@owlmeans/basic-keys 0.1.18-rc.47 → 0.1.18-rc.48

package/README.md

@@ -12,7 +12,7 @@ ED25519 and XChaCha20 cryptographic key operations: generation, signing, verific
 ## Installation
 
 ```bash
-bun add @owlmeans/basic-keys@^0.1.18-rc.47
+bun add @owlmeans/basic-keys@^0.1.18-rc.48
 ```
 
 ## Usage
@@ -32,19 +32,19 @@ const address = pair.exportAddress()        // derive address from public key
 Load from an existing public key:
 
 ```typescript
-import { fromPubKey, matchAddress } from '@owlmeans/basic-keys'
+import { keyHelper } from '@owlmeans/basic-keys'
 
-const model = fromPubKey('ed25519:ABC123...')
-const isMatch = matchAddress(knownAddress, publicKeyStr)
+const model = keyHelper.fromPubKey('ed25519:ABC123...')
+const isMatch = keyHelper.matchAddress(knownAddress, publicKeyStr)
 ```
 
 Pack authentication credentials for a request:
 
 ```typescript
-import { packAuthCredentials, unpackAuthCredentials } from '@owlmeans/basic-keys'
+import { authCredentialsHelper } from '@owlmeans/basic-keys'
 
-const signed = await packAuthCredentials(authObj, extraData, keyPairModel)
-const { isValid, extras } = await unpackAuthCredentials(signed, keyPairModel)
+const signed = await authCredentialsHelper.packAuthCredentials(authObj, extraData, keyPairModel)
+const { isValid, extras } = await authCredentialsHelper.unpackAuthCredentials(signed, keyPairModel)
 ```
 
 ## API
@@ -53,19 +53,19 @@ const { isValid, extras } = await unpackAuthCredentials(signed, keyPairModel)
 
 Creates a `KeyPairModel` from an existing `KeyPair` object, encoded private key string, or algorithm type string. Generates a new ED25519 key pair when called with no arguments.
 
-### `fromPubKey(pubKey, type?): KeyPairModel`
+### `keyHelper.fromPubKey(pubKey, type?): KeyPairModel`
 
 Creates a verify-only `KeyPairModel` from a public key string. Supports `"type:key"` format.
 
-### `matchAddress(address, pubKey): boolean`
+### `keyHelper.matchAddress(address, pubKey): boolean`
 
 Returns true if `address` was derived from `pubKey`.
 
-### `packAuthCredentials(auth, extra, signer): Promise<AuthCredentials>`
+### `authCredentialsHelper.packAuthCredentials(auth, extra, signer): Promise<AuthCredentials>`
 
 Signs auth credentials, optionally embedding extra data in the credential field.
 
-### `unpackAuthCredentials(auth, verifier?): Promise<UnpackedAuthCredentials>`
+### `authCredentialsHelper.unpackAuthCredentials(auth, verifier?): Promise<UnpackedAuthCredentials>`
 
 Extracts and optionally verifies signed auth credentials. Returns `isValid` boolean when a verifier is provided.
 
@@ -89,7 +89,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.49
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/basic-keys",
-  "version": "0.1.18-rc.47",
-  "generatedAt": "2026-10-05T08:32:19.086Z",
+  "version": "0.1.18-rc.48",
+  "generatedAt": "2026-10-05T21:03:06.361Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/basic-keys/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/basic-keys
 
 **Layer:** Core
-**Install:** `"@owlmeans/basic-keys": "^0.1.18-rc.47"` in `dependencies`
+**Install:** `"@owlmeans/basic-keys": "^0.1.18-rc.48"` in `dependencies`
 
 ## Key Exports
 
@@ -18,9 +18,9 @@ user-invocable: false
 | `KeyPair` | Key pair shape: `{ privateKey, publicKey, address, type }`, keys base64 |
 | `KeyPairModel` | `sign` / `verify` / `encrypt` / `decrypt` / `dcrpt` / `export*` |
 | `KeyType` | `ED25519` (`'ed25519'`, signing) and `XCHACHA` (`'xchacha'`, encryption) |
-| `fromPubKey(key, type?)`, `matchAddress(address, pubKey)` | Verify-only model from a public key; address check |
-| `packAuthCredentials(auth, extra, signer)` | Sign a credential payload into `AuthCredentials.credential` |
-| `unpackAuthCredentials(auth, verifier?)` | Split that back into `{ unsigned, signature, extras, isValid }` |
+| `keyHelper.fromPubKey(key, type?)`, `keyHelper.matchAddress(address, pubKey)` | Verify-only model from a public key; address check |
+| `authCredentialsHelper.packAuthCredentials(auth, extra, signer)` | Sign a credential payload into `AuthCredentials.credential` |
+| `authCredentialsHelper.unpackAuthCredentials(auth, verifier?)` | Split that back into `{ unsigned, signature, extras, isValid }` |
 | `plugins` | The key-type registry, keyed by type string |
 
 ## Subpath Exports
@@ -29,7 +29,7 @@ user-invocable: false
   again, and the **`KeyPlugin` type**. `KeyPlugin` is *not* on the root surface: the root re-exports
   only the registry value, so a package implementing a new key type imports the type from
   `@owlmeans/basic-keys/plugins`.
-- `./utils` — `assertType`, `prepareKey`, `prepareData`, `toAddress`
+- `./utils` — `keyUtils`: `assertType`, `prepareKey`, `prepareData`, `toAddress`
 
 ## Usage
 
@@ -68,9 +68,9 @@ Plain `Error` with a `basic.keys:<code>` message — this package does **not** u
 Not every failure comes back as one of these, so do not match on a code where the underlying
 library throws first:
 
-- Signing with a **verify-only** model does not raise `basic.keys:missing-pk`. `fromPubKey` stores
-  `privateKey: ''`, which passes the null guard, and `@noble/curves` rejects it as
-  `private key of length 32 expected, got 0`.
+- Signing with a **verify-only** model does not raise `basic.keys:missing-pk`.
+  `keyHelper.fromPubKey` stores `privateKey: ''`, which passes the null guard, and `@noble/curves`
+  rejects it as `private key of length 32 expected, got 0`.
 - A string input that is neither a key type nor valid base64 fails in the decoder
   (`Found a character that cannot be part of a valid base64 string`), never with a `basic.keys:`
   code.
@@ -96,11 +96,11 @@ Callers that tolerate undecryptable values must catch — e.g. `@owlmeans/mongo`
 
 ## Signed credentials
 
-`packAuthCredentials` canonicalizes the unsigned credentials plus your extras, signs them, and
-returns `AuthCredentials` whose `credential` holds the signature (alone, or folded into the extras).
-`unpackAuthCredentials` reverses it and — given a verifier — reports `isValid`. Either side accepts
-a `KeyPairModel` or a bare sign/verify function, so a caller that holds only a remote signer works
-the same way.
+`authCredentialsHelper.packAuthCredentials` canonicalizes the unsigned credentials plus your
+extras, signs them, and returns `AuthCredentials` whose `credential` holds the signature (alone, or
+folded into the extras). `authCredentialsHelper.unpackAuthCredentials` reverses it and — given a
+verifier — reports `isValid`. Either side accepts a `KeyPairModel` or a bare sign/verify function,
+so a caller that holds only a remote signer works the same way.
 
 ## Depends On
 

package/build/auth/types.d.ts

@@ -0,0 +1,10 @@
+import type { AuthCredentials } from '@owlmeans/auth';
+import type { KeyPairModel, PayloadSigner, PayloadVerifier, UnpackedAuthCredentials, UnsignedAuthCredentials } from '../types.js';
+/** Signed authentication credentials: the signature packed into `credential` with any extras. */
+export interface AuthCredentialsHelper {
+    /** Sign `auth` (plus canonicalized `extra`) and pack the signature into `credential`. */
+    packAuthCredentials: <T extends {} | undefined>(auth: UnsignedAuthCredentials, extra: T, signer: KeyPairModel | PayloadSigner) => Promise<AuthCredentials>;
+    /** Take packed credentials apart and, given a verifier, check the signature. */
+    unpackAuthCredentials: <T extends {} | undefined>(auth: AuthCredentials, verifier?: KeyPairModel | PayloadVerifier) => Promise<UnpackedAuthCredentials<T>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAEjI,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,SAAS,EAC5C,IAAI,EAAE,uBAAuB,EAC7B,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,YAAY,GAAG,aAAa,KACjC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC7B,gFAAgF;IAChF,qBAAqB,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,SAAS,EAC9C,IAAI,EAAE,eAAe,EACrB,QAAQ,CAAC,EAAE,YAAY,GAAG,eAAe,KACtC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAA;CACzC"}

package/build/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/build/auth.d.ts

@@ -1,5 +1,4 @@
-import type { AuthCredentials } from '@owlmeans/auth';
-import type { KeyPairModel, PayloadSigner, PayloadVerifier, UnpackedAuthCredentials, UnsignedAuthCredentials } from './types.js';
-export declare const packAuthCredentials: <T extends {} | undefined>(auth: UnsignedAuthCredentials, extra: T, signer: KeyPairModel | PayloadSigner) => Promise<AuthCredentials>;
-export declare const unpackAuthCredentials: <T extends {} | undefined>(auth: AuthCredentials, verifier?: KeyPairModel | PayloadVerifier) => Promise<UnpackedAuthCredentials<T>>;
+import type { AuthCredentialsHelper } from './auth/types.js';
+export declare const createAuthCredentialsHelper: () => AuthCredentialsHelper;
+export declare const authCredentialsHelper: AuthCredentialsHelper;
 //# sourceMappingURL=auth.d.ts.map

package/build/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAGhI,eAAO,MAAM,mBAAmB,GAAU,CAAC,SAAS,EAAE,GAAG,SAAS,QAC1D,uBAAuB,SACtB,CAAC,UACA,YAAY,GAAG,aAAa,KACnC,OAAO,CAAC,eAAe,CAiBzB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,CAAC,SAAS,EAAE,GAAG,SAAS,QAC5D,eAAe,aACV,YAAY,GAAG,eAAe,KACxC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CA6BpC,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAE5D,eAAO,MAAM,2BAA2B,QAAO,qBA2D9C,CAAA;AAED,eAAO,MAAM,qBAAqB,uBAAgC,CAAA"}

package/build/auth.js

@@ -1,45 +1,49 @@
 import canonicalize from 'canonicalize';
-export const packAuthCredentials = async (auth, extra, signer) => {
-    const unsigned = {
-        ...auth,
-        ...(extra == null ? {} : { credential: canonicalize(extra) })
-    };
-    if (typeof signer !== 'function') {
-        const _signer = signer;
-        signer = async (payload) => await _signer.sign(payload);
-    }
-    const signature = await signer(unsigned);
-    return {
-        ...auth,
-        credential: extra == null ? signature : canonicalize({ ...extra, signature }),
-    };
-};
-export const unpackAuthCredentials = async (auth, verifier) => {
-    let signature = '';
-    let extras;
-    try {
-        extras = JSON.parse(auth.credential);
-        if (typeof extras === 'object' && extras != null && "signature" in extras) {
-            signature = extras.signature;
-            delete extras.signature;
+export const createAuthCredentialsHelper = () => {
+    const packAuthCredentials = async (auth, extra, signer) => {
+        const unsigned = {
+            ...auth,
+            ...(extra == null ? {} : { credential: canonicalize(extra) })
+        };
+        if (typeof signer !== 'function') {
+            const _signer = signer;
+            signer = async (payload) => await _signer.sign(payload);
         }
-    }
-    catch {
-        signature = auth.credential;
-        extras = undefined;
-    }
-    const unsigned = {
-        ...auth,
-        ...(extras == null ? {} : { credential: canonicalize(extras) })
+        const signature = await signer(unsigned);
+        return {
+            ...auth,
+            credential: extra == null ? signature : canonicalize({ ...extra, signature }),
+        };
     };
-    let isValid = undefined;
-    if (verifier != null) {
-        if (typeof verifier !== 'function') {
-            const _verifier = verifier;
-            verifier = async (payload, signature) => await _verifier.verify(payload, signature);
+    const unpackAuthCredentials = async (auth, verifier) => {
+        let signature = '';
+        let extras;
+        try {
+            extras = JSON.parse(auth.credential);
+            if (typeof extras === 'object' && extras != null && "signature" in extras) {
+                signature = extras.signature;
+                delete extras.signature;
+            }
         }
-        isValid = await verifier(unsigned, signature);
-    }
-    return { unsigned, signature, isValid, extras };
+        catch {
+            signature = auth.credential;
+            extras = undefined;
+        }
+        const unsigned = {
+            ...auth,
+            ...(extras == null ? {} : { credential: canonicalize(extras) })
+        };
+        let isValid = undefined;
+        if (verifier != null) {
+            if (typeof verifier !== 'function') {
+                const _verifier = verifier;
+                verifier = async (payload, signature) => await _verifier.verify(payload, signature);
+            }
+            isValid = await verifier(unsigned, signature);
+        }
+        return { unsigned, signature, isValid, extras };
+    };
+    return { packAuthCredentials, unpackAuthCredentials };
 };
+export const authCredentialsHelper = createAuthCredentialsHelper();
 //# sourceMappingURL=auth.js.map

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,MAAM,cAAc,CAAA;AAEvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,IAA6B,EAC7B,KAAQ,EACR,MAAoC,EACV,EAAE;IAC5B,MAAM,QAAQ,GAA4B;QACxC,GAAG,IAAI;QACP,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,KAAK,CAAW,EAAE,CAAC;KACxE,CAAA;IAED,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAA;QACtB,MAAM,GAAG,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;IAExC,OAAO;QACL,GAAG,IAAI;QACP,UAAU,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAW;KACxF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,IAAqB,EACrB,QAAyC,EACJ,EAAE;IACvC,IAAI,SAAS,GAAW,EAAE,CAAA;IAC1B,IAAI,MAAS,CAAA;IACb,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;YAC1E,SAAS,GAAG,MAAM,CAAC,SAAmB,CAAA;YACtC,OAAO,MAAM,CAAC,SAAS,CAAA;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC,UAAU,CAAA;QAC3B,MAAM,GAAG,SAAc,CAAA;IACzB,CAAC;IACD,MAAM,QAAQ,GAA4B;QACxC,GAAG,IAAI;QACP,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,CAAW,EAAE,CAAC;KAC1E,CAAA;IACD,IAAI,OAAO,GAAwB,SAAS,CAAA;IAE5C,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,QAAQ,CAAA;YAC1B,QAAQ,GAAG,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QACrF,CAAC;QAED,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACjD,CAAC,CAAA"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,MAAM,cAAc,CAAA;AAGvC,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAA0B,EAAE;IACrE,MAAM,mBAAmB,GAAG,KAAK,EAC/B,IAA6B,EAC7B,KAAQ,EACR,MAAoC,EACV,EAAE;QAC5B,MAAM,QAAQ,GAA4B;YACxC,GAAG,IAAI;YACP,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,KAAK,CAAW,EAAE,CAAC;SACxE,CAAA;QAED,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,CAAA;YACtB,MAAM,GAAG,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;QAExC,OAAO;YACL,GAAG,IAAI;YACP,UAAU,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAW;SACxF,CAAA;IACH,CAAC,CAAA;IAED,MAAM,qBAAqB,GAAG,KAAK,EACjC,IAAqB,EACrB,QAAyC,EACJ,EAAE;QACvC,IAAI,SAAS,GAAW,EAAE,CAAA;QAC1B,IAAI,MAAS,CAAA;QACb,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;gBAC1E,SAAS,GAAG,MAAM,CAAC,SAAmB,CAAA;gBACtC,OAAO,MAAM,CAAC,SAAS,CAAA;YACzB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,IAAI,CAAC,UAAU,CAAA;YAC3B,MAAM,GAAG,SAAc,CAAA;QACzB,CAAC;QACD,MAAM,QAAQ,GAA4B;YACxC,GAAG,IAAI;YACP,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,CAAW,EAAE,CAAC;SAC1E,CAAA;QACD,IAAI,OAAO,GAAwB,SAAS,CAAA;QAE5C,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,QAAQ,CAAA;gBAC1B,QAAQ,GAAG,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YACrF,CAAC;YAED,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC/C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IACjD,CAAC,CAAA;IAED,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAA;AACvD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,EAAE,CAAA"}

package/build/helper/types.d.ts

@@ -0,0 +1,11 @@
+import type { KeyPairModel } from '../types.js';
+/** Key models built from what a peer publishes: its public key and its address. */
+export interface KeyHelper {
+    /**
+     * A verify-only key model of a public key, `<type>:<key>` or a bare key (ed25519 by default).
+     */
+    fromPubKey: (pubKey: string, type?: string) => KeyPairModel;
+    /** Whether an address is the one the public key derives to. */
+    matchAddress: (address: string, pubKey: string) => boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/helper/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/helper/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,mFAAmF;AACnF,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,YAAY,CAAA;IAC3D,+DAA+D;IAC/D,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;CAC3D"}

package/build/helper/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/helper/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/helper/types.ts"],"names":[],"mappings":""}

package/build/helper.d.ts

@@ -1,4 +1,7 @@
 import type { KeyPairModel } from './types.js';
+import type { KeyHelper } from './helper/types.js';
+export declare const createKeyHelper: () => KeyHelper;
+export declare const keyHelper: KeyHelper;
+/** @deprecated compat:factory-refactor — use `keyHelper.fromPubKey(…)` */
 export declare const fromPubKey: (pubKey: string, type?: string) => KeyPairModel;
-export declare const matchAddress: (address: string, pubKey: string) => boolean;
 //# sourceMappingURL=helper.d.ts.map

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,YAAY,CAAA;AAGvD,eAAO,MAAM,UAAU,WAAY,MAAM,SAAS,MAAM,KAAG,YAiB1D,CAAA;AAED,eAAO,MAAM,YAAY,YAAa,MAAM,UAAU,MAAM,KAAG,OACf,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,YAAY,CAAA;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD,eAAO,MAAM,eAAe,QAAO,SAwBlC,CAAA;AAED,eAAO,MAAM,SAAS,WAAoB,CAAA;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,UAAU,WAAY,MAAM,SAAS,MAAM,KAAG,YAAkD,CAAA"}

package/build/helper.js

@@ -1,22 +1,28 @@
 import { KeyType } from './consts.js';
 import { makeKeyPairModel } from './model.js';
 import { plugins } from './plugins/index.js';
-import { prepareKey } from './utils.js';
-export const fromPubKey = (pubKey, type) => {
-    if (type == null) {
-        [type, pubKey] = pubKey.includes(':') ? pubKey.split(':', 2) : [KeyType.ED25519, pubKey];
-        if (pubKey == null) {
-            pubKey = type;
-            type = KeyType.ED25519;
+import { keyUtils } from './utils.js';
+export const createKeyHelper = () => {
+    const fromPubKey = (pubKey, type) => {
+        if (type == null) {
+            [type, pubKey] = pubKey.includes(':') ? pubKey.split(':', 2) : [KeyType.ED25519, pubKey];
+            if (pubKey == null) {
+                pubKey = type;
+                type = KeyType.ED25519;
+            }
         }
-    }
-    const keyPair = {
-        privateKey: '',
-        publicKey: pubKey,
-        type,
-        address: plugins[type].toAdress(prepareKey(pubKey))
+        const keyPair = {
+            privateKey: '',
+            publicKey: pubKey,
+            type,
+            address: plugins[type].toAdress(keyUtils.prepareKey(pubKey))
+        };
+        return makeKeyPairModel(keyPair);
     };
-    return makeKeyPairModel(keyPair);
+    const matchAddress = (address, pubKey) => address === fromPubKey(pubKey).exportAddress();
+    return { fromPubKey, matchAddress };
 };
-export const matchAddress = (address, pubKey) => address === fromPubKey(pubKey).exportAddress();
+export const keyHelper = createKeyHelper();
+/** @deprecated compat:factory-refactor — use `keyHelper.fromPubKey(…)` */
+export const fromPubKey = (pubKey, type) => keyHelper.fromPubKey(pubKey, type);
 //# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,IAAa,EAAgB,EAAE;IACxE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxF,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,GAAG,OAAO,CAAC,OAAO,CAAA;QACxB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAY;QACvB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,MAAM;QACjB,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;KACpD,CAAA;IAED,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,MAAc,EAAW,EAAE,CACvE,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGrC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAc,EAAE;IAC7C,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,IAAa,EAAgB,EAAE;QACjE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACxF,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,GAAG,IAAI,CAAA;gBACb,IAAI,GAAG,OAAO,CAAC,OAAO,CAAA;YACxB,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAY;YACvB,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,MAAM;YACjB,IAAI;YACJ,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SAC7D,CAAA;QAED,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,MAAc,EAAW,EAAE,CAChE,OAAO,KAAK,UAAU,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IAEhD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAA;AACrC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAA;AAE1C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,IAAa,EAAgB,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,4 +1,6 @@
 export type * from './types.js';
+export type * from './helper/types.js';
+export type * from './auth/types.js';
 export * from './consts.js';
 export * from './helper.js';
 export * from './keypair.js';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,mBAAmB,mBAAmB,CAAA;AACtC,mBAAmB,iBAAiB,CAAA;AAEpC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,oBAAoB,CAAA"}

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,oBAAoB,CAAA"}

package/build/keypair.js

@@ -1,7 +1,7 @@
 import { base64 } from '@scure/base';
 import { KeyType } from './consts.js';
 import { plugins } from './plugins/index.js';
-import { assertType } from './utils.js';
+import { keyUtils } from './utils.js';
 export const inputToKeyPair = (input) => {
     let type = KeyType.ED25519;
     let keyPair = null;
@@ -29,7 +29,7 @@ export const inputToKeyPair = (input) => {
         }
     }
     if (keyPair == null) {
-        assertType(type);
+        keyUtils.assertType(type);
         if (primaryKey == null) {
             primaryKey = plugins[type].random();
         }

package/build/keypair.js.map

@@ -1 +1 @@
-{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../src/keypair.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAwB,EAAW,EAAE;IAClE,IAAI,IAAI,GAAW,OAAO,CAAC,OAAO,CAAA;IAClC,IAAI,OAAO,GAAmB,IAAI,CAAA;IAClC,IAAI,UAAU,GAAsB,IAAI,CAAA;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC,wCAAwC;YAC9D,IAAI,GAAG,KAAK,CAAA;QACd,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1C,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACnC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAA;gBACtB,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACrC,CAAC;iBAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,OAAO,CAAA;gBACd,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;QACrC,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACpD,OAAO,GAAG;YACR,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1C,IAAI;SACL,CAAA;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../src/keypair.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAwB,EAAW,EAAE;IAClE,IAAI,IAAI,GAAW,OAAO,CAAC,OAAO,CAAA;IAClC,IAAI,OAAO,GAAmB,IAAI,CAAA;IAClC,IAAI,UAAU,GAAsB,IAAI,CAAA;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC,wCAAwC;YAC9D,IAAI,GAAG,KAAK,CAAA;QACd,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1C,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACnC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAA;gBACtB,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACrC,CAAC;iBAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,OAAO,CAAA;gBACd,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;QACrC,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACpD,OAAO,GAAG;YACR,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1C,IAAI;SACL,CAAA;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/model.d.ts

@@ -1,3 +1,3 @@
-import type { KeyPairModelMaker } from './types.js';
-export declare const makeKeyPairModel: KeyPairModelMaker;
+import type { KeyPair, KeyPairModel } from './types.js';
+export declare const makeKeyPairModel: (input?: KeyPair | string) => KeyPairModel;
 //# sourceMappingURL=model.d.ts.map

package/build/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAMjE,eAAO,MAAM,gBAAgB,EAAE,iBAmH9B,CAAA"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAMvD,eAAO,MAAM,gBAAgB,WAAY,OAAO,GAAG,MAAM,KAAG,YAmH3D,CAAA"}

package/build/model.js

@@ -1,59 +1,59 @@
 import { plugins } from './plugins/index.js';
 import { base64urlnopad, utf8 } from '@scure/base';
-import { assertType, prepareData, prepareKey } from './utils.js';
+import { keyUtils } from './utils.js';
 import { inputToKeyPair } from './keypair.js';
-export const makeKeyPairModel = input => {
+export const makeKeyPairModel = (input) => {
     const keyPair = inputToKeyPair(input);
     const _model = {
         keyPair,
         sign: async (data) => {
-            data = prepareData(data);
-            assertType(_model.keyPair?.type);
+            data = keyUtils.prepareData(data);
+            keyUtils.assertType(_model.keyPair?.type);
             if (_model.keyPair == null) {
                 throw new Error('basic.keys:missing-keypair');
             }
             if (_model.keyPair.privateKey == null) {
                 throw new Error('basic.keys:missing-pk');
             }
-            return base64urlnopad.encode(plugins[_model.keyPair.type].sign(data, prepareKey(_model.keyPair.privateKey)));
+            return base64urlnopad.encode(plugins[_model.keyPair.type].sign(data, keyUtils.prepareKey(_model.keyPair.privateKey)));
         },
         verify: async (data, signature) => {
-            data = prepareData(data);
-            assertType(_model.keyPair?.type);
+            data = keyUtils.prepareData(data);
+            keyUtils.assertType(_model.keyPair?.type);
             const sig = base64urlnopad.decode(signature);
             if (_model.keyPair == null) {
                 throw new Error('basic.keys:missing-keypair');
             }
-            return plugins[_model.keyPair.type].verify(data, sig, prepareKey(_model.keyPair.publicKey));
+            return plugins[_model.keyPair.type].verify(data, sig, keyUtils.prepareKey(_model.keyPair.publicKey));
         },
         export: () => {
-            assertType(_model.keyPair?.type);
+            keyUtils.assertType(_model.keyPair?.type);
             if (_model.keyPair == null) {
                 throw new Error('basic.keys:missing-keypair');
             }
             return `${_model.keyPair.type}:${_model.keyPair.privateKey}`;
         },
         exportPublic: () => {
-            assertType(_model.keyPair?.type);
+            keyUtils.assertType(_model.keyPair?.type);
             if (_model.keyPair == null) {
                 throw new Error('basic.keys:missing-keypair');
             }
             return `${_model.keyPair.type}:${_model.keyPair.publicKey}`;
         },
         exportAddress: () => {
-            assertType(_model.keyPair?.type);
+            keyUtils.assertType(_model.keyPair?.type);
             if (_model.keyPair == null) {
                 throw new Error('basic.keys:missing-keypair');
             }
             return `${_model.keyPair.type}:${_model.keyPair.address}`;
         },
         encrypt: async (data) => {
-            data = prepareData(data);
-            assertType(_model.keyPair?.type);
+            data = keyUtils.prepareData(data);
+            keyUtils.assertType(_model.keyPair?.type);
             if (_model.keyPair == null) {
                 throw new Error('basic.keys:missing-keypair');
             }
-            return base64urlnopad.encode(plugins[_model.keyPair.type].encrypt(data, prepareKey(_model.keyPair.publicKey)));
+            return base64urlnopad.encode(plugins[_model.keyPair.type].encrypt(data, keyUtils.prepareKey(_model.keyPair.publicKey)));
         },
         decrypt: async (data) => {
             const plain = await _model.dcrpt(data);
@@ -68,11 +68,11 @@ export const makeKeyPairModel = input => {
         },
         dcrpt: async (data) => {
             data = data instanceof Uint8Array ? data : base64urlnopad.decode(data);
-            assertType(_model.keyPair?.type);
+            keyUtils.assertType(_model.keyPair?.type);
             if (_model.keyPair == null) {
                 throw new Error('basic.keys:missing-keypair');
             }
-            return plugins[_model.keyPair.type].decrypt(data, prepareKey(_model.keyPair.privateKey));
+            return plugins[_model.keyPair.type].decrypt(data, keyUtils.prepareKey(_model.keyPair.privateKey));
         }
     };
     return _model;

package/build/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAsB,KAAK,CAAC,EAAE;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAiB;QAC3B,OAAO;QAEP,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnB,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC1C,CAAC;YAED,OAAO,cAAc,CAAC,MAAM,CAC1B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAC/B,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CACtC,CACF,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YAChC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAChC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAE5C,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACxC,IAAkB,EAClB,GAAG,EACH,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CACrC,CAAA;QACH,CAAC;QAED,MAAM,EAAE,GAAG,EAAE;YACX,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAA;QAC9D,CAAC;QAED,YAAY,EAAE,GAAG,EAAE;YACjB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAA;QAC7D,CAAC;QAED,aAAa,EAAE,GAAG,EAAE;YAClB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QAC3D,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACpB,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,cAAc,CAAC,MAAM,CAC1B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAClC,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CACrC,CACF,CAAA;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,CAAC;gBACH,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YAClB,IAAI,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;YAChF,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CACzC,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CACtC,CAAA;QACH,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAwB,EAAgB,EAAE;IACzE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAiB;QAC3B,OAAO;QAEP,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnB,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;YACjC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEzC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC1C,CAAC;YAED,OAAO,cAAc,CAAC,MAAM,CAC1B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAC/B,IAAkB,EAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAC/C,CACF,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YAChC,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;YACjC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACzC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAE5C,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACxC,IAAkB,EAClB,GAAG,EACH,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC9C,CAAA;QACH,CAAC;QAED,MAAM,EAAE,GAAG,EAAE;YACX,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEzC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAA;QAC9D,CAAC;QAED,YAAY,EAAE,GAAG,EAAE;YACjB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEzC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAA;QAC7D,CAAC;QAED,aAAa,EAAE,GAAG,EAAE;YAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEzC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QAC3D,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACpB,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;YACjC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEzC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,cAAc,CAAC,MAAM,CAC1B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAClC,IAAkB,EAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC9C,CACF,CAAA;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,CAAC;gBACH,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YAClB,IAAI,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;YAChF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEzC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CACzC,IAAkB,EAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAC/C,CAAA;QACH,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/utils/types.d.ts

@@ -0,0 +1,16 @@
+/** The low-level key and payload primitives the key models and plugins share. */
+export interface KeyUtils {
+    /** The 20-byte address of a public key: the tail of its keccak-256 digest. */
+    toAddress: (publicKey: Uint8Array) => Uint8Array;
+    /** A base64-encoded key as bytes. */
+    prepareKey: (key: string) => Uint8Array;
+    /**
+     * Bytes to sign, verify or encrypt: an object is canonicalized, a string UTF-8 encoded.
+     *
+     * @throws {Error} `basic.keys:sign-data-type` for anything else
+     */
+    prepareData: (data: unknown) => Uint8Array;
+    /** @throws {Error} `basic.keys:unknown-type` for a key type no plugin is registered for */
+    assertType: (type?: string) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/utils/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,8EAA8E;IAC9E,SAAS,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,UAAU,CAAA;IAChD,qCAAqC;IACrC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,CAAA;IACvC;;;;OAIG;IACH,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,UAAU,CAAA;IAC1C,2FAA2F;IAC3F,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC"}

package/build/utils/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/utils/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":""}

package/build/utils.d.ts

@@ -1,5 +1,4 @@
-export declare const toAddress: (publicKey: Uint8Array) => Uint8Array;
-export declare const prepareKey: (key: string) => Uint8Array;
-export declare const prepareData: (data: unknown) => Uint8Array;
-export declare const assertType: (type?: string) => void;
+import type { KeyUtils } from './utils/types.js';
+export declare const createKeyUtils: () => KeyUtils;
+export declare const keyUtils: KeyUtils;
 //# sourceMappingURL=utils.d.ts.map

package/build/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS,cAAe,UAAU,KAAG,UACP,CAAA;AAE3C,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,UACrB,CAAA;AAEpB,eAAO,MAAM,WAAW,SAAU,OAAO,KAAG,UAiB3C,CAAA;AAED,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,IAI1C,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAEhD,eAAO,MAAM,cAAc,QAAO,QAiCjC,CAAA;AAED,eAAO,MAAM,QAAQ,UAAmB,CAAA"}

package/build/utils.js

@@ -2,28 +2,32 @@ import { keccak_256 } from '@noble/hashes/sha3.js';
 import { base64, utf8 } from '@scure/base';
 import { plugins } from './plugins/index.js';
 import canonicalize from 'canonicalize';
-export const toAddress = (publicKey) => keccak_256(publicKey.slice(4)).slice(-20);
-export const prepareKey = (key) => base64.decode(key);
-export const prepareData = (data) => {
-    if (typeof data === 'object') {
+export const createKeyUtils = () => {
+    const toAddress = (publicKey) => keccak_256(publicKey.slice(4)).slice(-20);
+    const prepareKey = (key) => base64.decode(key);
+    const prepareData = (data) => {
+        if (typeof data === 'object') {
+            if (!(data instanceof Uint8Array)) {
+                data = canonicalize(data);
+            }
+        }
+        if (typeof data === 'string') {
+            data = utf8.decode(data);
+        }
+        else if (!(data instanceof Uint8Array)) {
+            throw new Error('basic.keys:sign-data-type');
+        }
         if (!(data instanceof Uint8Array)) {
-            data = canonicalize(data);
+            throw new Error('basic.keys:sign-data-type');
         }
-    }
-    if (typeof data === 'string') {
-        data = utf8.decode(data);
-    }
-    else if (!(data instanceof Uint8Array)) {
-        throw new Error('basic.keys:sign-data-type');
-    }
-    if (!(data instanceof Uint8Array)) {
-        throw new Error('basic.keys:sign-data-type');
-    }
-    return data;
-};
-export const assertType = (type) => {
-    if (type == null || !(type in plugins)) {
-        throw new Error('basic.keys:unknown-type');
-    }
+        return data;
+    };
+    const assertType = (type) => {
+        if (type == null || !(type in plugins)) {
+            throw new Error('basic.keys:unknown-type');
+        }
+    };
+    return { toAddress, prepareKey, prepareData, assertType };
 };
+export const keyUtils = createKeyUtils();
 //# sourceMappingURL=utils.js.map

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,YAAY,MAAM,cAAc,CAAA;AAEvC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAAqB,EAAc,EAAE,CAC7D,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;AAE3C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAc,EAAE,CACpD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAa,EAAc,EAAE;IACvD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YAClC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAa,EAAQ,EAAE;IAChD,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,YAAY,MAAM,cAAc,CAAA;AAGvC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAa,EAAE;IAC3C,MAAM,SAAS,GAAG,CAAC,SAAqB,EAAc,EAAE,CACtD,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;IAE3C,MAAM,UAAU,GAAG,CAAC,GAAW,EAAc,EAAE,CAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAEpB,MAAM,WAAW,GAAG,CAAC,IAAa,EAAc,EAAE;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;gBAClC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,IAAa,EAAQ,EAAE;QACzC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAA;IAED,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;AAC3D,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/basic-keys",
-  "version": "0.1.18-rc.47",
+  "version": "0.1.18-rc.48",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -40,7 +40,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.45",
+    "@owlmeans/test-auth": "^0.1.18-rc.46",
     "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
@@ -49,7 +49,7 @@
     "@noble/ciphers": "^2.4.0",
     "@noble/curves": "^2.4.0",
     "@noble/hashes": "^2.4.0",
-    "@owlmeans/auth": "^0.1.18-rc.39",
+    "@owlmeans/auth": "^0.1.18-rc.40",
     "@scure/base": "^2.4.0",
     "canonicalize": "^5.1.0"
   },

package/src/auth/types.ts

@@ -0,0 +1,17 @@
+import type { AuthCredentials } from '@owlmeans/auth'
+import type { KeyPairModel, PayloadSigner, PayloadVerifier, UnpackedAuthCredentials, UnsignedAuthCredentials } from '../types.js'
+
+/** Signed authentication credentials: the signature packed into `credential` with any extras. */
+export interface AuthCredentialsHelper {
+  /** Sign `auth` (plus canonicalized `extra`) and pack the signature into `credential`. */
+  packAuthCredentials: <T extends {} | undefined>(
+    auth: UnsignedAuthCredentials,
+    extra: T,
+    signer: KeyPairModel | PayloadSigner
+  ) => Promise<AuthCredentials>
+  /** Take packed credentials apart and, given a verifier, check the signature. */
+  unpackAuthCredentials: <T extends {} | undefined>(
+    auth: AuthCredentials,
+    verifier?: KeyPairModel | PayloadVerifier
+  ) => Promise<UnpackedAuthCredentials<T>>
+}

package/src/auth.ts

@@ -1,60 +1,67 @@
 import type { AuthCredentials } from '@owlmeans/auth'
 import type { KeyPairModel, PayloadSigner, PayloadVerifier, UnpackedAuthCredentials, UnsignedAuthCredentials } from './types.js'
 import canonicalize from 'canonicalize'
+import type { AuthCredentialsHelper } from './auth/types.js'
 
-export const packAuthCredentials = async <T extends {} | undefined>(
-  auth: UnsignedAuthCredentials,
-  extra: T,
-  signer: KeyPairModel | PayloadSigner
-): Promise<AuthCredentials> => {
-  const unsigned: UnsignedAuthCredentials = {
-    ...auth,
-    ...(extra == null ? {} : { credential: canonicalize(extra) as string })
-  }
+export const createAuthCredentialsHelper = (): AuthCredentialsHelper => {
+  const packAuthCredentials = async <T extends {} | undefined>(
+    auth: UnsignedAuthCredentials,
+    extra: T,
+    signer: KeyPairModel | PayloadSigner
+  ): Promise<AuthCredentials> => {
+    const unsigned: UnsignedAuthCredentials = {
+      ...auth,
+      ...(extra == null ? {} : { credential: canonicalize(extra) as string })
+    }
 
-  if (typeof signer !== 'function') {
-    const _signer = signer
-    signer = async payload => await _signer.sign(payload)
-  }
+    if (typeof signer !== 'function') {
+      const _signer = signer
+      signer = async payload => await _signer.sign(payload)
+    }
 
-  const signature = await signer(unsigned)
+    const signature = await signer(unsigned)
 
-  return {
-    ...auth,
-    credential: extra == null ? signature : canonicalize({ ...extra, signature }) as string,
+    return {
+      ...auth,
+      credential: extra == null ? signature : canonicalize({ ...extra, signature }) as string,
+    }
   }
-}
 
-export const unpackAuthCredentials = async <T extends {} | undefined>(
-  auth: AuthCredentials,
-  verifier?: KeyPairModel | PayloadVerifier
-): Promise<UnpackedAuthCredentials<T>> => {
-  let signature: string = ''
-  let extras: T
-  try {
-    extras = JSON.parse(auth.credential)
-    if (typeof extras === 'object' && extras != null && "signature" in extras) {
-      signature = extras.signature as string
-      delete extras.signature
+  const unpackAuthCredentials = async <T extends {} | undefined>(
+    auth: AuthCredentials,
+    verifier?: KeyPairModel | PayloadVerifier
+  ): Promise<UnpackedAuthCredentials<T>> => {
+    let signature: string = ''
+    let extras: T
+    try {
+      extras = JSON.parse(auth.credential)
+      if (typeof extras === 'object' && extras != null && "signature" in extras) {
+        signature = extras.signature as string
+        delete extras.signature
+      }
+    } catch {
+      signature = auth.credential
+      extras = undefined as T
     }
-  } catch {
-    signature = auth.credential
-    extras = undefined as T
-  }
-  const unsigned: UnsignedAuthCredentials = { 
-    ...auth,
-    ...(extras == null ? {} : { credential: canonicalize(extras) as string })
-  }
-  let isValid: boolean | undefined = undefined
+    const unsigned: UnsignedAuthCredentials = { 
+      ...auth,
+      ...(extras == null ? {} : { credential: canonicalize(extras) as string })
+    }
+    let isValid: boolean | undefined = undefined
 
-  if (verifier != null) {
-    if (typeof verifier !== 'function') {
-      const _verifier = verifier
-      verifier = async (payload, signature) => await _verifier.verify(payload, signature)
+    if (verifier != null) {
+      if (typeof verifier !== 'function') {
+        const _verifier = verifier
+        verifier = async (payload, signature) => await _verifier.verify(payload, signature)
+      }
+
+      isValid = await verifier(unsigned, signature)
     }
 
-    isValid = await verifier(unsigned, signature)
+    return { unsigned, signature, isValid, extras }
   }
 
-  return { unsigned, signature, isValid, extras }
+  return { packAuthCredentials, unpackAuthCredentials }
 }
+
+export const authCredentialsHelper = createAuthCredentialsHelper()

package/src/helper/types.ts

@@ -0,0 +1,11 @@
+import type { KeyPairModel } from '../types.js'
+
+/** Key models built from what a peer publishes: its public key and its address. */
+export interface KeyHelper {
+  /**
+   * A verify-only key model of a public key, `<type>:<key>` or a bare key (ed25519 by default).
+   */
+  fromPubKey: (pubKey: string, type?: string) => KeyPairModel
+  /** Whether an address is the one the public key derives to. */
+  matchAddress: (address: string, pubKey: string) => boolean
+}

package/src/helper.ts

@@ -2,26 +2,36 @@ import { KeyType } from './consts.js'
 import { makeKeyPairModel } from './model.js'
 import { plugins } from './plugins/index.js'
 import type { KeyPair, KeyPairModel } from './types.js'
-import { prepareKey } from './utils.js'
+import { keyUtils } from './utils.js'
+import type { KeyHelper } from './helper/types.js'
 
-export const fromPubKey = (pubKey: string, type?: string): KeyPairModel => {
-  if (type == null) {
-    [type, pubKey] = pubKey.includes(':') ? pubKey.split(':', 2) : [KeyType.ED25519, pubKey]
-    if (pubKey == null) {
-      pubKey = type
-      type = KeyType.ED25519
+export const createKeyHelper = (): KeyHelper => {
+  const fromPubKey = (pubKey: string, type?: string): KeyPairModel => {
+    if (type == null) {
+      [type, pubKey] = pubKey.includes(':') ? pubKey.split(':', 2) : [KeyType.ED25519, pubKey]
+      if (pubKey == null) {
+        pubKey = type
+        type = KeyType.ED25519
+      }
+    }
+
+    const keyPair: KeyPair = {
+      privateKey: '',
+      publicKey: pubKey,
+      type,
+      address: plugins[type].toAdress(keyUtils.prepareKey(pubKey))
     }
-  }
 
-  const keyPair: KeyPair = {
-    privateKey: '',
-    publicKey: pubKey,
-    type,
-    address: plugins[type].toAdress(prepareKey(pubKey))
+    return makeKeyPairModel(keyPair)
   }
 
-  return makeKeyPairModel(keyPair)
+  const matchAddress = (address: string, pubKey: string): boolean =>
+    address === fromPubKey(pubKey).exportAddress()
+
+  return { fromPubKey, matchAddress }
 }
 
-export const matchAddress = (address: string, pubKey: string): boolean =>
-  address === fromPubKey(pubKey).exportAddress()
+export const keyHelper = createKeyHelper()
+
+/** @deprecated compat:factory-refactor — use `keyHelper.fromPubKey(…)` */
+export const fromPubKey = (pubKey: string, type?: string): KeyPairModel => keyHelper.fromPubKey(pubKey, type)

package/src/index.ts

@@ -1,4 +1,6 @@
 export type * from './types.js'
+export type * from './helper/types.js'
+export type * from './auth/types.js'
 
 export * from './consts.js'
 export * from './helper.js'

package/src/keypair.ts

@@ -2,7 +2,7 @@ import type { KeyPair } from './types.js'
 import { base64 } from '@scure/base'
 import { KeyType } from './consts.js'
 import { plugins } from './plugins/index.js'
-import { assertType } from './utils.js'
+import { keyUtils } from './utils.js'
 
 export const inputToKeyPair = (input?: KeyPair | string): KeyPair => {
   let type: string = KeyType.ED25519
@@ -27,7 +27,7 @@ export const inputToKeyPair = (input?: KeyPair | string): KeyPair => {
     }
   }
   if (keyPair == null) {
-    assertType(type)
+    keyUtils.assertType(type)
     if (primaryKey == null) {
       primaryKey = plugins[type].random()
     }

package/src/model.ts

@@ -1,18 +1,18 @@
-import type { KeyPairModel, KeyPairModelMaker } from './types.js'
+import type { KeyPair, KeyPairModel } from './types.js'
 import { plugins } from './plugins/index.js'
 import { base64urlnopad, utf8 } from '@scure/base'
-import { assertType, prepareData, prepareKey } from './utils.js'
+import { keyUtils } from './utils.js'
 import { inputToKeyPair } from './keypair.js'
 
-export const makeKeyPairModel: KeyPairModelMaker = input => {
+export const makeKeyPairModel = (input?: KeyPair | string): KeyPairModel => {
   const keyPair = inputToKeyPair(input)
 
   const _model: KeyPairModel = {
     keyPair,
 
     sign: async (data) => {
-      data = prepareData(data)
-      assertType(_model.keyPair?.type)
+      data = keyUtils.prepareData(data)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -25,14 +25,14 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
       return base64urlnopad.encode(
         plugins[_model.keyPair.type].sign(
           data as Uint8Array,
-          prepareKey(_model.keyPair.privateKey)
+          keyUtils.prepareKey(_model.keyPair.privateKey)
         )
       )
     },
     
     verify: async (data, signature) => {
-      data = prepareData(data)
-      assertType(_model.keyPair?.type)
+      data = keyUtils.prepareData(data)
+      keyUtils.assertType(_model.keyPair?.type)
       const sig = base64urlnopad.decode(signature)
 
       if (_model.keyPair == null) {
@@ -42,12 +42,12 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
       return plugins[_model.keyPair.type].verify(
         data as Uint8Array,
         sig,
-        prepareKey(_model.keyPair.publicKey)
+        keyUtils.prepareKey(_model.keyPair.publicKey)
       )
     },
 
     export: () => {
-      assertType(_model.keyPair?.type)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -57,7 +57,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
     },
 
     exportPublic: () => {
-      assertType(_model.keyPair?.type)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -67,7 +67,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
     },
 
     exportAddress: () => {
-      assertType(_model.keyPair?.type)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -77,8 +77,8 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
     },
 
     encrypt: async data => {
-      data = prepareData(data)
-      assertType(_model.keyPair?.type)
+      data = keyUtils.prepareData(data)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -87,7 +87,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
       return base64urlnopad.encode(
         plugins[_model.keyPair.type].encrypt(
           data as Uint8Array,
-          prepareKey(_model.keyPair.publicKey)
+          keyUtils.prepareKey(_model.keyPair.publicKey)
         )
       )
     },
@@ -105,7 +105,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
 
     dcrpt: async data => {
       data = data instanceof Uint8Array ? data : base64urlnopad.decode(data as string)
-      assertType(_model.keyPair?.type)
+      keyUtils.assertType(_model.keyPair?.type)
 
       if (_model.keyPair == null) {
         throw new Error('basic.keys:missing-keypair')
@@ -113,7 +113,7 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
 
       return plugins[_model.keyPair.type].decrypt(
         data as Uint8Array,
-        prepareKey(_model.keyPair.privateKey)
+        keyUtils.prepareKey(_model.keyPair.privateKey)
       )
     }
   }

package/src/utils/types.ts

@@ -0,0 +1,15 @@
+/** The low-level key and payload primitives the key models and plugins share. */
+export interface KeyUtils {
+  /** The 20-byte address of a public key: the tail of its keccak-256 digest. */
+  toAddress: (publicKey: Uint8Array) => Uint8Array
+  /** A base64-encoded key as bytes. */
+  prepareKey: (key: string) => Uint8Array
+  /**
+   * Bytes to sign, verify or encrypt: an object is canonicalized, a string UTF-8 encoded.
+   *
+   * @throws {Error} `basic.keys:sign-data-type` for anything else
+   */
+  prepareData: (data: unknown) => Uint8Array
+  /** @throws {Error} `basic.keys:unknown-type` for a key type no plugin is registered for */
+  assertType: (type?: string) => void
+}

package/src/utils.ts

@@ -2,34 +2,41 @@ import { keccak_256 } from '@noble/hashes/sha3.js'
 import { base64, utf8 } from '@scure/base'
 import { plugins } from './plugins/index.js'
 import canonicalize from 'canonicalize'
+import type { KeyUtils } from './utils/types.js'
 
-export const toAddress = (publicKey: Uint8Array): Uint8Array =>
-  keccak_256(publicKey.slice(4)).slice(-20)
+export const createKeyUtils = (): KeyUtils => {
+  const toAddress = (publicKey: Uint8Array): Uint8Array =>
+    keccak_256(publicKey.slice(4)).slice(-20)
 
-export const prepareKey = (key: string): Uint8Array =>
-  base64.decode(key)
+  const prepareKey = (key: string): Uint8Array =>
+    base64.decode(key)
+
+  const prepareData = (data: unknown): Uint8Array => {
+    if (typeof data === 'object') {
+      if (!(data instanceof Uint8Array)) {
+        data = canonicalize(data)
+      }
+    }
+    if (typeof data === 'string') {
+      data = utf8.decode(data)
+    } else if (!(data instanceof Uint8Array)) {
+      throw new Error('basic.keys:sign-data-type')
+    }
 
-export const prepareData = (data: unknown): Uint8Array => {
-  if (typeof data === 'object') {
     if (!(data instanceof Uint8Array)) {
-      data = canonicalize(data)
+      throw new Error('basic.keys:sign-data-type')
     }
-  }
-  if (typeof data === 'string') {
-    data = utf8.decode(data)
-  } else if (!(data instanceof Uint8Array)) {
-    throw new Error('basic.keys:sign-data-type')
+
+    return data
   }
 
-  if (!(data instanceof Uint8Array)) {
-    throw new Error('basic.keys:sign-data-type')
+  const assertType = (type?: string): void => {
+    if (type == null || !(type in plugins)) {
+      throw new Error('basic.keys:unknown-type')
+    }
   }
 
-  return data
+  return { toAddress, prepareKey, prepareData, assertType }
 }
 
-export const assertType = (type?: string): void => {
-  if (type == null || !(type in plugins)) {
-    throw new Error('basic.keys:unknown-type')
-  }
-}
+export const keyUtils = createKeyUtils()

package/tests/auth.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test'
-import { packAuthCredentials, unpackAuthCredentials } from '@owlmeans/basic-keys'
+import { authCredentialsHelper } from '@owlmeans/basic-keys'
 import { AuthRole, AuthenticationType } from '@owlmeans/auth'
 import type { AuthCredentials } from '@owlmeans/auth'
 import { fixtureKey } from './context.js'
@@ -15,8 +15,8 @@ const baseCreds = (): Omit<AuthCredentials, 'credential'> => ({
 describe('@owlmeans/basic-keys — packAuthCredentials round-trip', () => {
   test('signs and verifies credentials with extras attached', async () => {
     const key = fixtureKey()
-    const signed = await packAuthCredentials(baseCreds(), { nonce: 'n-1' }, key)
-    const result = await unpackAuthCredentials<{ nonce: string }>(signed, key)
+    const signed = await authCredentialsHelper.packAuthCredentials(baseCreds(), { nonce: 'n-1' }, key)
+    const result = await authCredentialsHelper.unpackAuthCredentials<{ nonce: string }>(signed, key)
     expect(result.isValid).toBe(true)
     expect(result.extras?.nonce).toBe('n-1')
   })
@@ -24,8 +24,8 @@ describe('@owlmeans/basic-keys — packAuthCredentials round-trip', () => {
   test('verification fails for a different keypair', async () => {
     const signing = fixtureKey('alice')
     const other = fixtureKey('bob')
-    const signed = await packAuthCredentials(baseCreds(), { nonce: 'n-1' }, signing)
-    const result = await unpackAuthCredentials(signed, other)
+    const signed = await authCredentialsHelper.packAuthCredentials(baseCreds(), { nonce: 'n-1' }, signing)
+    const result = await authCredentialsHelper.unpackAuthCredentials(signed, other)
     expect(result.isValid).toBe(false)
   })
 })

package/tests/keys.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test'
-import { fromPubKey, makeKeyPairModel, matchAddress } from '@owlmeans/basic-keys'
+import { keyHelper, makeKeyPairModel } from '@owlmeans/basic-keys'
 import { fixtureKey } from './context.js'
 
 describe('@owlmeans/basic-keys — KeyPairModel sign/verify', () => {
@@ -26,13 +26,13 @@ describe('@owlmeans/basic-keys — public-key-only verification (fromPubKey)', (
     const signing = fixtureKey('peer-keys-spec')
     const sig = await signing.sign({ event: 'check' })
 
-    const verifying = fromPubKey(signing.exportPublic())
+    const verifying = keyHelper.fromPubKey(signing.exportPublic())
     expect(await verifying.verify({ event: 'check' }, sig)).toBe(true)
   })
 
   test('matchAddress agrees with exportAddress() on the same keypair', () => {
     const key = fixtureKey('addr-spec')
-    expect(matchAddress(key.exportAddress(), key.exportPublic())).toBe(true)
+    expect(keyHelper.matchAddress(key.exportAddress(), key.exportPublic())).toBe(true)
   })
 
   test('export() round-trips into a new model that produces the same public key', async () => {