@waku/discovery 0.0.6-535a20f.0 → 0.0.6-98208d5.0

package/bundle/index.js

@@ -19,21 +19,35 @@
  */
 const peerDiscoverySymbol = Symbol.for('@libp2p/peer-discovery');
 
-const peerIdSymbol = Symbol.for('@libp2p/peer-id');
+/**
+ * All PeerId implementations must use this symbol as the name of a property
+ * with a boolean `true` value
+ */
+const peerIdSymbol$1 = Symbol.for('@libp2p/peer-id');
 
 /**
  * When this error is thrown it means an operation was aborted,
  * usually in response to the `abort` event being emitted by an
  * AbortSignal.
  */
-class CodeError extends Error {
-    code;
-    props;
-    constructor(message, code, props) {
+/**
+ * Thrown when invalid parameters are passed to a function or method call
+ */
+let InvalidParametersError$1 = class InvalidParametersError extends Error {
+    static name = 'InvalidParametersError';
+    constructor(message = 'Invalid parameters') {
         super(message);
-        this.code = code;
-        this.name = props?.name ?? 'CodeError';
-        this.props = props ?? {}; // eslint-disable-line @typescript-eslint/consistent-type-assertions
+        this.name = 'InvalidParametersError';
+    }
+};
+/**
+ * Thrown when an invalid multihash is encountered
+ */
+class InvalidMultihashError extends Error {
+    static name = 'InvalidMultihashError';
+    constructor(message = 'Invalid Multihash') {
+        super(message);
+        this.name = 'InvalidMultihashError';
     }
 }
 
@@ -104,7 +118,6 @@ class TypedEventEmitter extends EventTarget {
         return this.dispatchEvent(new CustomEvent(type, detail));
     }
 }
-const CustomEvent = globalThis.CustomEvent;
 
 var Protocols;
 (function (Protocols) {
@@ -282,23 +295,6 @@ const createView = (arr) => new DataView(arr.buffer, arr.byteOffset, arr.byteLen
 // The rotate right (circular right shift) operation for uint32
 const rotr = (word, shift) => (word << (32 - shift)) | (word >>> shift);
 new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44;
-// There is no setImmediate in browser and setTimeout is slow.
-// call of async fn will return Promise, which will be fullfiled only on
-// next scheduler queue processing step and this is exactly what we need.
-const nextTick = async () => { };
-// Returns control to thread each 'tick' ms to avoid blocking
-async function asyncLoop(iters, tick, cb) {
-    let ts = Date.now();
-    for (let i = 0; i < iters; i++) {
-        cb(i);
-        // Date.now() is not monotonic, so in case if clock goes backwards we return return control too
-        const diff = Date.now() - ts;
-        if (diff >= 0 && diff < tick)
-            continue;
-        await nextTick();
-        ts += diff;
-    }
-}
 /**
  * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])
  */
@@ -343,13 +339,6 @@ class Hash {
         return this._cloneInto();
     }
 }
-const toStr = {}.toString;
-function checkOpts(defaults, opts) {
-    if (opts !== undefined && toStr.call(opts) !== '[object Object]')
-        throw new Error('Options should be object or undefined');
-    const merged = Object.assign(defaults, opts);
-    return merged;
-}
 function wrapConstructor(hashCons) {
     const hashC = (msg) => hashCons().update(toBytes$1(msg)).digest();
     const tmp = hashCons();
@@ -361,7 +350,7 @@ function wrapConstructor(hashCons) {
 /**
  * Secure PRNG. Uses `crypto.getRandomValues`, which defers to OS.
  */
-function randomBytes$1(bytesLength = 32) {
+function randomBytes(bytesLength = 32) {
     if (crypto$2 && typeof crypto$2.getRandomValues === 'function') {
         return crypto$2.getRandomValues(new Uint8Array(bytesLength));
     }
@@ -1342,7 +1331,7 @@ function encodingLength$3(int) {
 /**
  * Creates a multihash digest.
  */
-function create$1(code, digest) {
+function create(code, digest) {
     const size = digest.byteLength;
     const sizeOffset = encodingLength$3(code);
     const digestOffset = sizeOffset + encodingLength$3(size);
@@ -1401,7 +1390,7 @@ const code = 0x0;
 const name$1 = 'identity';
 const encode$6 = coerce;
 function digest(input) {
-    return create$1(code, encode$6(input));
+    return create(code, encode$6(input));
 }
 const identity = { code, name: name$1, encode: encode$6, digest };
 
@@ -1425,9 +1414,9 @@ class Hasher {
         if (input instanceof Uint8Array) {
             const result = this.encode(input);
             return result instanceof Uint8Array
-                ? create$1(this.code, result)
+                ? create(this.code, result)
                 /* c8 ignore next 1 */
-                : result.then(digest => create$1(this.code, digest));
+                : result.then(digest => create(this.code, digest));
         }
         else {
             throw Error('Unknown type, must be binary type');
@@ -1527,7 +1516,7 @@ class CID {
         switch (this.version) {
             case 0: {
                 const { code, digest } = this.multihash;
-                const multihash = create$1(code, digest);
+                const multihash = create(code, digest);
                 return (CID.createV1(this.code, multihash));
             }
             case 1: {
@@ -2723,7 +2712,6 @@ var debug = /*@__PURE__*/getDefaultExportFromCjs(browserExports);
 
 const APP_NAME = "waku";
 let Logger$1 = class Logger {
-    _debug;
     _info;
     _warn;
     _error;
@@ -2731,14 +2719,10 @@ let Logger$1 = class Logger {
         return prefix ? `${APP_NAME}:${level}:${prefix}` : `${APP_NAME}:${level}`;
     }
     constructor(prefix) {
-        this._debug = debug(Logger.createDebugNamespace("debug", prefix));
         this._info = debug(Logger.createDebugNamespace("info", prefix));
         this._warn = debug(Logger.createDebugNamespace("warn", prefix));
         this._error = debug(Logger.createDebugNamespace("error", prefix));
     }
-    get debug() {
-        return this._debug;
-    }
     get info() {
         return this._info;
     }
@@ -5548,7 +5532,7 @@ function ParseError(str) {
  * const ma = multiaddr('/ip4/127.0.0.1/tcp/1234')
  * ```
  */
-const inspect$1 = Symbol.for('nodejs.util.inspect.custom');
+const inspect$2 = Symbol.for('nodejs.util.inspect.custom');
 const symbol$1 = Symbol.for('@multiformats/js-multiaddr/multiaddr');
 const DNS_CODES = [
     getProtocol('dns').code,
@@ -5772,7 +5756,7 @@ class Multiaddr {
      * // 'Multiaddr(/ip4/127.0.0.1/tcp/4001)'
      * ```
      */
-    [inspect$1]() {
+    [inspect$2]() {
         return `Multiaddr(${this.#string})`;
     }
 }
@@ -5945,14 +5929,41 @@ function locationMultiaddrFromEnrFields(enr, protocol) {
     return multiaddrFromFields(isIpv6 ? "ip6" : "ip4", protoName, ipVal, protoVal);
 }
 
-function isPromise$1(thing) {
-    if (thing == null) {
-        return false;
+/**
+ * When this error is thrown it means an operation was aborted,
+ * usually in response to the `abort` event being emitted by an
+ * AbortSignal.
+ */
+/**
+ * Thrown when invalid parameters are passed to a function or method call
+ */
+class InvalidParametersError extends Error {
+    static name = 'InvalidParametersError';
+    constructor(message = 'Invalid parameters') {
+        super(message);
+        this.name = 'InvalidParametersError';
+    }
+}
+/**
+ * Thrown when a public key is invalid
+ */
+class InvalidPublicKeyError extends Error {
+    static name = 'InvalidPublicKeyError';
+    constructor(message = 'Invalid public key') {
+        super(message);
+        this.name = 'InvalidPublicKeyError';
     }
-    return typeof thing.then === 'function' &&
-        typeof thing.catch === 'function' &&
-        typeof thing.finally === 'function';
 }
+/**
+ * Thrown when and attempt to operate on an unsupported key was made
+ */
+let UnsupportedKeyTypeError$1 = class UnsupportedKeyTypeError extends Error {
+    static name = 'UnsupportedKeyTypeError';
+    constructor(message = 'Unsupported key type') {
+        super(message);
+        this.name = 'UnsupportedKeyTypeError';
+    }
+};
 
 const U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
 const _32n = /* @__PURE__ */ BigInt(32);
@@ -7625,7 +7636,7 @@ const ed25519Defaults = /* @__PURE__ */ (() => ({
     Gx: BigInt('15112221349535400772501151409588531511454012693041857206046113283949847762202'),
     Gy: BigInt('46316835694926478169428394003475163141307993866256225615783033603165251855960'),
     hash: sha512,
-    randomBytes: randomBytes$1,
+    randomBytes,
     adjustScalarBytes,
     // dom2
     // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
@@ -7638,176 +7649,46 @@ const ed25519Defaults = /* @__PURE__ */ (() => ({
 const ed25519 = /* @__PURE__ */ (() => twistedEdwards(ed25519Defaults))();
 
 const PUBLIC_KEY_BYTE_LENGTH = 32;
-const PRIVATE_KEY_BYTE_LENGTH = 64; // private key is actually 32 bytes but for historical reasons we concat private and public keys
-const KEYS_BYTE_LENGTH = 32;
-function generateKey$2() {
-    // the actual private key (32 bytes)
-    const privateKeyRaw = ed25519.utils.randomPrivateKey();
-    const publicKey = ed25519.getPublicKey(privateKeyRaw);
-    // concatenated the public key to the private key
-    const privateKey = concatKeys(privateKeyRaw, publicKey);
-    return {
-        privateKey,
-        publicKey
-    };
-}
-/**
- * Generate keypair from a 32 byte uint8array
- */
-function generateKeyFromSeed(seed) {
-    if (seed.length !== KEYS_BYTE_LENGTH) {
-        throw new TypeError('"seed" must be 32 bytes in length.');
-    }
-    else if (!(seed instanceof Uint8Array)) {
-        throw new TypeError('"seed" must be a node.js Buffer, or Uint8Array.');
-    }
-    // based on node forges algorithm, the seed is used directly as private key
-    const privateKeyRaw = seed;
-    const publicKey = ed25519.getPublicKey(privateKeyRaw);
-    const privateKey = concatKeys(privateKeyRaw, publicKey);
-    return {
-        privateKey,
-        publicKey
-    };
-}
-function hashAndSign$2(privateKey, msg) {
-    const privateKeyRaw = privateKey.subarray(0, KEYS_BYTE_LENGTH);
-    return ed25519.sign(msg instanceof Uint8Array ? msg : msg.subarray(), privateKeyRaw);
-}
 function hashAndVerify$2(publicKey, sig, msg) {
     return ed25519.verify(sig, msg instanceof Uint8Array ? msg : msg.subarray(), publicKey);
 }
-function concatKeys(privateKeyRaw, publicKey) {
-    const privateKey = new Uint8Array(PRIVATE_KEY_BYTE_LENGTH);
-    for (let i = 0; i < KEYS_BYTE_LENGTH; i++) {
-        privateKey[i] = privateKeyRaw[i];
-        privateKey[KEYS_BYTE_LENGTH + i] = publicKey[i];
-    }
-    return privateKey;
-}
 
-/* eslint-env browser */
-// Check native crypto exists and is enabled (In insecure context `self.crypto`
-// exists but `self.crypto.subtle` does not).
-var webcrypto = {
-    get(win = globalThis) {
-        const nativeCrypto = win.crypto;
-        if (nativeCrypto?.subtle == null) {
-            throw Object.assign(new Error('Missing Web Crypto API. ' +
-                'The most likely cause of this error is that this page is being accessed ' +
-                'from an insecure context (i.e. not HTTPS). For more information and ' +
-                'possible resolutions see ' +
-                'https://github.com/libp2p/js-libp2p/blob/main/packages/crypto/README.md#web-crypto-api'), { code: 'ERR_MISSING_WEB_CRYPTO' });
-        }
-        return nativeCrypto;
+class Ed25519PublicKey {
+    type = 'Ed25519';
+    raw;
+    constructor(key) {
+        this.raw = ensureEd25519Key(key, PUBLIC_KEY_BYTE_LENGTH);
     }
-};
-
-// WebKit on Linux does not support deriving a key from an empty PBKDF2 key.
-// So, as a workaround, we provide the generated key as a constant. We test that
-// this generated key is accurate in test/workaround.spec.ts
-// Generated via:
-// await crypto.subtle.exportKey('jwk',
-//   await crypto.subtle.deriveKey(
-//     { name: 'PBKDF2', salt: new Uint8Array(16), iterations: 32767, hash: { name: 'SHA-256' } },
-//     await crypto.subtle.importKey('raw', new Uint8Array(0), { name: 'PBKDF2' }, false, ['deriveKey']),
-//     { name: 'AES-GCM', length: 128 }, true, ['encrypt', 'decrypt'])
-// )
-const derivedEmptyPasswordKey = { alg: 'A128GCM', ext: true, k: 'scm9jmO_4BJAgdwWGVulLg', key_ops: ['encrypt', 'decrypt'], kty: 'oct' };
-// Based off of code from https://github.com/luke-park/SecureCompatibleEncryptionExamples
-function create(opts) {
-    const algorithm = 'AES-GCM';
-    let keyLength = 16;
-    const nonceLength = 12;
-    const digest = 'SHA-256';
-    const saltLength = 16;
-    const iterations = 32767;
-    const crypto = webcrypto.get();
-    keyLength *= 8; // Browser crypto uses bits instead of bytes
-    /**
-     * Uses the provided password to derive a pbkdf2 key. The key
-     * will then be used to encrypt the data.
-     */
-    async function encrypt(data, password) {
-        const salt = crypto.getRandomValues(new Uint8Array(saltLength));
-        const nonce = crypto.getRandomValues(new Uint8Array(nonceLength));
-        const aesGcm = { name: algorithm, iv: nonce };
-        if (typeof password === 'string') {
-            password = fromString(password);
-        }
-        let cryptoKey;
-        if (password.length === 0) {
-            cryptoKey = await crypto.subtle.importKey('jwk', derivedEmptyPasswordKey, { name: 'AES-GCM' }, true, ['encrypt']);
-            try {
-                const deriveParams = { name: 'PBKDF2', salt, iterations, hash: { name: digest } };
-                const runtimeDerivedEmptyPassword = await crypto.subtle.importKey('raw', password, { name: 'PBKDF2' }, false, ['deriveKey']);
-                cryptoKey = await crypto.subtle.deriveKey(deriveParams, runtimeDerivedEmptyPassword, { name: algorithm, length: keyLength }, true, ['encrypt']);
-            }
-            catch {
-                cryptoKey = await crypto.subtle.importKey('jwk', derivedEmptyPasswordKey, { name: 'AES-GCM' }, true, ['encrypt']);
-            }
-        }
-        else {
-            // Derive a key using PBKDF2.
-            const deriveParams = { name: 'PBKDF2', salt, iterations, hash: { name: digest } };
-            const rawKey = await crypto.subtle.importKey('raw', password, { name: 'PBKDF2' }, false, ['deriveKey']);
-            cryptoKey = await crypto.subtle.deriveKey(deriveParams, rawKey, { name: algorithm, length: keyLength }, true, ['encrypt']);
-        }
-        // Encrypt the string.
-        const ciphertext = await crypto.subtle.encrypt(aesGcm, cryptoKey, data);
-        return concat$1([salt, aesGcm.iv, new Uint8Array(ciphertext)]);
+    toMultihash() {
+        return identity.digest(publicKeyToProtobuf(this));
     }
-    /**
-     * Uses the provided password to derive a pbkdf2 key. The key
-     * will then be used to decrypt the data. The options used to create
-     * this decryption cipher must be the same as those used to create
-     * the encryption cipher.
-     */
-    async function decrypt(data, password) {
-        const salt = data.subarray(0, saltLength);
-        const nonce = data.subarray(saltLength, saltLength + nonceLength);
-        const ciphertext = data.subarray(saltLength + nonceLength);
-        const aesGcm = { name: algorithm, iv: nonce };
-        if (typeof password === 'string') {
-            password = fromString(password);
-        }
-        let cryptoKey;
-        if (password.length === 0) {
-            try {
-                const deriveParams = { name: 'PBKDF2', salt, iterations, hash: { name: digest } };
-                const runtimeDerivedEmptyPassword = await crypto.subtle.importKey('raw', password, { name: 'PBKDF2' }, false, ['deriveKey']);
-                cryptoKey = await crypto.subtle.deriveKey(deriveParams, runtimeDerivedEmptyPassword, { name: algorithm, length: keyLength }, true, ['decrypt']);
-            }
-            catch {
-                cryptoKey = await crypto.subtle.importKey('jwk', derivedEmptyPasswordKey, { name: 'AES-GCM' }, true, ['decrypt']);
-            }
+    toCID() {
+        return CID.createV1(114, this.toMultihash());
+    }
+    toString() {
+        return base58btc.encode(this.toMultihash().bytes).substring(1);
+    }
+    equals(key) {
+        if (key == null || !(key.raw instanceof Uint8Array)) {
+            return false;
         }
-        else {
-            // Derive the key using PBKDF2.
-            const deriveParams = { name: 'PBKDF2', salt, iterations, hash: { name: digest } };
-            const rawKey = await crypto.subtle.importKey('raw', password, { name: 'PBKDF2' }, false, ['deriveKey']);
-            cryptoKey = await crypto.subtle.deriveKey(deriveParams, rawKey, { name: algorithm, length: keyLength }, true, ['decrypt']);
-        }
-        // Decrypt the string.
-        const plaintext = await crypto.subtle.decrypt(aesGcm, cryptoKey, ciphertext);
-        return new Uint8Array(plaintext);
-    }
-    const cipher = {
-        encrypt,
-        decrypt
-    };
-    return cipher;
+        return equals(this.raw, key.raw);
+    }
+    verify(data, sig) {
+        return hashAndVerify$2(this.raw, sig, data);
+    }
 }
 
-/**
- * Exports the given PrivateKey as a base64 encoded string.
- * The PrivateKey is encrypted via a password derived PBKDF2 key
- * leveraging the aes-gcm cipher algorithm.
- */
-async function exporter(privateKey, password) {
-    const cipher = create();
-    const encryptedKey = await cipher.encrypt(privateKey, password);
-    return base64.encode(encryptedKey);
+function unmarshalEd25519PublicKey(bytes) {
+    bytes = ensureEd25519Key(bytes, PUBLIC_KEY_BYTE_LENGTH);
+    return new Ed25519PublicKey(bytes);
+}
+function ensureEd25519Key(key, length) {
+    key = Uint8Array.from(key ?? []);
+    if (key.length !== length) {
+        throw new InvalidParametersError(`Key must be a Uint8Array of length ${length}, got ${key.length}`);
+    }
+    return key;
 }
 
 const f32 = new Float32Array([-0]);
@@ -9040,13 +8921,13 @@ var KeyType;
 (function (KeyType) {
     KeyType["RSA"] = "RSA";
     KeyType["Ed25519"] = "Ed25519";
-    KeyType["Secp256k1"] = "Secp256k1";
+    KeyType["secp256k1"] = "secp256k1";
 })(KeyType || (KeyType = {}));
 var __KeyTypeValues;
 (function (__KeyTypeValues) {
     __KeyTypeValues[__KeyTypeValues["RSA"] = 0] = "RSA";
     __KeyTypeValues[__KeyTypeValues["Ed25519"] = 1] = "Ed25519";
-    __KeyTypeValues[__KeyTypeValues["Secp256k1"] = 2] = "Secp256k1";
+    __KeyTypeValues[__KeyTypeValues["secp256k1"] = 2] = "secp256k1";
 })(__KeyTypeValues || (__KeyTypeValues = {}));
 (function (KeyType) {
     KeyType.codec = () => {
@@ -9073,21 +8954,24 @@ var PublicKey;
                 if (opts.lengthDelimited !== false) {
                     w.ldelim();
                 }
-            }, (reader, length) => {
+            }, (reader, length, opts = {}) => {
                 const obj = {};
                 const end = length == null ? reader.len : reader.pos + length;
                 while (reader.pos < end) {
                     const tag = reader.uint32();
                     switch (tag >>> 3) {
-                        case 1:
+                        case 1: {
                             obj.Type = KeyType.codec().decode(reader);
                             break;
-                        case 2:
+                        }
+                        case 2: {
                             obj.Data = reader.bytes();
                             break;
-                        default:
+                        }
+                        default: {
                             reader.skipType(tag & 7);
                             break;
+                        }
                     }
                 }
                 return obj;
@@ -9098,8 +8982,8 @@ var PublicKey;
     PublicKey.encode = (obj) => {
         return encodeMessage(obj, PublicKey.codec());
     };
-    PublicKey.decode = (buf) => {
-        return decodeMessage(buf, PublicKey.codec());
+    PublicKey.decode = (buf, opts) => {
+        return decodeMessage(buf, PublicKey.codec(), opts);
     };
 })(PublicKey || (PublicKey = {}));
 var PrivateKey;
@@ -9122,21 +9006,24 @@ var PrivateKey;
                 if (opts.lengthDelimited !== false) {
                     w.ldelim();
                 }
-            }, (reader, length) => {
+            }, (reader, length, opts = {}) => {
                 const obj = {};
                 const end = length == null ? reader.len : reader.pos + length;
                 while (reader.pos < end) {
                     const tag = reader.uint32();
                     switch (tag >>> 3) {
-                        case 1:
+                        case 1: {
                             obj.Type = KeyType.codec().decode(reader);
                             break;
-                        case 2:
+                        }
+                        case 2: {
                             obj.Data = reader.bytes();
                             break;
-                        default:
+                        }
+                        default: {
                             reader.skipType(tag & 7);
                             break;
+                        }
                     }
                 }
                 return obj;
@@ -9147,397 +9034,122 @@ var PrivateKey;
     PrivateKey.encode = (obj) => {
         return encodeMessage(obj, PrivateKey.codec());
     };
-    PrivateKey.decode = (buf) => {
-        return decodeMessage(buf, PrivateKey.codec());
+    PrivateKey.decode = (buf, opts) => {
+        return decodeMessage(buf, PrivateKey.codec(), opts);
     };
 })(PrivateKey || (PrivateKey = {}));
 
-class Ed25519PublicKey {
-    _key;
-    constructor(key) {
-        this._key = ensureKey(key, PUBLIC_KEY_BYTE_LENGTH);
-    }
-    verify(data, sig) {
-        return hashAndVerify$2(this._key, sig, data);
-    }
-    marshal() {
-        return this._key;
-    }
-    get bytes() {
-        return PublicKey.encode({
-            Type: KeyType.Ed25519,
-            Data: this.marshal()
-        }).subarray();
-    }
-    equals(key) {
-        return equals(this.bytes, key.bytes);
+/*!
+ * MIT License
+ * 
+ * Copyright (c) 2017-2022 Peculiar Ventures, LLC
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ * 
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ * 
+ */
+
+const ARRAY_BUFFER_NAME = "[object ArrayBuffer]";
+class BufferSourceConverter {
+    static isArrayBuffer(data) {
+        return Object.prototype.toString.call(data) === ARRAY_BUFFER_NAME;
     }
-    hash() {
-        const p = sha256.digest(this.bytes);
-        if (isPromise$1(p)) {
-            return p.then(({ bytes }) => bytes);
+    static toArrayBuffer(data) {
+        if (this.isArrayBuffer(data)) {
+            return data;
         }
-        return p.bytes;
-    }
-}
-class Ed25519PrivateKey {
-    _key;
-    _publicKey;
-    // key       - 64 byte Uint8Array containing private key
-    // publicKey - 32 byte Uint8Array containing public key
-    constructor(key, publicKey) {
-        this._key = ensureKey(key, PRIVATE_KEY_BYTE_LENGTH);
-        this._publicKey = ensureKey(publicKey, PUBLIC_KEY_BYTE_LENGTH);
-    }
-    sign(message) {
-        return hashAndSign$2(this._key, message);
+        if (data.byteLength === data.buffer.byteLength) {
+            return data.buffer;
+        }
+        if (data.byteOffset === 0 && data.byteLength === data.buffer.byteLength) {
+            return data.buffer;
+        }
+        return this.toUint8Array(data.buffer)
+            .slice(data.byteOffset, data.byteOffset + data.byteLength)
+            .buffer;
     }
-    get public() {
-        return new Ed25519PublicKey(this._publicKey);
+    static toUint8Array(data) {
+        return this.toView(data, Uint8Array);
     }
-    marshal() {
-        return this._key;
+    static toView(data, type) {
+        if (data.constructor === type) {
+            return data;
+        }
+        if (this.isArrayBuffer(data)) {
+            return new type(data);
+        }
+        if (this.isArrayBufferView(data)) {
+            return new type(data.buffer, data.byteOffset, data.byteLength);
+        }
+        throw new TypeError("The provided value is not of type '(ArrayBuffer or ArrayBufferView)'");
     }
-    get bytes() {
-        return PrivateKey.encode({
-            Type: KeyType.Ed25519,
-            Data: this.marshal()
-        }).subarray();
+    static isBufferSource(data) {
+        return this.isArrayBufferView(data)
+            || this.isArrayBuffer(data);
     }
-    equals(key) {
-        return equals(this.bytes, key.bytes);
+    static isArrayBufferView(data) {
+        return ArrayBuffer.isView(data)
+            || (data && this.isArrayBuffer(data.buffer));
     }
-    async hash() {
-        const p = sha256.digest(this.bytes);
-        let bytes;
-        if (isPromise$1(p)) {
-            ({ bytes } = await p);
+    static isEqual(a, b) {
+        const aView = BufferSourceConverter.toUint8Array(a);
+        const bView = BufferSourceConverter.toUint8Array(b);
+        if (aView.length !== bView.byteLength) {
+            return false;
         }
-        else {
-            bytes = p.bytes;
+        for (let i = 0; i < aView.length; i++) {
+            if (aView[i] !== bView[i]) {
+                return false;
+            }
         }
-        return bytes;
-    }
-    /**
-     * Gets the ID of the key.
-     *
-     * The key id is the base58 encoding of the identity multihash containing its public key.
-     * The public key is a protobuf encoding containing a type and the DER encoding
-     * of the PKCS SubjectPublicKeyInfo.
-     *
-     * @returns {Promise<string>}
-     */
-    async id() {
-        const encoding = identity.digest(this.public.bytes);
-        return base58btc.encode(encoding.bytes).substring(1);
+        return true;
     }
-    /**
-     * Exports the key into a password protected `format`
-     */
-    async export(password, format = 'libp2p-key') {
-        if (format === 'libp2p-key') {
-            return exporter(this.bytes, password);
+    static concat(...args) {
+        let buffers;
+        if (Array.isArray(args[0]) && !(args[1] instanceof Function)) {
+            buffers = args[0];
+        }
+        else if (Array.isArray(args[0]) && args[1] instanceof Function) {
+            buffers = args[0];
         }
         else {
-            throw new CodeError(`export format '${format}' is not supported`, 'ERR_INVALID_EXPORT_FORMAT');
+            if (args[args.length - 1] instanceof Function) {
+                buffers = args.slice(0, args.length - 1);
+            }
+            else {
+                buffers = args;
+            }
         }
-    }
-}
-function unmarshalEd25519PrivateKey(bytes) {
-    // Try the old, redundant public key version
-    if (bytes.length > PRIVATE_KEY_BYTE_LENGTH) {
-        bytes = ensureKey(bytes, PRIVATE_KEY_BYTE_LENGTH + PUBLIC_KEY_BYTE_LENGTH);
-        const privateKeyBytes = bytes.subarray(0, PRIVATE_KEY_BYTE_LENGTH);
-        const publicKeyBytes = bytes.subarray(PRIVATE_KEY_BYTE_LENGTH, bytes.length);
-        return new Ed25519PrivateKey(privateKeyBytes, publicKeyBytes);
-    }
-    bytes = ensureKey(bytes, PRIVATE_KEY_BYTE_LENGTH);
-    const privateKeyBytes = bytes.subarray(0, PRIVATE_KEY_BYTE_LENGTH);
-    const publicKeyBytes = bytes.subarray(PUBLIC_KEY_BYTE_LENGTH);
-    return new Ed25519PrivateKey(privateKeyBytes, publicKeyBytes);
-}
-function unmarshalEd25519PublicKey(bytes) {
-    bytes = ensureKey(bytes, PUBLIC_KEY_BYTE_LENGTH);
-    return new Ed25519PublicKey(bytes);
-}
-async function generateKeyPair$2() {
-    const { privateKey, publicKey } = generateKey$2();
-    return new Ed25519PrivateKey(privateKey, publicKey);
-}
-async function generateKeyPairFromSeed(seed) {
-    const { privateKey, publicKey } = generateKeyFromSeed(seed);
-    return new Ed25519PrivateKey(privateKey, publicKey);
-}
-function ensureKey(key, length) {
-    key = Uint8Array.from(key ?? []);
-    if (key.length !== length) {
-        throw new CodeError(`Key must be a Uint8Array of length ${length}, got ${key.length}`, 'ERR_INVALID_KEY_TYPE');
-    }
-    return key;
-}
-
-var Ed25519 = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    Ed25519PrivateKey: Ed25519PrivateKey,
-    Ed25519PublicKey: Ed25519PublicKey,
-    generateKeyPair: generateKeyPair$2,
-    generateKeyPairFromSeed: generateKeyPairFromSeed,
-    unmarshalEd25519PrivateKey: unmarshalEd25519PrivateKey,
-    unmarshalEd25519PublicKey: unmarshalEd25519PublicKey
-});
-
-/**
- * Generates a Uint8Array with length `number` populated by random bytes
- */
-function randomBytes(length) {
-    if (isNaN(length) || length <= 0) {
-        throw new CodeError('random bytes length must be a Number bigger than 0', 'ERR_INVALID_LENGTH');
-    }
-    return randomBytes$1(length);
-}
-
-// HMAC (RFC 2104)
-class HMAC extends Hash {
-    constructor(hash$1, _key) {
-        super();
-        this.finished = false;
-        this.destroyed = false;
-        hash(hash$1);
-        const key = toBytes$1(_key);
-        this.iHash = hash$1.create();
-        if (typeof this.iHash.update !== 'function')
-            throw new Error('Expected instance of class which extends utils.Hash');
-        this.blockLen = this.iHash.blockLen;
-        this.outputLen = this.iHash.outputLen;
-        const blockLen = this.blockLen;
-        const pad = new Uint8Array(blockLen);
-        // blockLen can be bigger than outputLen
-        pad.set(key.length > blockLen ? hash$1.create().update(key).digest() : key);
-        for (let i = 0; i < pad.length; i++)
-            pad[i] ^= 0x36;
-        this.iHash.update(pad);
-        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone
-        this.oHash = hash$1.create();
-        // Undo internal XOR && apply outer XOR
-        for (let i = 0; i < pad.length; i++)
-            pad[i] ^= 0x36 ^ 0x5c;
-        this.oHash.update(pad);
-        pad.fill(0);
-    }
-    update(buf) {
-        exists(this);
-        this.iHash.update(buf);
-        return this;
-    }
-    digestInto(out) {
-        exists(this);
-        bytes(out, this.outputLen);
-        this.finished = true;
-        this.iHash.digestInto(out);
-        this.oHash.update(out);
-        this.oHash.digestInto(out);
-        this.destroy();
-    }
-    digest() {
-        const out = new Uint8Array(this.oHash.outputLen);
-        this.digestInto(out);
-        return out;
-    }
-    _cloneInto(to) {
-        // Create new instance without calling constructor since key already in state and we don't know it.
-        to || (to = Object.create(Object.getPrototypeOf(this), {}));
-        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
-        to = to;
-        to.finished = finished;
-        to.destroyed = destroyed;
-        to.blockLen = blockLen;
-        to.outputLen = outputLen;
-        to.oHash = oHash._cloneInto(to.oHash);
-        to.iHash = iHash._cloneInto(to.iHash);
-        return to;
-    }
-    destroy() {
-        this.destroyed = true;
-        this.oHash.destroy();
-        this.iHash.destroy();
-    }
-}
-/**
- * HMAC: RFC2104 message authentication code.
- * @param hash - function that would be used e.g. sha256
- * @param key - message key
- * @param message - message data
- * @example
- * import { hmac } from '@noble/hashes/hmac';
- * import { sha256 } from '@noble/hashes/sha2';
- * const mac1 = hmac(sha256, 'key', 'message');
- */
-const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
-hmac.create = (hash, key) => new HMAC(hash, key);
-
-// Common prologue and epilogue for sync/async functions
-function pbkdf2Init(hash$1, _password, _salt, _opts) {
-    hash(hash$1);
-    const opts = checkOpts({ dkLen: 32, asyncTick: 10 }, _opts);
-    const { c, dkLen, asyncTick } = opts;
-    number(c);
-    number(dkLen);
-    number(asyncTick);
-    if (c < 1)
-        throw new Error('PBKDF2: iterations (c) should be >= 1');
-    const password = toBytes$1(_password);
-    const salt = toBytes$1(_salt);
-    // DK = PBKDF2(PRF, Password, Salt, c, dkLen);
-    const DK = new Uint8Array(dkLen);
-    // U1 = PRF(Password, Salt + INT_32_BE(i))
-    const PRF = hmac.create(hash$1, password);
-    const PRFSalt = PRF._cloneInto().update(salt);
-    return { c, dkLen, asyncTick, DK, PRF, PRFSalt };
-}
-function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
-    PRF.destroy();
-    PRFSalt.destroy();
-    if (prfW)
-        prfW.destroy();
-    u.fill(0);
-    return DK;
-}
-async function pbkdf2Async(hash, password, salt, opts) {
-    const { c, dkLen, asyncTick, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
-    let prfW; // Working copy
-    const arr = new Uint8Array(4);
-    const view = createView(arr);
-    const u = new Uint8Array(PRF.outputLen);
-    // DK = T1 + T2 + ⋯ + Tdklen/hlen
-    for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
-        // Ti = F(Password, Salt, c, i)
-        const Ti = DK.subarray(pos, pos + PRF.outputLen);
-        view.setInt32(0, ti, false);
-        // F(Password, Salt, c, i) = U1 ^ U2 ^ ⋯ ^ Uc
-        // U1 = PRF(Password, Salt + INT_32_BE(i))
-        (prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
-        Ti.set(u.subarray(0, Ti.length));
-        await asyncLoop(c - 1, asyncTick, () => {
-            // Uc = PRF(Password, Uc−1)
-            PRF._cloneInto(prfW).update(u).digestInto(u);
-            for (let i = 0; i < Ti.length; i++)
-                Ti[i] ^= u[i];
-        });
-    }
-    return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
-}
-
-/*!
- * MIT License
- * 
- * Copyright (c) 2017-2022 Peculiar Ventures, LLC
- * 
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- * 
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- * 
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- * 
- */
-
-const ARRAY_BUFFER_NAME = "[object ArrayBuffer]";
-class BufferSourceConverter {
-    static isArrayBuffer(data) {
-        return Object.prototype.toString.call(data) === ARRAY_BUFFER_NAME;
-    }
-    static toArrayBuffer(data) {
-        if (this.isArrayBuffer(data)) {
-            return data;
-        }
-        if (data.byteLength === data.buffer.byteLength) {
-            return data.buffer;
-        }
-        if (data.byteOffset === 0 && data.byteLength === data.buffer.byteLength) {
-            return data.buffer;
-        }
-        return this.toUint8Array(data.buffer)
-            .slice(data.byteOffset, data.byteOffset + data.byteLength)
-            .buffer;
-    }
-    static toUint8Array(data) {
-        return this.toView(data, Uint8Array);
-    }
-    static toView(data, type) {
-        if (data.constructor === type) {
-            return data;
-        }
-        if (this.isArrayBuffer(data)) {
-            return new type(data);
-        }
-        if (this.isArrayBufferView(data)) {
-            return new type(data.buffer, data.byteOffset, data.byteLength);
-        }
-        throw new TypeError("The provided value is not of type '(ArrayBuffer or ArrayBufferView)'");
-    }
-    static isBufferSource(data) {
-        return this.isArrayBufferView(data)
-            || this.isArrayBuffer(data);
-    }
-    static isArrayBufferView(data) {
-        return ArrayBuffer.isView(data)
-            || (data && this.isArrayBuffer(data.buffer));
-    }
-    static isEqual(a, b) {
-        const aView = BufferSourceConverter.toUint8Array(a);
-        const bView = BufferSourceConverter.toUint8Array(b);
-        if (aView.length !== bView.byteLength) {
-            return false;
-        }
-        for (let i = 0; i < aView.length; i++) {
-            if (aView[i] !== bView[i]) {
-                return false;
-            }
-        }
-        return true;
-    }
-    static concat(...args) {
-        let buffers;
-        if (Array.isArray(args[0]) && !(args[1] instanceof Function)) {
-            buffers = args[0];
-        }
-        else if (Array.isArray(args[0]) && args[1] instanceof Function) {
-            buffers = args[0];
-        }
-        else {
-            if (args[args.length - 1] instanceof Function) {
-                buffers = args.slice(0, args.length - 1);
-            }
-            else {
-                buffers = args;
-            }
-        }
-        let size = 0;
-        for (const buffer of buffers) {
-            size += buffer.byteLength;
-        }
-        const res = new Uint8Array(size);
-        let offset = 0;
-        for (const buffer of buffers) {
-            const view = this.toUint8Array(buffer);
-            res.set(view, offset);
-            offset += view.length;
-        }
-        if (args[args.length - 1] instanceof Function) {
-            return this.toView(res, args[args.length - 1]);
-        }
-        return res.buffer;
+        let size = 0;
+        for (const buffer of buffers) {
+            size += buffer.byteLength;
+        }
+        const res = new Uint8Array(size);
+        let offset = 0;
+        for (const buffer of buffers) {
+            const view = this.toUint8Array(buffer);
+            res.set(view, offset);
+            offset += view.length;
+        }
+        if (args[args.length - 1] instanceof Function) {
+            return this.toView(res, args[args.length - 1]);
+        }
+        return res.buffer;
     }
 }
 
@@ -12678,82 +12290,131 @@ _a = TIME;
 TIME.NAME = "TIME";
 
 /**
- * Convert a PKCS#1 in ASN1 DER format to a JWK key
+ * Signing a message failed
  */
-function pkcs1ToJwk(bytes) {
-    const { result } = fromBER(bytes);
-    // @ts-expect-error this looks fragile but DER is a canonical format so we are
-    // safe to have deeply property chains like this
-    const values = result.valueBlock.value;
-    const key = {
-        n: toString$6(bnToBuf(values[1].toBigInt()), 'base64url'),
-        e: toString$6(bnToBuf(values[2].toBigInt()), 'base64url'),
-        d: toString$6(bnToBuf(values[3].toBigInt()), 'base64url'),
-        p: toString$6(bnToBuf(values[4].toBigInt()), 'base64url'),
-        q: toString$6(bnToBuf(values[5].toBigInt()), 'base64url'),
-        dp: toString$6(bnToBuf(values[6].toBigInt()), 'base64url'),
-        dq: toString$6(bnToBuf(values[7].toBigInt()), 'base64url'),
-        qi: toString$6(bnToBuf(values[8].toBigInt()), 'base64url'),
-        kty: 'RSA',
-        alg: 'RS256'
-    };
-    return key;
-}
 /**
- * Convert a JWK key into PKCS#1 in ASN1 DER format
+ * Verifying a message signature failed
  */
-function jwkToPkcs1(jwk) {
-    if (jwk.n == null || jwk.e == null || jwk.d == null || jwk.p == null || jwk.q == null || jwk.dp == null || jwk.dq == null || jwk.qi == null) {
-        throw new CodeError('JWK was missing components', 'ERR_INVALID_PARAMETERS');
+class VerificationError extends Error {
+    constructor(message = 'An error occurred while verifying a message') {
+        super(message);
+        this.name = 'VerificationError';
     }
-    const root = new Sequence({
-        value: [
-            new Integer({ value: 0 }),
-            Integer.fromBigInt(bufToBn(fromString(jwk.n, 'base64url'))),
-            Integer.fromBigInt(bufToBn(fromString(jwk.e, 'base64url'))),
-            Integer.fromBigInt(bufToBn(fromString(jwk.d, 'base64url'))),
-            Integer.fromBigInt(bufToBn(fromString(jwk.p, 'base64url'))),
-            Integer.fromBigInt(bufToBn(fromString(jwk.q, 'base64url'))),
-            Integer.fromBigInt(bufToBn(fromString(jwk.dp, 'base64url'))),
-            Integer.fromBigInt(bufToBn(fromString(jwk.dq, 'base64url'))),
-            Integer.fromBigInt(bufToBn(fromString(jwk.qi, 'base64url')))
-        ]
-    });
-    const der = root.toBER();
-    return new Uint8Array(der, 0, der.byteLength);
 }
 /**
- * Convert a PKCIX in ASN1 DER format to a JWK key
+ * WebCrypto was not available in the current context
  */
-function pkixToJwk(bytes) {
-    const { result } = fromBER(bytes);
-    // @ts-expect-error this looks fragile but DER is a canonical format so we are
-    // safe to have deeply property chains like this
-    const values = result.valueBlock.value[1].valueBlock.value[0].valueBlock.value;
-    return {
-        kty: 'RSA',
-        n: toString$6(bnToBuf(values[0].toBigInt()), 'base64url'),
-        e: toString$6(bnToBuf(values[1].toBigInt()), 'base64url')
-    };
+class WebCryptoMissingError extends Error {
+    constructor(message = 'Missing Web Crypto API') {
+        super(message);
+        this.name = 'WebCryptoMissingError';
+    }
 }
-/**
- * Convert a JWK key to PKCIX in ASN1 DER format
- */
-function jwkToPkix(jwk) {
-    if (jwk.n == null || jwk.e == null) {
-        throw new CodeError('JWK was missing components', 'ERR_INVALID_PARAMETERS');
+
+/* eslint-env browser */
+// Check native crypto exists and is enabled (In insecure context `self.crypto`
+// exists but `self.crypto.subtle` does not).
+var webcrypto = {
+    get(win = globalThis) {
+        const nativeCrypto = win.crypto;
+        if (nativeCrypto?.subtle == null) {
+            throw new WebCryptoMissingError('Missing Web Crypto API. ' +
+                'The most likely cause of this error is that this page is being accessed ' +
+                'from an insecure context (i.e. not HTTPS). For more information and ' +
+                'possible resolutions see ' +
+                'https://github.com/libp2p/js-libp2p/blob/main/packages/crypto/README.md#web-crypto-api');
+        }
+        return nativeCrypto;
     }
-    const root = new Sequence({
-        value: [
-            new Sequence({
-                value: [
-                    // rsaEncryption
-                    new ObjectIdentifier({
-                        value: '1.2.840.113549.1.1.1'
-                    }),
-                    new Null()
-                ]
-            }),
+};
+
+async function hashAndVerify$1(key, sig, msg) {
+    const publicKey = await webcrypto.get().subtle.importKey('jwk', key, {
+        name: 'RSASSA-PKCS1-v1_5',
+        hash: { name: 'SHA-256' }
+    }, false, ['verify']);
+    return webcrypto.get().subtle.verify({ name: 'RSASSA-PKCS1-v1_5' }, publicKey, sig, msg instanceof Uint8Array ? msg : msg.subarray());
+}
+function rsaKeySize(jwk) {
+    if (jwk.kty !== 'RSA') {
+        throw new InvalidParametersError('invalid key type');
+    }
+    else if (jwk.n == null) {
+        throw new InvalidParametersError('invalid key modulus');
+    }
+    const bytes = fromString(jwk.n, 'base64url');
+    return bytes.length * 8;
+}
+
+class RSAPublicKey {
+    type = 'RSA';
+    _key;
+    _raw;
+    _multihash;
+    constructor(key, digest) {
+        this._key = key;
+        this._multihash = digest;
+    }
+    get raw() {
+        if (this._raw == null) {
+            this._raw = jwkToPkix(this._key);
+        }
+        return this._raw;
+    }
+    toMultihash() {
+        return this._multihash;
+    }
+    toCID() {
+        return CID.createV1(114, this._multihash);
+    }
+    toString() {
+        return base58btc.encode(this.toMultihash().bytes).substring(1);
+    }
+    equals(key) {
+        if (key == null || !(key.raw instanceof Uint8Array)) {
+            return false;
+        }
+        return equals(this.raw, key.raw);
+    }
+    verify(data, sig) {
+        return hashAndVerify$1(this._key, sig, data);
+    }
+}
+
+const MAX_RSA_KEY_SIZE = 8192;
+const SHA2_256_CODE = 0x12;
+/**
+ * Convert a PKIX in ASN1 DER format to a JWK key
+ */
+function pkixToJwk(bytes) {
+    const { result } = fromBER(bytes);
+    // @ts-expect-error this looks fragile but DER is a canonical format so we are
+    // safe to have deeply property chains like this
+    const values = result.valueBlock.value[1].valueBlock.value[0].valueBlock.value;
+    return {
+        kty: 'RSA',
+        n: toString$6(bnToBuf(values[0].toBigInt()), 'base64url'),
+        e: toString$6(bnToBuf(values[1].toBigInt()), 'base64url')
+    };
+}
+/**
+ * Convert a JWK key to PKIX in ASN1 DER format
+ */
+function jwkToPkix(jwk) {
+    if (jwk.n == null || jwk.e == null) {
+        throw new InvalidParametersError('JWK was missing components');
+    }
+    const root = new Sequence({
+        value: [
+            new Sequence({
+                value: [
+                    // rsaEncryption
+                    new ObjectIdentifier({
+                        value: '1.2.840.113549.1.1.1'
+                    }),
+                    new Null()
+                ]
+            }),
             // this appears to be a bug in asn1js.js - this should really be a Sequence
             // and not a BitString but it generates the same bytes as node-forge so 🤷‍♂️
             new BitString({
@@ -12796,328 +12457,100 @@ function bufToBn(u8) {
     });
     return BigInt('0x' + hex.join(''));
 }
-const SALT_LENGTH = 16;
-const KEY_SIZE = 32;
-const ITERATIONS = 10000;
-async function exportToPem(privateKey, password) {
-    const crypto = webcrypto.get();
-    // PrivateKeyInfo
-    const keyWrapper = new Sequence({
-        value: [
-            // version (0)
-            new Integer({ value: 0 }),
-            // privateKeyAlgorithm
-            new Sequence({
-                value: [
-                    // rsaEncryption OID
-                    new ObjectIdentifier({
-                        value: '1.2.840.113549.1.1.1'
-                    }),
-                    new Null()
-                ]
-            }),
-            // PrivateKey
-            new OctetString({
-                valueHex: privateKey.marshal()
-            })
-        ]
-    });
-    const keyBuf = keyWrapper.toBER();
-    const keyArr = new Uint8Array(keyBuf, 0, keyBuf.byteLength);
-    const salt = randomBytes(SALT_LENGTH);
-    const encryptionKey = await pbkdf2Async(sha512, password, salt, {
-        c: ITERATIONS,
-        dkLen: KEY_SIZE
-    });
-    const iv = randomBytes(16);
-    const cryptoKey = await crypto.subtle.importKey('raw', encryptionKey, 'AES-CBC', false, ['encrypt']);
-    const encrypted = await crypto.subtle.encrypt({
-        name: 'AES-CBC',
-        iv
-    }, cryptoKey, keyArr);
-    const pbkdf2Params = new Sequence({
-        value: [
-            // salt
-            new OctetString({ valueHex: salt }),
-            // iteration count
-            new Integer({ value: ITERATIONS }),
-            // key length
-            new Integer({ value: KEY_SIZE }),
-            // AlgorithmIdentifier
-            new Sequence({
-                value: [
-                    // hmacWithSHA512
-                    new ObjectIdentifier({ value: '1.2.840.113549.2.11' }),
-                    new Null()
-                ]
-            })
-        ]
-    });
-    const encryptionAlgorithm = new Sequence({
-        value: [
-            // pkcs5PBES2
-            new ObjectIdentifier({
-                value: '1.2.840.113549.1.5.13'
-            }),
-            new Sequence({
-                value: [
-                    // keyDerivationFunc
-                    new Sequence({
-                        value: [
-                            // pkcs5PBKDF2
-                            new ObjectIdentifier({
-                                value: '1.2.840.113549.1.5.12'
-                            }),
-                            // PBKDF2-params
-                            pbkdf2Params
-                        ]
-                    }),
-                    // encryptionScheme
-                    new Sequence({
-                        value: [
-                            // aes256-CBC
-                            new ObjectIdentifier({
-                                value: '2.16.840.1.101.3.4.1.42'
-                            }),
-                            // iv
-                            new OctetString({
-                                valueHex: iv
-                            })
-                        ]
-                    })
-                ]
-            })
-        ]
-    });
-    const finalWrapper = new Sequence({
-        value: [
-            encryptionAlgorithm,
-            new OctetString({ valueHex: encrypted })
-        ]
-    });
-    const finalWrapperBuf = finalWrapper.toBER();
-    const finalWrapperArr = new Uint8Array(finalWrapperBuf, 0, finalWrapperBuf.byteLength);
-    return [
-        '-----BEGIN ENCRYPTED PRIVATE KEY-----',
-        ...toString$6(finalWrapperArr, 'base64pad').split(/(.{64})/).filter(Boolean),
-        '-----END ENCRYPTED PRIVATE KEY-----'
-    ].join('\n');
-}
-
-async function generateKey$1(bits) {
-    const pair = await webcrypto.get().subtle.generateKey({
-        name: 'RSASSA-PKCS1-v1_5',
-        modulusLength: bits,
-        publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
-        hash: { name: 'SHA-256' }
-    }, true, ['sign', 'verify']);
-    const keys = await exportKey(pair);
-    return {
-        privateKey: keys[0],
-        publicKey: keys[1]
-    };
-}
-// Takes a jwk key
-async function unmarshalPrivateKey$1(key) {
-    const privateKey = await webcrypto.get().subtle.importKey('jwk', key, {
-        name: 'RSASSA-PKCS1-v1_5',
-        hash: { name: 'SHA-256' }
-    }, true, ['sign']);
-    const pair = [
-        privateKey,
-        await derivePublicFromPrivate(key)
-    ];
-    const keys = await exportKey({
-        privateKey: pair[0],
-        publicKey: pair[1]
-    });
-    return {
-        privateKey: keys[0],
-        publicKey: keys[1]
-    };
-}
-async function hashAndSign$1(key, msg) {
-    const privateKey = await webcrypto.get().subtle.importKey('jwk', key, {
-        name: 'RSASSA-PKCS1-v1_5',
-        hash: { name: 'SHA-256' }
-    }, false, ['sign']);
-    const sig = await webcrypto.get().subtle.sign({ name: 'RSASSA-PKCS1-v1_5' }, privateKey, msg instanceof Uint8Array ? msg : msg.subarray());
-    return new Uint8Array(sig, 0, sig.byteLength);
-}
-async function hashAndVerify$1(key, sig, msg) {
-    const publicKey = await webcrypto.get().subtle.importKey('jwk', key, {
-        name: 'RSASSA-PKCS1-v1_5',
-        hash: { name: 'SHA-256' }
-    }, false, ['verify']);
-    return webcrypto.get().subtle.verify({ name: 'RSASSA-PKCS1-v1_5' }, publicKey, sig, msg instanceof Uint8Array ? msg : msg.subarray());
-}
-async function exportKey(pair) {
-    if (pair.privateKey == null || pair.publicKey == null) {
-        throw new CodeError('Private and public key are required', 'ERR_INVALID_PARAMETERS');
-    }
-    return Promise.all([
-        webcrypto.get().subtle.exportKey('jwk', pair.privateKey),
-        webcrypto.get().subtle.exportKey('jwk', pair.publicKey)
-    ]);
-}
-async function derivePublicFromPrivate(jwKey) {
-    return webcrypto.get().subtle.importKey('jwk', {
-        kty: jwKey.kty,
-        n: jwKey.n,
-        e: jwKey.e
-    }, {
-        name: 'RSASSA-PKCS1-v1_5',
-        hash: { name: 'SHA-256' }
-    }, true, ['verify']);
-}
-function keySize(jwk) {
-    if (jwk.kty !== 'RSA') {
-        throw new CodeError('invalid key type', 'ERR_INVALID_KEY_TYPE');
-    }
-    else if (jwk.n == null) {
-        throw new CodeError('invalid key modulus', 'ERR_INVALID_KEY_MODULUS');
+/**
+ * Turn PKIX bytes to a PublicKey
+ */
+function pkixToRSAPublicKey(bytes) {
+    const jwk = pkixToJwk(bytes);
+    if (rsaKeySize(jwk) > MAX_RSA_KEY_SIZE) {
+        throw new InvalidPublicKeyError('Key size is too large');
     }
-    const bytes = fromString(jwk.n, 'base64url');
-    return bytes.length * 8;
+    const hash = sha256$1(PublicKey.encode({
+        Type: KeyType.RSA,
+        Data: bytes
+    }));
+    const digest = create(SHA2_256_CODE, hash);
+    return new RSAPublicKey(jwk, digest);
 }
 
-const MAX_RSA_KEY_SIZE = 8192;
-class RsaPublicKey {
-    _key;
-    constructor(key) {
-        this._key = key;
-    }
-    verify(data, sig) {
-        return hashAndVerify$1(this._key, sig, data);
-    }
-    marshal() {
-        return jwkToPkix(this._key);
-    }
-    get bytes() {
-        return PublicKey.encode({
-            Type: KeyType.RSA,
-            Data: this.marshal()
-        }).subarray();
-    }
-    equals(key) {
-        return equals(this.bytes, key.bytes);
-    }
-    hash() {
-        const p = sha256.digest(this.bytes);
-        if (isPromise$1(p)) {
-            return p.then(({ bytes }) => bytes);
-        }
-        return p.bytes;
-    }
-}
-class RsaPrivateKey {
-    _key;
-    _publicKey;
-    constructor(key, publicKey) {
-        this._key = key;
-        this._publicKey = publicKey;
-    }
-    genSecret() {
-        return randomBytes(16);
-    }
-    sign(message) {
-        return hashAndSign$1(this._key, message);
-    }
-    get public() {
-        if (this._publicKey == null) {
-            throw new CodeError('public key not provided', 'ERR_PUBKEY_NOT_PROVIDED');
-        }
-        return new RsaPublicKey(this._publicKey);
-    }
-    marshal() {
-        return jwkToPkcs1(this._key);
-    }
-    get bytes() {
-        return PrivateKey.encode({
-            Type: KeyType.RSA,
-            Data: this.marshal()
-        }).subarray();
-    }
-    equals(key) {
-        return equals(this.bytes, key.bytes);
-    }
-    hash() {
-        const p = sha256.digest(this.bytes);
-        if (isPromise$1(p)) {
-            return p.then(({ bytes }) => bytes);
-        }
-        return p.bytes;
-    }
-    /**
-     * Gets the ID of the key.
-     *
-     * The key id is the base58 encoding of the SHA-256 multihash of its public key.
-     * The public key is a protobuf encoding containing a type and the DER encoding
-     * of the PKCS SubjectPublicKeyInfo.
-     */
-    async id() {
-        const hash = await this.public.hash();
-        return toString$6(hash, 'base58btc');
+// HMAC (RFC 2104)
+class HMAC extends Hash {
+    constructor(hash$1, _key) {
+        super();
+        this.finished = false;
+        this.destroyed = false;
+        hash(hash$1);
+        const key = toBytes$1(_key);
+        this.iHash = hash$1.create();
+        if (typeof this.iHash.update !== 'function')
+            throw new Error('Expected instance of class which extends utils.Hash');
+        this.blockLen = this.iHash.blockLen;
+        this.outputLen = this.iHash.outputLen;
+        const blockLen = this.blockLen;
+        const pad = new Uint8Array(blockLen);
+        // blockLen can be bigger than outputLen
+        pad.set(key.length > blockLen ? hash$1.create().update(key).digest() : key);
+        for (let i = 0; i < pad.length; i++)
+            pad[i] ^= 0x36;
+        this.iHash.update(pad);
+        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone
+        this.oHash = hash$1.create();
+        // Undo internal XOR && apply outer XOR
+        for (let i = 0; i < pad.length; i++)
+            pad[i] ^= 0x36 ^ 0x5c;
+        this.oHash.update(pad);
+        pad.fill(0);
     }
-    /**
-     * Exports the key as libp2p-key - a aes-gcm encrypted value with the key
-     * derived from the password.
-     *
-     * To export it as a password protected PEM file, please use the `exportPEM`
-     * function from `@libp2p/rsa`.
-     */
-    async export(password, format = 'pkcs-8') {
-        if (format === 'pkcs-8') {
-            return exportToPem(this, password);
-        }
-        else if (format === 'libp2p-key') {
-            return exporter(this.bytes, password);
-        }
-        else {
-            throw new CodeError(`export format '${format}' is not supported`, 'ERR_INVALID_EXPORT_FORMAT');
-        }
+    update(buf) {
+        exists(this);
+        this.iHash.update(buf);
+        return this;
     }
-}
-async function unmarshalRsaPrivateKey(bytes) {
-    const jwk = pkcs1ToJwk(bytes);
-    if (keySize(jwk) > MAX_RSA_KEY_SIZE) {
-        throw new CodeError('key size is too large', 'ERR_KEY_SIZE_TOO_LARGE');
+    digestInto(out) {
+        exists(this);
+        bytes(out, this.outputLen);
+        this.finished = true;
+        this.iHash.digestInto(out);
+        this.oHash.update(out);
+        this.oHash.digestInto(out);
+        this.destroy();
     }
-    const keys = await unmarshalPrivateKey$1(jwk);
-    return new RsaPrivateKey(keys.privateKey, keys.publicKey);
-}
-function unmarshalRsaPublicKey(bytes) {
-    const jwk = pkixToJwk(bytes);
-    if (keySize(jwk) > MAX_RSA_KEY_SIZE) {
-        throw new CodeError('key size is too large', 'ERR_KEY_SIZE_TOO_LARGE');
+    digest() {
+        const out = new Uint8Array(this.oHash.outputLen);
+        this.digestInto(out);
+        return out;
     }
-    return new RsaPublicKey(jwk);
-}
-async function fromJwk(jwk) {
-    if (keySize(jwk) > MAX_RSA_KEY_SIZE) {
-        throw new CodeError('key size is too large', 'ERR_KEY_SIZE_TOO_LARGE');
+    _cloneInto(to) {
+        // Create new instance without calling constructor since key already in state and we don't know it.
+        to || (to = Object.create(Object.getPrototypeOf(this), {}));
+        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+        to = to;
+        to.finished = finished;
+        to.destroyed = destroyed;
+        to.blockLen = blockLen;
+        to.outputLen = outputLen;
+        to.oHash = oHash._cloneInto(to.oHash);
+        to.iHash = iHash._cloneInto(to.iHash);
+        return to;
     }
-    const keys = await unmarshalPrivateKey$1(jwk);
-    return new RsaPrivateKey(keys.privateKey, keys.publicKey);
-}
-async function generateKeyPair$1(bits) {
-    if (bits > MAX_RSA_KEY_SIZE) {
-        throw new CodeError('key size is too large', 'ERR_KEY_SIZE_TOO_LARGE');
+    destroy() {
+        this.destroyed = true;
+        this.oHash.destroy();
+        this.iHash.destroy();
     }
-    const keys = await generateKey$1(bits);
-    return new RsaPrivateKey(keys.privateKey, keys.publicKey);
 }
-
-var RSA = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    MAX_RSA_KEY_SIZE: MAX_RSA_KEY_SIZE,
-    RsaPrivateKey: RsaPrivateKey,
-    RsaPublicKey: RsaPublicKey,
-    fromJwk: fromJwk,
-    generateKeyPair: generateKeyPair$1,
-    unmarshalRsaPrivateKey: unmarshalRsaPrivateKey,
-    unmarshalRsaPublicKey: unmarshalRsaPublicKey
-});
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @param hash - function that would be used e.g. sha256
+ * @param key - message key
+ * @param message - message data
+ * @example
+ * import { hmac } from '@noble/hashes/hmac';
+ * import { sha256 } from '@noble/hashes/sha2';
+ * const mac1 = hmac(sha256, 'key', 'message');
+ */
+const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
+hmac.create = (hash, key) => new HMAC(hash, key);
 
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // Short Weierstrass curve. The formula is: y² = x³ + ax + b
@@ -14137,7 +13570,7 @@ function getHash(hash) {
     return {
         hash,
         hmac: (key, ...msgs) => hmac(hash, key, concatBytes$2(...msgs)),
-        randomBytes: randomBytes$1,
+        randomBytes,
     };
 }
 function createCurve(curveDef, defHash) {
@@ -14230,27 +13663,15 @@ const secp256k1 = createCurve({
 BigInt(0);
 secp256k1.ProjectivePoint;
 
-function generateKey() {
-    return secp256k1.utils.randomPrivateKey();
-}
-/**
- * Hash and sign message with private key
- */
-function hashAndSign(key, msg) {
-    const p = sha256.digest(msg instanceof Uint8Array ? msg : msg.subarray());
-    if (isPromise$1(p)) {
-        return p.then(({ digest }) => secp256k1.sign(digest, key).toDERRawBytes())
-            .catch(err => {
-            throw new CodeError(String(err), 'ERR_INVALID_INPUT');
-        });
-    }
-    try {
-        return secp256k1.sign(p.digest, key).toDERRawBytes();
-    }
-    catch (err) {
-        throw new CodeError(String(err), 'ERR_INVALID_INPUT');
+function isPromise$1(thing) {
+    if (thing == null) {
+        return false;
     }
+    return typeof thing.then === 'function' &&
+        typeof thing.catch === 'function' &&
+        typeof thing.finally === 'function';
 }
+
 /**
  * Hash message and verify signature with public key
  */
@@ -14259,231 +13680,134 @@ function hashAndVerify(key, sig, msg) {
     if (isPromise$1(p)) {
         return p.then(({ digest }) => secp256k1.verify(sig, digest, key))
             .catch(err => {
-            throw new CodeError(String(err), 'ERR_INVALID_INPUT');
+            throw new VerificationError(String(err));
         });
     }
     try {
         return secp256k1.verify(sig, p.digest, key);
     }
     catch (err) {
-        throw new CodeError(String(err), 'ERR_INVALID_INPUT');
-    }
-}
-function compressPublicKey(key) {
-    const point = secp256k1.ProjectivePoint.fromHex(key).toRawBytes(true);
-    return point;
-}
-function validatePrivateKey(key) {
-    try {
-        secp256k1.getPublicKey(key, true);
-    }
-    catch (err) {
-        throw new CodeError(String(err), 'ERR_INVALID_PRIVATE_KEY');
-    }
-}
-function validatePublicKey(key) {
-    try {
-        secp256k1.ProjectivePoint.fromHex(key);
-    }
-    catch (err) {
-        throw new CodeError(String(err), 'ERR_INVALID_PUBLIC_KEY');
-    }
-}
-function computePublicKey(privateKey) {
-    try {
-        return secp256k1.getPublicKey(privateKey, true);
-    }
-    catch (err) {
-        throw new CodeError(String(err), 'ERR_INVALID_PRIVATE_KEY');
+        throw new VerificationError(String(err));
     }
 }
 
 class Secp256k1PublicKey {
+    type = 'secp256k1';
+    raw;
     _key;
     constructor(key) {
-        validatePublicKey(key);
-        this._key = key;
-    }
-    verify(data, sig) {
-        return hashAndVerify(this._key, sig, data);
-    }
-    marshal() {
-        return compressPublicKey(this._key);
-    }
-    get bytes() {
-        return PublicKey.encode({
-            Type: KeyType.Secp256k1,
-            Data: this.marshal()
-        }).subarray();
-    }
-    equals(key) {
-        return equals(this.bytes, key.bytes);
+        this._key = validateSecp256k1PublicKey(key);
+        this.raw = compressSecp256k1PublicKey(this._key);
     }
-    async hash() {
-        const p = sha256.digest(this.bytes);
-        let bytes;
-        if (isPromise$1(p)) {
-            ({ bytes } = await p);
-        }
-        else {
-            bytes = p.bytes;
-        }
-        return bytes;
+    toMultihash() {
+        return identity.digest(publicKeyToProtobuf(this));
     }
-}
-class Secp256k1PrivateKey {
-    _key;
-    _publicKey;
-    constructor(key, publicKey) {
-        this._key = key;
-        this._publicKey = publicKey ?? computePublicKey(key);
-        validatePrivateKey(this._key);
-        validatePublicKey(this._publicKey);
-    }
-    sign(message) {
-        return hashAndSign(this._key, message);
-    }
-    get public() {
-        return new Secp256k1PublicKey(this._publicKey);
-    }
-    marshal() {
-        return this._key;
+    toCID() {
+        return CID.createV1(114, this.toMultihash());
     }
-    get bytes() {
-        return PrivateKey.encode({
-            Type: KeyType.Secp256k1,
-            Data: this.marshal()
-        }).subarray();
+    toString() {
+        return base58btc.encode(this.toMultihash().bytes).substring(1);
     }
     equals(key) {
-        return equals(this.bytes, key.bytes);
-    }
-    hash() {
-        const p = sha256.digest(this.bytes);
-        if (isPromise$1(p)) {
-            return p.then(({ bytes }) => bytes);
+        if (key == null || !(key.raw instanceof Uint8Array)) {
+            return false;
         }
-        return p.bytes;
+        return equals(this.raw, key.raw);
     }
-    /**
-     * Gets the ID of the key.
-     *
-     * The key id is the base58 encoding of the SHA-256 multihash of its public key.
-     * The public key is a protobuf encoding containing a type and the DER encoding
-     * of the PKCS SubjectPublicKeyInfo.
-     */
-    async id() {
-        const hash = await this.public.hash();
-        return toString$6(hash, 'base58btc');
-    }
-    /**
-     * Exports the key into a password protected `format`
-     */
-    async export(password, format = 'libp2p-key') {
-        if (format === 'libp2p-key') {
-            return exporter(this.bytes, password);
-        }
-        else {
-            throw new CodeError(`export format '${format}' is not supported`, 'ERR_INVALID_EXPORT_FORMAT');
-        }
+    verify(data, sig) {
+        return hashAndVerify(this._key, sig, data);
     }
 }
-function unmarshalSecp256k1PrivateKey(bytes) {
-    return new Secp256k1PrivateKey(bytes);
-}
+
 function unmarshalSecp256k1PublicKey(bytes) {
     return new Secp256k1PublicKey(bytes);
 }
-async function generateKeyPair() {
-    const privateKeyBytes = generateKey();
-    return new Secp256k1PrivateKey(privateKeyBytes);
+function compressSecp256k1PublicKey(key) {
+    const point = secp256k1.ProjectivePoint.fromHex(key).toRawBytes(true);
+    return point;
+}
+function validateSecp256k1PublicKey(key) {
+    try {
+        secp256k1.ProjectivePoint.fromHex(key);
+        return key;
+    }
+    catch (err) {
+        throw new InvalidPublicKeyError(String(err));
+    }
 }
-
-var Secp256k1 = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    Secp256k1PrivateKey: Secp256k1PrivateKey,
-    Secp256k1PublicKey: Secp256k1PublicKey,
-    generateKeyPair: generateKeyPair,
-    unmarshalSecp256k1PrivateKey: unmarshalSecp256k1PrivateKey,
-    unmarshalSecp256k1PublicKey: unmarshalSecp256k1PublicKey
-});
 
 /**
  * @packageDocumentation
  *
- * **Supported Key Types**
- *
- * The {@link generateKeyPair}, {@link marshalPublicKey}, and {@link marshalPrivateKey} functions accept a string `type` argument.
+ * ## Supported Key Types
  *
  * Currently the `'RSA'`, `'ed25519'`, and `secp256k1` types are supported, although ed25519 and secp256k1 keys support only signing and verification of messages.
  *
  * For encryption / decryption support, RSA keys should be used.
  */
-const supportedKeys = {
-    rsa: RSA,
-    ed25519: Ed25519,
-    secp256k1: Secp256k1
-};
-function unsupportedKey(type) {
-    const supported = Object.keys(supportedKeys).join(' / ');
-    return new CodeError(`invalid or unsupported key type ${type}. Must be ${supported}`, 'ERR_UNSUPPORTED_KEY_TYPE');
-}
-function typeToKey(type) {
-    type = type.toLowerCase();
-    if (type === 'rsa' || type === 'ed25519' || type === 'secp256k1') {
-        return supportedKeys[type];
+/**
+ * Creates a public key from the raw key bytes
+ */
+function publicKeyFromRaw(buf) {
+    if (buf.byteLength === 32) {
+        return unmarshalEd25519PublicKey(buf);
+    }
+    else if (buf.byteLength === 33) {
+        return unmarshalSecp256k1PublicKey(buf);
+    }
+    else {
+        return pkixToRSAPublicKey(buf);
     }
-    throw unsupportedKey(type);
 }
 /**
- * Converts a protobuf serialized public key into its representative object
+ * Creates a public key from an identity multihash which contains a protobuf
+ * encoded Ed25519 or secp256k1 public key.
+ *
+ * RSA keys are not supported as in practice we they are not stored in identity
+ * multihashes since the hash would be very large.
  */
-function unmarshalPublicKey(buf) {
-    const decoded = PublicKey.decode(buf);
-    const data = decoded.Data ?? new Uint8Array();
-    switch (decoded.Type) {
-        case KeyType.RSA:
-            return supportedKeys.rsa.unmarshalRsaPublicKey(data);
+function publicKeyFromMultihash(digest) {
+    const { Type, Data } = PublicKey.decode(digest.digest);
+    const data = Data ?? new Uint8Array();
+    switch (Type) {
         case KeyType.Ed25519:
-            return supportedKeys.ed25519.unmarshalEd25519PublicKey(data);
-        case KeyType.Secp256k1:
-            return supportedKeys.secp256k1.unmarshalSecp256k1PublicKey(data);
+            return unmarshalEd25519PublicKey(data);
+        case KeyType.secp256k1:
+            return unmarshalSecp256k1PublicKey(data);
         default:
-            throw unsupportedKey(decoded.Type ?? 'unknown');
+            throw new UnsupportedKeyTypeError$1();
     }
 }
 /**
  * Converts a public key object into a protobuf serialized public key
  */
-function marshalPublicKey(key, type) {
-    type = (type ?? 'rsa').toLowerCase();
-    typeToKey(type); // check type
-    return key.bytes;
+function publicKeyToProtobuf(key) {
+    return PublicKey.encode({
+        Type: KeyType[key.type],
+        Data: key.raw
+    });
 }
+
 /**
- * Converts a protobuf serialized private key into its representative object
+ * All PeerId implementations must use this symbol as the name of a property
+ * with a boolean `true` value
  */
-async function unmarshalPrivateKey(buf) {
-    const decoded = PrivateKey.decode(buf);
-    const data = decoded.Data ?? new Uint8Array();
-    switch (decoded.Type) {
-        case KeyType.RSA:
-            return supportedKeys.rsa.unmarshalRsaPrivateKey(data);
-        case KeyType.Ed25519:
-            return supportedKeys.ed25519.unmarshalEd25519PrivateKey(data);
-        case KeyType.Secp256k1:
-            return supportedKeys.secp256k1.unmarshalSecp256k1PrivateKey(data);
-        default:
-            throw unsupportedKey(decoded.Type ?? 'RSA');
-    }
-}
+const peerIdSymbol = Symbol.for('@libp2p/peer-id');
+
 /**
- * Converts a private key object into a protobuf serialized private key
+ * When this error is thrown it means an operation was aborted,
+ * usually in response to the `abort` event being emitted by an
+ * AbortSignal.
+ */
+/**
+ * Thrown when and attempt to operate on an unsupported key was made
  */
-function marshalPrivateKey(key, type) {
-    type = (type ?? 'rsa').toLowerCase();
-    typeToKey(type); // check type
-    return key.bytes;
+class UnsupportedKeyTypeError extends Error {
+    static name = 'UnsupportedKeyTypeError';
+    constructor(message = 'Unsupported key type') {
+        super(message);
+        this.name = 'UnsupportedKeyTypeError';
+    }
 }
 
 /**
@@ -14501,26 +13825,17 @@ function marshalPrivateKey(key, type) {
  * console.log(peer.toString()) // "12D3K..."
  * ```
  */
-const inspect = Symbol.for('nodejs.util.inspect.custom');
-const baseDecoder = Object
-    .values(bases)
-    .map(codec => codec.decoder)
-    // @ts-expect-error https://github.com/multiformats/js-multiformats/issues/141
-    .reduce((acc, curr) => acc.or(curr), bases.identity.decoder);
+const inspect$1 = Symbol.for('nodejs.util.inspect.custom');
 // these values are from https://github.com/multiformats/multicodec/blob/master/table.csv
-const LIBP2P_KEY_CODE = 0x72;
-const MARSHALLED_ED225519_PUBLIC_KEY_LENGTH = 36;
-const MARSHALLED_SECP256K1_PUBLIC_KEY_LENGTH = 37;
-class PeerIdImpl {
+const LIBP2P_KEY_CODE$1 = 0x72;
+let PeerIdImpl$1 = class PeerIdImpl {
     type;
     multihash;
-    privateKey;
     publicKey;
     string;
     constructor(init) {
         this.type = init.type;
         this.multihash = init.multihash;
-        this.privateKey = init.privateKey;
         // mark string cache as non-enumerable
         Object.defineProperty(this, 'string', {
             enumerable: false,
@@ -14537,17 +13852,14 @@ class PeerIdImpl {
         }
         return this.string;
     }
+    toMultihash() {
+        return this.multihash;
+    }
     // return self-describing String representation
     // in default format from RFC 0001: https://github.com/libp2p/specs/pull/209
     toCID() {
-        return CID.createV1(LIBP2P_KEY_CODE, this.multihash);
+        return CID.createV1(LIBP2P_KEY_CODE$1, this.multihash);
     }
-    toBytes() {
-        return this.multihash.bytes;
-    }
-    /**
-     * Returns Multiaddr as a JSON string
-     */
     toJSON() {
         return this.toString();
     }
@@ -14562,10 +13874,10 @@ class PeerIdImpl {
             return equals(this.multihash.bytes, id);
         }
         else if (typeof id === 'string') {
-            return peerIdFromString(id).equals(this);
+            return this.toString() === id;
         }
-        else if (id?.multihash?.bytes != null) {
-            return equals(this.multihash.bytes, id.multihash.bytes);
+        else if (id?.toMultihash()?.bytes != null) {
+            return equals(this.multihash.bytes, id.toMultihash().bytes);
         }
         else {
             throw new Error('not valid Id');
@@ -14583,145 +13895,79 @@ class PeerIdImpl {
      * // 'PeerId(QmFoo)'
      * ```
      */
-    [inspect]() {
+    [inspect$1]() {
         return `PeerId(${this.toString()})`;
     }
-}
-class RSAPeerIdImpl extends PeerIdImpl {
+};
+let RSAPeerId$1 = class RSAPeerId extends PeerIdImpl$1 {
     type = 'RSA';
     publicKey;
     constructor(init) {
         super({ ...init, type: 'RSA' });
         this.publicKey = init.publicKey;
     }
-}
-class Ed25519PeerIdImpl extends PeerIdImpl {
+};
+let Ed25519PeerId$1 = class Ed25519PeerId extends PeerIdImpl$1 {
     type = 'Ed25519';
     publicKey;
     constructor(init) {
         super({ ...init, type: 'Ed25519' });
-        this.publicKey = init.multihash.digest;
+        this.publicKey = init.publicKey;
     }
-}
-class Secp256k1PeerIdImpl extends PeerIdImpl {
+};
+let Secp256k1PeerId$1 = class Secp256k1PeerId extends PeerIdImpl$1 {
     type = 'secp256k1';
     publicKey;
     constructor(init) {
         super({ ...init, type: 'secp256k1' });
-        this.publicKey = init.multihash.digest;
-    }
-}
-// these values are from https://github.com/multiformats/multicodec/blob/master/table.csv
-const TRANSPORT_IPFS_GATEWAY_HTTP_CODE = 0x0920;
-class URLPeerIdImpl {
-    type = 'url';
-    multihash;
-    privateKey;
-    publicKey;
-    url;
-    constructor(url) {
-        this.url = url.toString();
-        this.multihash = identity.digest(fromString(this.url));
-    }
-    [inspect]() {
-        return `PeerId(${this.url})`;
-    }
-    [peerIdSymbol] = true;
-    toString() {
-        return this.toCID().toString();
-    }
-    toCID() {
-        return CID.createV1(TRANSPORT_IPFS_GATEWAY_HTTP_CODE, this.multihash);
-    }
-    toBytes() {
-        return this.toCID().bytes;
-    }
-    equals(other) {
-        if (other == null) {
-            return false;
-        }
-        if (other instanceof Uint8Array) {
-            other = toString$6(other);
-        }
-        return other.toString() === this.toString();
-    }
-}
-function peerIdFromString(str, decoder) {
-    if (str.charAt(0) === '1' || str.charAt(0) === 'Q') {
-        // identity hash ed25519/secp256k1 key or sha2-256 hash of
-        // rsa public key - base58btc encoded either way
-        const multihash = decode$6(base58btc.decode(`z${str}`));
-        if (str.startsWith('12D')) {
-            return new Ed25519PeerIdImpl({ multihash });
-        }
-        else if (str.startsWith('16U')) {
-            return new Secp256k1PeerIdImpl({ multihash });
-        }
-        else {
-            return new RSAPeerIdImpl({ multihash });
-        }
-    }
-    return peerIdFromBytes(baseDecoder.decode(str));
-}
-function peerIdFromBytes(buf) {
-    try {
-        const multihash = decode$6(buf);
-        if (multihash.code === identity.code) {
-            if (multihash.digest.length === MARSHALLED_ED225519_PUBLIC_KEY_LENGTH) {
-                return new Ed25519PeerIdImpl({ multihash });
-            }
-            else if (multihash.digest.length === MARSHALLED_SECP256K1_PUBLIC_KEY_LENGTH) {
-                return new Secp256k1PeerIdImpl({ multihash });
-            }
-        }
-        if (multihash.code === sha256.code) {
-            return new RSAPeerIdImpl({ multihash });
-        }
-    }
-    catch {
-        return peerIdFromCID(CID.decode(buf));
-    }
-    throw new Error('Supplied PeerID CID is invalid');
-}
-function peerIdFromCID(cid) {
-    if (cid?.multihash == null || cid.version == null || (cid.version === 1 && (cid.code !== LIBP2P_KEY_CODE) && cid.code !== TRANSPORT_IPFS_GATEWAY_HTTP_CODE)) {
-        throw new Error('Supplied PeerID CID is invalid');
-    }
-    if (cid.code === TRANSPORT_IPFS_GATEWAY_HTTP_CODE) {
-        const url = toString$6(cid.multihash.digest);
-        return new URLPeerIdImpl(new URL(url));
-    }
-    const multihash = cid.multihash;
-    if (multihash.code === sha256.code) {
-        return new RSAPeerIdImpl({ multihash: cid.multihash });
-    }
-    else if (multihash.code === identity.code) {
-        if (multihash.digest.length === MARSHALLED_ED225519_PUBLIC_KEY_LENGTH) {
-            return new Ed25519PeerIdImpl({ multihash: cid.multihash });
-        }
-        else if (multihash.digest.length === MARSHALLED_SECP256K1_PUBLIC_KEY_LENGTH) {
-            return new Secp256k1PeerIdImpl({ multihash: cid.multihash });
-        }
+        this.publicKey = init.publicKey;
     }
-    throw new Error('Supplied PeerID CID is invalid');
-}
+};
+
 /**
- * @param publicKey - A marshalled public key
- * @param privateKey - A marshalled private key
+ * @packageDocumentation
+ *
+ * An implementation of a peer id
+ *
+ * @example
+ *
+ * ```TypeScript
+ * import { peerIdFromString } from '@libp2p/peer-id'
+ * const peer = peerIdFromString('k51qzi5uqu5dkwkqm42v9j9kqcam2jiuvloi16g72i4i4amoo2m8u3ol3mqu6s')
+ *
+ * console.log(peer.toCID()) // CID(bafzaa...)
+ * console.log(peer.toString()) // "12D3K..."
+ * ```
  */
-async function peerIdFromKeys(publicKey, privateKey) {
-    if (publicKey.length === MARSHALLED_ED225519_PUBLIC_KEY_LENGTH) {
-        return new Ed25519PeerIdImpl({ multihash: create$1(identity.code, publicKey), privateKey });
+function peerIdFromPublicKey(publicKey) {
+    if (publicKey.type === 'Ed25519') {
+        return new Ed25519PeerId$1({
+            multihash: publicKey.toCID().multihash,
+            publicKey
+        });
     }
-    if (publicKey.length === MARSHALLED_SECP256K1_PUBLIC_KEY_LENGTH) {
-        return new Secp256k1PeerIdImpl({ multihash: create$1(identity.code, publicKey), privateKey });
+    else if (publicKey.type === 'secp256k1') {
+        return new Secp256k1PeerId$1({
+            multihash: publicKey.toCID().multihash,
+            publicKey
+        });
+    }
+    else if (publicKey.type === 'RSA') {
+        return new RSAPeerId$1({
+            multihash: publicKey.toCID().multihash,
+            publicKey
+        });
     }
-    return new RSAPeerIdImpl({ multihash: await sha256.digest(publicKey), publicKey, privateKey });
+    throw new UnsupportedKeyTypeError();
 }
 
+const ERR_TYPE_NOT_IMPLEMENTED = "Keypair type not implemented";
 function createPeerIdFromPublicKey(publicKey) {
-    const _publicKey = new supportedKeys.secp256k1.Secp256k1PublicKey(publicKey);
-    return peerIdFromKeys(_publicKey.bytes, undefined);
+    const pubKey = publicKeyFromRaw(publicKey);
+    if (pubKey.type !== "secp256k1") {
+        throw new Error(ERR_TYPE_NOT_IMPLEMENTED);
+    }
+    return peerIdFromPublicKey(pubKey);
 }
 
 function decodeMultiaddrs(bytes) {
@@ -14968,12 +14214,12 @@ var TransportProtocolPerIpVersion;
 class ENR extends RawEnr {
     static RECORD_PREFIX = "enr:";
     peerId;
-    static async create(kvs = {}, seq = BigInt(1), signature) {
+    static create(kvs = {}, seq = BigInt(1), signature) {
         const enr = new ENR(kvs, seq, signature);
         try {
             const publicKey = enr.publicKey;
             if (publicKey) {
-                enr.peerId = await createPeerIdFromPublicKey(publicKey);
+                enr.peerId = createPeerIdFromPublicKey(publicKey);
             }
         }
         catch (e) {
@@ -15738,7 +14984,7 @@ async function fromValues(values) {
         }
     }
     const _seq = decodeSeq(seq);
-    const enr = await ENR.create(obj, _seq, signature);
+    const enr = ENR.create(obj, _seq, signature);
     checkSignature(seq, kvs, enr, signature);
     return enr;
 }
@@ -25004,50 +24250,210 @@ function wakuPeerExchangeDiscovery(pubsubTopics) {
 /**
  * @packageDocumentation
  *
- * Generate, import, and export PeerIDs.
- *
- * A Peer ID is the SHA-256 [multihash](https://github.com/multiformats/multihash) of a public key.
- *
- * The public key is a base64 encoded string of a protobuf containing an RSA DER buffer. This uses a node buffer to pass the base64 encoded public key protobuf to the multihash for ID generation.
+ * An implementation of a peer id
  *
  * @example
  *
  * ```TypeScript
- * import { createEd25519PeerId } from '@libp2p/peer-id-factory'
- *
- * const peerId = await createEd25519PeerId()
- * console.log(peerId.toString())
- * ```
+ * import { peerIdFromString } from '@libp2p/peer-id'
+ * const peer = peerIdFromString('k51qzi5uqu5dkwkqm42v9j9kqcam2jiuvloi16g72i4i4amoo2m8u3ol3mqu6s')
  *
- * ```bash
- * 12D3KooWRm8J3iL796zPFi2EtGGtUJn58AG67gcqzMFHZnnsTzqD
+ * console.log(peer.toCID()) // CID(bafzaa...)
+ * console.log(peer.toString()) // "12D3K..."
  * ```
  */
-async function createFromPubKey(publicKey) {
-    return peerIdFromKeys(marshalPublicKey(publicKey));
+const inspect = Symbol.for('nodejs.util.inspect.custom');
+// these values are from https://github.com/multiformats/multicodec/blob/master/table.csv
+const LIBP2P_KEY_CODE = 0x72;
+class PeerIdImpl {
+    type;
+    multihash;
+    publicKey;
+    string;
+    constructor(init) {
+        this.type = init.type;
+        this.multihash = init.multihash;
+        // mark string cache as non-enumerable
+        Object.defineProperty(this, 'string', {
+            enumerable: false,
+            writable: true
+        });
+    }
+    get [Symbol.toStringTag]() {
+        return `PeerId(${this.toString()})`;
+    }
+    [peerIdSymbol$1] = true;
+    toString() {
+        if (this.string == null) {
+            this.string = base58btc.encode(this.multihash.bytes).slice(1);
+        }
+        return this.string;
+    }
+    toMultihash() {
+        return this.multihash;
+    }
+    // return self-describing String representation
+    // in default format from RFC 0001: https://github.com/libp2p/specs/pull/209
+    toCID() {
+        return CID.createV1(LIBP2P_KEY_CODE, this.multihash);
+    }
+    toJSON() {
+        return this.toString();
+    }
+    /**
+     * Checks the equality of `this` peer against a given PeerId
+     */
+    equals(id) {
+        if (id == null) {
+            return false;
+        }
+        if (id instanceof Uint8Array) {
+            return equals(this.multihash.bytes, id);
+        }
+        else if (typeof id === 'string') {
+            return this.toString() === id;
+        }
+        else if (id?.toMultihash()?.bytes != null) {
+            return equals(this.multihash.bytes, id.toMultihash().bytes);
+        }
+        else {
+            throw new Error('not valid Id');
+        }
+    }
+    /**
+     * Returns PeerId as a human-readable string
+     * https://nodejs.org/api/util.html#utilinspectcustom
+     *
+     * @example
+     * ```TypeScript
+     * import { peerIdFromString } from '@libp2p/peer-id'
+     *
+     * console.info(peerIdFromString('QmFoo'))
+     * // 'PeerId(QmFoo)'
+     * ```
+     */
+    [inspect]() {
+        return `PeerId(${this.toString()})`;
+    }
+}
+class RSAPeerId extends PeerIdImpl {
+    type = 'RSA';
+    publicKey;
+    constructor(init) {
+        super({ ...init, type: 'RSA' });
+        this.publicKey = init.publicKey;
+    }
+}
+class Ed25519PeerId extends PeerIdImpl {
+    type = 'Ed25519';
+    publicKey;
+    constructor(init) {
+        super({ ...init, type: 'Ed25519' });
+        this.publicKey = init.publicKey;
+    }
 }
-async function createFromPrivKey(privateKey) {
-    return peerIdFromKeys(marshalPublicKey(privateKey.public), marshalPrivateKey(privateKey));
+class Secp256k1PeerId extends PeerIdImpl {
+    type = 'secp256k1';
+    publicKey;
+    constructor(init) {
+        super({ ...init, type: 'secp256k1' });
+        this.publicKey = init.publicKey;
+    }
 }
-async function createFromJSON(obj) {
-    return createFromParts(fromString(obj.id, 'base58btc'), obj.privKey != null ? fromString(obj.privKey, 'base64pad') : undefined, obj.pubKey != null ? fromString(obj.pubKey, 'base64pad') : undefined);
+// these values are from https://github.com/multiformats/multicodec/blob/master/table.csv
+const TRANSPORT_IPFS_GATEWAY_HTTP_CODE = 0x0920;
+class URLPeerId {
+    type = 'url';
+    multihash;
+    publicKey;
+    url;
+    constructor(url) {
+        this.url = url.toString();
+        this.multihash = identity.digest(fromString(this.url));
+    }
+    [inspect]() {
+        return `PeerId(${this.url})`;
+    }
+    [peerIdSymbol$1] = true;
+    toString() {
+        return this.toCID().toString();
+    }
+    toMultihash() {
+        return this.multihash;
+    }
+    toCID() {
+        return CID.createV1(TRANSPORT_IPFS_GATEWAY_HTTP_CODE, this.toMultihash());
+    }
+    toJSON() {
+        return this.toString();
+    }
+    equals(other) {
+        if (other == null) {
+            return false;
+        }
+        if (other instanceof Uint8Array) {
+            other = toString$6(other);
+        }
+        return other.toString() === this.toString();
+    }
 }
-async function createFromParts(multihash, privKey, pubKey) {
-    if (privKey != null) {
-        const key = await unmarshalPrivateKey(privKey);
-        return createFromPrivKey(key);
+
+/**
+ * @packageDocumentation
+ *
+ * An implementation of a peer id
+ *
+ * @example
+ *
+ * ```TypeScript
+ * import { peerIdFromString } from '@libp2p/peer-id'
+ * const peer = peerIdFromString('k51qzi5uqu5dkwkqm42v9j9kqcam2jiuvloi16g72i4i4amoo2m8u3ol3mqu6s')
+ *
+ * console.log(peer.toCID()) // CID(bafzaa...)
+ * console.log(peer.toString()) // "12D3K..."
+ * ```
+ */
+function peerIdFromString(str, decoder) {
+    let multihash;
+    if (str.charAt(0) === '1' || str.charAt(0) === 'Q') {
+        // identity hash ed25519/secp256k1 key or sha2-256 hash of
+        // rsa public key - base58btc encoded either way
+        multihash = decode$6(base58btc.decode(`z${str}`));
+    }
+    else {
+        {
+            throw new InvalidParametersError$1('Please pass a multibase decoder for strings that do not start with "1" or "Q"');
+        }
     }
-    else if (pubKey != null) {
-        const key = unmarshalPublicKey(pubKey);
-        return createFromPubKey(key);
+    return peerIdFromMultihash(multihash);
+}
+function peerIdFromMultihash(multihash) {
+    if (isSha256Multihash(multihash)) {
+        return new RSAPeerId({ multihash });
     }
-    const peerId = peerIdFromBytes(multihash);
-    if (peerId.type !== 'Ed25519' && peerId.type !== 'secp256k1' && peerId.type !== 'RSA') {
-        // should not be possible since `multihash` is derived from keys and these
-        // are the cryptographic peer id types
-        throw new Error('Supplied PeerID is invalid');
+    else if (isIdentityMultihash(multihash)) {
+        try {
+            const publicKey = publicKeyFromMultihash(multihash);
+            if (publicKey.type === 'Ed25519') {
+                return new Ed25519PeerId({ multihash, publicKey });
+            }
+            else if (publicKey.type === 'secp256k1') {
+                return new Secp256k1PeerId({ multihash, publicKey });
+            }
+        }
+        catch (err) {
+            // was not Ed or secp key, try URL
+            const url = toString$6(multihash.digest);
+            return new URLPeerId(new URL(url));
+        }
     }
-    return peerId;
+    throw new InvalidMultihashError('Supplied PeerID Multihash is invalid');
+}
+function isIdentityMultihash(multihash) {
+    return multihash.code === identity.code;
+}
+function isSha256Multihash(multihash) {
+    return multihash.code === sha256.code;
 }
 
 const log = new Logger$1("peer-exchange-discovery");
@@ -25075,7 +24481,7 @@ class LocalPeerCacheDiscovery extends TypedEventEmitter {
         log.info("Starting Local Storage Discovery");
         this.components.events.addEventListener("peer:identify", this.handleNewPeers);
         for (const { id: idStr, address } of this.peers) {
-            const peerId = await createFromJSON({ id: idStr });
+            const peerId = peerIdFromString(idStr);
             if (await this.components.peerStore.has(peerId))
                 continue;
             await this.components.peerStore.save(peerId, {