@yeying-community/web3-bs 1.0.4 → 1.0.6

package/dist/web3-bs.esm.js

@@ -193,12 +193,12 @@ function onChainChanged(provider, handler) {
     return () => provider.removeListener?.('chainChanged', handler);
 }
 
-function normalizeBaseUrl$1(baseUrl) {
+function normalizeBaseUrl$2(baseUrl) {
     return baseUrl.replace(/\/+$/, '');
 }
-function joinUrl$1(baseUrl, path) {
+function joinUrl$2(baseUrl, path) {
     const trimmed = path.replace(/^\/+/, '');
-    return `${normalizeBaseUrl$1(baseUrl)}/${trimmed}`;
+    return `${normalizeBaseUrl$2(baseUrl)}/${trimmed}`;
 }
 const DEFAULT_TOKEN_KEY = 'authToken';
 let cachedAccessToken = null;
@@ -209,10 +209,10 @@ function resolveTokenKey(options) {
 function shouldStoreToken(options) {
     return options?.storeToken !== false;
 }
-function resolveFetcher(options) {
+function resolveFetcher$1(options) {
     return options?.fetcher || fetch;
 }
-function resolveCredentials(options) {
+function resolveCredentials$1(options) {
     return options?.credentials ?? 'include';
 }
 function readStoredToken(options) {
@@ -352,11 +352,11 @@ async function signMessage(options) {
 async function loginWithChallenge(options = {}) {
     const provider = options.provider || (await requireProvider());
     const address = await resolveAddress$1(provider, options.address);
-    const fetcher = resolveFetcher(options);
-    const credentials = resolveCredentials(options);
+    const fetcher = resolveFetcher$1(options);
+    const credentials = resolveCredentials$1(options);
     const baseUrl = options.baseUrl || '/api/v1/public/auth';
-    const challengeUrl = joinUrl$1(baseUrl, options.challengePath || 'challenge');
-    const verifyUrl = joinUrl$1(baseUrl, options.verifyPath || 'verify');
+    const challengeUrl = joinUrl$2(baseUrl, options.challengePath || 'challenge');
+    const verifyUrl = joinUrl$2(baseUrl, options.verifyPath || 'verify');
     const challengeBody = {
         address,
     };
@@ -420,10 +420,10 @@ async function refreshAccessToken(options = {}) {
         return refreshInFlight;
     }
     const task = (async () => {
-        const fetcher = resolveFetcher(options);
-        const credentials = resolveCredentials(options);
+        const fetcher = resolveFetcher$1(options);
+        const credentials = resolveCredentials$1(options);
         const baseUrl = options.baseUrl || '/api/v1/public/auth';
-        const refreshUrl = joinUrl$1(baseUrl, options.refreshPath || 'refresh');
+        const refreshUrl = joinUrl$2(baseUrl, options.refreshPath || 'refresh');
         const refreshRes = await fetcher(refreshUrl, {
             method: 'POST',
             headers: {
@@ -452,10 +452,10 @@ async function refreshAccessToken(options = {}) {
     }
 }
 async function logout(options = {}) {
-    const fetcher = resolveFetcher(options);
-    const credentials = resolveCredentials(options);
+    const fetcher = resolveFetcher$1(options);
+    const credentials = resolveCredentials$1(options);
     const baseUrl = options.baseUrl || '/api/v1/public/auth';
-    const logoutUrl = joinUrl$1(baseUrl, options.logoutPath || 'logout');
+    const logoutUrl = joinUrl$2(baseUrl, options.logoutPath || 'logout');
     const logoutRes = await fetcher(logoutUrl, {
         method: 'POST',
         headers: {
@@ -478,8 +478,8 @@ async function logout(options = {}) {
     return { response: payload };
 }
 async function authFetch(input, init = {}, options = {}) {
-    const fetcher = resolveFetcher(options);
-    const credentials = resolveCredentials(options);
+    const fetcher = resolveFetcher$1(options);
+    const credentials = resolveCredentials$1(options);
     const retryOnUnauthorized = options.retryOnUnauthorized !== false;
     const performRequest = async (tokenOverride) => {
         const headers = new Headers(init.headers || {});
@@ -511,6 +511,8 @@ const DEFAULT_SESSION_TTL = 24 * 60 * 60 * 1000;
 const DEFAULT_UCAN_TTL = 5 * 60 * 1000;
 const DB_NAME = 'yeying-web3';
 const DB_STORE = 'ucan-sessions';
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const DID_KEY_ED25519_MULTICODEC = new Uint8Array([0xed, 0x01]);
 const textEncoder = new TextEncoder();
 function toBase64Url(data) {
     const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);
@@ -520,6 +522,70 @@ function toBase64Url(data) {
     }
     return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
+function normalizeActionExpression(raw) {
+    const normalized = String(raw || '').trim().toLowerCase().replace(/\|/g, ',');
+    if (!normalized)
+        return '';
+    const parts = normalized
+        .split(',')
+        .map(part => part.trim())
+        .filter(Boolean);
+    if (!parts.length)
+        return '';
+    return Array.from(new Set(parts)).join(',');
+}
+function getCapabilityResource(cap) {
+    if (!cap || typeof cap !== 'object')
+        return '';
+    const withValue = typeof cap.with === 'string' ? cap.with.trim() : '';
+    if (withValue)
+        return withValue;
+    return typeof cap.resource === 'string' ? cap.resource.trim() : '';
+}
+function getCapabilityAction(cap) {
+    if (!cap || typeof cap !== 'object')
+        return '';
+    const canValue = typeof cap.can === 'string' ? cap.can.trim() : '';
+    if (canValue)
+        return normalizeActionExpression(canValue);
+    const actionValue = typeof cap.action === 'string' ? cap.action.trim() : '';
+    return normalizeActionExpression(actionValue);
+}
+function normalizeUcanCapability(cap, options = {}) {
+    const includeLegacyAliases = options.includeLegacyAliases !== false;
+    const resource = getCapabilityResource(cap);
+    const action = getCapabilityAction(cap);
+    if (!resource || !action)
+        return null;
+    const normalized = {
+        with: resource,
+        can: action,
+    };
+    if (includeLegacyAliases) {
+        normalized.resource = resource;
+        normalized.action = action;
+    }
+    if (cap && Object.prototype.hasOwnProperty.call(cap, 'nb')) {
+        normalized.nb = cap.nb;
+    }
+    return normalized;
+}
+function normalizeUcanCapabilities(caps, options = {}) {
+    const includeLegacyAliases = options.includeLegacyAliases !== false;
+    const seen = new Set();
+    const result = [];
+    for (const cap of caps || []) {
+        const normalized = normalizeUcanCapability(cap, { includeLegacyAliases });
+        if (!normalized)
+            continue;
+        const key = `${normalized.with}|${normalized.can}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(normalized);
+    }
+    return result;
+}
 function encodeJson(value) {
     return toBase64Url(textEncoder.encode(JSON.stringify(value)));
 }
@@ -533,6 +599,123 @@ function randomNonce(bytes = 16) {
 function normalizeExpiry(exp, fallbackMs) {
     return Date.now() + fallbackMs;
 }
+function isSessionExpired(expiresAt, nowMs = Date.now()) {
+    return typeof expiresAt === 'number' && nowMs >= expiresAt;
+}
+function encodeBase58(bytes) {
+    if (bytes.length === 0)
+        return '';
+    let value = 0n;
+    for (const byte of bytes) {
+        value = (value << 8n) + BigInt(byte);
+    }
+    let encoded = '';
+    while (value > 0n) {
+        const mod = Number(value % 58n);
+        encoded = `${BASE58_ALPHABET[mod]}${encoded}`;
+        value /= 58n;
+    }
+    let leadingZeroCount = 0;
+    while (leadingZeroCount < bytes.length && bytes[leadingZeroCount] === 0) {
+        leadingZeroCount += 1;
+    }
+    if (leadingZeroCount > 0) {
+        encoded = `${'1'.repeat(leadingZeroCount)}${encoded}`;
+    }
+    return encoded || '1';
+}
+function ensureWebCrypto() {
+    if (typeof crypto === 'undefined' || !crypto.subtle) {
+        throw new Error('WebCrypto not available for UCAN session');
+    }
+    return crypto;
+}
+function parseSessionId(options) {
+    return options.id || DEFAULT_SESSION_ID;
+}
+function isLocalSessionRecord(record) {
+    return Boolean(record?.source === 'local' || record?.privateKeyJwk);
+}
+async function buildDidKey(publicKey) {
+    const webCrypto = ensureWebCrypto();
+    const raw = new Uint8Array(await webCrypto.subtle.exportKey('raw', publicKey));
+    const prefixed = new Uint8Array(DID_KEY_ED25519_MULTICODEC.length + raw.length);
+    prefixed.set(DID_KEY_ED25519_MULTICODEC, 0);
+    prefixed.set(raw, DID_KEY_ED25519_MULTICODEC.length);
+    return `did:key:z${encodeBase58(prefixed)}`;
+}
+async function importLocalPrivateKey(privateKeyJwk) {
+    const webCrypto = ensureWebCrypto();
+    return await webCrypto.subtle.importKey('jwk', privateKeyJwk, 'Ed25519', true, ['sign']);
+}
+async function loadLocalSessionFromRecord(id, record) {
+    if (!record || !isLocalSessionRecord(record) || !record.privateKeyJwk) {
+        return null;
+    }
+    if (isSessionExpired(record.expiresAt)) {
+        await deleteSessionRecord(id);
+        return null;
+    }
+    try {
+        const privateKey = await importLocalPrivateKey(record.privateKeyJwk);
+        return {
+            id: record.id || id,
+            did: record.did,
+            createdAt: record.createdAt,
+            expiresAt: record.expiresAt,
+            source: 'local',
+            privateKey,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function shouldKeepRootForSession(root, did, nowMs) {
+    if (!root)
+        return false;
+    if (root.aud && root.aud !== did)
+        return false;
+    if (isRootExpired(root, nowMs))
+        return false;
+    return true;
+}
+async function createLocalSession(options, record) {
+    const webCrypto = ensureWebCrypto();
+    const sessionId = parseSessionId(options);
+    if (!options.forceNew) {
+        const existing = await loadLocalSessionFromRecord(sessionId, record);
+        if (existing)
+            return existing;
+    }
+    const pair = (await webCrypto.subtle.generateKey('Ed25519', true, ['sign', 'verify']));
+    const [privateKeyJwk, publicKeyJwk, did] = await Promise.all([
+        webCrypto.subtle.exportKey('jwk', pair.privateKey),
+        webCrypto.subtle.exportKey('jwk', pair.publicKey),
+        buildDidKey(pair.publicKey),
+    ]);
+    const createdAt = Date.now();
+    const expiresAt = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_SESSION_TTL);
+    const root = shouldKeepRootForSession(record?.root, did, createdAt) ? record?.root : undefined;
+    await writeSessionRecord({
+        id: sessionId,
+        did,
+        createdAt,
+        expiresAt,
+        source: 'local',
+        privateKeyJwk,
+        publicKeyJwk,
+        root,
+    });
+    return {
+        id: sessionId,
+        did,
+        createdAt,
+        expiresAt,
+        source: 'local',
+        privateKey: pair.privateKey,
+    };
+}
 function openDb() {
     if (typeof indexedDB === 'undefined') {
         return Promise.reject(new Error('IndexedDB not available'));
@@ -595,17 +778,19 @@ async function deleteSessionRecord(id) {
     }
 }
 async function getUcanSession(id = DEFAULT_SESSION_ID, provider) {
+    const record = await readSessionRecord(id);
     const walletProvider = provider || (typeof window !== 'undefined'
         ? await getProvider({ preferYeYing: true })
         : null);
-    if (!walletProvider)
-        return null;
-    try {
-        return await requestWalletUcanSession(walletProvider, { id });
-    }
-    catch {
-        return null;
+    if (walletProvider) {
+        try {
+            return await requestWalletUcanSession(walletProvider, { id });
+        }
+        catch {
+            return await loadLocalSessionFromRecord(id, record);
+        }
     }
+    return await loadLocalSessionFromRecord(id, record);
 }
 async function requestWalletUcanSession(provider, options) {
     const sessionId = options.id || DEFAULT_SESSION_ID;
@@ -630,6 +815,7 @@ async function requestWalletUcanSession(provider, options) {
         did: result.did,
         createdAt,
         expiresAt,
+        source: 'wallet',
         root: existing?.root,
     };
     if (nextRecord.root && nextRecord.root.aud && nextRecord.root.aud !== nextRecord.did) {
@@ -641,6 +827,7 @@ async function requestWalletUcanSession(provider, options) {
         did: result.did,
         createdAt,
         expiresAt,
+        source: 'wallet',
         signer: async (signingInput, payload) => {
             const signatureResult = (await provider.request({
                 method: 'yeying_ucan_sign',
@@ -663,13 +850,20 @@ async function requestWalletUcanSession(provider, options) {
     };
 }
 async function createUcanSession(options = {}) {
+    const sessionId = parseSessionId(options);
+    const record = await readSessionRecord(sessionId);
     const provider = options.provider || (typeof window !== 'undefined'
         ? await getProvider({ preferYeYing: true })
         : null);
-    if (!provider) {
-        throw new Error('No wallet provider for UCAN session');
+    if (provider) {
+        try {
+            return await requestWalletUcanSession(provider, { ...options, id: sessionId });
+        }
+        catch {
+            // fallback to local ed25519 session
+        }
     }
-    return await requestWalletUcanSession(provider, options);
+    return await createLocalSession({ ...options, id: sessionId }, record);
 }
 async function clearUcanSession(id = DEFAULT_SESSION_ID) {
     await deleteSessionRecord(id);
@@ -680,6 +874,7 @@ async function storeUcanRoot(root, id = DEFAULT_SESSION_ID) {
     const expiresAt = record?.expiresAt ?? null;
     const did = record?.did || root.aud;
     const nextRecord = {
+        ...(record || {}),
         id,
         did,
         createdAt,
@@ -693,7 +888,9 @@ async function getStoredUcanRoot(id = DEFAULT_SESSION_ID) {
     return record?.root || null;
 }
 function capsEqual(a, b) {
-    return JSON.stringify(a || []) === JSON.stringify(b || []);
+    const left = normalizeUcanCapabilities(a, { includeLegacyAliases: false });
+    const right = normalizeUcanCapabilities(b, { includeLegacyAliases: false });
+    return JSON.stringify(left) === JSON.stringify(right);
 }
 function isRootExpired(root, nowMs) {
     return Boolean(root.exp && nowMs > root.exp);
@@ -768,9 +965,13 @@ async function createRootUcan(options) {
     const nonce = options.nonce || randomNonce(8);
     const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_SESSION_TTL);
     const nbf = options.notBeforeMs;
+    const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+    if (!normalizedCapabilities.length) {
+        throw new Error('Missing UCAN capabilities');
+    }
     const statementPayload = {
         aud: session.did,
-        cap: options.capabilities,
+        cap: normalizedCapabilities,
         exp,
     };
     if (nbf)
@@ -793,7 +994,7 @@ async function createRootUcan(options) {
         type: 'siwe',
         iss: `did:pkh:eth:${address.toLowerCase()}`,
         aud: session.did,
-        cap: options.capabilities,
+        cap: normalizedCapabilities,
         exp,
         nbf,
         siwe: {
@@ -842,11 +1043,15 @@ async function createDelegationUcan(options) {
     }));
     if (!issuer)
         throw new Error('Missing UCAN session key');
+    const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+    if (!normalizedCapabilities.length) {
+        throw new Error('Missing UCAN capabilities');
+    }
     const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TTL);
     const payload = {
         iss: issuer.did,
         aud: options.audience,
-        cap: options.capabilities,
+        cap: normalizedCapabilities,
         exp,
         nbf: options.notBeforeMs,
         prf: await resolveProofs(options, issuer),
@@ -860,11 +1065,15 @@ async function createInvocationUcan(options) {
     }));
     if (!issuer)
         throw new Error('Missing UCAN session key');
+    const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+    if (!normalizedCapabilities.length) {
+        throw new Error('Missing UCAN capabilities');
+    }
     const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TTL);
     const payload = {
         iss: issuer.did,
         aud: options.audience,
-        cap: options.capabilities,
+        cap: normalizedCapabilities,
         exp,
         nbf: options.notBeforeMs,
         prf: await resolveProofs(options, issuer),
@@ -897,6 +1106,291 @@ async function authUcanFetch(input, init = {}, options = {}) {
     });
 }
 
+const DEFAULT_BASE_URL = '/api/v1/public/auth/central';
+const DEFAULT_ISSUER_PATH = 'issuer';
+const DEFAULT_SESSION_PATH = 'session';
+const DEFAULT_ISSUE_PATH = 'issue';
+const DEFAULT_SESSION_TOKEN_KEY = 'centralUcanSessionToken';
+let cachedCentralSessionToken = null;
+function normalizeBaseUrl$1(baseUrl) {
+    return baseUrl.replace(/\/+$/, '');
+}
+function joinUrl$1(baseUrl, path) {
+    const trimmed = path.replace(/^\/+/, '');
+    return `${normalizeBaseUrl$1(baseUrl)}/${trimmed}`;
+}
+function resolveBaseUrl(options) {
+    return options?.baseUrl || DEFAULT_BASE_URL;
+}
+function resolveFetcher(options) {
+    return options?.fetcher || fetch;
+}
+function resolveCredentials(options) {
+    return options?.credentials ?? 'include';
+}
+function resolveSessionTokenKey(options) {
+    return options?.sessionTokenStorageKey || DEFAULT_SESSION_TOKEN_KEY;
+}
+function shouldStoreSessionToken(options) {
+    return options?.storeSessionToken !== false;
+}
+function parseObject(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return {};
+    }
+    return value;
+}
+function parseEnvelopeData(payload) {
+    const root = parseObject(payload);
+    if (Object.prototype.hasOwnProperty.call(root, 'data')) {
+        return parseObject(root.data);
+    }
+    return root;
+}
+function parseStringField(obj, keys) {
+    for (const key of keys) {
+        const value = obj[key];
+        if (typeof value === 'string') {
+            return value;
+        }
+    }
+    return undefined;
+}
+function parseNumberField(obj, keys) {
+    for (const key of keys) {
+        const value = obj[key];
+        if (typeof value === 'number' && Number.isFinite(value)) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function parseCapabilitiesField(obj, keys) {
+    for (const key of keys) {
+        const value = obj[key];
+        if (!Array.isArray(value))
+            continue;
+        const caps = value
+            .filter(item => item && typeof item === 'object')
+            .map(item => normalizeUcanCapability(item))
+            .filter((cap) => Boolean(cap));
+        return caps;
+    }
+    return undefined;
+}
+function readStoredSessionToken(options) {
+    if (!shouldStoreSessionToken(options))
+        return null;
+    if (typeof localStorage === 'undefined')
+        return null;
+    const key = resolveSessionTokenKey(options);
+    return localStorage.getItem(key);
+}
+function persistSessionToken(token, options) {
+    cachedCentralSessionToken = token;
+    if (!shouldStoreSessionToken(options))
+        return;
+    if (typeof localStorage === 'undefined')
+        return;
+    const key = resolveSessionTokenKey(options);
+    if (!token) {
+        localStorage.removeItem(key);
+    }
+    else {
+        localStorage.setItem(key, token);
+    }
+}
+async function parseJsonBody(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { raw: text };
+    }
+}
+function getCentralSessionToken(options) {
+    if (cachedCentralSessionToken)
+        return cachedCentralSessionToken;
+    const stored = readStoredSessionToken(options);
+    if (stored) {
+        cachedCentralSessionToken = stored;
+    }
+    return stored;
+}
+function setCentralSessionToken(token, options) {
+    persistSessionToken(token, options);
+}
+function clearCentralSessionToken(options) {
+    cachedCentralSessionToken = null;
+    if (typeof localStorage === 'undefined')
+        return;
+    const key = resolveSessionTokenKey(options);
+    localStorage.removeItem(key);
+}
+async function getCentralIssuerInfo(options = {}) {
+    const fetcher = resolveFetcher(options);
+    const credentials = resolveCredentials(options);
+    const url = joinUrl$1(resolveBaseUrl(options), options.issuerPath || DEFAULT_ISSUER_PATH);
+    const response = await fetcher(url, {
+        method: 'GET',
+        headers: {
+            accept: 'application/json',
+        },
+        credentials,
+    });
+    const payload = await parseJsonBody(response);
+    if (!response.ok) {
+        throw new Error(`Central issuer request failed: ${response.status} ${JSON.stringify(payload)}`);
+    }
+    const data = parseEnvelopeData(payload);
+    return {
+        enabled: typeof data.enabled === 'boolean' ? data.enabled : undefined,
+        issuerDid: parseStringField(data, ['issuerDid']),
+        defaultAudience: parseStringField(data, ['defaultAudience']),
+        defaultCapabilities: parseCapabilitiesField(data, ['defaultCapabilities']),
+        response: payload,
+    };
+}
+async function createCentralSession(options) {
+    const subject = String(options?.subject || '').trim();
+    if (!subject) {
+        throw new Error('Missing subject');
+    }
+    const fetcher = resolveFetcher(options);
+    const credentials = resolveCredentials(options);
+    const url = joinUrl$1(resolveBaseUrl(options), options.sessionPath || DEFAULT_SESSION_PATH);
+    const response = await fetcher(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            accept: 'application/json',
+        },
+        credentials,
+        body: JSON.stringify({
+            subject,
+            sessionTtlMs: options.sessionTtlMs,
+        }),
+    });
+    const payload = await parseJsonBody(response);
+    if (!response.ok) {
+        throw new Error(`Central session request failed: ${response.status} ${JSON.stringify(payload)}`);
+    }
+    const data = parseEnvelopeData(payload);
+    const sessionToken = parseStringField(data, ['sessionToken']);
+    if (!sessionToken) {
+        throw new Error('Central session response missing sessionToken');
+    }
+    persistSessionToken(sessionToken, options);
+    return {
+        subject: parseStringField(data, ['subject']) || subject,
+        sessionToken,
+        expiresAt: parseNumberField(data, ['expiresAt']),
+        issuerDid: parseStringField(data, ['issuerDid']),
+        response: payload,
+    };
+}
+async function issueCentralUcan(options = {}) {
+    const sessionToken = options.sessionToken || getCentralSessionToken(options);
+    if (!sessionToken) {
+        throw new Error('Missing central session token');
+    }
+    const normalizedCapabilities = options.capabilities
+        ? normalizeUcanCapabilities(options.capabilities)
+        : undefined;
+    const fetcher = resolveFetcher(options);
+    const credentials = resolveCredentials(options);
+    const url = joinUrl$1(resolveBaseUrl(options), options.issuePath || DEFAULT_ISSUE_PATH);
+    const response = await fetcher(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            accept: 'application/json',
+            Authorization: `Bearer ${sessionToken}`,
+        },
+        credentials,
+        body: JSON.stringify({
+            audience: options.audience,
+            capabilities: normalizedCapabilities,
+            expiresInMs: options.expiresInMs,
+            ttlMs: options.ttlMs,
+        }),
+    });
+    const payload = await parseJsonBody(response);
+    if (!response.ok) {
+        throw new Error(`Central UCAN issue failed: ${response.status} ${JSON.stringify(payload)}`);
+    }
+    const data = parseEnvelopeData(payload);
+    const ucan = parseStringField(data, ['ucan']);
+    if (!ucan) {
+        throw new Error('Central UCAN response missing ucan');
+    }
+    return {
+        ucan,
+        issuerDid: parseStringField(data, ['issuerDid']),
+        subject: parseStringField(data, ['subject']),
+        audience: parseStringField(data, ['audience']),
+        capabilities: parseCapabilitiesField(data, ['capabilities']),
+        exp: parseNumberField(data, ['exp']),
+        nbf: parseNumberField(data, ['nbf']),
+        iat: parseNumberField(data, ['iat']),
+        response: payload,
+    };
+}
+async function createAndIssueCentralUcan(options) {
+    const session = await createCentralSession({
+        ...options,
+        subject: options.subject,
+        sessionTtlMs: options.sessionTtlMs,
+    });
+    const issue = await issueCentralUcan({
+        ...options,
+        sessionToken: session.sessionToken,
+        audience: options.audience,
+        capabilities: options.capabilities,
+        expiresInMs: options.expiresInMs,
+        ttlMs: options.ttlMs,
+    });
+    return { session, issue };
+}
+async function authCentralUcanFetch(input, init = {}, options = {}) {
+    const fetcher = resolveFetcher(options);
+    const credentials = resolveCredentials(options);
+    let token = options.ucan || null;
+    if (!token) {
+        let sessionToken = options.sessionToken || getCentralSessionToken(options);
+        if (!sessionToken) {
+            if (!options.subject) {
+                throw new Error('Missing central session token or subject');
+            }
+            const session = await createCentralSession({
+                ...options,
+                subject: options.subject,
+                sessionTtlMs: options.sessionTtlMs,
+            });
+            sessionToken = session.sessionToken;
+        }
+        const issued = await issueCentralUcan({
+            ...options,
+            sessionToken,
+            audience: options.audience,
+            capabilities: options.capabilities,
+            expiresInMs: options.expiresInMs,
+            ttlMs: options.ttlMs,
+        });
+        token = issued.ucan;
+    }
+    const headers = new Headers(init.headers || {});
+    headers.set('Authorization', `Bearer ${token}`);
+    return fetcher(input, {
+        ...init,
+        headers,
+        credentials,
+    });
+}
+
 function normalizeBaseUrl(baseUrl) {
     return baseUrl.replace(/\/+$/, '');
 }
@@ -1113,6 +1607,7 @@ function createWebDavClient(options) {
 
 const tokenCache = new Map();
 const TOKEN_SKEW_MS = 5000;
+const DEFAULT_APP_ACTION = 'write';
 function normalizeAppDir(path) {
     const trimmed = path.trim();
     if (!trimmed)
@@ -1124,6 +1619,36 @@ function normalizeAppDir(path) {
 function sanitizeAppId(appId) {
     return appId.trim().replace(/[^a-zA-Z0-9._-]/g, '-');
 }
+function normalizeAction(action) {
+    const trimmed = (action || '').trim();
+    return trimmed ? trimmed : null;
+}
+function buildAppCapability(options) {
+    if (!options.appId)
+        return null;
+    const action = normalizeAction(options.appAction) || DEFAULT_APP_ACTION;
+    const resource = `app:all:${sanitizeAppId(options.appId)}`;
+    return {
+        with: resource,
+        can: action,
+        resource,
+        action,
+    };
+}
+function hasAppCapability(caps) {
+    return (caps || []).some(cap => getCapabilityResource(cap).startsWith('app:'));
+}
+function dedupeCapabilities(caps) {
+    return normalizeUcanCapabilities(caps);
+}
+function ensureAppCapability(caps, options) {
+    const appCap = buildAppCapability(options);
+    if (!appCap)
+        return caps || [];
+    if (hasAppCapability(caps || []))
+        return caps || [];
+    return dedupeCapabilities([...(caps || []), appCap]);
+}
 function resolveAppDir(options) {
     if (options.appDir) {
         return normalizeAppDir(options.appDir);
@@ -1134,11 +1659,25 @@ function resolveAppDir(options) {
     return undefined;
 }
 function buildCapsKey(caps) {
-    return JSON.stringify(caps || []);
+    const canonical = (caps || [])
+        .map(cap => ({
+        with: getCapabilityResource(cap),
+        can: getCapabilityAction(cap),
+    }))
+        .filter(cap => Boolean(cap.with && cap.can));
+    return JSON.stringify(canonical);
 }
 function buildTokenCacheKey(issuer, audience, caps) {
     return `${issuer.did}|${audience}|${buildCapsKey(caps)}`;
 }
+function resolveWebdavCaps(options) {
+    const baseCaps = options.capabilities || options.root?.cap || [];
+    return ensureAppCapability(baseCaps, options);
+}
+function resolveInvocationCaps(options, fallbackCaps) {
+    const caps = options.invocationCapabilities || fallbackCaps;
+    return ensureAppCapability(caps, options);
+}
 function isTokenValid(entry, nowMs) {
     if (!entry.exp)
         return false;
@@ -1210,7 +1749,7 @@ async function getCachedInvocationToken(options) {
     return token;
 }
 async function initWebDavStorage(options) {
-    const caps = options.capabilities || options.root?.cap;
+    const caps = resolveWebdavCaps(options);
     if (!caps || caps.length === 0) {
         throw new Error('Missing UCAN capabilities for WebDAV');
     }
@@ -1240,7 +1779,7 @@ async function initWebDavStorage(options) {
             expiresInMs: options.rootExpiresInMs,
         });
     }
-    const invocationCaps = options.invocationCapabilities || caps;
+    const invocationCaps = resolveInvocationCaps(options, caps);
     const token = await getCachedInvocationToken({
         issuer: session,
         audience: options.audience,
@@ -1303,5 +1842,5 @@ async function initDappSession(options) {
     return result;
 }
 
-export { WebDavClient, authFetch, authUcanFetch, clearAccessToken, clearUcanSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, getAccessToken, getAccounts, getBalance, getChainId, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getUcanSession, initDappSession, initWebDavStorage, isYeYingProvider, loginWithChallenge, logout, onAccountsChanged, onChainChanged, refreshAccessToken, requestAccounts, requireProvider, setAccessToken, signMessage, storeUcanRoot, watchAccounts };
+export { WebDavClient, authCentralUcanFetch, authFetch, authUcanFetch, clearAccessToken, clearCentralSessionToken, clearUcanSession, createAndIssueCentralUcan, createCentralSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, getAccessToken, getAccounts, getBalance, getCapabilityAction, getCapabilityResource, getCentralIssuerInfo, getCentralSessionToken, getChainId, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getUcanSession, initDappSession, initWebDavStorage, isYeYingProvider, issueCentralUcan, loginWithChallenge, logout, normalizeUcanCapabilities, normalizeUcanCapability, onAccountsChanged, onChainChanged, refreshAccessToken, requestAccounts, requireProvider, setAccessToken, setCentralSessionToken, signMessage, storeUcanRoot, watchAccounts };
 //# sourceMappingURL=web3-bs.esm.js.map