@haex-space/vault-sdk 2.5.107 → 2.5.108

package/dist/index.d.mts

@@ -796,6 +796,25 @@ interface SignableRecord {
 }
 declare function signRecordAsync(record: SignableRecord, privateKeyBase64: string): Promise<string>;
 declare function verifyRecordSignatureAsync(record: SignableRecord, signatureBase64: string, publicKeyBase64: string): Promise<boolean>;
+/**
+ * Sign a space challenge to prove private key possession.
+ * Generates a fresh timestamp internally to prevent misuse.
+ *
+ * @returns signature (Base64) + timestamp (ISO 8601) to send as
+ *          X-Space-Signature / X-Space-Timestamp headers.
+ */
+declare function signSpaceChallengeAsync(spaceId: string, privateKeyBase64: string): Promise<{
+    signature: string;
+    timestamp: string;
+}>;
+/**
+ * Verify a space challenge signature (server-side).
+ * Checks both cryptographic validity and timestamp freshness (max 30s).
+ */
+declare function verifySpaceChallengeAsync(spaceId: string, timestamp: string, signatureBase64: string, publicKeyBase64: string): Promise<{
+    valid: boolean;
+    error?: string;
+}>;
 
 /**
  * Crypto utilities for WebAuthn/Passkey operations
@@ -871,4 +890,4 @@ declare function exportKeyPairAsync(keyPair: PasskeyKeyPair): Promise<ExportedPa
 
 declare function createHaexVaultSdk(config?: HaexHubConfig): HaexVaultSdk;
 
-export { type AuthUser, COSE_ALGORITHM, type CoseAlgorithm, type CreateSpaceRequest, type EncryptedSpaceKey, type ExportedPasskeyKeyPair, type ExportedUserKeypair, ExtensionManifest, HAEXSPACE_MESSAGE_TYPES, HaexHubConfig, HaexVaultSdk, type HaexspaceMessageType, type InviteMemberRequest, KEY_AGREEMENT_ALGO, type PasskeyKeyPair, type RegisterKeypairRequest, SIGNING_ALGO, type SignableRecord, SpaceRole, type StorageConfig, type ErrorResponse as SyncServerErrorResponse, type ServerInfo as SyncServerInfo, type LoginRequest as SyncServerLoginRequest, type LoginResponse as SyncServerLoginResponse, type RefreshRequest as SyncServerRefreshRequest, TAURI_COMMANDS, type TauriCommand, type UserKeypair, type VerifyResult, type ZipFileEntry, arrayBufferToBase64, base64ToArrayBuffer, createHaexVaultSdk, decryptCrdtData, decryptPrivateKeyAsync, decryptSpaceKeyAsync, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptPrivateKeyAsync, encryptSpaceKeyForRecipientAsync, encryptString, encryptVaultKey, exportKeyPairAsync, exportPrivateKeyAsync, exportPublicKeyAsync, exportPublicKeyCoseAsync, exportUserKeypairAsync, generateCredentialId, generatePasskeyPairAsync, generateSpaceKey, generateUserKeypairAsync, generateVaultKey, hexToBytes, importPrivateKeyAsync, importPrivateKeyForKeyAgreementAsync, importPublicKeyAsync, importPublicKeyForKeyAgreementAsync, importUserPrivateKeyAsync, importUserPublicKeyAsync, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, signRecordAsync, signWithPasskeyAsync, sortObjectKeysRecursively, unwrapKey, verifyExtensionSignature, verifyRecordSignatureAsync, verifyWithPasskeyAsync, wrapKey };
+export { type AuthUser, COSE_ALGORITHM, type CoseAlgorithm, type CreateSpaceRequest, type EncryptedSpaceKey, type ExportedPasskeyKeyPair, type ExportedUserKeypair, ExtensionManifest, HAEXSPACE_MESSAGE_TYPES, HaexHubConfig, HaexVaultSdk, type HaexspaceMessageType, type InviteMemberRequest, KEY_AGREEMENT_ALGO, type PasskeyKeyPair, type RegisterKeypairRequest, SIGNING_ALGO, type SignableRecord, SpaceRole, type StorageConfig, type ErrorResponse as SyncServerErrorResponse, type ServerInfo as SyncServerInfo, type LoginRequest as SyncServerLoginRequest, type LoginResponse as SyncServerLoginResponse, type RefreshRequest as SyncServerRefreshRequest, TAURI_COMMANDS, type TauriCommand, type UserKeypair, type VerifyResult, type ZipFileEntry, arrayBufferToBase64, base64ToArrayBuffer, createHaexVaultSdk, decryptCrdtData, decryptPrivateKeyAsync, decryptSpaceKeyAsync, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptPrivateKeyAsync, encryptSpaceKeyForRecipientAsync, encryptString, encryptVaultKey, exportKeyPairAsync, exportPrivateKeyAsync, exportPublicKeyAsync, exportPublicKeyCoseAsync, exportUserKeypairAsync, generateCredentialId, generatePasskeyPairAsync, generateSpaceKey, generateUserKeypairAsync, generateVaultKey, hexToBytes, importPrivateKeyAsync, importPrivateKeyForKeyAgreementAsync, importPublicKeyAsync, importPublicKeyForKeyAgreementAsync, importUserPrivateKeyAsync, importUserPublicKeyAsync, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, signRecordAsync, signSpaceChallengeAsync, signWithPasskeyAsync, sortObjectKeysRecursively, unwrapKey, verifyExtensionSignature, verifyRecordSignatureAsync, verifySpaceChallengeAsync, verifyWithPasskeyAsync, wrapKey };

package/dist/index.d.ts

@@ -796,6 +796,25 @@ interface SignableRecord {
 }
 declare function signRecordAsync(record: SignableRecord, privateKeyBase64: string): Promise<string>;
 declare function verifyRecordSignatureAsync(record: SignableRecord, signatureBase64: string, publicKeyBase64: string): Promise<boolean>;
+/**
+ * Sign a space challenge to prove private key possession.
+ * Generates a fresh timestamp internally to prevent misuse.
+ *
+ * @returns signature (Base64) + timestamp (ISO 8601) to send as
+ *          X-Space-Signature / X-Space-Timestamp headers.
+ */
+declare function signSpaceChallengeAsync(spaceId: string, privateKeyBase64: string): Promise<{
+    signature: string;
+    timestamp: string;
+}>;
+/**
+ * Verify a space challenge signature (server-side).
+ * Checks both cryptographic validity and timestamp freshness (max 30s).
+ */
+declare function verifySpaceChallengeAsync(spaceId: string, timestamp: string, signatureBase64: string, publicKeyBase64: string): Promise<{
+    valid: boolean;
+    error?: string;
+}>;
 
 /**
  * Crypto utilities for WebAuthn/Passkey operations
@@ -871,4 +890,4 @@ declare function exportKeyPairAsync(keyPair: PasskeyKeyPair): Promise<ExportedPa
 
 declare function createHaexVaultSdk(config?: HaexHubConfig): HaexVaultSdk;
 
-export { type AuthUser, COSE_ALGORITHM, type CoseAlgorithm, type CreateSpaceRequest, type EncryptedSpaceKey, type ExportedPasskeyKeyPair, type ExportedUserKeypair, ExtensionManifest, HAEXSPACE_MESSAGE_TYPES, HaexHubConfig, HaexVaultSdk, type HaexspaceMessageType, type InviteMemberRequest, KEY_AGREEMENT_ALGO, type PasskeyKeyPair, type RegisterKeypairRequest, SIGNING_ALGO, type SignableRecord, SpaceRole, type StorageConfig, type ErrorResponse as SyncServerErrorResponse, type ServerInfo as SyncServerInfo, type LoginRequest as SyncServerLoginRequest, type LoginResponse as SyncServerLoginResponse, type RefreshRequest as SyncServerRefreshRequest, TAURI_COMMANDS, type TauriCommand, type UserKeypair, type VerifyResult, type ZipFileEntry, arrayBufferToBase64, base64ToArrayBuffer, createHaexVaultSdk, decryptCrdtData, decryptPrivateKeyAsync, decryptSpaceKeyAsync, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptPrivateKeyAsync, encryptSpaceKeyForRecipientAsync, encryptString, encryptVaultKey, exportKeyPairAsync, exportPrivateKeyAsync, exportPublicKeyAsync, exportPublicKeyCoseAsync, exportUserKeypairAsync, generateCredentialId, generatePasskeyPairAsync, generateSpaceKey, generateUserKeypairAsync, generateVaultKey, hexToBytes, importPrivateKeyAsync, importPrivateKeyForKeyAgreementAsync, importPublicKeyAsync, importPublicKeyForKeyAgreementAsync, importUserPrivateKeyAsync, importUserPublicKeyAsync, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, signRecordAsync, signWithPasskeyAsync, sortObjectKeysRecursively, unwrapKey, verifyExtensionSignature, verifyRecordSignatureAsync, verifyWithPasskeyAsync, wrapKey };
+export { type AuthUser, COSE_ALGORITHM, type CoseAlgorithm, type CreateSpaceRequest, type EncryptedSpaceKey, type ExportedPasskeyKeyPair, type ExportedUserKeypair, ExtensionManifest, HAEXSPACE_MESSAGE_TYPES, HaexHubConfig, HaexVaultSdk, type HaexspaceMessageType, type InviteMemberRequest, KEY_AGREEMENT_ALGO, type PasskeyKeyPair, type RegisterKeypairRequest, SIGNING_ALGO, type SignableRecord, SpaceRole, type StorageConfig, type ErrorResponse as SyncServerErrorResponse, type ServerInfo as SyncServerInfo, type LoginRequest as SyncServerLoginRequest, type LoginResponse as SyncServerLoginResponse, type RefreshRequest as SyncServerRefreshRequest, TAURI_COMMANDS, type TauriCommand, type UserKeypair, type VerifyResult, type ZipFileEntry, arrayBufferToBase64, base64ToArrayBuffer, createHaexVaultSdk, decryptCrdtData, decryptPrivateKeyAsync, decryptSpaceKeyAsync, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptPrivateKeyAsync, encryptSpaceKeyForRecipientAsync, encryptString, encryptVaultKey, exportKeyPairAsync, exportPrivateKeyAsync, exportPublicKeyAsync, exportPublicKeyCoseAsync, exportUserKeypairAsync, generateCredentialId, generatePasskeyPairAsync, generateSpaceKey, generateUserKeypairAsync, generateVaultKey, hexToBytes, importPrivateKeyAsync, importPrivateKeyForKeyAgreementAsync, importPublicKeyAsync, importPublicKeyForKeyAgreementAsync, importUserPrivateKeyAsync, importUserPublicKeyAsync, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, signRecordAsync, signSpaceChallengeAsync, signWithPasskeyAsync, sortObjectKeysRecursively, unwrapKey, verifyExtensionSignature, verifyRecordSignatureAsync, verifySpaceChallengeAsync, verifyWithPasskeyAsync, wrapKey };

package/dist/index.js

@@ -2885,6 +2885,42 @@ async function verifyRecordSignatureAsync(record, signatureBase64, publicKeyBase
     canonicalize(record)
   );
 }
+var CHALLENGE_MAX_AGE_MS = 3e4;
+function canonicalizeChallenge(spaceId, timestamp) {
+  return new TextEncoder().encode(`${spaceId}\0${timestamp}`).buffer;
+}
+async function signSpaceChallengeAsync(spaceId, privateKeyBase64) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const key = await importUserPrivateKeyAsync(privateKeyBase64);
+  const sig = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    canonicalizeChallenge(spaceId, timestamp)
+  );
+  return { signature: arrayBufferToBase64(sig), timestamp };
+}
+async function verifySpaceChallengeAsync(spaceId, timestamp, signatureBase64, publicKeyBase64) {
+  const tsMs = new Date(timestamp).getTime();
+  if (Number.isNaN(tsMs)) {
+    return { valid: false, error: "Invalid timestamp format" };
+  }
+  const age = Date.now() - tsMs;
+  if (age < 0 || age > CHALLENGE_MAX_AGE_MS) {
+    return { valid: false, error: "Challenge timestamp expired or in the future" };
+  }
+  try {
+    const key = await importUserPublicKeyAsync(publicKeyBase64);
+    const isValid = await crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      key,
+      base64ToArrayBuffer(signatureBase64),
+      canonicalizeChallenge(spaceId, timestamp)
+    );
+    return isValid ? { valid: true } : { valid: false, error: "Invalid challenge signature" };
+  } catch {
+    return { valid: false, error: "Challenge verification failed" };
+  }
+}
 
 // src/crypto/passkey.ts
 function toArrayBuffer(data) {
@@ -3124,11 +3160,13 @@ exports.isPermissionDeniedError = isPermissionDeniedError;
 exports.isPermissionError = isPermissionError;
 exports.isPermissionPromptError = isPermissionPromptError;
 exports.signRecordAsync = signRecordAsync;
+exports.signSpaceChallengeAsync = signSpaceChallengeAsync;
 exports.signWithPasskeyAsync = signWithPasskeyAsync;
 exports.sortObjectKeysRecursively = sortObjectKeysRecursively;
 exports.unwrapKey = unwrapKey;
 exports.verifyExtensionSignature = verifyExtensionSignature;
 exports.verifyRecordSignatureAsync = verifyRecordSignatureAsync;
+exports.verifySpaceChallengeAsync = verifySpaceChallengeAsync;
 exports.verifyWithPasskeyAsync = verifyWithPasskeyAsync;
 exports.wrapKey = wrapKey;
 //# sourceMappingURL=index.js.map