@shelbyb/daywalker-sdk 0.0.0-stage → 0.1.1

package/dist/crypto/encoding.js

@@ -0,0 +1,117 @@
+/**
+ * Zero-dependency Web standard encoding utilities.
+ * Runs in Node.js 18+, Bun, Deno, Cloudflare Workers, and browser/Edge runtimes.
+ */
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+export function stringToUtf8(str) {
+    return encoder.encode(str);
+}
+export function utf8ToString(bytes) {
+    return decoder.decode(bytes);
+}
+export function bytesToBase64(bytes) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64");
+    }
+    let binary = "";
+    const len = bytes.byteLength;
+    for (let i = 0; i < len; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+export function base64ToBytes(b64) {
+    const clean = b64.trim().replace(/\s+/g, "");
+    if (typeof Buffer !== "undefined") {
+        const buf = Buffer.from(clean, "base64");
+        return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+    }
+    const binary = atob(clean);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+export function bytesToBase64Url(bytes) {
+    return bytesToBase64(bytes)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+export function base64UrlToBytes(b64url) {
+    let b64 = b64url.trim().replace(/-/g, "+").replace(/_/g, "/");
+    while (b64.length % 4 !== 0) {
+        b64 += "=";
+    }
+    return base64ToBytes(b64);
+}
+export function bytesToHex(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++) {
+        hex += bytes[i].toString(16).padStart(2, "0");
+    }
+    return hex;
+}
+export function hexToBytes(hex) {
+    const clean = hex.trim().replace(/^0x/i, "");
+    const bytes = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < clean.length; i += 2) {
+        bytes[i / 2] = parseInt(clean.substring(i, i + 2), 16);
+    }
+    return bytes;
+}
+/**
+ * Constant-time byte comparison to mitigate microarchitectural timing attacks.
+ */
+export function timingSafeEqual(a, b) {
+    if (a.byteLength !== b.byteLength)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.byteLength; i++) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+/**
+ * Constant-time string comparison helper.
+ */
+export function timingSafeEqualString(a, b) {
+    return timingSafeEqual(stringToUtf8(a), stringToUtf8(b));
+}
+/**
+ * Masks a secret string for safe display/logging (e.g. `srv_...cdef` or `[none]`).
+ */
+export function maskSecret(val) {
+    if (!val || typeof val !== "string")
+        return "[none]";
+    if (val.length <= 8)
+        return "***";
+    return `${val.slice(0, 4)}...${val.slice(-4)}`;
+}
+/**
+ * Redacts secrets, tokens, keys, and authorization headers from strings.
+ * Used across SDK error handlers and logs to prevent sensitive credential exposure.
+ */
+export function redactSecrets(input) {
+    if (!input || typeof input !== "string")
+        return "";
+    let out = input;
+    // Bearer tokens & Authorization headers
+    out = out.replace(/(Bearer\s+)[A-Za-z0-9_\-\.]+/gi, "$1[REDACTED]");
+    // API keys (e.g. srv_live_..., srv_test_..., dw_...)
+    out = out.replace(/\b(srv_(?:live|test)_[a-zA-Z0-9_\-]+)\b/g, (match) => {
+        if (match.length <= 12)
+            return "[REDACTED_KEY]";
+        return `${match.slice(0, 8)}...[REDACTED]`;
+    });
+    out = out.replace(/\b(dw_[a-zA-Z0-9_\-]+)\b/g, "[REDACTED_KEY]");
+    // Standard JWTs (header.payload.signature)
+    out = out.replace(/\beyJ[A-Za-z0-9_\-]{8,}\.eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\b/g, "[REDACTED_JWT]");
+    // PEM Private keys
+    out = out.replace(/-----BEGIN [A-Z\s]+ PRIVATE KEY-----[\s\S]*?-----END [A-Z\s]+ PRIVATE KEY-----/g, "[REDACTED_PRIVATE_KEY]");
+    // Query parameters in URLs like ?apiKey=... &token=...
+    out = out.replace(/([?&](?:apiKey|api_key|token|signingKey|signing_key|secret)=)[^&\s]+/gi, "$1[REDACTED]");
+    return out;
+}

package/dist/crypto/index.d.ts

@@ -0,0 +1,5 @@
+export { stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToHex, hexToBytes, timingSafeEqual, timingSafeEqualString, maskSecret, redactSecrets, } from "./encoding.js";
+export { DEFAULT_MAX_BODY_SIZE_BYTES, computeContentDigest, sha256Base64, sha256Base64Url, } from "./digest.js";
+export { calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, } from "./keys.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, } from "./signatures.js";
+export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, } from "./signatures.js";

package/dist/crypto/index.js

@@ -0,0 +1,4 @@
+export { stringToUtf8, utf8ToString, bytesToBase64, base64ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToHex, hexToBytes, timingSafeEqual, timingSafeEqualString, maskSecret, redactSecrets, } from "./encoding.js";
+export { DEFAULT_MAX_BODY_SIZE_BYTES, computeContentDigest, sha256Base64, sha256Base64Url, } from "./digest.js";
+export { calculateJwkThumbprint, generateSigningKey, loadSigningKey, loadPublicKey, } from "./keys.js";
+export { SIGNATURE_VERSION, SIGNATURE_LABEL, SIGNATURE_ALG, MAX_CLOCK_SKEW_SECONDS, formatSignatureParams, createSignatureBase, signRequest, verifyRequestSignature, verifyJwtLease, registerPublicKey, } from "./signatures.js";

package/dist/crypto/keys.d.ts

@@ -0,0 +1,25 @@
+import type { PublicJwk, SigningKey } from "../types.js";
+/**
+ * Calculate the RFC 7638 JWK thumbprint for an Ed25519 public key.
+ */
+export declare function calculateJwkThumbprint(jwk: {
+    crv: string;
+    kty: string;
+    x: string;
+}): Promise<string>;
+/**
+ * Generate a new Ed25519 keypair using WebCrypto.
+ */
+export declare function generateSigningKey(): Promise<SigningKey>;
+/**
+ * Load and import an Ed25519 private key from various string representations
+ * (PKCS#8 Base64 DER, PKCS#8 PEM, Base64url raw seed, or JSON JWK).
+ */
+export declare function loadSigningKey(raw: string | SigningKey): Promise<SigningKey>;
+/**
+ * Load an Ed25519 public key from JWK, PEM, Base64 SPKI, or Base64url raw public key.
+ */
+export declare function loadPublicKey(raw: string | PublicJwk | CryptoKey): Promise<{
+    publicKey: CryptoKey;
+    publicJwk: PublicJwk;
+}>;

package/dist/crypto/keys.js

@@ -0,0 +1,236 @@
+import { base64ToBytes, base64UrlToBytes, bytesToBase64, bytesToBase64Url, } from "./encoding.js";
+import { sha256Base64Url } from "./digest.js";
+// PKCS#8 prefix for Ed25519 private keys (16 bytes)
+// 30 2e 02 01 00 30 05 06 03 2b 65 70 04 22 04 20
+const ED25519_PKCS8_PREFIX = new Uint8Array([
+    0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20,
+]);
+// SPKI prefix for Ed25519 public keys (12 bytes)
+// 30 2a 30 05 06 03 2b 65 70 03 21 00
+const ED25519_SPKI_PREFIX = new Uint8Array([
+    0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+]);
+/**
+ * Calculate the RFC 7638 JWK thumbprint for an Ed25519 public key.
+ */
+export async function calculateJwkThumbprint(jwk) {
+    const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x });
+    return sha256Base64Url(canonical);
+}
+/**
+ * Generate a new Ed25519 keypair using WebCrypto.
+ */
+export async function generateSigningKey() {
+    const keyPair = (await globalThis.crypto.subtle.generateKey("Ed25519", true, [
+        "sign",
+        "verify",
+    ]));
+    const jwk = (await globalThis.crypto.subtle.exportKey("jwk", keyPair.privateKey));
+    const pkcs8Buffer = await globalThis.crypto.subtle.exportKey("pkcs8", keyPair.privateKey);
+    const privateKeyPkcs8Base64 = bytesToBase64(new Uint8Array(pkcs8Buffer));
+    const kid = await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: jwk.x });
+    const publicJwk = {
+        kty: "OKP",
+        crv: "Ed25519",
+        x: jwk.x,
+        kid,
+        use: "sig",
+        alg: "EdDSA",
+    };
+    return {
+        privateKey: keyPair.privateKey,
+        publicKey: keyPair.publicKey,
+        publicJwk,
+        privateKeyPkcs8Base64,
+    };
+}
+/**
+ * Load and import an Ed25519 private key from various string representations
+ * (PKCS#8 Base64 DER, PKCS#8 PEM, Base64url raw seed, or JSON JWK).
+ */
+export async function loadSigningKey(raw) {
+    if (typeof raw !== "string") {
+        return raw;
+    }
+    const trimmed = raw.trim();
+    // If raw string is JSON JWK
+    if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (parsed.kty === "OKP" && parsed.crv === "Ed25519" && parsed.d) {
+                const privateKey = await globalThis.crypto.subtle.importKey("jwk", parsed, "Ed25519", true, ["sign"]);
+                const jwk = (await globalThis.crypto.subtle.exportKey("jwk", privateKey));
+                const kid = parsed.kid || (await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: jwk.x }));
+                const publicJwk = {
+                    kty: "OKP",
+                    crv: "Ed25519",
+                    x: jwk.x,
+                    kid,
+                    use: "sig",
+                    alg: "EdDSA",
+                };
+                const publicKey = await globalThis.crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: jwk.x }, "Ed25519", true, ["verify"]);
+                const pkcs8Buffer = await globalThis.crypto.subtle.exportKey("pkcs8", privateKey);
+                return {
+                    privateKey,
+                    publicKey,
+                    publicJwk,
+                    privateKeyPkcs8Base64: bytesToBase64(new Uint8Array(pkcs8Buffer)),
+                };
+            }
+        }
+        catch {
+            // Continue to binary/PEM parsing
+        }
+    }
+    // Handle PEM or Base64 / Base64url
+    let cleaned = trimmed
+        .replace(/-----BEGIN [A-Z0-9_-]+ PRIVATE KEY-----/gi, "")
+        .replace(/-----END [A-Z0-9_-]+ PRIVATE KEY-----/gi, "")
+        .replace(/\\n/g, "")
+        .replace(/\s+/g, "");
+    let keyBytes;
+    try {
+        keyBytes = cleaned.includes("-") || cleaned.includes("_")
+            ? base64UrlToBytes(cleaned)
+            : base64ToBytes(cleaned);
+    }
+    catch {
+        throw new Error("Invalid base64 encoding in signing key");
+    }
+    // If 32 bytes raw seed, wrap into standard PKCS#8 DER
+    if (keyBytes.length === 32) {
+        const pkcs8 = new Uint8Array(ED25519_PKCS8_PREFIX.length + 32);
+        pkcs8.set(ED25519_PKCS8_PREFIX, 0);
+        pkcs8.set(keyBytes, ED25519_PKCS8_PREFIX.length);
+        keyBytes = pkcs8;
+    }
+    let privateKey;
+    try {
+        privateKey = await globalThis.crypto.subtle.importKey("pkcs8", keyBytes, "Ed25519", true, ["sign"]);
+    }
+    catch (err) {
+        throw new Error(`Failed to import Ed25519 private key: ${err.message}`);
+    }
+    const jwk = (await globalThis.crypto.subtle.exportKey("jwk", privateKey));
+    const kid = await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: jwk.x });
+    const publicJwk = {
+        kty: "OKP",
+        crv: "Ed25519",
+        x: jwk.x,
+        kid,
+        use: "sig",
+        alg: "EdDSA",
+    };
+    const publicKey = await globalThis.crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: jwk.x }, "Ed25519", true, ["verify"]);
+    return {
+        privateKey,
+        publicKey,
+        publicJwk,
+        privateKeyPkcs8Base64: bytesToBase64(keyBytes),
+    };
+}
+/**
+ * Load an Ed25519 public key from JWK, PEM, Base64 SPKI, or Base64url raw public key.
+ */
+export async function loadPublicKey(raw) {
+    if (typeof raw === "object" && "type" in raw && raw.type === "public") {
+        const exported = (await globalThis.crypto.subtle.exportKey("jwk", raw));
+        const kid = exported.kid || (await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: exported.x }));
+        return {
+            publicKey: raw,
+            publicJwk: {
+                kty: "OKP",
+                crv: "Ed25519",
+                x: exported.x,
+                kid,
+                use: "sig",
+                alg: "EdDSA",
+            },
+        };
+    }
+    if (typeof raw === "object" && "kty" in raw && raw.kty === "OKP" && raw.crv === "Ed25519") {
+        const kid = raw.kid || (await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: raw.x }));
+        const publicKey = await globalThis.crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: raw.x }, "Ed25519", true, ["verify"]);
+        return {
+            publicKey,
+            publicJwk: {
+                kty: "OKP",
+                crv: "Ed25519",
+                x: raw.x,
+                kid,
+                use: "sig",
+                alg: "EdDSA",
+            },
+        };
+    }
+    if (typeof raw !== "string") {
+        throw new Error("Invalid public key format");
+    }
+    const trimmed = raw.trim();
+    // Try parsing as JSON JWK or JWKS
+    if (trimmed.startsWith("{")) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            const jwkCandidate = parsed.keys ? parsed.keys[0] : parsed;
+            if (jwkCandidate && jwkCandidate.kty === "OKP" && jwkCandidate.crv === "Ed25519") {
+                return loadPublicKey(jwkCandidate);
+            }
+        }
+        catch {
+            // Continue
+        }
+    }
+    // Handle PEM / Base64 / Base64url
+    let cleaned = trimmed
+        .replace(/-----BEGIN [A-Z0-9_-]+ PUBLIC KEY-----/gi, "")
+        .replace(/-----END [A-Z0-9_-]+ PUBLIC KEY-----/gi, "")
+        .replace(/\\n/g, "")
+        .replace(/\s+/g, "");
+    let keyBytes;
+    try {
+        keyBytes = cleaned.includes("-") || cleaned.includes("_")
+            ? base64UrlToBytes(cleaned)
+            : base64ToBytes(cleaned);
+    }
+    catch {
+        throw new Error("Invalid base64 encoding in public key");
+    }
+    // If 32 bytes raw public key (x coord), import as JWK directly
+    if (keyBytes.length === 32) {
+        const x = bytesToBase64Url(keyBytes);
+        const kid = await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x });
+        const publicKey = await globalThis.crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x }, "Ed25519", true, ["verify"]);
+        return {
+            publicKey,
+            publicJwk: {
+                kty: "OKP",
+                crv: "Ed25519",
+                x,
+                kid,
+                use: "sig",
+                alg: "EdDSA",
+            },
+        };
+    }
+    // Try SPKI format
+    try {
+        const publicKey = await globalThis.crypto.subtle.importKey("spki", keyBytes, "Ed25519", true, ["verify"]);
+        const jwk = (await globalThis.crypto.subtle.exportKey("jwk", publicKey));
+        const kid = await calculateJwkThumbprint({ crv: "Ed25519", kty: "OKP", x: jwk.x });
+        return {
+            publicKey,
+            publicJwk: {
+                kty: "OKP",
+                crv: "Ed25519",
+                x: jwk.x,
+                kid,
+                use: "sig",
+                alg: "EdDSA",
+            },
+        };
+    }
+    catch (err) {
+        throw new Error(`Failed to import public key: ${err.message}`);
+    }
+}

package/dist/crypto/signatures.d.ts

@@ -0,0 +1,83 @@
+import type { PublicJwk, SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult } from "../types.js";
+export declare const SIGNATURE_VERSION = "rfc9421";
+export declare const SIGNATURE_LABEL = "sig1";
+export declare const SIGNATURE_ALG = "ed25519";
+export declare const MAX_CLOCK_SKEW_SECONDS = 300;
+export declare const SAFE_IDENTIFIER_PATTERN: RegExp;
+/**
+ * Normalizes HTTP request path per RFC 3986 to prevent path traversal & signature confusion.
+ */
+export declare function normalizePath(rawPath: string): string;
+/**
+ * Validates that an identifier (keyId, serviceSlug, etc.) contains only safe alphanumeric/hyphen characters.
+ */
+export declare function assertSafeIdentifier(name: string, value: string): void;
+/**
+ * In-memory LRU / sliding cache for nonces / signature replay protection.
+ */
+declare class SignatureReplayCache {
+    private seen;
+    private readonly ttlMs;
+    constructor(ttlSeconds?: number);
+    checkAndRecord(signatureId: string): boolean;
+}
+export declare const globalReplayCache: SignatureReplayCache;
+export type { SignedHeaders, SignRequestParams, VerifySignatureParams, VerifySignatureResult, };
+/**
+ * Format the RFC 9421 Signature-Input parameters string.
+ * Example: `("@method" "@path" "@authority" "content-digest");created=1791561600;keyid="...";alg="ed25519";nonce="..."`
+ */
+export declare function formatSignatureParams(params: {
+    components?: string[];
+    created: number;
+    keyid: string;
+    alg?: string;
+    nonce?: string;
+}): string;
+/**
+ * Construct canonical RFC 9421 signature base string.
+ */
+export declare function createSignatureBase(params: {
+    method: string;
+    path: string;
+    authority: string;
+    contentDigest?: string | null;
+    signatureParams: string;
+    additionalComponents?: Record<string, string>;
+}): string;
+/**
+ * Sign an outgoing HTTP request according to RFC 9421 + RFC 9530.
+ */
+export declare function signRequest(params: SignRequestParams): Promise<SignedHeaders>;
+/**
+ * Verify an incoming RFC 9421 HTTP Message Signature.
+ */
+export declare function verifyRequestSignature(params: VerifySignatureParams): Promise<VerifySignatureResult>;
+/**
+ * Zero-egress offline verification for asymmetric JWT token leases.
+ */
+export declare function verifyJwtLease(params: {
+    token: string;
+    publicKey: string | PublicJwk | CryptoKey;
+    expectedServiceSlug?: string;
+    currentTime?: number;
+}): Promise<{
+    valid: boolean;
+    payload?: Record<string, unknown>;
+    error?: string;
+}>;
+/**
+ * Register public key directly with Daywalker Auth via POST /api/v1/keys/register (Push Architecture).
+ */
+export declare function registerPublicKey(params: {
+    authUrl?: string;
+    apiKey: string;
+    serviceSlug?: string;
+    domain?: string | null;
+    publicJwk: PublicJwk;
+    fetchFn?: typeof fetch;
+}): Promise<{
+    ok: boolean;
+    status: number;
+    error?: string;
+}>;