@cratestack/cbor 0.19.2 → 0.19.4

package/README.md

@@ -170,3 +170,34 @@ for real.
 ## License
 
 MIT
+
+## Signed mode (`@cratestack/cbor/cose`)
+
+`createCoseClient` seals requests and opens responses as COSE (ADR 0006), through `cratestack-cose`
+compiled to WASM (browser) or the native addon (Node): all signing, hashing and the canonical query are
+Rust's. The signer is a COSE_Mac0 session key (`{ type: "hmac" }`), an in-memory Ed25519 or P-256 key, or
+an external callback for a non-extractable key:
+
+```ts
+import { createCoseClient, createSealedLink } from "@cratestack/cbor/cose";
+
+const cose = await createCoseClient({
+  audience: "payments",
+  serverKeys: [{ alg: "ed25519", bytes: serverPublicKey }], // the static trust root
+  signer: {
+    type: "external",
+    alg: "esp256",
+    publicKey, // SEC1 point
+    sign: async (toBeSigned) =>
+      new Uint8Array(
+        await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, privateKey, toBeSigned),
+      ),
+  },
+});
+// RPC: new CratestackRpcRuntime(origin, { links: [createSealedLink({ cose, contracts: OP_CONTRACTS })] })
+// REST: new CratestackRuntime(origin, { fetch: createSealedFetch({ cose, contracts: OP_CONTRACTS }) })
+```
+
+`cose` may be a function `({ route, method }) => CoseClient | undefined` to seal with Sign1 before a session,
+Mac0 after it, and not at all for anonymous calls. Every failed verification rejects with a `CoseFailure`
+whose `code` is `rejected` and whose message is empty.

package/dist/cose-node.d.ts

@@ -0,0 +1,6 @@
+export { createCoseClient } from "@cratestack/cbor-node/cose";
+export type { CoseAlgName, CoseCallBinding, CoseClient, CoseClientOptions, CoseExternalSign, CoseOpened, CoseServerKey, CoseSignerOptions, } from "@cratestack/ts-types";
+export { CoseFailure } from "@cratestack/ts-types";
+export type { CoseClientSource, OpContracts } from "./sealed.js";
+export { createSealedFetch, createSealedLink } from "./sealed.js";
+//# sourceMappingURL=cose-node.d.ts.map

package/dist/cose-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cose-node.d.ts","sourceRoot":"","sources":["../src/cose-node.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,YAAY,EACV,WAAW,EACX,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/cose-node.js

@@ -0,0 +1,7 @@
+// Node entry of `@cratestack/cbor/cose` (resolved by the `"node"` condition):
+// the COSE signed transport over the native addon. See
+// `@cratestack/cbor-node/cose` for the API; `@cratestack/ts-types` has its types.
+export { createCoseClient } from "@cratestack/cbor-node/cose";
+export { CoseFailure } from "@cratestack/ts-types";
+export { createSealedFetch, createSealedLink } from "./sealed.js";
+//# sourceMappingURL=cose-node.js.map

package/dist/cose-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cose-node.js","sourceRoot":"","sources":["../src/cose-node.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,uDAAuD;AACvD,kFAAkF;AAElF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAW9D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/cose-web.d.ts

@@ -0,0 +1,6 @@
+export { createCoseClient } from "@cratestack/cbor-web/cose";
+export type { CoseAlgName, CoseCallBinding, CoseClient, CoseClientOptions, CoseExternalSign, CoseOpened, CoseServerKey, CoseSignerOptions, } from "@cratestack/ts-types";
+export { CoseFailure } from "@cratestack/ts-types";
+export type { CoseClientSource, OpContracts } from "./sealed.js";
+export { createSealedFetch, createSealedLink } from "./sealed.js";
+//# sourceMappingURL=cose-web.d.ts.map

package/dist/cose-web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cose-web.d.ts","sourceRoot":"","sources":["../src/cose-web.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,YAAY,EACV,WAAW,EACX,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/cose-web.js

@@ -0,0 +1,7 @@
+// Browser entry of `@cratestack/cbor/cose` (resolved by the `"browser"` and `"default"` conditions):
+// the COSE signed transport over WASM. See
+// `@cratestack/cbor-web/cose` for the API; `@cratestack/ts-types` has its types.
+export { createCoseClient } from "@cratestack/cbor-web/cose";
+export { CoseFailure } from "@cratestack/ts-types";
+export { createSealedFetch, createSealedLink } from "./sealed.js";
+//# sourceMappingURL=cose-web.js.map

package/dist/cose-web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cose-web.js","sourceRoot":"","sources":["../src/cose-web.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,2CAA2C;AAC3C,iFAAiF;AAEjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAW7D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/node.d.ts

@@ -1,3 +1,4 @@
+import { type CborCodecOptions } from "@cratestack/cbor-node";
 import type { CratestackRpcCodec } from "@cratestack/ts-types";
 /**
  * Resolves immediately (no real async work — `@cratestack/cbor-node`'s
@@ -6,7 +7,8 @@ import type { CratestackRpcCodec } from "@cratestack/ts-types";
  * by the native N-API CBOR codec. Async purely for call-site parity with
  * the browser build's `createCborCodec()`, not because Node needs it.
  */
-export declare function createCborCodec(): Promise<CratestackRpcCodec>;
+export declare function createCborCodec(options?: CborCodecOptions): Promise<CratestackRpcCodec>;
 export type { CompactDirection, CompactKeys } from "@cratestack/cbor-node";
 export { createCompactKeys } from "@cratestack/cbor-node";
+export type { CborCodecOptions };
 //# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAEnE;AAID,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE7F;AAID,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/node.js

@@ -21,7 +21,7 @@
 // sometimes a real async boundary), which defeats the point of an umbrella
 // package in the first place. See README.md's "Sync vs. async" section and
 // issue #288 for the full reasoning.
-import { cborCodec } from "@cratestack/cbor-node";
+import { cborCodec, createCborCodec as createNodeCodec, } from "@cratestack/cbor-node";
 /**
  * Resolves immediately (no real async work — `@cratestack/cbor-node`'s
  * underlying native codec is already loaded and synchronous by the time
@@ -29,8 +29,8 @@ import { cborCodec } from "@cratestack/cbor-node";
  * by the native N-API CBOR codec. Async purely for call-site parity with
  * the browser build's `createCborCodec()`, not because Node needs it.
  */
-export async function createCborCodec() {
-    return cborCodec;
+export async function createCborCodec(options) {
+    return options ? createNodeCodec(options) : cborCodec;
 }
 export { createCompactKeys } from "@cratestack/cbor-node";
 //# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,8EAA8E;AAC9E,kDAAkD;AAClD,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,2BAA2B;AAC3B,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,qCAAqC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,SAAS,CAAC;AACnB,CAAC;AAKD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,8EAA8E;AAC9E,kDAAkD;AAClD,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,2BAA2B;AAC3B,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,qCAAqC;AACrC,OAAO,EAEL,SAAS,EACT,eAAe,IAAI,eAAe,GACnC,MAAM,uBAAuB,CAAC;AAG/B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA0B;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAKD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/sealed.d.ts

@@ -0,0 +1,60 @@
+import { type CoseClient } from "@cratestack/ts-types";
+/** The `CoseClient` a call is sealed with, or `undefined` to send it unsealed
+ *  (an anonymous call, an op the client does not seal). A function picks per
+ *  call, so a Sign1 client can seal the calls before a session and a Mac0
+ *  client under the session key the calls after it. */
+export type CoseClientSource = CoseClient | undefined | ((call: {
+    readonly route: string;
+    readonly method: string;
+}) => CoseClient | undefined);
+/** The `OP_CONTRACTS` of a generated client. */
+export type OpContracts = Readonly<Record<string, string>>;
+/** The slice of a generated RPC runtime's link types this file needs. The
+ *  generated `RpcLink` is structurally this. */
+interface RpcSealRequest {
+    readonly kind: "unary" | "batch";
+    readonly opId: string;
+    readonly fetchFn: typeof fetch;
+}
+type RpcSealLink = <R extends RpcSealRequest, T>(request: R, next: (request: R) => Promise<T>) => Promise<T>;
+/**
+ * An `RpcLink` that seals every unary and batch call of a generated RPC client:
+ * the route is the op id (`batch` for `/rpc/batch`), the contract digest is
+ * `OP_CONTRACTS[route]`. An op with no contract, or one `cose` declines
+ * (`undefined`), goes out unsealed. `stream()` is not a link of this chain and
+ * is never sealed (chain-mode streams are not implemented).
+ *
+ * ```ts
+ * import { createCoseClient, createSealedLink } from "@cratestack/cbor/cose";
+ * import { CratestackRpcRuntime, OP_CONTRACTS } from "./runtime";
+ *
+ * const runtime = new CratestackRpcRuntime(origin, {
+ *   links: [createSealedLink({ cose, contracts: OP_CONTRACTS })],
+ * });
+ * ```
+ */
+export declare function createSealedLink(options: {
+    cose: CoseClientSource;
+    contracts: OpContracts;
+}): RpcSealLink;
+/**
+ * A `fetch` that seals every call of a generated REST client, for
+ * `CratestackRuntime`'s `fetch` option. The route template and path parameters
+ * come from matching the URL path (after `basePath`, the runtime's own) against
+ * the `"<METHOD> <template>"` keys of `OP_CONTRACTS`; a call that matches none,
+ * or that `cose` declines (`undefined`), goes out unsealed.
+ *
+ * ```ts
+ * const runtime = new CratestackRuntime(origin, {
+ *   fetch: createSealedFetch({ cose, contracts: OP_CONTRACTS, basePath: "/api" }),
+ * });
+ * ```
+ */
+export declare function createSealedFetch(options: {
+    cose: CoseClientSource;
+    contracts: OpContracts;
+    basePath?: string;
+    fetch?: typeof fetch;
+}): typeof fetch;
+export {};
+//# sourceMappingURL=sealed.d.ts.map

package/dist/sealed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.d.ts","sourceRoot":"","sources":["../src/sealed.ts"],"names":[],"mappings":"AAUA,OAAO,EAAwB,KAAK,UAAU,EAAe,MAAM,sBAAsB,CAAC;AAE1F;;;uDAGuD;AACvD,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,SAAS,GACT,CAAC,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KAAK,UAAU,GAAG,SAAS,CAAC,CAAC;AAoH5F,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3D;gDACgD;AAChD,UAAU,cAAc;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC;CAChC;AACD,KAAK,WAAW,GAAG,CAAC,CAAC,SAAS,cAAc,EAAE,CAAC,EAC7C,OAAO,EAAE,CAAC,EACV,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAC7B,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CACxB,GAAG,WAAW,CAad;AAuCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,OAAO,KAAK,CA2Bf"}

package/dist/sealed.js

@@ -0,0 +1,192 @@
+// Sealing a call at the `fetch` boundary (issue #1010, ADR 0006 §11): the
+// orchestration around a `CoseClient`, for the generated REST runtime (a
+// `fetch` option) and the generated RPC runtime (an `RpcLink`).
+//
+// It sits at `fetch` because that is where the exact wire bytes (after the
+// codec and after compact keys) and the exact headers (`Idempotency-Key`,
+// `If-Match`, the compact `Content-Type` and `Accept`) exist, and it binds
+// what the request carries, as the Rust client's `request_sealed` does. It
+// holds no crypto and no canonical form: the signature, the hash, the query
+// and the AAD are the `CoseClient`'s (Rust). What is left is header plumbing.
+import { CoseFailure } from "@cratestack/ts-types";
+const CBOR = "application/cbor";
+const NO_BODY_STATUS = new Set([101, 204, 205, 304]);
+const PAYLOAD_TYPE_HEADER = "cratestack-payload-type";
+const hexBytes = (hex) => Uint8Array.from(hex.match(/../g) ?? [], (byte) => Number.parseInt(byte, 16));
+const pick = (source, route, method) => typeof source === "function" ? source({ route, method }) : source;
+async function bodyBytes(body) {
+    if (body === null || body === undefined)
+        return new Uint8Array();
+    if (typeof body === "string")
+        return new TextEncoder().encode(body);
+    if (body instanceof Uint8Array)
+        return body;
+    if (body instanceof ArrayBuffer)
+        return new Uint8Array(body);
+    throw new CoseFailure("misuse", "a sealed call carries a string or bytes body");
+}
+/** The media type of a header value, parameters dropped. */
+const mediaTypeOf = (value) => value.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+/** The URL a `fetch` was given, whatever shape it came in. */
+const urlOf = (input) => new URL(input instanceof Request ? input.url : input.toString());
+/**
+ * One sealed round trip: seals `init.body` as the call `route` describes, sends
+ * it through `fetchFn`, and opens the answer. Resolves to a `Response` whose
+ * body is the opened payload and whose `Content-Type` is the type it was sealed
+ * under, so everything downstream of `fetch` is the code an unsealed call runs.
+ *
+ * - An answer that opens is returned; one that does not rejects with a
+ *   {@link CoseFailure} `rejected` (tampered, replayed, wrong audience, wrong
+ *   signer, unrequested type), with no detail.
+ * - An unsigned answer to a refused call (`!ok`: a gateway's `401`, the
+ *   server's `415` or `426`) is returned untouched, a hint and never proof. An
+ *   unsigned *success* is never believed: it rejects.
+ */
+async function sealedFetch(fetchFn, cose, target, input, init = {}) {
+    const url = urlOf(input);
+    const headers = new Headers(init.headers);
+    const payload = await bodyBytes(init.body);
+    const payloadType = mediaTypeOf(headers.get("content-type") ?? "") || CBOR;
+    const accept = (headers.get("accept") ?? "")
+        .split(",")
+        .map(mediaTypeOf)
+        .filter((type) => type !== "");
+    const query = url.search.startsWith("?") ? url.search.slice(1) : url.search;
+    const binding = {
+        method: (init.method ?? "GET").toUpperCase(),
+        route: target.route,
+        pathParams: target.pathParams,
+        query: query === "" ? undefined : cose.canonicalQuery(query),
+        contractSha: target.contractSha,
+        idempotencyKey: headers.get("idempotency-key") ?? undefined,
+        ifMatch: headers.get("if-match") ?? undefined,
+        payloadType,
+        payloadAccept: accept.length === 0 ? undefined : accept,
+    };
+    if (target.route === "batch" &&
+        (payloadType !== CBOR || (accept.length > 0 && !accept.includes(CBOR)))) {
+        throw new CoseFailure("misuse", "a sealed /rpc/batch is CBOR both ways");
+    }
+    const sealed = await cose.sealRequest(payload, binding);
+    headers.set("content-type", cose.mediaType);
+    headers.set("accept", cose.mediaType);
+    headers.set("cratestack-contract", cose.contractHeader(target.contractSha));
+    for (const name of ["cratestack-payload-type", "cratestack-payload-accept"])
+        headers.delete(name);
+    for (const [name, value] of Object.entries(cose.selectorHeaders(binding))) {
+        headers.set(name, value);
+    }
+    const response = await fetchFn(url, { ...init, headers, body: sealed });
+    const contentType = mediaTypeOf(response.headers.get("content-type") ?? "");
+    if (contentType !== mediaTypeOf(cose.mediaType)) {
+        if (response.ok) {
+            throw new CoseFailure("rejected", "");
+        }
+        return response;
+    }
+    const opened = await cose.openResponse(new Uint8Array(await response.arrayBuffer()), binding, sealed, response.status, response.headers.get(PAYLOAD_TYPE_HEADER) ?? undefined);
+    const answered = new Headers(response.headers);
+    for (const name of ["content-length", "content-encoding", PAYLOAD_TYPE_HEADER]) {
+        answered.delete(name);
+    }
+    answered.set("content-type", opened.payloadType);
+    return new Response(NO_BODY_STATUS.has(response.status) ? null : opened.payload, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: answered,
+    });
+}
+/**
+ * An `RpcLink` that seals every unary and batch call of a generated RPC client:
+ * the route is the op id (`batch` for `/rpc/batch`), the contract digest is
+ * `OP_CONTRACTS[route]`. An op with no contract, or one `cose` declines
+ * (`undefined`), goes out unsealed. `stream()` is not a link of this chain and
+ * is never sealed (chain-mode streams are not implemented).
+ *
+ * ```ts
+ * import { createCoseClient, createSealedLink } from "@cratestack/cbor/cose";
+ * import { CratestackRpcRuntime, OP_CONTRACTS } from "./runtime";
+ *
+ * const runtime = new CratestackRpcRuntime(origin, {
+ *   links: [createSealedLink({ cose, contracts: OP_CONTRACTS })],
+ * });
+ * ```
+ */
+export function createSealedLink(options) {
+    return (request, next) => {
+        const route = request.kind === "batch" ? "batch" : request.opId;
+        const client = pick(options.cose, route, "POST");
+        const contract = options.contracts[route];
+        if (client === undefined || contract === undefined) {
+            return next(request);
+        }
+        const target = { route, pathParams: [], contractSha: hexBytes(contract) };
+        const sealedFetchFn = ((input, init) => sealedFetch(request.fetchFn, client, target, input, init));
+        return next({ ...request, fetchFn: sealedFetchFn });
+    };
+}
+/** `"<METHOD> <template>"` keys of `OP_CONTRACTS` as matchers over a path. */
+function restTemplates(contracts) {
+    const out = [];
+    for (const [key, contract] of Object.entries(contracts)) {
+        const space = key.indexOf(" ");
+        if (space < 0)
+            continue;
+        const template = key.slice(space + 1);
+        const segments = template.split("/");
+        const pattern = new RegExp(`^${segments
+            .map((segment) => /^\{[^}]+\}$/.test(segment) ? "([^/]+)" : segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+            .join("/")}$`);
+        out.push({
+            key,
+            method: key.slice(0, space),
+            template,
+            pattern,
+            literals: segments.filter((segment) => !/^\{[^}]+\}$/.test(segment)).length,
+            contractSha: hexBytes(contract),
+        });
+    }
+    // The most literal template wins (`/widgets/search` before `/widgets/{id}`).
+    return out.sort((a, b) => b.literals - a.literals);
+}
+/**
+ * A `fetch` that seals every call of a generated REST client, for
+ * `CratestackRuntime`'s `fetch` option. The route template and path parameters
+ * come from matching the URL path (after `basePath`, the runtime's own) against
+ * the `"<METHOD> <template>"` keys of `OP_CONTRACTS`; a call that matches none,
+ * or that `cose` declines (`undefined`), goes out unsealed.
+ *
+ * ```ts
+ * const runtime = new CratestackRuntime(origin, {
+ *   fetch: createSealedFetch({ cose, contracts: OP_CONTRACTS, basePath: "/api" }),
+ * });
+ * ```
+ */
+export function createSealedFetch(options) {
+    const templates = restTemplates(options.contracts);
+    const basePath = (options.basePath ?? "").replace(/\/+$/, "");
+    const underlying = options.fetch ?? fetch.bind(globalThis);
+    return (async (input, init) => {
+        const url = urlOf(input);
+        const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+        const path = basePath !== "" && url.pathname.startsWith(basePath)
+            ? url.pathname.slice(basePath.length)
+            : url.pathname;
+        for (const candidate of templates) {
+            const match = candidate.method === method ? candidate.pattern.exec(path) : null;
+            if (match === null)
+                continue;
+            const client = pick(options.cose, candidate.key, method);
+            if (client === undefined)
+                break;
+            const target = {
+                route: candidate.template,
+                pathParams: match.slice(1).map(decodeURIComponent),
+                contractSha: candidate.contractSha,
+            };
+            return sealedFetch(underlying, client, target, input, init);
+        }
+        return underlying(input, init);
+    });
+}
+//# sourceMappingURL=sealed.js.map

package/dist/sealed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.js","sourceRoot":"","sources":["../src/sealed.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,OAAO,EAAyC,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAkB1F,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAChC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAc,EAAE,CAC3C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAE/E,MAAM,IAAI,GAAG,CAAC,MAAwB,EAAE,KAAa,EAAE,MAAc,EAA0B,EAAE,CAC/F,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAEpE,KAAK,UAAU,SAAS,CAAC,IAAiC;IACxD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,UAAU,EAAE,CAAC;IACjE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,YAAY,UAAU;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;AAClF,CAAC;AAED,4DAA4D;AAC5D,MAAM,WAAW,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;AAElG,8DAA8D;AAC9D,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAO,EAAE,CAC9C,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,WAAW,CACxB,OAAqB,EACrB,IAAgB,EAChB,MAAmB,EACnB,KAAwB,EACxB,IAAI,GAAgB,EAAE;IAEtB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC;IAC3E,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;SACzC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,WAAW,CAAC;SAChB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IAC5E,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;QAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAC5D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS;QAC3D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS;QAC7C,WAAW;QACX,aAAa,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;KACxD,CAAC;IACF,IACE,MAAM,CAAC,KAAK,KAAK,OAAO;QACxB,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAkB,EAAE,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,WAAW,KAAK,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,EAC5C,OAAO,EACP,MAAM,EACN,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,CACvD,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,MAAM,CAAC,OAAoB,EAAE;QAC7F,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAGhC;IACC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,GAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvF,MAAM,aAAa,GAAG,CAAC,CAAC,KAAwB,EAAE,IAAkB,EAAE,EAAE,CACtE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAiB,CAAC;QAC7E,OAAO,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC;AAWD,8EAA8E;AAC9E,SAAS,aAAa,CAAC,SAAsB;IAC3C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,IAAI,QAAQ;aACT,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CACzF;aACA,IAAI,CAAC,GAAG,CAAC,GAAG,CAChB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,GAAG;YACH,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;YAC3B,QAAQ;YACR,OAAO;YACP,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC3E,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IACD,6EAA6E;IAC7E,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAKjC;IACC,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,CACb,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAClE,CAAC,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GACR,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YAClD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,MAAM,MAAM,GAAgB;gBAC1B,KAAK,EAAE,SAAS,CAAC,QAAQ;gBACzB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAClD,WAAW,EAAE,SAAS,CAAC,WAAW;aACnC,CAAC;YACF,OAAO,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAiB,CAAC;AACrB,CAAC"}

package/dist/web.d.ts

@@ -1,3 +1,3 @@
-export type { CompactDirection, CompactKeys } from "@cratestack/cbor-web";
+export type { CborCodecOptions, CompactDirection, CompactKeys } from "@cratestack/cbor-web";
 export { createCborCodec, createCompactKeys } from "@cratestack/cbor-web";
 //# sourceMappingURL=web.d.ts.map

package/dist/web.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAaA,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAaA,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratestack/cbor",
-  "version": "0.19.2",
+  "version": "0.19.4",
   "description": "Umbrella CBOR codec for CrateStack's generated TypeScript RPC clients: conditional exports auto-select @cratestack/cbor-node in Node and @cratestack/cbor-web in the browser behind one import path, one uniform async createCborCodec() API on both platforms.",
   "license": "MIT",
   "repository": {
@@ -44,6 +44,20 @@
     "./web": {
       "types": "./dist/web.d.ts",
       "import": "./dist/web.js"
+    },
+    "./cose": {
+      "node": {
+        "types": "./dist/cose-node.d.ts",
+        "import": "./dist/cose-node.js"
+      },
+      "browser": {
+        "types": "./dist/cose-web.d.ts",
+        "import": "./dist/cose-web.js"
+      },
+      "default": {
+        "types": "./dist/cose-web.d.ts",
+        "import": "./dist/cose-web.js"
+      }
     }
   },
   "files": [
@@ -57,9 +71,9 @@
     "lint": "biome check ."
   },
   "dependencies": {
-    "@cratestack/cbor-node": "0.19.2",
-    "@cratestack/cbor-web": "0.19.2",
-    "@cratestack/ts-types": "0.19.2"
+    "@cratestack/cbor-node": "0.19.4",
+    "@cratestack/cbor-web": "0.19.4",
+    "@cratestack/ts-types": "0.19.4"
   },
   "devDependencies": {
     "typescript": "^7.0.2",