@yeying-community/web3-bs 1.0.4 → 1.0.6

package/dist/web3-bs.umd.js

@@ -199,12 +199,12 @@
         return () => provider.removeListener?.('chainChanged', handler);
     }
 
-    function normalizeBaseUrl$1(baseUrl) {
+    function normalizeBaseUrl$2(baseUrl) {
         return baseUrl.replace(/\/+$/, '');
     }
-    function joinUrl$1(baseUrl, path) {
+    function joinUrl$2(baseUrl, path) {
         const trimmed = path.replace(/^\/+/, '');
-        return `${normalizeBaseUrl$1(baseUrl)}/${trimmed}`;
+        return `${normalizeBaseUrl$2(baseUrl)}/${trimmed}`;
     }
     const DEFAULT_TOKEN_KEY = 'authToken';
     let cachedAccessToken = null;
@@ -215,10 +215,10 @@
     function shouldStoreToken(options) {
         return options?.storeToken !== false;
     }
-    function resolveFetcher(options) {
+    function resolveFetcher$1(options) {
         return options?.fetcher || fetch;
     }
-    function resolveCredentials(options) {
+    function resolveCredentials$1(options) {
         return options?.credentials ?? 'include';
     }
     function readStoredToken(options) {
@@ -358,11 +358,11 @@
     async function loginWithChallenge(options = {}) {
         const provider = options.provider || (await requireProvider());
         const address = await resolveAddress$1(provider, options.address);
-        const fetcher = resolveFetcher(options);
-        const credentials = resolveCredentials(options);
+        const fetcher = resolveFetcher$1(options);
+        const credentials = resolveCredentials$1(options);
         const baseUrl = options.baseUrl || '/api/v1/public/auth';
-        const challengeUrl = joinUrl$1(baseUrl, options.challengePath || 'challenge');
-        const verifyUrl = joinUrl$1(baseUrl, options.verifyPath || 'verify');
+        const challengeUrl = joinUrl$2(baseUrl, options.challengePath || 'challenge');
+        const verifyUrl = joinUrl$2(baseUrl, options.verifyPath || 'verify');
         const challengeBody = {
             address,
         };
@@ -426,10 +426,10 @@
             return refreshInFlight;
         }
         const task = (async () => {
-            const fetcher = resolveFetcher(options);
-            const credentials = resolveCredentials(options);
+            const fetcher = resolveFetcher$1(options);
+            const credentials = resolveCredentials$1(options);
             const baseUrl = options.baseUrl || '/api/v1/public/auth';
-            const refreshUrl = joinUrl$1(baseUrl, options.refreshPath || 'refresh');
+            const refreshUrl = joinUrl$2(baseUrl, options.refreshPath || 'refresh');
             const refreshRes = await fetcher(refreshUrl, {
                 method: 'POST',
                 headers: {
@@ -458,10 +458,10 @@
         }
     }
     async function logout(options = {}) {
-        const fetcher = resolveFetcher(options);
-        const credentials = resolveCredentials(options);
+        const fetcher = resolveFetcher$1(options);
+        const credentials = resolveCredentials$1(options);
         const baseUrl = options.baseUrl || '/api/v1/public/auth';
-        const logoutUrl = joinUrl$1(baseUrl, options.logoutPath || 'logout');
+        const logoutUrl = joinUrl$2(baseUrl, options.logoutPath || 'logout');
         const logoutRes = await fetcher(logoutUrl, {
             method: 'POST',
             headers: {
@@ -484,8 +484,8 @@
         return { response: payload };
     }
     async function authFetch(input, init = {}, options = {}) {
-        const fetcher = resolveFetcher(options);
-        const credentials = resolveCredentials(options);
+        const fetcher = resolveFetcher$1(options);
+        const credentials = resolveCredentials$1(options);
         const retryOnUnauthorized = options.retryOnUnauthorized !== false;
         const performRequest = async (tokenOverride) => {
             const headers = new Headers(init.headers || {});
@@ -517,6 +517,8 @@
     const DEFAULT_UCAN_TTL = 5 * 60 * 1000;
     const DB_NAME = 'yeying-web3';
     const DB_STORE = 'ucan-sessions';
+    const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+    const DID_KEY_ED25519_MULTICODEC = new Uint8Array([0xed, 0x01]);
     const textEncoder = new TextEncoder();
     function toBase64Url(data) {
         const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);
@@ -526,6 +528,70 @@
         }
         return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
     }
+    function normalizeActionExpression(raw) {
+        const normalized = String(raw || '').trim().toLowerCase().replace(/\|/g, ',');
+        if (!normalized)
+            return '';
+        const parts = normalized
+            .split(',')
+            .map(part => part.trim())
+            .filter(Boolean);
+        if (!parts.length)
+            return '';
+        return Array.from(new Set(parts)).join(',');
+    }
+    function getCapabilityResource(cap) {
+        if (!cap || typeof cap !== 'object')
+            return '';
+        const withValue = typeof cap.with === 'string' ? cap.with.trim() : '';
+        if (withValue)
+            return withValue;
+        return typeof cap.resource === 'string' ? cap.resource.trim() : '';
+    }
+    function getCapabilityAction(cap) {
+        if (!cap || typeof cap !== 'object')
+            return '';
+        const canValue = typeof cap.can === 'string' ? cap.can.trim() : '';
+        if (canValue)
+            return normalizeActionExpression(canValue);
+        const actionValue = typeof cap.action === 'string' ? cap.action.trim() : '';
+        return normalizeActionExpression(actionValue);
+    }
+    function normalizeUcanCapability(cap, options = {}) {
+        const includeLegacyAliases = options.includeLegacyAliases !== false;
+        const resource = getCapabilityResource(cap);
+        const action = getCapabilityAction(cap);
+        if (!resource || !action)
+            return null;
+        const normalized = {
+            with: resource,
+            can: action,
+        };
+        if (includeLegacyAliases) {
+            normalized.resource = resource;
+            normalized.action = action;
+        }
+        if (cap && Object.prototype.hasOwnProperty.call(cap, 'nb')) {
+            normalized.nb = cap.nb;
+        }
+        return normalized;
+    }
+    function normalizeUcanCapabilities(caps, options = {}) {
+        const includeLegacyAliases = options.includeLegacyAliases !== false;
+        const seen = new Set();
+        const result = [];
+        for (const cap of caps || []) {
+            const normalized = normalizeUcanCapability(cap, { includeLegacyAliases });
+            if (!normalized)
+                continue;
+            const key = `${normalized.with}|${normalized.can}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            result.push(normalized);
+        }
+        return result;
+    }
     function encodeJson(value) {
         return toBase64Url(textEncoder.encode(JSON.stringify(value)));
     }
@@ -539,6 +605,123 @@
     function normalizeExpiry(exp, fallbackMs) {
         return Date.now() + fallbackMs;
     }
+    function isSessionExpired(expiresAt, nowMs = Date.now()) {
+        return typeof expiresAt === 'number' && nowMs >= expiresAt;
+    }
+    function encodeBase58(bytes) {
+        if (bytes.length === 0)
+            return '';
+        let value = 0n;
+        for (const byte of bytes) {
+            value = (value << 8n) + BigInt(byte);
+        }
+        let encoded = '';
+        while (value > 0n) {
+            const mod = Number(value % 58n);
+            encoded = `${BASE58_ALPHABET[mod]}${encoded}`;
+            value /= 58n;
+        }
+        let leadingZeroCount = 0;
+        while (leadingZeroCount < bytes.length && bytes[leadingZeroCount] === 0) {
+            leadingZeroCount += 1;
+        }
+        if (leadingZeroCount > 0) {
+            encoded = `${'1'.repeat(leadingZeroCount)}${encoded}`;
+        }
+        return encoded || '1';
+    }
+    function ensureWebCrypto() {
+        if (typeof crypto === 'undefined' || !crypto.subtle) {
+            throw new Error('WebCrypto not available for UCAN session');
+        }
+        return crypto;
+    }
+    function parseSessionId(options) {
+        return options.id || DEFAULT_SESSION_ID;
+    }
+    function isLocalSessionRecord(record) {
+        return Boolean(record?.source === 'local' || record?.privateKeyJwk);
+    }
+    async function buildDidKey(publicKey) {
+        const webCrypto = ensureWebCrypto();
+        const raw = new Uint8Array(await webCrypto.subtle.exportKey('raw', publicKey));
+        const prefixed = new Uint8Array(DID_KEY_ED25519_MULTICODEC.length + raw.length);
+        prefixed.set(DID_KEY_ED25519_MULTICODEC, 0);
+        prefixed.set(raw, DID_KEY_ED25519_MULTICODEC.length);
+        return `did:key:z${encodeBase58(prefixed)}`;
+    }
+    async function importLocalPrivateKey(privateKeyJwk) {
+        const webCrypto = ensureWebCrypto();
+        return await webCrypto.subtle.importKey('jwk', privateKeyJwk, 'Ed25519', true, ['sign']);
+    }
+    async function loadLocalSessionFromRecord(id, record) {
+        if (!record || !isLocalSessionRecord(record) || !record.privateKeyJwk) {
+            return null;
+        }
+        if (isSessionExpired(record.expiresAt)) {
+            await deleteSessionRecord(id);
+            return null;
+        }
+        try {
+            const privateKey = await importLocalPrivateKey(record.privateKeyJwk);
+            return {
+                id: record.id || id,
+                did: record.did,
+                createdAt: record.createdAt,
+                expiresAt: record.expiresAt,
+                source: 'local',
+                privateKey,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    function shouldKeepRootForSession(root, did, nowMs) {
+        if (!root)
+            return false;
+        if (root.aud && root.aud !== did)
+            return false;
+        if (isRootExpired(root, nowMs))
+            return false;
+        return true;
+    }
+    async function createLocalSession(options, record) {
+        const webCrypto = ensureWebCrypto();
+        const sessionId = parseSessionId(options);
+        if (!options.forceNew) {
+            const existing = await loadLocalSessionFromRecord(sessionId, record);
+            if (existing)
+                return existing;
+        }
+        const pair = (await webCrypto.subtle.generateKey('Ed25519', true, ['sign', 'verify']));
+        const [privateKeyJwk, publicKeyJwk, did] = await Promise.all([
+            webCrypto.subtle.exportKey('jwk', pair.privateKey),
+            webCrypto.subtle.exportKey('jwk', pair.publicKey),
+            buildDidKey(pair.publicKey),
+        ]);
+        const createdAt = Date.now();
+        const expiresAt = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_SESSION_TTL);
+        const root = shouldKeepRootForSession(record?.root, did, createdAt) ? record?.root : undefined;
+        await writeSessionRecord({
+            id: sessionId,
+            did,
+            createdAt,
+            expiresAt,
+            source: 'local',
+            privateKeyJwk,
+            publicKeyJwk,
+            root,
+        });
+        return {
+            id: sessionId,
+            did,
+            createdAt,
+            expiresAt,
+            source: 'local',
+            privateKey: pair.privateKey,
+        };
+    }
     function openDb() {
         if (typeof indexedDB === 'undefined') {
             return Promise.reject(new Error('IndexedDB not available'));
@@ -601,17 +784,19 @@
         }
     }
     async function getUcanSession(id = DEFAULT_SESSION_ID, provider) {
+        const record = await readSessionRecord(id);
         const walletProvider = provider || (typeof window !== 'undefined'
             ? await getProvider({ preferYeYing: true })
             : null);
-        if (!walletProvider)
-            return null;
-        try {
-            return await requestWalletUcanSession(walletProvider, { id });
-        }
-        catch {
-            return null;
+        if (walletProvider) {
+            try {
+                return await requestWalletUcanSession(walletProvider, { id });
+            }
+            catch {
+                return await loadLocalSessionFromRecord(id, record);
+            }
         }
+        return await loadLocalSessionFromRecord(id, record);
     }
     async function requestWalletUcanSession(provider, options) {
         const sessionId = options.id || DEFAULT_SESSION_ID;
@@ -636,6 +821,7 @@
             did: result.did,
             createdAt,
             expiresAt,
+            source: 'wallet',
             root: existing?.root,
         };
         if (nextRecord.root && nextRecord.root.aud && nextRecord.root.aud !== nextRecord.did) {
@@ -647,6 +833,7 @@
             did: result.did,
             createdAt,
             expiresAt,
+            source: 'wallet',
             signer: async (signingInput, payload) => {
                 const signatureResult = (await provider.request({
                     method: 'yeying_ucan_sign',
@@ -669,13 +856,20 @@
         };
     }
     async function createUcanSession(options = {}) {
+        const sessionId = parseSessionId(options);
+        const record = await readSessionRecord(sessionId);
         const provider = options.provider || (typeof window !== 'undefined'
             ? await getProvider({ preferYeYing: true })
             : null);
-        if (!provider) {
-            throw new Error('No wallet provider for UCAN session');
+        if (provider) {
+            try {
+                return await requestWalletUcanSession(provider, { ...options, id: sessionId });
+            }
+            catch {
+                // fallback to local ed25519 session
+            }
         }
-        return await requestWalletUcanSession(provider, options);
+        return await createLocalSession({ ...options, id: sessionId }, record);
     }
     async function clearUcanSession(id = DEFAULT_SESSION_ID) {
         await deleteSessionRecord(id);
@@ -686,6 +880,7 @@
         const expiresAt = record?.expiresAt ?? null;
         const did = record?.did || root.aud;
         const nextRecord = {
+            ...(record || {}),
             id,
             did,
             createdAt,
@@ -699,7 +894,9 @@
         return record?.root || null;
     }
     function capsEqual(a, b) {
-        return JSON.stringify(a || []) === JSON.stringify(b || []);
+        const left = normalizeUcanCapabilities(a, { includeLegacyAliases: false });
+        const right = normalizeUcanCapabilities(b, { includeLegacyAliases: false });
+        return JSON.stringify(left) === JSON.stringify(right);
     }
     function isRootExpired(root, nowMs) {
         return Boolean(root.exp && nowMs > root.exp);
@@ -774,9 +971,13 @@
         const nonce = options.nonce || randomNonce(8);
         const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_SESSION_TTL);
         const nbf = options.notBeforeMs;
+        const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+        if (!normalizedCapabilities.length) {
+            throw new Error('Missing UCAN capabilities');
+        }
         const statementPayload = {
             aud: session.did,
-            cap: options.capabilities,
+            cap: normalizedCapabilities,
             exp,
         };
         if (nbf)
@@ -799,7 +1000,7 @@
             type: 'siwe',
             iss: `did:pkh:eth:${address.toLowerCase()}`,
             aud: session.did,
-            cap: options.capabilities,
+            cap: normalizedCapabilities,
             exp,
             nbf,
             siwe: {
@@ -848,11 +1049,15 @@
         }));
         if (!issuer)
             throw new Error('Missing UCAN session key');
+        const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+        if (!normalizedCapabilities.length) {
+            throw new Error('Missing UCAN capabilities');
+        }
         const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TTL);
         const payload = {
             iss: issuer.did,
             aud: options.audience,
-            cap: options.capabilities,
+            cap: normalizedCapabilities,
             exp,
             nbf: options.notBeforeMs,
             prf: await resolveProofs(options, issuer),
@@ -866,11 +1071,15 @@
         }));
         if (!issuer)
             throw new Error('Missing UCAN session key');
+        const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+        if (!normalizedCapabilities.length) {
+            throw new Error('Missing UCAN capabilities');
+        }
         const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TTL);
         const payload = {
             iss: issuer.did,
             aud: options.audience,
-            cap: options.capabilities,
+            cap: normalizedCapabilities,
             exp,
             nbf: options.notBeforeMs,
             prf: await resolveProofs(options, issuer),
@@ -903,6 +1112,291 @@
         });
     }
 
+    const DEFAULT_BASE_URL = '/api/v1/public/auth/central';
+    const DEFAULT_ISSUER_PATH = 'issuer';
+    const DEFAULT_SESSION_PATH = 'session';
+    const DEFAULT_ISSUE_PATH = 'issue';
+    const DEFAULT_SESSION_TOKEN_KEY = 'centralUcanSessionToken';
+    let cachedCentralSessionToken = null;
+    function normalizeBaseUrl$1(baseUrl) {
+        return baseUrl.replace(/\/+$/, '');
+    }
+    function joinUrl$1(baseUrl, path) {
+        const trimmed = path.replace(/^\/+/, '');
+        return `${normalizeBaseUrl$1(baseUrl)}/${trimmed}`;
+    }
+    function resolveBaseUrl(options) {
+        return options?.baseUrl || DEFAULT_BASE_URL;
+    }
+    function resolveFetcher(options) {
+        return options?.fetcher || fetch;
+    }
+    function resolveCredentials(options) {
+        return options?.credentials ?? 'include';
+    }
+    function resolveSessionTokenKey(options) {
+        return options?.sessionTokenStorageKey || DEFAULT_SESSION_TOKEN_KEY;
+    }
+    function shouldStoreSessionToken(options) {
+        return options?.storeSessionToken !== false;
+    }
+    function parseObject(value) {
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+            return {};
+        }
+        return value;
+    }
+    function parseEnvelopeData(payload) {
+        const root = parseObject(payload);
+        if (Object.prototype.hasOwnProperty.call(root, 'data')) {
+            return parseObject(root.data);
+        }
+        return root;
+    }
+    function parseStringField(obj, keys) {
+        for (const key of keys) {
+            const value = obj[key];
+            if (typeof value === 'string') {
+                return value;
+            }
+        }
+        return undefined;
+    }
+    function parseNumberField(obj, keys) {
+        for (const key of keys) {
+            const value = obj[key];
+            if (typeof value === 'number' && Number.isFinite(value)) {
+                return value;
+            }
+        }
+        return undefined;
+    }
+    function parseCapabilitiesField(obj, keys) {
+        for (const key of keys) {
+            const value = obj[key];
+            if (!Array.isArray(value))
+                continue;
+            const caps = value
+                .filter(item => item && typeof item === 'object')
+                .map(item => normalizeUcanCapability(item))
+                .filter((cap) => Boolean(cap));
+            return caps;
+        }
+        return undefined;
+    }
+    function readStoredSessionToken(options) {
+        if (!shouldStoreSessionToken(options))
+            return null;
+        if (typeof localStorage === 'undefined')
+            return null;
+        const key = resolveSessionTokenKey(options);
+        return localStorage.getItem(key);
+    }
+    function persistSessionToken(token, options) {
+        cachedCentralSessionToken = token;
+        if (!shouldStoreSessionToken(options))
+            return;
+        if (typeof localStorage === 'undefined')
+            return;
+        const key = resolveSessionTokenKey(options);
+        if (!token) {
+            localStorage.removeItem(key);
+        }
+        else {
+            localStorage.setItem(key, token);
+        }
+    }
+    async function parseJsonBody(response) {
+        const text = await response.text();
+        if (!text)
+            return null;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return { raw: text };
+        }
+    }
+    function getCentralSessionToken(options) {
+        if (cachedCentralSessionToken)
+            return cachedCentralSessionToken;
+        const stored = readStoredSessionToken(options);
+        if (stored) {
+            cachedCentralSessionToken = stored;
+        }
+        return stored;
+    }
+    function setCentralSessionToken(token, options) {
+        persistSessionToken(token, options);
+    }
+    function clearCentralSessionToken(options) {
+        cachedCentralSessionToken = null;
+        if (typeof localStorage === 'undefined')
+            return;
+        const key = resolveSessionTokenKey(options);
+        localStorage.removeItem(key);
+    }
+    async function getCentralIssuerInfo(options = {}) {
+        const fetcher = resolveFetcher(options);
+        const credentials = resolveCredentials(options);
+        const url = joinUrl$1(resolveBaseUrl(options), options.issuerPath || DEFAULT_ISSUER_PATH);
+        const response = await fetcher(url, {
+            method: 'GET',
+            headers: {
+                accept: 'application/json',
+            },
+            credentials,
+        });
+        const payload = await parseJsonBody(response);
+        if (!response.ok) {
+            throw new Error(`Central issuer request failed: ${response.status} ${JSON.stringify(payload)}`);
+        }
+        const data = parseEnvelopeData(payload);
+        return {
+            enabled: typeof data.enabled === 'boolean' ? data.enabled : undefined,
+            issuerDid: parseStringField(data, ['issuerDid']),
+            defaultAudience: parseStringField(data, ['defaultAudience']),
+            defaultCapabilities: parseCapabilitiesField(data, ['defaultCapabilities']),
+            response: payload,
+        };
+    }
+    async function createCentralSession(options) {
+        const subject = String(options?.subject || '').trim();
+        if (!subject) {
+            throw new Error('Missing subject');
+        }
+        const fetcher = resolveFetcher(options);
+        const credentials = resolveCredentials(options);
+        const url = joinUrl$1(resolveBaseUrl(options), options.sessionPath || DEFAULT_SESSION_PATH);
+        const response = await fetcher(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                accept: 'application/json',
+            },
+            credentials,
+            body: JSON.stringify({
+                subject,
+                sessionTtlMs: options.sessionTtlMs,
+            }),
+        });
+        const payload = await parseJsonBody(response);
+        if (!response.ok) {
+            throw new Error(`Central session request failed: ${response.status} ${JSON.stringify(payload)}`);
+        }
+        const data = parseEnvelopeData(payload);
+        const sessionToken = parseStringField(data, ['sessionToken']);
+        if (!sessionToken) {
+            throw new Error('Central session response missing sessionToken');
+        }
+        persistSessionToken(sessionToken, options);
+        return {
+            subject: parseStringField(data, ['subject']) || subject,
+            sessionToken,
+            expiresAt: parseNumberField(data, ['expiresAt']),
+            issuerDid: parseStringField(data, ['issuerDid']),
+            response: payload,
+        };
+    }
+    async function issueCentralUcan(options = {}) {
+        const sessionToken = options.sessionToken || getCentralSessionToken(options);
+        if (!sessionToken) {
+            throw new Error('Missing central session token');
+        }
+        const normalizedCapabilities = options.capabilities
+            ? normalizeUcanCapabilities(options.capabilities)
+            : undefined;
+        const fetcher = resolveFetcher(options);
+        const credentials = resolveCredentials(options);
+        const url = joinUrl$1(resolveBaseUrl(options), options.issuePath || DEFAULT_ISSUE_PATH);
+        const response = await fetcher(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                accept: 'application/json',
+                Authorization: `Bearer ${sessionToken}`,
+            },
+            credentials,
+            body: JSON.stringify({
+                audience: options.audience,
+                capabilities: normalizedCapabilities,
+                expiresInMs: options.expiresInMs,
+                ttlMs: options.ttlMs,
+            }),
+        });
+        const payload = await parseJsonBody(response);
+        if (!response.ok) {
+            throw new Error(`Central UCAN issue failed: ${response.status} ${JSON.stringify(payload)}`);
+        }
+        const data = parseEnvelopeData(payload);
+        const ucan = parseStringField(data, ['ucan']);
+        if (!ucan) {
+            throw new Error('Central UCAN response missing ucan');
+        }
+        return {
+            ucan,
+            issuerDid: parseStringField(data, ['issuerDid']),
+            subject: parseStringField(data, ['subject']),
+            audience: parseStringField(data, ['audience']),
+            capabilities: parseCapabilitiesField(data, ['capabilities']),
+            exp: parseNumberField(data, ['exp']),
+            nbf: parseNumberField(data, ['nbf']),
+            iat: parseNumberField(data, ['iat']),
+            response: payload,
+        };
+    }
+    async function createAndIssueCentralUcan(options) {
+        const session = await createCentralSession({
+            ...options,
+            subject: options.subject,
+            sessionTtlMs: options.sessionTtlMs,
+        });
+        const issue = await issueCentralUcan({
+            ...options,
+            sessionToken: session.sessionToken,
+            audience: options.audience,
+            capabilities: options.capabilities,
+            expiresInMs: options.expiresInMs,
+            ttlMs: options.ttlMs,
+        });
+        return { session, issue };
+    }
+    async function authCentralUcanFetch(input, init = {}, options = {}) {
+        const fetcher = resolveFetcher(options);
+        const credentials = resolveCredentials(options);
+        let token = options.ucan || null;
+        if (!token) {
+            let sessionToken = options.sessionToken || getCentralSessionToken(options);
+            if (!sessionToken) {
+                if (!options.subject) {
+                    throw new Error('Missing central session token or subject');
+                }
+                const session = await createCentralSession({
+                    ...options,
+                    subject: options.subject,
+                    sessionTtlMs: options.sessionTtlMs,
+                });
+                sessionToken = session.sessionToken;
+            }
+            const issued = await issueCentralUcan({
+                ...options,
+                sessionToken,
+                audience: options.audience,
+                capabilities: options.capabilities,
+                expiresInMs: options.expiresInMs,
+                ttlMs: options.ttlMs,
+            });
+            token = issued.ucan;
+        }
+        const headers = new Headers(init.headers || {});
+        headers.set('Authorization', `Bearer ${token}`);
+        return fetcher(input, {
+            ...init,
+            headers,
+            credentials,
+        });
+    }
+
     function normalizeBaseUrl(baseUrl) {
         return baseUrl.replace(/\/+$/, '');
     }
@@ -1119,6 +1613,7 @@
 
     const tokenCache = new Map();
     const TOKEN_SKEW_MS = 5000;
+    const DEFAULT_APP_ACTION = 'write';
     function normalizeAppDir(path) {
         const trimmed = path.trim();
         if (!trimmed)
@@ -1130,6 +1625,36 @@
     function sanitizeAppId(appId) {
         return appId.trim().replace(/[^a-zA-Z0-9._-]/g, '-');
     }
+    function normalizeAction(action) {
+        const trimmed = (action || '').trim();
+        return trimmed ? trimmed : null;
+    }
+    function buildAppCapability(options) {
+        if (!options.appId)
+            return null;
+        const action = normalizeAction(options.appAction) || DEFAULT_APP_ACTION;
+        const resource = `app:all:${sanitizeAppId(options.appId)}`;
+        return {
+            with: resource,
+            can: action,
+            resource,
+            action,
+        };
+    }
+    function hasAppCapability(caps) {
+        return (caps || []).some(cap => getCapabilityResource(cap).startsWith('app:'));
+    }
+    function dedupeCapabilities(caps) {
+        return normalizeUcanCapabilities(caps);
+    }
+    function ensureAppCapability(caps, options) {
+        const appCap = buildAppCapability(options);
+        if (!appCap)
+            return caps || [];
+        if (hasAppCapability(caps || []))
+            return caps || [];
+        return dedupeCapabilities([...(caps || []), appCap]);
+    }
     function resolveAppDir(options) {
         if (options.appDir) {
             return normalizeAppDir(options.appDir);
@@ -1140,11 +1665,25 @@
         return undefined;
     }
     function buildCapsKey(caps) {
-        return JSON.stringify(caps || []);
+        const canonical = (caps || [])
+            .map(cap => ({
+            with: getCapabilityResource(cap),
+            can: getCapabilityAction(cap),
+        }))
+            .filter(cap => Boolean(cap.with && cap.can));
+        return JSON.stringify(canonical);
     }
     function buildTokenCacheKey(issuer, audience, caps) {
         return `${issuer.did}|${audience}|${buildCapsKey(caps)}`;
     }
+    function resolveWebdavCaps(options) {
+        const baseCaps = options.capabilities || options.root?.cap || [];
+        return ensureAppCapability(baseCaps, options);
+    }
+    function resolveInvocationCaps(options, fallbackCaps) {
+        const caps = options.invocationCapabilities || fallbackCaps;
+        return ensureAppCapability(caps, options);
+    }
     function isTokenValid(entry, nowMs) {
         if (!entry.exp)
             return false;
@@ -1216,7 +1755,7 @@
         return token;
     }
     async function initWebDavStorage(options) {
-        const caps = options.capabilities || options.root?.cap;
+        const caps = resolveWebdavCaps(options);
         if (!caps || caps.length === 0) {
             throw new Error('Missing UCAN capabilities for WebDAV');
         }
@@ -1246,7 +1785,7 @@
                 expiresInMs: options.rootExpiresInMs,
             });
         }
-        const invocationCaps = options.invocationCapabilities || caps;
+        const invocationCaps = resolveInvocationCaps(options, caps);
         const token = await getCachedInvocationToken({
             issuer: session,
             audience: options.audience,
@@ -1310,10 +1849,14 @@
     }
 
     exports.WebDavClient = WebDavClient;
+    exports.authCentralUcanFetch = authCentralUcanFetch;
     exports.authFetch = authFetch;
     exports.authUcanFetch = authUcanFetch;
     exports.clearAccessToken = clearAccessToken;
+    exports.clearCentralSessionToken = clearCentralSessionToken;
     exports.clearUcanSession = clearUcanSession;
+    exports.createAndIssueCentralUcan = createAndIssueCentralUcan;
+    exports.createCentralSession = createCentralSession;
     exports.createDelegationUcan = createDelegationUcan;
     exports.createInvocationUcan = createInvocationUcan;
     exports.createRootUcan = createRootUcan;
@@ -1322,6 +1865,10 @@
     exports.getAccessToken = getAccessToken;
     exports.getAccounts = getAccounts;
     exports.getBalance = getBalance;
+    exports.getCapabilityAction = getCapabilityAction;
+    exports.getCapabilityResource = getCapabilityResource;
+    exports.getCentralIssuerInfo = getCentralIssuerInfo;
+    exports.getCentralSessionToken = getCentralSessionToken;
     exports.getChainId = getChainId;
     exports.getOrCreateUcanRoot = getOrCreateUcanRoot;
     exports.getPreferredAccount = getPreferredAccount;
@@ -1331,14 +1878,18 @@
     exports.initDappSession = initDappSession;
     exports.initWebDavStorage = initWebDavStorage;
     exports.isYeYingProvider = isYeYingProvider;
+    exports.issueCentralUcan = issueCentralUcan;
     exports.loginWithChallenge = loginWithChallenge;
     exports.logout = logout;
+    exports.normalizeUcanCapabilities = normalizeUcanCapabilities;
+    exports.normalizeUcanCapability = normalizeUcanCapability;
     exports.onAccountsChanged = onAccountsChanged;
     exports.onChainChanged = onChainChanged;
     exports.refreshAccessToken = refreshAccessToken;
     exports.requestAccounts = requestAccounts;
     exports.requireProvider = requireProvider;
     exports.setAccessToken = setAccessToken;
+    exports.setCentralSessionToken = setCentralSessionToken;
     exports.signMessage = signMessage;
     exports.storeUcanRoot = storeUcanRoot;
     exports.watchAccounts = watchAccounts;