@owlmeans/basic-keys 0.1.18-rc.46 → 0.1.18-rc.48

package/build/utils/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":""}

package/build/utils.d.ts

@@ -1,5 +1,4 @@
-export declare const toAddress: (publicKey: Uint8Array) => Uint8Array;
-export declare const prepareKey: (key: string) => Uint8Array;
-export declare const prepareData: (data: unknown) => Uint8Array;
-export declare const assertType: (type?: string) => void;
+import type { KeyUtils } from './utils/types.js';
+export declare const createKeyUtils: () => KeyUtils;
+export declare const keyUtils: KeyUtils;
 //# sourceMappingURL=utils.d.ts.map

package/build/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS,cAAe,UAAU,KAAG,UACP,CAAA;AAE3C,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,UACrB,CAAA;AAEpB,eAAO,MAAM,WAAW,SAAU,OAAO,KAAG,UAiB3C,CAAA;AAED,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,IAI1C,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAEhD,eAAO,MAAM,cAAc,QAAO,QAiCjC,CAAA;AAED,eAAO,MAAM,QAAQ,UAAmB,CAAA"}

package/build/utils.js

@@ -1,29 +1,33 @@
-import { keccak_256 } from '@noble/hashes/sha3';
+import { keccak_256 } from '@noble/hashes/sha3.js';
 import { base64, utf8 } from '@scure/base';
 import { plugins } from './plugins/index.js';
 import canonicalize from 'canonicalize';
-export const toAddress = (publicKey) => keccak_256(publicKey.slice(4)).slice(-20);
-export const prepareKey = (key) => base64.decode(key);
-export const prepareData = (data) => {
-    if (typeof data === 'object') {
+export const createKeyUtils = () => {
+    const toAddress = (publicKey) => keccak_256(publicKey.slice(4)).slice(-20);
+    const prepareKey = (key) => base64.decode(key);
+    const prepareData = (data) => {
+        if (typeof data === 'object') {
+            if (!(data instanceof Uint8Array)) {
+                data = canonicalize(data);
+            }
+        }
+        if (typeof data === 'string') {
+            data = utf8.decode(data);
+        }
+        else if (!(data instanceof Uint8Array)) {
+            throw new Error('basic.keys:sign-data-type');
+        }
         if (!(data instanceof Uint8Array)) {
-            data = canonicalize(data);
+            throw new Error('basic.keys:sign-data-type');
         }
-    }
-    if (typeof data === 'string') {
-        data = utf8.decode(data);
-    }
-    else if (!(data instanceof Uint8Array)) {
-        throw new Error('basic.keys:sign-data-type');
-    }
-    if (!(data instanceof Uint8Array)) {
-        throw new Error('basic.keys:sign-data-type');
-    }
-    return data;
-};
-export const assertType = (type) => {
-    if (type == null || !(type in plugins)) {
-        throw new Error('basic.keys:unknown-type');
-    }
+        return data;
+    };
+    const assertType = (type) => {
+        if (type == null || !(type in plugins)) {
+            throw new Error('basic.keys:unknown-type');
+        }
+    };
+    return { toAddress, prepareKey, prepareData, assertType };
 };
+export const keyUtils = createKeyUtils();
 //# sourceMappingURL=utils.js.map

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,YAAY,MAAM,cAAc,CAAA;AAEvC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAAqB,EAAc,EAAE,CAC7D,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;AAE3C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAc,EAAE,CACpD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAa,EAAc,EAAE;IACvD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YAClC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAa,EAAQ,EAAE;IAChD,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,YAAY,MAAM,cAAc,CAAA;AAGvC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAa,EAAE;IAC3C,MAAM,SAAS,GAAG,CAAC,SAAqB,EAAc,EAAE,CACtD,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;IAE3C,MAAM,UAAU,GAAG,CAAC,GAAW,EAAc,EAAE,CAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAEpB,MAAM,WAAW,GAAG,CAAC,IAAa,EAAc,EAAE;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;gBAClC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,IAAa,EAAQ,EAAE;QACzC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAA;IAED,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;AAC3D,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/basic-keys",
-  "version": "0.1.18-rc.46",
+  "version": "0.1.18-rc.48",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -40,18 +40,18 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.44",
-    "@types/bun": "^1.4.0",
+    "@owlmeans/test-auth": "^0.1.18-rc.46",
+    "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },
   "dependencies": {
-    "@noble/ciphers": "^1.2.1",
-    "@noble/curves": "^1.6.0",
-    "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.38",
-    "@scure/base": "^2.3.0",
-    "canonicalize": "^2.0.0"
+    "@noble/ciphers": "^2.4.0",
+    "@noble/curves": "^2.4.0",
+    "@noble/hashes": "^2.4.0",
+    "@owlmeans/auth": "^0.1.18-rc.40",
+    "@scure/base": "^2.4.0",
+    "canonicalize": "^5.1.0"
   },
   "publishConfig": {
     "access": "public"

package/src/auth/types.ts

@@ -0,0 +1,17 @@
+import type { AuthCredentials } from '@owlmeans/auth'
+import type { KeyPairModel, PayloadSigner, PayloadVerifier, UnpackedAuthCredentials, UnsignedAuthCredentials } from '../types.js'
+
+/** Signed authentication credentials: the signature packed into `credential` with any extras. */
+export interface AuthCredentialsHelper {
+  /** Sign `auth` (plus canonicalized `extra`) and pack the signature into `credential`. */
+  packAuthCredentials: <T extends {} | undefined>(
+    auth: UnsignedAuthCredentials,
+    extra: T,
+    signer: KeyPairModel | PayloadSigner
+  ) => Promise<AuthCredentials>
+  /** Take packed credentials apart and, given a verifier, check the signature. */
+  unpackAuthCredentials: <T extends {} | undefined>(
+    auth: AuthCredentials,
+    verifier?: KeyPairModel | PayloadVerifier
+  ) => Promise<UnpackedAuthCredentials<T>>
+}

package/src/auth.ts

@@ -1,60 +1,67 @@
 import type { AuthCredentials } from '@owlmeans/auth'
 import type { KeyPairModel, PayloadSigner, PayloadVerifier, UnpackedAuthCredentials, UnsignedAuthCredentials } from './types.js'
 import canonicalize from 'canonicalize'
+import type { AuthCredentialsHelper } from './auth/types.js'
 
-export const packAuthCredentials = async <T extends {} | undefined>(
-  auth: UnsignedAuthCredentials,
-  extra: T,
-  signer: KeyPairModel | PayloadSigner
-): Promise<AuthCredentials> => {
-  const unsigned: UnsignedAuthCredentials = {
-    ...auth,
-    ...(extra == null ? {} : { credential: canonicalize(extra) as string })
-  }
+export const createAuthCredentialsHelper = (): AuthCredentialsHelper => {
+  const packAuthCredentials = async <T extends {} | undefined>(
+    auth: UnsignedAuthCredentials,
+    extra: T,
+    signer: KeyPairModel | PayloadSigner
+  ): Promise<AuthCredentials> => {
+    const unsigned: UnsignedAuthCredentials = {
+      ...auth,
+      ...(extra == null ? {} : { credential: canonicalize(extra) as string })
+    }
 
-  if (typeof signer !== 'function') {
-    const _signer = signer
-    signer = async payload => await _signer.sign(payload)
-  }
+    if (typeof signer !== 'function') {
+      const _signer = signer
+      signer = async payload => await _signer.sign(payload)
+    }
 
-  const signature = await signer(unsigned)
+    const signature = await signer(unsigned)
 
-  return {
-    ...auth,
-    credential: extra == null ? signature : canonicalize({ ...extra, signature }) as string,
+    return {
+      ...auth,
+      credential: extra == null ? signature : canonicalize({ ...extra, signature }) as string,
+    }
   }
-}
 
-export const unpackAuthCredentials = async <T extends {} | undefined>(
-  auth: AuthCredentials,
-  verifier?: KeyPairModel | PayloadVerifier
-): Promise<UnpackedAuthCredentials<T>> => {
-  let signature: string = ''
-  let extras: T
-  try {
-    extras = JSON.parse(auth.credential)
-    if (typeof extras === 'object' && extras != null && "signature" in extras) {
-      signature = extras.signature as string
-      delete extras.signature
+  const unpackAuthCredentials = async <T extends {} | undefined>(
+    auth: AuthCredentials,
+    verifier?: KeyPairModel | PayloadVerifier
+  ): Promise<UnpackedAuthCredentials<T>> => {
+    let signature: string = ''
+    let extras: T
+    try {
+      extras = JSON.parse(auth.credential)
+      if (typeof extras === 'object' && extras != null && "signature" in extras) {
+        signature = extras.signature as string
+        delete extras.signature
+      }
+    } catch {
+      signature = auth.credential
+      extras = undefined as T
     }
-  } catch {
-    signature = auth.credential
-    extras = undefined as T
-  }
-  const unsigned: UnsignedAuthCredentials = { 
-    ...auth,
-    ...(extras == null ? {} : { credential: canonicalize(extras) as string })
-  }
-  let isValid: boolean | undefined = undefined
+    const unsigned: UnsignedAuthCredentials = { 
+      ...auth,
+      ...(extras == null ? {} : { credential: canonicalize(extras) as string })
+    }
+    let isValid: boolean | undefined = undefined
 
-  if (verifier != null) {
-    if (typeof verifier !== 'function') {
-      const _verifier = verifier
-      verifier = async (payload, signature) => await _verifier.verify(payload, signature)
+    if (verifier != null) {
+      if (typeof verifier !== 'function') {
+        const _verifier = verifier
+        verifier = async (payload, signature) => await _verifier.verify(payload, signature)
+      }
+
+      isValid = await verifier(unsigned, signature)
     }
 
-    isValid = await verifier(unsigned, signature)
+    return { unsigned, signature, isValid, extras }
   }
 
-  return { unsigned, signature, isValid, extras }
+  return { packAuthCredentials, unpackAuthCredentials }
 }
+
+export const authCredentialsHelper = createAuthCredentialsHelper()

package/src/helper/types.ts

@@ -0,0 +1,11 @@
+import type { KeyPairModel } from '../types.js'
+
+/** Key models built from what a peer publishes: its public key and its address. */
+export interface KeyHelper {
+  /**
+   * A verify-only key model of a public key, `<type>:<key>` or a bare key (ed25519 by default).
+   */
+  fromPubKey: (pubKey: string, type?: string) => KeyPairModel
+  /** Whether an address is the one the public key derives to. */
+  matchAddress: (address: string, pubKey: string) => boolean
+}

package/src/helper.ts

@@ -2,26 +2,36 @@ import { KeyType } from './consts.js'
 import { makeKeyPairModel } from './model.js'
 import { plugins } from './plugins/index.js'
 import type { KeyPair, KeyPairModel } from './types.js'
-import { prepareKey } from './utils.js'
+import { keyUtils } from './utils.js'
+import type { KeyHelper } from './helper/types.js'
 
-export const fromPubKey = (pubKey: string, type?: string): KeyPairModel => {
-  if (type == null) {
-    [type, pubKey] = pubKey.includes(':') ? pubKey.split(':', 2) : [KeyType.ED25519, pubKey]
-    if (pubKey == null) {
-      pubKey = type
-      type = KeyType.ED25519
+export const createKeyHelper = (): KeyHelper => {
+  const fromPubKey = (pubKey: string, type?: string): KeyPairModel => {
+    if (type == null) {
+      [type, pubKey] = pubKey.includes(':') ? pubKey.split(':', 2) : [KeyType.ED25519, pubKey]
+      if (pubKey == null) {
+        pubKey = type
+        type = KeyType.ED25519
+      }
+    }
+
+    const keyPair: KeyPair = {
+      privateKey: '',
+      publicKey: pubKey,
+      type,
+      address: plugins[type].toAdress(keyUtils.prepareKey(pubKey))
     }
-  }
 
-  const keyPair: KeyPair = {
-    privateKey: '',
-    publicKey: pubKey,
-    type,
-    address: plugins[type].toAdress(prepareKey(pubKey))
+    return makeKeyPairModel(keyPair)
   }
 
-  return makeKeyPairModel(keyPair)
+  const matchAddress = (address: string, pubKey: string): boolean =>
+    address === fromPubKey(pubKey).exportAddress()
+
+  return { fromPubKey, matchAddress }
 }
 
-export const matchAddress = (address: string, pubKey: string): boolean =>
-  address === fromPubKey(pubKey).exportAddress()
+export const keyHelper = createKeyHelper()
+
+/** @deprecated compat:factory-refactor — use `keyHelper.fromPubKey(…)` */
+export const fromPubKey = (pubKey: string, type?: string): KeyPairModel => keyHelper.fromPubKey(pubKey, type)

package/src/index.ts

@@ -1,4 +1,6 @@
 export type * from './types.js'
+export type * from './helper/types.js'
+export type * from './auth/types.js'
 
 export * from './consts.js'
 export * from './helper.js'

package/src/keypair.ts

@@ -2,7 +2,7 @@ import type { KeyPair } from './types.js'
 import { base64 } from '@scure/base'
 import { KeyType } from './consts.js'
 import { plugins } from './plugins/index.js'
-import { assertType } from './utils.js'
+import { keyUtils } from './utils.js'
 
 export const inputToKeyPair = (input?: KeyPair | string): KeyPair => {
   let type: string = KeyType.ED25519
@@ -27,7 +27,7 @@ export const inputToKeyPair = (input?: KeyPair | string): KeyPair => {
     }
   }
   if (keyPair == null) {
-    assertType(type)
+    keyUtils.assertType(type)
     if (primaryKey == null) {
       primaryKey = plugins[type].random()
     }

package/src/model.ts

@@ -1,18 +1,18 @@
-import type { KeyPairModel, KeyPairModelMaker } from './types.js'
+import type { KeyPair, KeyPairModel } from './types.js'
 import { plugins } from './plugins/index.js'
 import { base64urlnopad, utf8 } from '@scure/base'
-import { assertType, prepareData, prepareKey } from './utils.js'
+import { keyUtils } from './utils.js'
 import { inputToKeyPair } from './keypair.js'
 
-export const makeKeyPairModel: KeyPairModelMaker = input => {
+export const makeKeyPairModel = (input?: KeyPair | string): KeyPairModel => {
   const keyPair = inputToKeyPair(input)
 
   const _model: KeyPairModel = {
     keyPair,
 
     sign: async (data) => {
-      data = prepareData(data)
-      assertType(_model.keyPair?.type)
+      data = keyUtils.prepareData(data)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -25,14 +25,14 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
       return base64urlnopad.encode(
         plugins[_model.keyPair.type].sign(
           data as Uint8Array,
-          prepareKey(_model.keyPair.privateKey)
+          keyUtils.prepareKey(_model.keyPair.privateKey)
         )
       )
     },
     
     verify: async (data, signature) => {
-      data = prepareData(data)
-      assertType(_model.keyPair?.type)
+      data = keyUtils.prepareData(data)
+      keyUtils.assertType(_model.keyPair?.type)
       const sig = base64urlnopad.decode(signature)
 
       if (_model.keyPair == null) {
@@ -42,12 +42,12 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
       return plugins[_model.keyPair.type].verify(
         data as Uint8Array,
         sig,
-        prepareKey(_model.keyPair.publicKey)
+        keyUtils.prepareKey(_model.keyPair.publicKey)
       )
     },
 
     export: () => {
-      assertType(_model.keyPair?.type)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -57,7 +57,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
     },
 
     exportPublic: () => {
-      assertType(_model.keyPair?.type)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -67,7 +67,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
     },
 
     exportAddress: () => {
-      assertType(_model.keyPair?.type)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -77,8 +77,8 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
     },
 
     encrypt: async data => {
-      data = prepareData(data)
-      assertType(_model.keyPair?.type)
+      data = keyUtils.prepareData(data)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -87,7 +87,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
       return base64urlnopad.encode(
         plugins[_model.keyPair.type].encrypt(
           data as Uint8Array,
-          prepareKey(_model.keyPair.publicKey)
+          keyUtils.prepareKey(_model.keyPair.publicKey)
         )
       )
     },
@@ -105,7 +105,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
 
     dcrpt: async data => {
       data = data instanceof Uint8Array ? data : base64urlnopad.decode(data as string)
-      assertType(_model.keyPair?.type)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -113,7 +113,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
 
       return plugins[_model.keyPair.type].decrypt(
         data as Uint8Array,
-        prepareKey(_model.keyPair.privateKey)
+        keyUtils.prepareKey(_model.keyPair.privateKey)
       )
     }
   }

package/src/plugins/ed25519.ts

@@ -1,13 +1,13 @@
 import { KeyType } from '../consts.js'
 import type { KeyPlugin } from './types.js'
-import { ed25519 } from '@noble/curves/ed25519'
+import { ed25519 } from '@noble/curves/ed25519.js'
 import { base58 } from '@scure/base'
-import { keccak_256 } from '@noble/hashes/sha3'
+import { keccak_256 } from '@noble/hashes/sha3.js'
 
 export const ed25519Plugin: KeyPlugin = {
   type: KeyType.ED25519,
 
-  random: () => ed25519.utils.randomPrivateKey(),
+  random: () => ed25519.utils.randomSecretKey(),
 
   sign: (data, pk) => ed25519.sign(data, pk),
 

package/src/plugins/xchacha.ts

@@ -1,7 +1,7 @@
 import { KeyType } from '../consts.js'
 import type { KeyPlugin } from './types.js'
-import { xchacha20poly1305 } from '@noble/ciphers/chacha'
-import { randomBytes, managedNonce } from '@noble/ciphers/webcrypto'
+import { xchacha20poly1305 } from '@noble/ciphers/chacha.js'
+import { randomBytes, managedNonce } from '@noble/ciphers/utils.js'
 
 
 export const xChahaPlugin: KeyPlugin = {

package/src/utils/types.ts

@@ -0,0 +1,15 @@
+/** The low-level key and payload primitives the key models and plugins share. */
+export interface KeyUtils {
+  /** The 20-byte address of a public key: the tail of its keccak-256 digest. */
+  toAddress: (publicKey: Uint8Array) => Uint8Array
+  /** A base64-encoded key as bytes. */
+  prepareKey: (key: string) => Uint8Array
+  /**
+   * Bytes to sign, verify or encrypt: an object is canonicalized, a string UTF-8 encoded.
+   *
+   * @throws {Error} `basic.keys:sign-data-type` for anything else
+   */
+  prepareData: (data: unknown) => Uint8Array
+  /** @throws {Error} `basic.keys:unknown-type` for a key type no plugin is registered for */
+  assertType: (type?: string) => void
+}

package/src/utils.ts

@@ -1,35 +1,42 @@
-import { keccak_256 } from '@noble/hashes/sha3'
+import { keccak_256 } from '@noble/hashes/sha3.js'
 import { base64, utf8 } from '@scure/base'
 import { plugins } from './plugins/index.js'
 import canonicalize from 'canonicalize'
+import type { KeyUtils } from './utils/types.js'
 
-export const toAddress = (publicKey: Uint8Array): Uint8Array =>
-  keccak_256(publicKey.slice(4)).slice(-20)
+export const createKeyUtils = (): KeyUtils => {
+  const toAddress = (publicKey: Uint8Array): Uint8Array =>
+    keccak_256(publicKey.slice(4)).slice(-20)
 
-export const prepareKey = (key: string): Uint8Array =>
-  base64.decode(key)
+  const prepareKey = (key: string): Uint8Array =>
+    base64.decode(key)
+
+  const prepareData = (data: unknown): Uint8Array => {
+    if (typeof data === 'object') {
+      if (!(data instanceof Uint8Array)) {
+        data = canonicalize(data)
+      }
+    }
+    if (typeof data === 'string') {
+      data = utf8.decode(data)
+    } else if (!(data instanceof Uint8Array)) {
+      throw new Error('basic.keys:sign-data-type')
+    }
 
-export const prepareData = (data: unknown): Uint8Array => {
-  if (typeof data === 'object') {
     if (!(data instanceof Uint8Array)) {
-      data = canonicalize(data)
+      throw new Error('basic.keys:sign-data-type')
     }
-  }
-  if (typeof data === 'string') {
-    data = utf8.decode(data)
-  } else if (!(data instanceof Uint8Array)) {
-    throw new Error('basic.keys:sign-data-type')
+
+    return data
   }
 
-  if (!(data instanceof Uint8Array)) {
-    throw new Error('basic.keys:sign-data-type')
+  const assertType = (type?: string): void => {
+    if (type == null || !(type in plugins)) {
+      throw new Error('basic.keys:unknown-type')
+    }
   }
 
-  return data
+  return { toAddress, prepareKey, prepareData, assertType }
 }
 
-export const assertType = (type?: string): void => {
-  if (type == null || !(type in plugins)) {
-    throw new Error('basic.keys:unknown-type')
-  }
-}
+export const keyUtils = createKeyUtils()

package/tests/auth.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test'
-import { packAuthCredentials, unpackAuthCredentials } from '@owlmeans/basic-keys'
+import { authCredentialsHelper } from '@owlmeans/basic-keys'
 import { AuthRole, AuthenticationType } from '@owlmeans/auth'
 import type { AuthCredentials } from '@owlmeans/auth'
 import { fixtureKey } from './context.js'
@@ -15,8 +15,8 @@ const baseCreds = (): Omit<AuthCredentials, 'credential'> => ({
 describe('@owlmeans/basic-keys — packAuthCredentials round-trip', () => {
   test('signs and verifies credentials with extras attached', async () => {
     const key = fixtureKey()
-    const signed = await packAuthCredentials(baseCreds(), { nonce: 'n-1' }, key)
-    const result = await unpackAuthCredentials<{ nonce: string }>(signed, key)
+    const signed = await authCredentialsHelper.packAuthCredentials(baseCreds(), { nonce: 'n-1' }, key)
+    const result = await authCredentialsHelper.unpackAuthCredentials<{ nonce: string }>(signed, key)
     expect(result.isValid).toBe(true)
     expect(result.extras?.nonce).toBe('n-1')
   })
@@ -24,8 +24,8 @@ describe('@owlmeans/basic-keys — packAuthCredentials round-trip', () => {
   test('verification fails for a different keypair', async () => {
     const signing = fixtureKey('alice')
     const other = fixtureKey('bob')
-    const signed = await packAuthCredentials(baseCreds(), { nonce: 'n-1' }, signing)
-    const result = await unpackAuthCredentials(signed, other)
+    const signed = await authCredentialsHelper.packAuthCredentials(baseCreds(), { nonce: 'n-1' }, signing)
+    const result = await authCredentialsHelper.unpackAuthCredentials(signed, other)
     expect(result.isValid).toBe(false)
   })
 })

package/tests/keys.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test'
-import { fromPubKey, makeKeyPairModel, matchAddress } from '@owlmeans/basic-keys'
+import { keyHelper, makeKeyPairModel } from '@owlmeans/basic-keys'
 import { fixtureKey } from './context.js'
 
 describe('@owlmeans/basic-keys — KeyPairModel sign/verify', () => {
@@ -26,13 +26,13 @@ describe('@owlmeans/basic-keys — public-key-only verification (fromPubKey)', (
     const signing = fixtureKey('peer-keys-spec')
     const sig = await signing.sign({ event: 'check' })
 
-    const verifying = fromPubKey(signing.exportPublic())
+    const verifying = keyHelper.fromPubKey(signing.exportPublic())
     expect(await verifying.verify({ event: 'check' }, sig)).toBe(true)
   })
 
   test('matchAddress agrees with exportAddress() on the same keypair', () => {
     const key = fixtureKey('addr-spec')
-    expect(matchAddress(key.exportAddress(), key.exportPublic())).toBe(true)
+    expect(keyHelper.matchAddress(key.exportAddress(), key.exportPublic())).toBe(true)
   })
 
   test('export() round-trips into a new model that produces the same public key', async () => {