@dignetwork/dig-sdk 0.0.1-alpha.99 → 0.1.0

package/dist/dig-client-entry-BIzuZ7Rs.d.ts

@@ -0,0 +1,263 @@
+/** The read-crypto functions the SDK uses from the dig_client WASM. */
+interface DigClientWasm {
+    /** `retrieval_key = SHA-256(canonical rootless urn)`, lowercase hex. Empty key ⇒ index.html. */
+    retrievalKey(storeIdHex: string, resourceKey: string): string;
+    /** Derive the 32-byte AES-256 content key (lowercase hex). `saltHex` for a private store. */
+    deriveKey(storeIdHex: string, resourceKey: string, saltHex?: string | null): string;
+    /**
+     * Verify `ciphertext` is included under `trustedRootHex` via the base64 merkle `proofB64`.
+     * Returns true on success, false on ANY verification failure (a decoy returns false rather than
+     * throwing). Throws only on malformed inputs.
+     */
+    verifyInclusion(ciphertext: Uint8Array, proofB64: string, trustedRootHex: string): boolean;
+    /** AES-256-GCM-SIV-open a single chunk under an explicit 32-byte `keyHex`. Throws on tag fail. */
+    decryptChunk(keyHex: string, ciphertext: Uint8Array): Uint8Array;
+    /**
+     * Full read pipeline: gate (inclusion) then decrypt (URN key, split by `chunkLens`), returning
+     * plaintext bytes. `chunkLens` may be null/empty for a single-chunk resource.
+     */
+    decryptResource(storeIdHex: string, resourceKey: string, ciphertext: Uint8Array, proofB64: string, trustedRootHex: string, saltHex?: string | null, chunkLens?: Uint32Array | null): Uint8Array;
+    /** As `decryptResource`, returning UTF-8 text. */
+    decryptResourceToText(storeIdHex: string, resourceKey: string, ciphertext: Uint8Array, proofB64: string, trustedRootHex: string, saltHex?: string | null, chunkLens?: Uint32Array | null): string;
+    /** Seal a resource's plaintext as one GCM-SIV blob under its per-URN key (the encrypt inverse). */
+    encryptResource(storeIdHex: string, resourceKey: string, plaintext: Uint8Array, saltHex?: string | null): Uint8Array;
+    /** Reconstruct the canonical rootless URN string. */
+    reconstructUrn(storeIdHex: string, resourceKey: string): string;
+    /** Reconstruct a root-pinned display URN string. */
+    reconstructUrnWithRoot(storeIdHex: string, rootHex: string, resourceKey: string): string;
+    /** Library version (matches the crate version). */
+    version(): string;
+}
+
+/** A normalized `{ publicKey, signature }` pair from a wallet sign, both as `0x`-prefixed hex. */
+interface SignResult {
+    /** The signing public key (synthetic BLS key), `0x`-prefixed hex. */
+    publicKey: string | null;
+    /** The BLS signature, `0x`-prefixed hex (or the raw wallet string). */
+    signature: string | null;
+}
+/**
+ * The minimal injected-provider contract the SDK detects on `window.chia` (the DIG Browser's
+ * in-process wallet, or a compatible CHIP-0002 extension). Mirrors the DIG Browser provider:
+ * `request({ method, params })` returns the wallet's `data`; `connect(eager)` blocks on per-origin
+ * approval; `on`/`off` are EIP-1193-style event hooks.
+ */
+interface InjectedChiaProvider {
+    /** Unspoofable marker the DIG Browser provider sets; the SDK prefers a provider that has it. */
+    isDIG?: boolean;
+    /** Some providers expose a connected flag. */
+    isConnected?: boolean;
+    /** One CHIP-0002 RPC. Bare names auto-prefix to `chip0002_`; `chia_*` passes through. */
+    request(args: {
+        method: string;
+        params?: unknown;
+    }): Promise<unknown>;
+    /** Ask the wallet to approve this origin. Blocks until approved/rejected. */
+    connect?(eager?: boolean): Promise<unknown>;
+    on?(event: string, fn: (data: unknown) => void): void;
+    off?(event: string, fn: (data: unknown) => void): void;
+}
+declare global {
+    var chia: InjectedChiaProvider | undefined;
+    interface Window {
+        chia?: InjectedChiaProvider;
+    }
+}
+/** Which wallet transport is backing a `ChiaProvider`. */
+type WalletBackend = "injected" | "walletconnect";
+/** A connected wallet session, returned by `ChiaProvider.connect()`. */
+interface WalletSession {
+    /** The transport backing this session. */
+    backend: WalletBackend;
+    /** The CAIP-2 chain id (e.g. "chia:mainnet"). */
+    chain: string;
+    /**
+     * The session topic. For WalletConnect this is the real relay topic; for the injected backend
+     * it is a stable sentinel ("injected") — callers do not need to inspect it.
+     */
+    topic: string;
+    /** The wallet's receive address, when known at connect time. */
+    address?: string | null;
+}
+/** Options for `DigClient.read*` calls — chiefly which dig RPC endpoint to use. */
+interface ReadOptions {
+    /** dig RPC endpoint. Defaults to the public `https://rpc.dig.net`. */
+    rpc?: string;
+}
+/** The result of reading a resource by URN. */
+interface ReadResult {
+    /** Store identity (64-hex). */
+    storeId: string;
+    /** The on-chain generation root the content was verified against (or null if none supplied). */
+    root: string | null;
+    /** The resource path within the store. */
+    resourceKey: string;
+    /** Private-store salt used (or null). */
+    salt: string | null;
+    /**
+     * The resource bytes. When `decrypted` is true these are the authenticated plaintext; when
+     * false they are the RAW served ciphertext (a decoy / wrong-key / wrong-salt response is just
+     * opaque bytes — the model is oblivious, so this is never a "not found" verdict).
+     */
+    bytes: Uint8Array;
+    /** Advisory: did the served bytes' inclusion proof verify against `root`? */
+    verified: boolean;
+    /** Did the bytes decrypt+authenticate under this URN's derived key? */
+    decrypted: boolean;
+}
+/** The two root-independent keys a URN maps to (derived client-side, nothing sent to the network). */
+interface UrnKeys {
+    storeId: string;
+    root: string | null;
+    resourceKey: string;
+    salt: string | null;
+    /** `SHA-256(canonical rootless URN)`, lowercase hex — what the dig RPC is addressed by. */
+    retrievalKey: string;
+    /** The per-URN AES-256-GCM-SIV decryption key, lowercase hex. */
+    decryptionKey: string;
+}
+
+/** The default public dig RPC endpoint. */
+declare const DEFAULT_RPC = "https://rpc.dig.net";
+/** Options to construct a DigClient. */
+interface DigClientOptions {
+    /** dig RPC endpoint. Defaults to the public `https://rpc.dig.net`. */
+    rpc?: string;
+    /** Override `fetch` (e.g. an instrumented one). Defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+}
+/**
+ * The read-crypto client. Construct once and reuse — the wasm is loaded + SRI-verified lazily on
+ * the first read and memoized process/page-wide.
+ *
+ * @example
+ * const dig = new DigClient();
+ * const { bytes, decrypted } = await dig.read({
+ *   urn: "urn:dig:chia:<storeId>/index.html",
+ *   root: "<onchain-root-hex>",
+ * });
+ * if (decrypted) console.log(new TextDecoder().decode(bytes));
+ */
+declare class DigClient {
+    private readonly rpc;
+    private readonly fetchImpl;
+    constructor(options?: DigClientOptions);
+    /** Load (and SRI-verify) the read-crypto wasm. Exposed for callers that want the raw functions. */
+    wasm(): Promise<DigClientWasm>;
+    /** `retrieval_key = SHA-256(canonical rootless URN)`, lowercase hex. */
+    retrievalKey(storeId: string, resourceKey: string): Promise<string>;
+    /** Derive the per-URN AES-256-GCM-SIV key, lowercase hex. `salt` for a private store. */
+    deriveKey(storeId: string, resourceKey: string, salt?: string | null): Promise<string>;
+    /** Verify served `ciphertext` is included under `root` via the base64 merkle `proof`. */
+    verifyInclusion(ciphertext: Uint8Array, proof: string, root: string): Promise<boolean>;
+    /** Reconstruct the canonical rootless URN whose SHA-256 is the retrieval key. */
+    reconstructUrn(storeId: string, resourceKey: string): Promise<string>;
+    /**
+     * Derive, client-side, the two root-independent keys a URN maps to (retrieval + decryption).
+     * Nothing is sent to the network — pure local derivation via the wasm.
+     */
+    deriveUrnKeys(input: {
+        urn: string;
+        salt?: string | null;
+    }): Promise<UrnKeys>;
+    /**
+     * Fetch + verify + decrypt one resource by URN. `root` is the on-chain generation root to verify
+     * against (resolved by the caller from the chain); when omitted, the root embedded in the URN is
+     * used. Returns the bytes plus advisory `verified`/`decrypted` flags. NEVER throws "not found"
+     * (presence is unknowable) — it throws only on a transport failure.
+     */
+    read(input: {
+        urn: string;
+        root?: string | null;
+        salt?: string | null;
+    }, opts?: ReadOptions): Promise<ReadResult>;
+    /** As `read`, but decoding the plaintext to a UTF-8 string when it decrypts (else throws). */
+    readText(input: {
+        urn: string;
+        root?: string | null;
+        salt?: string | null;
+    }, opts?: ReadOptions): Promise<string>;
+    /**
+     * Read by explicit (storeId, resourceKey, root, salt) rather than a URN string. The oblivious
+     * download primitive the URN read is built on.
+     */
+    readResource(input: {
+        storeId: string;
+        resourceKey: string;
+        root: string;
+        salt?: string | null;
+    }, opts?: ReadOptions): Promise<ReadResult>;
+    private fetchCiphertext;
+    private rpcCall;
+}
+
+/** SHA-256 (lowercase hex) of vendor/dig_client_bg.wasm — the SRI digest. Fail closed on mismatch. */
+declare const DIG_CLIENT_WASM_SHA256 = "ff486be806f908a2a90780e499a04dbd34e10e3b97be0470cb9ee841a1e49e77";
+/** Optional explicit wasm inputs, for environments where auto-resolution can't find vendor/. */
+interface WasmConfig {
+    /**
+     * The wasm bytes (already loaded). When provided, SRI is still enforced unless `skipIntegrity`.
+     * Pass this in CSP-strict browsers where you fetch + verify the bytes yourself.
+     */
+    wasmBytes?: BufferSource;
+    /**
+     * URL to the wasm-bindgen glue module (vendor/dig_client.mjs) for browser dynamic import. When
+     * omitted in a browser, the loader tries to import the glue relative to this module.
+     */
+    glueUrl?: string;
+    /**
+     * URL to fetch the wasm bytes from (browser) when `wasmBytes` is not supplied. The fetched bytes
+     * are SRI-verified before init.
+     */
+    wasmUrl?: string;
+    /** Skip the SRI check. Only for tests / trusted custom builds — NOT recommended. */
+    skipIntegrity?: boolean;
+}
+/**
+ * Override how the read-crypto wasm is located/loaded. Call BEFORE the first `DigClient` read.
+ * Mainly for browsers without a bundler that resolves package files, or CSP-strict apps that fetch
+ * + verify the wasm bytes themselves and hand them in. Resets any cached instance.
+ */
+declare function configureWasm(config: WasmConfig): void;
+/**
+ * Load, SRI-verify, and instantiate the read-crypto wasm, returning its functions. Memoized — at
+ * most one init per process/page. Fails closed on an integrity mismatch.
+ */
+declare function loadDigClientWasm(): Promise<DigClientWasm>;
+
+/** The parts of a parsed DIG URN. `root`/`salt` are null when absent. */
+interface ParsedUrn {
+    /** Store identity (64-hex launcher id), lowercased. */
+    readonly storeId: string;
+    /** Generation root (64-hex), lowercased — or null for the root-independent form. */
+    readonly root: string | null;
+    /** Resource path within the store (verbatim, not lowercased). */
+    readonly resourceKey: string;
+    /** Private-store secret salt (hex), lowercased — or null for a public store. */
+    readonly salt: string | null;
+}
+/**
+ * Parse a DIG URN into its parts. Throws on a malformed URN.
+ *
+ * @example
+ * parseUrn("urn:dig:chia:" + "ab".repeat(32) + "/index.html")
+ * // → { storeId: "abab…", root: null, resourceKey: "index.html", salt: null }
+ */
+declare function parseUrn(raw: string): ParsedUrn;
+/** True iff `raw` is a syntactically valid DIG URN. Never throws. */
+declare function isUrn(raw: string): boolean;
+/**
+ * Reconstruct the canonical, root-INDEPENDENT URN string for a store + resource key:
+ * `urn:dig:chia:<store_id>/<resource_key>`. An empty resource key resolves to the default view
+ * `index.html`. This is the form whose SHA-256 is the retrieval key and whose bytes seed the AES
+ * key — matching the wasm's `reconstructUrn`.
+ */
+declare function reconstructUrn(storeId: string, resourceKey: string): string;
+/**
+ * Reconstruct a root-PINNED display URN: `urn:dig:chia:<store_id>:<root>/<resource_key>`. Useful
+ * for sharing a URN bound to a specific generation; the retrieval/AES keys still use the rootless
+ * form (`reconstructUrn`).
+ */
+declare function reconstructUrnWithRoot(storeId: string, root: string, resourceKey: string): string;
+
+export { DEFAULT_RPC as D, type InjectedChiaProvider as I, type ParsedUrn as P, type ReadOptions as R, type SignResult as S, type UrnKeys as U, type WalletBackend as W, type WalletSession as a, DIG_CLIENT_WASM_SHA256 as b, DigClient as c, type DigClientOptions as d, type DigClientWasm as e, type ReadResult as f, type WasmConfig as g, configureWasm as h, isUrn as i, reconstructUrnWithRoot as j, loadDigClientWasm as l, parseUrn as p, reconstructUrn as r };

package/dist/dig-client.cjs

@@ -0,0 +1,330 @@
+'use strict';
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+// src/loader.ts
+var DIG_CLIENT_WASM_SHA256 = "ff486be806f908a2a90780e499a04dbd34e10e3b97be0470cb9ee841a1e49e77";
+var _config = {};
+var _ready = null;
+function configureWasm(config) {
+  _config = { ...config };
+  _ready = null;
+}
+var isNode = typeof process !== "undefined" && !!process.versions?.node;
+async function sha256Hex(bytes) {
+  if (isNode) {
+    const { createHash } = await import('crypto');
+    const view = bytes instanceof ArrayBuffer ? new Uint8Array(bytes) : new Uint8Array(
+      bytes.buffer,
+      bytes.byteOffset,
+      bytes.byteLength
+    );
+    return createHash("sha256").update(view).digest("hex");
+  }
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function assertIntegrity(hex) {
+  if (_config.skipIntegrity) return;
+  if (hex !== DIG_CLIENT_WASM_SHA256) {
+    throw new Error(
+      `dig-client wasm integrity check failed \u2014 refusing to run unverified crypto (expected ${DIG_CLIENT_WASM_SHA256}, got ${hex}).`
+    );
+  }
+}
+async function loadNode() {
+  const { readFile } = await import('fs/promises');
+  const { fileURLToPath, pathToFileURL } = await import('url');
+  const path = await import('path');
+  const here = path.dirname(fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('dig-client.cjs', document.baseURI).href))));
+  const vendorDir = path.resolve(here, "..", "vendor");
+  const wasmPath = path.join(vendorDir, "dig_client_bg.wasm");
+  const gluePath = path.join(vendorDir, "dig_client.mjs");
+  const buf = await readFile(wasmPath);
+  const bytes = new Uint8Array(buf.byteLength);
+  bytes.set(buf);
+  return { glueHref: pathToFileURL(gluePath).href, bytes };
+}
+async function loadBrowser() {
+  const glueHref = _config.glueUrl ?? new URL("../vendor/dig_client.mjs", (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('dig-client.cjs', document.baseURI).href))).href;
+  let bytes;
+  if (_config.wasmBytes) {
+    bytes = _config.wasmBytes;
+  } else {
+    const wasmUrl = _config.wasmUrl ?? new URL("../vendor/dig_client_bg.wasm", (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('dig-client.cjs', document.baseURI).href))).href;
+    const res = await fetch(wasmUrl);
+    if (!res.ok) throw new Error(`dig-client wasm fetch failed (${res.status})`);
+    bytes = await res.arrayBuffer();
+  }
+  return { glueHref, bytes };
+}
+function loadDigClientWasm() {
+  if (_ready) return _ready;
+  _ready = (async () => {
+    const { glueHref, bytes } = isNode ? await loadNode() : await loadBrowser();
+    assertIntegrity(await sha256Hex(bytes));
+    const mod = await import(
+      /* @vite-ignore */
+      glueHref
+    );
+    await mod.default({ module_or_path: bytes });
+    return mod;
+  })().catch((e) => {
+    _ready = null;
+    throw e;
+  });
+  return _ready;
+}
+
+// src/urn.ts
+var URN_RE = /^urn:dig:chia:([0-9a-fA-F]{64})(?::([0-9a-fA-F]{64}))?\/(.+?)(?:\?salt=([0-9a-fA-F]+))?$/;
+function parseUrn(raw) {
+  const s = String(raw ?? "").trim();
+  const m = URN_RE.exec(s);
+  if (!m) {
+    throw new Error(
+      "Not a valid dig URN (expected urn:dig:chia:<store-id>[:<root>]/<path>[?salt=<hex>])."
+    );
+  }
+  return {
+    storeId: m[1].toLowerCase(),
+    root: m[2] ? m[2].toLowerCase() : null,
+    resourceKey: m[3],
+    salt: m[4] ? m[4].toLowerCase() : null
+  };
+}
+function isUrn(raw) {
+  try {
+    parseUrn(raw);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function reconstructUrn(storeId, resourceKey) {
+  const key = resourceKey && resourceKey.length > 0 ? resourceKey : "index.html";
+  return `urn:dig:chia:${storeId.toLowerCase()}/${key}`;
+}
+function reconstructUrnWithRoot(storeId, root, resourceKey) {
+  const key = resourceKey && resourceKey.length > 0 ? resourceKey : "index.html";
+  return `urn:dig:chia:${storeId.toLowerCase()}:${root.toLowerCase()}/${key}`;
+}
+
+// src/dig-client.ts
+var DEFAULT_RPC = "https://rpc.dig.net";
+var RPC_CHUNK_BYTES = 3 * 1024 * 1024;
+function b64ToBytes(b64) {
+  if (typeof atob === "function") {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  }
+  return new Uint8Array(globalThis.Buffer.from(b64, "base64"));
+}
+var DigClient = class {
+  constructor(options = {}) {
+    this.rpc = options.rpc ?? DEFAULT_RPC;
+    this.fetchImpl = options.fetch ?? (typeof fetch === "function" ? fetch.bind(globalThis) : undefinedFetch());
+  }
+  /** Load (and SRI-verify) the read-crypto wasm. Exposed for callers that want the raw functions. */
+  async wasm() {
+    return loadDigClientWasm();
+  }
+  /** `retrieval_key = SHA-256(canonical rootless URN)`, lowercase hex. */
+  async retrievalKey(storeId, resourceKey) {
+    return (await this.wasm()).retrievalKey(storeId, resourceKey);
+  }
+  /** Derive the per-URN AES-256-GCM-SIV key, lowercase hex. `salt` for a private store. */
+  async deriveKey(storeId, resourceKey, salt) {
+    return (await this.wasm()).deriveKey(storeId, resourceKey, salt ?? void 0);
+  }
+  /** Verify served `ciphertext` is included under `root` via the base64 merkle `proof`. */
+  async verifyInclusion(ciphertext, proof, root) {
+    return (await this.wasm()).verifyInclusion(ciphertext, proof, root);
+  }
+  /** Reconstruct the canonical rootless URN whose SHA-256 is the retrieval key. */
+  async reconstructUrn(storeId, resourceKey) {
+    return (await this.wasm()).reconstructUrn(storeId, resourceKey);
+  }
+  /**
+   * Derive, client-side, the two root-independent keys a URN maps to (retrieval + decryption).
+   * Nothing is sent to the network — pure local derivation via the wasm.
+   */
+  async deriveUrnKeys(input) {
+    const parsed = parseUrn(input.urn);
+    const wasm = await this.wasm();
+    const effSalt = input.salt ?? parsed.salt ?? void 0;
+    return {
+      storeId: parsed.storeId,
+      root: parsed.root,
+      resourceKey: parsed.resourceKey,
+      salt: effSalt ?? null,
+      retrievalKey: wasm.retrievalKey(parsed.storeId, parsed.resourceKey),
+      decryptionKey: wasm.deriveKey(parsed.storeId, parsed.resourceKey, effSalt)
+    };
+  }
+  /**
+   * Fetch + verify + decrypt one resource by URN. `root` is the on-chain generation root to verify
+   * against (resolved by the caller from the chain); when omitted, the root embedded in the URN is
+   * used. Returns the bytes plus advisory `verified`/`decrypted` flags. NEVER throws "not found"
+   * (presence is unknowable) — it throws only on a transport failure.
+   */
+  async read(input, opts = {}) {
+    const parsed = parseUrn(input.urn);
+    const effSalt = input.salt ?? parsed.salt ?? null;
+    const effRoot = input.root ?? parsed.root ?? null;
+    if (!effRoot) {
+      throw new Error(
+        "a confirmed on-chain root is required to read content (pass { root } or use a root-pinned URN)"
+      );
+    }
+    return this.readResource(
+      { storeId: parsed.storeId, resourceKey: parsed.resourceKey, root: effRoot, salt: effSalt },
+      opts
+    );
+  }
+  /** As `read`, but decoding the plaintext to a UTF-8 string when it decrypts (else throws). */
+  async readText(input, opts = {}) {
+    const r = await this.read(input, opts);
+    if (!r.decrypted) {
+      throw new Error(
+        "resource did not decrypt under this URN \u2014 wrong store/key/salt, or a decoy response"
+      );
+    }
+    return new TextDecoder().decode(r.bytes);
+  }
+  /**
+   * Read by explicit (storeId, resourceKey, root, salt) rather than a URN string. The oblivious
+   * download primitive the URN read is built on.
+   */
+  async readResource(input, opts = {}) {
+    const rpc = opts.rpc ?? this.rpc;
+    const wasm = await this.wasm();
+    const rk = wasm.retrievalKey(input.storeId, input.resourceKey);
+    const { ciphertext, proof, chunkLens } = await this.fetchCiphertext(
+      input.storeId,
+      rk,
+      input.root,
+      rpc
+    );
+    let verified = false;
+    try {
+      verified = !!wasm.verifyInclusion(ciphertext, proof, input.root);
+    } catch {
+      verified = false;
+    }
+    const keyHex = wasm.deriveKey(input.storeId, input.resourceKey, input.salt ?? void 0);
+    try {
+      const bytes = decryptResourceChunks(wasm, keyHex, ciphertext, chunkLens);
+      return {
+        storeId: input.storeId,
+        root: input.root,
+        resourceKey: input.resourceKey,
+        salt: input.salt ?? null,
+        bytes,
+        verified,
+        decrypted: true
+      };
+    } catch {
+      return {
+        storeId: input.storeId,
+        root: input.root,
+        resourceKey: input.resourceKey,
+        salt: input.salt ?? null,
+        bytes: ciphertext,
+        verified,
+        decrypted: false
+      };
+    }
+  }
+  // Stream the FULL ciphertext for a resource from the RPC by retrieval key, reassembling 3-MiB
+  // chunks. A null result is a TRANSPORT failure, never a presence judgment.
+  async fetchCiphertext(storeId, rk, root, rpc) {
+    let offset = 0;
+    let total = null;
+    let buf = null;
+    let proof = "";
+    let chunkLens = null;
+    for (; ; ) {
+      const r = await this.rpcCall(rpc, "dig.getContent", {
+        store_id: storeId,
+        root,
+        retrieval_key: rk,
+        offset,
+        length: RPC_CHUNK_BYTES
+      });
+      if (!r) throw new Error("The content network returned no data for this request.");
+      if (total === null) {
+        total = r.total_length >>> 0;
+        buf = new Uint8Array(total);
+      }
+      if (chunkLens === null && Array.isArray(r.chunk_lens)) {
+        chunkLens = r.chunk_lens.map((n) => n >>> 0);
+      }
+      const chunk = b64ToBytes(r.ciphertext ?? "");
+      const at = r.offset >>> 0;
+      buf.set(chunk.subarray(0, Math.max(0, Math.min(chunk.length, total - at))), at);
+      if (r.inclusion_proof) proof = r.inclusion_proof;
+      if (r.complete || r.next_offset == null) break;
+      offset = r.next_offset >>> 0;
+    }
+    return { ciphertext: buf ?? new Uint8Array(0), proof, chunkLens };
+  }
+  // One JSON-RPC 2.0 call. Throws on transport failure or a JSON-RPC error; returns `result`.
+  async rpcCall(rpc, method, params) {
+    let res;
+    try {
+      res = await this.fetchImpl(rpc, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+      });
+    } catch {
+      throw new Error("Could not reach the content network. Check your connection and try again.");
+    }
+    if (!res.ok) throw new Error(`dig RPC ${method} failed (${res.status})`);
+    const json = await res.json();
+    if (json && json.error) throw new Error(`dig RPC ${method}: ${json.error.message ?? "error"}`);
+    return json ? json.result ?? null : null;
+  }
+};
+function decryptResourceChunks(wasm, keyHex, ciphertext, chunkLens) {
+  const lens = chunkLens && chunkLens.length ? chunkLens : [ciphertext.length];
+  const total = lens.reduce((a, n) => a + n, 0);
+  if (total !== ciphertext.length) {
+    throw new Error("served ciphertext length does not match chunk lengths");
+  }
+  if (lens.length === 1) return wasm.decryptChunk(keyHex, ciphertext);
+  const parts = [];
+  let p = 0;
+  for (const len of lens) {
+    parts.push(wasm.decryptChunk(keyHex, ciphertext.subarray(p, p + len)));
+    p += len;
+  }
+  const out = new Uint8Array(parts.reduce((a, x) => a + x.length, 0));
+  let q = 0;
+  for (const part of parts) {
+    out.set(part, q);
+    q += part.length;
+  }
+  return out;
+}
+function undefinedFetch() {
+  return (() => {
+    throw new Error(
+      "No global fetch available. Pass { fetch } to DigClient (Node < 18 needs a fetch polyfill)."
+    );
+  });
+}
+
+exports.DEFAULT_RPC = DEFAULT_RPC;
+exports.DIG_CLIENT_WASM_SHA256 = DIG_CLIENT_WASM_SHA256;
+exports.DigClient = DigClient;
+exports.configureWasm = configureWasm;
+exports.isUrn = isUrn;
+exports.loadDigClientWasm = loadDigClientWasm;
+exports.parseUrn = parseUrn;
+exports.reconstructUrn = reconstructUrn;
+exports.reconstructUrnWithRoot = reconstructUrnWithRoot;
+//# sourceMappingURL=dig-client.cjs.map
+//# sourceMappingURL=dig-client.cjs.map

package/dist/dig-client.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/loader.ts","../src/urn.ts","../src/dig-client.ts"],"names":[],"mappings":";;;;AAmBO,IAAM,sBAAA,GACX;AAuBF,IAAI,UAAsB,EAAC;AAC3B,IAAI,MAAA,GAAwC,IAAA;AAOrC,SAAS,cAAc,MAAA,EAA0B;AACtD,EAAA,OAAA,GAAU,EAAE,GAAG,MAAA,EAAO;AACtB,EAAA,MAAA,GAAS,IAAA;AACX;AAEA,IAAM,SACJ,OAAO,OAAA,KAAY,eACnB,CAAC,CAAE,QAA6C,QAAA,EAAU,IAAA;AAG5D,eAAe,UAAU,KAAA,EAAsC;AAC7D,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,QAAa,CAAA;AACjD,IAAA,MAAM,OACJ,KAAA,YAAiB,WAAA,GACb,IAAI,UAAA,CAAW,KAAK,IACpB,IAAI,UAAA;AAAA,MACD,KAAA,CAA0B,MAAA;AAAA,MAC1B,KAAA,CAA0B,UAAA;AAAA,MAC1B,KAAA,CAA0B;AAAA,KAC7B;AACN,IAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,IAAI,CAAA,CAAE,OAAO,KAAK,CAAA;AAAA,EACvD;AACA,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,KAAqB,CAAA;AAC1E,EAAA,OAAO,CAAC,GAAG,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACxF;AAEA,SAAS,gBAAgB,GAAA,EAAmB;AAC1C,EAAA,IAAI,QAAQ,aAAA,EAAe;AAC3B,EAAA,IAAI,QAAQ,sBAAA,EAAwB;AAClC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,0FAAA,EACe,sBAAsB,CAAA,MAAA,EAAS,GAAG,CAAA,EAAA;AAAA,KACnD;AAAA,EACF;AACF;AAGA,eAAe,QAAA,GAA+D;AAC5E,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,OAAO,aAAkB,CAAA;AACpD,EAAA,MAAM,EAAE,aAAA,EAAe,aAAA,EAAc,GAAI,MAAM,OAAO,KAAU,CAAA;AAChE,EAAA,MAAM,IAAA,GAAO,MAAM,OAAO,MAAW,CAAA;AAErC,EAAA,MAAM,OAAO,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,gQAAe,CAAC,CAAA;AACxD,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,MAAM,QAAQ,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,oBAAoB,CAAA;AAC1D,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,gBAAgB,CAAA;AACtD,EAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,QAAQ,CAAA;AAGnC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAA,CAAI,UAAU,CAAA;AAC3C,EAAA,KAAA,CAAM,IAAI,GAAG,CAAA;AACb,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,CAAc,QAAQ,CAAA,CAAE,MAAM,KAAA,EAAM;AACzD;AAIA,eAAe,WAAA,GAAkE;AAC/E,EAAA,MAAM,QAAA,GACJ,QAAQ,OAAA,IAAW,IAAI,IAAI,0BAAA,EAA4B,gQAAe,CAAA,CAAE,IAAA;AAC1E,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,KAAA,GAAQ,OAAA,CAAQ,SAAA;AAAA,EAClB,CAAA,MAAO;AACL,IAAA,MAAM,OAAA,GACJ,QAAQ,OAAA,IAAW,IAAI,IAAI,8BAAA,EAAgC,gQAAe,CAAA,CAAE,IAAA;AAC9E,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,OAAO,CAAA;AAC/B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAC3E,IAAA,KAAA,GAAQ,MAAM,IAAI,WAAA,EAAY;AAAA,EAChC;AACA,EAAA,OAAO,EAAE,UAAU,KAAA,EAAM;AAC3B;AAMO,SAAS,iBAAA,GAA4C;AAC1D,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAA,GAAA,CAAU,YAAY;AACpB,IAAA,MAAM,EAAE,UAAU,KAAA,EAAM,GAAI,SAAS,MAAM,QAAA,EAAS,GAAI,MAAM,WAAA,EAAY;AAC1E,IAAA,eAAA,CAAgB,MAAM,SAAA,CAAU,KAAK,CAAC,CAAA;AACtC,IAAA,MAAM,MAAO,MAAM;AAAA;AAAA,MAA0B;AAAA,KAAA;AAI7C,IAAA,MAAM,GAAA,CAAI,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAO,CAAA;AAC3C,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,GAAG,CAAE,KAAA,CAAM,CAAC,CAAA,KAAM;AAChB,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,MAAM,CAAA;AAAA,EACR,CAAC,CAAA;AACD,EAAA,OAAO,MAAA;AACT;;;ACnHA,IAAM,MAAA,GACJ,0FAAA;AASK,SAAS,SAAS,GAAA,EAAwB;AAC/C,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,GAAA,IAAO,EAAE,EAAE,IAAA,EAAK;AACjC,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA;AACvB,EAAA,IAAI,CAAC,CAAA,EAAG;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAA,CAAE,CAAC,CAAA,CAAG,WAAA,EAAY;AAAA,IAC3B,IAAA,EAAM,EAAE,CAAC,CAAA,GAAI,EAAE,CAAC,CAAA,CAAE,aAAY,GAAI,IAAA;AAAA,IAClC,WAAA,EAAa,EAAE,CAAC,CAAA;AAAA,IAChB,IAAA,EAAM,EAAE,CAAC,CAAA,GAAI,EAAE,CAAC,CAAA,CAAE,aAAY,GAAI;AAAA,GACpC;AACF;AAGO,SAAS,MAAM,GAAA,EAAsB;AAC1C,EAAA,IAAI;AACF,IAAA,QAAA,CAAS,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAQO,SAAS,cAAA,CAAe,SAAiB,WAAA,EAA6B;AAC3E,EAAA,MAAM,GAAA,GAAM,WAAA,IAAe,WAAA,CAAY,MAAA,GAAS,IAAI,WAAA,GAAc,YAAA;AAClE,EAAA,OAAO,CAAA,aAAA,EAAgB,OAAA,CAAQ,WAAA,EAAa,IAAI,GAAG,CAAA,CAAA;AACrD;AAOO,SAAS,sBAAA,CACd,OAAA,EACA,IAAA,EACA,WAAA,EACQ;AACR,EAAA,MAAM,GAAA,GAAM,WAAA,IAAe,WAAA,CAAY,MAAA,GAAS,IAAI,WAAA,GAAc,YAAA;AAClE,EAAA,OAAO,CAAA,aAAA,EAAgB,QAAQ,WAAA,EAAa,IAAI,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA;AAC3E;;;ACjEO,IAAM,WAAA,GAAc;AAI3B,IAAM,eAAA,GAAkB,IAAI,IAAA,GAAO,IAAA;AAqBnC,SAAS,WAAW,GAAA,EAAyB;AAE3C,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAK,GAAG,CAAA;AACpB,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAI,UAAA,CAAY,UAAA,CAAmB,OAAO,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAC,CAAA;AACtE;AAcO,IAAM,YAAN,MAAgB;AAAA,EAIrB,WAAA,CAAY,OAAA,GAA4B,EAAC,EAAG;AAC1C,IAAA,IAAA,CAAK,GAAA,GAAM,QAAQ,GAAA,IAAO,WAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GACH,OAAA,CAAQ,KAAA,KACP,OAAO,KAAA,KAAU,aAAa,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA,GAAI,cAAA,EAAe,CAAA;AAAA,EAC3E;AAAA;AAAA,EAGA,MAAM,IAAA,GAA+B;AACnC,IAAA,OAAO,iBAAA,EAAkB;AAAA,EAC3B;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,OAAA,EAAiB,WAAA,EAAsC;AACxE,IAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,IAAA,EAAK,EAAG,YAAA,CAAa,SAAS,WAAW,CAAA;AAAA,EAC9D;AAAA;AAAA,EAGA,MAAM,SAAA,CACJ,OAAA,EACA,WAAA,EACA,IAAA,EACiB;AACjB,IAAA,OAAA,CAAQ,MAAM,KAAK,IAAA,EAAK,EAAG,UAAU,OAAA,EAAS,WAAA,EAAa,QAAQ,MAAS,CAAA;AAAA,EAC9E;AAAA;AAAA,EAGA,MAAM,eAAA,CACJ,UAAA,EACA,KAAA,EACA,IAAA,EACkB;AAClB,IAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,IAAA,IAAQ,eAAA,CAAgB,UAAA,EAAY,OAAO,IAAI,CAAA;AAAA,EACpE;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,OAAA,EAAiB,WAAA,EAAsC;AAC1E,IAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,IAAA,EAAK,EAAG,cAAA,CAAe,SAAS,WAAW,CAAA;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,KAAA,EAAgE;AAClF,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AACjC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,IAAA,IAAQ,MAAA,CAAO,IAAA,IAAQ,MAAA;AAC7C,IAAA,OAAO;AAAA,MACL,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,aAAa,MAAA,CAAO,WAAA;AAAA,MACpB,MAAM,OAAA,IAAW,IAAA;AAAA,MACjB,cAAc,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,OAAA,EAAS,OAAO,WAAW,CAAA;AAAA,MAClE,eAAe,IAAA,CAAK,SAAA,CAAU,OAAO,OAAA,EAAS,MAAA,CAAO,aAAa,OAAO;AAAA,KAC3E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,IAAA,CACJ,KAAA,EACA,IAAA,GAAoB,EAAC,EACA;AACrB,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,IAAA,IAAQ,MAAA,CAAO,IAAA,IAAQ,IAAA;AAC7C,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,IAAA,IAAQ,MAAA,CAAO,IAAA,IAAQ,IAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,MACV,EAAE,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,WAAA,EAAa,OAAO,WAAA,EAAa,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,OAAA,EAAQ;AAAA,MACzF;AAAA,KACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,QAAA,CACJ,KAAA,EACA,IAAA,GAAoB,EAAC,EACJ;AACjB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,IAAA,CAAK,OAAO,IAAI,CAAA;AACrC,IAAA,IAAI,CAAC,EAAE,SAAA,EAAW;AAChB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,EAAE,KAAK,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,GAAoB,EAAC,EACA;AACrB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA;AAC7B,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAC7B,IAAA,MAAM,KAAK,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,OAAA,EAAS,MAAM,WAAW,CAAA;AAC7D,IAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAO,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,eAAA;AAAA,MAClD,KAAA,CAAM,OAAA;AAAA,MACN,EAAA;AAAA,MACA,KAAA,CAAM,IAAA;AAAA,MACN;AAAA,KACF;AACA,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,CAAC,CAAC,IAAA,CAAK,gBAAgB,UAAA,EAAY,KAAA,EAAO,MAAM,IAAI,CAAA;AAAA,IACjE,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,KAAA;AAAA,IACb;AACA,IAAA,MAAM,MAAA,GAAS,KAAK,SAAA,CAAU,KAAA,CAAM,SAAS,KAAA,CAAM,WAAA,EAAa,KAAA,CAAM,IAAA,IAAQ,MAAS,CAAA;AACvF,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,qBAAA,CAAsB,IAAA,EAAM,MAAA,EAAQ,YAAY,SAAS,CAAA;AACvE,MAAA,OAAO;AAAA,QACL,SAAS,KAAA,CAAM,OAAA;AAAA,QACf,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,aAAa,KAAA,CAAM,WAAA;AAAA,QACnB,IAAA,EAAM,MAAM,IAAA,IAAQ,IAAA;AAAA,QACpB,KAAA;AAAA,QACA,QAAA;AAAA,QACA,SAAA,EAAW;AAAA,OACb;AAAA,IACF,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO;AAAA,QACL,SAAS,KAAA,CAAM,OAAA;AAAA,QACf,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,aAAa,KAAA,CAAM,WAAA;AAAA,QACnB,IAAA,EAAM,MAAM,IAAA,IAAQ,IAAA;AAAA,QACpB,KAAA,EAAO,UAAA;AAAA,QACP,QAAA;AAAA,QACA,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAc,eAAA,CACZ,OAAA,EACA,EAAA,EACA,MACA,GAAA,EACgF;AAChF,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,IAAI,KAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI,GAAA,GAAyB,IAAA;AAC7B,IAAA,IAAI,KAAA,GAAQ,EAAA;AACZ,IAAA,IAAI,SAAA,GAA6B,IAAA;AACjC,IAAA,WAAS;AACP,MAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,OAAA,CAA0B,KAAK,gBAAA,EAAkB;AAAA,QACpE,QAAA,EAAU,OAAA;AAAA,QACV,IAAA;AAAA,QACA,aAAA,EAAe,EAAA;AAAA,QACf,MAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAChF,MAAA,IAAI,UAAU,IAAA,EAAM;AAClB,QAAA,KAAA,GAAQ,EAAE,YAAA,KAAiB,CAAA;AAC3B,QAAA,GAAA,GAAM,IAAI,WAAW,KAAK,CAAA;AAAA,MAC5B;AACA,MAAA,IAAI,cAAc,IAAA,IAAQ,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,UAAU,CAAA,EAAG;AACrD,QAAA,SAAA,GAAY,EAAE,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,KAAM,MAAM,CAAC,CAAA;AAAA,MAC7C;AACA,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA;AAC3C,MAAA,MAAM,EAAA,GAAK,EAAE,MAAA,KAAW,CAAA;AACxB,MAAA,GAAA,CAAK,IAAI,KAAA,CAAM,QAAA,CAAS,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,QAAQ,KAAA,GAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;AAC/E,MAAA,IAAI,CAAA,CAAE,eAAA,EAAiB,KAAA,GAAQ,CAAA,CAAE,eAAA;AACjC,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,WAAA,IAAe,IAAA,EAAM;AACzC,MAAA,MAAA,GAAS,EAAE,WAAA,KAAgB,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,EAAE,YAAY,GAAA,IAAO,IAAI,WAAW,CAAC,CAAA,EAAG,OAAO,SAAA,EAAU;AAAA,EAClE;AAAA;AAAA,EAGA,MAAc,OAAA,CAAW,GAAA,EAAa,MAAA,EAAgB,MAAA,EAAoC;AACxF,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK;AAAA,QAC9B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,QAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,OAAO,EAAA,EAAI,CAAA,EAAG,MAAA,EAAQ,MAAA,EAAQ;AAAA,OAC/D,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,MAAM,2EAA2E,CAAA;AAAA,IAC7F;AACA,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,MAAM,CAAA,SAAA,EAAY,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACvE,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,MAAM,CAAA,EAAA,EAAK,IAAA,CAAK,KAAA,CAAM,OAAA,IAAW,OAAO,CAAA,CAAE,CAAA;AAC7F,IAAA,OAAO,IAAA,GAAQ,IAAA,CAAK,MAAA,IAAU,IAAA,GAAQ,IAAA;AAAA,EACxC;AACF;AAKA,SAAS,qBAAA,CACP,IAAA,EACA,MAAA,EACA,UAAA,EACA,SAAA,EACY;AACZ,EAAA,MAAM,OAAO,SAAA,IAAa,SAAA,CAAU,SAAS,SAAA,GAAY,CAAC,WAAW,MAAM,CAAA;AAC3E,EAAA,MAAM,KAAA,GAAQ,KAAK,MAAA,CAAO,CAAC,GAAG,CAAA,KAAM,CAAA,GAAI,GAAG,CAAC,CAAA;AAC5C,EAAA,IAAI,KAAA,KAAU,WAAW,MAAA,EAAQ;AAC/B,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,SAAU,IAAA,CAAK,YAAA,CAAa,QAAQ,UAAU,CAAA;AAClE,EAAA,MAAM,QAAsB,EAAC;AAC7B,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa,MAAA,EAAQ,UAAA,CAAW,SAAS,CAAA,EAAG,CAAA,GAAI,GAAG,CAAC,CAAC,CAAA;AACrE,IAAA,CAAA,IAAK,GAAA;AAAA,EACP;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAC,CAAA;AAClE,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,GAAA,CAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AACf,IAAA,CAAA,IAAK,IAAA,CAAK,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,cAAA,GAA+B;AACtC,EAAA,QAAQ,MAAM;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF,CAAA;AACF","file":"dig-client.cjs","sourcesContent":["// Cross-target loader for the vendored `dig_client` read-crypto WASM.\n//\n// The wasm is the SAME artifact the DIG Browser, extension, companion, and hub all run — vendored\n// under vendor/ with a PROVENANCE note and pinned SRI (see vendor/PROVENANCE.md). We NEVER run it\n// unverified: we obtain the raw bytes, SHA-256 them, compare against the pinned digest, and only\n// then hand the verified bytes to wasm-bindgen's init. A mismatch (tampered / wrong artifact)\n// throws — the reader FAILS CLOSED rather than running unverified crypto.\n//\n// Three runtimes are supported, auto-detected, with an escape hatch (`configureWasm`):\n//   • Node / Bun        — read vendor/ files from the package directory (fs + node:crypto).\n//   • Browser (bundled)  — the consumer's bundler can resolve the vendor files; if it can't, the\n//                         consumer supplies bytes via `configureWasm({ wasmBytes, glueUrl })`.\n//   • Browser (no bundler) — `configureWasm` with a URL/bytes you serve yourself.\n//\n// Memoized: the wasm initializes at most once per process/page.\n\nimport type { DigClientWasm } from \"./wasm.js\";\n\n/** SHA-256 (lowercase hex) of vendor/dig_client_bg.wasm — the SRI digest. Fail closed on mismatch. */\nexport const DIG_CLIENT_WASM_SHA256 =\n  \"ff486be806f908a2a90780e499a04dbd34e10e3b97be0470cb9ee841a1e49e77\";\n\n/** Optional explicit wasm inputs, for environments where auto-resolution can't find vendor/. */\nexport interface WasmConfig {\n  /**\n   * The wasm bytes (already loaded). When provided, SRI is still enforced unless `skipIntegrity`.\n   * Pass this in CSP-strict browsers where you fetch + verify the bytes yourself.\n   */\n  wasmBytes?: BufferSource;\n  /**\n   * URL to the wasm-bindgen glue module (vendor/dig_client.mjs) for browser dynamic import. When\n   * omitted in a browser, the loader tries to import the glue relative to this module.\n   */\n  glueUrl?: string;\n  /**\n   * URL to fetch the wasm bytes from (browser) when `wasmBytes` is not supplied. The fetched bytes\n   * are SRI-verified before init.\n   */\n  wasmUrl?: string;\n  /** Skip the SRI check. Only for tests / trusted custom builds — NOT recommended. */\n  skipIntegrity?: boolean;\n}\n\nlet _config: WasmConfig = {};\nlet _ready: Promise<DigClientWasm> | null = null;\n\n/**\n * Override how the read-crypto wasm is located/loaded. Call BEFORE the first `DigClient` read.\n * Mainly for browsers without a bundler that resolves package files, or CSP-strict apps that fetch\n * + verify the wasm bytes themselves and hand them in. Resets any cached instance.\n */\nexport function configureWasm(config: WasmConfig): void {\n  _config = { ...config };\n  _ready = null;\n}\n\nconst isNode =\n  typeof process !== \"undefined\" &&\n  !!(process as { versions?: { node?: string } }).versions?.node;\n\n/** SHA-256 a buffer to lowercase hex, using node:crypto or WebCrypto. */\nasync function sha256Hex(bytes: BufferSource): Promise<string> {\n  if (isNode) {\n    const { createHash } = await import(\"node:crypto\");\n    const view =\n      bytes instanceof ArrayBuffer\n        ? new Uint8Array(bytes)\n        : new Uint8Array(\n            (bytes as ArrayBufferView).buffer,\n            (bytes as ArrayBufferView).byteOffset,\n            (bytes as ArrayBufferView).byteLength,\n          );\n    return createHash(\"sha256\").update(view).digest(\"hex\");\n  }\n  const digest = await crypto.subtle.digest(\"SHA-256\", bytes as BufferSource);\n  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction assertIntegrity(hex: string): void {\n  if (_config.skipIntegrity) return;\n  if (hex !== DIG_CLIENT_WASM_SHA256) {\n    throw new Error(\n      \"dig-client wasm integrity check failed — refusing to run unverified crypto \" +\n        `(expected ${DIG_CLIENT_WASM_SHA256}, got ${hex}).`,\n    );\n  }\n}\n\n// Read the vendored glue URL + wasm bytes for Node from the package's vendor/ directory.\nasync function loadNode(): Promise<{ glueHref: string; bytes: BufferSource }> {\n  const { readFile } = await import(\"node:fs/promises\");\n  const { fileURLToPath, pathToFileURL } = await import(\"node:url\");\n  const path = await import(\"node:path\");\n  // This module lives in dist/; vendor/ sits at the package root, one level up.\n  const here = path.dirname(fileURLToPath(import.meta.url));\n  const vendorDir = path.resolve(here, \"..\", \"vendor\");\n  const wasmPath = path.join(vendorDir, \"dig_client_bg.wasm\");\n  const gluePath = path.join(vendorDir, \"dig_client.mjs\");\n  const buf = await readFile(wasmPath);\n  // Copy into a fresh ArrayBuffer-backed view so the type is a plain BufferSource (not the\n  // ArrayBufferLike/SharedArrayBuffer union the Node Buffer type widens to).\n  const bytes = new Uint8Array(buf.byteLength);\n  bytes.set(buf);\n  return { glueHref: pathToFileURL(gluePath).href, bytes };\n}\n\n// Resolve the glue URL + wasm bytes for a browser. Prefers explicit config; otherwise resolves\n// the vendored files relative to this module (works when the bundler copies vendor/ alongside).\nasync function loadBrowser(): Promise<{ glueHref: string; bytes: BufferSource }> {\n  const glueHref =\n    _config.glueUrl ?? new URL(\"../vendor/dig_client.mjs\", import.meta.url).href;\n  let bytes: BufferSource;\n  if (_config.wasmBytes) {\n    bytes = _config.wasmBytes;\n  } else {\n    const wasmUrl =\n      _config.wasmUrl ?? new URL(\"../vendor/dig_client_bg.wasm\", import.meta.url).href;\n    const res = await fetch(wasmUrl);\n    if (!res.ok) throw new Error(`dig-client wasm fetch failed (${res.status})`);\n    bytes = await res.arrayBuffer();\n  }\n  return { glueHref, bytes };\n}\n\n/**\n * Load, SRI-verify, and instantiate the read-crypto wasm, returning its functions. Memoized — at\n * most one init per process/page. Fails closed on an integrity mismatch.\n */\nexport function loadDigClientWasm(): Promise<DigClientWasm> {\n  if (_ready) return _ready;\n  _ready = (async () => {\n    const { glueHref, bytes } = isNode ? await loadNode() : await loadBrowser();\n    assertIntegrity(await sha256Hex(bytes));\n    const mod = (await import(/* @vite-ignore */ glueHref)) as {\n      default: (input: { module_or_path: BufferSource }) => Promise<unknown>;\n    } & Partial<DigClientWasm>;\n    // wasm-bindgen default export = async init; accepts raw bytes via { module_or_path }.\n    await mod.default({ module_or_path: bytes });\n    return mod as unknown as DigClientWasm;\n  })().catch((e) => {\n    _ready = null; // allow a retry on transient load failure\n    throw e;\n  });\n  return _ready;\n}\n","// DIG URN parsing + canonicalization — PURE, dependency-free, and identical to the parser the\n// hub (apps/web/lib/dig-client.js), the extension, and the companion use. Kept pure (no wasm) so\n// it is trivially unit-testable under `node --test` and usable on any runtime.\n//\n// A DIG URN addresses one resource inside a store:\n//\n//     urn:dig:chia:<store_id>[:<root>]/<resource_key>[?salt=<hex>]\n//\n//   • <store_id>   — 64 hex chars, the singleton launcher id (the store identity).\n//   • :<root>      — OPTIONAL 64 hex chars, pins a specific on-chain generation. Omit for the\n//                    canonical, root-INDEPENDENT form. The root is only the trust anchor for\n//                    inclusion verification; it is NOT a key input (retrieval/decryption keys are\n//                    root-independent).\n//   • <resource_key> — the path within the store (e.g. \"index.html\", \"img/logo.png\"). An empty\n//                    key resolves to the §8.5 default view \"index.html\".\n//   • ?salt=<hex>  — OPTIONAL out-of-band secret salt for a PRIVATE store.\n\n/** The parts of a parsed DIG URN. `root`/`salt` are null when absent. */\nexport interface ParsedUrn {\n  /** Store identity (64-hex launcher id), lowercased. */\n  readonly storeId: string;\n  /** Generation root (64-hex), lowercased — or null for the root-independent form. */\n  readonly root: string | null;\n  /** Resource path within the store (verbatim, not lowercased). */\n  readonly resourceKey: string;\n  /** Private-store secret salt (hex), lowercased — or null for a public store. */\n  readonly salt: string | null;\n}\n\nconst URN_RE =\n  /^urn:dig:chia:([0-9a-fA-F]{64})(?::([0-9a-fA-F]{64}))?\\/(.+?)(?:\\?salt=([0-9a-fA-F]+))?$/;\n\n/**\n * Parse a DIG URN into its parts. Throws on a malformed URN.\n *\n * @example\n * parseUrn(\"urn:dig:chia:\" + \"ab\".repeat(32) + \"/index.html\")\n * // → { storeId: \"abab…\", root: null, resourceKey: \"index.html\", salt: null }\n */\nexport function parseUrn(raw: string): ParsedUrn {\n  const s = String(raw ?? \"\").trim();\n  const m = URN_RE.exec(s);\n  if (!m) {\n    throw new Error(\n      \"Not a valid dig URN (expected urn:dig:chia:<store-id>[:<root>]/<path>[?salt=<hex>]).\",\n    );\n  }\n  return {\n    storeId: m[1]!.toLowerCase(),\n    root: m[2] ? m[2].toLowerCase() : null,\n    resourceKey: m[3]!,\n    salt: m[4] ? m[4].toLowerCase() : null,\n  };\n}\n\n/** True iff `raw` is a syntactically valid DIG URN. Never throws. */\nexport function isUrn(raw: string): boolean {\n  try {\n    parseUrn(raw);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Reconstruct the canonical, root-INDEPENDENT URN string for a store + resource key:\n * `urn:dig:chia:<store_id>/<resource_key>`. An empty resource key resolves to the default view\n * `index.html`. This is the form whose SHA-256 is the retrieval key and whose bytes seed the AES\n * key — matching the wasm's `reconstructUrn`.\n */\nexport function reconstructUrn(storeId: string, resourceKey: string): string {\n  const key = resourceKey && resourceKey.length > 0 ? resourceKey : \"index.html\";\n  return `urn:dig:chia:${storeId.toLowerCase()}/${key}`;\n}\n\n/**\n * Reconstruct a root-PINNED display URN: `urn:dig:chia:<store_id>:<root>/<resource_key>`. Useful\n * for sharing a URN bound to a specific generation; the retrieval/AES keys still use the rootless\n * form (`reconstructUrn`).\n */\nexport function reconstructUrnWithRoot(\n  storeId: string,\n  root: string,\n  resourceKey: string,\n): string {\n  const key = resourceKey && resourceKey.length > 0 ? resourceKey : \"index.html\";\n  return `urn:dig:chia:${storeId.toLowerCase()}:${root.toLowerCase()}/${key}`;\n}\n","// DigClient — the read side of the SDK. It fetches a resource's served ciphertext from the dig RPC,\n// derives the URN's keys CLIENT-SIDE via the read-crypto wasm, verifies inclusion against an\n// on-chain root, and decrypts — so the serving host stays BLIND (it only ever relays opaque\n// ciphertext + proofs). Genericized from hub.dig.net/apps/web/lib/dig-client.js, with the hub-app\n// coupling removed (no Vite import.meta.env, no window.location origin; the RPC endpoint and the\n// trust root are explicit inputs).\n//\n// HARD BOUNDARY (read sources). Everything read from a .dig — ciphertext, inclusion proofs, the\n// public manifest, metadata — comes ONLY from the dig RPC. The trust ROOT it is verified against\n// comes from the chain (the caller resolves it from coinset.org and passes it in). The host can\n// never become the trust anchor: every content read REQUIRES a caller-supplied root.\n//\n// OBLIVIOUS model. The host returns indistinguishable ciphertext for any retrieval key, so\n// presence is UNKNOWABLE. A read therefore NEVER concludes \"not found\": it returns plaintext when\n// the URN key decrypts the bytes, otherwise the raw ciphertext (a decoy is just opaque bytes). The\n// only thrown error is a transport failure.\n\nimport { loadDigClientWasm } from \"./loader.js\";\nimport type { DigClientWasm } from \"./wasm.js\";\nimport { parseUrn } from \"./urn.js\";\nimport type { ReadOptions, ReadResult, UrnKeys } from \"./types.js\";\n\n/** The default public dig RPC endpoint. */\nexport const DEFAULT_RPC = \"https://rpc.dig.net\";\n\n// The backend caps each dig.getContent chunk at 3 MiB (Lambda/APIGW response ceiling); the client\n// loops chunks until `complete`.\nconst RPC_CHUNK_BYTES = 3 * 1024 * 1024;\n\n/** Options to construct a DigClient. */\nexport interface DigClientOptions {\n  /** dig RPC endpoint. Defaults to the public `https://rpc.dig.net`. */\n  rpc?: string;\n  /** Override `fetch` (e.g. an instrumented one). Defaults to the global `fetch`. */\n  fetch?: typeof fetch;\n}\n\ninterface GetContentResult {\n  total_length: number;\n  offset: number;\n  next_offset?: number | null;\n  complete?: boolean;\n  ciphertext?: string;\n  inclusion_proof?: string;\n  chunk_lens?: number[];\n}\n\n/** Decode a standard-base64 string (the RPC ciphertext encoding) to bytes — no DOM dependency. */\nfunction b64ToBytes(b64: string): Uint8Array {\n  // atob exists in browsers and modern Node; fall back to Buffer in older Node.\n  if (typeof atob === \"function\") {\n    const bin = atob(b64);\n    const out = new Uint8Array(bin.length);\n    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n    return out;\n  }\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  return new Uint8Array((globalThis as any).Buffer.from(b64, \"base64\"));\n}\n\n/**\n * The read-crypto client. Construct once and reuse — the wasm is loaded + SRI-verified lazily on\n * the first read and memoized process/page-wide.\n *\n * @example\n * const dig = new DigClient();\n * const { bytes, decrypted } = await dig.read({\n *   urn: \"urn:dig:chia:<storeId>/index.html\",\n *   root: \"<onchain-root-hex>\",\n * });\n * if (decrypted) console.log(new TextDecoder().decode(bytes));\n */\nexport class DigClient {\n  private readonly rpc: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(options: DigClientOptions = {}) {\n    this.rpc = options.rpc ?? DEFAULT_RPC;\n    this.fetchImpl =\n      options.fetch ??\n      (typeof fetch === \"function\" ? fetch.bind(globalThis) : undefinedFetch());\n  }\n\n  /** Load (and SRI-verify) the read-crypto wasm. Exposed for callers that want the raw functions. */\n  async wasm(): Promise<DigClientWasm> {\n    return loadDigClientWasm();\n  }\n\n  /** `retrieval_key = SHA-256(canonical rootless URN)`, lowercase hex. */\n  async retrievalKey(storeId: string, resourceKey: string): Promise<string> {\n    return (await this.wasm()).retrievalKey(storeId, resourceKey);\n  }\n\n  /** Derive the per-URN AES-256-GCM-SIV key, lowercase hex. `salt` for a private store. */\n  async deriveKey(\n    storeId: string,\n    resourceKey: string,\n    salt?: string | null,\n  ): Promise<string> {\n    return (await this.wasm()).deriveKey(storeId, resourceKey, salt ?? undefined);\n  }\n\n  /** Verify served `ciphertext` is included under `root` via the base64 merkle `proof`. */\n  async verifyInclusion(\n    ciphertext: Uint8Array,\n    proof: string,\n    root: string,\n  ): Promise<boolean> {\n    return (await this.wasm()).verifyInclusion(ciphertext, proof, root);\n  }\n\n  /** Reconstruct the canonical rootless URN whose SHA-256 is the retrieval key. */\n  async reconstructUrn(storeId: string, resourceKey: string): Promise<string> {\n    return (await this.wasm()).reconstructUrn(storeId, resourceKey);\n  }\n\n  /**\n   * Derive, client-side, the two root-independent keys a URN maps to (retrieval + decryption).\n   * Nothing is sent to the network — pure local derivation via the wasm.\n   */\n  async deriveUrnKeys(input: { urn: string; salt?: string | null }): Promise<UrnKeys> {\n    const parsed = parseUrn(input.urn);\n    const wasm = await this.wasm();\n    const effSalt = input.salt ?? parsed.salt ?? undefined;\n    return {\n      storeId: parsed.storeId,\n      root: parsed.root,\n      resourceKey: parsed.resourceKey,\n      salt: effSalt ?? null,\n      retrievalKey: wasm.retrievalKey(parsed.storeId, parsed.resourceKey),\n      decryptionKey: wasm.deriveKey(parsed.storeId, parsed.resourceKey, effSalt),\n    };\n  }\n\n  /**\n   * Fetch + verify + decrypt one resource by URN. `root` is the on-chain generation root to verify\n   * against (resolved by the caller from the chain); when omitted, the root embedded in the URN is\n   * used. Returns the bytes plus advisory `verified`/`decrypted` flags. NEVER throws \"not found\"\n   * (presence is unknowable) — it throws only on a transport failure.\n   */\n  async read(\n    input: { urn: string; root?: string | null; salt?: string | null },\n    opts: ReadOptions = {},\n  ): Promise<ReadResult> {\n    const parsed = parseUrn(input.urn);\n    const effSalt = input.salt ?? parsed.salt ?? null;\n    const effRoot = input.root ?? parsed.root ?? null;\n    if (!effRoot) {\n      throw new Error(\n        \"a confirmed on-chain root is required to read content (pass { root } or use a root-pinned URN)\",\n      );\n    }\n    return this.readResource(\n      { storeId: parsed.storeId, resourceKey: parsed.resourceKey, root: effRoot, salt: effSalt },\n      opts,\n    );\n  }\n\n  /** As `read`, but decoding the plaintext to a UTF-8 string when it decrypts (else throws). */\n  async readText(\n    input: { urn: string; root?: string | null; salt?: string | null },\n    opts: ReadOptions = {},\n  ): Promise<string> {\n    const r = await this.read(input, opts);\n    if (!r.decrypted) {\n      throw new Error(\n        \"resource did not decrypt under this URN — wrong store/key/salt, or a decoy response\",\n      );\n    }\n    return new TextDecoder().decode(r.bytes);\n  }\n\n  /**\n   * Read by explicit (storeId, resourceKey, root, salt) rather than a URN string. The oblivious\n   * download primitive the URN read is built on.\n   */\n  async readResource(\n    input: { storeId: string; resourceKey: string; root: string; salt?: string | null },\n    opts: ReadOptions = {},\n  ): Promise<ReadResult> {\n    const rpc = opts.rpc ?? this.rpc;\n    const wasm = await this.wasm();\n    const rk = wasm.retrievalKey(input.storeId, input.resourceKey);\n    const { ciphertext, proof, chunkLens } = await this.fetchCiphertext(\n      input.storeId,\n      rk,\n      input.root,\n      rpc,\n    );\n    let verified = false;\n    try {\n      verified = !!wasm.verifyInclusion(ciphertext, proof, input.root);\n    } catch {\n      verified = false;\n    }\n    const keyHex = wasm.deriveKey(input.storeId, input.resourceKey, input.salt ?? undefined);\n    try {\n      const bytes = decryptResourceChunks(wasm, keyHex, ciphertext, chunkLens);\n      return {\n        storeId: input.storeId,\n        root: input.root,\n        resourceKey: input.resourceKey,\n        salt: input.salt ?? null,\n        bytes,\n        verified,\n        decrypted: true,\n      };\n    } catch {\n      // Not decryptable with this URN/salt — hand back the raw bytes; never a \"not present\" verdict.\n      return {\n        storeId: input.storeId,\n        root: input.root,\n        resourceKey: input.resourceKey,\n        salt: input.salt ?? null,\n        bytes: ciphertext,\n        verified,\n        decrypted: false,\n      };\n    }\n  }\n\n  // Stream the FULL ciphertext for a resource from the RPC by retrieval key, reassembling 3-MiB\n  // chunks. A null result is a TRANSPORT failure, never a presence judgment.\n  private async fetchCiphertext(\n    storeId: string,\n    rk: string,\n    root: string,\n    rpc: string,\n  ): Promise<{ ciphertext: Uint8Array; proof: string; chunkLens: number[] | null }> {\n    let offset = 0;\n    let total: number | null = null;\n    let buf: Uint8Array | null = null;\n    let proof = \"\";\n    let chunkLens: number[] | null = null;\n    for (;;) {\n      const r = await this.rpcCall<GetContentResult>(rpc, \"dig.getContent\", {\n        store_id: storeId,\n        root,\n        retrieval_key: rk,\n        offset,\n        length: RPC_CHUNK_BYTES,\n      });\n      if (!r) throw new Error(\"The content network returned no data for this request.\");\n      if (total === null) {\n        total = r.total_length >>> 0;\n        buf = new Uint8Array(total);\n      }\n      if (chunkLens === null && Array.isArray(r.chunk_lens)) {\n        chunkLens = r.chunk_lens.map((n) => n >>> 0);\n      }\n      const chunk = b64ToBytes(r.ciphertext ?? \"\");\n      const at = r.offset >>> 0;\n      buf!.set(chunk.subarray(0, Math.max(0, Math.min(chunk.length, total - at))), at);\n      if (r.inclusion_proof) proof = r.inclusion_proof;\n      if (r.complete || r.next_offset == null) break;\n      offset = r.next_offset >>> 0;\n    }\n    return { ciphertext: buf ?? new Uint8Array(0), proof, chunkLens };\n  }\n\n  // One JSON-RPC 2.0 call. Throws on transport failure or a JSON-RPC error; returns `result`.\n  private async rpcCall<T>(rpc: string, method: string, params: unknown): Promise<T | null> {\n    let res: Response;\n    try {\n      res = await this.fetchImpl(rpc, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method, params }),\n      });\n    } catch {\n      throw new Error(\"Could not reach the content network. Check your connection and try again.\");\n    }\n    if (!res.ok) throw new Error(`dig RPC ${method} failed (${res.status})`);\n    const json = (await res.json()) as { result?: T; error?: { message?: string } };\n    if (json && json.error) throw new Error(`dig RPC ${method}: ${json.error.message ?? \"error\"}`);\n    return json ? (json.result ?? null) : null;\n  }\n}\n\n// AES-256-GCM-SIV-open a resource's served ciphertext under `keyHex`, splitting the PLAIN-\n// concatenated chunk ciphertexts by `chunkLens` (per-chunk CIPHERTEXT byte lengths) and opening\n// each. Empty/absent chunkLens ⇒ single-chunk resource. Throws if any chunk's tag fails.\nfunction decryptResourceChunks(\n  wasm: DigClientWasm,\n  keyHex: string,\n  ciphertext: Uint8Array,\n  chunkLens: number[] | null,\n): Uint8Array {\n  const lens = chunkLens && chunkLens.length ? chunkLens : [ciphertext.length];\n  const total = lens.reduce((a, n) => a + n, 0);\n  if (total !== ciphertext.length) {\n    throw new Error(\"served ciphertext length does not match chunk lengths\");\n  }\n  if (lens.length === 1) return wasm.decryptChunk(keyHex, ciphertext);\n  const parts: Uint8Array[] = [];\n  let p = 0;\n  for (const len of lens) {\n    parts.push(wasm.decryptChunk(keyHex, ciphertext.subarray(p, p + len)));\n    p += len;\n  }\n  const out = new Uint8Array(parts.reduce((a, x) => a + x.length, 0));\n  let q = 0;\n  for (const part of parts) {\n    out.set(part, q);\n    q += part.length;\n  }\n  return out;\n}\n\nfunction undefinedFetch(): typeof fetch {\n  return (() => {\n    throw new Error(\n      \"No global fetch available. Pass { fetch } to DigClient (Node < 18 needs a fetch polyfill).\",\n    );\n  }) as unknown as typeof fetch;\n}\n"]}