@koralabs/kora-labs-common 6.7.9 → 6.8.0

package/handles/utils.js

@@ -1,30 +1,7 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildDrep = exports.checkHandlePattern = exports.buildMetadata = exports.buildNumericModifiers = exports.buildCharacters = exports.getRarity = void 0;
-const crypto = __importStar(require("crypto"));
+const js_md5_1 = require("js-md5");
 const constants_1 = require("../constants");
 const utils_1 = require("../utils");
 const constants_2 = require("./constants");
@@ -128,7 +105,7 @@ const buildDrep = (address, id_hash) => {
     const decoded = (_a = (0, utils_1.decodeAddress)(address)) === null || _a === void 0 ? void 0 : _a.slice(2, 58);
     if (!decoded || decoded == '')
         return undefined;
-    const hashed = crypto.createHash('md5').update(Buffer.from(decoded, 'hex')).digest('hex');
+    const hashed = (0, js_md5_1.md5)(Buffer.from(decoded, 'hex'));
     if (!id_hash.startsWith(hashed))
         return undefined;
     const typeByte = id_hash.slice(32, 34);

package/index.d.ts

@@ -1,5 +1,4 @@
 export * from './constants';
-export * from './aws';
 export { ComputeEnvironment, Environment } from './environment';
 export * from './errors';
 export * from './fn';

package/index.js

@@ -16,7 +16,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProtectedWords = exports.Logger = exports.LogCategory = exports.Environment = exports.ComputeEnvironment = void 0;
 __exportStar(require("./constants"), exports);
-__exportStar(require("./aws"), exports);
+// NOTE: './aws' (KMS + JWT signing) is intentionally NOT re-exported here — it pulls Node-only
+// deps (@aws-sdk/client-kms, node:crypto) that break browser bundles. It is server-only; import it
+// directly from the subpath: `@koralabs/kora-labs-common/aws`. This keeps the root index isomorphic.
 var environment_1 = require("./environment");
 Object.defineProperty(exports, "ComputeEnvironment", { enumerable: true, get: function () { return environment_1.ComputeEnvironment; } });
 Object.defineProperty(exports, "Environment", { enumerable: true, get: function () { return environment_1.Environment; } });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@koralabs/kora-labs-common",
-    "version": "6.7.9",
+    "version": "6.8.0",
     "description": "Kora Labs Common Utilities",
     "main": "index.js",
     "types": "index.d.ts",
@@ -40,13 +40,13 @@
     },
     "dependencies": {
         "@aws-sdk/client-kms": "^3.1003.0",
-        "@emurgo/cardano-message-signing-nodejs": "^1.0.1",
         "bech32": "^2.0.0",
         "blakejs": "^1.2.1",
         "boolean": "^3.2.0",
         "bs58": "^6.0.0",
         "cbor": "^9.0.2",
         "crc": "^4.3.2",
+        "js-md5": "^0.8.3",
         "libsodium-wrappers-sumo": "^0.8.3",
         "pluralize-esm": "^9.0.5"
     },

package/utils/index.d.ts

@@ -30,5 +30,4 @@ export declare const isUserIssueTrackingId: (value: unknown) => value is string;
 export declare const normalizeUserIssueEventSegment: (value: string) => string;
 export declare const buildUserIssueEventKey: (repo: string, flow: string, pathOrFunction: string, step: string) => string;
 export { decodeCborToJson, encodeJsonToDatum, DefaultTextFormat as KeyType } from './cbor';
-export * from './cip8';
 export * from './crypto';

package/utils/index.js

@@ -199,5 +199,7 @@ var cbor_1 = require("./cbor");
 Object.defineProperty(exports, "decodeCborToJson", { enumerable: true, get: function () { return cbor_1.decodeCborToJson; } });
 Object.defineProperty(exports, "encodeJsonToDatum", { enumerable: true, get: function () { return cbor_1.encodeJsonToDatum; } });
 Object.defineProperty(exports, "KeyType", { enumerable: true, get: function () { return cbor_1.DefaultTextFormat; } });
-__exportStar(require("./cip8"), exports);
+// NOTE: './cip8' (CIP-30 signData via @emurgo/cardano-message-signing-nodejs WASM + node:crypto)
+// was removed from kora-labs-common — its only consumer was auth.handle.me, which now owns it. It
+// is a heavy Node-only signer that should never reach an isomorphic package's surface.
 __exportStar(require("./crypto"), exports);

package/utils/cip8/index.d.ts

@@ -1,29 +0,0 @@
-/**
- * Produce a CIP-30 signData (CIP-8) signature.
- *
- * Builds COSE_Sign1 and COSE_Key structures that verifyCip30SignData can verify.
- *
- * @param privateKeyHex - raw Ed25519 private key (32 bytes hex)
- * @param publicKeyHex  - raw Ed25519 public key (32 bytes hex)
- * @param payloadHex    - hex of the payload to sign (e.g. UTF-8 bytes of requestId + handle)
- * @param addressHex    - hex of the signing address (included in COSE protected headers)
- * @returns { signature: string, key: string } — COSESign1 and COSEKey as CBOR hex
- */
-export declare const signCip30Data: (privateKeyHex: string, publicKeyHex: string, payloadHex: string, addressHex: string, signFn?: ((messageHex: string) => string) | undefined) => Promise<{
-    signature: string;
-    key: string;
-}>;
-/**
- * Verify a CIP-30 signData (CIP-8) signature.
- *
- * Parses the COSE structures produced by the wallet, reconstructs the
- * SigStructure using the library (not manual CBOR), and verifies the
- * Ed25519 signature with Node.js crypto.
- *
- * @param signatureCborHex - COSESign1 CBOR hex from wallet signData response
- * @param publicKeyCborHex - COSEKey CBOR hex from wallet signData response
- * @param expectedPayloadHex - hex of the expected signed payload (e.g. requestId + handle as UTF-8 bytes)
- * @param expectedAddressHex - hex of the expected signing address (must match the address in the COSE protected headers)
- * @returns true if the signature is valid
- */
-export declare const verifyCip30SignData: (signatureCborHex: string, publicKeyCborHex: string, expectedPayloadHex: string, expectedAddressHex: string) => Promise<boolean>;

package/utils/cip8/index.js

@@ -1,154 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyCip30SignData = exports.signCip30Data = void 0;
-const crypto_1 = require("crypto");
-let _cms;
-const getCms = async () => {
-    if (!_cms) {
-        _cms = await Promise.resolve().then(() => __importStar(require('@emurgo/cardano-message-signing-nodejs')));
-    }
-    return _cms;
-};
-/**
- * Produce a CIP-30 signData (CIP-8) signature.
- *
- * Builds COSE_Sign1 and COSE_Key structures that verifyCip30SignData can verify.
- *
- * @param privateKeyHex - raw Ed25519 private key (32 bytes hex)
- * @param publicKeyHex  - raw Ed25519 public key (32 bytes hex)
- * @param payloadHex    - hex of the payload to sign (e.g. UTF-8 bytes of requestId + handle)
- * @param addressHex    - hex of the signing address (included in COSE protected headers)
- * @returns { signature: string, key: string } — COSESign1 and COSEKey as CBOR hex
- */
-const signCip30Data = async (privateKeyHex, publicKeyHex, payloadHex, addressHex, 
-/** Optional sign function for extended keys. Takes message hex, returns signature hex. */
-signFn) => {
-    const cms = await getCms();
-    const payloadBytes = Buffer.from(payloadHex, 'hex');
-    const addrBytes = Buffer.from(addressHex, 'hex');
-    const pubKeyBytes = Buffer.from(publicKeyHex, 'hex');
-    // Build protected headers: algorithm = EdDSA, address = signing address
-    const protectedHeaders = cms.HeaderMap.new();
-    protectedHeaders.set_algorithm_id(cms.Label.from_algorithm_id(cms.AlgorithmId.EdDSA));
-    protectedHeaders.set_header(cms.Label.new_text('address'), cms.CBORValue.new_bytes(addrBytes));
-    const headers = cms.Headers.new(cms.ProtectedHeaderMap.new(protectedHeaders), cms.HeaderMap.new());
-    const builder = cms.COSESign1Builder.new(headers, payloadBytes, false);
-    // Sign the SigStructure with the Ed25519 private key.
-    // Accepts 32-byte seed (Node.js crypto) or 64-byte extended key (Cardano BIP32).
-    // For extended keys, a signFn callback must be provided since the standard
-    // DER format doesn't support pre-clamped scalars.
-    const sigStructureBytes = builder.make_data_to_sign().to_bytes();
-    const privKeyRaw = Buffer.from(privateKeyHex, 'hex');
-    let signatureBytes;
-    if (privKeyRaw.length <= 32) {
-        // 32-byte seed: use Node.js crypto
-        const privKeyDer = Buffer.concat([
-            Buffer.from('302e020100300506032b657004220420', 'hex'),
-            privKeyRaw
-        ]);
-        const keyObject = (0, crypto_1.createPrivateKey)({ key: privKeyDer, format: 'der', type: 'pkcs8' });
-        signatureBytes = (0, crypto_1.sign)(null, Buffer.from(sigStructureBytes), keyObject);
-    }
-    else if (signFn) {
-        // Extended key with custom sign function (e.g. @cardano-sdk/crypto Ed25519PrivateKey.sign)
-        signatureBytes = Buffer.from(signFn(Buffer.from(sigStructureBytes).toString('hex')), 'hex');
-    }
-    else {
-        throw new Error('64-byte extended key requires a signFn parameter');
-    }
-    const coseSign1 = builder.build(signatureBytes);
-    // Build COSE_Key with the public key
-    const coseKey = cms.COSEKey.new(cms.Label.from_key_type(cms.KeyType.OKP));
-    coseKey.set_algorithm_id(cms.Label.from_algorithm_id(cms.AlgorithmId.EdDSA));
-    coseKey.set_header(cms.Label.new_int(cms.Int.new_i32(-1)), cms.CBORValue.from_label(cms.Label.from_curve_type(cms.CurveType.Ed25519)));
-    coseKey.set_header(cms.Label.new_int(cms.Int.new_i32(-2)), cms.CBORValue.new_bytes(pubKeyBytes));
-    return {
-        signature: Buffer.from(coseSign1.to_bytes()).toString('hex'),
-        key: Buffer.from(coseKey.to_bytes()).toString('hex')
-    };
-};
-exports.signCip30Data = signCip30Data;
-/**
- * Verify a CIP-30 signData (CIP-8) signature.
- *
- * Parses the COSE structures produced by the wallet, reconstructs the
- * SigStructure using the library (not manual CBOR), and verifies the
- * Ed25519 signature with Node.js crypto.
- *
- * @param signatureCborHex - COSESign1 CBOR hex from wallet signData response
- * @param publicKeyCborHex - COSEKey CBOR hex from wallet signData response
- * @param expectedPayloadHex - hex of the expected signed payload (e.g. requestId + handle as UTF-8 bytes)
- * @param expectedAddressHex - hex of the expected signing address (must match the address in the COSE protected headers)
- * @returns true if the signature is valid
- */
-const verifyCip30SignData = async (signatureCborHex, publicKeyCborHex, expectedPayloadHex, expectedAddressHex) => {
-    var _a;
-    const cms = await getCms();
-    // Parse COSESign1 and COSEKey from wallet output
-    const coseSign1 = cms.COSESign1.from_bytes(Buffer.from(signatureCborHex, 'hex'));
-    const coseKey = cms.COSEKey.from_bytes(Buffer.from(publicKeyCborHex, 'hex'));
-    // Extract the address from the protected headers and verify it matches
-    const protectedHeaders = coseSign1.headers().protected().deserialized_headers();
-    const addressLabel = cms.Label.new_text('address');
-    const addressValue = protectedHeaders.header(addressLabel);
-    if (addressValue) {
-        const addressBytes = Buffer.from((_a = addressValue.as_bytes()) !== null && _a !== void 0 ? _a : new Uint8Array()).toString('hex');
-        if (addressBytes !== expectedAddressHex) {
-            return false;
-        }
-    }
-    // Verify the payload matches what we expect
-    const signedPayload = coseSign1.payload();
-    if (signedPayload) {
-        const payloadHex = Buffer.from(signedPayload).toString('hex');
-        if (payloadHex !== expectedPayloadHex) {
-            return false;
-        }
-    }
-    // Reconstruct the SigStructure (what was actually signed) using the library
-    const sigStructure = coseSign1.signed_data();
-    const sigStructureBytes = sigStructure.to_bytes();
-    // Extract the raw Ed25519 signature
-    const signatureBytes = coseSign1.signature();
-    // Extract the Ed25519 public key from COSEKey (label -2 is the "x" coordinate / public key)
-    const xLabel = cms.Label.new_int(cms.Int.new_i32(-2));
-    const pubKeyValue = coseKey.header(xLabel);
-    if (!pubKeyValue) {
-        return false;
-    }
-    const pubKeyBytes = pubKeyValue.as_bytes();
-    if (!pubKeyBytes || pubKeyBytes.length !== 32) {
-        return false;
-    }
-    // Wrap the raw Ed25519 public key in DER SPKI format for Node.js crypto
-    const pubKeyDer = Buffer.concat([
-        Buffer.from('302a300506032b6570032100', 'hex'),
-        Buffer.from(pubKeyBytes)
-    ]);
-    const keyObject = (0, crypto_1.createPublicKey)({ key: pubKeyDer, format: 'der', type: 'spki' });
-    return (0, crypto_1.verify)(null, Buffer.from(sigStructureBytes), keyObject, Buffer.from(signatureBytes));
-};
-exports.verifyCip30SignData = verifyCip30SignData;