@sesamy/sesamy-js 1.113.2 → 1.114.0

package/dist/capsule-plugin.iife.js

@@ -1 +1 @@
-var capsulePlugin=(function(e){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});function t(e){let t=e.length%4,n=(t?e+`=`.repeat(4-t):e).replace(/-/g,`+`).replace(/_/g,`/`),r=atob(n),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function n(e){let t=``;for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}var r=new Uint8Array([1,0,1]),i=`dca-keys`,a=`keypair`,o=`default`,s=class e{fetchFn;unlockFn;periodKeyCache;clientBound;rsaKeySize;keyDbName;keyPairPromise=null;accessCheck;paywallFn;constructor(e={}){this.fetchFn=e.fetch??globalThis.fetch.bind(globalThis),this.unlockFn=e.unlockFn,this.periodKeyCache=e.periodKeyCache,this.clientBound=e.clientBound??!1,this.rsaKeySize=e.rsaKeySize??2048,this.keyDbName=e.keyDbName??i,this.accessCheck=e.accessCheck,this.paywallFn=e.paywallFn}parsePage(e){let t=e??document,n=t.querySelector(`script.dca-data`);if(!n)throw Error(`DCA: <script class="dca-data"> not found`);let r=JSON.parse(n.textContent??``),i=t.querySelector(`template.dca-sealed-content`),a={};if(i&&i instanceof HTMLTemplateElement){let e=i.content.querySelectorAll(`[data-dca-content-name]`);for(let t of Array.from(e)){let e=t.getAttribute(`data-dca-content-name`);e&&(a[e]=t.textContent?.trim()??``)}}return{dcaData:r,sealedContent:a}}parseJsonResponse(e){let{sealedContent:t,...n}=e;return{dcaData:n,sealedContent:t}}static hasDcaContent(e){return(e??document).querySelector(`script.dca-data`)!==null}async unlock(e,t,n){let r=e.dcaData.issuerData[t];if(!r)throw Error(`DCA: issuer "${t}" not found in issuerData`);let i={resourceJWT:e.dcaData.resourceJWT,contentEncryptionKeys:r.contentEncryptionKeys,...n};if(this.clientBound&&(i.clientPublicKey=await this.getPublicKey()),this.unlockFn)return this.unlockFn(r.unlockUrl,i);let a=await this.fetchFn(r.unlockUrl,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify(i)});if(!a.ok)throw Error(`DCA unlock failed: ${a.status} ${a.statusText}`);return a.json()}async unlockWithShareToken(e,t,n,r){return this.unlock(e,t,{...r,shareToken:n})}static getShareTokenFromUrl(e=`share`){if(typeof window>`u`||typeof URL>`u`)return null;try{return new URL(window.location.href).searchParams.get(e)}catch{return null}}async decrypt(e,n,r,i){let a=e.dcaData.contentSealData[n];if(!a)throw Error(`DCA: contentSealData not found for "${n}"`);let o=e.sealedContent[n];if(!o)throw Error(`DCA: sealed content not found for "${n}"`);let s=i??r.contentEncryptionKeys.find(e=>(e.contentName??`default`)===n);if(!s)throw Error(`DCA: no key provided for "${n}"`);let c=r.transport===`client-bound`,l=s.periodKeys?Object.fromEntries(s.periodKeys.map(e=>[e.bucket,e.key])):void 0,u;if(s.contentKey){if(u=c?await this.rsaUnwrapKey(s.contentKey):t(s.contentKey),l&&this.periodKeyCache){let e=c?await this.unwrapPeriodKeyMap(l):l,t=s.keyName??n;await this.cachePeriodKeys(t,e)}}else if(l){let t=c?await this.unwrapPeriodKeyMap(l):l;if(u=await this.unwrapWithPeriodKeys(e.dcaData.sealedContentKeys[n]??[],t),this.periodKeyCache){let e=s.keyName??n;await this.cachePeriodKeys(e,t)}}else{let t=Object.values(e.dcaData.issuerData).flatMap(e=>e.contentEncryptionKeys).find(e=>(e.contentName??`default`)===n)?.keyName??n,r=await this.getCachedPeriodKeys(t,e.dcaData.sealedContentKeys[n]??[]);if(r)u=await this.unwrapWithPeriodKeys(e.dcaData.sealedContentKeys[n]??[],r);else throw Error(`DCA: no contentKey or periodKeys available for "${n}"`)}let d=t(o),f=t(a.nonce),p=new TextEncoder().encode(a.aad),m=await crypto.subtle.importKey(`raw`,u,{name:`AES-GCM`},!1,[`decrypt`]),h=await crypto.subtle.decrypt({name:`AES-GCM`,iv:f,additionalData:p,tagLength:128},m,d);return new TextDecoder().decode(h)}async decryptAll(e,t){let n={},r=new Map(t.contentEncryptionKeys.map(e=>[e.contentName??`default`,e]));for(let[i,a]of r)n[i]=await this.decrypt(e,i,t,a);return n}async processPage(t={}){let n=t.root??document;if(this.accessCheck){let t=e.getPublisherContentId(n);if(!t)return console.warn(`DCA: accessCheck is configured but no publisher-content-id attribute was found on the page. Treating as denied.`),this.paywallFn&&this.paywallFn(t,n),{};let r=await this.accessCheck(t);if(!r||!r.hasAccess)return this.paywallFn&&this.paywallFn(t,n),{}}let r=this.parsePage(n),i=t.issuerName??Object.keys(r.dcaData.issuerData)[0];if(!i)throw Error(`DCA: no issuers found in issuerData`);let a=t.shareToken===void 0?e.getShareTokenFromUrl(t.shareTokenParam):t.shareToken,o=a?await this.unlockWithShareToken(r,i,a,t.additionalBody):await this.unlock(r,i,t.additionalBody);return this.decryptAll(r,o)}renderToPage(e,t){let n=t??document,r=new Set;for(let[t,i]of Object.entries(e)){let e=n.querySelector(`[data-dca-content-name="${CSS.escape(t)}"]`);e&&(e.innerHTML=i,r.add(t))}return r}static getPublisherContentId(e){let t=e??document;if(t instanceof Element){let e=t.closest(`[publisher-content-id]`);if(e)return e.getAttribute(`publisher-content-id`)}let n=t.querySelector(`script.dca-data`);if(n){let e=n.closest(`[publisher-content-id]`);if(e)return e.getAttribute(`publisher-content-id`)}return null}observe(e,t){let n=e??document.body,r=new MutationObserver(e=>{for(let n of e)for(let e of Array.from(n.addedNodes)){if(!(e instanceof HTMLElement))continue;let n=[];if(e.matches(`script.dca-data`)){let t=e.parentElement??e;n.includes(t)||n.push(t)}let r=e.querySelectorAll(`script.dca-data`);for(let t of Array.from(r)){let r=t.parentElement??e;n.includes(r)||n.push(r)}for(let e of n)this.processPage({...t,root:e}).then(t=>{Object.keys(t).length>0&&this.renderToPage(t,e)}).catch(e=>console.error(`DCA auto-process failed:`,e))}});return r.observe(n,{childList:!0,subtree:!0}),r}async unwrapWithPeriodKeys(e,n){for(let r of e){let e=n[r.t];if(!e)continue;let i=t(e),a=t(r.nonce),o=t(r.key),s=await crypto.subtle.importKey(`raw`,i,{name:`AES-GCM`},!1,[`decrypt`]);try{let e=await crypto.subtle.decrypt({name:`AES-GCM`,iv:a,tagLength:128},s,o);return new Uint8Array(e)}catch{continue}}throw Error(`DCA: could not unwrap contentKey — no matching periodKey`)}async cachePeriodKeys(e,t){if(this.periodKeyCache)for(let[n,r]of Object.entries(t))await this.periodKeyCache.set(`dca:pk:${e}:${n}`,r)}async getCachedPeriodKeys(e,t){if(!this.periodKeyCache)return null;let n={},r=!1;for(let i of t){let t=await this.periodKeyCache.get(`dca:pk:${e}:${i.t}`);t&&(n[i.t]=t,r=!0)}return r?n:null}async getPublicKey(){let e=await this.ensureKeyPair(),t=await crypto.subtle.exportKey(`spki`,e.publicKey);return n(new Uint8Array(t))}async hasKeyPair(){try{let e=await this.openKeyDb();return await this.idbGet(e,o)!==void 0}catch{return!1}}ensureKeyPair(){return this.keyPairPromise||=this.loadOrCreateKeyPair(),this.keyPairPromise}async loadOrCreateKeyPair(){try{let e=await this.openKeyDb(),t=await this.idbGet(e,o);if(t?.publicKey&&t?.privateKey)return{publicKey:t.publicKey,privateKey:t.privateKey}}catch{}let e=await crypto.subtle.generateKey({name:`RSA-OAEP`,modulusLength:this.rsaKeySize,publicExponent:r,hash:`SHA-256`},!0,[`encrypt`,`decrypt`]),t=await crypto.subtle.exportKey(`jwk`,e.privateKey),n=await crypto.subtle.importKey(`jwk`,t,{name:`RSA-OAEP`,hash:`SHA-256`},!1,[`decrypt`]),i={publicKey:e.publicKey,privateKey:n};try{let t=await this.openKeyDb();await this.idbPut(t,o,{id:o,publicKey:e.publicKey,privateKey:n,createdAt:Date.now(),keySize:this.rsaKeySize})}catch{}return i}async rsaUnwrapKey(e){let n=await this.ensureKeyPair(),r=t(e),i=await crypto.subtle.decrypt({name:`RSA-OAEP`},n.privateKey,r);return new Uint8Array(i)}async unwrapPeriodKeyMap(e){let t={};for(let[r,i]of Object.entries(e))t[r]=n(await this.rsaUnwrapKey(i));return t}keyDbPromise=null;openKeyDb(){return this.keyDbPromise||=new Promise((e,t)=>{let n=indexedDB.open(this.keyDbName,1);n.onupgradeneeded=()=>{let e=n.result;e.objectStoreNames.contains(a)||e.createObjectStore(a,{keyPath:`id`})},n.onsuccess=()=>e(n.result),n.onerror=()=>t(n.error)}),this.keyDbPromise}idbGet(e,t){return new Promise((n,r)=>{let i=e.transaction(a,`readonly`).objectStore(a).get(t);i.onsuccess=()=>n(i.result),i.onerror=()=>r(i.error)})}idbPut(e,t,n){return new Promise((t,r)=>{let i=e.transaction(a,`readwrite`).objectStore(a).put(n);i.onsuccess=()=>t(),i.onerror=()=>r(i.error)})}};function c(e){return s.hasDcaContent(e)}var l=function(e){return e.AUTH_INITIALIZED=`sesamyJsAuthInitialized`,e.READY=`sesamyJsReady`,e.AUTHENTICATED=`sesamyJsAuthenticated`,e.LOGOUT=`sesamyJsLogout`,e.CLEAR_CACHE=`sesamyJsClearCache`,e.USER_ATTRIBUTE_CHANGED=`sesamyUserAttributeChanged`,e.PURCHASE=`sesamyJsPurchase`,e.CONSENT_CHANGED=`sesamyJsConsentChanged`,e}({}),u=3600*1e3;function d(){let e=null;return{init(t,n){let r=async(e,t)=>{let r=await n.getToken(!1),i=new Headers(t?.headers);return r&&i.set(`Authorization`,`Bearer ${r}`),globalThis.fetch(e,{...t,headers:i,credentials:t?.credentials??`same-origin`})};window.addEventListener(l.LOGOUT,()=>{try{let e=[];for(let t=0;t<sessionStorage.length;t++){let n=sessionStorage.key(t);n?.startsWith(`dca:unlock:`)&&e.push(n)}e.forEach(e=>sessionStorage.removeItem(e))}catch{}}),e=new s({fetch:r,clientBound:t.clientBound??!1,rsaKeySize:t.rsaKeySize??2048,unlockFn:async(e,t)=>{let n=JSON.stringify(t),i=`dca:unlock:${e}:${n}`;try{let e=sessionStorage.getItem(i);if(e){let{ts:t,data:n}=JSON.parse(e);if(Date.now()-t<u)return n;sessionStorage.removeItem(i)}}catch{}let a=await r(e,{method:`POST`,headers:{"Content-Type":`application/json`},body:n});if(!a.ok)throw Error(`DCA unlock failed: ${a.status} ${a.statusText}`);let o=await a.json();try{sessionStorage.setItem(i,JSON.stringify({ts:Date.now(),data:o}))}catch{}return o}})},getDcaClient(){return e},async processPage(){if(!e||!c())return null;let t=await e.processPage();return e.renderToPage(t),t}}}return e.createCapsulePlugin=d,e})({});
+var capsulePlugin=(function(e){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});function t(e){let t=e.length%4,n=(t?e+`=`.repeat(4-t):e).replace(/-/g,`+`).replace(/_/g,`/`),r=atob(n),i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function n(e){let t=``;for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}var r=new Uint8Array([1,0,1]),i=`dca-keys`,a=`keypair`,o=`default`,s=`dca-wrap-keys`,c=`wrap-keys`;function l(){let e=null;function t(){return e||=new Promise((e,t)=>{let n=indexedDB.open(s,1);n.onupgradeneeded=()=>{let e=n.result;e.objectStoreNames.contains(c)||e.createObjectStore(c)},n.onsuccess=()=>e(n.result),n.onerror=()=>t(n.error)}),e}return{async get(e){if(typeof indexedDB>`u`)return null;try{let n=await t();return await new Promise(t=>{let r=n.transaction(c,`readonly`).objectStore(c).get(e);r.onsuccess=()=>t(r.result??null),r.onerror=()=>t(null)})}catch{return null}},async set(e,n){if(!(typeof indexedDB>`u`))try{let r=await t();await new Promise((t,i)=>{let a=r.transaction(c,`readwrite`);a.objectStore(c).put(n,e),a.oncomplete=()=>t(),a.onerror=()=>i(a.error)})}catch{}}}}var u=class e{fetchFn;unlockFn;wrapKeyCache;clientBound;rsaKeySize;keyDbName;keyPairPromise=null;accessCheck;paywallFn;constructor(e={}){this.fetchFn=e.fetch??globalThis.fetch.bind(globalThis),this.unlockFn=e.unlockFn,this.wrapKeyCache=e.wrapKeyCache===!1?void 0:e.wrapKeyCache??l(),this.clientBound=e.clientBound??!1,this.rsaKeySize=e.rsaKeySize??2048,this.keyDbName=e.keyDbName??i,this.accessCheck=e.accessCheck,this.paywallFn=e.paywallFn}parsePage(e){let t=(e??document).querySelector(`script.dca-manifest`);if(!t)throw Error(`DCA: <script class="dca-manifest"> not found`);return{manifest:JSON.parse(t.textContent??``)}}parseJsonResponse(e){return{manifest:e}}static hasDcaContent(e){return(e??document).querySelector(`script.dca-manifest`)!==null}async unlock(e,t,n){let r=e.manifest.issuers[t];if(!r)throw Error(`DCA: issuer "${t}" not found in manifest.issuers`);let i={resourceJWT:e.manifest.resourceJWT,keys:r.keys,...n};if(this.clientBound&&(i.clientPublicKey=await this.getPublicKey()),this.unlockFn)return this.unlockFn(r.unlockUrl,i);let a=await this.fetchFn(r.unlockUrl,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify(i)});if(!a.ok)throw Error(`DCA unlock failed: ${a.status} ${a.statusText}`);return a.json()}async unlockWithShareToken(e,t,n,r){return this.unlock(e,t,{...r,shareToken:n})}static getShareTokenFromUrl(e=`share`){if(typeof window>`u`||typeof URL>`u`)return null;try{return new URL(window.location.href).searchParams.get(e)}catch{return null}}async decrypt(e,n,r,i){let a=e.manifest.content[n];if(!a)throw Error(`DCA: content entry not found for "${n}"`);let o=i??r.keys.find(e=>(e.contentName??`default`)===n);if(!o)throw Error(`DCA: no key provided for "${n}"`);let s=r.transport===`client-bound`,c=o.wrapKeys?Object.fromEntries(o.wrapKeys.map(e=>[e.kid,e.key])):void 0,l;if(o.contentKey)l=s?await this.rsaUnwrapKey(o.contentKey):t(o.contentKey);else if(c){let t=s?await this.unwrapWrapKeyMap(c):c;if(l=await this.unwrapContentKey(a.wrappedContentKey,t),this.wrapKeyCache){let r=this.resolveScope(e,n,o.scope)??n;await this.cacheWrapKeys(r,t)}}else{let t=this.resolveScope(e,n,o.scope)??n,r=await this.getCachedWrapKeys(t,a.wrappedContentKey);if(r)l=await this.unwrapContentKey(a.wrappedContentKey,r);else throw Error(`DCA: no contentKey or wrapKeys available for "${n}"`)}return this.decryptContentBody(a,l)}async decryptContentBody(e,n){let r=t(e.ciphertext),i=t(e.iv),a=new TextEncoder().encode(e.aad),o=await crypto.subtle.importKey(`raw`,n,{name:`AES-GCM`},!1,[`decrypt`]),s=await crypto.subtle.decrypt({name:`AES-GCM`,iv:i,additionalData:a,tagLength:128},o,r);return new TextDecoder().decode(s)}async tryDecryptFromCache(e,t){let n=e.manifest.content[t];if(!n||n.wrappedContentKey.length===0)return null;let r=this.resolveScope(e,t)??t,i=await this.getCachedWrapKeys(r,n.wrappedContentKey);if(!i)return null;try{let e=await this.unwrapContentKey(n.wrappedContentKey,i);return await this.decryptContentBody(n,e)}catch{return null}}async decryptAll(e,t){let n={},r=new Map(t.keys.map(e=>[e.contentName??`default`,e]));for(let[i,a]of r)n[i]=await this.decrypt(e,i,t,a);return n}async processPage(t={}){let n=t.root??document;if(this.accessCheck){let t=e.getPublisherContentId(n);if(!t)return console.warn(`DCA: accessCheck is configured but no publisher-content-id attribute was found on the page. Treating as denied.`),this.paywallFn&&this.paywallFn(t,n),{};let r=await this.accessCheck(t);if(!r||!r.hasAccess)return this.paywallFn&&this.paywallFn(t,n),{}}let r=this.parsePage(n),i=t.issuerName??Object.keys(r.manifest.issuers)[0];if(!i)throw Error(`DCA: no issuers found in manifest.issuers`);let a={},o=[];for(let e of Object.keys(r.manifest.content)){let t=await this.tryDecryptFromCache(r,e);t===null?o.push(e):a[e]=t}if(o.length===0)return a;let s=t.shareToken===void 0?e.getShareTokenFromUrl(t.shareTokenParam):t.shareToken,c=s?await this.unlockWithShareToken(r,i,s,t.additionalBody):await this.unlock(r,i,t.additionalBody);for(let e of o)a[e]=await this.decrypt(r,e,c);return a}renderToPage(e,t){let n=t??document,r=new Set;for(let[t,i]of Object.entries(e)){let e=n.querySelector(`[data-dca-content-name="${CSS.escape(t)}"]`);e&&(e.innerHTML=i,r.add(t))}return r}static getPublisherContentId(e){let t=e??document;if(t instanceof Element){let e=t.closest(`[publisher-content-id]`);if(e)return e.getAttribute(`publisher-content-id`)}let n=t.querySelector(`script.dca-manifest`);if(n){let e=n.closest(`[publisher-content-id]`);if(e)return e.getAttribute(`publisher-content-id`)}return null}observe(e,t){let n=e??document.body,r=new MutationObserver(e=>{for(let n of e)for(let e of Array.from(n.addedNodes)){if(!(e instanceof HTMLElement))continue;let n=[];if(e.matches(`script.dca-manifest`)){let t=e.parentElement??e;n.includes(t)||n.push(t)}let r=e.querySelectorAll(`script.dca-manifest`);for(let t of Array.from(r)){let r=t.parentElement??e;n.includes(r)||n.push(r)}for(let e of n)this.processPage({...t,root:e}).then(t=>{Object.keys(t).length>0&&this.renderToPage(t,e)}).catch(e=>console.error(`DCA auto-process failed:`,e))}});return r.observe(n,{childList:!0,subtree:!0}),r}resolveScope(e,t,n){if(n)return n;for(let n of Object.values(e.manifest.issuers)){let e=n.keys.find(e=>(e.contentName??`default`)===t);if(e)return e.scope}}async unwrapContentKey(e,n){for(let r of e){let e=n[r.kid];if(!e)continue;let i=t(e),a=t(r.iv),o=t(r.ciphertext),s=await crypto.subtle.importKey(`raw`,i,{name:`AES-GCM`},!1,[`decrypt`]);try{let e=await crypto.subtle.decrypt({name:`AES-GCM`,iv:a,tagLength:128},s,o);return new Uint8Array(e)}catch{continue}}throw Error(`DCA: could not unwrap contentKey — no matching wrapKey`)}async cacheWrapKeys(e,t){if(this.wrapKeyCache)for(let[n,r]of Object.entries(t))await this.wrapKeyCache.set(`dca:wk:${e}:${n}`,r)}async getCachedWrapKeys(e,t){if(!this.wrapKeyCache)return null;let n={},r=!1;for(let i of t){let t=await this.wrapKeyCache.get(`dca:wk:${e}:${i.kid}`);t&&(n[i.kid]=t,r=!0)}return r?n:null}async getPublicKey(){let e=await this.ensureKeyPair(),t=await crypto.subtle.exportKey(`spki`,e.publicKey);return n(new Uint8Array(t))}async hasKeyPair(){try{let e=await this.openKeyDb();return await this.idbGet(e,o)!==void 0}catch{return!1}}ensureKeyPair(){return this.keyPairPromise||=this.loadOrCreateKeyPair(),this.keyPairPromise}async loadOrCreateKeyPair(){try{let e=await this.openKeyDb(),t=await this.idbGet(e,o);if(t?.publicKey&&t?.privateKey)return{publicKey:t.publicKey,privateKey:t.privateKey}}catch{}let e=await crypto.subtle.generateKey({name:`RSA-OAEP`,modulusLength:this.rsaKeySize,publicExponent:r,hash:`SHA-256`},!0,[`encrypt`,`decrypt`]),t=await crypto.subtle.exportKey(`jwk`,e.privateKey),n=await crypto.subtle.importKey(`jwk`,t,{name:`RSA-OAEP`,hash:`SHA-256`},!1,[`decrypt`]),i={publicKey:e.publicKey,privateKey:n};try{let t=await this.openKeyDb();await this.idbPut(t,o,{id:o,publicKey:e.publicKey,privateKey:n,createdAt:Date.now(),keySize:this.rsaKeySize})}catch{}return i}async rsaUnwrapKey(e){let n=await this.ensureKeyPair(),r=t(e),i=await crypto.subtle.decrypt({name:`RSA-OAEP`},n.privateKey,r);return new Uint8Array(i)}async unwrapWrapKeyMap(e){let t={};for(let[r,i]of Object.entries(e))t[r]=n(await this.rsaUnwrapKey(i));return t}keyDbPromise=null;openKeyDb(){return this.keyDbPromise||=new Promise((e,t)=>{let n=indexedDB.open(this.keyDbName,1);n.onupgradeneeded=()=>{let e=n.result;e.objectStoreNames.contains(a)||e.createObjectStore(a,{keyPath:`id`})},n.onsuccess=()=>e(n.result),n.onerror=()=>t(n.error)}),this.keyDbPromise}idbGet(e,t){return new Promise((n,r)=>{let i=e.transaction(a,`readonly`).objectStore(a).get(t);i.onsuccess=()=>n(i.result),i.onerror=()=>r(i.error)})}idbPut(e,t,n){return new Promise((t,r)=>{let i=e.transaction(a,`readwrite`).objectStore(a).put(n);i.onsuccess=()=>t(),i.onerror=()=>r(i.error)})}};function d(e){return u.hasDcaContent(e)}var f=function(e){return e.AUTH_INITIALIZED=`sesamyJsAuthInitialized`,e.READY=`sesamyJsReady`,e.AUTHENTICATED=`sesamyJsAuthenticated`,e.LOGOUT=`sesamyJsLogout`,e.CLEAR_CACHE=`sesamyJsClearCache`,e.USER_ATTRIBUTE_CHANGED=`sesamyUserAttributeChanged`,e.PURCHASE=`sesamyJsPurchase`,e.CONSENT_CHANGED=`sesamyJsConsentChanged`,e}({}),p=3600*1e3,m=`dca:`,h=`${m}unlock:`,g=`${m}wk:`,_=!1;function v(){try{let e=[];for(let t=0;t<sessionStorage.length;t++){let n=sessionStorage.key(t);n?.startsWith(m)&&e.push(n)}e.forEach(e=>sessionStorage.removeItem(e))}catch{}}var y=class{async get(e){try{return sessionStorage.getItem(`${g}${e}`)}catch{return null}}async set(e,t){try{sessionStorage.setItem(`${g}${e}`,t)}catch{}}};function b(){let e=null;return{init(t,n){let r=async(e,t)=>{let r=await n.getToken(!1),i=new Headers(t?.headers);return r&&i.set(`Authorization`,`Bearer ${r}`),globalThis.fetch(e,{...t,headers:i,credentials:t?.credentials??`same-origin`})};_||=(window.addEventListener(f.LOGOUT,v),!0),e=new u({fetch:r,clientBound:t.clientBound??!1,rsaKeySize:t.rsaKeySize??2048,unlockFn:async(e,t)=>{let n=JSON.stringify(t),i=`${h}${e}:${n}`;try{let e=sessionStorage.getItem(i);if(e){let{ts:t,data:n}=JSON.parse(e);if(Date.now()-t<p)return n;sessionStorage.removeItem(i)}}catch{}let a=await r(e,{method:`POST`,headers:{"Content-Type":`application/json`},body:n});if(!a.ok)throw Error(`DCA unlock failed: ${a.status} ${a.statusText}`);let o=await a.json();try{sessionStorage.setItem(i,JSON.stringify({ts:Date.now(),data:o}))}catch{}return o},wrapKeyCache:new y})},getDcaClient(){return e},async processPage(){if(!e||!d())return null;let t=await e.processPage();return e.renderToPage(t),t}}}return e.createCapsulePlugin=b,e})({});

package/dist/capsule-plugin.mjs

@@ -1,4 +1,4 @@
-//#region ../../node_modules/.pnpm/@sesamy+capsule@0.11.0/node_modules/@sesamy/capsule/dist/index.mjs
+//#region ../../node_modules/.pnpm/@sesamy+capsule@0.12.0/node_modules/@sesamy/capsule/dist/index.mjs
 function e(e) {
 	let t = e.length % 4, n = (t ? e + "=".repeat(4 - t) : e).replace(/-/g, "+").replace(/_/g, "/"), r = atob(n), i = new Uint8Array(r.length);
 	for (let e = 0; e < r.length; e++) i[e] = r.charCodeAt(e);
@@ -13,10 +13,46 @@ var n = new Uint8Array([
 	1,
 	0,
 	1
-]), r = "dca-keys", i = "keypair", a = "default", o = class o {
+]), r = "dca-keys", i = "keypair", a = "default", o = "dca-wrap-keys", s = "wrap-keys";
+function c() {
+	let e = null;
+	function t() {
+		return e ||= new Promise((e, t) => {
+			let n = indexedDB.open(o, 1);
+			n.onupgradeneeded = () => {
+				let e = n.result;
+				e.objectStoreNames.contains(s) || e.createObjectStore(s);
+			}, n.onsuccess = () => e(n.result), n.onerror = () => t(n.error);
+		}), e;
+	}
+	return {
+		async get(e) {
+			if (typeof indexedDB > "u") return null;
+			try {
+				let n = await t();
+				return await new Promise((t) => {
+					let r = n.transaction(s, "readonly").objectStore(s).get(e);
+					r.onsuccess = () => t(r.result ?? null), r.onerror = () => t(null);
+				});
+			} catch {
+				return null;
+			}
+		},
+		async set(e, n) {
+			if (!(typeof indexedDB > "u")) try {
+				let r = await t();
+				await new Promise((t, i) => {
+					let a = r.transaction(s, "readwrite");
+					a.objectStore(s).put(n, e), a.oncomplete = () => t(), a.onerror = () => i(a.error);
+				});
+			} catch {}
+		}
+	};
+}
+var l = class o {
 	fetchFn;
 	unlockFn;
-	periodKeyCache;
+	wrapKeyCache;
 	clientBound;
 	rsaKeySize;
 	keyDbName;
@@ -24,40 +60,25 @@ var n = new Uint8Array([
 	accessCheck;
 	paywallFn;
 	constructor(e = {}) {
-		this.fetchFn = e.fetch ?? globalThis.fetch.bind(globalThis), this.unlockFn = e.unlockFn, this.periodKeyCache = e.periodKeyCache, this.clientBound = e.clientBound ?? !1, this.rsaKeySize = e.rsaKeySize ?? 2048, this.keyDbName = e.keyDbName ?? r, this.accessCheck = e.accessCheck, this.paywallFn = e.paywallFn;
+		this.fetchFn = e.fetch ?? globalThis.fetch.bind(globalThis), this.unlockFn = e.unlockFn, this.wrapKeyCache = e.wrapKeyCache === !1 ? void 0 : e.wrapKeyCache ?? c(), this.clientBound = e.clientBound ?? !1, this.rsaKeySize = e.rsaKeySize ?? 2048, this.keyDbName = e.keyDbName ?? r, this.accessCheck = e.accessCheck, this.paywallFn = e.paywallFn;
 	}
 	parsePage(e) {
-		let t = e ?? document, n = t.querySelector("script.dca-data");
-		if (!n) throw Error("DCA: <script class=\"dca-data\"> not found");
-		let r = JSON.parse(n.textContent ?? ""), i = t.querySelector("template.dca-sealed-content"), a = {};
-		if (i && i instanceof HTMLTemplateElement) {
-			let e = i.content.querySelectorAll("[data-dca-content-name]");
-			for (let t of Array.from(e)) {
-				let e = t.getAttribute("data-dca-content-name");
-				e && (a[e] = t.textContent?.trim() ?? "");
-			}
-		}
-		return {
-			dcaData: r,
-			sealedContent: a
-		};
+		let t = (e ?? document).querySelector("script.dca-manifest");
+		if (!t) throw Error("DCA: <script class=\"dca-manifest\"> not found");
+		return { manifest: JSON.parse(t.textContent ?? "") };
 	}
 	parseJsonResponse(e) {
-		let { sealedContent: t, ...n } = e;
-		return {
-			dcaData: n,
-			sealedContent: t
-		};
+		return { manifest: e };
 	}
 	static hasDcaContent(e) {
-		return (e ?? document).querySelector("script.dca-data") !== null;
+		return (e ?? document).querySelector("script.dca-manifest") !== null;
 	}
 	async unlock(e, t, n) {
-		let r = e.dcaData.issuerData[t];
-		if (!r) throw Error(`DCA: issuer "${t}" not found in issuerData`);
+		let r = e.manifest.issuers[t];
+		if (!r) throw Error(`DCA: issuer "${t}" not found in manifest.issuers`);
 		let i = {
-			resourceJWT: e.dcaData.resourceJWT,
-			contentEncryptionKeys: r.contentEncryptionKeys,
+			resourceJWT: e.manifest.resourceJWT,
+			keys: r.keys,
 			...n
 		};
 		if (this.clientBound && (i.clientPublicKey = await this.getPublicKey()), this.unlockFn) return this.unlockFn(r.unlockUrl, i);
@@ -84,39 +105,48 @@ var n = new Uint8Array([
 		}
 	}
 	async decrypt(t, n, r, i) {
-		let a = t.dcaData.contentSealData[n];
-		if (!a) throw Error(`DCA: contentSealData not found for "${n}"`);
-		let o = t.sealedContent[n];
-		if (!o) throw Error(`DCA: sealed content not found for "${n}"`);
-		let s = i ?? r.contentEncryptionKeys.find((e) => (e.contentName ?? "default") === n);
-		if (!s) throw Error(`DCA: no key provided for "${n}"`);
-		let c = r.transport === "client-bound", l = s.periodKeys ? Object.fromEntries(s.periodKeys.map((e) => [e.bucket, e.key])) : void 0, u;
-		if (s.contentKey) {
-			if (u = c ? await this.rsaUnwrapKey(s.contentKey) : e(s.contentKey), l && this.periodKeyCache) {
-				let e = c ? await this.unwrapPeriodKeyMap(l) : l, t = s.keyName ?? n;
-				await this.cachePeriodKeys(t, e);
-			}
-		} else if (l) {
-			let e = c ? await this.unwrapPeriodKeyMap(l) : l;
-			if (u = await this.unwrapWithPeriodKeys(t.dcaData.sealedContentKeys[n] ?? [], e), this.periodKeyCache) {
-				let t = s.keyName ?? n;
-				await this.cachePeriodKeys(t, e);
+		let a = t.manifest.content[n];
+		if (!a) throw Error(`DCA: content entry not found for "${n}"`);
+		let o = i ?? r.keys.find((e) => (e.contentName ?? "default") === n);
+		if (!o) throw Error(`DCA: no key provided for "${n}"`);
+		let s = r.transport === "client-bound", c = o.wrapKeys ? Object.fromEntries(o.wrapKeys.map((e) => [e.kid, e.key])) : void 0, l;
+		if (o.contentKey) l = s ? await this.rsaUnwrapKey(o.contentKey) : e(o.contentKey);
+		else if (c) {
+			let e = s ? await this.unwrapWrapKeyMap(c) : c;
+			if (l = await this.unwrapContentKey(a.wrappedContentKey, e), this.wrapKeyCache) {
+				let r = this.resolveScope(t, n, o.scope) ?? n;
+				await this.cacheWrapKeys(r, e);
 			}
 		} else {
-			let e = Object.values(t.dcaData.issuerData).flatMap((e) => e.contentEncryptionKeys).find((e) => (e.contentName ?? "default") === n)?.keyName ?? n, r = await this.getCachedPeriodKeys(e, t.dcaData.sealedContentKeys[n] ?? []);
-			if (r) u = await this.unwrapWithPeriodKeys(t.dcaData.sealedContentKeys[n] ?? [], r);
-			else throw Error(`DCA: no contentKey or periodKeys available for "${n}"`);
+			let e = this.resolveScope(t, n, o.scope) ?? n, r = await this.getCachedWrapKeys(e, a.wrappedContentKey);
+			if (r) l = await this.unwrapContentKey(a.wrappedContentKey, r);
+			else throw Error(`DCA: no contentKey or wrapKeys available for "${n}"`);
 		}
-		let d = e(o), f = e(a.nonce), p = new TextEncoder().encode(a.aad), m = await crypto.subtle.importKey("raw", u, { name: "AES-GCM" }, !1, ["decrypt"]), h = await crypto.subtle.decrypt({
+		return this.decryptContentBody(a, l);
+	}
+	async decryptContentBody(t, n) {
+		let r = e(t.ciphertext), i = e(t.iv), a = new TextEncoder().encode(t.aad), o = await crypto.subtle.importKey("raw", n, { name: "AES-GCM" }, !1, ["decrypt"]), s = await crypto.subtle.decrypt({
 			name: "AES-GCM",
-			iv: f,
-			additionalData: p,
+			iv: i,
+			additionalData: a,
 			tagLength: 128
-		}, m, d);
-		return new TextDecoder().decode(h);
+		}, o, r);
+		return new TextDecoder().decode(s);
+	}
+	async tryDecryptFromCache(e, t) {
+		let n = e.manifest.content[t];
+		if (!n || n.wrappedContentKey.length === 0) return null;
+		let r = this.resolveScope(e, t) ?? t, i = await this.getCachedWrapKeys(r, n.wrappedContentKey);
+		if (!i) return null;
+		try {
+			let e = await this.unwrapContentKey(n.wrappedContentKey, i);
+			return await this.decryptContentBody(n, e);
+		} catch {
+			return null;
+		}
 	}
 	async decryptAll(e, t) {
-		let n = {}, r = new Map(t.contentEncryptionKeys.map((e) => [e.contentName ?? "default", e]));
+		let n = {}, r = new Map(t.keys.map((e) => [e.contentName ?? "default", e]));
 		for (let [i, a] of r) n[i] = await this.decrypt(e, i, t, a);
 		return n;
 	}
@@ -128,10 +158,17 @@ var n = new Uint8Array([
 			let n = await this.accessCheck(e);
 			if (!n || !n.hasAccess) return this.paywallFn && this.paywallFn(e, t), {};
 		}
-		let n = this.parsePage(t), r = e.issuerName ?? Object.keys(n.dcaData.issuerData)[0];
-		if (!r) throw Error("DCA: no issuers found in issuerData");
-		let i = e.shareToken === void 0 ? o.getShareTokenFromUrl(e.shareTokenParam) : e.shareToken, a = i ? await this.unlockWithShareToken(n, r, i, e.additionalBody) : await this.unlock(n, r, e.additionalBody);
-		return this.decryptAll(n, a);
+		let n = this.parsePage(t), r = e.issuerName ?? Object.keys(n.manifest.issuers)[0];
+		if (!r) throw Error("DCA: no issuers found in manifest.issuers");
+		let i = {}, a = [];
+		for (let e of Object.keys(n.manifest.content)) {
+			let t = await this.tryDecryptFromCache(n, e);
+			t === null ? a.push(e) : i[e] = t;
+		}
+		if (a.length === 0) return i;
+		let s = e.shareToken === void 0 ? o.getShareTokenFromUrl(e.shareTokenParam) : e.shareToken, c = s ? await this.unlockWithShareToken(n, r, s, e.additionalBody) : await this.unlock(n, r, e.additionalBody);
+		for (let e of a) i[e] = await this.decrypt(n, e, c);
+		return i;
 	}
 	renderToPage(e, t) {
 		let n = t ?? document, r = /* @__PURE__ */ new Set();
@@ -147,7 +184,7 @@ var n = new Uint8Array([
 			let e = t.closest("[publisher-content-id]");
 			if (e) return e.getAttribute("publisher-content-id");
 		}
-		let n = t.querySelector("script.dca-data");
+		let n = t.querySelector("script.dca-manifest");
 		if (n) {
 			let e = n.closest("[publisher-content-id]");
 			if (e) return e.getAttribute("publisher-content-id");
@@ -159,11 +196,11 @@ var n = new Uint8Array([
 			for (let n of e) for (let e of Array.from(n.addedNodes)) {
 				if (!(e instanceof HTMLElement)) continue;
 				let n = [];
-				if (e.matches("script.dca-data")) {
+				if (e.matches("script.dca-manifest")) {
 					let t = e.parentElement ?? e;
 					n.includes(t) || n.push(t);
 				}
-				let r = e.querySelectorAll("script.dca-data");
+				let r = e.querySelectorAll("script.dca-manifest");
 				for (let t of Array.from(r)) {
 					let r = t.parentElement ?? e;
 					n.includes(r) || n.push(r);
@@ -181,11 +218,18 @@ var n = new Uint8Array([
 			subtree: !0
 		}), r;
 	}
-	async unwrapWithPeriodKeys(t, n) {
+	resolveScope(e, t, n) {
+		if (n) return n;
+		for (let n of Object.values(e.manifest.issuers)) {
+			let e = n.keys.find((e) => (e.contentName ?? "default") === t);
+			if (e) return e.scope;
+		}
+	}
+	async unwrapContentKey(t, n) {
 		for (let r of t) {
-			let t = n[r.t];
+			let t = n[r.kid];
 			if (!t) continue;
-			let i = e(t), a = e(r.nonce), o = e(r.key), s = await crypto.subtle.importKey("raw", i, { name: "AES-GCM" }, !1, ["decrypt"]);
+			let i = e(t), a = e(r.iv), o = e(r.ciphertext), s = await crypto.subtle.importKey("raw", i, { name: "AES-GCM" }, !1, ["decrypt"]);
 			try {
 				let e = await crypto.subtle.decrypt({
 					name: "AES-GCM",
@@ -197,17 +241,17 @@ var n = new Uint8Array([
 				continue;
 			}
 		}
-		throw Error("DCA: could not unwrap contentKey — no matching periodKey");
+		throw Error("DCA: could not unwrap contentKey — no matching wrapKey");
 	}
-	async cachePeriodKeys(e, t) {
-		if (this.periodKeyCache) for (let [n, r] of Object.entries(t)) await this.periodKeyCache.set(`dca:pk:${e}:${n}`, r);
+	async cacheWrapKeys(e, t) {
+		if (this.wrapKeyCache) for (let [n, r] of Object.entries(t)) await this.wrapKeyCache.set(`dca:wk:${e}:${n}`, r);
 	}
-	async getCachedPeriodKeys(e, t) {
-		if (!this.periodKeyCache) return null;
+	async getCachedWrapKeys(e, t) {
+		if (!this.wrapKeyCache) return null;
 		let n = {}, r = !1;
 		for (let i of t) {
-			let t = await this.periodKeyCache.get(`dca:pk:${e}:${i.t}`);
-			t && (n[i.t] = t, r = !0);
+			let t = await this.wrapKeyCache.get(`dca:wk:${e}:${i.kid}`);
+			t && (n[i.kid] = t, r = !0);
 		}
 		return r ? n : null;
 	}
@@ -262,7 +306,7 @@ var n = new Uint8Array([
 		let n = await this.ensureKeyPair(), r = e(t), i = await crypto.subtle.decrypt({ name: "RSA-OAEP" }, n.privateKey, r);
 		return new Uint8Array(i);
 	}
-	async unwrapPeriodKeyMap(e) {
+	async unwrapWrapKeyMap(e) {
 		let n = {};
 		for (let [r, i] of Object.entries(e)) n[r] = t(await this.rsaUnwrapKey(i));
 		return n;
@@ -290,15 +334,39 @@ var n = new Uint8Array([
 		});
 	}
 };
-function s(e) {
-	return o.hasDcaContent(e);
+function u(e) {
+	return l.hasDcaContent(e);
 }
 //#endregion
 //#region src/types/Events.ts
-var c = /* @__PURE__ */ function(e) {
+var d = /* @__PURE__ */ function(e) {
 	return e.AUTH_INITIALIZED = "sesamyJsAuthInitialized", e.READY = "sesamyJsReady", e.AUTHENTICATED = "sesamyJsAuthenticated", e.LOGOUT = "sesamyJsLogout", e.CLEAR_CACHE = "sesamyJsClearCache", e.USER_ATTRIBUTE_CHANGED = "sesamyUserAttributeChanged", e.PURCHASE = "sesamyJsPurchase", e.CONSENT_CHANGED = "sesamyJsConsentChanged", e;
-}({}), l = 3600 * 1e3;
-function u() {
+}({}), f = 3600 * 1e3, p = "dca:", m = `${p}unlock:`, h = `${p}wk:`, g = !1;
+function _() {
+	try {
+		let e = [];
+		for (let t = 0; t < sessionStorage.length; t++) {
+			let n = sessionStorage.key(t);
+			n?.startsWith(p) && e.push(n);
+		}
+		e.forEach((e) => sessionStorage.removeItem(e));
+	} catch {}
+}
+var v = class {
+	async get(e) {
+		try {
+			return sessionStorage.getItem(`${h}${e}`);
+		} catch {
+			return null;
+		}
+	}
+	async set(e, t) {
+		try {
+			sessionStorage.setItem(`${h}${e}`, t);
+		} catch {}
+	}
+};
+function y() {
 	let e = null;
 	return {
 		init(t, n) {
@@ -310,26 +378,17 @@ function u() {
 					credentials: t?.credentials ?? "same-origin"
 				});
 			};
-			window.addEventListener(c.LOGOUT, () => {
-				try {
-					let e = [];
-					for (let t = 0; t < sessionStorage.length; t++) {
-						let n = sessionStorage.key(t);
-						n?.startsWith("dca:unlock:") && e.push(n);
-					}
-					e.forEach((e) => sessionStorage.removeItem(e));
-				} catch {}
-			}), e = new o({
+			g ||= (window.addEventListener(d.LOGOUT, _), !0), e = new l({
 				fetch: r,
 				clientBound: t.clientBound ?? !1,
 				rsaKeySize: t.rsaKeySize ?? 2048,
 				unlockFn: async (e, t) => {
-					let n = JSON.stringify(t), i = `dca:unlock:${e}:${n}`;
+					let n = JSON.stringify(t), i = `${m}${e}:${n}`;
 					try {
 						let e = sessionStorage.getItem(i);
 						if (e) {
 							let { ts: t, data: n } = JSON.parse(e);
-							if (Date.now() - t < l) return n;
+							if (Date.now() - t < f) return n;
 							sessionStorage.removeItem(i);
 						}
 					} catch {}
@@ -347,18 +406,19 @@ function u() {
 						}));
 					} catch {}
 					return o;
-				}
+				},
+				wrapKeyCache: new v()
 			});
 		},
 		getDcaClient() {
 			return e;
 		},
 		async processPage() {
-			if (!e || !s()) return null;
+			if (!e || !u()) return null;
 			let t = await e.processPage();
 			return e.renderToPage(t), t;
 		}
 	};
 }
 //#endregion
-export { u as createCapsulePlugin };
+export { y as createCapsulePlugin };