hbsig 0.1.0 → 0.1.2

package/cjs/commit.js

@@ -15,11 +15,15 @@ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t =
 function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
 function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : i + ""; }
 function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
 function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
+// todo: handle @
 var commit = exports.commit = /*#__PURE__*/function () {
   var _ref = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(obj, opts) {
-    var msg, hmacId, rsaId, pub, committer, meta, meta2, sigs;
+    var msg, _yield$verify, components, body, inlineBodyKey, _iterator, _step, v, key, bodyContent, arrayBuffer, hmacId, rsaId, pub, committer, meta, meta2, sigs, committed;
     return _regenerator().w(function (_context) {
       while (1) switch (_context.n) {
         case 0:
@@ -27,6 +31,54 @@ var commit = exports.commit = /*#__PURE__*/function () {
           return opts.signer(obj, opts);
         case 1:
           msg = _context.v;
+          _context.n = 2;
+          return (0, _signerUtils.verify)(msg);
+        case 2:
+          _yield$verify = _context.v;
+          components = _yield$verify.decodedSignatureInput.components;
+          body = {}; // Check for inline-body-key
+          inlineBodyKey = msg.headers["inline-body-key"]; // Build body from components
+          _iterator = _createForOfIteratorHelper(components);
+          try {
+            for (_iterator.s(); !(_step = _iterator.n()).done;) {
+              v = _step.value;
+              key = v === "@path" ? "path" : v;
+              body[key] = msg.headers[key];
+            }
+
+            // Handle body resolution
+          } catch (err) {
+            _iterator.e(err);
+          } finally {
+            _iterator.f();
+          }
+          if (!msg.body) {
+            _context.n = 6;
+            break;
+          }
+          if (!(msg.body instanceof Blob)) {
+            _context.n = 4;
+            break;
+          }
+          _context.n = 3;
+          return msg.body.arrayBuffer();
+        case 3:
+          arrayBuffer = _context.v;
+          bodyContent = Buffer.from(arrayBuffer);
+          _context.n = 5;
+          break;
+        case 4:
+          bodyContent = msg.body;
+        case 5:
+          // If inline-body-key is "data", put content in data field
+          if (inlineBodyKey === "data") {
+            body.data = bodyContent;
+          } else {
+            body.body = bodyContent;
+          }
+        case 6:
+          // Remove inline-body-key from the final body as it's just metadata
+          delete body["inline-body-key"];
           hmacId = (0, _id.hmacid)(msg.headers);
           rsaId = (0, _id.rsaid)(msg.headers);
           pub = (0, _signerUtils.extractPubKey)(msg.headers);
@@ -43,11 +95,12 @@ var commit = exports.commit = /*#__PURE__*/function () {
             signature: msg.headers.signature,
             "signature-input": msg.headers["signature-input"]
           };
-          return _context.a(2, _objectSpread({
+          committed = _objectSpread({
             commitments: _defineProperty(_defineProperty({}, rsaId, _objectSpread(_objectSpread({}, meta), {}, {
               committer: committer
             }, sigs)), hmacId, _objectSpread(_objectSpread({}, meta2), sigs))
-          }, obj));
+          }, body);
+          return _context.a(2, committed);
       }
     }, _callee);
   }));

package/cjs/signer.js

@@ -5,7 +5,6 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.createSigner = void 0;
 exports.sign = sign;
-exports.signInternal = void 0;
 exports.signer = signer;
 Object.defineProperty(exports, "verify", {
   enumerable: true,
@@ -21,8 +20,9 @@ var _encodeUtils = require("./encode-utils.js");
 var _aoconnect = require("@permaweb/aoconnect");
 var _send = require("./send.js");
 var _signerUtils = require("./signer-utils.js");
-var _excluded = ["path", "method"],
-  _excluded2 = ["body"];
+var _excluded = ["body"],
+  _excluded2 = ["path", "method"],
+  _excluded3 = ["body"];
 function _objectWithoutProperties(e, t) { if (null == e) return {}; var o, r, i = _objectWithoutPropertiesLoose(e, t); if (Object.getOwnPropertySymbols) { var n = Object.getOwnPropertySymbols(e); for (r = 0; r < n.length; r++) o = n[r], -1 === t.indexOf(o) && {}.propertyIsEnumerable.call(e, o) && (i[o] = e[o]); } return i; }
 function _objectWithoutPropertiesLoose(r, e) { if (null == r) return {}; var t = {}; for (var n in r) if ({}.hasOwnProperty.call(r, n)) { if (-1 !== e.indexOf(n)) continue; t[n] = r[n]; } return t; }
 function _regenerator() { /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */ var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i["return"]) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
@@ -226,9 +226,8 @@ var smartSign = /*#__PURE__*/function () {
             break;
           }
           // Build a simple message that won't trigger multipart
-          message = {
-            path: path || filtered.path || "/~wao@1.0/httpsig"
-          };
+          message = {};
+          if (path) message.path = path;
           types = [];
           _i5 = 0, _Object$entries5 = Object.entries(filtered);
         case 7:
@@ -275,8 +274,8 @@ var smartSign = /*#__PURE__*/function () {
           return _context.a(2, (0, _httpsig.httpsig_to)(message));
         case 11:
           // For complex structures that need multipart, use enc()
-          normalized = (0, _erl_json.normalize)(_objectSpread(_objectSpread({}, filtered), {}, {
-            path: path || "/~wao@1.0/httpsig"
+          normalized = (0, _erl_json.normalize)(_objectSpread(_objectSpread({}, filtered), path && {
+            path: path
           }));
           _context.n = 12;
           return (0, _encode.enc)(normalized);
@@ -285,8 +284,9 @@ var smartSign = /*#__PURE__*/function () {
           // enc() returns { headers: {...}, body: ... }
           // We need to flatten this for httpsig_to
           flattened = _objectSpread(_objectSpread({}, result.headers), {}, {
-            body: result.body,
-            path: normalized.path || path || "/~wao@1.0/httpsig"
+            body: result.body
+          }, path && {
+            path: path
           }); // httpsig_to expects the structured format
           encoded = (0, _httpsig.httpsig_to)(flattened);
           return _context.a(2, encoded);
@@ -296,9 +296,8 @@ var smartSign = /*#__PURE__*/function () {
           console.error("Encoding failed:", _t);
 
           // Fallback: create a simple structure
-          _result = {
-            path: path || "/~wao@1.0/httpsig"
-          };
+          _result = {};
+          if (path) _result.path = path;
           _i6 = 0, _Object$entries6 = Object.entries(obj);
         case 14:
           if (!(_i6 < _Object$entries6.length)) {
@@ -329,10 +328,10 @@ var smartSign = /*#__PURE__*/function () {
   };
 }();
 
-// Internal sign function that matches the original signature
-var _sign = exports.signInternal = /*#__PURE__*/function () {
+// Internal encode function that uses the original impl as much as possible
+var encode = /*#__PURE__*/function () {
   var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(obj, path) {
-    var filtered, encoded;
+    var filtered, fields, encoded, body, headers;
     return _regenerator().w(function (_context2) {
       while (1) switch (_context2.n) {
         case 0:
@@ -343,28 +342,36 @@ var _sign = exports.signInternal = /*#__PURE__*/function () {
             break;
           }
           _context2.n = 1;
-          return smartSign(filtered, path);
+          return (0, _encode.enc)(filtered);
         case 1:
           return _context2.a(2, _context2.v);
         case 2:
           // Otherwise use the standard pipeline
-          encoded = (0, _httpsig.httpsig_to)((0, _erl_json.normalize)((0, _structured.structured_from)((0, _erl_json.normalize)(_objectSpread(_objectSpread({}, filtered), {}, {
-            path: path || "/~wao@1.0/httpsig"
-          }))))); // Check if the encoded result is valid for HTTP headers
+          fields = _objectSpread({}, filtered); // Only add path if explicitly provided
+          if (path) fields.path = path;
+
+          // Try the standard encoding pipeline
+          encoded = (0, _httpsig.httpsig_to)((0, _erl_json.normalize)((0, _structured.structured_from)((0, _erl_json.normalize)(fields)))); // Check if the encoded result is valid for HTTP headers
           if (isValid(encoded)) {
             _context2.n = 4;
             break;
           }
           _context2.n = 3;
-          return smartSign(filtered, path);
+          return (0, _encode.enc)(filtered);
         case 3:
           return _context2.a(2, _context2.v);
         case 4:
-          return _context2.a(2, encoded);
+          // For non-binary data, return in the same format as enc()
+          // httpsig_to returns a flattened object, so we need to separate headers and body
+          body = encoded.body, headers = _objectWithoutProperties(encoded, _excluded);
+          return _context2.a(2, {
+            headers: headers,
+            body: body
+          });
       }
     }, _callee2);
   }));
-  return function _sign(_x3, _x4) {
+  return function encode(_x3, _x4) {
     return _ref2.apply(this, arguments);
   };
 }();
@@ -384,32 +391,79 @@ function sign(_x5) {
 } // Helper function to recursively filter out undefined values
 function _sign2() {
   _sign2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(_ref4) {
-    var url, path, encoded, jwk, _ref4$signPath, signPath, signer, _encoded$body, body, headers, _enc, headersObj, bodyData, url_path, _url, bodySize, lowercaseHeaders, _i0, _Object$entries0, _Object$entries0$_i, key, value, bodyKeys, isPath, signingFields, signedRequest, finalHeaders, _i1, _Object$entries1, _Object$entries1$_i, _key4, _value4, result;
+    var url, path, encoded, jwk, _ref4$signPath, signPath, signer, _encoded$body, body, headers, _enc;
     return _regenerator().w(function (_context4) {
       while (1) switch (_context4.n) {
         case 0:
           url = _ref4.url, path = _ref4.path, encoded = _ref4.msg, jwk = _ref4.jwk, _ref4$signPath = _ref4.signPath, signPath = _ref4$signPath === void 0 ? true : _ref4$signPath;
           signer = (0, _aoconnect.createSigner)(jwk, url);
-          _encoded$body = encoded.body, body = _encoded$body === void 0 ? null : _encoded$body, headers = _objectWithoutProperties(encoded, _excluded2);
+          _encoded$body = encoded.body, body = _encoded$body === void 0 ? null : _encoded$body, headers = _objectWithoutProperties(encoded, _excluded3);
           _enc = {
             headers: headers
           };
           if (body) _enc.body = new Blob([body]);
-          headersObj = _enc.headers || {};
-          bodyData = _enc.body || undefined;
+          _context4.n = 1;
+          return _sign({
+            path: path,
+            signPath: signPath,
+            encoded: encoded,
+            signer: signer,
+            url: url
+          });
+        case 1:
+          return _context4.a(2, _context4.v);
+      }
+    }, _callee4);
+  }));
+  return _sign2.apply(this, arguments);
+}
+var _filterUndefined = function filterUndefined(obj) {
+  if (obj === null || obj === undefined) return obj;
+  if (Array.isArray(obj)) {
+    return obj.map(_filterUndefined).filter(function (item) {
+      return item !== undefined;
+    });
+  }
+  if (_typeof(obj) === "object" && obj.constructor === Object) {
+    var filtered = {};
+    for (var _i7 = 0, _Object$entries7 = Object.entries(obj); _i7 < _Object$entries7.length; _i7++) {
+      var _Object$entries7$_i = _slicedToArray(_Object$entries7[_i7], 2),
+        key = _Object$entries7$_i[0],
+        value = _Object$entries7$_i[1];
+      var filteredValue = _filterUndefined(value);
+      if (filteredValue !== undefined) {
+        filtered[key] = filteredValue;
+      }
+    }
+    return filtered;
+  }
+  return obj;
+};
+function _sign(_x6) {
+  return _sign3.apply(this, arguments);
+}
+function _sign3() {
+  _sign3 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(_ref5) {
+    var path, _ref5$signPath, signPath, _ref5$method, method, encoded, signer, url, headersObj, body, url_path, _url, bodySize, lowercaseHeaders, _i8, _Object$entries8, _Object$entries8$_i, key, value, bodyKeys, isPath, signingFields, signedRequest, finalHeaders, _i9, _Object$entries9, _Object$entries9$_i, _key3, _value3, result;
+    return _regenerator().w(function (_context5) {
+      while (1) switch (_context5.n) {
+        case 0:
+          path = _ref5.path, _ref5$signPath = _ref5.signPath, signPath = _ref5$signPath === void 0 ? true : _ref5$signPath, _ref5$method = _ref5.method, method = _ref5$method === void 0 ? "POST" : _ref5$method, encoded = _ref5.encoded, signer = _ref5.signer, url = _ref5.url;
+          headersObj = encoded ? encoded.headers : {};
+          body = encoded ? encoded.body : undefined;
           url_path = typeof signPath === "string" ? signPath : path;
           _url = joinUrl({
             url: url,
             path: url_path
-          });
-          headersObj["path"] = path;
-          if (bodyData && !headersObj["content-length"]) {
-            bodySize = bodyData.size || bodyData.byteLength || 0;
+          }); // Only add path header if path is provided
+          if (path) headersObj["path"] = path;
+          if (body && !headersObj["content-length"]) {
+            bodySize = body.size || body.byteLength || 0;
             if (bodySize > 0) headersObj["content-length"] = String(bodySize);
           }
           lowercaseHeaders = {};
-          for (_i0 = 0, _Object$entries0 = Object.entries(headersObj); _i0 < _Object$entries0.length; _i0++) {
-            _Object$entries0$_i = _slicedToArray(_Object$entries0[_i0], 2), key = _Object$entries0$_i[0], value = _Object$entries0$_i[1];
+          for (_i8 = 0, _Object$entries8 = Object.entries(headersObj); _i8 < _Object$entries8.length; _i8++) {
+            _Object$entries8$_i = _slicedToArray(_Object$entries8[_i8], 2), key = _Object$entries8$_i[0], value = _Object$entries8$_i[1];
             lowercaseHeaders[key.toLowerCase()] = value;
           }
           bodyKeys = headersObj["body-keys"] ? headersObj["body-keys"].replace(/"/g, "").split(",").map(function (k) {
@@ -419,23 +473,23 @@ function _sign2() {
           signingFields = Object.keys(lowercaseHeaders).filter(function (key) {
             if (key === "path") isPath = true;
             return key !== "body-keys" && key !== "path" && !bodyKeys.includes(key);
-          });
+          }); // Only add @path if signPath is enabled AND path header exists
           if (signPath !== false && isPath) signingFields.push("@path");
-          _context4.n = 1;
+          _context5.n = 1;
           return (0, _send.toHttpSigner)(signer)({
             request: {
               url: _url,
-              method: "POST",
+              method: method,
               headers: lowercaseHeaders
             },
             fields: signingFields
           });
         case 1:
-          signedRequest = _context4.v;
+          signedRequest = _context5.v;
           finalHeaders = {};
-          for (_i1 = 0, _Object$entries1 = Object.entries(headersObj); _i1 < _Object$entries1.length; _i1++) {
-            _Object$entries1$_i = _slicedToArray(_Object$entries1[_i1], 2), _key4 = _Object$entries1$_i[0], _value4 = _Object$entries1$_i[1];
-            finalHeaders[_key4] = _value4;
+          for (_i9 = 0, _Object$entries9 = Object.entries(headersObj); _i9 < _Object$entries9.length; _i9++) {
+            _Object$entries9$_i = _slicedToArray(_Object$entries9[_i9], 2), _key3 = _Object$entries9$_i[0], _value3 = _Object$entries9$_i[1];
+            finalHeaders[_key3] = _value3;
           }
           finalHeaders["signature"] = signedRequest.headers["signature"];
           finalHeaders["signature-input"] = signedRequest.headers["signature-input"];
@@ -444,52 +498,28 @@ function _sign2() {
           }
           result = {
             url: _url,
-            method: "POST",
+            method: method,
             headers: finalHeaders
           };
-          if (bodyData) result.body = bodyData;
-          return _context4.a(2, result);
+          if (body) result.body = body;
+          return _context5.a(2, result);
       }
-    }, _callee4);
+    }, _callee5);
   }));
-  return _sign2.apply(this, arguments);
+  return _sign3.apply(this, arguments);
 }
-var _filterUndefined = function filterUndefined(obj) {
-  if (obj === null || obj === undefined) return obj;
-  if (Array.isArray(obj)) {
-    return obj.map(_filterUndefined).filter(function (item) {
-      return item !== undefined;
-    });
-  }
-  if (_typeof(obj) === "object" && obj.constructor === Object) {
-    var filtered = {};
-    for (var _i7 = 0, _Object$entries7 = Object.entries(obj); _i7 < _Object$entries7.length; _i7++) {
-      var _Object$entries7$_i = _slicedToArray(_Object$entries7[_i7], 2),
-        key = _Object$entries7$_i[0],
-        value = _Object$entries7$_i[1];
-      var filteredValue = _filterUndefined(value);
-      if (filteredValue !== undefined) {
-        filtered[key] = filteredValue;
-      }
-    }
-    return filtered;
-  }
-  return obj;
-};
-
-// Signer factory function that matches signer.js API
 function signer(config) {
   var signer = config.signer,
     _config$url = config.url,
     url = _config$url === void 0 ? "http://localhost:10001" : _config$url;
   if (!signer) throw new Error("Signer is required for mainnet mode");
   return /*#__PURE__*/function () {
-    var _ref5 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(fields) {
-      var _ref6,
-        _ref6$encoded,
+    var _ref6 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(fields) {
+      var _ref7,
+        _ref7$encoded,
         _encoded,
-        _ref6$path,
-        _path,
+        _ref7$path,
+        signPath,
         _fields$path,
         path,
         _fields$method,
@@ -497,35 +527,13 @@ function signer(config) {
         aoFields,
         filteredFields,
         encoded,
-        headersObj,
-        body,
-        url_path,
-        _url,
-        bodySize,
-        lowercaseHeaders,
-        _i8,
-        _Object$entries8,
-        _Object$entries8$_i,
-        key,
-        value,
-        bodyKeys,
-        isPath,
-        signingFields,
-        signedRequest,
-        finalHeaders,
-        _i9,
-        _Object$entries9,
-        _Object$entries9$_i,
-        _key3,
-        _value3,
-        result,
         _args3 = arguments,
         _t2;
       return _regenerator().w(function (_context3) {
         while (1) switch (_context3.n) {
           case 0:
-            _ref6 = _args3.length > 1 && _args3[1] !== undefined ? _args3[1] : {}, _ref6$encoded = _ref6.encoded, _encoded = _ref6$encoded === void 0 ? false : _ref6$encoded, _ref6$path = _ref6.path, _path = _ref6$path === void 0 ? true : _ref6$path;
-            _fields$path = fields.path, path = _fields$path === void 0 ? "/relay/process" : _fields$path, _fields$method = fields.method, method = _fields$method === void 0 ? "POST" : _fields$method, aoFields = _objectWithoutProperties(fields, _excluded); // Filter out undefined values before encoding
+            _ref7 = _args3.length > 1 && _args3[1] !== undefined ? _args3[1] : {}, _ref7$encoded = _ref7.encoded, _encoded = _ref7$encoded === void 0 ? false : _ref7$encoded, _ref7$path = _ref7.path, signPath = _ref7$path === void 0 ? true : _ref7$path;
+            _fields$path = fields.path, path = _fields$path === void 0 ? "/relay/process" : _fields$path, _fields$method = fields.method, method = _fields$method === void 0 ? "POST" : _fields$method, aoFields = _objectWithoutProperties(fields, _excluded2);
             filteredFields = _filterUndefined(aoFields);
             if (!_encoded) {
               _context3.n = 1;
@@ -536,70 +544,27 @@ function signer(config) {
             break;
           case 1:
             _context3.n = 2;
-            return (0, _encode.enc)(filteredFields);
+            return encode(filteredFields, path);
           case 2:
             _t2 = _context3.v;
           case 3:
             encoded = _t2;
-            headersObj = encoded ? encoded.headers : {};
-            body = encoded ? encoded.body : undefined;
-            url_path = typeof _path === "string" ? _path : path;
-            _url = joinUrl({
-              url: url,
-              path: url_path
-            });
-            headersObj["path"] = path;
-            if (body && !headersObj["content-length"]) {
-              bodySize = body.size || body.byteLength || 0;
-              if (bodySize > 0) headersObj["content-length"] = String(bodySize);
-            }
-            lowercaseHeaders = {};
-            for (_i8 = 0, _Object$entries8 = Object.entries(headersObj); _i8 < _Object$entries8.length; _i8++) {
-              _Object$entries8$_i = _slicedToArray(_Object$entries8[_i8], 2), key = _Object$entries8$_i[0], value = _Object$entries8$_i[1];
-              lowercaseHeaders[key.toLowerCase()] = value;
-            }
-            bodyKeys = headersObj["body-keys"] ? headersObj["body-keys"].replace(/"/g, "").split(",").map(function (k) {
-              return k.trim();
-            }) : [];
-            isPath = false;
-            signingFields = Object.keys(lowercaseHeaders).filter(function (key) {
-              if (key === "path") isPath = true;
-              return key !== "body-keys" && key !== "path" && !bodyKeys.includes(key);
-            });
-            if (_path !== false && isPath) signingFields.push("@path");
             _context3.n = 4;
-            return (0, _send.toHttpSigner)(signer)({
-              request: {
-                url: _url,
-                method: method,
-                headers: lowercaseHeaders
-              },
-              fields: signingFields
+            return _sign({
+              path: path,
+              signPath: signPath,
+              method: method,
+              encoded: encoded,
+              signer: signer,
+              url: url
             });
           case 4:
-            signedRequest = _context3.v;
-            finalHeaders = {};
-            for (_i9 = 0, _Object$entries9 = Object.entries(headersObj); _i9 < _Object$entries9.length; _i9++) {
-              _Object$entries9$_i = _slicedToArray(_Object$entries9[_i9], 2), _key3 = _Object$entries9$_i[0], _value3 = _Object$entries9$_i[1];
-              finalHeaders[_key3] = _value3;
-            }
-            finalHeaders["signature"] = signedRequest.headers["signature"];
-            finalHeaders["signature-input"] = signedRequest.headers["signature-input"];
-            if (headersObj["body-keys"]) {
-              finalHeaders["body-keys"] = headersObj["body-keys"];
-            }
-            result = {
-              url: _url,
-              method: method,
-              headers: finalHeaders
-            };
-            if (body) result.body = body;
-            return _context3.a(2, result);
+            return _context3.a(2, _context3.v);
         }
       }, _callee3);
     }));
-    return function (_x6) {
-      return _ref5.apply(this, arguments);
+    return function (_x7) {
+      return _ref6.apply(this, arguments);
     };
   }();
 }

package/esm/commit.js

@@ -1,9 +1,48 @@
 import { id, base, hashpath, rsaid, hmacid } from "./id.js"
 import { toAddr } from "./utils.js"
 import { extractPubKey } from "./signer-utils.js"
+import { verify } from "./signer-utils.js"
 
+// todo: handle @
 export const commit = async (obj, opts) => {
   const msg = await opts.signer(obj, opts)
+  const {
+    decodedSignatureInput: { components },
+  } = await verify(msg)
+
+  let body = {}
+
+  // Check for inline-body-key
+  const inlineBodyKey = msg.headers["inline-body-key"]
+
+  // Build body from components
+  for (const v of components) {
+    const key = v === "@path" ? "path" : v
+    body[key] = msg.headers[key]
+  }
+
+  // Handle body resolution
+  if (msg.body) {
+    let bodyContent
+
+    if (msg.body instanceof Blob) {
+      const arrayBuffer = await msg.body.arrayBuffer()
+      bodyContent = Buffer.from(arrayBuffer)
+    } else {
+      bodyContent = msg.body
+    }
+
+    // If inline-body-key is "data", put content in data field
+    if (inlineBodyKey === "data") {
+      body.data = bodyContent
+    } else {
+      body.body = bodyContent
+    }
+  }
+
+  // Remove inline-body-key from the final body as it's just metadata
+  delete body["inline-body-key"]
+
   const hmacId = hmacid(msg.headers)
   const rsaId = rsaid(msg.headers)
   const pub = extractPubKey(msg.headers)
@@ -14,11 +53,12 @@ export const commit = async (obj, opts) => {
     signature: msg.headers.signature,
     "signature-input": msg.headers["signature-input"],
   }
-  return {
+  const committed = {
     commitments: {
       [rsaId]: { ...meta, committer, ...sigs },
       [hmacId]: { ...meta2, ...sigs },
     },
-    ...obj,
+    ...body,
   }
+  return committed
 }

package/esm/signer.js

@@ -183,7 +183,9 @@ const smartSign = async (obj, path) => {
 
     if (canUseSimpleEncoding) {
       // Build a simple message that won't trigger multipart
-      const message = { path: path || filtered.path || "/~wao@1.0/httpsig" }
+      const message = {}
+      if (path) message.path = path
+
       const types = []
 
       for (const [key, value] of Object.entries(filtered)) {
@@ -204,7 +206,7 @@ const smartSign = async (obj, path) => {
           message[key] = encodeAsStructuredFieldList(value)
         } else if (typeof value === "number") {
           types.push(
-            `${key}="${Number.isInteger(value) ? "integer" : "float"}"`,
+            `${key}="${Number.isInteger(value) ? "integer" : "float"}"`
           )
           message[key] = String(value)
         } else if (typeof value === "boolean") {
@@ -228,7 +230,7 @@ const smartSign = async (obj, path) => {
     // For complex structures that need multipart, use enc()
     const normalized = normalize({
       ...filtered,
-      path: path || "/~wao@1.0/httpsig",
+      ...(path && { path }),
     })
     const result = await enc(normalized)
 
@@ -237,7 +239,7 @@ const smartSign = async (obj, path) => {
     const flattened = {
       ...result.headers,
       body: result.body,
-      path: normalized.path || path || "/~wao@1.0/httpsig",
+      ...(path && { path }),
     }
 
     // httpsig_to expects the structured format
@@ -248,7 +250,8 @@ const smartSign = async (obj, path) => {
     console.error("Encoding failed:", error)
 
     // Fallback: create a simple structure
-    const result = { path: path || "/~wao@1.0/httpsig" }
+    const result = {}
+    if (path) result.path = path
 
     for (const [key, value] of Object.entries(obj)) {
       if (key === "path") continue
@@ -262,31 +265,35 @@ const smartSign = async (obj, path) => {
   }
 }
 
-// Internal sign function that matches the original signature
-const _sign = async (obj, path) => {
+// Internal encode function that uses the original impl as much as possible
+const encode = async (obj, path) => {
   // Filter out undefined values before processing
   const filtered = filterUndefined(obj)
 
   // If object contains binary data, use enc() directly
   if (hasBinaryData(filtered)) {
-    return await smartSign(filtered, path)
+    // For binary data, use enc() which handles multipart
+    return await enc(filtered)
   }
 
   // Otherwise use the standard pipeline
-  const encoded = httpsig_to(
-    normalize(
-      structured_from(
-        normalize({ ...filtered, path: path || "/~wao@1.0/httpsig" }),
-      ),
-    ),
-  )
+  let fields = { ...filtered }
+  // Only add path if explicitly provided
+  if (path) fields.path = path
+
+  // Try the standard encoding pipeline
+  const encoded = httpsig_to(normalize(structured_from(normalize(fields))))
 
   // Check if the encoded result is valid for HTTP headers
   if (!isValid(encoded)) {
-    return await smartSign(filtered, path)
+    // If invalid, fall back to enc()
+    return await enc(filtered)
   }
 
-  return encoded
+  // For non-binary data, return in the same format as enc()
+  // httpsig_to returns a flattened object, so we need to separate headers and body
+  const { body, ...headers } = encoded
+  return { headers, body }
 }
 
 // Helper to join URL and path
@@ -304,15 +311,46 @@ export async function sign({ url, path, msg: encoded, jwk, signPath = true }) {
   const { body = null, ...headers } = encoded
   let _enc = { headers }
   if (body) _enc.body = new Blob([body])
+  return await _sign({ path, signPath, encoded, signer, url })
+}
+
+// Helper function to recursively filter out undefined values
+const filterUndefined = obj => {
+  if (obj === null || obj === undefined) return obj
+  if (Array.isArray(obj)) {
+    return obj.map(filterUndefined).filter(item => item !== undefined)
+  }
+  if (typeof obj === "object" && obj.constructor === Object) {
+    const filtered = {}
+    for (const [key, value] of Object.entries(obj)) {
+      const filteredValue = filterUndefined(value)
+      if (filteredValue !== undefined) {
+        filtered[key] = filteredValue
+      }
+    }
+    return filtered
+  }
+  return obj
+}
 
-  const headersObj = _enc.headers || {}
-  const bodyData = _enc.body || undefined
+async function _sign({
+  path,
+  signPath = true,
+  method = "POST",
+  encoded,
+  signer,
+  url,
+}) {
+  const headersObj = encoded ? encoded.headers : {}
+  const body = encoded ? encoded.body : undefined
   let url_path = typeof signPath === "string" ? signPath : path
   const _url = joinUrl({ url, path: url_path })
 
-  headersObj["path"] = path
-  if (bodyData && !headersObj["content-length"]) {
-    const bodySize = bodyData.size || bodyData.byteLength || 0
+  // Only add path header if path is provided
+  if (path) headersObj["path"] = path
+
+  if (body && !headersObj["content-length"]) {
+    const bodySize = body.size || body.byteLength || 0
     if (bodySize > 0) headersObj["content-length"] = String(bodySize)
   }
 
@@ -334,10 +372,11 @@ export async function sign({ url, path, msg: encoded, jwk, signPath = true }) {
     return key !== "body-keys" && key !== "path" && !bodyKeys.includes(key)
   })
 
+  // Only add @path if signPath is enabled AND path header exists
   if (signPath !== false && isPath) signingFields.push("@path")
 
   const signedRequest = await toHttpSigner(signer)({
-    request: { url: _url, method: "POST", headers: lowercaseHeaders },
+    request: { url: _url, method, headers: lowercaseHeaders },
     fields: signingFields,
   })
 
@@ -353,98 +392,25 @@ export async function sign({ url, path, msg: encoded, jwk, signPath = true }) {
     finalHeaders["body-keys"] = headersObj["body-keys"]
   }
 
-  const result = { url: _url, method: "POST", headers: finalHeaders }
-  if (bodyData) result.body = bodyData
+  const result = { url: _url, method, headers: finalHeaders }
+  if (body) result.body = body
 
   return result
 }
 
-// Helper function to recursively filter out undefined values
-const filterUndefined = obj => {
-  if (obj === null || obj === undefined) return obj
-  if (Array.isArray(obj)) {
-    return obj.map(filterUndefined).filter(item => item !== undefined)
-  }
-  if (typeof obj === "object" && obj.constructor === Object) {
-    const filtered = {}
-    for (const [key, value] of Object.entries(obj)) {
-      const filteredValue = filterUndefined(value)
-      if (filteredValue !== undefined) {
-        filtered[key] = filteredValue
-      }
-    }
-    return filtered
-  }
-  return obj
-}
-
-// Signer factory function that matches signer.js API
 export function signer(config) {
   const { signer, url = "http://localhost:10001" } = config
   if (!signer) throw new Error("Signer is required for mainnet mode")
-
   return async (
     fields,
-    { encoded: _encoded = false, path: _path = true } = {},
+    { encoded: _encoded = false, path: signPath = true } = {}
   ) => {
     const { path = "/relay/process", method = "POST", ...aoFields } = fields
-
-    // Filter out undefined values before encoding
     const filteredFields = filterUndefined(aoFields)
-    const encoded = _encoded ? filteredFields : await enc(filteredFields)
-
-    const headersObj = encoded ? encoded.headers : {}
-    const body = encoded ? encoded.body : undefined
-    let url_path = typeof _path === "string" ? _path : path
-    const _url = joinUrl({ url, path: url_path })
-
-    headersObj["path"] = path
-    if (body && !headersObj["content-length"]) {
-      const bodySize = body.size || body.byteLength || 0
-      if (bodySize > 0) headersObj["content-length"] = String(bodySize)
-    }
-
-    const lowercaseHeaders = {}
-    for (const [key, value] of Object.entries(headersObj)) {
-      lowercaseHeaders[key.toLowerCase()] = value
-    }
-
-    const bodyKeys = headersObj["body-keys"]
-      ? headersObj["body-keys"]
-          .replace(/"/g, "")
-          .split(",")
-          .map(k => k.trim())
-      : []
-
-    let isPath = false
-    const signingFields = Object.keys(lowercaseHeaders).filter(key => {
-      if (key === "path") isPath = true
-      return key !== "body-keys" && key !== "path" && !bodyKeys.includes(key)
-    })
-
-    if (_path !== false && isPath) signingFields.push("@path")
-
-    const signedRequest = await toHttpSigner(signer)({
-      request: { url: _url, method, headers: lowercaseHeaders },
-      fields: signingFields,
-    })
-
-    const finalHeaders = {}
-    for (const [key, value] of Object.entries(headersObj)) {
-      finalHeaders[key] = value
-    }
-
-    finalHeaders["signature"] = signedRequest.headers["signature"]
-    finalHeaders["signature-input"] = signedRequest.headers["signature-input"]
-
-    if (headersObj["body-keys"]) {
-      finalHeaders["body-keys"] = headersObj["body-keys"]
-    }
-
-    const result = { url: _url, method, headers: finalHeaders }
-    if (body) result.body = body
-
-    return result
+    const encoded = _encoded
+      ? filteredFields
+      : await encode(filteredFields, path)
+    return await _sign({ path, signPath, method, encoded, signer, url })
   }
 }
 
@@ -452,5 +418,3 @@ export const createSigner = (jwk, url) => {
   const _signer = _createSigner(jwk, url)
   return signer({ signer: _signer, url })
 }
-
-export { _sign as signInternal }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hbsig",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "main": "cjs/index.js",
   "license": "MIT",
   "devDependencies": {