@oma3/omatrust 0.1.0-alpha.11 → 0.1.0-alpha.12

package/dist/reputation/index.browser.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var ethers = require('ethers');
 var jose = require('jose');
+var ethers = require('ethers');
 var easSdk = require('@ethereum-attestation-service/eas-sdk');
 var canonicalize = require('canonicalize');
 
@@ -77,6 +77,152 @@ var init_caip = __esm({
     CAIP_10_REGEX = /^(?<namespace>[a-z0-9-]+):(?<reference>[a-zA-Z0-9-]+):(?<address>.+)$/;
   }
 });
+function validatePublicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    return { valid: false, error: "JWK must be a non-null object" };
+  }
+  const obj = jwk;
+  const kty = obj.kty;
+  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
+    return {
+      valid: false,
+      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
+    };
+  }
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in obj) {
+      return {
+        valid: false,
+        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
+      };
+    }
+  }
+  const required = REQUIRED_PUBLIC_FIELDS[kty];
+  if (required) {
+    for (const field of required) {
+      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
+        return {
+          valid: false,
+          error: `Missing required public key field "${field}" for kty="${kty}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function canonicalizeJwkJson(jwk) {
+  const sorted = Object.keys(jwk).sort();
+  const obj = {};
+  for (const key of sorted) {
+    obj[key] = jwk[key];
+  }
+  return JSON.stringify(obj);
+}
+function jwkToDidJwk(jwk) {
+  assertObject(jwk, "jwk", "INVALID_JWK");
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
+  }
+  const canonical = canonicalizeJwkJson(jwk);
+  const encoded = jose.base64url.encode(new TextEncoder().encode(canonical));
+  return `did:jwk:${encoded}`;
+}
+function didJwkToJwk(didJwk) {
+  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
+    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
+  }
+  const parts = didJwk.split(":");
+  if (parts.length !== 3) {
+    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
+      input: didJwk
+    });
+  }
+  const encoded = parts[2];
+  if (!encoded || encoded.length === 0) {
+    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
+      input: didJwk
+    });
+  }
+  let decoded;
+  try {
+    const bytes = jose.base64url.decode(encoded);
+    decoded = new TextDecoder().decode(bytes);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
+      input: didJwk
+    });
+  }
+  let jwk;
+  try {
+    jwk = JSON.parse(decoded);
+  } catch {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
+      input: didJwk
+    });
+  }
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
+      input: didJwk
+    });
+  }
+  const validation = validatePublicJwk(jwk);
+  if (!validation.valid) {
+    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
+      input: didJwk
+    });
+  }
+  return jwk;
+}
+function extractPublicKeyFields(jwk) {
+  const result = {};
+  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
+  for (const [key, value] of Object.entries(jwk)) {
+    if (PRIVATE_KEY_FIELDS.has(key)) continue;
+    if (metadataFields.has(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function publicJwkEquals(a, b) {
+  assertObject(a, "a", "INVALID_JWK");
+  assertObject(b, "b", "INVALID_JWK");
+  const aObj = a;
+  const bObj = b;
+  for (const field of PRIVATE_KEY_FIELDS) {
+    if (field in aObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `First JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+    if (field in bObj) {
+      throw new OmaTrustError(
+        "INVALID_JWK",
+        `Second JWK contains private key field "${field}"`,
+        { field }
+      );
+    }
+  }
+  const aPublic = extractPublicKeyFields(aObj);
+  const bPublic = extractPublicKeyFields(bObj);
+  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
+}
+var VALID_KTY, PRIVATE_KEY_FIELDS, REQUIRED_PUBLIC_FIELDS;
+var init_jwk = __esm({
+  "src/identity/jwk.ts"() {
+    init_errors();
+    init_assert();
+    VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
+    PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+    REQUIRED_PUBLIC_FIELDS = {
+      EC: ["crv", "x", "y"],
+      OKP: ["crv", "x"],
+      RSA: ["n", "e"]
+    };
+  }
+});
 function isValidDid(did) {
   return DID_REGEX.test(did);
 }
@@ -145,7 +291,7 @@ function normalizeDidKey(input) {
 }
 function normalizeDid(input) {
   assertString(input, "input", "INVALID_DID");
-  const trimmed = input.trim();
+  const trimmed = input.trim().split("#")[0];
   if (!trimmed.startsWith("did:")) {
     return normalizeDidWeb(trimmed);
   }
@@ -304,6 +450,10 @@ function validateDidJwk(did) {
       error: "DID must reference a public key \u2014 private key component (d) is not allowed"
     };
   }
+  const jwkValidation = validatePublicJwk(jwk);
+  if (!jwkValidation.valid) {
+    return { valid: false, method: "jwk", error: jwkValidation.error };
+  }
   return { valid: true, method: "jwk" };
 }
 function normalizeDidJwk(input) {
@@ -324,157 +474,12 @@ var init_did = __esm({
     init_errors();
     init_assert();
     init_caip();
+    init_jwk();
     DID_REGEX = /^did:[a-z0-9]+:.+$/i;
     BASE64URL_REGEX = /^[A-Za-z0-9_-]+$/;
     VALID_JWK_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
   }
 });
-function validatePublicJwk(jwk) {
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
-    return { valid: false, error: "JWK must be a non-null object" };
-  }
-  const obj = jwk;
-  const kty = obj.kty;
-  if (typeof kty !== "string" || !VALID_KTY.has(kty)) {
-    return {
-      valid: false,
-      error: `Invalid or missing kty (must be one of: ${[...VALID_KTY].join(", ")})`
-    };
-  }
-  for (const field of PRIVATE_KEY_FIELDS) {
-    if (field in obj) {
-      return {
-        valid: false,
-        error: `JWK contains private key field "${field}" \u2014 only public keys are allowed`
-      };
-    }
-  }
-  const required = REQUIRED_PUBLIC_FIELDS[kty];
-  if (required) {
-    for (const field of required) {
-      if (!(field in obj) || obj[field] === void 0 || obj[field] === null || obj[field] === "") {
-        return {
-          valid: false,
-          error: `Missing required public key field "${field}" for kty="${kty}"`
-        };
-      }
-    }
-  }
-  return { valid: true };
-}
-function canonicalizeJwkJson(jwk) {
-  const sorted = Object.keys(jwk).sort();
-  const obj = {};
-  for (const key of sorted) {
-    obj[key] = jwk[key];
-  }
-  return JSON.stringify(obj);
-}
-function jwkToDidJwk(jwk) {
-  assertObject(jwk, "jwk", "INVALID_JWK");
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_JWK", validation.error ?? "Invalid public JWK", { jwk });
-  }
-  const canonical = canonicalizeJwkJson(jwk);
-  const encoded = jose.base64url.encode(new TextEncoder().encode(canonical));
-  return `did:jwk:${encoded}`;
-}
-function didJwkToJwk(didJwk) {
-  if (typeof didJwk !== "string" || !didJwk.startsWith("did:jwk:")) {
-    throw new OmaTrustError("INVALID_DID", "Expected a did:jwk DID", { input: didJwk });
-  }
-  const parts = didJwk.split(":");
-  if (parts.length !== 3) {
-    throw new OmaTrustError("INVALID_DID", "did:jwk must have exactly 3 colon-separated parts", {
-      input: didJwk
-    });
-  }
-  const encoded = parts[2];
-  if (!encoded || encoded.length === 0) {
-    throw new OmaTrustError("INVALID_DID", "Missing base64url-encoded JWK identifier", {
-      input: didJwk
-    });
-  }
-  let decoded;
-  try {
-    const bytes = jose.base64url.decode(encoded);
-    decoded = new TextDecoder().decode(bytes);
-  } catch {
-    throw new OmaTrustError("INVALID_DID", "Failed to base64url-decode did:jwk identifier", {
-      input: didJwk
-    });
-  }
-  let jwk;
-  try {
-    jwk = JSON.parse(decoded);
-  } catch {
-    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk identifier is not valid JSON", {
-      input: didJwk
-    });
-  }
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
-    throw new OmaTrustError("INVALID_DID", "Decoded did:jwk must be a JSON object", {
-      input: didJwk
-    });
-  }
-  const validation = validatePublicJwk(jwk);
-  if (!validation.valid) {
-    throw new OmaTrustError("INVALID_DID", validation.error ?? "Invalid public JWK in did:jwk", {
-      input: didJwk
-    });
-  }
-  return jwk;
-}
-function extractPublicKeyFields(jwk) {
-  const result = {};
-  const metadataFields = /* @__PURE__ */ new Set(["kid", "use", "key_ops", "alg", "ext"]);
-  for (const [key, value] of Object.entries(jwk)) {
-    if (PRIVATE_KEY_FIELDS.has(key)) continue;
-    if (metadataFields.has(key)) continue;
-    result[key] = value;
-  }
-  return result;
-}
-function publicJwkEquals(a, b) {
-  assertObject(a, "a", "INVALID_JWK");
-  assertObject(b, "b", "INVALID_JWK");
-  const aObj = a;
-  const bObj = b;
-  for (const field of PRIVATE_KEY_FIELDS) {
-    if (field in aObj) {
-      throw new OmaTrustError(
-        "INVALID_JWK",
-        `First JWK contains private key field "${field}"`,
-        { field }
-      );
-    }
-    if (field in bObj) {
-      throw new OmaTrustError(
-        "INVALID_JWK",
-        `Second JWK contains private key field "${field}"`,
-        { field }
-      );
-    }
-  }
-  const aPublic = extractPublicKeyFields(aObj);
-  const bPublic = extractPublicKeyFields(bObj);
-  return canonicalizeJwkJson(aPublic) === canonicalizeJwkJson(bPublic);
-}
-var VALID_KTY, PRIVATE_KEY_FIELDS, REQUIRED_PUBLIC_FIELDS;
-var init_jwk = __esm({
-  "src/identity/jwk.ts"() {
-    init_errors();
-    init_assert();
-    VALID_KTY = /* @__PURE__ */ new Set(["EC", "OKP", "RSA"]);
-    PRIVATE_KEY_FIELDS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
-    REQUIRED_PUBLIC_FIELDS = {
-      EC: ["crv", "x", "y"],
-      OKP: ["crv", "x"],
-      RSA: ["n", "e"]
-    };
-  }
-});
 
 // src/reputation/proof/dns-txt-record.ts
 function parseDnsTxtRecord(record) {