@pdsjs/spaces 1.0.2 → 2.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pdsjs/spaces",
-  "version": "1.0.2",
+  "version": "2.0.1",
   "type": "module",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
@@ -23,7 +23,7 @@
     "./service-auth": "./src/service-auth.js"
   },
   "dependencies": {
-    "@pdsjs/core": "1.0.2"
+    "@pdsjs/core": "2.1.0"
   },
   "publishConfig": {
     "access": "public"

package/src/handlers/auth.js

@@ -202,7 +202,7 @@ export function createAuthRoutes(ctx) {
         }
 
         const spaceRow = await spaceStorage.getSpace(space);
-        if (!spaceRow || !spaceRow.isOwner) {
+        if (!spaceRow?.isOwner) {
           return errorResponse('SpaceNotFound', 'Space not found', 404);
         }
         if (spaceRow.deletedAt) {
@@ -266,7 +266,7 @@ export function createAuthRoutes(ctx) {
         const space = url.searchParams.get('space');
         if (!space) return errorResponse('InvalidRequest', 'space is required');
         const row = await spaceStorage.getSpace(space);
-        if (!row || !row.isOwner) {
+        if (!row?.isOwner) {
           return errorResponse('SpaceNotFound', 'Space not found', 404);
         }
         return Response.json({
@@ -305,7 +305,7 @@ export function createAuthRoutes(ctx) {
         }
 
         const row = await spaceStorage.getSpace(space);
-        if (!row || !row.isOwner) {
+        if (!row?.isOwner) {
           return errorResponse('SpaceNotFound', 'Space not found', 404);
         }
 

package/src/handlers/manage.js

@@ -334,7 +334,7 @@ export function createManageRoutes(ctx) {
         }
 
         const row = await spaceStorage.getSpace(body.space);
-        if (!row || !row.isOwner) {
+        if (!row?.isOwner) {
           return errorResponse('SpaceNotFound', 'Space not found', 404);
         }
 

package/src/token.js

@@ -7,7 +7,11 @@
 // They share a wire shape and differ only in who signs, who they address, and
 // how long they live — so they are data, not three implementations.
 
-import { base64UrlDecode, base64UrlEncode, bytesToHex } from '@pdsjs/core/crypto';
+import {
+  base64UrlDecode,
+  base64UrlEncode,
+  bytesToHex,
+} from '@pdsjs/core/crypto';
 
 export const SPACE_TOKEN_TYPES = {
   delegation: {

package/src/verifier.d.ts

@@ -1,15 +1 @@
-/**
- * @param {string} didKey - did:key:z… (the did: prefix is optional)
- * @returns {{curve: 'p256'|'secp256k1', publicKey: Uint8Array}}
- */
-export declare function parseDidKey(didKey: string): {
-    curve: 'p256' | 'secp256k1';
-    publicKey: Uint8Array;
-};
-/**
- * @param {{secp256k1?: (publicKey: Uint8Array, data: Uint8Array, sig: Uint8Array) => Promise<boolean>}} [opts]
- * @returns {import('@pdsjs/core/ports').SignatureVerifierPort}
- */
-export declare function createVerifier(opts?: {
-    secp256k1?: (publicKey: Uint8Array, data: Uint8Array, sig: Uint8Array) => Promise<boolean>;
-}): import('@pdsjs/core/ports').SignatureVerifierPort;
+export { createVerifier, parseDidKey } from '@pdsjs/core/verify';

package/src/verifier.js

@@ -1,74 +1,8 @@
 // @pdsjs/spaces/verifier - signature verification port.
 //
-// P-256 ships built in on crypto.subtle. secp256k1 is injected: hand-rolling
-// ECDSA verification is a different risk class from hand-rolling a hash, since
-// a subtle bug means accepting a forged credential rather than a failing test.
-// Without an injected verifier, spaces interoperate only with P-256 accounts.
+// The implementation now lives in @pdsjs/core/verify so that core features
+// (service-auth verification on account migration) and spaces (space
+// credentials) share one verifier. This module re-exports it to keep the
+// @pdsjs/spaces/verifier entry point stable for existing importers.
 
-import { base58btcDecode, P256_MULTICODEC } from '@pdsjs/core/plc';
-
-const SECP256K1_MULTICODEC = [0xe7, 0x01];
-
-/**
- * @param {string} didKey - did:key:z… (the did: prefix is optional)
- * @returns {{curve: 'p256'|'secp256k1', publicKey: Uint8Array}}
- */
-export function parseDidKey(didKey) {
-  const value = didKey.startsWith('did:key:') ? didKey.slice(8) : didKey;
-  if (!value.startsWith('z')) {
-    throw new Error(`expected a did:key multibase value, got: ${didKey}`);
-  }
-  const bytes = base58btcDecode(value.slice(1));
-  if (bytes[0] === P256_MULTICODEC[0] && bytes[1] === P256_MULTICODEC[1]) {
-    return { curve: 'p256', publicKey: bytes.slice(2) };
-  }
-  if (
-    bytes[0] === SECP256K1_MULTICODEC[0] &&
-    bytes[1] === SECP256K1_MULTICODEC[1]
-  ) {
-    return { curve: 'secp256k1', publicKey: bytes.slice(2) };
-  }
-  throw new Error(`unsupported did:key multicodec: ${didKey}`);
-}
-
-/**
- * @param {{secp256k1?: (publicKey: Uint8Array, data: Uint8Array, sig: Uint8Array) => Promise<boolean>}} [opts]
- * @returns {import('@pdsjs/core/ports').SignatureVerifierPort}
- */
-export function createVerifier(opts = {}) {
-  return {
-    async verify(didKey, data, sig) {
-      const { curve, publicKey } = parseDidKey(didKey);
-      if (curve === 'p256') return verifyP256(publicKey, data, sig);
-      if (!opts.secp256k1) {
-        throw new Error(
-          'secp256k1 verification requires an injected verifier; ' +
-            'this deployment supports P-256 keys only',
-        );
-      }
-      return opts.secp256k1(publicKey, data, sig);
-    },
-  };
-}
-
-/**
- * @param {Uint8Array} publicKey - 33-byte compressed point
- * @param {Uint8Array} data
- * @param {Uint8Array} sig - 64-byte raw r||s
- * @returns {Promise<boolean>}
- */
-async function verifyP256(publicKey, data, sig) {
-  const key = await crypto.subtle.importKey(
-    'raw',
-    /** @type {BufferSource} */ (publicKey),
-    { name: 'ECDSA', namedCurve: 'P-256' },
-    false,
-    ['verify'],
-  );
-  return crypto.subtle.verify(
-    { name: 'ECDSA', hash: 'SHA-256' },
-    key,
-    /** @type {BufferSource} */ (sig),
-    /** @type {BufferSource} */ (data),
-  );
-}
+export { createVerifier, parseDidKey } from '@pdsjs/core/verify';