@ocap/mcrypto 1.29.22 → 1.29.23

package/esm/webauthn.mjs

@@ -0,0 +1,512 @@
+import { __exportAll } from "./_virtual/rolldown_runtime.mjs";
+import { sha256, sha384, sha512 } from "@noble/hashes/sha2.js";
+import { secp256k1 } from "@noble/curves/secp256k1";
+import { p256 } from "@noble/curves/p256";
+import { p384 } from "@noble/curves/p384";
+import { p521 } from "@noble/curves/p521";
+
+//#region src/webauthn.ts
+/**
+* Lightweight WebAuthn/passkey utilities — replaces @simplewebauthn/server/helpers.
+*
+* Provides COSE constants, CBOR-based credential public key decoding, base64url helpers,
+* authenticator data parsing, and ECDSA signature verification using @noble/curves.
+*
+* Designed for environments sensitive to bundle size (e.g. Cloudflare Workers).
+*/
+var webauthn_exports = /* @__PURE__ */ __exportAll({
+	COSEALG: () => COSEALG,
+	COSECRV: () => COSECRV,
+	COSEKEYS: () => COSEKEYS,
+	COSEKTY: () => COSEKTY,
+	cose: () => cose,
+	decodeClientDataJSON: () => decodeClientDataJSON,
+	generateAuthenticationOptions: () => generateAuthenticationOptions,
+	generateChallenge: () => generateChallenge,
+	generateRegistrationOptions: () => generateRegistrationOptions,
+	isoBase64URL: () => isoBase64URL,
+	isoCBOR: () => isoCBOR,
+	isoUint8Array: () => isoUint8Array,
+	parseAuthenticatorData: () => parseAuthenticatorData,
+	toHash: () => toHash,
+	verifyRegistrationResponse: () => verifyRegistrationResponse,
+	verifySignature: () => verifySignature
+});
+const COSEKEYS = {
+	kty: 1,
+	alg: 3,
+	crv: -1,
+	x: -2,
+	y: -3,
+	n: -1,
+	e: -2
+};
+const COSEKTY = {
+	OKP: 1,
+	EC2: 2,
+	RSA: 3
+};
+const COSEALG = {
+	ES256: -7,
+	EdDSA: -8,
+	ES384: -35,
+	ES512: -36,
+	PS256: -37,
+	PS384: -38,
+	PS512: -39,
+	ES256K: -47,
+	RS256: -257,
+	RS384: -258,
+	RS512: -259,
+	RS1: -65535
+};
+const COSECRV = {
+	P256: 1,
+	P384: 2,
+	P521: 3,
+	ED25519: 6,
+	SECP256K1: 8
+};
+const cose = {
+	COSEKEYS,
+	COSEKTY,
+	COSEALG,
+	COSECRV
+};
+const isoBase64URL = {
+	toBuffer(base64url) {
+		const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+		const binary = atob(padded);
+		const bytes = new Uint8Array(binary.length);
+		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+		return bytes;
+	},
+	fromBuffer(buffer, to = "base64url") {
+		const normalized = new Uint8Array(buffer);
+		let binary = "";
+		for (let i = 0; i < normalized.length; i++) binary += String.fromCharCode(normalized[i]);
+		const base64 = btoa(binary);
+		if (to === "base64") return base64;
+		return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+	},
+	toUTF8String(base64url) {
+		const bytes = isoBase64URL.toBuffer(base64url);
+		return new TextDecoder().decode(bytes);
+	},
+	fromUTF8String(utf8String) {
+		const bytes = new TextEncoder().encode(utf8String);
+		return isoBase64URL.fromBuffer(bytes);
+	}
+};
+const isoUint8Array = {
+	concat(arrays) {
+		const totalLength = arrays.reduce((sum, a) => sum + a.length, 0);
+		const result = new Uint8Array(totalLength);
+		let offset = 0;
+		for (const arr of arrays) {
+			result.set(arr, offset);
+			offset += arr.length;
+		}
+		return result;
+	},
+	areEqual(a, b) {
+		if (a.length !== b.length) return false;
+		return a.every((v, i) => v === b[i]);
+	},
+	toDataView(array) {
+		return new DataView(array.buffer, array.byteOffset, array.length);
+	},
+	fromHex(hex) {
+		const bytes = new Uint8Array(hex.length / 2);
+		for (let i = 0; i < hex.length; i += 2) bytes[i / 2] = Number.parseInt(hex.substring(i, i + 2), 16);
+		return bytes;
+	}
+};
+function decodeCBORInternal(data, offset) {
+	const major = data[offset] >> 5;
+	const additional = data[offset] & 31;
+	offset++;
+	let length;
+	if (additional < 24) length = additional;
+	else if (additional === 24) length = data[offset++];
+	else if (additional === 25) {
+		length = data[offset] << 8 | data[offset + 1];
+		offset += 2;
+	} else if (additional === 26) {
+		length = data[offset] << 24 | data[offset + 1] << 16 | data[offset + 2] << 8 | data[offset + 3];
+		offset += 4;
+	} else throw new Error(`CBOR: unsupported additional info ${additional}`);
+	switch (major) {
+		case 0: return [length, offset];
+		case 1: return [-1 - length, offset];
+		case 2: return [data.slice(offset, offset + length), offset + length];
+		case 3: return [new TextDecoder().decode(data.slice(offset, offset + length)), offset + length];
+		case 4: {
+			const arr = [];
+			for (let i = 0; i < length; i++) {
+				const [value, newOffset] = decodeCBORInternal(data, offset);
+				arr.push(value);
+				offset = newOffset;
+			}
+			return [arr, offset];
+		}
+		case 5: {
+			const map = /* @__PURE__ */ new Map();
+			for (let i = 0; i < length; i++) {
+				const [key, keyOffset] = decodeCBORInternal(data, offset);
+				const [value, valueOffset] = decodeCBORInternal(data, keyOffset);
+				map.set(key, value);
+				offset = valueOffset;
+			}
+			return [map, offset];
+		}
+		default: throw new Error(`CBOR: unsupported major type ${major}`);
+	}
+}
+function encodeCBORValue(value) {
+	if (value instanceof Uint8Array || value instanceof ArrayBuffer) {
+		const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+		return [...encodeCBORHead(2, bytes.length), ...bytes];
+	}
+	if (typeof value === "number") {
+		if (value >= 0) return encodeCBORHead(0, value);
+		return encodeCBORHead(1, -1 - value);
+	}
+	if (typeof value === "string") {
+		const encoded = new TextEncoder().encode(value);
+		return [...encodeCBORHead(3, encoded.length), ...encoded];
+	}
+	if (Array.isArray(value)) {
+		const items = value.flatMap((v) => encodeCBORValue(v));
+		return [...encodeCBORHead(4, value.length), ...items];
+	}
+	if (value instanceof Map) {
+		const items = [];
+		for (const [k, v] of value) items.push(...encodeCBORValue(k), ...encodeCBORValue(v));
+		return [...encodeCBORHead(5, value.size), ...items];
+	}
+	throw new Error(`CBOR encode: unsupported type ${typeof value}`);
+}
+function encodeCBORHead(major, length) {
+	const prefix = major << 5;
+	if (length < 24) return [prefix | length];
+	if (length < 256) return [prefix | 24, length];
+	if (length < 65536) return [
+		prefix | 25,
+		length >> 8 & 255,
+		length & 255
+	];
+	return [
+		prefix | 26,
+		length >> 24 & 255,
+		length >> 16 & 255,
+		length >> 8 & 255,
+		length & 255
+	];
+}
+const isoCBOR = {
+	decodeFirst(input) {
+		const [value] = decodeCBORInternal(new Uint8Array(input), 0);
+		return value;
+	},
+	encode(input) {
+		return new Uint8Array(encodeCBORValue(input));
+	}
+};
+async function toHash(data, algorithm = COSEALG.ES256) {
+	const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
+	if ([
+		COSEALG.ES256,
+		COSEALG.PS256,
+		COSEALG.RS256,
+		COSEALG.ES256K
+	].includes(algorithm)) return sha256(input);
+	if ([
+		COSEALG.ES384,
+		COSEALG.PS384,
+		COSEALG.RS384
+	].includes(algorithm)) return sha384(input);
+	if ([
+		COSEALG.ES512,
+		COSEALG.PS512,
+		COSEALG.RS512,
+		COSEALG.EdDSA
+	].includes(algorithm)) return sha512(input);
+	return sha256(input);
+}
+function decodeClientDataJSON(data) {
+	return JSON.parse(isoBase64URL.toUTF8String(data));
+}
+function parseAuthenticatorData(authData) {
+	if (authData.byteLength < 37) throw new Error(`Authenticator data was ${authData.byteLength} bytes, expected at least 37 bytes`);
+	let pointer = 0;
+	const dataView = isoUint8Array.toDataView(authData);
+	const rpIdHash = authData.slice(pointer, pointer += 32);
+	const flagsBuf = authData.slice(pointer, pointer += 1);
+	const flagsInt = flagsBuf[0];
+	const flags = {
+		up: !!(flagsInt & 1),
+		uv: !!(flagsInt & 4),
+		be: !!(flagsInt & 8),
+		bs: !!(flagsInt & 16),
+		at: !!(flagsInt & 64),
+		ed: !!(flagsInt & 128),
+		flagsInt
+	};
+	const counterBuf = authData.slice(pointer, pointer + 4);
+	const counter = dataView.getUint32(pointer, false);
+	pointer += 4;
+	let aaguid;
+	let credentialID;
+	let credentialPublicKey;
+	if (flags.at) {
+		aaguid = authData.slice(pointer, pointer += 16);
+		const credIDLen = dataView.getUint16(pointer);
+		pointer += 2;
+		credentialID = authData.slice(pointer, pointer += credIDLen);
+		const firstDecoded = isoCBOR.decodeFirst(authData.slice(pointer));
+		const firstEncoded = isoCBOR.encode(firstDecoded);
+		credentialPublicKey = firstEncoded;
+		pointer += firstEncoded.byteLength;
+	}
+	let extensionsData;
+	let extensionsDataBuffer;
+	if (flags.ed) {
+		const firstDecoded = isoCBOR.decodeFirst(authData.slice(pointer));
+		extensionsDataBuffer = isoCBOR.encode(firstDecoded);
+		extensionsData = firstDecoded;
+		pointer += extensionsDataBuffer.byteLength;
+	}
+	return {
+		rpIdHash,
+		flagsBuf,
+		flags,
+		counter,
+		counterBuf,
+		aaguid,
+		credentialID,
+		credentialPublicKey,
+		extensionsData,
+		extensionsDataBuffer
+	};
+}
+function getCurveForCrv(crv) {
+	switch (crv) {
+		case COSECRV.P256: return {
+			curve: p256,
+			hash: sha256,
+			componentLen: 32
+		};
+		case COSECRV.P384: return {
+			curve: p384,
+			hash: sha384,
+			componentLen: 48
+		};
+		case COSECRV.P521: return {
+			curve: p521,
+			hash: sha512,
+			componentLen: 66
+		};
+		case COSECRV.SECP256K1: return {
+			curve: secp256k1,
+			hash: sha256,
+			componentLen: 32
+		};
+		default: throw new Error(`Unsupported COSE curve: ${crv}`);
+	}
+}
+async function verifySignature(opts) {
+	const { signature, data, credentialPublicKey } = opts;
+	const coseKey = isoCBOR.decodeFirst(credentialPublicKey);
+	const kty = coseKey.get(COSEKEYS.kty);
+	if (kty !== COSEKTY.EC2) throw new Error(`Unsupported COSE key type: ${kty} (only EC2 is supported)`);
+	const crv = coseKey.get(COSEKEYS.crv);
+	const x = coseKey.get(COSEKEYS.x);
+	const y = coseKey.get(COSEKEYS.y);
+	if (!x || !y) throw new Error("COSE public key missing x or y coordinate");
+	const { curve, hash, componentLen } = getCurveForCrv(crv);
+	const pubKeyBytes = new Uint8Array(1 + componentLen * 2);
+	pubKeyBytes[0] = 4;
+	pubKeyBytes.set(x.length <= componentLen ? x : x.slice(x.length - componentLen), 1 + (componentLen - x.length));
+	pubKeyBytes.set(y.length <= componentLen ? y : y.slice(y.length - componentLen), 1 + componentLen + (componentLen - y.length));
+	const msgHash = hash(data);
+	try {
+		const sig = curve.Signature.fromDER(signature);
+		return curve.verify(sig, msgHash, pubKeyBytes);
+	} catch {
+		return false;
+	}
+}
+function generateChallenge() {
+	return crypto.getRandomValues(new Uint8Array(32));
+}
+function convertAAGUIDToString(aaguid) {
+	const hex = Array.from(aaguid, (b) => b.toString(16).padStart(2, "0")).join("");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+async function matchExpectedRPID(rpIdHash, expectedRPIDs) {
+	for (const rpID of expectedRPIDs) {
+		const expectedHash = sha256(new TextEncoder().encode(rpID));
+		if (isoUint8Array.areEqual(rpIdHash, expectedHash)) return rpID;
+	}
+	throw new Error(`Unexpected RP ID hash, expected one of: ${expectedRPIDs.join(", ")}`);
+}
+function parseBackupFlags(flags) {
+	const credentialDeviceType = flags.be ? "multiDevice" : "singleDevice";
+	const credentialBackedUp = flags.bs;
+	if (!flags.be && flags.bs) throw new Error("Credential indicates backup state but not backup eligibility");
+	return {
+		credentialDeviceType,
+		credentialBackedUp
+	};
+}
+async function generateRegistrationOptions(options) {
+	const { rpName, rpID, userName, userID, challenge = generateChallenge(), userDisplayName = "", timeout = 6e4, attestationType = "none", excludeCredentials = [], authenticatorSelection = {
+		residentKey: "preferred",
+		userVerification: "preferred"
+	}, extensions, supportedAlgorithmIDs = [
+		-8,
+		-7,
+		-257
+	] } = options;
+	const pubKeyCredParams = supportedAlgorithmIDs.map((id) => ({
+		alg: id,
+		type: "public-key"
+	}));
+	if (authenticatorSelection.residentKey === void 0) {
+		if (authenticatorSelection.requireResidentKey) authenticatorSelection.residentKey = "required";
+	} else authenticatorSelection.requireResidentKey = authenticatorSelection.residentKey === "required";
+	let _challenge = challenge;
+	if (typeof _challenge === "string") _challenge = new TextEncoder().encode(_challenge);
+	let _userID = userID;
+	if (!_userID) _userID = crypto.getRandomValues(new Uint8Array(32));
+	return {
+		challenge: isoBase64URL.fromBuffer(_challenge),
+		rp: {
+			name: rpName,
+			id: rpID
+		},
+		user: {
+			id: isoBase64URL.fromBuffer(_userID),
+			name: userName,
+			displayName: userDisplayName
+		},
+		pubKeyCredParams,
+		timeout,
+		attestation: attestationType,
+		excludeCredentials: excludeCredentials.map((cred) => ({
+			...cred,
+			id: cred.id.replace(/=+$/, ""),
+			type: "public-key"
+		})),
+		authenticatorSelection,
+		extensions: {
+			...extensions,
+			credProps: true
+		}
+	};
+}
+async function generateAuthenticationOptions(options) {
+	const { rpID, allowCredentials, challenge = generateChallenge(), timeout = 6e4, userVerification = "preferred", extensions } = options;
+	let _challenge = challenge;
+	if (typeof _challenge === "string") _challenge = new TextEncoder().encode(_challenge);
+	return {
+		rpId: rpID,
+		challenge: isoBase64URL.fromBuffer(_challenge),
+		allowCredentials: allowCredentials?.map((cred) => ({
+			...cred,
+			id: cred.id.replace(/=+$/, ""),
+			type: "public-key"
+		})),
+		timeout,
+		userVerification,
+		extensions
+	};
+}
+async function verifyRegistrationResponse(options) {
+	const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = [
+		-8,
+		-7,
+		-36,
+		-37,
+		-38,
+		-39,
+		-257,
+		-258,
+		-259,
+		-65535
+	] } = options;
+	const { id, rawId, type: credentialType, response: attestationResponse } = response;
+	if (!id) throw new Error("Missing credential ID");
+	if (id !== rawId) throw new Error("Credential ID was not base64url-encoded");
+	if (credentialType !== "public-key") throw new Error(`Unexpected credential type ${credentialType}, expected "public-key"`);
+	const clientDataJSON = decodeClientDataJSON(attestationResponse.clientDataJSON);
+	const { type, origin, challenge } = clientDataJSON;
+	if (Array.isArray(expectedType)) {
+		if (!expectedType.includes(type)) throw new Error(`Unexpected registration response type "${type}", expected one of: ${expectedType.join(", ")}`);
+	} else if (expectedType) {
+		if (type !== expectedType) throw new Error(`Unexpected registration response type "${type}", expected "${expectedType}"`);
+	} else if (type !== "webauthn.create") throw new Error(`Unexpected registration response type: ${type}`);
+	if (typeof expectedChallenge === "function") {
+		if (!await expectedChallenge(challenge)) throw new Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`);
+	} else if (challenge !== expectedChallenge) throw new Error(`Unexpected registration response challenge "${challenge}", expected "${expectedChallenge}"`);
+	if (Array.isArray(expectedOrigin)) {
+		if (!expectedOrigin.includes(origin)) throw new Error(`Unexpected registration response origin "${origin}", expected one of: ${expectedOrigin.join(", ")}`);
+	} else if (origin !== expectedOrigin) throw new Error(`Unexpected registration response origin "${origin}", expected "${expectedOrigin}"`);
+	const attestationObject = isoBase64URL.toBuffer(attestationResponse.attestationObject);
+	const decodedAttestationObject = isoCBOR.decodeFirst(attestationObject);
+	const fmt = decodedAttestationObject.get("fmt");
+	const authData = decodedAttestationObject.get("authData");
+	const attStmt = decodedAttestationObject.get("attStmt");
+	const { aaguid, rpIdHash, flags, credentialID, counter, credentialPublicKey, extensionsData } = parseAuthenticatorData(authData);
+	let matchedRPID;
+	if (expectedRPID) matchedRPID = await matchExpectedRPID(rpIdHash, Array.isArray(expectedRPID) ? expectedRPID : [expectedRPID]);
+	if (requireUserPresence && !flags.up) throw new Error("User presence was required, but user was not present");
+	if (requireUserVerification && !flags.uv) throw new Error("User verification was required, but user could not be verified");
+	if (!credentialID) throw new Error("No credential ID was provided by authenticator");
+	if (!credentialPublicKey) throw new Error("No public key was provided by authenticator");
+	if (!aaguid) throw new Error("No AAGUID was present during registration");
+	const alg = isoCBOR.decodeFirst(credentialPublicKey).get(COSEKEYS.alg);
+	if (typeof alg !== "number") throw new Error("Credential public key was missing numeric alg");
+	if (!supportedAlgorithmIDs.includes(alg)) throw new Error(`Unexpected public key alg "${alg}", expected one of "${supportedAlgorithmIDs.join(", ")}"`);
+	let verified = false;
+	if (fmt === "none") {
+		if (attStmt.size > 0) throw new Error("None attestation had unexpected attestation statement");
+		verified = true;
+	} else if (fmt === "packed" && attStmt.size === 2 && attStmt.has("alg") && attStmt.has("sig")) {
+		const clientDataHash = await toHash(isoBase64URL.toBuffer(attestationResponse.clientDataJSON));
+		const signedData = isoUint8Array.concat([authData, clientDataHash]);
+		verified = await verifySignature({
+			signature: attStmt.get("sig"),
+			data: signedData,
+			credentialPublicKey
+		});
+	} else throw new Error(`Unsupported attestation format: "${fmt}". Only "none" and "packed" (self-attestation) are supported.`);
+	if (!verified) return { verified: false };
+	const { credentialDeviceType, credentialBackedUp } = parseBackupFlags(flags);
+	return {
+		verified: true,
+		registrationInfo: {
+			fmt,
+			aaguid: convertAAGUIDToString(aaguid),
+			credential: {
+				id: isoBase64URL.fromBuffer(credentialID),
+				publicKey: credentialPublicKey,
+				counter,
+				transports: response.response.transports
+			},
+			credentialType: "public-key",
+			attestationObject,
+			userVerified: flags.uv,
+			credentialDeviceType,
+			credentialBackedUp,
+			origin: clientDataJSON.origin,
+			rpID: matchedRPID,
+			authenticatorExtensionResults: extensionsData
+		}
+	};
+}
+
+//#endregion
+export { COSEALG, COSECRV, COSEKEYS, COSEKTY, cose, decodeClientDataJSON, generateAuthenticationOptions, generateChallenge, generateRegistrationOptions, isoBase64URL, isoCBOR, isoUint8Array, parseAuthenticatorData, toHash, verifyRegistrationResponse, verifySignature, webauthn_exports };

package/lib/_virtual/rolldown_runtime.cjs

@@ -5,6 +5,19 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __exportAll = (all, symbols) => {
+	let target = {};
+	for (var name in all) {
+		__defProp(target, name, {
+			get: all[name],
+			enumerable: true
+		});
+	}
+	if (symbols) {
+		__defProp(target, Symbol.toStringTag, { value: "Module" });
+	}
+	return target;
+};
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") {
 		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
@@ -26,4 +39,5 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 //#endregion
 
+exports.__exportAll = __exportAll;
 exports.__toESM = __toESM;

package/lib/index.cjs

@@ -6,6 +6,7 @@ const require_hasher_sha3 = require('./hasher/sha3.cjs');
 const require_signer_ed25519 = require('./signer/ed25519.cjs');
 const require_signer_secp256k1 = require('./signer/secp256k1.cjs');
 const require_signer_ethereum = require('./signer/ethereum.cjs');
+const require_webauthn = require('./webauthn.cjs');
 const require_signer_passkey = require('./signer/passkey.cjs');
 let randombytes = require("randombytes");
 randombytes = require_rolldown_runtime.__toESM(randombytes);
@@ -189,4 +190,10 @@ exports.getHasher = getHasher;
 exports.getRandomBytes = getRandomBytes;
 exports.getSigner = getSigner;
 exports.toTxHash = toTxHash;
-exports.types = types;
+exports.types = types;
+Object.defineProperty(exports, 'webauthn', {
+  enumerable: true,
+  get: function () {
+    return require_webauthn.webauthn_exports;
+  }
+});

package/lib/index.d.cts

@@ -5,6 +5,7 @@ import { Ed25519Signer } from "./signer/ed25519.cjs";
 import { Secp256k1Signer } from "./signer/secp256k1.cjs";
 import { EthereumSigner } from "./signer/ethereum.cjs";
 import { PasskeySigner } from "./signer/passkey.cjs";
+import { webauthn_d_exports } from "./webauthn.cjs";
 import { BytesType, EncodingType, KeyPairType } from "@ocap/util";
 import { LiteralUnion } from "type-fest";
 
@@ -238,4 +239,4 @@ declare function getRandomBytes(length: number, encoding?: 'Uint8Array'): Uint8A
 declare function getRandomBytes(length: number, encoding?: EncodingType): BytesType;
 declare const toTxHash: (buf: Buffer | Uint8Array) => string;
 //#endregion
-export { AddressType, HashFnType, HashType, Hasher, KeyType, RoleType, Signer, SignerType, getHasher, getRandomBytes, getSigner, toTxHash, types };
+export { AddressType, HashFnType, HashType, Hasher, KeyType, RoleType, Signer, SignerType, getHasher, getRandomBytes, getSigner, toTxHash, types, webauthn_d_exports as webauthn };

package/lib/signer/ethereum.cjs

@@ -2,14 +2,20 @@ Object.defineProperty(exports, '__esModule', { value: true });
 const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
 const require_signer_secp256k1 = require('./secp256k1.cjs');
 let _ocap_util = require("@ocap/util");
-let eth_lib_lib_account = require("eth-lib/lib/account");
-eth_lib_lib_account = require_rolldown_runtime.__toESM(eth_lib_lib_account);
-let eth_lib_lib_hash = require("eth-lib/lib/hash");
-eth_lib_lib_hash = require_rolldown_runtime.__toESM(eth_lib_lib_hash);
+let _noble_hashes_sha3_js = require("@noble/hashes/sha3.js");
+let _noble_hashes_utils_js = require("@noble/hashes/utils.js");
+let _noble_curves_secp256k1 = require("@noble/curves/secp256k1");
 
 //#region src/signer/ethereum.ts
+function toChecksumAddress(address) {
+	const addr = address.slice(2).toLowerCase();
+	const hash = (0, _noble_hashes_utils_js.bytesToHex)((0, _noble_hashes_sha3_js.keccak_256)(Buffer.from(addr)));
+	let result = "0x";
+	for (let i = 0; i < 40; i++) result += Number.parseInt(hash[i], 16) > 7 ? addr[i].toUpperCase() : addr[i];
+	return result;
+}
 /**
-* Signer implementation for secp256k1, based on `elliptic`, and ethereum compatible
+* Signer implementation for secp256k1, based on `@noble/curves`, and ethereum compatible
 *
 * @class EthereumSigner
 */
@@ -20,17 +26,25 @@ var EthereumSigner = class extends require_signer_secp256k1.Secp256k1Signer {
 	}
 	ethHash(data) {
 		const messageBytes = (0, _ocap_util.hexToBytes)((0, _ocap_util.isHexStrict)(data) ? data : (0, _ocap_util.utf8ToHex)(data));
-		const messageBuffer = Buffer.from(messageBytes);
 		const preamble = `\x19Ethereum Signed Message:\n${messageBytes.length}`;
-		const preambleBuffer = Uint8Array.from(Buffer.from(preamble));
-		const ethMessage = Buffer.concat([preambleBuffer, Uint8Array.from(messageBuffer)]);
-		return eth_lib_lib_hash.default.keccak256s(ethMessage);
+		const ethMessage = Buffer.concat([Buffer.from(preamble), Buffer.from(messageBytes)]);
+		return `0x${(0, _noble_hashes_utils_js.bytesToHex)((0, _noble_hashes_sha3_js.keccak_256)(new Uint8Array(ethMessage)))}`;
 	}
 	ethSign(data, privateKey) {
-		return eth_lib_lib_account.default.sign(data, privateKey);
+		const msgHash = Buffer.from(data.slice(2), "hex");
+		const sk = Buffer.from(privateKey.slice(2), "hex");
+		const sig = _noble_curves_secp256k1.secp256k1.sign(msgHash, sk);
+		const v = (27 + sig.recovery).toString(16).padStart(2, "0");
+		return `0x${sig.toCompactHex()}${v}`;
 	}
 	ethRecover(data, signature) {
-		return eth_lib_lib_account.default.recover(data, signature);
+		const sigHex = signature.slice(2);
+		const v = Number.parseInt(sigHex.slice(128, 130), 16);
+		const recovery = v < 2 ? v : 1 - v % 2;
+		const sig = _noble_curves_secp256k1.secp256k1.Signature.fromCompact(sigHex.slice(0, 128)).addRecoveryBit(recovery);
+		const msgHash = Buffer.from(data.slice(2), "hex");
+		const pubKeyHex = sig.recoverPublicKey(msgHash).toHex(false).slice(2);
+		return toChecksumAddress(`0x${(0, _noble_hashes_utils_js.bytesToHex)((0, _noble_hashes_sha3_js.keccak_256)(Buffer.from(pubKeyHex, "hex"))).slice(-40)}`);
 	}
 };
 var ethereum_default = new EthereumSigner();

package/lib/signer/ethereum.d.cts

@@ -3,7 +3,7 @@ import { Secp256k1Signer } from "./secp256k1.cjs";
 //#region src/signer/ethereum.d.ts
 
 /**
- * Signer implementation for secp256k1, based on `elliptic`, and ethereum compatible
+ * Signer implementation for secp256k1, based on `@noble/curves`, and ethereum compatible
  *
  * @class EthereumSigner
  */

package/lib/signer/passkey.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
 const require_protocols_signer = require('../protocols/signer.cjs');
+const require_webauthn = require('../webauthn.cjs');
 let _ocap_util = require("@ocap/util");
-let _simplewebauthn_server_helpers = require("@simplewebauthn/server/helpers");
 
 //#region src/signer/passkey.ts
 /**
-* Signer implementation for passkey, based on `@simplewebauthn/server`
+* Signer implementation for passkey, based on `@noble/curves`
 * Since passkey supports only verification, we do not need to implement the sign method
 * And passkeys can used multiple algorithms, we do not need to implement the algorithm selection
 *
@@ -34,11 +34,11 @@ var PasskeySigner = class extends require_protocols_signer.default {
 		const parsed = JSON.parse(extra);
 		if (!parsed.authenticatorData || !parsed.clientDataJSON) throw new Error("extra.authenticatorData or extra.clientDataJSON is required for passkey signature verification");
 		const authDataBuffer = (0, _ocap_util.toBuffer)((0, _ocap_util.fromBase64)(parsed.authenticatorData));
-		const clientDataHash = await (0, _simplewebauthn_server_helpers.toHash)(_simplewebauthn_server_helpers.isoBase64URL.toBuffer(parsed.clientDataJSON));
-		if ((0, _simplewebauthn_server_helpers.decodeClientDataJSON)(parsed.clientDataJSON).challenge !== (0, _ocap_util.toBase64)(challenge)) throw new Error("challenge mismatch for passkey signature");
-		return (0, _simplewebauthn_server_helpers.verifySignature)({
-			signature: _simplewebauthn_server_helpers.isoBase64URL.toBuffer(typeof signature === "string" ? signature : (0, _ocap_util.toBase64)(signature)),
-			data: _simplewebauthn_server_helpers.isoUint8Array.concat([Uint8Array.from(authDataBuffer), clientDataHash]),
+		const clientDataHash = await require_webauthn.toHash(require_webauthn.isoBase64URL.toBuffer(parsed.clientDataJSON));
+		if (require_webauthn.decodeClientDataJSON(parsed.clientDataJSON).challenge !== (0, _ocap_util.toBase64)(challenge)) throw new Error("challenge mismatch for passkey signature");
+		return require_webauthn.verifySignature({
+			signature: require_webauthn.isoBase64URL.toBuffer(typeof signature === "string" ? signature : (0, _ocap_util.toBase64)(signature)),
+			data: require_webauthn.isoUint8Array.concat([Uint8Array.from(authDataBuffer), clientDataHash]),
 			credentialPublicKey: (0, _ocap_util.toUint8Array)(pk)
 		});
 	}

package/lib/signer/passkey.d.cts

@@ -4,7 +4,7 @@ import { BytesType, EncodingType, KeyPairType } from "@ocap/util";
 //#region src/signer/passkey.d.ts
 
 /**
- * Signer implementation for passkey, based on `@simplewebauthn/server`
+ * Signer implementation for passkey, based on `@noble/curves`
  * Since passkey supports only verification, we do not need to implement the sign method
  * And passkeys can used multiple algorithms, we do not need to implement the algorithm selection
  *