInteger(now) || now < issuedAtMs || now >= expiresAtMs) return false;
+      const publicKey = decodeCanonicalMlsBase64Url(key, 32);
+      const signature = decodeCanonicalMlsBase64Url(parsed.signature, 64);
+      if (!primeOrderPoint(publicKey) || !primeOrderPoint(signature.subarray(0, 32))) return false;
+      return ed25519.verify(signature, new TextEncoder().encode(parsed.signingInput), publicKey, { zip215: false });
+    } catch {
+      return false;
+    }
+  };
+}
+__name(createMlsDevCredentialVerifier, "createMlsDevCredentialVerifier");
+
+export {
+  mlsDevDeviceHttpConfiguration,
+  parseMlsDevClientConfiguration,
+  createMlsDevCredentialVerifier
+};