wao 0.41.3 → 0.41.5

package/hbsig/dist/esm/collect-body-keys.js

@@ -0,0 +1,436 @@
+import {
+  hasNonAscii,
+  sha256,
+  hasNewline,
+  isBytes,
+  isPojo,
+} from "./encode-utils.js"
+
+// Helper functions
+const isEmpty = value => {
+  if (typeof value === "string") return value === ""
+  if (Array.isArray(value)) return value.length === 0
+  if (isPojo(value)) return Object.keys(value).length === 0
+  if (isBytes(value)) return value.length === 0 || value.byteLength === 0
+  return false
+}
+
+const hasOnlyEmptyValues = obj => {
+  if (!isPojo(obj)) return false
+  return Object.values(obj).every(
+    v =>
+      (typeof v === "string" && v === "") ||
+      (Array.isArray(v) && v.length === 0) ||
+      (isPojo(v) && Object.keys(v).length === 0)
+  )
+}
+
+const isSimpleValue = value => {
+  return (
+    typeof value === "string" ||
+    typeof value === "number" ||
+    typeof value === "boolean" ||
+    value === null ||
+    value === undefined ||
+    typeof value === "symbol"
+  )
+}
+
+const getValueByPath = (obj, path) => {
+  const parts = path.split("/")
+  let value = obj
+  for (const part of parts) {
+    if (/^\d+$/.test(part)) {
+      value = value[parseInt(part) - 1]
+    } else {
+      value = value[part]
+    }
+  }
+  return value
+}
+
+const canArrayBeInHeader = array => {
+  // Empty arrays can be in headers
+  if (array.length === 0) return true
+
+  // Arrays with objects must go to body
+  if (array.some(item => isPojo(item))) return false
+
+  // Arrays with binary data must go to body
+  if (array.some(item => isBytes(item) && item.length > 0)) return false
+
+  // Arrays with non-ASCII strings must go to body
+  if (array.some(item => typeof item === "string" && hasNonAscii(item)))
+    return false
+
+  // Arrays with nested arrays must go to body (to match original behavior)
+  if (array.some(item => Array.isArray(item))) return false
+
+  // Arrays with nested arrays that have objects must go to body
+  if (
+    array.some(
+      item => Array.isArray(item) && item.some(subItem => isPojo(subItem))
+    )
+  )
+    return false
+
+  // Simple arrays of primitives can stay in headers
+  return true
+}
+
+// Array analysis helper
+const analyzeArray = array => {
+  const analysis = {
+    hasObjects: false,
+    hasArrays: false,
+    hasNonObjects: false,
+    hasArraysOfObjects: false,
+    hasEmptyStrings: false,
+    hasEmptyObjects: false,
+    hasNonEmptyObjects: false,
+    hasObjectsWithOnlyEmptyValues: false,
+    hasOnlyEmptyElements: true,
+  }
+
+  for (const item of array) {
+    if (isPojo(item)) {
+      analysis.hasObjects = true
+      if (Object.keys(item).length === 0) {
+        analysis.hasEmptyObjects = true
+      } else {
+        analysis.hasNonEmptyObjects = true
+        if (hasOnlyEmptyValues(item)) {
+          analysis.hasObjectsWithOnlyEmptyValues = true
+        }
+      }
+    } else if (Array.isArray(item)) {
+      analysis.hasArrays = true
+      if (item.some(subItem => isPojo(subItem))) {
+        analysis.hasArraysOfObjects = true
+      }
+    } else {
+      analysis.hasNonObjects = true
+    }
+
+    if (typeof item === "string" && item === "") {
+      analysis.hasEmptyStrings = true
+    }
+
+    if (!isEmpty(item)) {
+      analysis.hasOnlyEmptyElements = false
+    }
+  }
+
+  return analysis
+}
+
+// Body key collector class
+class BodyKeyCollector {
+  constructor(obj) {
+    this.obj = obj
+    this.keys = []
+  }
+
+  collect() {
+    this.processRootObject()
+    return this.deduplicateAndFilter()
+  }
+
+  // Process top-level object
+  processRootObject() {
+    const objKeys = Object.keys(this.obj)
+
+    for (const [key, value] of Object.entries(this.obj)) {
+      if (this.isSpecialDataBodyField(key, value, objKeys)) {
+        this.keys.push(key)
+      } else if (Array.isArray(value) && value.length > 0) {
+        // Check if array can stay in header
+        if (!canArrayBeInHeader(value)) {
+          this.processRootArray(key, value)
+        }
+      } else if (isPojo(value)) {
+        this.processRootNestedObject(key, value)
+      } else if (this.needsBodyKey(key, value)) {
+        this.keys.push(key)
+      }
+    }
+  }
+
+  // Check if field is special data/body field
+  isSpecialDataBodyField(key, value, objKeys) {
+    if (
+      (key === "data" || key === "body") &&
+      isSimpleValue(value) &&
+      objKeys.length > 1
+    ) {
+      const otherKey = key === "data" ? "body" : "data"
+      const otherValue = this.obj[otherKey]
+
+      if (
+        otherValue &&
+        isPojo(otherValue) &&
+        Object.keys(otherValue).length > 0
+      ) {
+        return false
+      }
+      return true
+    }
+    return false
+  }
+
+  // Check if value needs a body key
+  needsBodyKey(key, value) {
+    return (
+      (isBytes(value) && value.length > 0) ||
+      (typeof value === "string" && value.includes("\n")) ||
+      (typeof value === "string" && hasNonAscii(value))
+    )
+  }
+
+  // Process root-level arrays
+  processRootArray(key, array) {
+    const analysis = analyzeArray(array)
+    let bodyPartCounter = 1
+
+    if (analysis.hasArraysOfObjects) {
+      // Handle arrays of arrays containing objects
+      array.forEach((item, index) => {
+        if (Array.isArray(item)) {
+          item.forEach((subItem, subIndex) => {
+            if (isPojo(subItem)) {
+              this.keys.push(`${key}/${index + 1}/${subIndex + 1}`)
+            }
+          })
+        }
+      })
+      this.keys.push(key)
+    } else if (
+      analysis.hasObjects &&
+      (analysis.hasEmptyStrings || analysis.hasEmptyObjects) &&
+      !analysis.hasObjectsWithOnlyEmptyValues
+    ) {
+      // Mixed array: only non-empty objects get parts
+      array.forEach(item => {
+        if (isPojo(item) && Object.keys(item).length > 0) {
+          const path = `${key}/${bodyPartCounter}`
+          this.keys.push(path)
+          this.addNestedObjectPaths(item, path)
+        }
+        bodyPartCounter++
+      })
+      this.keys.push(key)
+    } else if (analysis.hasObjects) {
+      // Regular array with objects
+      const skipEmptyObjects = analysis.hasOnlyEmptyElements
+
+      array.forEach(item => {
+        if (isPojo(item)) {
+          if (!(skipEmptyObjects && Object.keys(item).length === 0)) {
+            const path = `${key}/${bodyPartCounter}`
+            this.keys.push(path)
+            if (Object.keys(item).length > 0) {
+              this.addNestedObjectPaths(item, path)
+            }
+          }
+        } else if (typeof item === "string" && item === "") {
+          this.keys.push(`${key}/${bodyPartCounter}`)
+        }
+        bodyPartCounter++
+      })
+
+      // Add main array key conditionally
+      if (!analysis.hasObjectsWithOnlyEmptyValues || analysis.hasNonObjects) {
+        if (!analysis.hasOnlyEmptyElements) {
+          this.keys.push(key)
+        }
+      }
+    } else {
+      // Simple array without objects
+      const hasOnlyEmptyArraysOrObjects = array.every(
+        item =>
+          isEmpty(item) &&
+          (Array.isArray(item) || isPojo(item) || typeof item === "string")
+      )
+
+      if (hasOnlyEmptyArraysOrObjects || !array.every(isEmpty)) {
+        this.keys.push(key)
+      }
+    }
+  }
+
+  // Add paths for nested objects within an object
+  addNestedObjectPaths(obj, basePath) {
+    for (const [nestedKey, nestedValue] of Object.entries(obj)) {
+      if (isPojo(nestedValue) && Object.keys(nestedValue).length > 0) {
+        this.keys.push(`${basePath}/${nestedKey}`)
+      }
+    }
+  }
+
+  // Process root-level nested object
+  processRootNestedObject(key, obj) {
+    // Check for arrays with only empty elements
+    for (const [k, v] of Object.entries(obj)) {
+      if (Array.isArray(v) && v.length > 0 && v.every(isEmpty)) {
+        this.keys.push(`${key}/${k}`)
+      }
+    }
+
+    // Traverse the object
+    this.traverse(obj, key)
+  }
+
+  // Traverse nested structures
+  traverse(current, path) {
+    let hasSimpleFields = false
+    const nestedPaths = []
+    let hasArraysWithObjects = false
+
+    // First pass: analyze structure
+    for (const [key, value] of Object.entries(current)) {
+      const fullPath = path ? `${path}/${key}` : key
+      const result = this.analyzeFieldInTraversal(value, fullPath, nestedPaths)
+
+      hasSimpleFields = hasSimpleFields || result.hasSimpleFields
+      hasArraysWithObjects = hasArraysWithObjects || result.hasArraysWithObjects
+    }
+
+    // Add current path if needed
+    if (hasSimpleFields || (hasArraysWithObjects && path)) {
+      this.keys.push(path)
+    }
+
+    // Second pass: check for arrays with only empty elements
+    for (const [key, value] of Object.entries(current)) {
+      const fullPath = path ? `${path}/${key}` : key
+      if (Array.isArray(value) && value.length > 0 && value.every(isEmpty)) {
+        this.keys.push(fullPath)
+      }
+    }
+
+    // Traverse nested objects
+    for (const nestedPath of nestedPaths) {
+      const nestedObj = getValueByPath(this.obj, nestedPath)
+      if (isPojo(nestedObj)) {
+        this.traverse(nestedObj, nestedPath)
+      }
+    }
+  }
+
+  // Analyze a field during traversal
+  analyzeFieldInTraversal(value, fullPath, nestedPaths) {
+    let hasSimpleFields = false
+    let hasArraysWithObjects = false
+
+    if (Array.isArray(value)) {
+      if (value.length === 0) {
+        hasSimpleFields = true
+      } else {
+        const analysis = analyzeArray(value)
+
+        if (analysis.hasObjects) {
+          hasArraysWithObjects = true
+          this.processArrayInTraversal(value, fullPath, nestedPaths, analysis)
+
+          if (analysis.hasNonObjects) {
+            hasSimpleFields = true
+            // Only add to keys if array can't be in header
+            if (!canArrayBeInHeader(value)) {
+              this.keys.push(fullPath)
+            }
+          }
+        } else {
+          hasSimpleFields = true
+        }
+      }
+    } else if (isPojo(value)) {
+      if (Object.keys(value).length === 0) {
+        hasSimpleFields = true
+      } else if (hasOnlyEmptyValues(value)) {
+        this.keys.push(fullPath)
+      } else {
+        const hasArraysWithOnlyEmptyElements = Object.entries(value).some(
+          ([k, v]) => Array.isArray(v) && v.length > 0 && v.every(isEmpty)
+        )
+
+        if (hasArraysWithOnlyEmptyElements) {
+          this.keys.push(fullPath)
+        }
+        nestedPaths.push(fullPath)
+      }
+    } else if ((isBytes(value) && value.length > 0) || isSimpleValue(value)) {
+      hasSimpleFields = true
+    }
+
+    return { hasSimpleFields, hasArraysWithObjects }
+  }
+
+  // Process arrays found during traversal
+  processArrayInTraversal(array, fullPath, nestedPaths, analysis) {
+    if (
+      (analysis.hasEmptyStrings || analysis.hasEmptyObjects) &&
+      analysis.hasNonEmptyObjects
+    ) {
+      // Special case: only non-empty objects get parts
+      array.forEach((item, index) => {
+        if (isPojo(item) && Object.keys(item).length > 0) {
+          const itemPath = `${fullPath}/${index + 1}`
+          this.keys.push(itemPath)
+          nestedPaths.push(itemPath)
+        }
+      })
+    } else if (
+      analysis.hasObjectsWithOnlyEmptyValues &&
+      !analysis.hasNonObjects
+    ) {
+      // Objects with only empty values
+      array.forEach((item, index) => {
+        if (isPojo(item)) {
+          const itemPath = `${fullPath}/${index + 1}`
+          this.keys.push(itemPath)
+          if (Object.keys(item).length > 0) {
+            nestedPaths.push(itemPath)
+          }
+        }
+      })
+    } else {
+      // Normal case
+      array.forEach((item, index) => {
+        if (isPojo(item)) {
+          const itemPath = `${fullPath}/${index + 1}`
+          this.keys.push(itemPath)
+          if (Object.keys(item).length > 0) {
+            nestedPaths.push(itemPath)
+          }
+        }
+      })
+    }
+  }
+
+  // Deduplicate and filter results
+  deduplicateAndFilter() {
+    const uniqueKeys = [...new Set(this.keys)]
+
+    return uniqueKeys.filter(k => {
+      if (!k) return false
+
+      // Check if this is a path to an element inside an array with only empty elements
+      const parts = k.split("/")
+      if (parts.length >= 2 && /^\d+$/.test(parts[parts.length - 1])) {
+        const arrayPath = parts.slice(0, -1).join("/")
+        const arrayValue = getValueByPath(this.obj, arrayPath)
+
+        if (Array.isArray(arrayValue) && arrayValue.every(isEmpty)) {
+          return false
+        }
+      }
+
+      return true
+    })
+  }
+}
+
+export default function collectBodyKeys(obj, prefix = "") {
+  const collector = new BodyKeyCollector(obj)
+  return collector.collect()
+}

package/hbsig/dist/esm/commit.js

@@ -0,0 +1,219 @@
+import { id, base, hashpath, rsaid } from "./id.js"
+import { toAddr } from "./utils.js"
+import { extractPubKey } from "./signer-utils.js"
+import { verify } from "./signer-utils.js"
+import crypto from "crypto"
+
+// Helper to compute SHA-256 content-digest in RFC 9530 format
+const computeContentDigest = (body) => {
+  let bodyBuffer
+  if (Buffer.isBuffer(body)) {
+    bodyBuffer = body
+  } else if (body instanceof Blob) {
+    return null // Can't compute synchronously for Blob
+  } else if (typeof body === "string") {
+    bodyBuffer = Buffer.from(body, "binary")
+  } else {
+    bodyBuffer = Buffer.from(String(body), "binary")
+  }
+  const hash = crypto.createHash("sha256").update(bodyBuffer).digest("base64")
+  return `sha-256=:${hash}:`
+}
+
+// Helper to build ao-types string from an object
+const buildAoTypes = (obj) => {
+  const types = []
+  for (const [key, value] of Object.entries(obj)) {
+    if (typeof value === "number") {
+      types.push(`${key}="${Number.isInteger(value) ? "integer" : "float"}"`)
+    } else if (typeof value === "boolean") {
+      types.push(`${key}="atom"`)
+    } else if (value === null) {
+      types.push(`${key}="atom"`)
+    } else if (typeof value === "symbol") {
+      // Symbols are Erlang atoms
+      types.push(`${key}="atom"`)
+    }
+  }
+  return types.length > 0 ? types.join(", ") : null
+}
+
+// todo: handle @
+export const commit = async (obj, opts) => {
+  const msg = await opts.signer(obj, opts)
+  const {
+    decodedSignatureInput: { components },
+  } = await verify(msg)
+
+  let body = {}
+
+  // Check for inline-body-key (indicates a field was moved to HTTP body during encoding)
+  const inlineBodyKey = msg.headers["inline-body-key"] || msg.headers["ao-body-key"]
+
+  // Body field names that HyperBEAM's inline_key() recognizes natively.
+  // For these, normalize_for_encoding() re-derives ao-body-key automatically.
+  // For custom names (e.g., "json"), we must keep ao-body-key in committed list
+  // so HyperBEAM knows which field to inline during verification.
+  const NATIVE_BODY_KEYS = new Set(["body", "data"])
+  const isNativeBodyKey = !inlineBodyKey || NATIVE_BODY_KEYS.has(inlineBodyKey)
+
+  // Build body from committed components.
+  // IMPORTANT: Use original typed values from obj (preserves integers, booleans, etc.)
+  // instead of string values from headers. This is critical because:
+  // 1. HTTP headers are always strings (e.g., quantity: 100 → "100")
+  // 2. We include ao-types to tell HyperBEAM the original types
+  // 3. HyperBEAM applies ao-types BEFORE signature verification
+  // 4. If we send strings, HyperBEAM converts to integers, breaking signature
+  // 5. If we send original integers, HyperBEAM re-encodes them as strings for verification
+  //
+  // Always skip content-digest and inline-body-key (transport artifacts re-derived by HyperBEAM).
+  // Skip ao-body-key only for native body keys (HyperBEAM re-derives it).
+  // Keep ao-body-key for custom body keys (HyperBEAM needs it to find the body field).
+
+  // Create case-insensitive lookup maps
+  const headerLookup = new Map()
+  for (const [k, v] of Object.entries(msg.headers)) {
+    headerLookup.set(k.toLowerCase(), v)
+  }
+  // Case-insensitive lookup for original object values (preserves types)
+  const objLookup = new Map()
+  for (const [k, v] of Object.entries(obj)) {
+    objLookup.set(k.toLowerCase(), v)
+  }
+
+  for (const v of components) {
+    const key = v === "@path" ? "path" : v
+    if (key === "content-length") continue
+    if (key === "content-digest") continue
+    if (key === "inline-body-key") continue
+    if (isNativeBodyKey && key === "ao-body-key") continue
+
+    // Prefer original value from input object (preserves integer/boolean/etc. types)
+    // Fall back to header string value if not found in original object
+    const originalValue = objLookup.get(key.toLowerCase())
+    if (originalValue !== undefined) {
+      body[key] = originalValue
+    } else {
+      const headerValue = headerLookup.get(key)
+      if (headerValue !== undefined) {
+        body[key] = headerValue
+      }
+    }
+  }
+
+  // Handle body resolution - restore the inlined field to its AO-Core name
+  let bodyContent = null
+  if (msg.body) {
+    if (msg.body instanceof Blob) {
+      const arrayBuffer = await msg.body.arrayBuffer()
+      bodyContent = Buffer.from(arrayBuffer)
+    } else {
+      bodyContent = msg.body
+    }
+
+    // Put body content under the original field name (e.g., "data", "json")
+    if (inlineBodyKey) {
+      body[inlineBodyKey] = bodyContent
+    } else {
+      body.body = bodyContent
+    }
+  }
+
+  // Include non-committed fields from the original object as JSON values.
+  // This covers: (1) body-key fields (arrays/objects encoded as multipart,
+  // which can't be included as raw multipart in JSON), and (2) any other
+  // fields excluded from signing. These fields are unsigned but present
+  // so HyperBEAM can parse them directly as JSON types.
+  // Use case-insensitive matching: signing normalizes keys to lowercase,
+  // but the original object may use mixed case (e.g., "To" vs "to").
+  const committedSetLower = new Set(components.map(v => (v === "@path" ? "path" : v).toLowerCase()))
+  // Also track lowercase keys already in body to prevent duplicates
+  const bodyKeysLower = new Set(Object.keys(body).map(k => k.toLowerCase()))
+  for (const [key, value] of Object.entries(obj)) {
+    // Skip HTTP method (not a data field)
+    if (key === "method") continue
+    // Skip if already in committed set (was signed)
+    if (committedSetLower.has(key.toLowerCase())) continue
+    // Skip if already in body (duplicate prevention)
+    if (bodyKeysLower.has(key.toLowerCase())) continue
+    if (value === undefined) continue
+    body[key] = value
+    bodyKeysLower.add(key.toLowerCase())
+  }
+
+  // Include ao-types so HyperBEAM knows how to convert string values to proper types.
+  // First check if it was set by the signer, otherwise compute it from the original object
+  let aoTypes = msg.headers["ao-types"]
+  if (!aoTypes) {
+    // Compute ao-types from the original typed values in obj
+    aoTypes = buildAoTypes(obj)
+  }
+  if (aoTypes) {
+    body["ao-types"] = aoTypes
+  }
+
+  const rsaId = rsaid(msg.headers)
+  const pub = extractPubKey(msg.headers)
+  const pubKeyBase64 = pub.toString("base64")
+  const committer = toAddr(pubKeyBase64)
+
+  // Extract keyid from signature-input to ensure it matches what was signed
+  // Format: sig-xxx=("field1"...);alg="...";keyid="..."
+  // The keyid may already have a scheme prefix (e.g., "publickey:base64data")
+  const extractKeyidFromSigInput = (sigInput) => {
+    if (!sigInput) return null
+    const match = sigInput.match(/keyid="([^"]+)"/)
+    if (!match) return null
+    // Return as-is - the keyid already includes the prefix from signing
+    return match[1]
+  }
+  const keyid = extractKeyidFromSigInput(msg.headers["signature-input"]) || `publickey:${pubKeyBase64}`
+
+  // Build the list of committed fields.
+  // Always transform HTTPSig transport keys to AO-Core keys:
+  // - Replace content-digest with the body field name (HyperBEAM re-derives content-digest)
+  // - For native body keys ("body", "data"): also remove ao-body-key (HyperBEAM re-derives it)
+  // - For custom body keys (e.g., "json"): keep ao-body-key (HyperBEAM needs it to find the field)
+  let committedFields = components.map(v => v === "@path" ? "path" : v)
+  if (committedFields.includes("content-digest") && (inlineBodyKey || msg.body)) {
+    const bodyFieldName = inlineBodyKey || "body"
+    committedFields = committedFields.filter(k => k !== "content-digest")
+    if (!committedFields.includes(bodyFieldName)) {
+      committedFields.push(bodyFieldName)
+    }
+  }
+  if (isNativeBodyKey) {
+    // For native body keys, ao-body-key is a transport artifact - remove it
+    committedFields = committedFields.filter(k => k !== "ao-body-key")
+  }
+
+  // Extract just the base64 signature data from the header format "sig-xxx=:base64data:"
+  // HyperBEAM expects raw base64 without colons (uses b64fast:encode/decode)
+  const extractSignature = (sigHeader) => {
+    if (!sigHeader) return sigHeader
+    // Match the base64 data between colons after the label
+    const match = sigHeader.match(/=:([^:]+):/)
+    return match ? match[1] : sigHeader
+  }
+  const rawSignature = extractSignature(msg.headers.signature)
+  const meta = {
+    type: "rsa-pss-sha512",
+    alg: "rsa-pss-sha512",
+    "commitment-device": "httpsig@1.0",
+    keyid: keyid,
+    committed: committedFields
+  }
+  const sigs = {
+    signature: rawSignature,
+    "signature-input": msg.headers["signature-input"],
+  }
+  // Only include the RSA commitment - HMAC commitments are created by HyperBEAM
+  // when needed and require the server's HMAC key which we don't have
+  const committed = {
+    commitments: {
+      [rsaId]: { ...meta, committer, ...sigs },
+    },
+    ...body,
+  }
+  return committed
+}