@opendatalabs/vana-sdk 3.0.0 → 3.0.1

package/dist/auth/web3-signed.cjs

@@ -34,6 +34,30 @@ function base64urlDecode(input) {
   base64 += "=".repeat(padLength);
   return new TextDecoder().decode((0, import_encoding.fromBase64)(base64));
 }
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function parsePayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new import_errors.InvalidSignatureError({ reason: "Invalid payload shape" });
+  }
+  const payload = value;
+  if (typeof payload["aud"] !== "string" || typeof payload["method"] !== "string" || typeof payload["uri"] !== "string" || typeof payload["bodyHash"] !== "string" || !isFiniteNumber(payload["iat"]) || !isFiniteNumber(payload["exp"])) {
+    throw new import_errors.InvalidSignatureError({ reason: "Invalid payload claims" });
+  }
+  if (payload["grantId"] !== void 0 && typeof payload["grantId"] !== "string") {
+    throw new import_errors.InvalidSignatureError({ reason: "Invalid grantId claim" });
+  }
+  return {
+    aud: payload["aud"],
+    method: payload["method"],
+    uri: payload["uri"],
+    bodyHash: payload["bodyHash"],
+    iat: payload["iat"],
+    exp: payload["exp"],
+    grantId: payload["grantId"]
+  };
+}
 function parseWeb3SignedHeader(headerValue) {
   if (!headerValue) {
     throw new import_errors.MissingAuthError();
@@ -54,8 +78,9 @@ function parseWeb3SignedHeader(headerValue) {
   let payload;
   try {
     const decoded = base64urlDecode(payloadBase64);
-    payload = JSON.parse(decoded);
-  } catch {
+    payload = parsePayload(JSON.parse(decoded));
+  } catch (err) {
+    if (err instanceof import_errors.InvalidSignatureError) throw err;
     throw new import_errors.InvalidSignatureError({ reason: "Invalid payload encoding" });
   }
   return {
@@ -98,7 +123,7 @@ async function verifyWeb3Signed(params) {
       actual: payload.uri
     });
   }
-  if (params.bodyBytes !== void 0 && params.bodyBytes.length > 0) {
+  if (params.bodyBytes !== void 0) {
     const expectedBodyHash = (0, import_web3_signed_builder.computeBodyHash)(params.bodyBytes);
     if (payload.bodyHash !== expectedBodyHash) {
       throw new import_errors.InvalidSignatureError({

package/dist/auth/web3-signed.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/web3-signed.ts"],"sourcesContent":["/**\n * Web3Signed Authorization header parsing and verification.\n *\n * @remarks\n * Header format: `\"Web3Signed {base64url(payload)}.{signature}\"`.\n * Payload is JSON with fields `aud`, `method`, `uri`, `bodyHash`, `iat`, `exp`,\n * and optional `grantId`. The signature is EIP-191 over the base64url-encoded\n * payload string.\n *\n * Ported from `personal-server-ts` (`packages/core/src/auth/web3-signed.ts`).\n * Adjusted to be isomorphic (no `Buffer`) and to use SDK-local error types.\n *\n * @category Auth\n */\n\nimport { recoverMessageAddress } from \"viem\";\nimport { fromBase64 } from \"../utils/encoding\";\nimport {\n  MissingAuthError,\n  InvalidSignatureError,\n  ExpiredTokenError,\n} from \"./errors\";\nimport { computeBodyHash } from \"./web3-signed-builder\";\n\nexport interface Web3SignedPayload {\n  aud: string;\n  method: string;\n  uri: string;\n  bodyHash: string;\n  iat: number;\n  exp: number;\n  grantId?: string;\n}\n\nexport interface VerifiedAuth {\n  signer: `0x${string}`;\n  payload: Web3SignedPayload;\n}\n\nconst WEB3_SIGNED_PREFIX = \"Web3Signed \";\nconst CLOCK_SKEW_SECONDS = 60;\n\n/** Decode a base64url string (no padding) to UTF-8. */\nfunction base64urlDecode(input: string): string {\n  let base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padLength = (4 - (base64.length % 4)) % 4;\n  base64 += \"=\".repeat(padLength);\n  return new TextDecoder().decode(fromBase64(base64));\n}\n\n/**\n * Parse a `\"Web3Signed <base64url>.<signature>\"` header value.\n *\n * @throws {MissingAuthError} If the header is missing or empty.\n * @throws {InvalidSignatureError} If the format is invalid.\n */\nexport function parseWeb3SignedHeader(headerValue: string | undefined): {\n  payloadBase64: string;\n  payload: Web3SignedPayload;\n  signature: `0x${string}`;\n} {\n  if (!headerValue) {\n    throw new MissingAuthError();\n  }\n\n  if (!headerValue.startsWith(WEB3_SIGNED_PREFIX)) {\n    throw new InvalidSignatureError({ reason: \"Missing Web3Signed prefix\" });\n  }\n\n  const value = headerValue.slice(WEB3_SIGNED_PREFIX.length);\n  const dotIndex = value.indexOf(\".\");\n  if (dotIndex === -1 || dotIndex === 0 || dotIndex === value.length - 1) {\n    throw new InvalidSignatureError({ reason: \"Invalid header format\" });\n  }\n\n  const payloadBase64 = value.slice(0, dotIndex);\n  const signatureStr = value.slice(dotIndex + 1);\n\n  if (!signatureStr.startsWith(\"0x\")) {\n    throw new InvalidSignatureError({ reason: \"Invalid signature format\" });\n  }\n\n  let payload: Web3SignedPayload;\n  try {\n    const decoded = base64urlDecode(payloadBase64);\n    payload = JSON.parse(decoded) as Web3SignedPayload;\n  } catch {\n    throw new InvalidSignatureError({ reason: \"Invalid payload encoding\" });\n  }\n\n  return {\n    payloadBase64,\n    payload,\n    signature: signatureStr as `0x${string}`,\n  };\n}\n\n/**\n * Full verification: parse header, recover signer via EIP-191, check claims.\n *\n * @remarks\n * Steps:\n * 1. Parse header to base64url + signature.\n * 2. Recover signer via {@link recoverMessageAddress} (EIP-191) over the base64url payload string.\n * 3. Check `aud === expectedOrigin`, `method === expectedMethod`, `uri === expectedPath`.\n * 4. Optionally check `bodyHash` against `bodyBytes`.\n * 5. Check `iat`/`exp` within a 60s clock skew.\n *\n * @returns The recovered signer address and parsed payload.\n */\nexport async function verifyWeb3Signed(params: {\n  headerValue: string | undefined;\n  expectedOrigin: string;\n  expectedMethod: string;\n  expectedPath: string;\n  bodyBytes?: Uint8Array;\n  now?: number;\n}): Promise<VerifiedAuth> {\n  const { payloadBase64, payload, signature } = parseWeb3SignedHeader(\n    params.headerValue,\n  );\n\n  let signer: `0x${string}`;\n  try {\n    signer = await recoverMessageAddress({\n      message: payloadBase64,\n      signature,\n    });\n  } catch {\n    throw new InvalidSignatureError({ reason: \"Signature recovery failed\" });\n  }\n\n  if (payload.aud !== params.expectedOrigin) {\n    throw new InvalidSignatureError({\n      reason: \"Audience mismatch\",\n      expected: params.expectedOrigin,\n      actual: payload.aud,\n    });\n  }\n\n  if (payload.method !== params.expectedMethod) {\n    throw new InvalidSignatureError({\n      reason: \"Method mismatch\",\n      expected: params.expectedMethod,\n      actual: payload.method,\n    });\n  }\n\n  if (payload.uri !== params.expectedPath) {\n    throw new InvalidSignatureError({\n      reason: \"URI mismatch\",\n      expected: params.expectedPath,\n      actual: payload.uri,\n    });\n  }\n\n  if (params.bodyBytes !== undefined && params.bodyBytes.length > 0) {\n    const expectedBodyHash = computeBodyHash(params.bodyBytes);\n    if (payload.bodyHash !== expectedBodyHash) {\n      throw new InvalidSignatureError({\n        reason: \"Body hash mismatch\",\n        expected: expectedBodyHash,\n        actual: payload.bodyHash,\n      });\n    }\n  }\n\n  const now = params.now ?? Math.floor(Date.now() / 1000);\n\n  if (payload.exp < now - CLOCK_SKEW_SECONDS) {\n    throw new ExpiredTokenError({ reason: \"Token expired\" });\n  }\n\n  if (payload.iat > now + CLOCK_SKEW_SECONDS) {\n    throw new ExpiredTokenError({ reason: \"Token issued in the future\" });\n  }\n\n  return { signer, payload };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,kBAAsC;AACtC,sBAA2B;AAC3B,oBAIO;AACP,iCAAgC;AAiBhC,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAG3B,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,aAAa,IAAK,OAAO,SAAS,KAAM;AAC9C,YAAU,IAAI,OAAO,SAAS;AAC9B,SAAO,IAAI,YAAY,EAAE,WAAO,4BAAW,MAAM,CAAC;AACpD;AAQO,SAAS,sBAAsB,aAIpC;AACA,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,+BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,YAAY,WAAW,kBAAkB,GAAG;AAC/C,UAAM,IAAI,oCAAsB,EAAE,QAAQ,4BAA4B,CAAC;AAAA,EACzE;AAEA,QAAM,QAAQ,YAAY,MAAM,mBAAmB,MAAM;AACzD,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,aAAa,MAAM,aAAa,KAAK,aAAa,MAAM,SAAS,GAAG;AACtE,UAAM,IAAI,oCAAsB,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACrE;AAEA,QAAM,gBAAgB,MAAM,MAAM,GAAG,QAAQ;AAC7C,QAAM,eAAe,MAAM,MAAM,WAAW,CAAC;AAE7C,MAAI,CAAC,aAAa,WAAW,IAAI,GAAG;AAClC,UAAM,IAAI,oCAAsB,EAAE,QAAQ,2BAA2B,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,gBAAgB,aAAa;AAC7C,cAAU,KAAK,MAAM,OAAO;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,oCAAsB,EAAE,QAAQ,2BAA2B,CAAC;AAAA,EACxE;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb;AACF;AAeA,eAAsB,iBAAiB,QAOb;AACxB,QAAM,EAAE,eAAe,SAAS,UAAU,IAAI;AAAA,IAC5C,OAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,UAAM,mCAAsB;AAAA,MACnC,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,oCAAsB,EAAE,QAAQ,4BAA4B,CAAC;AAAA,EACzE;AAEA,MAAI,QAAQ,QAAQ,OAAO,gBAAgB;AACzC,UAAM,IAAI,oCAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,WAAW,OAAO,gBAAgB;AAC5C,UAAM,IAAI,oCAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,QAAQ,OAAO,cAAc;AACvC,UAAM,IAAI,oCAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,cAAc,UAAa,OAAO,UAAU,SAAS,GAAG;AACjE,UAAM,uBAAmB,4CAAgB,OAAO,SAAS;AACzD,QAAI,QAAQ,aAAa,kBAAkB;AACzC,YAAM,IAAI,oCAAsB;AAAA,QAC9B,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,MAAM,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAEtD,MAAI,QAAQ,MAAM,MAAM,oBAAoB;AAC1C,UAAM,IAAI,gCAAkB,EAAE,QAAQ,gBAAgB,CAAC;AAAA,EACzD;AAEA,MAAI,QAAQ,MAAM,MAAM,oBAAoB;AAC1C,UAAM,IAAI,gCAAkB,EAAE,QAAQ,6BAA6B,CAAC;AAAA,EACtE;AAEA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;","names":[]}
+{"version":3,"sources":["../../src/auth/web3-signed.ts"],"sourcesContent":["/**\n * Web3Signed Authorization header parsing and verification.\n *\n * @remarks\n * Header format: `\"Web3Signed {base64url(payload)}.{signature}\"`.\n * Payload is JSON with fields `aud`, `method`, `uri`, `bodyHash`, `iat`, `exp`,\n * and optional `grantId`. The signature is EIP-191 over the base64url-encoded\n * payload string.\n *\n * Ported from `personal-server-ts` (`packages/core/src/auth/web3-signed.ts`).\n * Adjusted to be isomorphic (no `Buffer`) and to use SDK-local error types.\n *\n * @category Auth\n */\n\nimport { recoverMessageAddress } from \"viem\";\nimport { fromBase64 } from \"../utils/encoding\";\nimport {\n  MissingAuthError,\n  InvalidSignatureError,\n  ExpiredTokenError,\n} from \"./errors\";\nimport { computeBodyHash } from \"./web3-signed-builder\";\n\nexport interface Web3SignedPayload {\n  aud: string;\n  method: string;\n  uri: string;\n  bodyHash: string;\n  iat: number;\n  exp: number;\n  grantId?: string;\n}\n\nexport interface VerifiedAuth {\n  signer: `0x${string}`;\n  payload: Web3SignedPayload;\n}\n\nconst WEB3_SIGNED_PREFIX = \"Web3Signed \";\nconst CLOCK_SKEW_SECONDS = 60;\n\n/** Decode a base64url string (no padding) to UTF-8. */\nfunction base64urlDecode(input: string): string {\n  let base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padLength = (4 - (base64.length % 4)) % 4;\n  base64 += \"=\".repeat(padLength);\n  return new TextDecoder().decode(fromBase64(base64));\n}\n\nfunction isFiniteNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value);\n}\n\nfunction parsePayload(value: unknown): Web3SignedPayload {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new InvalidSignatureError({ reason: \"Invalid payload shape\" });\n  }\n\n  const payload = value as Record<string, unknown>;\n  if (\n    typeof payload[\"aud\"] !== \"string\" ||\n    typeof payload[\"method\"] !== \"string\" ||\n    typeof payload[\"uri\"] !== \"string\" ||\n    typeof payload[\"bodyHash\"] !== \"string\" ||\n    !isFiniteNumber(payload[\"iat\"]) ||\n    !isFiniteNumber(payload[\"exp\"])\n  ) {\n    throw new InvalidSignatureError({ reason: \"Invalid payload claims\" });\n  }\n\n  if (\n    payload[\"grantId\"] !== undefined &&\n    typeof payload[\"grantId\"] !== \"string\"\n  ) {\n    throw new InvalidSignatureError({ reason: \"Invalid grantId claim\" });\n  }\n\n  return {\n    aud: payload[\"aud\"],\n    method: payload[\"method\"],\n    uri: payload[\"uri\"],\n    bodyHash: payload[\"bodyHash\"],\n    iat: payload[\"iat\"],\n    exp: payload[\"exp\"],\n    grantId: payload[\"grantId\"],\n  };\n}\n\n/**\n * Parse a `\"Web3Signed <base64url>.<signature>\"` header value.\n *\n * @throws {MissingAuthError} If the header is missing or empty.\n * @throws {InvalidSignatureError} If the format is invalid.\n */\nexport function parseWeb3SignedHeader(headerValue: string | undefined): {\n  payloadBase64: string;\n  payload: Web3SignedPayload;\n  signature: `0x${string}`;\n} {\n  if (!headerValue) {\n    throw new MissingAuthError();\n  }\n\n  if (!headerValue.startsWith(WEB3_SIGNED_PREFIX)) {\n    throw new InvalidSignatureError({ reason: \"Missing Web3Signed prefix\" });\n  }\n\n  const value = headerValue.slice(WEB3_SIGNED_PREFIX.length);\n  const dotIndex = value.indexOf(\".\");\n  if (dotIndex === -1 || dotIndex === 0 || dotIndex === value.length - 1) {\n    throw new InvalidSignatureError({ reason: \"Invalid header format\" });\n  }\n\n  const payloadBase64 = value.slice(0, dotIndex);\n  const signatureStr = value.slice(dotIndex + 1);\n\n  if (!signatureStr.startsWith(\"0x\")) {\n    throw new InvalidSignatureError({ reason: \"Invalid signature format\" });\n  }\n\n  let payload: Web3SignedPayload;\n  try {\n    const decoded = base64urlDecode(payloadBase64);\n    payload = parsePayload(JSON.parse(decoded));\n  } catch (err) {\n    if (err instanceof InvalidSignatureError) throw err;\n    throw new InvalidSignatureError({ reason: \"Invalid payload encoding\" });\n  }\n\n  return {\n    payloadBase64,\n    payload,\n    signature: signatureStr as `0x${string}`,\n  };\n}\n\n/**\n * Full verification: parse header, recover signer via EIP-191, check claims.\n *\n * @remarks\n * Steps:\n * 1. Parse header to base64url + signature.\n * 2. Recover signer via {@link recoverMessageAddress} (EIP-191) over the base64url payload string.\n * 3. Check `aud === expectedOrigin`, `method === expectedMethod`, `uri === expectedPath`.\n * 4. Optionally check `bodyHash` against `bodyBytes`.\n * 5. Check `iat`/`exp` within a 60s clock skew.\n *\n * @returns The recovered signer address and parsed payload.\n */\nexport async function verifyWeb3Signed(params: {\n  headerValue: string | undefined;\n  expectedOrigin: string;\n  expectedMethod: string;\n  expectedPath: string;\n  bodyBytes?: Uint8Array;\n  now?: number;\n}): Promise<VerifiedAuth> {\n  const { payloadBase64, payload, signature } = parseWeb3SignedHeader(\n    params.headerValue,\n  );\n\n  let signer: `0x${string}`;\n  try {\n    signer = await recoverMessageAddress({\n      message: payloadBase64,\n      signature,\n    });\n  } catch {\n    throw new InvalidSignatureError({ reason: \"Signature recovery failed\" });\n  }\n\n  if (payload.aud !== params.expectedOrigin) {\n    throw new InvalidSignatureError({\n      reason: \"Audience mismatch\",\n      expected: params.expectedOrigin,\n      actual: payload.aud,\n    });\n  }\n\n  if (payload.method !== params.expectedMethod) {\n    throw new InvalidSignatureError({\n      reason: \"Method mismatch\",\n      expected: params.expectedMethod,\n      actual: payload.method,\n    });\n  }\n\n  if (payload.uri !== params.expectedPath) {\n    throw new InvalidSignatureError({\n      reason: \"URI mismatch\",\n      expected: params.expectedPath,\n      actual: payload.uri,\n    });\n  }\n\n  if (params.bodyBytes !== undefined) {\n    const expectedBodyHash = computeBodyHash(params.bodyBytes);\n    if (payload.bodyHash !== expectedBodyHash) {\n      throw new InvalidSignatureError({\n        reason: \"Body hash mismatch\",\n        expected: expectedBodyHash,\n        actual: payload.bodyHash,\n      });\n    }\n  }\n\n  const now = params.now ?? Math.floor(Date.now() / 1000);\n\n  if (payload.exp < now - CLOCK_SKEW_SECONDS) {\n    throw new ExpiredTokenError({ reason: \"Token expired\" });\n  }\n\n  if (payload.iat > now + CLOCK_SKEW_SECONDS) {\n    throw new ExpiredTokenError({ reason: \"Token issued in the future\" });\n  }\n\n  return { signer, payload };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,kBAAsC;AACtC,sBAA2B;AAC3B,oBAIO;AACP,iCAAgC;AAiBhC,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAG3B,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,aAAa,IAAK,OAAO,SAAS,KAAM;AAC9C,YAAU,IAAI,OAAO,SAAS;AAC9B,SAAO,IAAI,YAAY,EAAE,WAAO,4BAAW,MAAM,CAAC;AACpD;AAEA,SAAS,eAAe,OAAiC;AACvD,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAC3D;AAEA,SAAS,aAAa,OAAmC;AACvD,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,oCAAsB,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU;AAChB,MACE,OAAO,QAAQ,KAAK,MAAM,YAC1B,OAAO,QAAQ,QAAQ,MAAM,YAC7B,OAAO,QAAQ,KAAK,MAAM,YAC1B,OAAO,QAAQ,UAAU,MAAM,YAC/B,CAAC,eAAe,QAAQ,KAAK,CAAC,KAC9B,CAAC,eAAe,QAAQ,KAAK,CAAC,GAC9B;AACA,UAAM,IAAI,oCAAsB,EAAE,QAAQ,yBAAyB,CAAC;AAAA,EACtE;AAEA,MACE,QAAQ,SAAS,MAAM,UACvB,OAAO,QAAQ,SAAS,MAAM,UAC9B;AACA,UAAM,IAAI,oCAAsB,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACrE;AAEA,SAAO;AAAA,IACL,KAAK,QAAQ,KAAK;AAAA,IAClB,QAAQ,QAAQ,QAAQ;AAAA,IACxB,KAAK,QAAQ,KAAK;AAAA,IAClB,UAAU,QAAQ,UAAU;AAAA,IAC5B,KAAK,QAAQ,KAAK;AAAA,IAClB,KAAK,QAAQ,KAAK;AAAA,IAClB,SAAS,QAAQ,SAAS;AAAA,EAC5B;AACF;AAQO,SAAS,sBAAsB,aAIpC;AACA,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,+BAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,YAAY,WAAW,kBAAkB,GAAG;AAC/C,UAAM,IAAI,oCAAsB,EAAE,QAAQ,4BAA4B,CAAC;AAAA,EACzE;AAEA,QAAM,QAAQ,YAAY,MAAM,mBAAmB,MAAM;AACzD,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,aAAa,MAAM,aAAa,KAAK,aAAa,MAAM,SAAS,GAAG;AACtE,UAAM,IAAI,oCAAsB,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACrE;AAEA,QAAM,gBAAgB,MAAM,MAAM,GAAG,QAAQ;AAC7C,QAAM,eAAe,MAAM,MAAM,WAAW,CAAC;AAE7C,MAAI,CAAC,aAAa,WAAW,IAAI,GAAG;AAClC,UAAM,IAAI,oCAAsB,EAAE,QAAQ,2BAA2B,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,gBAAgB,aAAa;AAC7C,cAAU,aAAa,KAAK,MAAM,OAAO,CAAC;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAI,eAAe,oCAAuB,OAAM;AAChD,UAAM,IAAI,oCAAsB,EAAE,QAAQ,2BAA2B,CAAC;AAAA,EACxE;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb;AACF;AAeA,eAAsB,iBAAiB,QAOb;AACxB,QAAM,EAAE,eAAe,SAAS,UAAU,IAAI;AAAA,IAC5C,OAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,UAAM,mCAAsB;AAAA,MACnC,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,oCAAsB,EAAE,QAAQ,4BAA4B,CAAC;AAAA,EACzE;AAEA,MAAI,QAAQ,QAAQ,OAAO,gBAAgB;AACzC,UAAM,IAAI,oCAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,WAAW,OAAO,gBAAgB;AAC5C,UAAM,IAAI,oCAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,QAAQ,OAAO,cAAc;AACvC,UAAM,IAAI,oCAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,cAAc,QAAW;AAClC,UAAM,uBAAmB,4CAAgB,OAAO,SAAS;AACzD,QAAI,QAAQ,aAAa,kBAAkB;AACzC,YAAM,IAAI,oCAAsB;AAAA,QAC9B,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,MAAM,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAEtD,MAAI,QAAQ,MAAM,MAAM,oBAAoB;AAC1C,UAAM,IAAI,gCAAkB,EAAE,QAAQ,gBAAgB,CAAC;AAAA,EACzD;AAEA,MAAI,QAAQ,MAAM,MAAM,oBAAoB;AAC1C,UAAM,IAAI,gCAAkB,EAAE,QAAQ,6BAA6B,CAAC;AAAA,EACtE;AAEA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;","names":[]}

package/dist/auth/web3-signed.js

@@ -14,6 +14,30 @@ function base64urlDecode(input) {
   base64 += "=".repeat(padLength);
   return new TextDecoder().decode(fromBase64(base64));
 }
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function parsePayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new InvalidSignatureError({ reason: "Invalid payload shape" });
+  }
+  const payload = value;
+  if (typeof payload["aud"] !== "string" || typeof payload["method"] !== "string" || typeof payload["uri"] !== "string" || typeof payload["bodyHash"] !== "string" || !isFiniteNumber(payload["iat"]) || !isFiniteNumber(payload["exp"])) {
+    throw new InvalidSignatureError({ reason: "Invalid payload claims" });
+  }
+  if (payload["grantId"] !== void 0 && typeof payload["grantId"] !== "string") {
+    throw new InvalidSignatureError({ reason: "Invalid grantId claim" });
+  }
+  return {
+    aud: payload["aud"],
+    method: payload["method"],
+    uri: payload["uri"],
+    bodyHash: payload["bodyHash"],
+    iat: payload["iat"],
+    exp: payload["exp"],
+    grantId: payload["grantId"]
+  };
+}
 function parseWeb3SignedHeader(headerValue) {
   if (!headerValue) {
     throw new MissingAuthError();
@@ -34,8 +58,9 @@ function parseWeb3SignedHeader(headerValue) {
   let payload;
   try {
     const decoded = base64urlDecode(payloadBase64);
-    payload = JSON.parse(decoded);
-  } catch {
+    payload = parsePayload(JSON.parse(decoded));
+  } catch (err) {
+    if (err instanceof InvalidSignatureError) throw err;
     throw new InvalidSignatureError({ reason: "Invalid payload encoding" });
   }
   return {
@@ -78,7 +103,7 @@ async function verifyWeb3Signed(params) {
       actual: payload.uri
     });
   }
-  if (params.bodyBytes !== void 0 && params.bodyBytes.length > 0) {
+  if (params.bodyBytes !== void 0) {
     const expectedBodyHash = computeBodyHash(params.bodyBytes);
     if (payload.bodyHash !== expectedBodyHash) {
       throw new InvalidSignatureError({

package/dist/auth/web3-signed.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/web3-signed.ts"],"sourcesContent":["/**\n * Web3Signed Authorization header parsing and verification.\n *\n * @remarks\n * Header format: `\"Web3Signed {base64url(payload)}.{signature}\"`.\n * Payload is JSON with fields `aud`, `method`, `uri`, `bodyHash`, `iat`, `exp`,\n * and optional `grantId`. The signature is EIP-191 over the base64url-encoded\n * payload string.\n *\n * Ported from `personal-server-ts` (`packages/core/src/auth/web3-signed.ts`).\n * Adjusted to be isomorphic (no `Buffer`) and to use SDK-local error types.\n *\n * @category Auth\n */\n\nimport { recoverMessageAddress } from \"viem\";\nimport { fromBase64 } from \"../utils/encoding\";\nimport {\n  MissingAuthError,\n  InvalidSignatureError,\n  ExpiredTokenError,\n} from \"./errors\";\nimport { computeBodyHash } from \"./web3-signed-builder\";\n\nexport interface Web3SignedPayload {\n  aud: string;\n  method: string;\n  uri: string;\n  bodyHash: string;\n  iat: number;\n  exp: number;\n  grantId?: string;\n}\n\nexport interface VerifiedAuth {\n  signer: `0x${string}`;\n  payload: Web3SignedPayload;\n}\n\nconst WEB3_SIGNED_PREFIX = \"Web3Signed \";\nconst CLOCK_SKEW_SECONDS = 60;\n\n/** Decode a base64url string (no padding) to UTF-8. */\nfunction base64urlDecode(input: string): string {\n  let base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padLength = (4 - (base64.length % 4)) % 4;\n  base64 += \"=\".repeat(padLength);\n  return new TextDecoder().decode(fromBase64(base64));\n}\n\n/**\n * Parse a `\"Web3Signed <base64url>.<signature>\"` header value.\n *\n * @throws {MissingAuthError} If the header is missing or empty.\n * @throws {InvalidSignatureError} If the format is invalid.\n */\nexport function parseWeb3SignedHeader(headerValue: string | undefined): {\n  payloadBase64: string;\n  payload: Web3SignedPayload;\n  signature: `0x${string}`;\n} {\n  if (!headerValue) {\n    throw new MissingAuthError();\n  }\n\n  if (!headerValue.startsWith(WEB3_SIGNED_PREFIX)) {\n    throw new InvalidSignatureError({ reason: \"Missing Web3Signed prefix\" });\n  }\n\n  const value = headerValue.slice(WEB3_SIGNED_PREFIX.length);\n  const dotIndex = value.indexOf(\".\");\n  if (dotIndex === -1 || dotIndex === 0 || dotIndex === value.length - 1) {\n    throw new InvalidSignatureError({ reason: \"Invalid header format\" });\n  }\n\n  const payloadBase64 = value.slice(0, dotIndex);\n  const signatureStr = value.slice(dotIndex + 1);\n\n  if (!signatureStr.startsWith(\"0x\")) {\n    throw new InvalidSignatureError({ reason: \"Invalid signature format\" });\n  }\n\n  let payload: Web3SignedPayload;\n  try {\n    const decoded = base64urlDecode(payloadBase64);\n    payload = JSON.parse(decoded) as Web3SignedPayload;\n  } catch {\n    throw new InvalidSignatureError({ reason: \"Invalid payload encoding\" });\n  }\n\n  return {\n    payloadBase64,\n    payload,\n    signature: signatureStr as `0x${string}`,\n  };\n}\n\n/**\n * Full verification: parse header, recover signer via EIP-191, check claims.\n *\n * @remarks\n * Steps:\n * 1. Parse header to base64url + signature.\n * 2. Recover signer via {@link recoverMessageAddress} (EIP-191) over the base64url payload string.\n * 3. Check `aud === expectedOrigin`, `method === expectedMethod`, `uri === expectedPath`.\n * 4. Optionally check `bodyHash` against `bodyBytes`.\n * 5. Check `iat`/`exp` within a 60s clock skew.\n *\n * @returns The recovered signer address and parsed payload.\n */\nexport async function verifyWeb3Signed(params: {\n  headerValue: string | undefined;\n  expectedOrigin: string;\n  expectedMethod: string;\n  expectedPath: string;\n  bodyBytes?: Uint8Array;\n  now?: number;\n}): Promise<VerifiedAuth> {\n  const { payloadBase64, payload, signature } = parseWeb3SignedHeader(\n    params.headerValue,\n  );\n\n  let signer: `0x${string}`;\n  try {\n    signer = await recoverMessageAddress({\n      message: payloadBase64,\n      signature,\n    });\n  } catch {\n    throw new InvalidSignatureError({ reason: \"Signature recovery failed\" });\n  }\n\n  if (payload.aud !== params.expectedOrigin) {\n    throw new InvalidSignatureError({\n      reason: \"Audience mismatch\",\n      expected: params.expectedOrigin,\n      actual: payload.aud,\n    });\n  }\n\n  if (payload.method !== params.expectedMethod) {\n    throw new InvalidSignatureError({\n      reason: \"Method mismatch\",\n      expected: params.expectedMethod,\n      actual: payload.method,\n    });\n  }\n\n  if (payload.uri !== params.expectedPath) {\n    throw new InvalidSignatureError({\n      reason: \"URI mismatch\",\n      expected: params.expectedPath,\n      actual: payload.uri,\n    });\n  }\n\n  if (params.bodyBytes !== undefined && params.bodyBytes.length > 0) {\n    const expectedBodyHash = computeBodyHash(params.bodyBytes);\n    if (payload.bodyHash !== expectedBodyHash) {\n      throw new InvalidSignatureError({\n        reason: \"Body hash mismatch\",\n        expected: expectedBodyHash,\n        actual: payload.bodyHash,\n      });\n    }\n  }\n\n  const now = params.now ?? Math.floor(Date.now() / 1000);\n\n  if (payload.exp < now - CLOCK_SKEW_SECONDS) {\n    throw new ExpiredTokenError({ reason: \"Token expired\" });\n  }\n\n  if (payload.iat > now + CLOCK_SKEW_SECONDS) {\n    throw new ExpiredTokenError({ reason: \"Token issued in the future\" });\n  }\n\n  return { signer, payload };\n}\n"],"mappings":"AAeA,SAAS,6BAA6B;AACtC,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAiBhC,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAG3B,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,aAAa,IAAK,OAAO,SAAS,KAAM;AAC9C,YAAU,IAAI,OAAO,SAAS;AAC9B,SAAO,IAAI,YAAY,EAAE,OAAO,WAAW,MAAM,CAAC;AACpD;AAQO,SAAS,sBAAsB,aAIpC;AACA,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,YAAY,WAAW,kBAAkB,GAAG;AAC/C,UAAM,IAAI,sBAAsB,EAAE,QAAQ,4BAA4B,CAAC;AAAA,EACzE;AAEA,QAAM,QAAQ,YAAY,MAAM,mBAAmB,MAAM;AACzD,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,aAAa,MAAM,aAAa,KAAK,aAAa,MAAM,SAAS,GAAG;AACtE,UAAM,IAAI,sBAAsB,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACrE;AAEA,QAAM,gBAAgB,MAAM,MAAM,GAAG,QAAQ;AAC7C,QAAM,eAAe,MAAM,MAAM,WAAW,CAAC;AAE7C,MAAI,CAAC,aAAa,WAAW,IAAI,GAAG;AAClC,UAAM,IAAI,sBAAsB,EAAE,QAAQ,2BAA2B,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,gBAAgB,aAAa;AAC7C,cAAU,KAAK,MAAM,OAAO;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,sBAAsB,EAAE,QAAQ,2BAA2B,CAAC;AAAA,EACxE;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb;AACF;AAeA,eAAsB,iBAAiB,QAOb;AACxB,QAAM,EAAE,eAAe,SAAS,UAAU,IAAI;AAAA,IAC5C,OAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,sBAAsB;AAAA,MACnC,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,sBAAsB,EAAE,QAAQ,4BAA4B,CAAC;AAAA,EACzE;AAEA,MAAI,QAAQ,QAAQ,OAAO,gBAAgB;AACzC,UAAM,IAAI,sBAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,WAAW,OAAO,gBAAgB;AAC5C,UAAM,IAAI,sBAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,QAAQ,OAAO,cAAc;AACvC,UAAM,IAAI,sBAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,cAAc,UAAa,OAAO,UAAU,SAAS,GAAG;AACjE,UAAM,mBAAmB,gBAAgB,OAAO,SAAS;AACzD,QAAI,QAAQ,aAAa,kBAAkB;AACzC,YAAM,IAAI,sBAAsB;AAAA,QAC9B,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,MAAM,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAEtD,MAAI,QAAQ,MAAM,MAAM,oBAAoB;AAC1C,UAAM,IAAI,kBAAkB,EAAE,QAAQ,gBAAgB,CAAC;AAAA,EACzD;AAEA,MAAI,QAAQ,MAAM,MAAM,oBAAoB;AAC1C,UAAM,IAAI,kBAAkB,EAAE,QAAQ,6BAA6B,CAAC;AAAA,EACtE;AAEA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;","names":[]}
+{"version":3,"sources":["../../src/auth/web3-signed.ts"],"sourcesContent":["/**\n * Web3Signed Authorization header parsing and verification.\n *\n * @remarks\n * Header format: `\"Web3Signed {base64url(payload)}.{signature}\"`.\n * Payload is JSON with fields `aud`, `method`, `uri`, `bodyHash`, `iat`, `exp`,\n * and optional `grantId`. The signature is EIP-191 over the base64url-encoded\n * payload string.\n *\n * Ported from `personal-server-ts` (`packages/core/src/auth/web3-signed.ts`).\n * Adjusted to be isomorphic (no `Buffer`) and to use SDK-local error types.\n *\n * @category Auth\n */\n\nimport { recoverMessageAddress } from \"viem\";\nimport { fromBase64 } from \"../utils/encoding\";\nimport {\n  MissingAuthError,\n  InvalidSignatureError,\n  ExpiredTokenError,\n} from \"./errors\";\nimport { computeBodyHash } from \"./web3-signed-builder\";\n\nexport interface Web3SignedPayload {\n  aud: string;\n  method: string;\n  uri: string;\n  bodyHash: string;\n  iat: number;\n  exp: number;\n  grantId?: string;\n}\n\nexport interface VerifiedAuth {\n  signer: `0x${string}`;\n  payload: Web3SignedPayload;\n}\n\nconst WEB3_SIGNED_PREFIX = \"Web3Signed \";\nconst CLOCK_SKEW_SECONDS = 60;\n\n/** Decode a base64url string (no padding) to UTF-8. */\nfunction base64urlDecode(input: string): string {\n  let base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padLength = (4 - (base64.length % 4)) % 4;\n  base64 += \"=\".repeat(padLength);\n  return new TextDecoder().decode(fromBase64(base64));\n}\n\nfunction isFiniteNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value);\n}\n\nfunction parsePayload(value: unknown): Web3SignedPayload {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new InvalidSignatureError({ reason: \"Invalid payload shape\" });\n  }\n\n  const payload = value as Record<string, unknown>;\n  if (\n    typeof payload[\"aud\"] !== \"string\" ||\n    typeof payload[\"method\"] !== \"string\" ||\n    typeof payload[\"uri\"] !== \"string\" ||\n    typeof payload[\"bodyHash\"] !== \"string\" ||\n    !isFiniteNumber(payload[\"iat\"]) ||\n    !isFiniteNumber(payload[\"exp\"])\n  ) {\n    throw new InvalidSignatureError({ reason: \"Invalid payload claims\" });\n  }\n\n  if (\n    payload[\"grantId\"] !== undefined &&\n    typeof payload[\"grantId\"] !== \"string\"\n  ) {\n    throw new InvalidSignatureError({ reason: \"Invalid grantId claim\" });\n  }\n\n  return {\n    aud: payload[\"aud\"],\n    method: payload[\"method\"],\n    uri: payload[\"uri\"],\n    bodyHash: payload[\"bodyHash\"],\n    iat: payload[\"iat\"],\n    exp: payload[\"exp\"],\n    grantId: payload[\"grantId\"],\n  };\n}\n\n/**\n * Parse a `\"Web3Signed <base64url>.<signature>\"` header value.\n *\n * @throws {MissingAuthError} If the header is missing or empty.\n * @throws {InvalidSignatureError} If the format is invalid.\n */\nexport function parseWeb3SignedHeader(headerValue: string | undefined): {\n  payloadBase64: string;\n  payload: Web3SignedPayload;\n  signature: `0x${string}`;\n} {\n  if (!headerValue) {\n    throw new MissingAuthError();\n  }\n\n  if (!headerValue.startsWith(WEB3_SIGNED_PREFIX)) {\n    throw new InvalidSignatureError({ reason: \"Missing Web3Signed prefix\" });\n  }\n\n  const value = headerValue.slice(WEB3_SIGNED_PREFIX.length);\n  const dotIndex = value.indexOf(\".\");\n  if (dotIndex === -1 || dotIndex === 0 || dotIndex === value.length - 1) {\n    throw new InvalidSignatureError({ reason: \"Invalid header format\" });\n  }\n\n  const payloadBase64 = value.slice(0, dotIndex);\n  const signatureStr = value.slice(dotIndex + 1);\n\n  if (!signatureStr.startsWith(\"0x\")) {\n    throw new InvalidSignatureError({ reason: \"Invalid signature format\" });\n  }\n\n  let payload: Web3SignedPayload;\n  try {\n    const decoded = base64urlDecode(payloadBase64);\n    payload = parsePayload(JSON.parse(decoded));\n  } catch (err) {\n    if (err instanceof InvalidSignatureError) throw err;\n    throw new InvalidSignatureError({ reason: \"Invalid payload encoding\" });\n  }\n\n  return {\n    payloadBase64,\n    payload,\n    signature: signatureStr as `0x${string}`,\n  };\n}\n\n/**\n * Full verification: parse header, recover signer via EIP-191, check claims.\n *\n * @remarks\n * Steps:\n * 1. Parse header to base64url + signature.\n * 2. Recover signer via {@link recoverMessageAddress} (EIP-191) over the base64url payload string.\n * 3. Check `aud === expectedOrigin`, `method === expectedMethod`, `uri === expectedPath`.\n * 4. Optionally check `bodyHash` against `bodyBytes`.\n * 5. Check `iat`/`exp` within a 60s clock skew.\n *\n * @returns The recovered signer address and parsed payload.\n */\nexport async function verifyWeb3Signed(params: {\n  headerValue: string | undefined;\n  expectedOrigin: string;\n  expectedMethod: string;\n  expectedPath: string;\n  bodyBytes?: Uint8Array;\n  now?: number;\n}): Promise<VerifiedAuth> {\n  const { payloadBase64, payload, signature } = parseWeb3SignedHeader(\n    params.headerValue,\n  );\n\n  let signer: `0x${string}`;\n  try {\n    signer = await recoverMessageAddress({\n      message: payloadBase64,\n      signature,\n    });\n  } catch {\n    throw new InvalidSignatureError({ reason: \"Signature recovery failed\" });\n  }\n\n  if (payload.aud !== params.expectedOrigin) {\n    throw new InvalidSignatureError({\n      reason: \"Audience mismatch\",\n      expected: params.expectedOrigin,\n      actual: payload.aud,\n    });\n  }\n\n  if (payload.method !== params.expectedMethod) {\n    throw new InvalidSignatureError({\n      reason: \"Method mismatch\",\n      expected: params.expectedMethod,\n      actual: payload.method,\n    });\n  }\n\n  if (payload.uri !== params.expectedPath) {\n    throw new InvalidSignatureError({\n      reason: \"URI mismatch\",\n      expected: params.expectedPath,\n      actual: payload.uri,\n    });\n  }\n\n  if (params.bodyBytes !== undefined) {\n    const expectedBodyHash = computeBodyHash(params.bodyBytes);\n    if (payload.bodyHash !== expectedBodyHash) {\n      throw new InvalidSignatureError({\n        reason: \"Body hash mismatch\",\n        expected: expectedBodyHash,\n        actual: payload.bodyHash,\n      });\n    }\n  }\n\n  const now = params.now ?? Math.floor(Date.now() / 1000);\n\n  if (payload.exp < now - CLOCK_SKEW_SECONDS) {\n    throw new ExpiredTokenError({ reason: \"Token expired\" });\n  }\n\n  if (payload.iat > now + CLOCK_SKEW_SECONDS) {\n    throw new ExpiredTokenError({ reason: \"Token issued in the future\" });\n  }\n\n  return { signer, payload };\n}\n"],"mappings":"AAeA,SAAS,6BAA6B;AACtC,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAiBhC,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAG3B,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,aAAa,IAAK,OAAO,SAAS,KAAM;AAC9C,YAAU,IAAI,OAAO,SAAS;AAC9B,SAAO,IAAI,YAAY,EAAE,OAAO,WAAW,MAAM,CAAC;AACpD;AAEA,SAAS,eAAe,OAAiC;AACvD,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAC3D;AAEA,SAAS,aAAa,OAAmC;AACvD,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU;AAChB,MACE,OAAO,QAAQ,KAAK,MAAM,YAC1B,OAAO,QAAQ,QAAQ,MAAM,YAC7B,OAAO,QAAQ,KAAK,MAAM,YAC1B,OAAO,QAAQ,UAAU,MAAM,YAC/B,CAAC,eAAe,QAAQ,KAAK,CAAC,KAC9B,CAAC,eAAe,QAAQ,KAAK,CAAC,GAC9B;AACA,UAAM,IAAI,sBAAsB,EAAE,QAAQ,yBAAyB,CAAC;AAAA,EACtE;AAEA,MACE,QAAQ,SAAS,MAAM,UACvB,OAAO,QAAQ,SAAS,MAAM,UAC9B;AACA,UAAM,IAAI,sBAAsB,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACrE;AAEA,SAAO;AAAA,IACL,KAAK,QAAQ,KAAK;AAAA,IAClB,QAAQ,QAAQ,QAAQ;AAAA,IACxB,KAAK,QAAQ,KAAK;AAAA,IAClB,UAAU,QAAQ,UAAU;AAAA,IAC5B,KAAK,QAAQ,KAAK;AAAA,IAClB,KAAK,QAAQ,KAAK;AAAA,IAClB,SAAS,QAAQ,SAAS;AAAA,EAC5B;AACF;AAQO,SAAS,sBAAsB,aAIpC;AACA,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,iBAAiB;AAAA,EAC7B;AAEA,MAAI,CAAC,YAAY,WAAW,kBAAkB,GAAG;AAC/C,UAAM,IAAI,sBAAsB,EAAE,QAAQ,4BAA4B,CAAC;AAAA,EACzE;AAEA,QAAM,QAAQ,YAAY,MAAM,mBAAmB,MAAM;AACzD,QAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,MAAI,aAAa,MAAM,aAAa,KAAK,aAAa,MAAM,SAAS,GAAG;AACtE,UAAM,IAAI,sBAAsB,EAAE,QAAQ,wBAAwB,CAAC;AAAA,EACrE;AAEA,QAAM,gBAAgB,MAAM,MAAM,GAAG,QAAQ;AAC7C,QAAM,eAAe,MAAM,MAAM,WAAW,CAAC;AAE7C,MAAI,CAAC,aAAa,WAAW,IAAI,GAAG;AAClC,UAAM,IAAI,sBAAsB,EAAE,QAAQ,2BAA2B,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,gBAAgB,aAAa;AAC7C,cAAU,aAAa,KAAK,MAAM,OAAO,CAAC;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAI,eAAe,sBAAuB,OAAM;AAChD,UAAM,IAAI,sBAAsB,EAAE,QAAQ,2BAA2B,CAAC;AAAA,EACxE;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb;AACF;AAeA,eAAsB,iBAAiB,QAOb;AACxB,QAAM,EAAE,eAAe,SAAS,UAAU,IAAI;AAAA,IAC5C,OAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,sBAAsB;AAAA,MACnC,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,sBAAsB,EAAE,QAAQ,4BAA4B,CAAC;AAAA,EACzE;AAEA,MAAI,QAAQ,QAAQ,OAAO,gBAAgB;AACzC,UAAM,IAAI,sBAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,WAAW,OAAO,gBAAgB;AAC5C,UAAM,IAAI,sBAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,QAAQ,OAAO,cAAc;AACvC,UAAM,IAAI,sBAAsB;AAAA,MAC9B,QAAQ;AAAA,MACR,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,cAAc,QAAW;AAClC,UAAM,mBAAmB,gBAAgB,OAAO,SAAS;AACzD,QAAI,QAAQ,aAAa,kBAAkB;AACzC,YAAM,IAAI,sBAAsB;AAAA,QAC9B,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,MAAM,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAEtD,MAAI,QAAQ,MAAM,MAAM,oBAAoB;AAC1C,UAAM,IAAI,kBAAkB,EAAE,QAAQ,gBAAgB,CAAC;AAAA,EACzD;AAEA,MAAI,QAAQ,MAAM,MAAM,oBAAoB;AAC1C,UAAM,IAAI,kBAAkB,EAAE,QAAQ,6BAA6B,CAAC;AAAA,EACtE;AAEA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;","names":[]}

package/dist/index.browser.d.ts

@@ -35,6 +35,7 @@ export { parseWeb3SignedHeader, verifyWeb3Signed, type Web3SignedPayload, type V
 export { buildWeb3SignedHeader, computeBodyHash, type Web3SignedSignFn, } from "./auth/web3-signed-builder";
 export { MissingAuthError, InvalidSignatureError, ExpiredTokenError, } from "./auth/errors";
 export { fileRegistrationDomain, grantRegistrationDomain, grantRevocationDomain, serverRegistrationDomain, builderRegistrationDomain, FILE_REGISTRATION_TYPES, GRANT_REGISTRATION_TYPES, GRANT_REVOCATION_TYPES, SERVER_REGISTRATION_TYPES, BUILDER_REGISTRATION_TYPES, type DataPortabilityContracts, type DataPortabilityGatewayConfig, type FileRegistrationMessage, type GrantRegistrationMessage, type GrantRevocationMessage, type ServerRegistrationMessage, type BuilderRegistrationMessage, } from "./protocol/eip712";
+export { isDataPortabilityGatewayConfig, parseGrantRegistrationPayload, verifyGrantRegistration, type DataPortabilityGrantPayload, type VerifyGrantRegistrationInput, type VerifyGrantRegistrationResult, } from "./protocol/grants";
 export { ScopeSchema, parseScope, scopeToPathSegments, scopeMatchesPattern, scopeCoveredByGrant, type Scope, type ParsedScope, } from "./protocol/scopes";
 export { DataFileEnvelopeSchema, createDataFileEnvelope, IngestResponseSchema, type DataFileEnvelope, type IngestResponse, } from "./protocol/data-file";
 export { createGatewayClient, type GatewayEnvelope, type GatewayProof, type Builder, type Schema, type ServerInfo, type GatewayGrantResponse, type GrantListItem, type FileRecord, type FileListResult, type RegisterServerParams, type RegisterServerResult, type RegisterFileParams, type CreateGrantParams, type RevokeGrantParams, type GatewayClient, } from "./protocol/gateway";

package/dist/index.browser.js

@@ -31548,6 +31548,30 @@ function base64urlDecode(input) {
   base64 += "=".repeat(padLength);
   return new TextDecoder().decode(fromBase64(base64));
 }
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function parsePayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new InvalidSignatureError({ reason: "Invalid payload shape" });
+  }
+  const payload = value;
+  if (typeof payload["aud"] !== "string" || typeof payload["method"] !== "string" || typeof payload["uri"] !== "string" || typeof payload["bodyHash"] !== "string" || !isFiniteNumber(payload["iat"]) || !isFiniteNumber(payload["exp"])) {
+    throw new InvalidSignatureError({ reason: "Invalid payload claims" });
+  }
+  if (payload["grantId"] !== void 0 && typeof payload["grantId"] !== "string") {
+    throw new InvalidSignatureError({ reason: "Invalid grantId claim" });
+  }
+  return {
+    aud: payload["aud"],
+    method: payload["method"],
+    uri: payload["uri"],
+    bodyHash: payload["bodyHash"],
+    iat: payload["iat"],
+    exp: payload["exp"],
+    grantId: payload["grantId"]
+  };
+}
 function parseWeb3SignedHeader(headerValue) {
   if (!headerValue) {
     throw new MissingAuthError();
@@ -31568,8 +31592,9 @@ function parseWeb3SignedHeader(headerValue) {
   let payload;
   try {
     const decoded = base64urlDecode(payloadBase64);
-    payload = JSON.parse(decoded);
-  } catch {
+    payload = parsePayload(JSON.parse(decoded));
+  } catch (err) {
+    if (err instanceof InvalidSignatureError) throw err;
     throw new InvalidSignatureError({ reason: "Invalid payload encoding" });
   }
   return {
@@ -31612,7 +31637,7 @@ async function verifyWeb3Signed(params) {
       actual: payload.uri
     });
   }
-  if (params.bodyBytes !== void 0 && params.bodyBytes.length > 0) {
+  if (params.bodyBytes !== void 0) {
     const expectedBodyHash = computeBodyHash(params.bodyBytes);
     if (payload.bodyHash !== expectedBodyHash) {
       throw new InvalidSignatureError({
@@ -31711,6 +31736,121 @@ var BUILDER_REGISTRATION_TYPES = {
   ]
 };
 
+// src/protocol/grants.ts
+import { verifyTypedData } from "viem";
+function isHexString(value) {
+  return typeof value === "string" && value.startsWith("0x");
+}
+function isDataPortabilityGatewayConfig(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const config = value;
+  const contracts = config["contracts"];
+  if (typeof config["chainId"] !== "number" || !Number.isInteger(config["chainId"]) || config["chainId"] <= 0 || contracts === null || typeof contracts !== "object" || Array.isArray(contracts)) {
+    return false;
+  }
+  const c = contracts;
+  return isHexString(c["dataRegistry"]) && isHexString(c["dataPortabilityPermissions"]) && isHexString(c["dataPortabilityServer"]) && isHexString(c["dataPortabilityGrantees"]);
+}
+function parseGrantRegistrationPayload(grant) {
+  let parsed;
+  try {
+    parsed = JSON.parse(grant);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  const value = parsed;
+  if (!Array.isArray(value["scopes"]) || value["scopes"].length === 0) {
+    return null;
+  }
+  if (!value["scopes"].every((scope) => typeof scope === "string")) {
+    return null;
+  }
+  if (typeof value["expiresAt"] !== "number" || !Number.isFinite(value["expiresAt"])) {
+    return null;
+  }
+  if (value["user"] !== void 0 && !isHexString(value["user"])) {
+    return null;
+  }
+  if (value["builder"] !== void 0 && !isHexString(value["builder"])) {
+    return null;
+  }
+  if (value["nonce"] !== void 0 && (typeof value["nonce"] !== "number" || !Number.isFinite(value["nonce"]))) {
+    return null;
+  }
+  return {
+    user: value["user"],
+    builder: value["builder"],
+    scopes: value["scopes"],
+    expiresAt: value["expiresAt"],
+    nonce: value["nonce"]
+  };
+}
+function parseFileIds(fileIds) {
+  try {
+    const values = (fileIds ?? []).map((fileId) => BigInt(fileId));
+    return {
+      values,
+      display: values.map((fileId) => fileId.toString())
+    };
+  } catch {
+    return null;
+  }
+}
+async function verifyGrantRegistration(input) {
+  const payload = parseGrantRegistrationPayload(input.grant);
+  if (!payload) {
+    return {
+      valid: false,
+      error: "Grant must be JSON with scopes and expiresAt"
+    };
+  }
+  const fileIds = parseFileIds(input.fileIds);
+  if (!fileIds) {
+    return { valid: false, error: "fileIds must contain integer values" };
+  }
+  let valid;
+  try {
+    valid = await verifyTypedData({
+      address: input.grantorAddress,
+      domain: grantRegistrationDomain(input.gatewayConfig),
+      types: GRANT_REGISTRATION_TYPES,
+      primaryType: "GrantRegistration",
+      message: {
+        grantorAddress: input.grantorAddress,
+        granteeId: input.granteeId,
+        grant: input.grant,
+        fileIds: fileIds.values
+      },
+      signature: input.signature
+    });
+  } catch {
+    return { valid: false, error: "EIP-712 signature verification failed" };
+  }
+  if (!valid) {
+    return { valid: false, error: "Grant signature does not match grantor" };
+  }
+  const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  if (payload.expiresAt > 0 && payload.expiresAt < nowSeconds) {
+    return { valid: false, error: "Grant has expired" };
+  }
+  if (payload.user !== void 0 && payload.user.toLowerCase() !== input.grantorAddress.toLowerCase()) {
+    return { valid: false, error: "Grant user does not match grantorAddress" };
+  }
+  return {
+    valid: true,
+    grantorAddress: input.grantorAddress,
+    granteeId: input.granteeId,
+    grant: input.grant,
+    payload,
+    fileIds: fileIds.display
+  };
+}
+
 // src/protocol/scopes.ts
 import { z } from "zod";
 var SEGMENT_RE = /^[a-z0-9][a-z0-9_]*$/;
@@ -31991,32 +32131,57 @@ var PSError = class extends Error {
   code;
 };
 var KNOWN_CODES = /* @__PURE__ */ new Set([
+  "missing_auth",
+  "invalid_signature",
+  "unregistered_builder",
+  "not_owner",
+  "expired_token",
   "grant_invalid",
+  "grant_required",
+  "grant_expired",
   "grant_revoked",
+  "scope_mismatch",
   "fee_required",
-  "ps_unavailable"
+  "ps_unavailable",
+  "server_not_configured",
+  "content_too_large"
 ]);
-async function parsePSError(response) {
-  if (response.ok) {
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeCode(value) {
+  if (typeof value !== "string") {
     return null;
   }
-  let body;
-  try {
-    body = await response.json();
-  } catch {
+  const code = value.toLowerCase();
+  return KNOWN_CODES.has(code) ? code : null;
+}
+function extractPSErrorBody(body) {
+  if (!isRecord(body)) {
     return null;
   }
-  if (typeof body !== "object" || body === null) {
+  const nested = isRecord(body.error) ? body.error : null;
+  const code = normalizeCode(
+    nested?.errorCode ?? nested?.code ?? body.errorCode ?? body.code
+  );
+  const message = nested?.message ?? body.message;
+  if (!code || typeof message !== "string") {
     return null;
   }
-  const { code, message } = body;
-  if (typeof code !== "string" || typeof message !== "string") {
+  return { code, message };
+}
+async function parsePSError(response) {
+  if (response.ok) {
     return null;
   }
-  if (!KNOWN_CODES.has(code)) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
     return null;
   }
-  return new PSError(code, message);
+  const errorBody = extractPSErrorBody(body);
+  return errorBody ? new PSError(errorBody.code, errorBody.message) : null;
 }
 export {
   BUILDER_REGISTRATION_TYPES,
@@ -32095,12 +32260,14 @@ export {
   getServiceEndpoints,
   grantRegistrationDomain,
   grantRevocationDomain,
+  isDataPortabilityGatewayConfig,
   isECIESEncrypted,
   isPlatformSupported,
   mainnetServices,
   moksha,
   mokshaServices,
   mokshaTestnet2 as mokshaTestnet,
+  parseGrantRegistrationPayload,
   parsePSError,
   parseScope,
   parseWeb3SignedHeader,
@@ -32111,6 +32278,7 @@ export {
   serializeECIES,
   serverRegistrationDomain,
   vanaMainnet2 as vanaMainnet,
+  verifyGrantRegistration,
   verifyPkceChallenge,
   verifyWeb3Signed
 };