@covia/covia-sdk 1.19.1 → 1.21.0

package/dist/index.js

@@ -165,15 +165,15 @@ var isBig = (n) => typeof n === "bigint";
 var isStr = (s) => typeof s === "string";
 var isBytes = (a) => a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 var abytes = (value, length, title = "") => {
-  const bytes = isBytes(value);
+  const bytes2 = isBytes(value);
   const len = value?.length;
   const needsLen = length !== void 0;
-  if (!bytes || needsLen && len !== length) {
+  if (!bytes2 || needsLen && len !== length) {
     const prefix = title && `"${title}" `;
     const ofLen = needsLen ? ` of length ${length}` : "";
-    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const got = bytes2 ? `length=${len}` : `type=${typeof value}`;
     const msg = prefix + "expected Uint8Array" + ofLen + ", got " + got;
-    throw bytes ? new RangeError(msg) : new TypeError(msg);
+    throw bytes2 ? new RangeError(msg) : new TypeError(msg);
   }
   return value;
 };
@@ -632,15 +632,15 @@ function isBytes2(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
 function abytes2(value, length, title = "") {
-  const bytes = isBytes2(value);
+  const bytes2 = isBytes2(value);
   const len = value?.length;
   const needsLen = length !== void 0;
-  if (!bytes || needsLen) {
+  if (!bytes2 || needsLen) {
     const prefix = title && `"${title}" `;
     const ofLen = "";
-    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const got = bytes2 ? `length=${len}` : `type=${typeof value}`;
     const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
-    if (!bytes)
+    if (!bytes2)
       throw new TypeError(message);
     throw new RangeError(message);
   }
@@ -1061,11 +1061,11 @@ function hexToPrivateKey(hex) {
   if (!/^[0-9a-fA-F]{64}$/.test(cleaned)) {
     throw new Error("Invalid Ed25519 private key: expected 64 hex characters (32 bytes)");
   }
-  const bytes = new Uint8Array(32);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = parseInt(cleaned.substring(i * 2, i * 2 + 2), 16);
+  const bytes2 = new Uint8Array(32);
+  for (let i = 0; i < bytes2.length; i++) {
+    bytes2[i] = parseInt(cleaned.substring(i * 2, i * 2 + 2), 16);
   }
-  return bytes;
+  return bytes2;
 }
 
 // src/crypto/base58.ts
@@ -1075,13 +1075,13 @@ var ALPHABET_MAP = /* @__PURE__ */ new Map();
 for (let i = 0; i < ALPHABET.length; i++) {
   ALPHABET_MAP.set(ALPHABET[i], i);
 }
-function encode(bytes) {
-  if (bytes.length === 0) return "";
+function encode(bytes2) {
+  if (bytes2.length === 0) return "";
   let zeros = 0;
-  while (zeros < bytes.length && bytes[zeros] === 0) zeros++;
+  while (zeros < bytes2.length && bytes2[zeros] === 0) zeros++;
   const digits = [];
-  for (let i = zeros; i < bytes.length; i++) {
-    let carry = bytes[i];
+  for (let i = zeros; i < bytes2.length; i++) {
+    let carry = bytes2[i];
     for (let j = 0; j < digits.length; j++) {
       carry += digits[j] << 8;
       digits[j] = carry % BASE;
@@ -1102,24 +1102,24 @@ function decode(str) {
   if (str.length === 0) return new Uint8Array(0);
   let zeros = 0;
   while (zeros < str.length && str[zeros] === ALPHABET[0]) zeros++;
-  const bytes = [];
+  const bytes2 = [];
   for (let i = zeros; i < str.length; i++) {
     const val = ALPHABET_MAP.get(str[i]);
     if (val === void 0) throw new Error(`Invalid base58 character: ${str[i]}`);
     let carry = val;
-    for (let j = 0; j < bytes.length; j++) {
-      carry += bytes[j] * BASE;
-      bytes[j] = carry & 255;
+    for (let j = 0; j < bytes2.length; j++) {
+      carry += bytes2[j] * BASE;
+      bytes2[j] = carry & 255;
       carry >>= 8;
     }
     while (carry > 0) {
-      bytes.push(carry & 255);
+      bytes2.push(carry & 255);
       carry >>= 8;
     }
   }
-  const result = new Uint8Array(zeros + bytes.length);
+  const result = new Uint8Array(zeros + bytes2.length);
   for (let i = 0; i < zeros; i++) result[i] = 0;
-  for (let i = 0; i < bytes.length; i++) result[zeros + i] = bytes[bytes.length - 1 - i];
+  for (let i = 0; i < bytes2.length; i++) result[zeros + i] = bytes2[bytes2.length - 1 - i];
   return result;
 }
 
@@ -1155,7 +1155,16 @@ function base64UrlEncode(data) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function createEdDSAJWT(privateKey, lifetimeSeconds = 300, audience) {
-  const publicKey = getPublicKey2(privateKey);
+  const signingInput = edDSASigningInput(getPublicKey2(privateKey), lifetimeSeconds, audience);
+  const signature = sign(encoder.encode(signingInput), privateKey);
+  return `${signingInput}.${base64UrlEncode(signature)}`;
+}
+async function createEdDSAJWTWith(signer, lifetimeSeconds = 300, audience) {
+  const signingInput = edDSASigningInput(signer.publicKey, lifetimeSeconds, audience);
+  const signature = await signer.sign(encoder.encode(signingInput));
+  return `${signingInput}.${base64UrlEncode(signature)}`;
+}
+function edDSASigningInput(publicKey, lifetimeSeconds, audience) {
   const multikey = encodePublicKey(publicKey);
   const did = `did:key:${multikey}`;
   const nowSecs = Math.floor(Date.now() / 1e3);
@@ -1173,18 +1182,95 @@ function createEdDSAJWT(privateKey, lifetimeSeconds = 300, audience) {
   const payload = JSON.stringify(claims);
   const headerB64 = base64UrlEncode(encoder.encode(header));
   const payloadB64 = base64UrlEncode(encoder.encode(payload));
-  const signingInput = `${headerB64}.${payloadB64}`;
-  const signature = sign(encoder.encode(signingInput), privateKey);
-  const signatureB64 = base64UrlEncode(signature);
-  return `${signingInput}.${signatureB64}`;
+  return `${headerB64}.${payloadB64}`;
+}
+
+// src/crypto/signer.ts
+var ED25519 = "Ed25519";
+var PKCS8_ED25519_PREFIX = new Uint8Array([
+  48,
+  46,
+  2,
+  1,
+  0,
+  48,
+  5,
+  6,
+  3,
+  43,
+  101,
+  112,
+  4,
+  34,
+  4,
+  32
+]);
+function subtle2() {
+  const s = globalThis.crypto?.subtle;
+  if (!s) {
+    throw new Error("WebCrypto is unavailable: crypto.subtle requires a secure context (HTTPS or localhost)");
+  }
+  return s;
+}
+function bytes(data) {
+  return new Uint8Array(data);
+}
+function rawKeySigner(privateKey) {
+  const publicKey = getPublicKey2(privateKey);
+  return {
+    publicKey,
+    sign: (data) => Promise.resolve(sign(data, privateKey))
+  };
+}
+async function webCryptoSigner(keyPair) {
+  const publicKey = new Uint8Array(await subtle2().exportKey("raw", keyPair.publicKey));
+  const privateKey = keyPair.privateKey;
+  return {
+    publicKey,
+    sign: async (data) => new Uint8Array(await subtle2().sign(ED25519, privateKey, bytes(data)))
+  };
+}
+async function generateNonExtractableKeyPair() {
+  return subtle2().generateKey(ED25519, false, ["sign", "verify"]);
+}
+async function importNonExtractableKey(privateKey) {
+  if (privateKey.length !== 32) {
+    throw new Error("Invalid Ed25519 private key: expected 32 bytes");
+  }
+  const pkcs8 = new Uint8Array(PKCS8_ED25519_PREFIX.length + 32);
+  pkcs8.set(PKCS8_ED25519_PREFIX, 0);
+  pkcs8.set(privateKey, PKCS8_ED25519_PREFIX.length);
+  try {
+    const s = subtle2();
+    const [priv, pub] = await Promise.all([
+      s.importKey("pkcs8", pkcs8, ED25519, false, ["sign"]),
+      s.importKey("raw", bytes(getPublicKey2(privateKey)), ED25519, true, ["verify"])
+    ]);
+    return { privateKey: priv, publicKey: pub };
+  } finally {
+    pkcs8.fill(0);
+  }
+}
+var supported;
+function isWebCryptoEd25519Supported() {
+  supported ?? (supported = (async () => {
+    try {
+      const kp = await generateNonExtractableKeyPair();
+      await subtle2().sign(ED25519, kp.privateKey, new Uint8Array(1));
+      return true;
+    } catch {
+      return false;
+    }
+  })());
+  return supported;
 }
 
 // src/Credentials.ts
 function base64Encode(text) {
-  const bytes = new TextEncoder().encode(text);
+  const bytes2 = new TextEncoder().encode(text);
   let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.length; i++) {
+    binary += String.fromCharCode(bytes2[i]);
   }
   return btoa(binary);
 }
@@ -1216,18 +1302,29 @@ var BasicAuth = class extends Auth {
 };
 var Ed25519Auth = class _Ed25519Auth extends Auth {
   /**
-   * @param privateKey - 32-byte Ed25519 private key
+   * @param key - 32-byte Ed25519 private key, or an {@link Ed25519Signer}
    * @param tokenLifetimeSeconds - JWT lifetime in seconds (default 300 = 5 min)
    */
-  constructor(privateKey, tokenLifetimeSeconds = 300) {
+  constructor(key, tokenLifetimeSeconds = 300) {
     super();
-    this._privateKey = privateKey;
-    this._publicKey = getPublicKey2(privateKey);
+    if (isSigner(key)) {
+      this._signer = key;
+    } else {
+      this._privateKey = key;
+      this._signer = rawKeySigner(key);
+    }
+    this._publicKey = this._signer.publicKey;
     this._did = didFromPublicKey(this._publicKey);
     this._lifetime = tokenLifetimeSeconds;
   }
   apply(headers, audience) {
-    headers["Authorization"] = `Bearer ${this.identityToken(audience)}`;
+    if (this._privateKey) {
+      headers["Authorization"] = `Bearer ${this.identityToken(audience)}`;
+      return;
+    }
+    return this.mintIdentityToken(audience).then((token) => {
+      headers["Authorization"] = `Bearer ${token}`;
+    });
   }
   /**
    * Mint a bearer-usable identity JWT for this key — the same token
@@ -1240,17 +1337,37 @@ var Ed25519Auth = class _Ed25519Auth extends Auth {
    * at any venue that accepts the caller's DID, so minting one is refused
    * rather than silently weakened.
    *
+   * Raw-key instances only: a signer-backed instance signs asynchronously,
+   * so use {@link mintIdentityToken}, which works for both.
+   *
    * @param audience - The venue DID the token is bound to (`aud` claim).
    * @param lifetimeSeconds - Token lifetime; defaults to this instance's.
    */
   identityToken(audience, lifetimeSeconds) {
+    const aud = this.resolveAudience(audience);
+    if (!this._privateKey) {
+      throw new CoviaError(
+        "Ed25519Auth.identityToken() needs a raw private key; this instance signs through an Ed25519Signer, so use the async mintIdentityToken() instead."
+      );
+    }
+    return createEdDSAJWT(this._privateKey, lifetimeSeconds ?? this._lifetime, aud);
+  }
+  /**
+   * Async {@link identityToken} that works for raw-key and signer-backed
+   * instances alike. Same token, same audience rules.
+   */
+  async mintIdentityToken(audience, lifetimeSeconds) {
+    const aud = this.resolveAudience(audience);
+    return createEdDSAJWTWith(this._signer, lifetimeSeconds ?? this._lifetime, aud);
+  }
+  resolveAudience(audience) {
     const aud = this._audience ?? (audience || void 0);
     if (!aud) {
       throw new CoviaError(
         "Ed25519Auth requires a venue audience to bind the token to: connect via Grid.connect()/Venue.connect() so the venue DID is known, or pin auth.audience explicitly."
       );
     }
-    return createEdDSAJWT(this._privateKey, lifetimeSeconds ?? this._lifetime, aud);
+    return aud;
   }
   /** The caller's DID derived from the public key. */
   getDID() {
@@ -1279,7 +1396,17 @@ var Ed25519Auth = class _Ed25519Auth extends Auth {
   static fromHex(privateKeyHex, tokenLifetimeSeconds = 300) {
     return new _Ed25519Auth(hexToPrivateKey(privateKeyHex), tokenLifetimeSeconds);
   }
+  /**
+   * Create from an {@link Ed25519Signer}, e.g. `await webCryptoSigner(keyPair)`
+   * over a non-extractable WebCrypto key. Requests sign asynchronously.
+   */
+  static fromSigner(signer, tokenLifetimeSeconds = 300) {
+    return new _Ed25519Auth(signer, tokenLifetimeSeconds);
+  }
 };
+function isSigner(key) {
+  return !ArrayBuffer.isView(key) && typeof key.sign === "function";
+}
 var KeyPairAuth = Ed25519Auth;
 var CredentialsHTTP = class {
   constructor(venueId, apiKey, userId) {
@@ -1703,7 +1830,7 @@ var AdapterManager = class {
 };
 
 // src/VenueTransport.ts
-function requestOptions(venue, options) {
+async function requestOptions(venue, options) {
   const {
     contentType,
     headers: suppliedHeaders = {},
@@ -1714,19 +1841,19 @@ function requestOptions(venue, options) {
   if (effectiveContentType && headers["Content-Type"] === void 0) {
     headers["Content-Type"] = effectiveContentType;
   }
-  venue.auth.apply(headers, venue.venueId);
+  await venue.auth.apply(headers, venue.venueId);
   return { ...request, headers };
 }
-function venueJson(venue, path, options = {}) {
+async function venueJson(venue, path, options = {}) {
   return fetchWithError(
     `${venue.baseUrl}${path}`,
-    requestOptions(venue, options)
+    await requestOptions(venue, options)
   );
 }
-function venueStream(venue, path, options = {}) {
+async function venueStream(venue, path, options = {}) {
   return fetchStreamWithError(
     `${venue.baseUrl}${path}`,
-    requestOptions(venue, options)
+    await requestOptions(venue, options)
   );
 }
 
@@ -2531,6 +2658,9 @@ var AssetManager = class {
     if (options.expand !== void 0) {
       params.set("expand", options.expand);
     }
+    if (options.kind !== void 0) {
+      params.set("kind", options.kind);
+    }
     return venueJson(
       this.venue,
       `/api/v1/assets?${params.toString()}`,
@@ -4067,7 +4197,17 @@ function didFor(privateKey) {
   return `did:key:${encodePublicKey(getPublicKey2(privateKey))}`;
 }
 function createUCANJWT(privateKey, audienceDID, att, lifetimeSeconds, proofs = []) {
-  const multikey = encodePublicKey(getPublicKey2(privateKey));
+  const signingInput = ucanSigningInput(getPublicKey2(privateKey), audienceDID, att, lifetimeSeconds, proofs);
+  const signature = sign(encoder2.encode(signingInput), privateKey);
+  return `${signingInput}.${base64UrlEncode(signature)}`;
+}
+async function createUCANJWTWith(signer, audienceDID, att, lifetimeSeconds, proofs = []) {
+  const signingInput = ucanSigningInput(signer.publicKey, audienceDID, att, lifetimeSeconds, proofs);
+  const signature = await signer.sign(encoder2.encode(signingInput));
+  return `${signingInput}.${base64UrlEncode(signature)}`;
+}
+function ucanSigningInput(publicKey, audienceDID, att, lifetimeSeconds, proofs) {
+  const multikey = encodePublicKey(publicKey);
   const nowSecs = Math.floor(Date.now() / 1e3);
   const header = JSON.stringify({ alg: "EdDSA", typ: "JWT", kid: multikey });
   const claims = {
@@ -4083,9 +4223,7 @@ function createUCANJWT(privateKey, audienceDID, att, lifetimeSeconds, proofs = [
     // CVMDouble the venue's UcanJwtValidator rejects outright (covia-sdk#46).
     exp: lifetimeSeconds === null ? null : Math.floor(nowSecs + lifetimeSeconds)
   };
-  const signingInput = `${base64UrlEncode(encoder2.encode(header))}.${base64UrlEncode(encoder2.encode(JSON.stringify(claims)))}`;
-  const signature = sign(encoder2.encode(signingInput), privateKey);
-  return `${signingInput}.${base64UrlEncode(signature)}`;
+  return `${base64UrlEncode(encoder2.encode(header))}.${base64UrlEncode(encoder2.encode(JSON.stringify(claims)))}`;
 }
 function identityToken(privateKey, venueDID, lifetimeSeconds = 300) {
   return createUCANJWT(privateKey, venueDID, [], lifetimeSeconds);
@@ -4093,10 +4231,17 @@ function identityToken(privateKey, venueDID, lifetimeSeconds = 300) {
 function grant(ownerPrivateKey, audienceDID, withResource, can, lifetimeSeconds) {
   return createUCANJWT(ownerPrivateKey, audienceDID, [{ with: withResource, can }], lifetimeSeconds);
 }
+function grantWith(ownerSigner, audienceDID, withResource, can, lifetimeSeconds) {
+  return createUCANJWTWith(ownerSigner, audienceDID, [{ with: withResource, can }], lifetimeSeconds);
+}
 function relayDelegation(privateKey, venueDID, lifetimeSeconds, caps = []) {
   const att = [{ with: didFor(privateKey), can: VENUE_RELAY }, ...caps];
   return createUCANJWT(privateKey, venueDID, att, lifetimeSeconds);
 }
+function relayDelegationWith(signer, venueDID, lifetimeSeconds, caps = []) {
+  const att = [{ with: didFromPublicKey(signer.publicKey), can: VENUE_RELAY }, ...caps];
+  return createUCANJWTWith(signer, venueDID, att, lifetimeSeconds);
+}
 /*! Bundled license information:
 
 @noble/ed25519/index.js:
@@ -4154,6 +4299,7 @@ exports.WorkspaceManager = WorkspaceManager;
 exports.assetHash = assetHash;
 exports.createSSEEvent = createSSEEvent;
 exports.createUCANJWT = createUCANJWT;
+exports.createUCANJWTWith = createUCANJWTWith;
 exports.decodePublicKey = decodePublicKey;
 exports.didFor = didFor;
 exports.didFromPublicKey = didFromPublicKey;
@@ -4163,23 +4309,30 @@ exports.encodePublicKey = encodePublicKey;
 exports.fetchStreamWithError = fetchStreamWithError;
 exports.fetchWithError = fetchWithError;
 exports.generateKeyPair = generateKeyPair;
+exports.generateNonExtractableKeyPair = generateNonExtractableKeyPair;
 exports.getAssetIdFromPath = getAssetIdFromPath;
 exports.getAssetIdFromVenueId = getAssetIdFromVenueId;
 exports.getAssetMetadataStore = getAssetMetadataStore;
 exports.getParsedAssetId = getParsedAssetId;
 exports.grant = grant;
+exports.grantWith = grantWith;
 exports.hexToPrivateKey = hexToPrivateKey;
 exports.identityToken = identityToken;
+exports.importNonExtractableKey = importNonExtractableKey;
 exports.isDid = isDid;
 exports.isJobComplete = isJobComplete;
 exports.isJobFinished = isJobFinished;
 exports.isJobPaused = isJobPaused;
+exports.isWebCryptoEd25519Supported = isWebCryptoEd25519Supported;
 exports.logger = logger;
 exports.parseDidUrl = parseDidUrl;
 exports.parseRetryAfterMs = parseRetryAfterMs;
 exports.parseSSEStream = parseSSEStream;
 exports.privateKeyToHex = privateKeyToHex;
+exports.rawKeySigner = rawKeySigner;
 exports.relayDelegation = relayDelegation;
+exports.relayDelegationWith = relayDelegationWith;
 exports.retryDelayMs = retryDelayMs;
 exports.setAssetMetadataStore = setAssetMetadataStore;
 exports.venueBaseUrlCandidates = venueBaseUrlCandidates;
+exports.webCryptoSigner = webCryptoSigner;