@oma3/omatrust 0.1.0-alpha.1 → 0.1.0-alpha.11

package/dist/identity/index.js

@@ -1,4 +1,5 @@
 import { keccak256, toUtf8Bytes, isAddress, getAddress, sha256 } from 'ethers';
+import { base64url, calculateJwkThumbprint } from 'jose';
 import canonicalize from 'canonicalize';
 
 // src/identity/did.ts
@@ -21,6 +22,11 @@ function assertString(value, name, code = "INVALID_INPUT") {
     throw new OmaTrustError(code, `${name} must be a non-empty string`, { value });
   }
 }
+function assertObject(value, name, code = "INVALID_INPUT") {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new OmaTrustError(code, `${name} must be an object`, { value });
+  }
+}
 
 // src/identity/caip.ts
 var CAIP_10_REGEX = /^(?<namespace>[a-z0-9-]+):(?<reference>[a-zA-Z0-9-]+):(?<address>.+)$/;
@@ -91,7 +97,7 @@ function extractDidIdentifier(did) {
 }
 function normalizeDomain(domain) {
   assertString(domain, "domain", "INVALID_DID");
-  return domain.trim().toLowerCase().replace(/\.$/, "");
+  return domain.trim().toLowerCase().replace(/\.$/, "").replace(/^www\./, "");
 }
 function normalizeDidWeb(input) {
   assertString(input, "input", "INVALID_DID");
@@ -167,6 +173,8 @@ function normalizeDid(input) {
       return normalizeDidHandle(trimmed);
     case "key":
       return normalizeDidKey(trimmed);
+    case "jwk":
+      return normalizeDidJwk(trimmed);
     default:
       return trimmed;
   }
@@ -270,6 +278,524 @@ function extractAddressFromDid(identifier) {
   }
   throw new OmaTrustError("INVALID_DID", "Unsupported identifier format", { identifier });
 }
+var CAIP2_NAMESPACE_REGEX = /^[a-z0-9-]{3,8}$/;
+var BASE64URL_REGEX = /^[A-Za-z0-9_-]+$/;
+var VALID_JWK_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+function isPrivateKeyDid(did) {
+  return validatePrivateKeyDid(did).valid;
+}
+function validatePrivateKeyDid(did) {
+  if (typeof did !== "string" || did.trim().length === 0) {
+    return { valid: false, method: null, error: "DID must be a non-empty string" };
+  }
+  const trimmed = did.trim();
+  const method = extractDidMethod(trimmed);
+  switch (method) {
+    case "pkh":
+      return validateDidPkh(trimmed);
+    case "jwk":
+      return validateDidJwk(trimmed);
+    default:
+      return {
+        valid: false,
+        method: null,
+        error: method ? `DID method "${method}" is not a recognized private-key method` : "Invalid DID format"
+      };
+  }
+}
+function validateDidPkh(did) {
+  const parts = did.split(":");
+  if (parts.length !== 5) {
+    return {
+      valid: false,
+      method: "pkh",
+      error: `did:pkh must have exactly 5 colon-separated parts, got ${parts.length}`
+    };
+  }
+  const [, , namespace, chainId, address] = parts;
+  if (!namespace) {
+    return { valid: false, method: "pkh", error: "Missing namespace" };
+  }
+  if (!CAIP2_NAMESPACE_REGEX.test(namespace)) {
+    return {
+      valid: false,
+      method: "pkh",
+      error: `Invalid CAIP-2 namespace "${namespace}" (must be 3-8 lowercase alphanumeric/hyphen chars)`
+    };
+  }
+  if (!chainId) {
+    return { valid: false, method: "pkh", error: "Missing chain ID (reference)" };
+  }
+  if (!address) {
+    return { valid: false, method: "pkh", error: "Missing address" };
+  }
+  if (namespace === "eip155") {
+    if (!/^\d+$/.test(chainId)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid eip155 chain ID "${chainId}" (must be numeric)`
+      };
+    }
+    if (!isAddress(address)) {
+      return {
+        valid: false,
+        method: "pkh",
+        error: `Invalid EVM address "${address}" (must be 0x + 40 hex chars)`
+      };
+    }
+  }
+  return { valid: true, method: "pkh" };
+}
+function validateDidJwk(did) {
+  const parts = did.split(":");
+  if (parts.length !== 3) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: `did:jwk must have exactly 3 colon-separated parts, got ${parts.length}`
+    };
+  }
+  const [, , encoded] = parts;
+  if (!encoded || encoded.length === 0) {
+    return { valid: false, method: "jwk", error: "Missing base64url-encoded JWK identifier" };
+  }
+  if (!BASE64URL_REGEX.test(encoded)) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: "Identifier contains invalid base64url characters"
+    };
+  }
+  let decoded;
+  try {
+    const bytes = base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    return { valid: false, method: "jwk", error: "Failed to base64url-decode identifier" };
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    return { valid: false, method: "jwk", error: "Decoded identifier is not valid JSON" };
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, method: "jwk", error: "Decoded JWK must be a JSON object" };
+  }
+  const kty = jwk.kty;
+  if (typeof kty !== "string" || !VALID_JWK_KTY.has(kty)) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: `Invalid or missing kty field (must be one of: EC, OKP, RSA)`
+    };
+  }
+  if ("d" in jwk) {
+    return {
+      valid: false,
+      method: "jwk",
+      error: "DID must reference a public key \u2014 private key component (d) is not allowed"
+    };
+  }
+  return { valid: true, method: "jwk" };
+}
+function normalizeDidJwk(input) {
+  assertString(input, "input", "INVALID_DID");
+  const trimmed = input.trim();
+  if (!trimmed.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected did:jwk DID", { input });
+  }
+  const result = validateDidJwk(trimmed);
+  if (!result.valid) {
+    throw new OmaTrustError("INVALID_DID", result.error ?? "Invalid did:jwk", { input });
+  }
+  return trimmed;
+}
+
+// src/identity/did-url.ts
+var DID_URL_REGEX = /^did:[a-z0-9]+:.+$/i;
+function parseDidUrl(input) {
+  assertString(input, "input", "INVALID_DID_URL");
+  const trimmed = input.trim();
+  const hashIndex = trimmed.indexOf("#");
+  let did;
+  let fragment;
+  if (hashIndex === -1) {
+    did = trimmed;
+    fragment = null;
+  } else {
+    did = trimmed.slice(0, hashIndex);
+    const rawFragment = trimmed.slice(hashIndex + 1);
+    if (rawFragment.length === 0) {
+      throw new OmaTrustError(
+        "INVALID_DID_URL",
+        "DID URL has empty fragment (trailing '#' with no identifier)",
+        { input }
+      );
+    }
+    fragment = rawFragment;
+  }
+  if (!DID_URL_REGEX.test(did)) {
+    throw new OmaTrustError(
+      "INVALID_DID_URL",
+      "Invalid DID URL: base DID portion is malformed",
+      { input, did }
+    );
+  }
+  return {
+    didUrl: trimmed,
+    did,
+    fragment
+  };
+}
+function isDidUrl(input) {
+  if (typeof input !== "string") return false;
+  const trimmed = input.trim();
+  return trimmed.includes("#") && DID_URL_REGEX.test(trimmed.split("#")[0]);
+}
+function assertBareDid(input, paramName = "did") {
+  assertString(input, paramName, "INVALID_DID");
+  if (isDidUrl(input)) {
+    throw new OmaTrustError(
+      "INVALID_DID",
+      `Expected a bare DID but received a DID URL with a fragment. Use parseDidUrl() to handle DID URLs.`,
+      { input }
+    );
+  }
+}
+var VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+var PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+var REQUIRED_PUBLIC_FIELDS = {
+  EC: ["crv", "x", "y"],
+  OKP: ["crv", "x"],
+  RSA: ["n", "e"]
+};
+function validatePublicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, error: "JWK must be a non-null object" };
+  }
+  const obj = jwk;
+  const kty = obj.kty;
+  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
+    return {
+      valid: false,
+      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
+    };
+  }
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in obj) {
+      return {
+        valid: false,
+        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
+      };
+    }
+  }
+  const required = REQUIRED_PUBLIC_FIELDS[kty];
+  if (required) {
+    for (const field of required) {
+      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
+        return {
+          valid: false,
+          error: `Missing required public key field "${field}" for kty="${kty}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function canonicalizeJwkJson(jwk) {
+  const sorted = Object.keys(jwk).sort();
+  const obj = {};
+  for (const key of sorted) {
+    obj[key] = jwk[key];
+  }
+  return JSON.stringify(obj);
+}
+function jwkToDidJwk(jwk) {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const canonical = canonicalizeJwkJson(jwk);
+  const encoded = base64url.encode(new TextEncoder().encode(canonical));
+  return `did:jwk:${encoded}`;
+}
+function didJwkToJwk(didJwk) {
+  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
+  }
+  const parts = didJwk.split(":");
+  if (parts.length !== 3) {
+    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
+      input: didJwk
+    });
+  }
+  const encoded = parts[2];
+  if (!encoded || encoded.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
+      input: didJwk
+    });
+  }
+  let decoded;
+  try {
+    const bytes = base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
+      input: didJwk
+    });
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
+      input: didJwk
+    });
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
+      input: didJwk
+    });
+  }
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
+      input: didJwk
+    });
+  }
+  return jwk;
+}
+function extractPublicKeyFields(jwk) {
+  const result = {};
+  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
+  for (const [key, value] of Object.entries(jwk)) {
+    if (PRIVATE_KEY_FIELDS.has(key)) continue;
+    if (metadataFields.has(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function publicJwkEquals(a, b) {
+  assertObject(a, "a", "INVALID_JWK");
+  assertObject(b, "b", "INVALID_JWK");
+  const aObj = a;
+  const bObj = b;
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in aObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `First JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+    if (field in bObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `Second JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+  }
+  const aPublic = extractPublicKeyFields(aObj);
+  const bPublic = extractPublicKeyFields(bObj);
+  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+}
+async function computeJwkThumbprint(jwk, digestAlgorithm = "sha256") {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const alg = digestAlgorithm === "sha256" ? "sha256" : digestAlgorithm === "sha384" ? "sha384" : "sha512";
+  return calculateJwkThumbprint(jwk, alg);
+}
+async function formatJktValue(jwk) {
+  const thumbprint = await computeJwkThumbprint(jwk, "sha256");
+  return `jkt=S256:${thumbprint}`;
+}
+
+// src/shared/did-document.ts
+async function fetchDidDocument(domain) {
+  const normalized = domain.toLowerCase().replace(/\.$/, "");
+  const url = `https://${normalized}/.well-known/did.json`;
+  let response;
+  try {
+    response = await fetch(url, { headers: { Accept: "application/json" } });
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to fetch DID document", { domain, err });
+  }
+  if (!response.ok) {
+    throw new OmaTrustError("NETWORK_ERROR", `DID document fetch failed: ${response.status}`, {
+      domain,
+      status: response.status
+    });
+  }
+  return await response.json();
+}
+
+// src/identity/resolve-key.ts
+function findVerificationMethod(didDocument, didUrl, fragment) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) {
+    return null;
+  }
+  for (const method of methods) {
+    if (!method || typeof method !== "object") continue;
+    const id = method.id;
+    if (typeof id !== "string") continue;
+    if (id === didUrl) return method;
+    if (fragment && (id === `#${fragment}` || id.endsWith(`#${fragment}`))) {
+      return method;
+    }
+  }
+  return null;
+}
+function extractMethodIdsFromDidDocument(didDocument) {
+  const methods = didDocument.verificationMethod;
+  if (!Array.isArray(methods)) return [];
+  return methods.filter((m) => m && typeof m.id === "string").map((m) => m.id);
+}
+async function resolveDidUrlToPublicKey(didUrl, options) {
+  assertString(didUrl, "didUrl", "INVALID_DID_URL");
+  const parsed = parseDidUrl(didUrl);
+  const method = extractDidMethod(parsed.did);
+  if (!method) {
+    throw new OmaTrustError("INVALID_DID_URL", "Cannot extract DID method from DID URL", {
+      didUrl,
+      did: parsed.did
+    });
+  }
+  switch (method) {
+    case "web":
+      return resolveDidUrlKey(parsed.didUrl, parsed.did, parsed.fragment, options);
+    default:
+      throw new OmaTrustError(
+        "UNSUPPORTED_DID_METHOD",
+        `DID URL key resolution is not supported for method "${method}"`,
+        { didUrl, method }
+      );
+  }
+}
+async function resolveDidUrlToControllerDid(didUrl, options) {
+  const resolved = await resolveDidUrlToPublicKey(didUrl, options);
+  const controllerDid = jwkToDidJwk(resolved.publicKeyJwk);
+  return {
+    ...resolved,
+    controllerDid
+  };
+}
+async function resolveDidUrlKey(didUrl, did, fragment, options) {
+  const domain = getDomainFromDidWeb(did);
+  if (!domain) {
+    throw new OmaTrustError("INVALID_DID_URL", "Cannot extract domain from did:web DID", {
+      didUrl,
+      did
+    });
+  }
+  const fetchFn = options?.fetchDidDocument ?? fetchDidDocument;
+  const didDocument = await fetchFn(domain);
+  const method = findVerificationMethod(didDocument, didUrl, fragment);
+  if (!method) {
+    throw new OmaTrustError(
+      "KEY_NOT_FOUND",
+      `No verification method found matching "${fragment ? `#${fragment}` : didUrl}"`,
+      { didUrl, fragment, availableMethods: extractMethodIdsFromDidDocument(didDocument) }
+    );
+  }
+  const publicKeyJwk = method.publicKeyJwk;
+  if (!publicKeyJwk || typeof publicKeyJwk !== "object") {
+    throw new OmaTrustError(
+      "KEY_NOT_FOUND",
+      `Verification method "${method.id}" does not contain publicKeyJwk`,
+      { didUrl, verificationMethodId: method.id }
+    );
+  }
+  const validation = validatePublicJwk(publicKeyJwk);
+  if (!validation.valid) {
+    throw new OmaTrustError(
+      "INVALID_JWK",
+      `publicKeyJwk in verification method "${method.id}" is invalid: ${validation.error}`,
+      { didUrl, verificationMethodId: method.id }
+    );
+  }
+  return {
+    didUrl,
+    did,
+    fragment,
+    publicKeyJwk,
+    verificationMethodId: method.id
+  };
+}
+
+// src/identity/controller-id.ts
+function isSameControllerId(a, b) {
+  let normalizedA = null;
+  let normalizedB = null;
+  try {
+    normalizedA = normalizeDid(a);
+  } catch {
+  }
+  try {
+    normalizedB = normalizeDid(b);
+  } catch {
+  }
+  if (normalizedA && normalizedB && normalizedA === normalizedB) {
+    return true;
+  }
+  const evmA = extractControllerEvmAddress(a);
+  const evmB = extractControllerEvmAddress(b);
+  if (evmA && evmB && evmA.toLowerCase() === evmB.toLowerCase()) {
+    return true;
+  }
+  const methodA = extractDidMethod(a);
+  const methodB = extractDidMethod(b);
+  if (methodA === "jwk" && methodB === "jwk") {
+    try {
+      const jwkA = didJwkToJwk(a);
+      const jwkB = didJwkToJwk(b);
+      return publicJwkEquals(jwkA, jwkB);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function extractControllerEvmAddress(controllerDid) {
+  try {
+    const method = extractDidMethod(controllerDid);
+    if (method === "pkh" && controllerDid.includes("eip155")) {
+      return extractAddressFromDid(controllerDid);
+    }
+  } catch {
+  }
+  return null;
+}
+
+// src/identity/types.ts
+function extractAuthorizationMetadata(result) {
+  const payload = result.payload;
+  const resourceUrl = typeof payload.resourceUrl === "string" ? payload.resourceUrl : null;
+  const issuedAt = typeof payload.issuedAt === "string" ? payload.issuedAt : null;
+  let subjectDid = null;
+  if (resourceUrl) {
+    try {
+      const url = new URL(resourceUrl);
+      subjectDid = `did:web:${url.hostname}`;
+    } catch {
+    }
+  }
+  return {
+    controllerDid: result.publicKeyDid,
+    subjectDid,
+    resourceUrl,
+    issuedAt,
+    kid: result.kid,
+    publicKeyJwk: result.publicKeyJwk
+  };
+}
 function canonicalizeJson(obj) {
   const jcs = canonicalize(obj);
   if (!jcs) {
@@ -290,6 +816,6 @@ function hashCanonicalizedJson(obj, algorithm) {
   return algorithm === "keccak256" ? keccak256(bytes) : sha256(bytes);
 }
 
-export { buildCaip10, buildCaip2, buildDidPkh, buildDidPkhFromCaip10, buildDidWeb, buildEvmDidPkh, canonicalizeForHash, canonicalizeJson, computeDidAddress, computeDidHash, didToAddress, extractAddressFromDid, extractDidIdentifier, extractDidMethod, getAddressFromDidPkh, getChainIdFromDidPkh, getDomainFromDidWeb, getNamespaceFromDidPkh, hashCanonicalizedJson, isEvmDidPkh, isValidDid, normalizeCaip10, normalizeDid, normalizeDidHandle, normalizeDidKey, normalizeDidPkh, normalizeDidWeb, normalizeDomain, parseCaip10, parseCaip2, validateDidAddress };
+export { assertBareDid, buildCaip10, buildCaip2, buildDidPkh, buildDidPkhFromCaip10, buildDidWeb, buildEvmDidPkh, canonicalizeForHash, canonicalizeJson, computeDidAddress, computeDidHash, computeJwkThumbprint, didJwkToJwk, didToAddress, extractAddressFromDid, extractAuthorizationMetadata, extractControllerEvmAddress, extractDidIdentifier, extractDidMethod, formatJktValue, getAddressFromDidPkh, getChainIdFromDidPkh, getDomainFromDidWeb, getNamespaceFromDidPkh, hashCanonicalizedJson, isDidUrl, isEvmDidPkh, isPrivateKeyDid, isSameControllerId, isValidDid, jwkToDidJwk, normalizeCaip10, normalizeDid, normalizeDidHandle, normalizeDidJwk, normalizeDidKey, normalizeDidPkh, normalizeDidWeb, normalizeDomain, parseCaip10, parseCaip2, parseDidUrl, publicJwkEquals, resolveDidUrlToControllerDid, resolveDidUrlToPublicKey, validateDidAddress, validatePrivateKeyDid, validatePublicJwk };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map