wao 0.27.3 → 0.28.0

package/esm/id.js

@@ -0,0 +1,222 @@
+import { hash, hmac } from "fast-sha256"
+
+/**
+ * Parse structured field dictionary format
+ * Handles both complex format: name=(components);params
+ * and simple format: name=:value:
+ */
+function parseStructuredFieldDictionary(input) {
+  // Try complex format first
+  const match = input.match(/([^=]+)=\((.*?)\);(.*)$/)
+  if (match) {
+    const name = match[1]
+    const components = match[2].split(" ")
+    const params = {}
+
+    const paramPairs = match[3].split(";").filter(p => p)
+    paramPairs.forEach(pair => {
+      const [key, value] = pair.split("=")
+      if (key && value) {
+        params[key] = value.replace(/"/g, "")
+      }
+    })
+
+    return { name, components, params }
+  }
+
+  // Try simple format
+  const simpleMatch = input.match(/([^=]+)=:([^:]+):/)
+  if (simpleMatch) {
+    return { name: simpleMatch[1], value: simpleMatch[2] }
+  }
+
+  return null
+}
+
+/**
+ * Convert base64url string to base64
+ */
+function base64urlToBase64(str) {
+  return str.replace(/-/g, "+").replace(/_/g, "/")
+}
+
+/**
+ * Convert Uint8Array to base64url string
+ */
+function uint8ArrayToBase64url(bytes) {
+  // Convert to base64
+  let binary = ""
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i])
+  }
+  const base64 = btoa(binary)
+
+  // Convert to base64url
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "")
+}
+
+/**
+ * Generate commitment ID for RSA-PSS and ECDSA signatures
+ * The ID is the SHA256 hash of the raw signature bytes
+ *
+ * @param {Object} commitment - The commitment object containing signature
+ * @returns {string} The commitment ID in base64url format
+ */
+function generateRsaCommitmentId(commitment) {
+  // Extract the base64 signature from structured field format
+  // Format: "signature-name=:BASE64_SIGNATURE:"
+  const match = commitment.signature.match(/^[^=]+=:([^:]+):/)
+  if (!match) {
+    throw new Error("Invalid signature format")
+  }
+
+  const signatureBase64 = match[1]
+  // Convert base64 to Uint8Array
+  const signatureBinary = Uint8Array.from(atob(signatureBase64), c =>
+    c.charCodeAt(0)
+  )
+
+  // SHA256 hash of the raw signature
+  const hashResult = hash(signatureBinary)
+  const id = uint8ArrayToBase64url(hashResult)
+
+  return id
+}
+
+/**
+ * Generate HMAC commitment ID for HyperBEAM messages
+ * The ID is deterministic based on message content only
+ *
+ * The Erlang implementation sorts components WITH @ prefix included,
+ * then removes @ from derived components in the signature base.
+ *
+ * @param {Object} message - The message with signature and signature-input
+ * @returns {string} The commitment ID in base64url format
+ */
+function generateHmacCommitmentId(message) {
+  // Parse signature-input to get components
+  const parsed = parseStructuredFieldDictionary(message["signature-input"])
+  if (!parsed || !parsed.components) {
+    throw new Error("Failed to parse signature-input")
+  }
+
+  // Sort components AS-IS (with quotes and @ prefix)
+  const sortedComponents = [...parsed.components].sort()
+
+  // Build signature base in sorted order
+  const lines = []
+
+  sortedComponents.forEach(component => {
+    const cleanComponent = component.replace(/"/g, "")
+    let fieldName = cleanComponent
+    let value
+
+    // For derived components (starting with @), remove @ in the signature base
+    if (cleanComponent.startsWith("@")) {
+      fieldName = cleanComponent.substring(1)
+      value = message[fieldName]
+    } else {
+      value = message[cleanComponent]
+    }
+
+    if (value === undefined || value === null) {
+      value = ""
+    } else if (typeof value === "number") {
+      value = value.toString()
+    }
+
+    lines.push(`"${fieldName}": ${value}`)
+  })
+
+  // Add signature-params line with sorted components (keeping @ prefix)
+  const paramsComponents = sortedComponents.join(" ")
+  lines.push(
+    `"@signature-params": (${paramsComponents});alg="hmac-sha256";keyid="ao"`
+  )
+
+  const signatureBase = lines.join("\n")
+
+  // Generate HMAC with key "ao"
+  // Convert string to Uint8Array
+  const messageBytes = new TextEncoder().encode(signatureBase)
+  const keyBytes = new TextEncoder().encode("ao")
+
+  const hmacResult = hmac(keyBytes, messageBytes)
+  return uint8ArrayToBase64url(hmacResult)
+}
+
+/**
+ * Generate commitment ID based on the algorithm type
+ *
+ * @param {Object} commitment - The commitment object containing alg, signature, etc.
+ * @param {Object} fullMessage - The full message (required for HMAC)
+ * @returns {string} The commitment ID in base64url format
+ */
+function generateCommitmentId(commitment, fullMessage = null) {
+  switch (commitment.alg) {
+    case "rsa-pss-sha512":
+    case "ecdsa-p256-sha256":
+      return generateRsaCommitmentId(commitment)
+
+    case "hmac-sha256":
+      if (!fullMessage) {
+        throw new Error("HMAC commitment IDs require full message context")
+      }
+      return generateHmacCommitmentId(fullMessage)
+
+    default:
+      throw new Error(`Unsupported algorithm: ${commitment.alg}`)
+  }
+}
+
+/**
+ * Extract all commitment IDs from a HyperBEAM message
+ *
+ * @param {Object} message - The message with commitments
+ * @returns {Object} Map of commitment IDs to their types
+ */
+function extractCommitmentIds(message) {
+  const ids = {}
+
+  if (!message.commitments) {
+    return ids
+  }
+
+  for (const [id, commitment] of Object.entries(message.commitments)) {
+    ids[id] = {
+      alg: commitment.alg,
+      committer: commitment.committer,
+      device: commitment["commitment-device"],
+    }
+  }
+
+  return ids
+}
+
+/**
+ * Verify a commitment ID matches the expected value
+ *
+ * @param {Object} commitment - The commitment object
+ * @param {string} expectedId - The expected commitment ID
+ * @param {Object} fullMessage - The full message (required for HMAC)
+ * @returns {boolean} True if the ID matches
+ */
+function verifyCommitmentId(commitment, expectedId, fullMessage = null) {
+  try {
+    const calculatedId = generateCommitmentId(commitment, fullMessage)
+    return calculatedId === expectedId
+  } catch (error) {
+    console.error("Error verifying commitment ID:", error)
+    return false
+  }
+}
+
+// Export all functions
+export {
+  generateCommitmentId,
+  generateRsaCommitmentId,
+  generateHmacCommitmentId,
+  extractCommitmentIds,
+  verifyCommitmentId,
+  parseStructuredFieldDictionary,
+}

package/esm/send.js

@@ -9,6 +9,8 @@ const {
 } = httpbis
 
 export async function send(signedMsg, fetchImpl = fetch) {
+  // IMPORTANT: Use the URL from signedMsg.url, NOT from any path header
+  // This ensures we send to the correct URL even if path header is different
   const fetchOptions = {
     method: signedMsg.method,
     headers: signedMsg.headers,
@@ -21,8 +23,9 @@ export async function send(signedMsg, fetchImpl = fetch) {
   ) {
     fetchOptions.body = signedMsg.body
   }
-  const response = await fetchImpl(signedMsg.url, fetchOptions)
 
+  // Use the URL as provided, ignoring any path header
+  const response = await fetchImpl(signedMsg.url, fetchOptions)
   if (response.status >= 400) {
     throw new Error(`${response.status}: ${await response.text()}`)
   }
@@ -90,10 +93,8 @@ export const toHttpSigner = signer => {
 
       signatureBaseArray.push(['"@signature-params"', [signatureInput]])
       signatureBase = formatSignatureBase(signatureBaseArray)
-
       return new TextEncoder().encode(signatureBase)
     }
-
     const result = await signer(create, "httpsig")
 
     if (!createCalled) {

package/esm/signer-utils.js

@@ -207,7 +207,7 @@ export async function verify(signedMessage, publicKey) {
  * @param {string} [signatureName] - Optional signature name to look for
  * @returns {Buffer|null} Public key buffer or null
  */
-function extractPublicKeyFromHeaders(headers, signatureName) {
+export function extractPublicKeyFromHeaders(headers, signatureName) {
   const signatureInput =
     headers["signature-input"] || headers["Signature-Input"]
   if (!signatureInput) return null

package/esm/signer.js

@@ -5,7 +5,11 @@ const joinUrl = ({ url, path }) => {
   if (path.startsWith("http://") || path.startsWith("https://")) {
     return path
   }
-  return url.endsWith("/") ? url.slice(0, -1) + path : url + path
+  // Ensure path starts with /
+  const normalizedPath = path.startsWith("/") ? path : "/" + path
+  return url.endsWith("/")
+    ? url.slice(0, -1) + normalizedPath
+    : url + normalizedPath
 }
 
 export function signer(config) {
@@ -15,7 +19,7 @@ export function signer(config) {
     throw new Error("Signer is required for mainnet mode")
   }
 
-  return async function sign(fields) {
+  return async function sign(fields, { path: _path = false } = {}) {
     const { path = "/relay/process", method = "POST", ...restFields } = fields
     const aoFields = { ...restFields }
     const encoded = await enc(aoFields)
@@ -24,6 +28,8 @@ export function signer(config) {
 
     const _url = joinUrl({ url, path })
 
+    headersObj["path"] = path
+
     if (body && !headersObj["content-length"]) {
       const bodySize = body.size || body.byteLength || 0
       if (bodySize > 0) {
@@ -35,21 +41,39 @@ export function signer(config) {
     for (const [key, value] of Object.entries(headersObj)) {
       lowercaseHeaders[key.toLowerCase()] = value
     }
-
+    if (lowercaseHeaders.path && /^\//.test(lowercaseHeaders.path)) {
+      //const sp = lowercaseHeaders.path.split("/")
+      //lowercaseHeaders.path = sp.slice(sp.length - 1).join("/")
+    }
+    // Parse body-keys if present
+    const bodyKeys = headersObj["body-keys"]
+      ? headersObj["body-keys"]
+          .replace(/"/g, "")
+          .split(",")
+          .map(k => k.trim())
+      : []
+
+    // Collect fields to sign from headers
     const signingFields = Object.keys(lowercaseHeaders).filter(
-      key => key !== "body-keys"
+      key => key !== "body-keys" && key !== "path" && !bodyKeys.includes(key) // Also exclude fields that are in body-keys
     )
-
+    // Always include @path in the signature
+    //if (!signingFields.includes("path")) signingFields.push("path")
+    if (_path) signingFields.push("path")
+    // Ensure we have at least one field to sign
     if (signingFields.length === 0 && !body) {
       lowercaseHeaders["content-length"] = "0"
       signingFields.push("content-length")
     }
 
     const signedRequest = await toHttpSigner(signer)({
-      request: { url: _url, method, headers: lowercaseHeaders },
+      request: {
+        url: _url,
+        method,
+        headers: lowercaseHeaders,
+      },
       fields: signingFields,
     })
-
     const finalHeaders = {}
 
     for (const [key, value] of Object.entries(headersObj)) {
@@ -62,7 +86,6 @@ export function signer(config) {
     if (headersObj["body-keys"]) {
       finalHeaders["body-keys"] = headersObj["body-keys"]
     }
-
     const result = { url: _url, method, headers: finalHeaders }
 
     if (body) result.body = body
@@ -70,3 +93,5 @@ export function signer(config) {
     return result
   }
 }
+
+// stack / simple-pay / patch / hyperbeam / hyperbeam-aos / scheduler / cron

package/esm/utils.js

@@ -1,5 +1,12 @@
 import { graphql, parse, validate, buildSchema } from "graphql"
 import sha256 from "fast-sha256"
+import {
+  generateCommitmentId,
+  generateRsaCommitmentId,
+  generateHmacCommitmentId,
+  verifyCommitmentId,
+} from "./id.js"
+export { generateRsaCommitmentId as rsaid, generateHmacCommitmentId as hmacid }
 import {
   clone,
   is,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wao",
-  "version": "0.27.3",
+  "version": "0.28.0",
   "bin": {
     "wao": "./cjs/cli.js",
     "wao-esm": "./esm/cli.js"