wb-auth 0.1.1 → 0.3.0

package/dist/index.d.cts

@@ -60,7 +60,9 @@ declare class Identity {
      * first. Verifiers select by `kid`. Mirror of Python `export_jwks`.
      */
     exportJwks(): {
-        keys: JsonWebKey[];
+        keys: Array<JsonWebKey & {
+            kid: string;
+        }>;
     };
     /**
      * IDENT-07: generate a new active key, demote current to retiring.
@@ -80,7 +82,7 @@ declare class Identity {
      * For tests + Cloudflare debug smoke checks. NEVER use in production.
      * Does NOT write any file to disk.
      */
-    static fromTestKey(signatureAgentUrl: string): Promise<Identity>;
+    static fromTestKey(signatureAgentUrl: string, opts?: Omit<IdentityOptions, "signatureAgentUrl">): Promise<Identity>;
     toString(): string;
 }
 
@@ -91,32 +93,52 @@ declare class Identity {
  * `identity` only. Returns a function whose signature matches `typeof fetch`,
  * so user code can swap `fetch` for `signedFetch` without other changes.
  *
- * v1 limitation (Pitfall 4): streaming bodies are NOT supported. The adapter
- * reads the full body via `req.clone().arrayBuffer()` to compute Content-Digest.
+ * - Request-object inputs keep their `signal`, `redirect`, `credentials`,
+ *   `cache`, `keepalive`, `integrity` and `referrerPolicy`.
+ * - Re-sending an already signed request (retry wrappers) produces exactly one
+ *   fresh signature — stale Signature* headers are replaced, never merged.
+ * - **Redirects** (`redirect: "follow"`, the default) are followed here, not
+ *   by the underlying fetch, so each hop is re-signed for its own
+ *   `@authority`. Native fetch would otherwise replay hop 1's signature to the
+ *   redirect target. Method/body rewriting and cross-origin credential
+ *   stripping follow the WHATWG fetch spec.
+ *
+ * v1 limitation: streaming bodies are buffered (`req.clone().arrayBuffer()`)
+ * so Content-Digest can be computed.
  */
 
-declare function createSignedFetch(identity: Identity): typeof fetch;
+interface SignedFetchOptions {
+    /** Underlying fetch implementation. Defaults to `globalThis.fetch` at call time. */
+    fetch?: typeof fetch;
+    /** Maximum redirects followed (and re-signed). Default 20, like fetch. */
+    maxRedirects?: number;
+}
+declare function createSignedFetch(identity: Identity, options?: SignedFetchOptions): typeof fetch;
 
 /**
- * applyTo — Playwright async helper for Web Bot Auth (ADAPT-05).
+ * applyTo — sign every matching request a Playwright page sends.
  *
- * Mirrors python/src/wbauth/adapters/playwright.py. Registers a route
- * handler that intercepts every outgoing request, signs it via wbauth.sign(),
- * and continues with the signed headers.
+ * Mirrors python/src/wbauth/adapters/playwright.py.
  *
- * Pitfall 3: Call applyTo(page, identity) BEFORE the first page.goto()/click
- * that should produce signed requests. page.route must be registered before
- * navigation begins, or the navigation request leaves the browser unsigned.
+ * Privacy: by default every http(s) request is signed, including third-party
+ * analytics/CDN hosts, which reveals your agent identity to them. Pass
+ * `hosts` to restrict signing to the sites you actually target:
  *
- * Pitfall (iframe coverage): page.route('**\/*', handler) covers all
- * sub-frame requests by default. If the target site uses Service Workers,
- * set serviceWorkers="block" on the BrowserContext (Playwright option).
+ *   await applyTo(page, identity, { hosts: ["example.com", "*.example.org"] });
  *
- * Note: `playwright` is a peerDependency (optional). End users only install
- * it if they actually use this adapter — fetch-only consumers pay zero cost.
+ * Non-http(s) requests (data:, blob:, chrome-extension:) are never signed.
+ * Note: Playwright disables the HTTP cache while a route is active.
  */
 
-declare function applyTo(page: Page, identity: Identity): Promise<void>;
+interface ApplyToOptions {
+    /** Only sign requests to these hosts (`example.com`, `*.example.com`). */
+    hosts?: readonly string[];
+    /** Custom predicate; takes precedence over `hosts`. */
+    shouldSign?: (url: URL) => boolean;
+    /** Route pattern passed to `page.route`. Default `"**\/*"`. */
+    pattern?: string;
+}
+declare function applyTo(page: Page, identity: Identity, options?: ApplyToOptions): Promise<void>;
 
 /**
  * NormalizedRequest — the structural input to wbauth.sign().
@@ -172,11 +194,11 @@ declare function sign(request: NormalizedRequest, identity: Identity, opts?: Sig
 /**
  * wbauth: Web Bot Auth (RFC 9421) TypeScript SDK — Phase 4 public surface.
  *
- * Per CONTEXT D-74: flat root exports. Subpath exports (`wbauth/adapters`)
+ * Per CONTEXT D-74: flat root exports. Subpath exports (`wb-auth/adapters`)
  * are a v1.x optimization, not required for Phase 4.
  *
  * Quickstart:
- *   import { Identity, createSignedFetch } from "wbauth";
+ *   import { Identity, createSignedFetch } from "wb-auth";
  *   const id = await Identity.loadOrGenerate("./key.pem", {
  *     signatureAgentUrl: "https://example.com/.well-known/.../<kid>",
  *   });
@@ -184,6 +206,6 @@ declare function sign(request: NormalizedRequest, identity: Identity, opts?: Sig
  *   const res = await sf("https://api.example.com/data");
  */
 
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.3.0";
 
-export { DEFAULT_KEY_PATH, Identity, type IdentityOptions, type KeyPair, type NormalizedRequest, type SignOptions, type SignatureHeaders, VERSION, applyTo, createSignedFetch, sign };
+export { type ApplyToOptions, DEFAULT_KEY_PATH, Identity, type IdentityOptions, type KeyPair, type NormalizedRequest, type SignOptions, type SignatureHeaders, type SignedFetchOptions, VERSION, applyTo, createSignedFetch, sign };

package/dist/index.d.ts

@@ -60,7 +60,9 @@ declare class Identity {
      * first. Verifiers select by `kid`. Mirror of Python `export_jwks`.
      */
     exportJwks(): {
-        keys: JsonWebKey[];
+        keys: Array<JsonWebKey & {
+            kid: string;
+        }>;
     };
     /**
      * IDENT-07: generate a new active key, demote current to retiring.
@@ -80,7 +82,7 @@ declare class Identity {
      * For tests + Cloudflare debug smoke checks. NEVER use in production.
      * Does NOT write any file to disk.
      */
-    static fromTestKey(signatureAgentUrl: string): Promise<Identity>;
+    static fromTestKey(signatureAgentUrl: string, opts?: Omit<IdentityOptions, "signatureAgentUrl">): Promise<Identity>;
     toString(): string;
 }
 
@@ -91,32 +93,52 @@ declare class Identity {
  * `identity` only. Returns a function whose signature matches `typeof fetch`,
  * so user code can swap `fetch` for `signedFetch` without other changes.
  *
- * v1 limitation (Pitfall 4): streaming bodies are NOT supported. The adapter
- * reads the full body via `req.clone().arrayBuffer()` to compute Content-Digest.
+ * - Request-object inputs keep their `signal`, `redirect`, `credentials`,
+ *   `cache`, `keepalive`, `integrity` and `referrerPolicy`.
+ * - Re-sending an already signed request (retry wrappers) produces exactly one
+ *   fresh signature — stale Signature* headers are replaced, never merged.
+ * - **Redirects** (`redirect: "follow"`, the default) are followed here, not
+ *   by the underlying fetch, so each hop is re-signed for its own
+ *   `@authority`. Native fetch would otherwise replay hop 1's signature to the
+ *   redirect target. Method/body rewriting and cross-origin credential
+ *   stripping follow the WHATWG fetch spec.
+ *
+ * v1 limitation: streaming bodies are buffered (`req.clone().arrayBuffer()`)
+ * so Content-Digest can be computed.
  */
 
-declare function createSignedFetch(identity: Identity): typeof fetch;
+interface SignedFetchOptions {
+    /** Underlying fetch implementation. Defaults to `globalThis.fetch` at call time. */
+    fetch?: typeof fetch;
+    /** Maximum redirects followed (and re-signed). Default 20, like fetch. */
+    maxRedirects?: number;
+}
+declare function createSignedFetch(identity: Identity, options?: SignedFetchOptions): typeof fetch;
 
 /**
- * applyTo — Playwright async helper for Web Bot Auth (ADAPT-05).
+ * applyTo — sign every matching request a Playwright page sends.
  *
- * Mirrors python/src/wbauth/adapters/playwright.py. Registers a route
- * handler that intercepts every outgoing request, signs it via wbauth.sign(),
- * and continues with the signed headers.
+ * Mirrors python/src/wbauth/adapters/playwright.py.
  *
- * Pitfall 3: Call applyTo(page, identity) BEFORE the first page.goto()/click
- * that should produce signed requests. page.route must be registered before
- * navigation begins, or the navigation request leaves the browser unsigned.
+ * Privacy: by default every http(s) request is signed, including third-party
+ * analytics/CDN hosts, which reveals your agent identity to them. Pass
+ * `hosts` to restrict signing to the sites you actually target:
  *
- * Pitfall (iframe coverage): page.route('**\/*', handler) covers all
- * sub-frame requests by default. If the target site uses Service Workers,
- * set serviceWorkers="block" on the BrowserContext (Playwright option).
+ *   await applyTo(page, identity, { hosts: ["example.com", "*.example.org"] });
  *
- * Note: `playwright` is a peerDependency (optional). End users only install
- * it if they actually use this adapter — fetch-only consumers pay zero cost.
+ * Non-http(s) requests (data:, blob:, chrome-extension:) are never signed.
+ * Note: Playwright disables the HTTP cache while a route is active.
  */
 
-declare function applyTo(page: Page, identity: Identity): Promise<void>;
+interface ApplyToOptions {
+    /** Only sign requests to these hosts (`example.com`, `*.example.com`). */
+    hosts?: readonly string[];
+    /** Custom predicate; takes precedence over `hosts`. */
+    shouldSign?: (url: URL) => boolean;
+    /** Route pattern passed to `page.route`. Default `"**\/*"`. */
+    pattern?: string;
+}
+declare function applyTo(page: Page, identity: Identity, options?: ApplyToOptions): Promise<void>;
 
 /**
  * NormalizedRequest — the structural input to wbauth.sign().
@@ -172,11 +194,11 @@ declare function sign(request: NormalizedRequest, identity: Identity, opts?: Sig
 /**
  * wbauth: Web Bot Auth (RFC 9421) TypeScript SDK — Phase 4 public surface.
  *
- * Per CONTEXT D-74: flat root exports. Subpath exports (`wbauth/adapters`)
+ * Per CONTEXT D-74: flat root exports. Subpath exports (`wb-auth/adapters`)
  * are a v1.x optimization, not required for Phase 4.
  *
  * Quickstart:
- *   import { Identity, createSignedFetch } from "wbauth";
+ *   import { Identity, createSignedFetch } from "wb-auth";
  *   const id = await Identity.loadOrGenerate("./key.pem", {
  *     signatureAgentUrl: "https://example.com/.well-known/.../<kid>",
  *   });
@@ -184,6 +206,6 @@ declare function sign(request: NormalizedRequest, identity: Identity, opts?: Sig
  *   const res = await sf("https://api.example.com/data");
  */
 
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.3.0";
 
-export { DEFAULT_KEY_PATH, Identity, type IdentityOptions, type KeyPair, type NormalizedRequest, type SignOptions, type SignatureHeaders, VERSION, applyTo, createSignedFetch, sign };
+export { type ApplyToOptions, DEFAULT_KEY_PATH, Identity, type IdentityOptions, type KeyPair, type NormalizedRequest, type SignOptions, type SignatureHeaders, type SignedFetchOptions, VERSION, applyTo, createSignedFetch, sign };

package/dist/index.js

@@ -1,64 +1,57 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  DEFAULT_KEY_PATH: () => DEFAULT_KEY_PATH,
-  Identity: () => Identity,
-  VERSION: () => VERSION,
-  applyTo: () => applyTo,
-  createSignedFetch: () => createSignedFetch,
-  sign: () => sign
-});
-module.exports = __toCommonJS(index_exports);
-
 // src/signer.ts
-var import_web_bot_auth = require("web-bot-auth");
+import { signatureHeaders } from "web-bot-auth";
 var DEFAULT_LABEL = "sig1";
 var DEFAULT_EXPIRES_SECONDS = 60;
-var DIGEST_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
-function componentsFor(method, hasBody) {
+var MAX_EXPIRES_SECONDS = 3600;
+function componentsFor(_method, hasBody) {
   const base = ["@authority", "signature-agent"];
-  if (hasBody && DIGEST_METHODS.has(method.toUpperCase())) {
+  if (hasBody) {
     base.push("content-digest");
   }
   return base;
 }
+var RESIGN_HEADERS = ["signature", "signature-input", "signature-agent"];
+function hasHeader(headers, name) {
+  const n = name.toLowerCase();
+  return Object.keys(headers).some((k) => k.toLowerCase() === n);
+}
+function removeHeaders(headers, names) {
+  for (const k of Object.keys(headers)) {
+    if (names.includes(k.toLowerCase())) delete headers[k];
+  }
+}
 async function sign(request, identity, opts = {}) {
   if (!identity.signatureAgentUrl.startsWith("https://")) {
     throw new Error(
       `signatureAgentUrl must be https://, got: ${identity.signatureAgentUrl}`
     );
   }
+  const expiresAfterSeconds = opts.expiresAfterSeconds ?? DEFAULT_EXPIRES_SECONDS;
+  if (typeof expiresAfterSeconds !== "number" || !Number.isFinite(expiresAfterSeconds) || expiresAfterSeconds <= 0 || expiresAfterSeconds > MAX_EXPIRES_SECONDS) {
+    throw new RangeError(
+      `expiresAfterSeconds must be a number in (0, ${MAX_EXPIRES_SECONDS}], got: ${expiresAfterSeconds}`
+    );
+  }
+  removeHeaders(request.headers, RESIGN_HEADERS);
   const signatureAgentHeader = `"${identity.signatureAgentUrl}"`;
   request.headers["Signature-Agent"] = signatureAgentHeader;
   const created = opts.created ?? /* @__PURE__ */ new Date();
-  const expiresAfterSeconds = opts.expiresAfterSeconds ?? DEFAULT_EXPIRES_SECONDS;
   const expires = new Date(created.getTime() + expiresAfterSeconds * 1e3);
   const label = opts.label ?? DEFAULT_LABEL;
-  const hasBody = request.body !== null && request.body !== void 0;
+  const hasBody = request.body !== null && request.body !== void 0 && request.body.byteLength > 0;
   const components = componentsFor(request.method, hasBody);
+  if (components.includes("content-digest") && !hasHeader(request.headers, "content-digest")) {
+    throw new Error(
+      'Covered header field "content-digest" not found in the message. Call ensureContentDigest() or use createSignedFetch()/applyTo(), which add it automatically.'
+    );
+  }
   const headers = new Headers();
   for (const [k, v] of Object.entries(request.headers)) headers.set(k, v);
   const init = { method: request.method, headers };
-  if (hasBody) init.body = request.body;
+  const m = request.method.toUpperCase();
+  if (hasBody && m !== "GET" && m !== "HEAD") {
+    init.body = request.body;
+  }
   const req = new Request(request.url, init);
   const params = {
     created,
@@ -67,7 +60,7 @@ async function sign(request, identity, opts = {}) {
     components,
     ...opts.nonce !== void 0 ? { nonce: opts.nonce } : {}
   };
-  const result = await (0, import_web_bot_auth.signatureHeaders)(req, identity._signer(), params);
+  const result = await signatureHeaders(req, identity._signer(), params);
   request.headers.Signature = result.Signature;
   request.headers["Signature-Input"] = result["Signature-Input"];
   return {
@@ -78,73 +71,176 @@ async function sign(request, identity, opts = {}) {
 }
 
 // src/adapters/_utils.ts
-var import_node_crypto = require("crypto");
-var DIGEST_METHODS2 = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
+import { createHash } from "crypto";
+var LIBRARY_DEFAULT_UA = /^(node|undici|node-fetch)(\/|$)/i;
+function findHeader(headers, name) {
+  const n = name.toLowerCase();
+  return Object.keys(headers).find((k) => k.toLowerCase() === n);
+}
 function ensureContentDigest(method, headers, body) {
   if (!body || body.byteLength === 0) return;
-  if (!DIGEST_METHODS2.has(method.toUpperCase())) return;
-  if (Object.keys(headers).some((k) => k.toLowerCase() === "content-digest")) {
+  void method;
+  if (findHeader(headers, "content-digest")) return;
+  const b64 = createHash("sha256").update(body).digest("base64");
+  headers["Content-Digest"] = `sha-256=:${b64}:`;
+}
+function applyUserAgent(headers, userAgent) {
+  if (!userAgent) return;
+  const key = findHeader(headers, "user-agent");
+  if (key === void 0) {
+    headers["User-Agent"] = userAgent;
     return;
   }
-  const b64 = (0, import_node_crypto.createHash)("sha256").update(body).digest("base64");
-  headers["Content-Digest"] = `sha-256=:${b64}:`;
+  if (LIBRARY_DEFAULT_UA.test(headers[key] ?? "")) {
+    delete headers[key];
+    headers["User-Agent"] = userAgent;
+  }
+}
+function hostMatches(hostname, allow) {
+  const h = hostname.toLowerCase().replace(/\.$/, "");
+  return allow.some((raw) => {
+    const a = raw.toLowerCase().replace(/\.$/, "");
+    if (a.startsWith("*.")) {
+      const base = a.slice(2);
+      return h === base || h.endsWith(`.${base}`);
+    }
+    return h === a;
+  });
 }
 
 // src/adapters/fetch.ts
-function createSignedFetch(identity) {
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var CROSS_ORIGIN_STRIP = /* @__PURE__ */ new Set([
+  "authorization",
+  "cookie",
+  "proxy-authorization"
+]);
+var BODY_HEADERS = /* @__PURE__ */ new Set([
+  "content-type",
+  "content-length",
+  "content-encoding",
+  "content-language",
+  "content-location",
+  "content-digest"
+]);
+function dropHeaders(headers, names) {
+  for (const k of Object.keys(headers)) {
+    if (names.has(k.toLowerCase())) delete headers[k];
+  }
+}
+function createSignedFetch(identity, options = {}) {
   return async function signedFetch(input, init = {}) {
     const req = new Request(input, init);
-    const method = req.method;
-    const url = req.url;
+    let method = req.method;
+    let url = req.url;
     let body = null;
     if (req.body) {
       const buf = await req.clone().arrayBuffer();
       body = buf.byteLength > 0 ? new Uint8Array(buf) : null;
     }
-    const headers = {};
+    const baseHeaders = {};
     req.headers.forEach((value, key) => {
-      headers[key] = value;
+      baseHeaders[key] = value;
     });
-    ensureContentDigest(method, headers, body);
-    await sign({ method, url, headers, body }, identity);
-    if (identity.userAgent && !Object.keys(headers).some((k) => k.toLowerCase() === "user-agent")) {
-      headers["User-Agent"] = identity.userAgent;
+    const redirectMode = init.redirect ?? req.redirect;
+    const followHere = redirectMode === "follow";
+    const maxRedirects = options.maxRedirects ?? 20;
+    const doFetch = options.fetch ?? globalThis.fetch;
+    for (let hop = 0; ; hop++) {
+      const headers = { ...baseHeaders };
+      ensureContentDigest(method, headers, body);
+      await sign({ method, url, headers, body }, identity);
+      applyUserAgent(headers, identity.userAgent);
+      const outInit = {
+        ...init,
+        method,
+        headers,
+        body: body ?? void 0,
+        signal: init.signal ?? req.signal,
+        redirect: followHere ? "manual" : redirectMode,
+        credentials: init.credentials ?? req.credentials,
+        cache: init.cache ?? req.cache,
+        keepalive: init.keepalive ?? req.keepalive
+      };
+      const integrity = init.integrity ?? req.integrity;
+      if (integrity) outInit.integrity = integrity;
+      const referrerPolicy = init.referrerPolicy ?? req.referrerPolicy;
+      if (referrerPolicy) outInit.referrerPolicy = referrerPolicy;
+      const res = await doFetch(url, outInit);
+      if (!followHere || !REDIRECT_STATUSES.has(res.status)) return res;
+      const location = res.headers.get("location");
+      if (location === null) return res;
+      if (hop >= maxRedirects) {
+        throw new TypeError(`redirect count exceeded (${maxRedirects})`);
+      }
+      const next = new URL(location, url);
+      if (next.protocol !== "http:" && next.protocol !== "https:") {
+        throw new TypeError(`unsupported redirect scheme: ${next.protocol}`);
+      }
+      const upper = method.toUpperCase();
+      if (res.status === 303 && upper !== "GET" && upper !== "HEAD" || (res.status === 301 || res.status === 302) && upper === "POST") {
+        method = "GET";
+        body = null;
+        dropHeaders(baseHeaders, BODY_HEADERS);
+      }
+      if (new URL(url).origin !== next.origin) {
+        dropHeaders(baseHeaders, CROSS_ORIGIN_STRIP);
+      }
+      await res.body?.cancel().catch(() => {
+      });
+      url = next.href;
     }
-    return fetch(url, {
-      ...init,
-      method,
-      headers,
-      body: body ?? void 0
-    });
   };
 }
 
 // src/adapters/playwright.ts
-async function applyTo(page, identity) {
-  await page.route("**/*", async (route, request) => {
+async function applyTo(page, identity, options = {}) {
+  const pattern = options.pattern ?? "**/*";
+  const decide = (raw) => {
+    let u;
+    try {
+      u = new URL(raw);
+    } catch {
+      return false;
+    }
+    if (u.protocol !== "https:" && u.protocol !== "http:") return false;
+    if (options.shouldSign) return options.shouldSign(u);
+    if (options.hosts) return hostMatches(u.hostname, options.hosts);
+    return true;
+  };
+  await page.route(pattern, async (route, request) => {
+    const url = request.url();
+    if (!decide(url)) {
+      const r = route;
+      await (r.fallback ? r.fallback() : route.continue());
+      return;
+    }
     const headers = await request.allHeaders();
     const postData = request.postDataBuffer();
     const body = postData ? new Uint8Array(postData) : null;
     ensureContentDigest(request.method(), headers, body);
-    await sign(
-      { method: request.method(), url: request.url(), headers, body },
-      identity
-    );
-    if (identity.userAgent && !Object.keys(headers).some((k) => k.toLowerCase() === "user-agent")) {
-      headers["User-Agent"] = identity.userAgent;
-    }
+    await sign({ method: request.method(), url, headers, body }, identity);
+    applyUserAgent(headers, identity.userAgent);
     await route.continue({ headers });
   });
 }
 
 // src/identity.ts
-var import_node_crypto2 = require("crypto");
-var import_node_fs = require("fs");
-var import_node_os = require("os");
-var import_node_path = require("path");
-var import_crypto = require("web-bot-auth/crypto");
-var DEFAULT_KEY_PATH = (0, import_node_path.resolve)(
-  (0, import_node_os.homedir)(),
+import { createPrivateKey, generateKeyPairSync } from "crypto";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { dirname, resolve } from "path";
+import { signerFromJWK } from "web-bot-auth/crypto";
+var DEFAULT_KEY_PATH = resolve(
+  homedir(),
   ".config",
   "wbauth",
   "key.pem"
@@ -214,7 +310,7 @@ var Identity = class _Identity {
    */
   static async loadOrGenerate(path = DEFAULT_KEY_PATH, opts) {
     const resolved = expandUser(path);
-    const pair = (0, import_node_fs.existsSync)(resolved) ? await loadKeypair(resolved) : await generateKeypairTo(resolved);
+    const pair = existsSync(resolved) ? await loadKeypair(resolved) : await generateKeypairTo(resolved);
     return new _Identity(pair, opts);
   }
   /**
@@ -222,9 +318,9 @@ var Identity = class _Identity {
    * For tests + Cloudflare debug smoke checks. NEVER use in production.
    * Does NOT write any file to disk.
    */
-  static async fromTestKey(signatureAgentUrl) {
+  static async fromTestKey(signatureAgentUrl, opts = {}) {
     const pair = await keyPairFromJwk(TEST_KEY_JWK);
-    return new _Identity(pair, { signatureAgentUrl });
+    return new _Identity(pair, { ...opts, signatureAgentUrl });
   }
   // ---------- Redaction guarantees (IDENT-08) ----------
   toString() {
@@ -236,10 +332,10 @@ var Identity = class _Identity {
   }
 };
 function expandUser(path) {
-  return (0, import_node_path.resolve)(path.startsWith("~") ? path.replace(/^~/, (0, import_node_os.homedir)()) : path);
+  return resolve(path.startsWith("~") ? path.replace(/^~/, homedir()) : path);
 }
 async function keyPairFromJwk(privateJwk) {
-  const signer = await (0, import_crypto.signerFromJWK)(privateJwk);
+  const signer = await signerFromJWK(privateJwk);
   const kid = signer.keyid;
   const publicJwk = {
     kty: privateJwk.kty,
@@ -251,7 +347,7 @@ async function keyPairFromJwk(privateJwk) {
 }
 async function loadKeypair(path) {
   if (process.platform !== "win32") {
-    const mode = (0, import_node_fs.statSync)(path).mode & 511;
+    const mode = statSync(path).mode & 511;
     if ((mode & 63) !== 0) {
       throw new Error(
         `Key file ${path} has mode 0o${mode.toString(8)}; expected 0o600. Fix: chmod 600 ${path}`
@@ -262,39 +358,39 @@ async function loadKeypair(path) {
       `Windows detected \u2014 file permissions on ${path} cannot be enforced via POSIX mode. Use NTFS ACLs or store the key in a per-user secrets vault.`
     );
   }
-  const pem = (0, import_node_fs.readFileSync)(path, "utf8");
-  const jwk = (0, import_node_crypto2.createPrivateKey)(pem).export({ format: "jwk" });
+  const pem = readFileSync(path, "utf8");
+  const jwk = createPrivateKey(pem).export({ format: "jwk" });
   if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519") {
     throw new TypeError(`Expected Ed25519, got kty=${jwk.kty}, crv=${jwk.crv}`);
   }
   return keyPairFromJwk(jwk);
 }
 async function generateKeypairTo(path) {
-  const dir = (0, import_node_path.dirname)(path);
-  (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-  if ((0, import_node_fs.existsSync)(path)) {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true });
+  if (existsSync(path)) {
     throw new Error(`Key already exists at ${path}; refuse overwrite`);
   }
-  const { privateKey } = (0, import_node_crypto2.generateKeyPairSync)("ed25519");
+  const { privateKey } = generateKeyPairSync("ed25519");
   const pem = privateKey.export({ format: "pem", type: "pkcs8" });
-  const fd = (0, import_node_fs.openSync)(path, "wx", 384);
+  const fd = openSync(path, "wx", 384);
   try {
-    (0, import_node_fs.writeFileSync)(fd, pem);
+    writeFileSync(fd, pem);
   } finally {
-    (0, import_node_fs.closeSync)(fd);
+    closeSync(fd);
   }
   const jwk = privateKey.export({ format: "jwk" });
   return keyPairFromJwk(jwk);
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+var VERSION = "0.3.0";
+export {
   DEFAULT_KEY_PATH,
   Identity,
   VERSION,
   applyTo,
   createSignedFetch,
   sign
-});
+};
+//# sourceMappingURL=index.js.map