@mblaney/holster 2.0.1 → 2.1.0

package/ts/src/sea-utils.ts

@@ -4,7 +4,7 @@
  */
 
 import SafeBuffer from "./buffer.ts"
-import type { JWK } from "./schemas.ts"
+import type {JWK} from "./schemas.ts"
 
 const isNode = typeof process !== "undefined" && process.versions?.node != null
 
@@ -64,23 +64,20 @@ export const jwk = (pub: string, priv?: string): JWK => {
  */
 export const sha256 = async (data: unknown): Promise<SeaArray> => {
   const hash = await subtle.digest(
-    { name: "SHA-256" },
-    new TextEncoder().encode(stringify(data))
+    {name: "SHA-256"},
+    new TextEncoder().encode(stringify(data)),
   )
   return SafeBuffer.from(new Uint8Array(hash))
 }
 
 /**
- * Derive AES key from password and salt  
+ * Derive AES key from password and salt
  */
-export const aeskey = async (
-  key: string,
-  salt: SeaArray
-) => {
+export const aeskey = async (key: string, salt: SeaArray) => {
   const combined = key + salt.toString("utf8")
   const hashResult = await sha256(combined)
   const jwkKey = keyToJwk(hashResult)
-  return await subtle.importKey("jwk", jwkKey, { name: "AES-GCM" }, false, [
+  return await subtle.importKey("jwk", jwkKey, {name: "AES-GCM"}, false, [
     "encrypt",
     "decrypt",
   ])
@@ -95,9 +92,8 @@ const keyToJwk = (key: SeaArray): JWK => {
     .replace(/\+/g, "-")
     .replace(/\//g, "_")
     .replace(/=/g, "")
-  return { kty: "oct", k: k, ext: false, alg: "A256GCM" }
+  return {kty: "oct", k: k, ext: false, alg: "A256GCM"}
 }
 
 // Re-export SeaArray type for convenience
 import type SeaArray from "./array.ts"
-

package/ts/src/sea.ts

@@ -3,14 +3,10 @@
  * Cryptographic functions for signing, verification, encryption, and decryption
  */
 
-import { userPublicKey, userSignature } from "./utils.ts"
+import {userPublicKey, userSignature} from "./utils.ts"
 import * as utils from "./sea-utils.ts"
 import SafeBuffer from "./buffer.ts"
-import type {
-  UserPair,
-  EncryptedData,
-  SignedData,
-} from "./schemas.ts"
+import type {UserPair, EncryptedData, SignedData} from "./schemas.ts"
 
 type Callback<T> = (result: T) => void
 
@@ -24,7 +20,7 @@ const SEA = {
   pair: async (cb?: Callback<UserPair>): Promise<UserPair> => {
     // ECDSA keys for signing/verifying
     const ecdsa = await utils.subtle
-      .generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, [
+      .generateKey({name: "ECDSA", namedCurve: "P-256"}, true, [
         "sign",
         "verify",
       ])
@@ -38,7 +34,7 @@ const SEA = {
 
     // ECDH keys for encryption/decryption
     const ecdh = await utils.subtle
-      .generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveKey"])
+      .generateKey({name: "ECDH", namedCurve: "P-256"}, true, ["deriveKey"])
       .then(async keys => {
         const pub = await utils.subtle.exportKey("jwk", keys.publicKey)
         return {
@@ -63,14 +59,14 @@ const SEA = {
   encrypt: async (
     data: unknown,
     pair: Partial<UserPair> | null,
-    cb?: Callback<EncryptedData | null>
+    cb?: Callback<EncryptedData | null>,
   ): Promise<EncryptedData | null> => {
     if (!pair || !pair.epriv) {
       if (cb) cb(null)
       return null
     }
 
-    const rand = { s: utils.random(9), iv: utils.random(15) }
+    const rand = {s: utils.random(9), iv: utils.random(15)}
     const ct = await utils.aeskey(pair.epriv, rand.s).then(aes => {
       return utils.subtle.encrypt(
         {
@@ -78,7 +74,7 @@ const SEA = {
           iv: new Uint8Array(rand.iv),
         },
         aes,
-        new TextEncoder().encode(utils.stringify(data))
+        new TextEncoder().encode(utils.stringify(data)),
       )
     })
     const enc: EncryptedData = {
@@ -96,7 +92,7 @@ const SEA = {
   decrypt: async (
     enc: Partial<EncryptedData> | null,
     pair: Partial<UserPair> | null,
-    cb?: Callback<unknown | null>
+    cb?: Callback<unknown | null>,
   ): Promise<unknown | null> => {
     if (!enc || !enc.ct || !enc.iv || !enc.s || !pair || !pair.epriv) {
       if (cb) cb(null)
@@ -117,7 +113,7 @@ const SEA = {
             tagLength: 128,
           },
           aes,
-          new Uint8Array(data.ct)
+          new Uint8Array(data.ct),
         )
       })
       const dec = utils.parse(new TextDecoder("utf8").decode(ct))
@@ -136,7 +132,7 @@ const SEA = {
   verify: async (
     data: string | SignedData,
     pair: Partial<UserPair> | null,
-    cb?: Callback<unknown | null>
+    cb?: Callback<unknown | null>,
   ): Promise<unknown | null> => {
     if (!pair || !pair.pub) {
       if (cb) cb(null)
@@ -149,9 +145,9 @@ const SEA = {
     const key = await utils.subtle.importKey(
       "jwk",
       utils.jwk(pair.pub),
-      { name: "ECDSA", namedCurve: "P-256" },
+      {name: "ECDSA", namedCurve: "P-256"},
       false,
-      ["verify"]
+      ["verify"],
     )
 
     let msg: string | Record<string, unknown> = {}
@@ -162,13 +158,13 @@ const SEA = {
       // (which should not be part of signature, so not verified)
       for (const k of Object.keys(signed.m).sort()) {
         if (k !== "_" && k !== userPublicKey && k !== userSignature) {
-          (msg as Record<string, unknown>)[k] = signed.m[k]
+          ;(msg as Record<string, unknown>)[k] = signed.m[k]
         }
       }
     }
     const hash = await utils.sha256(msg)
     const sig = new Uint8Array(SafeBuffer.from(signed.s, "base64"))
-    const alg = { name: "ECDSA", hash: { name: "SHA-256" } }
+    const alg = {name: "ECDSA", hash: {name: "SHA-256"}}
     if (await utils.subtle.verify(alg, key, sig, new Uint8Array(hash))) {
       const verified = utils.parse(signed.m as string)
       if (cb) cb(verified)
@@ -185,7 +181,7 @@ const SEA = {
   sign: async (
     data: string | Record<string, unknown>,
     pair: Partial<UserPair> | null,
-    cb?: Callback<SignedData | null>
+    cb?: Callback<SignedData | null>,
   ): Promise<SignedData | null> => {
     if (!pair || !pair.pub || !pair.priv) {
       if (cb) cb(null)
@@ -199,21 +195,21 @@ const SEA = {
       const check = utils.parse(data as never) as Record<string, unknown>
       for (const k of Object.keys(check).sort()) {
         if (k !== "_" && k !== userPublicKey && k !== userSignature) {
-          (msg as Record<string, unknown>)[k] = check[k]
+          ;(msg as Record<string, unknown>)[k] = check[k]
         }
       }
     }
     const hash = await utils.sha256(msg)
     const jwk = utils.jwk(pair.pub, pair.priv)
-    const alg = { name: "ECDSA", namedCurve: "P-256" }
+    const alg = {name: "ECDSA", namedCurve: "P-256"}
     const sig = await utils.subtle
       .importKey("jwk", jwk, alg, false, ["sign"])
       .then(key =>
         utils.subtle.sign(
-          { name: "ECDSA", hash: { name: "SHA-256" } },
+          {name: "ECDSA", hash: {name: "SHA-256"}},
           key,
-          new Uint8Array(hash)
-        )
+          new Uint8Array(hash),
+        ),
       )
     const signed: SignedData = {
       m: msg,
@@ -230,7 +226,7 @@ const SEA = {
   signTimestamp: async (
     timestamp: number,
     pair: Partial<UserPair> | null,
-    cb?: Callback<string | null>
+    cb?: Callback<string | null>,
   ): Promise<string | null> => {
     if (!pair || !pair.pub || !pair.priv) {
       if (cb) cb(null)
@@ -241,16 +237,16 @@ const SEA = {
     const timestampStr = timestamp.toString()
     const hash = await utils.sha256(timestampStr)
     const jwk = utils.jwk(pair.pub, pair.priv)
-    const alg = { name: "ECDSA", namedCurve: "P-256" }
+    const alg = {name: "ECDSA", namedCurve: "P-256"}
 
     const sig = await utils.subtle
       .importKey("jwk", jwk, alg, false, ["sign"])
       .then(key =>
         utils.subtle.sign(
-          { name: "ECDSA", hash: { name: "SHA-256" } },
+          {name: "ECDSA", hash: {name: "SHA-256"}},
           key,
-          new Uint8Array(hash)
-        )
+          new Uint8Array(hash),
+        ),
       )
 
     const signature = SafeBuffer.from(sig, "binary").toString("base64")
@@ -266,7 +262,7 @@ const SEA = {
     timestamp: number,
     signature: string,
     publicKey: string,
-    cb?: Callback<boolean>
+    cb?: Callback<boolean>,
   ): Promise<boolean> => {
     if (!publicKey || !timestamp || !signature) {
       if (cb) cb(false)
@@ -281,25 +277,27 @@ const SEA = {
       const key = await utils.subtle.importKey(
         "jwk",
         utils.jwk(publicKey),
-        { name: "ECDSA", namedCurve: "P-256" },
+        {name: "ECDSA", namedCurve: "P-256"},
         false,
-        ["verify"]
+        ["verify"],
       )
 
       const sig = new Uint8Array(SafeBuffer.from(signature, "base64"))
-      const alg = { name: "ECDSA", hash: { name: "SHA-256" } }
+      const alg = {name: "ECDSA", hash: {name: "SHA-256"}}
 
       const isValid = await utils.subtle.verify(
         alg,
         key,
         sig,
-        new Uint8Array(hash)
+        new Uint8Array(hash),
       )
 
       if (cb) cb(isValid)
       return isValid
     } catch (err) {
-      console.log(`error verifying timestamp signature: ${(err as Error).message}`)
+      console.log(
+        `error verifying timestamp signature: ${(err as Error).message}`,
+      )
       if (cb) cb(false)
       return false
     }
@@ -311,13 +309,13 @@ const SEA = {
   work: async (
     data: unknown,
     salt?: unknown,
-    cb?: Callback<{ epriv: string }>
-  ): Promise<{ epriv: string }> => {
+    cb?: Callback<{epriv: string}>,
+  ): Promise<{epriv: string}> => {
     let _cb = cb
     let _salt = salt
 
     if (typeof salt === "function") {
-      _cb = salt as Callback<{ epriv: string }>
+      _cb = salt as Callback<{epriv: string}>
       _salt = undefined
     }
     if (typeof _salt === "undefined") _salt = utils.random(9)
@@ -325,19 +323,19 @@ const SEA = {
     const key = await utils.subtle.importKey(
       "raw",
       new TextEncoder().encode(utils.stringify(data)),
-      { name: "PBKDF2" },
+      {name: "PBKDF2"},
       false,
-      ["deriveBits"]
+      ["deriveBits"],
     )
     const alg = {
       name: "PBKDF2",
       iterations: 100000,
       salt: new TextEncoder().encode(_salt as string),
-      hash: { name: "SHA-256" },
+      hash: {name: "SHA-256"},
     }
     const work = await utils.subtle.deriveBits(alg, key, 512)
     // Use "pair" format so that work can be used as epriv by decrypt
-    const pair = { epriv: SafeBuffer.from(work, "binary").toString("base64") }
+    const pair = {epriv: SafeBuffer.from(work, "binary").toString("base64")}
     if (_cb) _cb(pair)
     return pair
   },
@@ -348,41 +346,40 @@ const SEA = {
   secret: async (
     to: Partial<UserPair> | null,
     from: Partial<UserPair> | null,
-    cb?: Callback<{ epriv: string } | null>
-  ): Promise<{ epriv: string } | null> => {
+    cb?: Callback<{epriv: string} | null>,
+  ): Promise<{epriv: string} | null> => {
     if (!to || !to.epub || !from || !from.epub || !from.epriv) {
       if (cb) cb(null)
       return null
     }
 
-    const alg = { name: "ECDH", namedCurve: "P-256" }
+    const alg = {name: "ECDH", namedCurve: "P-256"}
     const pub = utils.jwk(to.epub)
     const pubKey = await utils.subtle.importKey("jwk", pub, alg, true, [])
     const priv = utils.jwk(from.epub, from.epriv)
     // utils.jwk provides default key_ops but it shouldn't be used here
-    delete (priv as { key_ops?: unknown }).key_ops
+    delete (priv as {key_ops?: unknown}).key_ops
     const derived = await utils.subtle
       .importKey("jwk", priv, alg, false, ["deriveBits"])
       .then(async key => {
         const derivedBits = await utils.subtle.deriveBits(
-          { public: pubKey, name: "ECDH", namedCurve: "P-256" } as never,
+          {public: pubKey, name: "ECDH", namedCurve: "P-256"} as never,
           key,
-          256
+          256,
         )
         const derivedKey = await utils.subtle.importKey(
           "raw",
           new Uint8Array(derivedBits),
-          { name: "AES-GCM", length: 256 },
+          {name: "AES-GCM", length: 256},
           true,
-          ["encrypt", "decrypt"]
+          ["encrypt", "decrypt"],
         )
-        return utils.subtle.exportKey("jwk", derivedKey).then(({ k }) => k!)
+        return utils.subtle.exportKey("jwk", derivedKey).then(({k}) => k!)
       })
     // Use "pair" format so that secret can be used as epriv by encrypt
-    if (cb) cb({ epriv: derived })
-    return { epriv: derived }
+    if (cb) cb({epriv: derived})
+    return {epriv: derived}
   },
 }
 
 export default SEA
-

package/ts/src/store.ts

@@ -18,9 +18,7 @@ import type {
 const isNode = typeof process !== "undefined" && process.versions?.node != null
 
 // Dynamic import for Node.js fs module - won't execute in browser/service worker
-const fs = isNode
-  ? await import(/*webpackIgnore: true*/ "node:fs")
-  : undefined
+const fs = isNode ? await import(/*webpackIgnore: true*/ "node:fs") : undefined
 
 // ASCII character for enquiry
 const enq = String.fromCharCode(5)
@@ -41,39 +39,49 @@ const fileSystem = (opt: StoreOptions): FileSystemInterface => {
 
     return {
       get: (file, cb) => {
-        fs!.readFile(dir + "/" + file, (err: NodeJS.ErrnoException | null, data?: Buffer) => {
-          if (err) {
-            if ((err as { code?: string }).code === "ENOENT") {
-              cb()
-              return
+        fs!.readFile(
+          dir + "/" + file,
+          (err: NodeJS.ErrnoException | null, data?: Buffer) => {
+            if (err) {
+              if ((err as {code?: string}).code === "ENOENT") {
+                cb()
+                return
+              }
+              console.log("fs.readFile error:", err)
             }
-            console.log("fs.readFile error:", err)
-          }
-          const dataStr = data ? data.toString() : undefined
-          cb(err as never, dataStr)
-        })
+            const dataStr = data ? data.toString() : undefined
+            cb(err as never, dataStr)
+          },
+        )
       },
       put: (file, data, cb) => {
         const tmp = file + "." + utils.text.random(9) + ".tmp"
-        fs!.writeFile(tmp, data as string, (err: NodeJS.ErrnoException | null) => {
-          if (err) {
-            console.log("fs.writeFile error:", err)
-            cb(err as never)
-            return
-          }
-          fs!.rename(tmp, dir + "/" + file, cb as never)
-        })
+        fs!.writeFile(
+          tmp,
+          data as string,
+          (err: NodeJS.ErrnoException | null) => {
+            if (err) {
+              console.log("fs.writeFile error:", err)
+              cb(err as never)
+              return
+            }
+            fs!.rename(tmp, dir + "/" + file, cb as never)
+          },
+        )
       },
       list: cb => {
-        fs!.readdir(dir, (err: NodeJS.ErrnoException | null, files?: string[]) => {
-          if (err) {
-            console.log("fs.readdir error:", err)
+        fs!.readdir(
+          dir,
+          (err: NodeJS.ErrnoException | null, files?: string[]) => {
+            if (err) {
+              console.log("fs.readdir error:", err)
+              cb()
+              return
+            }
+            if (files) files.forEach(cb)
             cb()
-            return
-          }
-          if (files) files.forEach(cb)
-          cb()
-        })
+          },
+        )
       },
     }
   }
@@ -122,7 +130,10 @@ const fileSystem = (opt: StoreOptions): FileSystemInterface => {
 
     return {
       get: (file, cb) => {
-        const _get = (file: string, cb: (err?: string | null, data?: string) => void) => {
+        const _get = (
+          file: string,
+          cb: (err?: string | null, data?: string) => void,
+        ) => {
           const tx = db.transaction([dir], "readonly")
           const req = tx.objectStore(dir).get(file)
           req.onerror = () => {
@@ -146,7 +157,7 @@ const fileSystem = (opt: StoreOptions): FileSystemInterface => {
         const _put = (
           file: string,
           data: string,
-          cb: (err?: string | null) => void
+          cb: (err?: string | null) => void,
         ) => {
           const tx = db.transaction([dir], "readwrite")
           const req = tx.objectStore(dir).put(data, file)
@@ -209,11 +220,7 @@ const fileSystem = (opt: StoreOptions): FileSystemInterface => {
 }
 
 export interface StoreInterface {
-  get: (
-    lex: Lex,
-    cb: (err?: string | null, graph?: Graph) => void,
-    _opt?: { secure?: boolean }
-  ) => void
+  get: (lex: Lex, cb: (err?: string | null, graph?: Graph) => void) => void
   put: (graph: Graph, cb: (err?: string | null) => void) => void
 }
 
@@ -227,7 +234,7 @@ const Store = (opt?: StoreOptions): StoreInterface => {
   const radisk = Radisk(options as never)
 
   return {
-    get: (lex, cb, _opt) => {
+    get: (lex, cb) => {
       if (!lex || !utils.obj.is(lex)) {
         cb("lex required")
         return
@@ -237,42 +244,56 @@ const Store = (opt?: StoreOptions): StoreInterface => {
         return
       }
 
-      const opts = _opt || {}
       const soul = lex["#"]
-      const key =
-        !opts.secure && typeof lex["."] === "string" ? lex["."] : ""
+      const key = typeof lex["."] === "string" ? lex["."] : ""
       let node: GraphNode | undefined
       const signatures: Record<string, string> = {}
 
-      const each = (value: EncodedValue, key: string): void => {
-        // Always include userPublicKey for verification, regardless of filter
-        if (key !== utils.userPublicKey && !utils.match(lex["."], key)) return
+      const each = (value: EncodedValue, k: string): void => {
+        if (k !== utils.userPublicKey && !utils.match(lex["."], k)) return
 
-        if (!node) node = { _: { "#": soul, ">": {} } }
-        node[key] = value[0]
-        node._[">"][key] = value[1]
+        if (!node) node = {_: {"#": soul, ">": {}}}
+        node[k] = value[0]
+        node._[">"][k] = value[1]
         // If signature is present, store it in _["s"]
         if (value.length === 3 && value[2]) {
           signatures[value[1].toString()] = value[2]
         }
       }
 
+      // When doing a targeted property lookup, also fetch userPublicKey in
+      // parallel so ham.js can verify signatures regardless of secure mode.
+      // Full-soul scans (key="") already surface it via Radix.map.
+      const needsPubKey = key !== "" && key !== utils.userPublicKey
+      let pending = needsPubKey ? 2 : 1
+      let cbErr: string | null = null
+      const finish = (err: string | null | undefined): void => {
+        if (err && !cbErr) cbErr = err
+        if (--pending > 0) return
+        const graph: Graph = {[soul]: node!}
+        if (node && Object.keys(signatures).length > 0) {
+          node._["s"] = signatures
+        }
+        cb(cbErr, graph)
+      }
+
       radisk(soul + enq + key, (err, value) => {
-        let graph: Graph | undefined
         if (utils.obj.is(value)) {
           Radix.map(value as never, each)
           if (!node) each(value as never, key)
-          graph = { [soul]: node! }
         } else if (value) {
           each(value as EncodedValue, key)
-          graph = { [soul]: node! }
-        }
-        // Only add _["s"] if we found any signatures
-        if (graph && graph[soul] && Object.keys(signatures).length > 0) {
-          graph[soul]._["s"] = signatures
         }
-        cb(err, graph)
+        finish(err)
       })
+
+      if (needsPubKey) {
+        radisk(soul + enq + utils.userPublicKey, (err, value) => {
+          if (value && !utils.obj.is(value))
+            each(value as EncodedValue, utils.userPublicKey)
+          finish(err)
+        })
+      }
     },
     put: (graph, cb) => {
       if (!graph) {
@@ -307,9 +328,7 @@ const Store = (opt?: StoreOptions): StoreInterface => {
           const value = node[key]!
           const state = node._[">"][key]!
           const sig = node._["s"] && node._["s"][state]
-          const data: EncodedValue = sig
-            ? [value, state, sig]
-            : [value, state]
+          const data: EncodedValue = sig ? [value, state, sig] : [value, state]
           radisk(soul + enq + key, data, ack)
         })
       })
@@ -318,4 +337,3 @@ const Store = (opt?: StoreOptions): StoreInterface => {
 }
 
 export default Store
-