@enbox/dwn-sdk-js 0.4.5 → 0.4.7

package/src/utils/grant-key-coverage.ts

@@ -0,0 +1,303 @@
+import type { PermissionScope, RecordsPermissionScope } from '../types/permission-types.js';
+import type { ProtocolDefinition, ProtocolRuleSet } from '../types/protocols-types.js';
+
+import { KeyDerivationScheme } from './hd-key.js';
+import { ProtocolAction } from '../types/protocols-types.js';
+import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
+import { getRuleSetAtPath, parseCrossProtocolRef } from './protocols.js';
+
+type GrantKeyRecordsScopeBase = RecordsPermissionScope & {
+  interface: typeof DwnInterfaceName.Records;
+  protocol: string;
+};
+
+export type GrantKeyRecordsScope = GrantKeyRecordsScopeBase & {
+  method: typeof DwnMethodName.Read | typeof DwnMethodName.Write;
+};
+
+export type GrantKeyReadRecordsScope = GrantKeyRecordsScopeBase & {
+  contextId?: undefined;
+  method: typeof DwnMethodName.Read;
+};
+
+export type GrantKeyWriteRecordsScope = GrantKeyRecordsScopeBase & {
+  contextId?: undefined;
+  method: typeof DwnMethodName.Write;
+};
+
+export type GrantKeyEligibleRecordsScope = GrantKeyReadRecordsScope | GrantKeyWriteRecordsScope;
+
+export type GrantKeyProtocolPathScope = {
+  scheme: typeof KeyDerivationScheme.ProtocolPath;
+  protocol: string;
+  protocolPath?: string;
+};
+
+type GrantKeyDeliveryScopeBuilder = (
+  grantScope: GrantKeyEligibleRecordsScope,
+  protocolDefinition?: ProtocolDefinition,
+) => GrantKeyProtocolPathScope[];
+
+type GrantKeyCoveragePredicate = (
+  input: {
+    grantScope: GrantKeyEligibleRecordsScope;
+    deliveredScope: Pick<GrantKeyProtocolPathScope, 'protocol' | 'protocolPath'>;
+    protocolDefinition?: ProtocolDefinition;
+  },
+) => boolean;
+
+const grantKeyRecordsMethods = new Set<string>([
+  DwnMethodName.Read,
+  DwnMethodName.Write,
+]);
+
+const grantKeyDeliveryScopeBuilders: Record<GrantKeyRecordsScope['method'], GrantKeyDeliveryScopeBuilder> = {
+  [DwnMethodName.Read]  : getReadGrantKeyDeliveryScopes,
+  [DwnMethodName.Write] : getWriteGrantKeyDeliveryScopes,
+};
+
+const grantKeyCoveragePredicates: Record<GrantKeyRecordsScope['method'], GrantKeyCoveragePredicate> = {
+  [DwnMethodName.Read]  : readGrantKeyScopeCoversDeliveredScope,
+  [DwnMethodName.Write] : writeGrantKeyScopeCoversDeliveredScope,
+};
+
+export function isGrantKeyRecordsScope(scope: PermissionScope): scope is GrantKeyRecordsScope {
+  const maybeProtocol = (scope as { protocol?: unknown }).protocol;
+  return [
+    scope.interface === DwnInterfaceName.Records,
+    grantKeyRecordsMethods.has(scope.method),
+    typeof maybeProtocol === 'string',
+  ].every(Boolean);
+}
+
+export function isGrantKeyEligibleRecordsScope(scope: PermissionScope): scope is GrantKeyEligibleRecordsScope {
+  return isGrantKeyRecordsScope(scope) &&
+    !('contextId' in scope && scope.contextId !== undefined);
+}
+
+export function getGrantKeyDeliveryScopes(
+  grantScope: GrantKeyReadRecordsScope,
+  protocolDefinition?: ProtocolDefinition,
+): GrantKeyProtocolPathScope[];
+
+export function getGrantKeyDeliveryScopes(
+  grantScope: GrantKeyWriteRecordsScope,
+  protocolDefinition: ProtocolDefinition,
+): GrantKeyProtocolPathScope[];
+
+export function getGrantKeyDeliveryScopes(
+  grantScope: GrantKeyEligibleRecordsScope,
+  protocolDefinition?: ProtocolDefinition,
+): GrantKeyProtocolPathScope[] {
+  return uniqueGrantKeyScopes(grantKeyDeliveryScopeBuilders[grantScope.method](grantScope, protocolDefinition));
+}
+
+export function grantKeyScopeCoversDeliveredScope(input: {
+  grantScope: GrantKeyEligibleRecordsScope;
+  deliveredScope: Pick<GrantKeyProtocolPathScope, 'protocol' | 'protocolPath'>;
+  protocolDefinition?: ProtocolDefinition;
+}): boolean {
+  const { grantScope, deliveredScope, protocolDefinition } = input;
+  if (grantScope.protocol !== deliveredScope.protocol) {
+    return false;
+  }
+
+  return grantKeyCoveragePredicates[grantScope.method]({ grantScope, deliveredScope, protocolDefinition });
+}
+
+function getReadGrantKeyDeliveryScopes(
+  grantScope: GrantKeyEligibleRecordsScope,
+  protocolDefinition?: ProtocolDefinition,
+): GrantKeyProtocolPathScope[] {
+  if (grantScope.protocolPath === undefined) {
+    return [createProtocolGrantKeyScope(grantScope.protocol)];
+  }
+
+  const scopes = [
+    createProtocolPathGrantKeyScope(grantScope.protocol, grantScope.protocolPath),
+  ];
+
+  if (protocolDefinition === undefined) {
+    return scopes;
+  }
+
+  for (const rolePath of getGrantKeyReadRolePathsForScope(protocolDefinition, grantScope.protocolPath)) {
+    scopes.push(createProtocolPathGrantKeyScope(grantScope.protocol, rolePath));
+  }
+
+  return scopes;
+}
+
+function getWriteGrantKeyDeliveryScopes(
+  grantScope: GrantKeyEligibleRecordsScope,
+  protocolDefinition?: ProtocolDefinition,
+): GrantKeyProtocolPathScope[] {
+  if (protocolDefinition === undefined) {
+    throw new Error('getGrantKeyDeliveryScopes: write grants require a protocol definition.');
+  }
+
+  return getGrantKeyRolePathsCoveredByScope(protocolDefinition, grantScope.protocolPath)
+    .map((rolePath) => createProtocolPathGrantKeyScope(grantScope.protocol, rolePath));
+}
+
+function createProtocolGrantKeyScope(protocol: string): GrantKeyProtocolPathScope {
+  return {
+    scheme: KeyDerivationScheme.ProtocolPath,
+    protocol,
+  };
+}
+
+function createProtocolPathGrantKeyScope(protocol: string, protocolPath: string): GrantKeyProtocolPathScope {
+  return {
+    scheme: KeyDerivationScheme.ProtocolPath,
+    protocol,
+    protocolPath,
+  };
+}
+
+function readGrantKeyScopeCoversDeliveredScope(input: {
+  grantScope: GrantKeyEligibleRecordsScope;
+  deliveredScope: Pick<GrantKeyProtocolPathScope, 'protocol' | 'protocolPath'>;
+  protocolDefinition?: ProtocolDefinition;
+}): boolean {
+  const { grantScope, deliveredScope, protocolDefinition } = input;
+  const grantProtocolPath = grantScope.protocolPath;
+  if (grantProtocolPath === undefined) {
+    return true;
+  }
+
+  const deliveredProtocolPath = deliveredScope.protocolPath;
+  if (deliveredProtocolPath === undefined) {
+    return false;
+  }
+
+  if (isBoundaryAwareSubtree(grantProtocolPath, deliveredProtocolPath)) {
+    return true;
+  }
+
+  if (protocolDefinition === undefined) {
+    return false;
+  }
+
+  return grantKeyReadScopeReferencesRolePath(protocolDefinition, grantProtocolPath, deliveredProtocolPath);
+}
+
+function writeGrantKeyScopeCoversDeliveredScope(input: {
+  grantScope: GrantKeyEligibleRecordsScope;
+  deliveredScope: Pick<GrantKeyProtocolPathScope, 'protocol' | 'protocolPath'>;
+  protocolDefinition?: ProtocolDefinition;
+}): boolean {
+  const { grantScope, deliveredScope, protocolDefinition } = input;
+  const deliveredProtocolPath = deliveredScope.protocolPath;
+  if (deliveredProtocolPath === undefined) {
+    return false;
+  }
+
+  if (protocolDefinition === undefined) {
+    return false;
+  }
+
+  if (!isGrantKeyLocalRolePath(protocolDefinition, deliveredProtocolPath)) {
+    return false;
+  }
+
+  const grantProtocolPath = grantScope.protocolPath;
+  if (grantProtocolPath === undefined) {
+    return true;
+  }
+
+  return isBoundaryAwareSubtree(grantProtocolPath, deliveredProtocolPath);
+}
+
+function getGrantKeyReadRolePathsForScope(protocolDefinition: ProtocolDefinition, scopeProtocolPath: string): string[] {
+  const scopedRuleSet = getRuleSetAtPath(scopeProtocolPath, protocolDefinition.structure);
+  if (scopedRuleSet === undefined) {
+    return [];
+  }
+
+  return [...collectReadRolePaths(protocolDefinition, scopedRuleSet)];
+}
+
+function grantKeyReadScopeReferencesRolePath(
+  protocolDefinition: ProtocolDefinition,
+  scopeProtocolPath: string,
+  rolePath: string,
+): boolean {
+  if (!isGrantKeyLocalRolePath(protocolDefinition, rolePath)) {
+    return false;
+  }
+
+  return getGrantKeyReadRolePathsForScope(protocolDefinition, scopeProtocolPath).includes(rolePath);
+}
+
+function collectReadRolePaths(protocolDefinition: ProtocolDefinition, ruleSet: ProtocolRuleSet): Set<string> {
+  const rolePaths = new Set<string>();
+
+  for (const actionRule of ruleSet.$actions ?? []) {
+    if (!actionRule.can.includes(ProtocolAction.Read) || actionRule.role === undefined || parseCrossProtocolRef(actionRule.role) !== undefined) {
+      continue;
+    }
+
+    if (isGrantKeyLocalRolePath(protocolDefinition, actionRule.role)) {
+      rolePaths.add(actionRule.role);
+    }
+  }
+
+  for (const [key, value] of Object.entries(ruleSet)) {
+    if (key.startsWith('$')) {
+      continue;
+    }
+    for (const rolePath of collectReadRolePaths(protocolDefinition, value as ProtocolRuleSet)) {
+      rolePaths.add(rolePath);
+    }
+  }
+
+  return rolePaths;
+}
+
+function getGrantKeyRolePathsCoveredByScope(protocolDefinition: ProtocolDefinition, scopeProtocolPath?: string): string[] {
+  return collectRolePaths(protocolDefinition, protocolDefinition.structure as ProtocolRuleSet)
+    .filter((rolePath) => scopeProtocolPath === undefined || isBoundaryAwareSubtree(scopeProtocolPath, rolePath));
+}
+
+function collectRolePaths(protocolDefinition: ProtocolDefinition, ruleSet: ProtocolRuleSet, parentPath: string[] = []): string[] {
+  const rolePaths: string[] = [];
+
+  for (const [key, value] of Object.entries(ruleSet)) {
+    if (key.startsWith('$')) {
+      continue;
+    }
+
+    const path = [...parentPath, key];
+    const protocolPath = path.join('/');
+    const childRuleSet = value as ProtocolRuleSet;
+    if (isGrantKeyLocalRolePath(protocolDefinition, protocolPath)) {
+      rolePaths.push(protocolPath);
+    }
+    rolePaths.push(...collectRolePaths(protocolDefinition, childRuleSet, path));
+  }
+
+  return rolePaths;
+}
+
+function isGrantKeyLocalRolePath(protocolDefinition: ProtocolDefinition, protocolPath: string): boolean {
+  const ruleSet = getRuleSetAtPath(protocolPath, protocolDefinition.structure);
+  return ruleSet?.$role === true && ruleSet.$keyAgreement !== undefined;
+}
+
+function isBoundaryAwareSubtree(scopePath: string, candidatePath: string): boolean {
+  return `${candidatePath}/`.startsWith(`${scopePath}/`);
+}
+
+function getGrantKeyScopeCacheKey(scope: GrantKeyProtocolPathScope): string {
+  return JSON.stringify([scope.protocol, scope.protocolPath]);
+}
+
+function uniqueGrantKeyScopes(scopes: GrantKeyProtocolPathScope[]): GrantKeyProtocolPathScope[] {
+  const deliveredScopes = new Map<string, GrantKeyProtocolPathScope>();
+  for (const scope of scopes) {
+    deliveredScopes.set(getGrantKeyScopeCacheKey(scope), scope);
+  }
+
+  return [...deliveredScopes.values()];
+}

package/src/utils/hd-key.ts

@@ -1,7 +1,6 @@
 import type { PrivateKeyJwk, PublicKeyJwk } from '../types/jose-types.js';
 
 import { Encoder } from './encoder.js';
-import { getWebcryptoSubtle } from '@noble/ciphers/webcrypto';
 import { X25519 } from '@enbox/crypto';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 
@@ -82,7 +81,7 @@ export class HdKey {
   }): Promise<Uint8Array> {
     const { hashAlgorithm, initialKeyMaterial, info, keyLengthInBytes } = params;
 
-    const webCrypto = getWebcryptoSubtle() as SubtleCrypto;
+    const webCrypto = globalThis.crypto.subtle;
 
     // Import the `initialKeyMaterial` into the Web Crypto API to use for the key derivation operation.
     const webCryptoKey = await webCrypto.importKey('raw', initialKeyMaterial as BufferSource, { name: 'HKDF' }, false, ['deriveBits']);

package/src/utils/jws.ts

@@ -3,13 +3,19 @@ import type { MessageSigner } from '../types/signer.js';
 import type { SignatureEntry } from '../types/jws-types.js';
 import type { KeyMaterial, PublicKeyJwk } from '../types/jose-types.js';
 
-import isPlainObject from 'lodash/isPlainObject.js';
-
 import { Encoder } from './encoder.js';
 import { PrivateKeySigner } from './private-key-signer.js';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 import { signatureAlgorithms, type SupportedCurve } from '../jose/algorithms/signing/signature-algorithms.js';
 
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== 'object' || value === null) {
+    return false;
+  }
+
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
 
 /**
  * Utility class for JWS related operations.

package/src/utils/memory-cache.ts

@@ -1,31 +1,62 @@
 import type { Cache } from '../types/cache.js';
-import { LRUCache } from 'lru-cache';
+
+type CacheEntry = {
+  expiresAt: number;
+  value: unknown;
+};
 
 /**
  * A cache using local memory.
  */
 export class MemoryCache implements Cache {
-  private readonly cache: LRUCache<string, any>;
+  private static readonly maxEntries = 100_000;
+
+  private readonly cache = new Map<string, CacheEntry>();
 
   /**
    * @param timeToLiveInSeconds time-to-live for every key-value pair set in the cache
    */
-  public constructor (private readonly timeToLiveInSeconds: number) {
-    this.cache = new LRUCache({
-      max : 100_000,
-      ttl : timeToLiveInSeconds * 1000
-    });
+  public constructor(private readonly timeToLiveInSeconds: number) {
   }
 
-  async set(key: string, value: any): Promise<void> {
+  public async set<T = unknown>(key: string, value: T): Promise<void> {
     try {
-      this.cache.set(key, value);
+      const entry = {
+        expiresAt : Date.now() + this.timeToLiveInSeconds * 1000,
+        value     : value,
+      };
+
+      this.cache.delete(key);
+      this.cache.set(key, entry);
+      this.evictOldestEntries();
     } catch {
       // let the code continue as this is a non-fatal error
     }
   }
 
-  async get(key: string): Promise<any | undefined> {
-    return this.cache.get(key);
+  public async get<T = unknown>(key: string): Promise<T | undefined> {
+    const entry = this.cache.get(key);
+    if (entry === undefined) {
+      return undefined;
+    }
+
+    if (Date.now() >= entry.expiresAt) {
+      this.cache.delete(key);
+      return undefined;
+    }
+
+    this.cache.delete(key);
+    this.cache.set(key, entry);
+    return entry.value as T;
+  }
+
+  private evictOldestEntries(): void {
+    while (this.cache.size > MemoryCache.maxEntries) {
+      const oldestKey = this.cache.keys().next().value;
+      if (oldestKey === undefined) {
+        return;
+      }
+      this.cache.delete(oldestKey);
+    }
   }
 }

package/src/utils/protocols.ts

@@ -52,6 +52,38 @@ export function getTypeName(protocolPath: string): string {
   return protocolPath.split('/').slice(-1)[0];
 }
 
+/**
+ * Computes the role-audience context id for a role path relative to a source record context id.
+ * Root-level role audiences use the empty string; nested role audiences use the ancestor
+ * context prefix at the same depth as the role parent.
+ */
+export function getRoleAudienceContextId(rolePath: string, contextId?: string): string | undefined {
+  const roleParentDepth = rolePath.split('/').length - 1;
+  if (roleParentDepth === 0) {
+    return '';
+  }
+
+  if (contextId === undefined) {
+    return undefined;
+  }
+
+  const contextSegments = contextId.split('/');
+  if (contextSegments.length < roleParentDepth) {
+    return undefined;
+  }
+
+  return contextSegments.slice(0, roleParentDepth).join('/');
+}
+
+/**
+ * Computes the context prefix used when querying for role records. Root-level
+ * role records are queried without a context prefix.
+ */
+export function getRoleContextPrefix(rolePath: string, contextId?: string): string | undefined {
+  const roleAudienceContextId = getRoleAudienceContextId(rolePath, contextId);
+  return roleAudienceContextId === '' ? undefined : roleAudienceContextId;
+}
+
 /**
  * Gets the rule set at a given protocol path within a protocol definition's structure tree.
  * Returns `undefined` if the path does not exist.

package/src/utils/record-limit-occupancy.ts

@@ -37,6 +37,13 @@ type RecordLimitFilterResolution = {
   projectedFilters: Filter[];
 };
 
+type OccupancyProjectionInput<T extends RecordsWriteMessage> = {
+  records: T[];
+  max: number;
+  getScopeKey(record: T): string;
+  compareRecords(left: T, right: T): number;
+};
+
 /**
  * Queries records with bounded `$recordLimit` occupancy projection when every limited filter targets one concrete scope.
  *
@@ -285,11 +292,12 @@ async function findOccupantRecordIds(input: {
     ...boundaryCandidates,
   ];
 
-  return new Set(
-    rankedCandidates
-      .slice(0, input.recordLimit.max)
-      .map((message): string => message.recordId)
-  );
+  return selectOccupantRecordIds({
+    records        : rankedCandidates,
+    max            : input.recordLimit.max,
+    getScopeKey    : (): string => '',
+    compareRecords : compareRecordLimitCandidates,
+  });
 }
 
 function buildRecordLimitScopeFilter(scope: RecordLimitScope): Filter {
@@ -375,3 +383,24 @@ function compareRecordLimitCandidates(left: RecordsWriteMessage, right: RecordsW
 
   return lexicographicalCompare(left.recordId, right.recordId);
 }
+
+export function selectOccupantRecordIds<T extends RecordsWriteMessage>(input: OccupancyProjectionInput<T>): Set<string> {
+  const occupants = new Set<string>();
+  const groups = new Map<string, T[]>();
+
+  for (const record of input.records) {
+    const scopeKey = input.getScopeKey(record);
+    const group = groups.get(scopeKey) ?? [];
+    group.push(record);
+    groups.set(scopeKey, group);
+  }
+
+  for (const group of groups.values()) {
+    group.sort(input.compareRecords);
+    for (const record of group.slice(0, input.max)) {
+      occupants.add(record.recordId);
+    }
+  }
+
+  return occupants;
+}

package/src/utils/records.ts

@@ -1,8 +1,8 @@
 import type { DerivedPrivateJwk } from './hd-key.js';
 import type { Jwk } from '@enbox/crypto';
 import type { KeyDecrypter } from '../types/encryption-types.js';
-import type { KeyEncryption } from './encryption.js';
 import type { PublicKeyJwk } from '../types/jose-types.js';
+import type { X25519KeyEncryption } from './encryption.js';
 import type { Filter, KeyValues, StartsWithFilter } from '../types/query-types.js';
 import type { GenericMessage, GenericSignaturePayload, MessageSort } from '../types/message-types.js';
 import type { RecordsCountMessage, RecordsDeleteMessage, RecordsFilter, RecordsQueryMessage, RecordsReadMessage, RecordsSubscribeMessage, RecordsWriteDescriptor, RecordsWriteMessage, RecordsWriteTags, RecordsWriteTagsFilter } from '../types/records-types.js';
@@ -21,6 +21,7 @@ import { X25519 } from '@enbox/crypto';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import { Encryption, ROLE_AUDIENCE_DERIVATION_SCHEME } from './encryption.js';
+import { ENCRYPTION_CONTROL_PATHS, isEncryptionControlPath } from '../core/constants.js';
 import { HdKey, KeyDerivationScheme } from './hd-key.js';
 import { normalizeProtocolUrl, normalizeSchemaUrl } from './url.js';
 
@@ -132,7 +133,7 @@ export class Records {
   private static async findMatchingKeyEncryption(
     recordsWrite: RecordsWriteMessage,
     keyOrDecrypter: DerivedPrivateJwk | KeyDecrypter,
-  ): Promise<{ fullDerivationPath: string[]; leafPrivateKey?: Jwk; matchingKeyEncryption?: KeyEncryption }> {
+  ): Promise<{ fullDerivationPath: string[]; leafPrivateKey?: Jwk; matchingKeyEncryption?: X25519KeyEncryption }> {
     const { encryption } = recordsWrite;
     const fullDerivationPath = Records.constructKeyDerivationPath(keyOrDecrypter.derivationScheme, recordsWrite);
 
@@ -334,6 +335,10 @@ export class Records {
       return;
     }
 
+    if (isEncryptionControlPath(protocolPath)) {
+      return;
+    }
+
     const expectedParentDepth = protocolPath.split('/').length - 1;
     const contextIdSegments = contextId?.split('/');
     if (
@@ -442,6 +447,35 @@ export class Records {
     return filterCopy;
   }
 
+  public static buildUnpublishedControlRecordsFilter(filter: RecordsFilter, dateSort?: DateSort): Filter {
+    return {
+      ...Records.convertFilter(filter, dateSort),
+      interface         : DwnInterfaceName.Records,
+      method            : DwnMethodName.Write,
+      isLatestBaseState : true,
+      published         : false,
+    };
+  }
+
+  public static buildControlRecordsFilters(filters: Filter[]): Filter[] {
+    const controlFilters: Filter[] = [];
+    for (const filter of filters) {
+      const protocolPath = filter.protocolPath;
+      if (typeof protocolPath === 'string') {
+        if (isEncryptionControlPath(protocolPath)) {
+          controlFilters.push(filter);
+        }
+        continue;
+      }
+
+      for (const controlPath of ENCRYPTION_CONTROL_PATHS) {
+        controlFilters.push({ ...filter, protocolPath: controlPath });
+      }
+    }
+
+    return controlFilters;
+  }
+
   /**
    * Validates the referential integrity of both author-delegated grant and owner-delegated grant.
    * @param authorSignaturePayload Decoded payload of the author signature of the message. Pass `undefined` if message is not signed.

package/src/utils/secp256k1.ts

@@ -1,7 +1,8 @@
 import type { JwkParamsEcPrivate, JwkParamsEcPublic } from '@enbox/crypto';
 import type { PrivateKeyJwk, PublicKeyJwk } from '../types/jose-types.js';
 
-import * as secp256k1 from '@noble/secp256k1';
+import { bytesToNumberBE } from '@noble/curves/utils.js';
+import { secp256k1 } from '@noble/curves/secp256k1.js';
 
 import { Encoder } from '../utils/encoder.js';
 import { sha256 } from 'multiformats/hashes/sha2';
@@ -30,8 +31,8 @@ export class Secp256k1 {
     let uncompressedPublicKeyBytes;
     if (publicKeyBytes.byteLength === 33) {
       // this means given key is compressed
-      const curvePoints = secp256k1.ProjectivePoint.fromHex(publicKeyBytes);
-      uncompressedPublicKeyBytes = curvePoints.toRawBytes(false); // isCompressed = false
+      const curvePoints = secp256k1.Point.fromBytes(publicKeyBytes);
+      uncompressedPublicKeyBytes = curvePoints.toBytes(false); // isCompressed = false
     } else {
       uncompressedPublicKeyBytes = publicKeyBytes;
     }
@@ -75,10 +76,10 @@ export class Secp256k1 {
     const x = Encoder.base64UrlToBytes(ecJwk.x);
     const y = Encoder.base64UrlToBytes(ecJwk.y!);
 
-    return secp256k1.ProjectivePoint.fromAffine({
-      x : secp256k1.etc.bytesToNumberBE(x),
-      y : secp256k1.etc.bytesToNumberBE(y)
-    }).toRawBytes(true);
+    return secp256k1.Point.fromAffine({
+      x : bytesToNumberBE(x),
+      y : bytesToNumberBE(y)
+    }).toBytes(true);
   }
 
   /**
@@ -100,7 +101,7 @@ export class Secp256k1 {
     const hashedContent = await sha256.encode(content);
     const privateKeyBytes = Secp256k1.privateJwkToBytes(privateJwk);
 
-    return (await secp256k1.signAsync(hashedContent, privateKeyBytes)).toCompactRawBytes();
+    return secp256k1.sign(hashedContent, privateKeyBytes, { prehash: false });
   }
 
   /**
@@ -112,14 +113,14 @@ export class Secp256k1 {
 
     const publicKeyBytes = Secp256k1.publicJwkToBytes(publicJwk);
     const hashedContent = await sha256.encode(content);
-    return secp256k1.verify(signature, hashedContent, publicKeyBytes, { lowS: false });
+    return secp256k1.verify(signature, hashedContent, publicKeyBytes, { lowS: false, prehash: false });
   }
 
   /**
    * Generates a random key pair in JWK format.
    */
   public static async generateKeyPair(): Promise<{publicJwk: PublicKeyJwk, privateJwk: PrivateKeyJwk}> {
-    const privateKeyBytes = secp256k1.utils.randomPrivateKey();
+    const privateKeyBytes = secp256k1.utils.randomSecretKey();
     const publicKeyBytes = secp256k1.getPublicKey(privateKeyBytes, false); // `false` = uncompressed
 
     const d = Encoder.bytesToBase64Url(privateKeyBytes);
@@ -133,7 +134,7 @@ export class Secp256k1 {
    * Generates key pair in raw bytes, where the `publicKey` is compressed.
    */
   public static async generateKeyPairRaw(): Promise<{publicKey: Uint8Array, privateKey: Uint8Array}> {
-    const privateKey = secp256k1.utils.randomPrivateKey();
+    const privateKey = secp256k1.utils.randomSecretKey();
     const publicKey = secp256k1.getPublicKey(privateKey, true); // `true` = compressed
 
     return { publicKey, privateKey };
@@ -156,4 +157,3 @@ export class Secp256k1 {
     return publicKey as PublicKeyJwk;
   }
 }
-