@openentity/sdk 0.4.1 → 0.5.1

package/LICENSE

@@ -19,6 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
-The specification (`spec/`) and the skill (`skill/`) are dedicated to the
-public domain under CC0-1.0; see the LICENSE file in each directory.

package/README.md

@@ -10,4 +10,6 @@ Most agents want the CLI instead: `npx openentity@latest adopt`. Start at https:
 
 Shared core: `adopt(kp, {name, client})`, `trust(eid)` (a `TrustReport` from registry reads only, every signature verified locally, cached 5 minutes, `ok: false` on any failure), the issuer helpers `signAttestation`, `signRevocation`, `buildDidDocument`, `buildOpenEntityJson`, and in Node `import { Identity } from "@openentity/sdk/node"` for `Identity.loadOrCreate()` (OS keychain, else `~/.openentity/identity.key` at 0600).
 
+HTTP message signatures (RFC 9421, Web Bot Auth profile): `signRequest({method, url, body, privateKey, did})` returns `Signature-Input`, `Signature` and, for a non-empty body, `Content-Digest` (ed25519, `keyid` = the signer's did:key, covers `@method`, `@target-uri`, `content-digest`; `created`, `expires`, `nonce`). `verifyRequest({method, url, headers, body})` returns `{did, keyid, created, expires, nonce}` or throws `HttpSigError` with a `.code` (`missing_headers`, `unknown_alg`, `bad_keyid`, `digest_mismatch`, `created_in_future`, `created_too_old`, `expired`, `lifetime_too_long`, `missing_nonce`, `bad_signature`). Nonce replay tracking is yours. Shared vectors: `test-vectors/http-signature.json`.
+
 MIT licensed. Source: https://github.com/moltbot-den/openentity

package/dist/{chunk-IWY5EQIP.js → chunk-BYNZITFU.js}

@@ -1946,6 +1946,83 @@ async function readTrust(eid, base, now, get, resolver) {
   }
   return report;
 }
+var HttpSigError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "HttpSigError";
+  }
+};
+var HTTPSIG_SKEW = 5;
+var contentDigest = (body) => `sha-256=:${b64(sha256Sync(body))}:`;
+function httpSigBase(method, url, components, digest, params) {
+  const value = { "@method": method.toUpperCase(), "@target-uri": url, "content-digest": digest };
+  return utf8([...components.map((c) => `"${c}": ${value[c]}`), `"@signature-params": ${params}`].join("\n"));
+}
+async function signRequest(o) {
+  const seed = o.privateKey instanceof Uint8Array ? o.privateKey : unb64url(o.privateKey.privateJwk.d);
+  const created = o.created ?? Math.floor(Date.now() / 1e3);
+  const nonce = o.nonce ?? b64url(crypto.getRandomValues(new Uint8Array(16)));
+  const out = {};
+  const comps = ["@method", "@target-uri"];
+  if (o.body?.length) {
+    out["Content-Digest"] = contentDigest(o.body);
+    comps.push("content-digest");
+  }
+  const params = `(${comps.map((c) => `"${c}"`).join(" ")});created=${created};expires=${created + (o.expiresIn ?? 60)};nonce="${nonce}";keyid="${o.did}";alg="ed25519"`;
+  const sig = ed25519.sign(httpSigBase(o.method, o.url, comps, out["Content-Digest"], params), seed);
+  out["Signature-Input"] = `sig1=${params}`;
+  out["Signature"] = `sig1=:${b64(sig)}:`;
+  return out;
+}
+async function verifyRequest(o) {
+  const fail = (code) => {
+    throw new HttpSigError(code);
+  };
+  const h = Object.fromEntries(Object.entries(o.headers).map(([k, v]) => [k.toLowerCase(), v]));
+  const maxAge = o.maxAge ?? 300;
+  const body = o.body ?? new Uint8Array();
+  if (!h["signature-input"] || !h["signature"]) fail("missing_headers");
+  const m = /(?:^|,)\s*sig1=(\(([^)]*)\)((?:;[a-z]+=(?:\d+|"[^"]*"))*))/.exec(h["signature-input"]);
+  const s = /(?:^|,)\s*sig1=:([A-Za-z0-9+/]+={0,2}):/.exec(h["signature"]);
+  if (!m || !s) return fail("missing_headers");
+  const params = m[1];
+  const comps = [...m[2].matchAll(/"([^"]*)"/g)].map((x) => x[1]);
+  const p = {};
+  for (const [, k, v] of m[3].matchAll(/;([a-z]+)=(\d+|"[^"]*")/g)) p[k] = v.startsWith('"') ? v.slice(1, -1) : Number(v);
+  if (p.alg !== "ed25519") fail("unknown_alg");
+  const keyid = String(p.keyid ?? "");
+  let pub;
+  try {
+    pub = publicKeyFromDidKey(keyid);
+    if (didKeyFromPublicKey(pub) !== keyid) throw 0;
+  } catch {
+    return fail("bad_keyid");
+  }
+  if (typeof p.created !== "number" || typeof p.expires !== "number") fail("missing_headers");
+  const created = p.created, expires = p.expires;
+  const nonce = String(p.nonce ?? "");
+  if (nonce.length < 22) fail("missing_nonce");
+  if (comps[0] !== "@method" || comps[1] !== "@target-uri" || comps.length > 3 || comps.length === 3 && comps[2] !== "content-digest") fail("missing_headers");
+  let digest;
+  if (body.length || comps.includes("content-digest")) {
+    digest = h["content-digest"];
+    if (!comps.includes("content-digest") || digest !== contentDigest(body)) fail("digest_mismatch");
+  }
+  const now = o.now ?? Math.floor(Date.now() / 1e3);
+  if (created > now + HTTPSIG_SKEW) fail("created_in_future");
+  if (now - created > maxAge) fail("created_too_old");
+  if (expires < now) fail("expired");
+  if (expires - created > maxAge) fail("lifetime_too_long");
+  let ok = false;
+  try {
+    ok = ed25519.verify(unb64(s[1]), httpSigBase(o.method, o.url, comps, digest, params), pub);
+  } catch {
+  }
+  if (!ok) fail("bad_signature");
+  return { did: keyid, keyid, created, expires, nonce };
+}
 
 export {
   SPEC,
@@ -2008,5 +2085,9 @@ export {
   adopt,
   clearTrustCache,
   didWebResolver,
-  trust
+  trust,
+  HttpSigError,
+  httpSigBase,
+  signRequest,
+  verifyRequest
 };

package/dist/index.d.ts

@@ -359,4 +359,35 @@ export declare function trust(eid: string, o?: {
     fetchJson?: FetchJson;
     resolver?: Resolver;
 }): Promise<TrustReport>;
+export declare class HttpSigError extends Error {
+    code: string;
+    constructor(code: string);
+}
+export declare function httpSigBase(method: string, url: string, components: string[], digest: string | undefined, params: string): Uint8Array;
+/** Sign a request. `privateKey` is a KeyPair or a 32-byte Ed25519 seed. Returns Signature-Input, Signature and, for a non-empty body, Content-Digest. */
+export declare function signRequest(o: {
+    method: string;
+    url: string;
+    body?: Uint8Array;
+    privateKey: KeyPair | Uint8Array;
+    did: string;
+    created?: number;
+    expiresIn?: number;
+    nonce?: string;
+}): Promise<Record<string, string>>;
+/** Verify a request signed by signRequest. Throws HttpSigError with `.code`. Nonce replay tracking is the caller's job. */
+export declare function verifyRequest(o: {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body?: Uint8Array;
+    now?: number;
+    maxAge?: number;
+}): Promise<{
+    did: string;
+    keyid: string;
+    created: number;
+    expires: number;
+    nonce: string;
+}>;
 export {};

package/dist/index.js

@@ -4,6 +4,7 @@ import {
   DECLARATION_SHA256,
   DECLARATION_TEXT,
   DECLARATION_VERSION,
+  HttpSigError,
   SPEC,
   a2aExtension,
   adopt,
@@ -27,6 +28,7 @@ import {
   eip712Digest,
   generateKeyPair,
   hashData,
+  httpSigBase,
   inclusionProof,
   keyPairFromJwk,
   keyPairFromSeed,
@@ -49,6 +51,7 @@ import {
   signNote,
   signObject,
   signProof,
+  signRequest,
   signRevocation,
   successorDocument,
   trust,
@@ -59,14 +62,16 @@ import {
   verifyNote,
   verifyObject,
   verifyPresentation,
-  verifyProof
-} from "./chunk-IWY5EQIP.js";
+  verifyProof,
+  verifyRequest
+} from "./chunk-BYNZITFU.js";
 export {
   A2A_EXTENSION_URI,
   CLIENTS,
   DECLARATION_SHA256,
   DECLARATION_TEXT,
   DECLARATION_VERSION,
+  HttpSigError,
   SPEC,
   a2aExtension,
   adopt,
@@ -90,6 +95,7 @@ export {
   eip712Digest,
   generateKeyPair,
   hashData,
+  httpSigBase,
   inclusionProof,
   keyPairFromJwk,
   keyPairFromSeed,
@@ -112,6 +118,7 @@ export {
   signNote,
   signObject,
   signProof,
+  signRequest,
   signRevocation,
   successorDocument,
   trust,
@@ -122,5 +129,6 @@ export {
   verifyNote,
   verifyObject,
   verifyPresentation,
-  verifyProof
+  verifyProof,
+  verifyRequest
 };

package/dist/node.d.ts

@@ -6,10 +6,11 @@ export interface Identity {
     seed: Uint8Array;
     source: "keychain" | "file";
 }
-/** The entity's key from the OS keychain, else `~/.openentity/identity.key` (mode 0600). A fresh key goes to the keychain
- * when one answers, otherwise to the file. OPENENTITY_KEYCHAIN=off uses the file only. Same key file as the Python SDK. */
+/** The existing identity, or null. Never creates one. */
+declare function load(): Promise<Identity | null>;
 declare function loadOrCreate(): Promise<Identity>;
 export declare const Identity: {
+    load: typeof load;
     loadOrCreate: typeof loadOrCreate;
 };
 export {};

package/dist/node.js

@@ -1,6 +1,6 @@
 import {
   keyPairFromSeed
-} from "./chunk-IWY5EQIP.js";
+} from "./chunk-BYNZITFU.js";
 
 // src/node.ts
 import { execFileSync } from "node:child_process";
@@ -22,15 +22,19 @@ var keychainSet = (seedHex) => !keychainOn() ? false : process.platform === "dar
 var identityFile = () => join(process.env.OPENENTITY_HOME || join(homedir(), ".openentity"), "identity.key");
 var unhex = (h) => Uint8Array.from(h.match(/../g), (x) => parseInt(x, 16));
 var hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
-async function loadOrCreate() {
-  const make = async (seedHex2, source) => {
-    const seed = unhex(seedHex2), kp = await keyPairFromSeed(seed);
-    return { kp, did: kp.did, seed, source };
-  };
-  const file = identityFile();
+var make = async (seedHex, source) => {
+  const seed = unhex(seedHex), kp = await keyPairFromSeed(seed);
+  return { kp, did: kp.did, seed, source };
+};
+async function load() {
   const fromKeychain = keychainGet();
   if (fromKeychain) return make(fromKeychain, "keychain");
-  if (existsSync(file)) return make(readFileSync(file, "utf8").trim(), "file");
+  return existsSync(identityFile()) ? make(readFileSync(identityFile(), "utf8").trim(), "file") : null;
+}
+async function loadOrCreate() {
+  const found = await load();
+  if (found) return found;
+  const file = identityFile();
   const seedHex = hex(crypto.getRandomValues(new Uint8Array(32)));
   if (keychainSet(seedHex)) return make(seedHex, "keychain");
   mkdirSync(dirname(file), { recursive: true, mode: 448 });
@@ -45,7 +49,7 @@ async function loadOrCreate() {
   chmodSync(file, 384);
   return make(seedHex, "file");
 }
-var Identity = { loadOrCreate };
+var Identity = { load, loadOrCreate };
 export {
   Identity,
   identityFile

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openentity/sdk",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "Reference TypeScript SDK for the Open Entity Identity Standard (OEIS-1)",
   "license": "MIT",
   "type": "module",