@sphereon/ssi-sdk-ext.key-utils 0.34.1-feature.SSISDK.26.RP.58 → 0.34.1-feature.SSISDK.44.finish.dcql.309

package/dist/index.js

@@ -4,7 +4,7 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 // src/functions.ts
 import { randomBytes } from "@ethersproject/random";
 import { bls12_381 } from "@noble/curves/bls12-381";
-import { ed25519 } from "@noble/curves/ed25519";
+import { ed25519, x25519 } from "@noble/curves/ed25519";
 import { p256 } from "@noble/curves/p256";
 import { p384 } from "@noble/curves/p384";
 import { p521 } from "@noble/curves/p521";
@@ -193,17 +193,17 @@ __name(jcsCanonicalize, "jcsCanonicalize");
 // src/types/key-util-types.ts
 var JWK_JCS_PUB_NAME = "jwk_jcs-pub";
 var JWK_JCS_PUB_PREFIX = 60241;
-var Key = /* @__PURE__ */ function(Key2) {
+var Key = /* @__PURE__ */ (function(Key2) {
   Key2["Ed25519"] = "Ed25519";
   Key2["Secp256k1"] = "Secp256k1";
   Key2["Secp256r1"] = "Secp256r1";
   return Key2;
-}({});
-var JwkKeyUse = /* @__PURE__ */ function(JwkKeyUse2) {
+})({});
+var JwkKeyUse = /* @__PURE__ */ (function(JwkKeyUse2) {
   JwkKeyUse2["Encryption"] = "enc";
   JwkKeyUse2["Signature"] = "sig";
   return JwkKeyUse2;
-}({});
+})({});
 var SIG_KEY_ALGS = [
   "ES256",
   "ES384",
@@ -296,14 +296,19 @@ var keyMetaAlgorithmsFromKeyType = /* @__PURE__ */ __name((type) => {
 async function importProvidedOrGeneratedKey(args, context) {
   const type = args.options?.type ?? args.options?.key?.type ?? args.options?.keyType ?? "Secp256r1";
   const key = args?.options?.key;
-  if (args.options?.x509 && key) {
+  if (key) {
     key.meta = {
-      ...key.meta,
-      x509: {
-        ...args.options.x509,
-        ...key.meta?.x509
-      }
+      providerName: args.providerName
     };
+    if (args.options?.x509) {
+      key.meta = {
+        ...key.meta,
+        x509: {
+          ...args.options.x509,
+          ...key.meta?.x509
+        }
+      };
+    }
   }
   if (args.options && args.options?.use === JwkKeyUse.Encryption && !ENC_KEY_ALGS.includes(type)) {
     throw new Error(`${type} keys are not valid for encryption`);
@@ -550,6 +555,15 @@ function octJwkToRawHexKey(jwk) {
   return toString2(key, "hex");
 }
 __name(octJwkToRawHexKey, "octJwkToRawHexKey");
+function x25519PublicHexFromPrivateHex(privateKeyHex) {
+  if (!/^[0-9a-fA-F]{64}$/.test(privateKeyHex)) {
+    throw new Error("Private key must be 32-byte hex (64 chars)");
+  }
+  const priv = Uint8Array.from(Buffer.from(privateKeyHex, "hex"));
+  const pub = x25519.getPublicKey(priv);
+  return Buffer.from(pub).toString("hex");
+}
+__name(x25519PublicHexFromPrivateHex, "x25519PublicHexFromPrivateHex");
 var jwkDetermineUse = /* @__PURE__ */ __name((type, suppliedUse) => {
   return suppliedUse ? suppliedUse : SIG_KEY_ALGS.includes(type) ? JwkKeyUse.Signature : ENC_KEY_ALGS.includes(type) ? JwkKeyUse.Encryption : void 0;
 }, "jwkDetermineUse");
@@ -586,8 +600,8 @@ var toSecp256k1Jwk = /* @__PURE__ */ __name((keyHex, opts) => {
     },
     kty: JwkKeyType.EC,
     crv: JoseCurve.secp256k1,
-    x: hexToBase64(pubPoint.getX().toString("hex"), "base64url"),
-    y: hexToBase64(pubPoint.getY().toString("hex"), "base64url"),
+    x: hexToBase64(pubPoint.getX().toString("hex").padStart(64, "0"), "base64url"),
+    y: hexToBase64(pubPoint.getY().toString("hex").padStart(64, "0"), "base64url"),
     ...opts?.isPrivateKey && {
       d: hexToBase64(keyPair.getPrivate("hex"), "base64url")
     }
@@ -618,8 +632,8 @@ var toSecp256r1Jwk = /* @__PURE__ */ __name((keyHex, opts) => {
     },
     kty: JwkKeyType.EC,
     crv: JoseCurve.P_256,
-    x: hexToBase64(pubPoint.getX().toString("hex"), "base64url"),
-    y: hexToBase64(pubPoint.getY().toString("hex"), "base64url"),
+    x: hexToBase64(pubPoint.getX().toString("hex").padStart(64, "0"), "base64url"),
+    y: hexToBase64(pubPoint.getY().toString("hex").padStart(64, "0"), "base64url"),
     ...opts?.isPrivateKey && {
       d: hexToBase64(keyPair.getPrivate("hex"), "base64url")
     }
@@ -1020,7 +1034,7 @@ async function verifyRawSignature({ data, signature, key: inputKey, opts }) {
         return bls12_381.verify(signature, data, fromString2(publicKeyHex, "hex"));
       case "RSA": {
         const signatureAlgorithm = opts?.signatureAlg ?? jwk.alg ?? JoseSignatureAlgorithm.PS256;
-        const hashAlg = signatureAlgorithm === (JoseSignatureAlgorithm.RS512 || JoseSignatureAlgorithm.PS512) ? sha5122 : signatureAlgorithm === (JoseSignatureAlgorithm.RS384 || JoseSignatureAlgorithm.PS384) ? sha3842 : sha2562;
+        const hashAlg = signatureAlgorithm === JoseSignatureAlgorithm.RS512 || signatureAlgorithm === JoseSignatureAlgorithm.PS512 ? sha5122 : signatureAlgorithm === JoseSignatureAlgorithm.RS384 || signatureAlgorithm === JoseSignatureAlgorithm.PS384 ? sha3842 : sha2562;
         switch (signatureAlgorithm) {
           case JoseSignatureAlgorithm.RS256:
             return rsa.PKCS1_SHA256.verify({
@@ -1229,27 +1243,38 @@ function coseToJoseSignatureAlg(coseAlg) {
 __name(coseToJoseSignatureAlg, "coseToJoseSignatureAlg");
 function joseToCoseSignatureAlg(joseAlg) {
   switch (joseAlg) {
-    case (JoseSignatureAlgorithm2.ES256K, "ES256K"):
+    case JoseSignatureAlgorithm2.ES256K:
+    case "ES256K":
       return ICoseSignatureAlgorithm.ES256K;
-    case (JoseSignatureAlgorithm2.ES256, "ES256"):
+    case JoseSignatureAlgorithm2.ES256:
+    case "ES256":
       return ICoseSignatureAlgorithm.ES256;
-    case (JoseSignatureAlgorithm2.ES384, "ES384"):
+    case JoseSignatureAlgorithm2.ES384:
+    case "ES384":
       return ICoseSignatureAlgorithm.ES384;
-    case (JoseSignatureAlgorithm2.ES512, "ES512"):
+    case JoseSignatureAlgorithm2.ES512:
+    case "ES512":
       return ICoseSignatureAlgorithm.ES512;
-    case (JoseSignatureAlgorithm2.PS256, "PS256"):
+    case JoseSignatureAlgorithm2.PS256:
+    case "PS256":
       return ICoseSignatureAlgorithm.PS256;
-    case (JoseSignatureAlgorithm2.PS384, "PS384"):
+    case JoseSignatureAlgorithm2.PS384:
+    case "PS384":
       return ICoseSignatureAlgorithm.PS384;
-    case (JoseSignatureAlgorithm2.PS512, "PS512"):
+    case JoseSignatureAlgorithm2.PS512:
+    case "PS512":
       return ICoseSignatureAlgorithm.PS512;
-    case (JoseSignatureAlgorithm2.HS256, "HS256"):
+    case JoseSignatureAlgorithm2.HS256:
+    case "HS256":
       return ICoseSignatureAlgorithm.HS256;
-    case (JoseSignatureAlgorithm2.HS384, "HS384"):
+    case JoseSignatureAlgorithm2.HS384:
+    case "HS384":
       return ICoseSignatureAlgorithm.HS384;
-    case (JoseSignatureAlgorithm2.HS512, "HS512"):
+    case JoseSignatureAlgorithm2.HS512:
+    case "HS512":
       return ICoseSignatureAlgorithm.HS512;
-    case (JoseSignatureAlgorithm2.EdDSA, "EdDSA"):
+    case JoseSignatureAlgorithm2.EdDSA:
+    case "EdDSA":
       return ICoseSignatureAlgorithm.EdDSA;
     default:
       throw Error(`Signature algorithm ${joseAlg} not supported in Cose`);
@@ -1258,21 +1283,29 @@ function joseToCoseSignatureAlg(joseAlg) {
 __name(joseToCoseSignatureAlg, "joseToCoseSignatureAlg");
 function joseToCoseKeyOperation(keyOp) {
   switch (keyOp) {
-    case (JoseKeyOperation.SIGN, "sign"):
+    case JoseKeyOperation.SIGN:
+    case "sign":
       return ICoseKeyOperation.SIGN;
-    case (JoseKeyOperation.VERIFY, "verify"):
+    case JoseKeyOperation.VERIFY:
+    case "verify":
       return ICoseKeyOperation.VERIFY;
-    case (JoseKeyOperation.ENCRYPT, "encrypt"):
+    case JoseKeyOperation.ENCRYPT:
+    case "encrypt":
       return ICoseKeyOperation.ENCRYPT;
-    case (JoseKeyOperation.DECRYPT, "decrypt"):
+    case JoseKeyOperation.DECRYPT:
+    case "decrypt":
       return ICoseKeyOperation.DECRYPT;
-    case (JoseKeyOperation.WRAP_KEY, "wrapKey"):
+    case JoseKeyOperation.WRAP_KEY:
+    case "wrapKey":
       return ICoseKeyOperation.WRAP_KEY;
-    case (JoseKeyOperation.UNWRAP_KEY, "unwrapKey"):
+    case JoseKeyOperation.UNWRAP_KEY:
+    case "unwrapKey":
       return ICoseKeyOperation.UNWRAP_KEY;
-    case (JoseKeyOperation.DERIVE_KEY, "deriveKey"):
+    case JoseKeyOperation.DERIVE_KEY:
+    case "deriveKey":
       return ICoseKeyOperation.DERIVE_KEY;
-    case (JoseKeyOperation.DERIVE_BITS, "deriveBits"):
+    case JoseKeyOperation.DERIVE_BITS:
+    case "deriveBits":
       return ICoseKeyOperation.DERIVE_BITS;
     default:
       throw Error(`Key operation ${keyOp} not supported in Cose`);
@@ -1398,6 +1431,7 @@ export {
   toPkcs1FromHex,
   toRawCompressedHexPublicKey,
   validateJwk,
-  verifyRawSignature
+  verifyRawSignature,
+  x25519PublicHexFromPrivateHex
 };
 //# sourceMappingURL=index.js.map