@tinycloud/sdk-core 3.1.0-beta.9 → 3.1.0

package/dist/policy/index.cjs

@@ -95,6 +95,7 @@ __export(policy_exports, {
   normalizeUnifiedPolicyCapability: () => normalizeUnifiedPolicyCapability,
   parseCompactUcanAuthorization: () => parseCompactUcanAuthorization,
   parsePolicySessionUcan: () => parsePolicySessionUcan,
+  parseSignedCompactUcanAttenuation: () => parseSignedCompactUcanAttenuation,
   policyCapabilityContains: () => policyCapabilityContains,
   policyCapabilityDigestHex: () => policyCapabilityDigestHex,
   policyCidFromCanonicalBytes: () => policyCidFromCanonicalBytes,
@@ -4107,6 +4108,32 @@ function parseCompactUcanAuthorization(input, expectedCid) {
     throw new Error("compact UCAN CID does not match exact Authorization bytes");
   return { authorization: input, cid, header, payload };
 }
+var SignedCompactAttenuationSchema = import_zod.z.record(import_zod.z.record(import_zod.z.array(import_zod.z.unknown()).min(1)));
+function parseSignedCompactUcanAttenuation(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(headerSegment)));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(payloadSegment)));
+  if (!isRecordValue(headerValue) || !isRecordValue(headerValue.jwk) || headerValue.alg !== "EdDSA" || headerValue.typ !== "JWT" || headerValue.ucv !== "0.10.0" || headerValue.jwk.kty !== "OKP" || headerValue.jwk.crv !== "Ed25519" || !isRecordValue(payloadValue) || typeof payloadValue.iss !== "string")
+    throw new Error("Authorization has an invalid signed UCAN header or issuer");
+  const att = SignedCompactAttenuationSchema.parse(payloadValue.att);
+  const principal = payloadValue.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  const publicKey = didMaterial.length === 34 && didMaterial[0] === 237 && didMaterial[1] === 1 ? didMaterial.slice(2) : new Uint8Array();
+  const jwkKey = typeof headerValue.jwk.x === "string" ? decodeBase64Url(headerValue.jwk.x) : new Uint8Array();
+  if (publicKey.length !== 32 || !equalBytes(publicKey, jwkKey))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  const signature = decodeBase64Url(signatureSegment);
+  if (!import_ed255192.ed25519.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  const cid = CID.createV1(85, create(30, (0, import_blake3.blake3)(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid !== expectedCid) throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { cid, payload: { att } };
+}
 function parsePolicySessionUcan(authorization, expectedProofs) {
   const parsed = parseCompactUcanAuthorization(authorization);
   const fact = parsed.payload.fct[0];