@yeying-community/web3-bs 1.0.5 → 1.0.7

package/dist/web3-bs.esm.js

@@ -193,12 +193,12 @@ function onChainChanged(provider, handler) {
     return () => provider.removeListener?.('chainChanged', handler);
 }
 
-function normalizeBaseUrl$1(baseUrl) {
+function normalizeBaseUrl$2(baseUrl) {
     return baseUrl.replace(/\/+$/, '');
 }
-function joinUrl$1(baseUrl, path) {
+function joinUrl$2(baseUrl, path) {
     const trimmed = path.replace(/^\/+/, '');
-    return `${normalizeBaseUrl$1(baseUrl)}/${trimmed}`;
+    return `${normalizeBaseUrl$2(baseUrl)}/${trimmed}`;
 }
 const DEFAULT_TOKEN_KEY = 'authToken';
 let cachedAccessToken = null;
@@ -209,10 +209,10 @@ function resolveTokenKey(options) {
 function shouldStoreToken(options) {
     return options?.storeToken !== false;
 }
-function resolveFetcher(options) {
+function resolveFetcher$1(options) {
     return options?.fetcher || fetch;
 }
-function resolveCredentials(options) {
+function resolveCredentials$1(options) {
     return options?.credentials ?? 'include';
 }
 function readStoredToken(options) {
@@ -352,11 +352,11 @@ async function signMessage(options) {
 async function loginWithChallenge(options = {}) {
     const provider = options.provider || (await requireProvider());
     const address = await resolveAddress$1(provider, options.address);
-    const fetcher = resolveFetcher(options);
-    const credentials = resolveCredentials(options);
+    const fetcher = resolveFetcher$1(options);
+    const credentials = resolveCredentials$1(options);
     const baseUrl = options.baseUrl || '/api/v1/public/auth';
-    const challengeUrl = joinUrl$1(baseUrl, options.challengePath || 'challenge');
-    const verifyUrl = joinUrl$1(baseUrl, options.verifyPath || 'verify');
+    const challengeUrl = joinUrl$2(baseUrl, options.challengePath || 'challenge');
+    const verifyUrl = joinUrl$2(baseUrl, options.verifyPath || 'verify');
     const challengeBody = {
         address,
     };
@@ -420,10 +420,10 @@ async function refreshAccessToken(options = {}) {
         return refreshInFlight;
     }
     const task = (async () => {
-        const fetcher = resolveFetcher(options);
-        const credentials = resolveCredentials(options);
+        const fetcher = resolveFetcher$1(options);
+        const credentials = resolveCredentials$1(options);
         const baseUrl = options.baseUrl || '/api/v1/public/auth';
-        const refreshUrl = joinUrl$1(baseUrl, options.refreshPath || 'refresh');
+        const refreshUrl = joinUrl$2(baseUrl, options.refreshPath || 'refresh');
         const refreshRes = await fetcher(refreshUrl, {
             method: 'POST',
             headers: {
@@ -452,10 +452,10 @@ async function refreshAccessToken(options = {}) {
     }
 }
 async function logout(options = {}) {
-    const fetcher = resolveFetcher(options);
-    const credentials = resolveCredentials(options);
+    const fetcher = resolveFetcher$1(options);
+    const credentials = resolveCredentials$1(options);
     const baseUrl = options.baseUrl || '/api/v1/public/auth';
-    const logoutUrl = joinUrl$1(baseUrl, options.logoutPath || 'logout');
+    const logoutUrl = joinUrl$2(baseUrl, options.logoutPath || 'logout');
     const logoutRes = await fetcher(logoutUrl, {
         method: 'POST',
         headers: {
@@ -478,8 +478,8 @@ async function logout(options = {}) {
     return { response: payload };
 }
 async function authFetch(input, init = {}, options = {}) {
-    const fetcher = resolveFetcher(options);
-    const credentials = resolveCredentials(options);
+    const fetcher = resolveFetcher$1(options);
+    const credentials = resolveCredentials$1(options);
     const retryOnUnauthorized = options.retryOnUnauthorized !== false;
     const performRequest = async (tokenOverride) => {
         const headers = new Headers(init.headers || {});
@@ -511,6 +511,8 @@ const DEFAULT_SESSION_TTL = 24 * 60 * 60 * 1000;
 const DEFAULT_UCAN_TTL = 5 * 60 * 1000;
 const DB_NAME = 'yeying-web3';
 const DB_STORE = 'ucan-sessions';
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const DID_KEY_ED25519_MULTICODEC = new Uint8Array([0xed, 0x01]);
 const textEncoder = new TextEncoder();
 function toBase64Url(data) {
     const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);
@@ -520,6 +522,70 @@ function toBase64Url(data) {
     }
     return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
+function normalizeActionExpression(raw) {
+    const normalized = String(raw || '').trim().toLowerCase().replace(/\|/g, ',');
+    if (!normalized)
+        return '';
+    const parts = normalized
+        .split(',')
+        .map(part => part.trim())
+        .filter(Boolean);
+    if (!parts.length)
+        return '';
+    return Array.from(new Set(parts)).join(',');
+}
+function getCapabilityResource(cap) {
+    if (!cap || typeof cap !== 'object')
+        return '';
+    const withValue = typeof cap.with === 'string' ? cap.with.trim() : '';
+    if (withValue)
+        return withValue;
+    return typeof cap.resource === 'string' ? cap.resource.trim() : '';
+}
+function getCapabilityAction(cap) {
+    if (!cap || typeof cap !== 'object')
+        return '';
+    const canValue = typeof cap.can === 'string' ? cap.can.trim() : '';
+    if (canValue)
+        return normalizeActionExpression(canValue);
+    const actionValue = typeof cap.action === 'string' ? cap.action.trim() : '';
+    return normalizeActionExpression(actionValue);
+}
+function normalizeUcanCapability(cap, options = {}) {
+    const includeLegacyAliases = options.includeLegacyAliases !== false;
+    const resource = getCapabilityResource(cap);
+    const action = getCapabilityAction(cap);
+    if (!resource || !action)
+        return null;
+    const normalized = {
+        with: resource,
+        can: action,
+    };
+    if (includeLegacyAliases) {
+        normalized.resource = resource;
+        normalized.action = action;
+    }
+    if (cap && Object.prototype.hasOwnProperty.call(cap, 'nb')) {
+        normalized.nb = cap.nb;
+    }
+    return normalized;
+}
+function normalizeUcanCapabilities(caps, options = {}) {
+    const includeLegacyAliases = options.includeLegacyAliases !== false;
+    const seen = new Set();
+    const result = [];
+    for (const cap of caps || []) {
+        const normalized = normalizeUcanCapability(cap, { includeLegacyAliases });
+        if (!normalized)
+            continue;
+        const key = `${normalized.with}|${normalized.can}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(normalized);
+    }
+    return result;
+}
 function encodeJson(value) {
     return toBase64Url(textEncoder.encode(JSON.stringify(value)));
 }
@@ -533,6 +599,123 @@ function randomNonce(bytes = 16) {
 function normalizeExpiry(exp, fallbackMs) {
     return Date.now() + fallbackMs;
 }
+function isSessionExpired(expiresAt, nowMs = Date.now()) {
+    return typeof expiresAt === 'number' && nowMs >= expiresAt;
+}
+function encodeBase58(bytes) {
+    if (bytes.length === 0)
+        return '';
+    let value = 0n;
+    for (const byte of bytes) {
+        value = (value << 8n) + BigInt(byte);
+    }
+    let encoded = '';
+    while (value > 0n) {
+        const mod = Number(value % 58n);
+        encoded = `${BASE58_ALPHABET[mod]}${encoded}`;
+        value /= 58n;
+    }
+    let leadingZeroCount = 0;
+    while (leadingZeroCount < bytes.length && bytes[leadingZeroCount] === 0) {
+        leadingZeroCount += 1;
+    }
+    if (leadingZeroCount > 0) {
+        encoded = `${'1'.repeat(leadingZeroCount)}${encoded}`;
+    }
+    return encoded || '1';
+}
+function ensureWebCrypto() {
+    if (typeof crypto === 'undefined' || !crypto.subtle) {
+        throw new Error('WebCrypto not available for UCAN session');
+    }
+    return crypto;
+}
+function parseSessionId(options) {
+    return options.id || DEFAULT_SESSION_ID;
+}
+function isLocalSessionRecord(record) {
+    return Boolean(record?.source === 'local' || record?.privateKeyJwk);
+}
+async function buildDidKey(publicKey) {
+    const webCrypto = ensureWebCrypto();
+    const raw = new Uint8Array(await webCrypto.subtle.exportKey('raw', publicKey));
+    const prefixed = new Uint8Array(DID_KEY_ED25519_MULTICODEC.length + raw.length);
+    prefixed.set(DID_KEY_ED25519_MULTICODEC, 0);
+    prefixed.set(raw, DID_KEY_ED25519_MULTICODEC.length);
+    return `did:key:z${encodeBase58(prefixed)}`;
+}
+async function importLocalPrivateKey(privateKeyJwk) {
+    const webCrypto = ensureWebCrypto();
+    return await webCrypto.subtle.importKey('jwk', privateKeyJwk, 'Ed25519', true, ['sign']);
+}
+async function loadLocalSessionFromRecord(id, record) {
+    if (!record || !isLocalSessionRecord(record) || !record.privateKeyJwk) {
+        return null;
+    }
+    if (isSessionExpired(record.expiresAt)) {
+        await deleteSessionRecord(id);
+        return null;
+    }
+    try {
+        const privateKey = await importLocalPrivateKey(record.privateKeyJwk);
+        return {
+            id: record.id || id,
+            did: record.did,
+            createdAt: record.createdAt,
+            expiresAt: record.expiresAt,
+            source: 'local',
+            privateKey,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function shouldKeepRootForSession(root, did, nowMs) {
+    if (!root)
+        return false;
+    if (root.aud && root.aud !== did)
+        return false;
+    if (isRootExpired(root, nowMs))
+        return false;
+    return true;
+}
+async function createLocalSession(options, record) {
+    const webCrypto = ensureWebCrypto();
+    const sessionId = parseSessionId(options);
+    if (!options.forceNew) {
+        const existing = await loadLocalSessionFromRecord(sessionId, record);
+        if (existing)
+            return existing;
+    }
+    const pair = (await webCrypto.subtle.generateKey('Ed25519', true, ['sign', 'verify']));
+    const [privateKeyJwk, publicKeyJwk, did] = await Promise.all([
+        webCrypto.subtle.exportKey('jwk', pair.privateKey),
+        webCrypto.subtle.exportKey('jwk', pair.publicKey),
+        buildDidKey(pair.publicKey),
+    ]);
+    const createdAt = Date.now();
+    const expiresAt = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_SESSION_TTL);
+    const root = shouldKeepRootForSession(record?.root, did, createdAt) ? record?.root : undefined;
+    await writeSessionRecord({
+        id: sessionId,
+        did,
+        createdAt,
+        expiresAt,
+        source: 'local',
+        privateKeyJwk,
+        publicKeyJwk,
+        root,
+    });
+    return {
+        id: sessionId,
+        did,
+        createdAt,
+        expiresAt,
+        source: 'local',
+        privateKey: pair.privateKey,
+    };
+}
 function openDb() {
     if (typeof indexedDB === 'undefined') {
         return Promise.reject(new Error('IndexedDB not available'));
@@ -595,17 +778,19 @@ async function deleteSessionRecord(id) {
     }
 }
 async function getUcanSession(id = DEFAULT_SESSION_ID, provider) {
+    const record = await readSessionRecord(id);
     const walletProvider = provider || (typeof window !== 'undefined'
         ? await getProvider({ preferYeYing: true })
         : null);
-    if (!walletProvider)
-        return null;
-    try {
-        return await requestWalletUcanSession(walletProvider, { id });
-    }
-    catch {
-        return null;
+    if (walletProvider) {
+        try {
+            return await requestWalletUcanSession(walletProvider, { id });
+        }
+        catch {
+            return await loadLocalSessionFromRecord(id, record);
+        }
     }
+    return await loadLocalSessionFromRecord(id, record);
 }
 async function requestWalletUcanSession(provider, options) {
     const sessionId = options.id || DEFAULT_SESSION_ID;
@@ -630,6 +815,7 @@ async function requestWalletUcanSession(provider, options) {
         did: result.did,
         createdAt,
         expiresAt,
+        source: 'wallet',
         root: existing?.root,
     };
     if (nextRecord.root && nextRecord.root.aud && nextRecord.root.aud !== nextRecord.did) {
@@ -641,6 +827,7 @@ async function requestWalletUcanSession(provider, options) {
         did: result.did,
         createdAt,
         expiresAt,
+        source: 'wallet',
         signer: async (signingInput, payload) => {
             const signatureResult = (await provider.request({
                 method: 'yeying_ucan_sign',
@@ -663,13 +850,20 @@ async function requestWalletUcanSession(provider, options) {
     };
 }
 async function createUcanSession(options = {}) {
+    const sessionId = parseSessionId(options);
+    const record = await readSessionRecord(sessionId);
     const provider = options.provider || (typeof window !== 'undefined'
         ? await getProvider({ preferYeYing: true })
         : null);
-    if (!provider) {
-        throw new Error('No wallet provider for UCAN session');
+    if (provider) {
+        try {
+            return await requestWalletUcanSession(provider, { ...options, id: sessionId });
+        }
+        catch {
+            // fallback to local ed25519 session
+        }
     }
-    return await requestWalletUcanSession(provider, options);
+    return await createLocalSession({ ...options, id: sessionId }, record);
 }
 async function clearUcanSession(id = DEFAULT_SESSION_ID) {
     await deleteSessionRecord(id);
@@ -680,6 +874,7 @@ async function storeUcanRoot(root, id = DEFAULT_SESSION_ID) {
     const expiresAt = record?.expiresAt ?? null;
     const did = record?.did || root.aud;
     const nextRecord = {
+        ...(record || {}),
         id,
         did,
         createdAt,
@@ -693,7 +888,9 @@ async function getStoredUcanRoot(id = DEFAULT_SESSION_ID) {
     return record?.root || null;
 }
 function capsEqual(a, b) {
-    return JSON.stringify(a || []) === JSON.stringify(b || []);
+    const left = normalizeUcanCapabilities(a, { includeLegacyAliases: false });
+    const right = normalizeUcanCapabilities(b, { includeLegacyAliases: false });
+    return JSON.stringify(left) === JSON.stringify(right);
 }
 function isRootExpired(root, nowMs) {
     return Boolean(root.exp && nowMs > root.exp);
@@ -768,9 +965,13 @@ async function createRootUcan(options) {
     const nonce = options.nonce || randomNonce(8);
     const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_SESSION_TTL);
     const nbf = options.notBeforeMs;
+    const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+    if (!normalizedCapabilities.length) {
+        throw new Error('Missing UCAN capabilities');
+    }
     const statementPayload = {
         aud: session.did,
-        cap: options.capabilities,
+        cap: normalizedCapabilities,
         exp,
     };
     if (nbf)
@@ -793,7 +994,7 @@ async function createRootUcan(options) {
         type: 'siwe',
         iss: `did:pkh:eth:${address.toLowerCase()}`,
         aud: session.did,
-        cap: options.capabilities,
+        cap: normalizedCapabilities,
         exp,
         nbf,
         siwe: {
@@ -842,11 +1043,15 @@ async function createDelegationUcan(options) {
     }));
     if (!issuer)
         throw new Error('Missing UCAN session key');
+    const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+    if (!normalizedCapabilities.length) {
+        throw new Error('Missing UCAN capabilities');
+    }
     const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TTL);
     const payload = {
         iss: issuer.did,
         aud: options.audience,
-        cap: options.capabilities,
+        cap: normalizedCapabilities,
         exp,
         nbf: options.notBeforeMs,
         prf: await resolveProofs(options, issuer),
@@ -860,11 +1065,15 @@ async function createInvocationUcan(options) {
     }));
     if (!issuer)
         throw new Error('Missing UCAN session key');
+    const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
+    if (!normalizedCapabilities.length) {
+        throw new Error('Missing UCAN capabilities');
+    }
     const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TTL);
     const payload = {
         iss: issuer.did,
         aud: options.audience,
-        cap: options.capabilities,
+        cap: normalizedCapabilities,
         exp,
         nbf: options.notBeforeMs,
         prf: await resolveProofs(options, issuer),
@@ -897,6 +1106,314 @@ async function authUcanFetch(input, init = {}, options = {}) {
     });
 }
 
+const DEFAULT_BASE_URL = '/api/v1/public/auth/central';
+const DEFAULT_ISSUER_PATH = 'issuer';
+const DEFAULT_SESSION_PATH = 'session';
+const DEFAULT_ISSUE_PATH = 'issue';
+const DEFAULT_SESSION_TOKEN_KEY = 'centralUcanSessionToken';
+let cachedCentralSessionToken = null;
+function normalizeBaseUrl$1(baseUrl) {
+    return baseUrl.replace(/\/+$/, '');
+}
+function joinUrl$1(baseUrl, path) {
+    const trimmed = path.replace(/^\/+/, '');
+    return `${normalizeBaseUrl$1(baseUrl)}/${trimmed}`;
+}
+function resolveBaseUrl(options) {
+    return options?.baseUrl || DEFAULT_BASE_URL;
+}
+function resolveFetcher(options) {
+    return options?.fetcher || fetch;
+}
+function resolveCredentials(options) {
+    return options?.credentials ?? 'include';
+}
+function resolveSessionTokenKey(options) {
+    return options?.sessionTokenStorageKey || DEFAULT_SESSION_TOKEN_KEY;
+}
+function resolveAccessToken(options) {
+    if (typeof options?.accessToken === 'string') {
+        const token = options.accessToken.trim();
+        return token || null;
+    }
+    if (options?.accessToken === null) {
+        return null;
+    }
+    return getAccessToken(options);
+}
+function shouldStoreSessionToken(options) {
+    return options?.storeSessionToken !== false;
+}
+function parseObject(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return {};
+    }
+    return value;
+}
+function parseEnvelopeData(payload) {
+    const root = parseObject(payload);
+    if (Object.prototype.hasOwnProperty.call(root, 'data')) {
+        return parseObject(root.data);
+    }
+    return root;
+}
+function parseStringField(obj, keys) {
+    for (const key of keys) {
+        const value = obj[key];
+        if (typeof value === 'string') {
+            return value;
+        }
+    }
+    return undefined;
+}
+function parseNumberField(obj, keys) {
+    for (const key of keys) {
+        const value = obj[key];
+        if (typeof value === 'number' && Number.isFinite(value)) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function parseCapabilitiesField(obj, keys) {
+    for (const key of keys) {
+        const value = obj[key];
+        if (!Array.isArray(value))
+            continue;
+        const caps = value
+            .filter(item => item && typeof item === 'object')
+            .map(item => normalizeUcanCapability(item))
+            .filter((cap) => Boolean(cap));
+        return caps;
+    }
+    return undefined;
+}
+function parseIssuerDidField(obj) {
+    return parseStringField(obj, ['issuerDid', 'issuer', 'did']);
+}
+function readStoredSessionToken(options) {
+    if (!shouldStoreSessionToken(options))
+        return null;
+    if (typeof localStorage === 'undefined')
+        return null;
+    const key = resolveSessionTokenKey(options);
+    return localStorage.getItem(key);
+}
+function persistSessionToken(token, options) {
+    cachedCentralSessionToken = token;
+    if (!shouldStoreSessionToken(options))
+        return;
+    if (typeof localStorage === 'undefined')
+        return;
+    const key = resolveSessionTokenKey(options);
+    if (!token) {
+        localStorage.removeItem(key);
+    }
+    else {
+        localStorage.setItem(key, token);
+    }
+}
+async function parseJsonBody(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { raw: text };
+    }
+}
+function getCentralSessionToken(options) {
+    if (cachedCentralSessionToken)
+        return cachedCentralSessionToken;
+    const stored = readStoredSessionToken(options);
+    if (stored) {
+        cachedCentralSessionToken = stored;
+    }
+    return stored;
+}
+function setCentralSessionToken(token, options) {
+    persistSessionToken(token, options);
+}
+function clearCentralSessionToken(options) {
+    cachedCentralSessionToken = null;
+    if (typeof localStorage === 'undefined')
+        return;
+    const key = resolveSessionTokenKey(options);
+    localStorage.removeItem(key);
+}
+async function getCentralIssuerInfo(options = {}) {
+    const fetcher = resolveFetcher(options);
+    const credentials = resolveCredentials(options);
+    const url = joinUrl$1(resolveBaseUrl(options), options.issuerPath || DEFAULT_ISSUER_PATH);
+    const token = resolveAccessToken(options);
+    const headers = new Headers({
+        accept: 'application/json',
+    });
+    if (token) {
+        headers.set('Authorization', `Bearer ${token}`);
+    }
+    const response = await fetcher(url, {
+        method: 'GET',
+        headers,
+        credentials,
+    });
+    const payload = await parseJsonBody(response);
+    if (!response.ok) {
+        throw new Error(`Central issuer request failed: ${response.status} ${JSON.stringify(payload)}`);
+    }
+    const data = parseEnvelopeData(payload);
+    return {
+        enabled: typeof data.enabled === 'boolean' ? data.enabled : undefined,
+        issuerDid: parseIssuerDidField(data),
+        defaultAudience: parseStringField(data, ['defaultAudience']),
+        defaultCapabilities: parseCapabilitiesField(data, ['defaultCapabilities']),
+        response: payload,
+    };
+}
+async function createCentralSession(options) {
+    const subject = String(options?.subject || '').trim();
+    if (!subject) {
+        throw new Error('Missing subject');
+    }
+    const fetcher = resolveFetcher(options);
+    const credentials = resolveCredentials(options);
+    const accessToken = resolveAccessToken(options);
+    const url = joinUrl$1(resolveBaseUrl(options), options.sessionPath || DEFAULT_SESSION_PATH);
+    const headers = new Headers({
+        'Content-Type': 'application/json',
+        accept: 'application/json',
+    });
+    if (accessToken) {
+        headers.set('Authorization', `Bearer ${accessToken}`);
+    }
+    const response = await fetcher(url, {
+        method: 'POST',
+        headers,
+        credentials,
+        body: JSON.stringify({
+            subject,
+            sessionTtlMs: options.sessionTtlMs,
+        }),
+    });
+    const payload = await parseJsonBody(response);
+    if (!response.ok) {
+        throw new Error(`Central session request failed: ${response.status} ${JSON.stringify(payload)}`);
+    }
+    const data = parseEnvelopeData(payload);
+    const sessionToken = parseStringField(data, ['sessionToken']);
+    if (!sessionToken) {
+        throw new Error('Central session response missing sessionToken');
+    }
+    persistSessionToken(sessionToken, options);
+    return {
+        subject: parseStringField(data, ['subject']) || subject,
+        sessionToken,
+        expiresAt: parseNumberField(data, ['expiresAt']),
+        issuerDid: parseIssuerDidField(data),
+        response: payload,
+    };
+}
+async function issueCentralUcan(options = {}) {
+    const sessionToken = options.sessionToken || getCentralSessionToken(options);
+    if (!sessionToken) {
+        throw new Error('Missing central session token');
+    }
+    const normalizedCapabilities = options.capabilities
+        ? normalizeUcanCapabilities(options.capabilities)
+        : undefined;
+    const fetcher = resolveFetcher(options);
+    const credentials = resolveCredentials(options);
+    const url = joinUrl$1(resolveBaseUrl(options), options.issuePath || DEFAULT_ISSUE_PATH);
+    const response = await fetcher(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            accept: 'application/json',
+            Authorization: `Bearer ${sessionToken}`,
+        },
+        credentials,
+        body: JSON.stringify({
+            audience: options.audience,
+            capabilities: normalizedCapabilities,
+            expiresInMs: options.expiresInMs,
+            ttlMs: options.ttlMs,
+        }),
+    });
+    const payload = await parseJsonBody(response);
+    if (!response.ok) {
+        throw new Error(`Central UCAN issue failed: ${response.status} ${JSON.stringify(payload)}`);
+    }
+    const data = parseEnvelopeData(payload);
+    const ucan = parseStringField(data, ['ucan']);
+    if (!ucan) {
+        throw new Error('Central UCAN response missing ucan');
+    }
+    return {
+        ucan,
+        issuerDid: parseIssuerDidField(data),
+        subject: parseStringField(data, ['subject']),
+        audience: parseStringField(data, ['audience']),
+        capabilities: parseCapabilitiesField(data, ['capabilities']),
+        exp: parseNumberField(data, ['exp', 'expiresAt']),
+        nbf: parseNumberField(data, ['nbf', 'notBefore']),
+        iat: parseNumberField(data, ['iat', 'issuedAt']),
+        response: payload,
+    };
+}
+async function createAndIssueCentralUcan(options) {
+    const session = await createCentralSession({
+        ...options,
+        subject: options.subject,
+        sessionTtlMs: options.sessionTtlMs,
+    });
+    const issue = await issueCentralUcan({
+        ...options,
+        sessionToken: session.sessionToken,
+        audience: options.audience,
+        capabilities: options.capabilities,
+        expiresInMs: options.expiresInMs,
+        ttlMs: options.ttlMs,
+    });
+    return { session, issue };
+}
+async function authCentralUcanFetch(input, init = {}, options = {}) {
+    const fetcher = resolveFetcher(options);
+    const credentials = resolveCredentials(options);
+    let token = options.ucan || null;
+    if (!token) {
+        let sessionToken = options.sessionToken || getCentralSessionToken(options);
+        if (!sessionToken) {
+            if (!options.subject) {
+                throw new Error('Missing central session token or subject');
+            }
+            const session = await createCentralSession({
+                ...options,
+                subject: options.subject,
+                sessionTtlMs: options.sessionTtlMs,
+            });
+            sessionToken = session.sessionToken;
+        }
+        const issued = await issueCentralUcan({
+            ...options,
+            sessionToken,
+            audience: options.audience,
+            capabilities: options.capabilities,
+            expiresInMs: options.expiresInMs,
+            ttlMs: options.ttlMs,
+        });
+        token = issued.ucan;
+    }
+    const headers = new Headers(init.headers || {});
+    headers.set('Authorization', `Bearer ${token}`);
+    return fetcher(input, {
+        ...init,
+        headers,
+        credentials,
+    });
+}
+
 function normalizeBaseUrl(baseUrl) {
     return baseUrl.replace(/\/+$/, '');
 }
@@ -1114,6 +1631,13 @@ function createWebDavClient(options) {
 const tokenCache = new Map();
 const TOKEN_SKEW_MS = 5000;
 const DEFAULT_APP_ACTION = 'write';
+const LOOPBACK_HOST_ALIASES = new Set([
+    'localhost',
+    '127.0.0.1',
+    '::1',
+    '0:0:0:0:0:0:0:1',
+    '0.0.0.0',
+]);
 function normalizeAppDir(path) {
     const trimmed = path.trim();
     if (!trimmed)
@@ -1125,6 +1649,69 @@ function normalizeAppDir(path) {
 function sanitizeAppId(appId) {
     return appId.trim().replace(/[^a-zA-Z0-9._-]/g, '-');
 }
+function parseHostPort(rawHost) {
+    const host = rawHost.trim();
+    if (!host)
+        return { hostname: '', port: '' };
+    const bracketMatch = host.match(/^\[([^\]]+)\](?::([0-9]+))?$/);
+    if (bracketMatch) {
+        return {
+            hostname: bracketMatch[1] || '',
+            port: bracketMatch[2] || '',
+        };
+    }
+    const firstColon = host.indexOf(':');
+    const lastColon = host.lastIndexOf(':');
+    if (firstColon > -1 && firstColon === lastColon) {
+        const hostname = host.slice(0, firstColon).trim();
+        const port = host.slice(firstColon + 1).trim();
+        if (/^[0-9]+$/.test(port)) {
+            return { hostname, port };
+        }
+    }
+    return { hostname: host, port: '' };
+}
+function normalizeAppHostnameForAppId(hostname) {
+    const normalized = (hostname || '').trim().toLowerCase();
+    if (!normalized)
+        return '';
+    const bare = normalized.replace(/^\[(.*)\]$/, '$1');
+    if (LOOPBACK_HOST_ALIASES.has(normalized) || LOOPBACK_HOST_ALIASES.has(bare)) {
+        return 'localhost';
+    }
+    return bare;
+}
+function buildSanitizedAppId(hostname, port) {
+    const normalizedHostname = normalizeAppHostnameForAppId(hostname);
+    if (!normalizedHostname)
+        return '';
+    const normalizedPort = port === undefined || port === null ? '' : String(port).trim();
+    const host = normalizedPort
+        ? `${normalizedHostname}:${normalizedPort}`
+        : normalizedHostname;
+    return sanitizeAppId(host);
+}
+function deriveAppIdFromHost(host) {
+    const parsed = parseHostPort(host || '');
+    return buildSanitizedAppId(parsed.hostname, parsed.port);
+}
+function deriveAppIdFromLocation(locationLike) {
+    const source = locationLike ||
+        (typeof window !== 'undefined' ? window.location : undefined);
+    if (!source)
+        return '';
+    const hostname = typeof source.hostname === 'string' ? source.hostname : '';
+    const port = source.port;
+    if (hostname) {
+        const appId = buildSanitizedAppId(hostname, port);
+        if (appId)
+            return appId;
+    }
+    if (typeof source.host === 'string') {
+        return deriveAppIdFromHost(source.host);
+    }
+    return '';
+}
 function normalizeAction(action) {
     const trimmed = (action || '').trim();
     return trimmed ? trimmed : null;
@@ -1133,25 +1720,19 @@ function buildAppCapability(options) {
     if (!options.appId)
         return null;
     const action = normalizeAction(options.appAction) || DEFAULT_APP_ACTION;
+    const resource = `app:all:${sanitizeAppId(options.appId)}`;
     return {
-        resource: `app:${sanitizeAppId(options.appId)}`,
+        with: resource,
+        can: action,
+        resource,
         action,
     };
 }
 function hasAppCapability(caps) {
-    return (caps || []).some(cap => typeof cap?.resource === 'string' && cap.resource.startsWith('app:'));
+    return (caps || []).some(cap => getCapabilityResource(cap).startsWith('app:'));
 }
 function dedupeCapabilities(caps) {
-    const seen = new Set();
-    return (caps || []).filter(cap => {
-        if (!cap || !cap.resource || !cap.action)
-            return false;
-        const key = `${cap.resource}|${cap.action}`;
-        if (seen.has(key))
-            return false;
-        seen.add(key);
-        return true;
-    });
+    return normalizeUcanCapabilities(caps);
 }
 function ensureAppCapability(caps, options) {
     const appCap = buildAppCapability(options);
@@ -1171,7 +1752,13 @@ function resolveAppDir(options) {
     return undefined;
 }
 function buildCapsKey(caps) {
-    return JSON.stringify(caps || []);
+    const canonical = (caps || [])
+        .map(cap => ({
+        with: getCapabilityResource(cap),
+        can: getCapabilityAction(cap),
+    }))
+        .filter(cap => Boolean(cap.with && cap.can));
+    return JSON.stringify(canonical);
 }
 function buildTokenCacheKey(issuer, audience, caps) {
     return `${issuer.did}|${audience}|${buildCapsKey(caps)}`;
@@ -1348,5 +1935,5 @@ async function initDappSession(options) {
     return result;
 }
 
-export { WebDavClient, authFetch, authUcanFetch, clearAccessToken, clearUcanSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, getAccessToken, getAccounts, getBalance, getChainId, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getUcanSession, initDappSession, initWebDavStorage, isYeYingProvider, loginWithChallenge, logout, onAccountsChanged, onChainChanged, refreshAccessToken, requestAccounts, requireProvider, setAccessToken, signMessage, storeUcanRoot, watchAccounts };
+export { WebDavClient, authCentralUcanFetch, authFetch, authUcanFetch, clearAccessToken, clearCentralSessionToken, clearUcanSession, createAndIssueCentralUcan, createCentralSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, deriveAppIdFromHost, deriveAppIdFromLocation, getAccessToken, getAccounts, getBalance, getCapabilityAction, getCapabilityResource, getCentralIssuerInfo, getCentralSessionToken, getChainId, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getUcanSession, initDappSession, initWebDavStorage, isYeYingProvider, issueCentralUcan, loginWithChallenge, logout, normalizeAppHostnameForAppId, normalizeUcanCapabilities, normalizeUcanCapability, onAccountsChanged, onChainChanged, refreshAccessToken, requestAccounts, requireProvider, setAccessToken, setCentralSessionToken, signMessage, storeUcanRoot, watchAccounts };
 //# sourceMappingURL=web3-bs.esm.js.map