web-dc-api 0.0.58 → 0.0.60

package/dist/esm/node_modules/@libp2p/circuit-relay-v2/dist/src/transport/transport.js

@@ -0,0 +1,320 @@
+import { serviceCapabilities, serviceDependencies, transportSymbol, setMaxListeners, start, stop, DialError, InvalidMessageError } from '@libp2p/interface';
+import { peerIdFromString, peerIdFromMultihash } from '@libp2p/peer-id';
+import { streamToMaConnection } from '../../../../utils/dist/src/stream-to-ma-conn.js';
+import { multiaddr } from '@multiformats/multiaddr';
+import { Circuit } from '../../../../../@multiformats/multiaddr-matcher/dist/src/index.js';
+import { pbStream } from '../../../../../it-protobuf-stream/dist/src/index.js';
+import { decode } from '../../../../../multiformats/dist/src/hashes/digest.js';
+import { CustomProgressEvent } from '../../../../../progress-events/dist/src/index.js';
+import { MAX_CONNECTIONS, RELAY_V2_STOP_CODEC, CIRCUIT_PROTO_CODE, RELAY_V2_HOP_CODEC, DEFAULT_DISCOVERY_FILTER_SIZE, DEFAULT_DISCOVERY_FILTER_ERROR_RATE } from '../constants.js';
+import { HopMessage, Status, StopMessage } from '../pb/index.js';
+import { LimitTracker, CircuitListen, CircuitSearch } from '../utils.js';
+import { RelayDiscovery } from './discovery.js';
+import { createListener } from './listener.js';
+import { ReservationStore } from './reservation-store.js';
+import { peerFilter } from '../../../../peer-collections/dist/src/filter.js';
+
+const isValidStop = request => {
+  if (request.peer == null) {
+    return false;
+  }
+  try {
+    request.peer.addrs.forEach(multiaddr);
+  } catch {
+    return false;
+  }
+  return true;
+};
+const defaults = {
+  maxInboundStopStreams: MAX_CONNECTIONS,
+  maxOutboundStopStreams: MAX_CONNECTIONS};
+class CircuitRelayTransport {
+  discovery;
+  registrar;
+  peerStore;
+  connectionManager;
+  transportManager;
+  peerId;
+  upgrader;
+  addressManager;
+  connectionGater;
+  reservationStore;
+  logger;
+  maxInboundStopStreams;
+  maxOutboundStopStreams;
+  started;
+  log;
+  shutdownController;
+  constructor(components) {
+    let init = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+    this.log = components.logger.forComponent('libp2p:circuit-relay:transport');
+    this.registrar = components.registrar;
+    this.peerStore = components.peerStore;
+    this.connectionManager = components.connectionManager;
+    this.transportManager = components.transportManager;
+    this.logger = components.logger;
+    this.peerId = components.peerId;
+    this.upgrader = components.upgrader;
+    this.addressManager = components.addressManager;
+    this.connectionGater = components.connectionGater;
+    this.maxInboundStopStreams = init.maxInboundStopStreams ?? defaults.maxInboundStopStreams;
+    this.maxOutboundStopStreams = init.maxOutboundStopStreams ?? defaults.maxOutboundStopStreams;
+    this.shutdownController = new AbortController();
+    this.discovery = new RelayDiscovery(components, {
+      filter: init.discoveryFilter ?? peerFilter(DEFAULT_DISCOVERY_FILTER_SIZE, DEFAULT_DISCOVERY_FILTER_ERROR_RATE)
+    });
+    this.discovery.addEventListener('relay:discover', evt => {
+      this.reservationStore.addRelay(evt.detail, 'discovered').catch(err => {
+        if (err.name !== 'HadEnoughRelaysError' && err.name !== 'RelayQueueFullError') {
+          this.log.error('could not add discovered relay %p', evt.detail, err);
+        }
+      });
+    });
+    this.reservationStore = new ReservationStore(components, init);
+    this.reservationStore.addEventListener('relay:not-enough-relays', () => {
+      this.discovery?.startDiscovery();
+    });
+    this.reservationStore.addEventListener('relay:found-enough-relays', () => {
+      this.discovery?.stopDiscovery();
+    });
+    this.started = false;
+  }
+  [Symbol.toStringTag] = '@libp2p/circuit-relay-v2-transport';
+  [serviceCapabilities] = ['@libp2p/transport', '@libp2p/circuit-relay-v2-transport'];
+  get [serviceDependencies]() {
+    // we only need identify if discovery is enabled
+    if (this.discovery != null) {
+      return ['@libp2p/identify'];
+    }
+    return [];
+  }
+  [transportSymbol] = true;
+  isStarted() {
+    return this.started;
+  }
+  async start() {
+    this.shutdownController = new AbortController();
+    setMaxListeners(Infinity, this.shutdownController.signal);
+    await this.registrar.handle(RELAY_V2_STOP_CODEC, data => {
+      const signal = this.upgrader.createInboundAbortSignal(this.shutdownController.signal);
+      void this.onStop(data, signal).catch(err => {
+        this.log.error('error while handling STOP protocol', err);
+        data.stream.abort(err);
+      }).finally(() => {
+        signal.clear();
+      });
+    }, {
+      maxInboundStreams: this.maxInboundStopStreams,
+      maxOutboundStreams: this.maxOutboundStopStreams,
+      runOnLimitedConnection: true
+    });
+    await start(this.discovery, this.reservationStore);
+    this.started = true;
+  }
+  async stop() {
+    this.shutdownController.abort();
+    await stop(this.discovery, this.reservationStore);
+    await this.registrar.unhandle(RELAY_V2_STOP_CODEC);
+    this.started = false;
+  }
+  /**
+   * Dial a peer over a relay
+   */
+  async dial(ma, options) {
+    if (ma.protoCodes().filter(code => code === CIRCUIT_PROTO_CODE).length !== 1) {
+      const errMsg = 'Invalid circuit relay address';
+      this.log.error(errMsg, ma);
+      throw new DialError(errMsg);
+    }
+    // Check the multiaddr to see if it contains a relay and a destination peer
+    const addrs = ma.toString().split('/p2p-circuit');
+    const relayAddr = multiaddr(addrs[0]);
+    const destinationAddr = multiaddr(addrs[addrs.length - 1]);
+    const relayId = relayAddr.getPeerId();
+    const destinationId = destinationAddr.getPeerId();
+    if (relayId == null || destinationId == null) {
+      const errMsg = `ircuit relay dial to ${ma.toString()} failed as address did not have both relay and destination PeerIDs`;
+      this.log.error(`c${errMsg}`);
+      throw new DialError(`C${errMsg}`);
+    }
+    const relayPeer = peerIdFromString(relayId);
+    const destinationPeer = peerIdFromString(destinationId);
+    const relayConnections = this.connectionManager.getConnections(relayPeer);
+    let relayConnection = relayConnections[0];
+    if (relayConnection == null) {
+      await this.peerStore.merge(relayPeer, {
+        multiaddrs: [relayAddr]
+      });
+      options.onProgress?.(new CustomProgressEvent('circuit-relay:open-connection'));
+      relayConnection = await this.connectionManager.openConnection(relayPeer, options);
+    } else {
+      options.onProgress?.(new CustomProgressEvent('circuit-relay:reuse-connection'));
+    }
+    let stream;
+    try {
+      options.onProgress?.(new CustomProgressEvent('circuit-relay:open-hop-stream'));
+      stream = await relayConnection.newStream(RELAY_V2_HOP_CODEC, options);
+      const pbstr = pbStream(stream);
+      const hopstr = pbstr.pb(HopMessage);
+      options.onProgress?.(new CustomProgressEvent('circuit-relay:write-connect-message'));
+      await hopstr.write({
+        type: HopMessage.Type.CONNECT,
+        peer: {
+          id: destinationPeer.toMultihash().bytes,
+          addrs: [multiaddr(destinationAddr).bytes]
+        }
+      }, options);
+      options.onProgress?.(new CustomProgressEvent('circuit-relay:read-connect-response'));
+      const status = await hopstr.read(options);
+      if (status.status !== Status.OK) {
+        throw new InvalidMessageError(`failed to connect via relay with status ${status?.status?.toString() ?? 'undefined'}`);
+      }
+      const limits = new LimitTracker(status.limit);
+      const maConn = streamToMaConnection({
+        stream: pbstr.unwrap(),
+        remoteAddr: ma,
+        localAddr: relayAddr.encapsulate(`/p2p-circuit/p2p/${this.peerId.toString()}`),
+        logger: this.logger,
+        onDataRead: limits.onData,
+        onDataWrite: limits.onData
+      });
+      this.log('new outbound relayed connection %a', maConn.remoteAddr);
+      return await this.upgrader.upgradeOutbound(maConn, {
+        ...options,
+        limits: limits.getLimits()
+      });
+    } catch (err) {
+      this.log.error('circuit relay dial to destination %p via relay %p failed', destinationPeer, relayPeer, err);
+      stream?.abort(err);
+      throw err;
+    }
+  }
+  /**
+   * Create a listener
+   */
+  createListener(options) {
+    return createListener({
+      peerId: this.peerId,
+      connectionManager: this.connectionManager,
+      addressManager: this.addressManager,
+      reservationStore: this.reservationStore,
+      logger: this.logger
+    });
+  }
+  /**
+   * Filter check for all Multiaddrs that this transport can listen on
+   */
+  listenFilter(multiaddrs) {
+    multiaddrs = Array.isArray(multiaddrs) ? multiaddrs : [multiaddrs];
+    return multiaddrs.filter(ma => {
+      return CircuitListen.exactMatch(ma) || CircuitSearch.exactMatch(ma);
+    });
+  }
+  /**
+   * Filter check for all Multiaddrs that this transport can dial
+   */
+  dialFilter(multiaddrs) {
+    multiaddrs = Array.isArray(multiaddrs) ? multiaddrs : [multiaddrs];
+    return multiaddrs.filter(ma => {
+      return Circuit.exactMatch(ma);
+    });
+  }
+  /**
+   * An incoming STOP request means a remote peer wants to dial us via a relay
+   */
+  async onStop(_ref, signal) {
+    let {
+      connection,
+      stream
+    } = _ref;
+    if (!this.reservationStore.hasReservation(connection.remotePeer)) {
+      try {
+        this.log('dialed via relay we did not have a reservation on, start listening on that relay address');
+        await this.transportManager.listen([connection.remoteAddr.encapsulate('/p2p-circuit')]);
+      } catch (err) {
+        // failed to refresh our hitherto unknown relay reservation but allow the connection attempt anyway
+        this.log.error('failed to listen on a relay peer we were dialed via but did not have a reservation on', err);
+      }
+    }
+    const pbstr = pbStream(stream).pb(StopMessage);
+    const request = await pbstr.read({
+      signal
+    });
+    this.log('new circuit relay v2 stop stream from %p with type %s', connection.remotePeer, request.type);
+    if (request?.type === undefined) {
+      this.log.error('type was missing from circuit v2 stop protocol request from %s', connection.remotePeer);
+      await pbstr.write({
+        type: StopMessage.Type.STATUS,
+        status: Status.MALFORMED_MESSAGE
+      }, {
+        signal
+      });
+      await stream.close();
+      return;
+    }
+    // Validate the STOP request has the required input
+    if (request.type !== StopMessage.Type.CONNECT) {
+      this.log.error('invalid stop connect request via peer %p', connection.remotePeer);
+      await pbstr.write({
+        type: StopMessage.Type.STATUS,
+        status: Status.UNEXPECTED_MESSAGE
+      }, {
+        signal
+      });
+      await stream.close();
+      return;
+    }
+    if (!isValidStop(request)) {
+      this.log.error('invalid stop connect request via peer %p', connection.remotePeer);
+      await pbstr.write({
+        type: StopMessage.Type.STATUS,
+        status: Status.MALFORMED_MESSAGE
+      }, {
+        signal
+      });
+      await stream.close({
+        signal
+      });
+      return;
+    }
+    const remotePeerId = peerIdFromMultihash(decode(request.peer.id));
+    if ((await this.connectionGater.denyInboundRelayedConnection?.(connection.remotePeer, remotePeerId)) === true) {
+      this.log.error('connection gater denied inbound relayed connection from %p', connection.remotePeer);
+      await pbstr.write({
+        type: StopMessage.Type.STATUS,
+        status: Status.PERMISSION_DENIED
+      }, {
+        signal
+      });
+      await stream.close({
+        signal
+      });
+      return;
+    }
+    this.log.trace('sending success response to %p', connection.remotePeer);
+    await pbstr.write({
+      type: StopMessage.Type.STATUS,
+      status: Status.OK
+    }, {
+      signal
+    });
+    const limits = new LimitTracker(request.limit);
+    const remoteAddr = connection.remoteAddr.encapsulate(`/p2p-circuit/p2p/${remotePeerId.toString()}`);
+    this.addressManager.getAddresses()[0];
+    const maConn = streamToMaConnection({
+      stream: pbstr.unwrap().unwrap(),
+      remoteAddr,
+      logger: this.logger,
+      onDataRead: limits.onData,
+      onDataWrite: limits.onData
+    });
+    this.log('new inbound relayed connection %a', maConn.remoteAddr);
+    await this.upgrader.upgradeInbound(maConn, {
+      limits: limits.getLimits(),
+      signal
+    });
+    this.log('%s connection %a upgraded', 'inbound', maConn.remoteAddr);
+  }
+}
+
+export { CircuitRelayTransport };

package/dist/esm/node_modules/@libp2p/circuit-relay-v2/dist/src/utils.js

@@ -0,0 +1,72 @@
+import { P2P } from '../../../../@multiformats/multiaddr-matcher/dist/src/index.js';
+import { fmt, and, literal } from '../../../../@multiformats/multiaddr-matcher/dist/src/utils.js';
+import '../../../../multiformats/dist/src/bases/base32.js';
+import '../../../../multiformats/dist/src/bases/base36.js';
+import '../../../../multiformats/dist/src/bases/base58.js';
+import '../../../../multiformats/dist/src/hashes/sha2-browser.js';
+
+/**
+ * returns number of ms between now and expiration time
+ */
+function getExpirationMilliseconds(expireTimeSeconds) {
+  const expireTimeMillis = expireTimeSeconds * BigInt(1000);
+  const currentTime = new Date().getTime();
+  // downcast to number to use with setTimeout
+  return Number(expireTimeMillis - BigInt(currentTime));
+}
+class LimitTracker {
+  expires;
+  bytes;
+  constructor(limits) {
+    if (limits?.duration != null && limits?.duration !== 0) {
+      this.expires = Date.now() + limits.duration * 1000;
+    }
+    this.bytes = limits?.data;
+    if (this.bytes === 0n) {
+      this.bytes = undefined;
+    }
+    this.onData = this.onData.bind(this);
+  }
+  onData(buf) {
+    if (this.bytes == null) {
+      return;
+    }
+    this.bytes -= BigInt(buf.byteLength);
+    if (this.bytes < 0n) {
+      this.bytes = 0n;
+    }
+  }
+  getLimits() {
+    if (this.expires == null && this.bytes == null) {
+      return;
+    }
+    const output = {};
+    if (this.bytes != null) {
+      const self = this;
+      Object.defineProperty(output, 'bytes', {
+        get() {
+          return self.bytes;
+        }
+      });
+    }
+    if (this.expires != null) {
+      const self = this;
+      Object.defineProperty(output, 'seconds', {
+        get() {
+          return Math.round(((self.expires ?? 0) - Date.now()) / 1000);
+        }
+      });
+    }
+    return output;
+  }
+}
+/**
+ * A custom matcher that tells us to listen on a particular relay
+ */
+const CircuitListen = fmt(and(P2P.matchers[0], literal('p2p-circuit')));
+/**
+ * A custom matcher that tells us to discover available relays
+ */
+const CircuitSearch = fmt(literal('p2p-circuit'));
+
+export { CircuitListen, CircuitSearch, LimitTracker, getExpirationMilliseconds };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/errors.js

@@ -0,0 +1,32 @@
+/**
+ * Signing a message failed
+ */
+class SigningError extends Error {
+  constructor() {
+    let message = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 'An error occurred while signing a message';
+    super(message);
+    this.name = 'SigningError';
+  }
+}
+/**
+ * Verifying a message signature failed
+ */
+class VerificationError extends Error {
+  constructor() {
+    let message = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 'An error occurred while verifying a message';
+    super(message);
+    this.name = 'VerificationError';
+  }
+}
+/**
+ * WebCrypto was not available in the current context
+ */
+class WebCryptoMissingError extends Error {
+  constructor() {
+    let message = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 'Missing Web Crypto API';
+    super(message);
+    this.name = 'WebCryptoMissingError';
+  }
+}
+
+export { SigningError, VerificationError, WebCryptoMissingError };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/keys/ecdsa/ecdsa.js

@@ -0,0 +1,74 @@
+import { base58btc } from '../../../../../../multiformats/dist/src/bases/base58.js';
+import { CID } from '../../../../../../multiformats/dist/src/cid.js';
+import { identity } from '../../../../../../multiformats/dist/src/hashes/identity.js';
+import { equals } from '../../../../../../uint8arrays/dist/src/equals.js';
+import { publicKeyToProtobuf } from '../index.js';
+import { publicKeyToPKIMessage, privateKeyToPKIMessage } from './utils.js';
+import { hashAndVerify, hashAndSign } from './index.js';
+
+class ECDSAPublicKey {
+  type = 'ECDSA';
+  jwk;
+  _raw;
+  constructor(jwk) {
+    this.jwk = jwk;
+  }
+  get raw() {
+    if (this._raw == null) {
+      this._raw = publicKeyToPKIMessage(this.jwk);
+    }
+    return this._raw;
+  }
+  toMultihash() {
+    return identity.digest(publicKeyToProtobuf(this));
+  }
+  toCID() {
+    return CID.createV1(114, this.toMultihash());
+  }
+  toString() {
+    return base58btc.encode(this.toMultihash().bytes).substring(1);
+  }
+  equals(key) {
+    if (key == null || !(key.raw instanceof Uint8Array)) {
+      return false;
+    }
+    return equals(this.raw, key.raw);
+  }
+  async verify(data, sig) {
+    return hashAndVerify(this.jwk, sig, data);
+  }
+}
+class ECDSAPrivateKey {
+  type = 'ECDSA';
+  jwk;
+  publicKey;
+  _raw;
+  constructor(jwk) {
+    this.jwk = jwk;
+    this.publicKey = new ECDSAPublicKey({
+      crv: jwk.crv,
+      ext: jwk.ext,
+      key_ops: ['verify'],
+      kty: 'EC',
+      x: jwk.x,
+      y: jwk.y
+    });
+  }
+  get raw() {
+    if (this._raw == null) {
+      this._raw = privateKeyToPKIMessage(this.jwk);
+    }
+    return this._raw;
+  }
+  equals(key) {
+    if (key == null || !(key.raw instanceof Uint8Array)) {
+      return false;
+    }
+    return equals(this.raw, key.raw);
+  }
+  async sign(message) {
+    return hashAndSign(this.jwk, message);
+  }
+}
+
+export { ECDSAPrivateKey, ECDSAPublicKey };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/keys/ecdsa/index.js

@@ -0,0 +1,41 @@
+const ECDSA_P_256_OID = '1.2.840.10045.3.1.7';
+const ECDSA_P_384_OID = '1.3.132.0.34';
+const ECDSA_P_521_OID = '1.3.132.0.35';
+async function generateECDSAKey() {
+  let curve = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 'P-256';
+  const keyPair = await crypto.subtle.generateKey({
+    name: 'ECDSA',
+    namedCurve: curve
+  }, true, ['sign', 'verify']);
+  return {
+    publicKey: await crypto.subtle.exportKey('jwk', keyPair.publicKey),
+    privateKey: await crypto.subtle.exportKey('jwk', keyPair.privateKey)
+  };
+}
+async function hashAndSign(key, msg) {
+  const privateKey = await crypto.subtle.importKey('jwk', key, {
+    name: 'ECDSA',
+    namedCurve: key.crv ?? 'P-256'
+  }, false, ['sign']);
+  const signature = await crypto.subtle.sign({
+    name: 'ECDSA',
+    hash: {
+      name: 'SHA-256'
+    }
+  }, privateKey, msg.subarray());
+  return new Uint8Array(signature, 0, signature.byteLength);
+}
+async function hashAndVerify(key, sig, msg) {
+  const publicKey = await crypto.subtle.importKey('jwk', key, {
+    name: 'ECDSA',
+    namedCurve: key.crv ?? 'P-256'
+  }, false, ['verify']);
+  return crypto.subtle.verify({
+    name: 'ECDSA',
+    hash: {
+      name: 'SHA-256'
+    }
+  }, publicKey, sig, msg.subarray());
+}
+
+export { ECDSA_P_256_OID, ECDSA_P_384_OID, ECDSA_P_521_OID, generateECDSAKey, hashAndSign, hashAndVerify };

package/dist/esm/node_modules/@libp2p/crypto/dist/src/keys/ecdsa/utils.js

@@ -0,0 +1,146 @@
+import { InvalidParametersError } from '@libp2p/interface';
+import { Uint8ArrayList } from '../../../../../../uint8arraylist/dist/src/index.js';
+import { fromString } from '../../../../../../uint8arrays/dist/src/from-string.js';
+import { toString } from '../../../../../../uint8arrays/dist/src/to-string.js';
+import { decodeDer, encodeSequence, encodeInteger, encodeBitString, encodeOctetString } from '../rsa/der.js';
+import { ECDSAPublicKey, ECDSAPrivateKey } from './ecdsa.js';
+import { generateECDSAKey } from './index.js';
+
+// 1.2.840.10045.3.1.7 prime256v1 (ANSI X9.62 named elliptic curve)
+const OID_256 = Uint8Array.from([0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07]);
+// 1.3.132.0.34 secp384r1 (SECG (Certicom) named elliptic curve)
+const OID_384 = Uint8Array.from([0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x22]);
+// 1.3.132.0.35 secp521r1 (SECG (Certicom) named elliptic curve)
+const OID_521 = Uint8Array.from([0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x23]);
+const P_256_KEY_JWK = {
+  ext: true,
+  kty: 'EC',
+  crv: 'P-256'
+};
+const P_384_KEY_JWK = {
+  ext: true,
+  kty: 'EC',
+  crv: 'P-384'
+};
+const P_521_KEY_JWK = {
+  ext: true,
+  kty: 'EC',
+  crv: 'P-521'
+};
+const P_256_KEY_LENGTH = 32;
+const P_384_KEY_LENGTH = 48;
+const P_521_KEY_LENGTH = 66;
+function pkiMessageToECDSAPrivateKey(message) {
+  const privateKey = message[1];
+  const d = toString(privateKey, 'base64url');
+  const coordinates = message[2][1][0];
+  const offset = 1;
+  let x;
+  let y;
+  if (privateKey.byteLength === P_256_KEY_LENGTH) {
+    x = toString(coordinates.subarray(offset, offset + P_256_KEY_LENGTH), 'base64url');
+    y = toString(coordinates.subarray(offset + P_256_KEY_LENGTH), 'base64url');
+    return new ECDSAPrivateKey({
+      ...P_256_KEY_JWK,
+      key_ops: ['sign'],
+      d,
+      x,
+      y
+    });
+  }
+  if (privateKey.byteLength === P_384_KEY_LENGTH) {
+    x = toString(coordinates.subarray(offset, offset + P_384_KEY_LENGTH), 'base64url');
+    y = toString(coordinates.subarray(offset + P_384_KEY_LENGTH), 'base64url');
+    return new ECDSAPrivateKey({
+      ...P_384_KEY_JWK,
+      key_ops: ['sign'],
+      d,
+      x,
+      y
+    });
+  }
+  if (privateKey.byteLength === P_521_KEY_LENGTH) {
+    x = toString(coordinates.subarray(offset, offset + P_521_KEY_LENGTH), 'base64url');
+    y = toString(coordinates.subarray(offset + P_521_KEY_LENGTH), 'base64url');
+    return new ECDSAPrivateKey({
+      ...P_521_KEY_JWK,
+      key_ops: ['sign'],
+      d,
+      x,
+      y
+    });
+  }
+  throw new InvalidParametersError(`Private key length was wrong length, got ${privateKey.byteLength}, expected 32, 48 or 66`);
+}
+function unmarshalECDSAPublicKey(bytes) {
+  const message = decodeDer(bytes);
+  return pkiMessageToECDSAPublicKey(message);
+}
+function pkiMessageToECDSAPublicKey(message) {
+  const coordinates = message[1][1][0];
+  const offset = 1;
+  let x;
+  let y;
+  if (coordinates.byteLength === P_256_KEY_LENGTH * 2 + 1) {
+    x = toString(coordinates.subarray(offset, offset + P_256_KEY_LENGTH), 'base64url');
+    y = toString(coordinates.subarray(offset + P_256_KEY_LENGTH), 'base64url');
+    return new ECDSAPublicKey({
+      ...P_256_KEY_JWK,
+      key_ops: ['verify'],
+      x,
+      y
+    });
+  }
+  if (coordinates.byteLength === P_384_KEY_LENGTH * 2 + 1) {
+    x = toString(coordinates.subarray(offset, offset + P_384_KEY_LENGTH), 'base64url');
+    y = toString(coordinates.subarray(offset + P_384_KEY_LENGTH), 'base64url');
+    return new ECDSAPublicKey({
+      ...P_384_KEY_JWK,
+      key_ops: ['verify'],
+      x,
+      y
+    });
+  }
+  if (coordinates.byteLength === P_521_KEY_LENGTH * 2 + 1) {
+    x = toString(coordinates.subarray(offset, offset + P_521_KEY_LENGTH), 'base64url');
+    y = toString(coordinates.subarray(offset + P_521_KEY_LENGTH), 'base64url');
+    return new ECDSAPublicKey({
+      ...P_521_KEY_JWK,
+      key_ops: ['verify'],
+      x,
+      y
+    });
+  }
+  throw new InvalidParametersError(`coordinates were wrong length, got ${coordinates.byteLength}, expected 65, 97 or 133`);
+}
+function privateKeyToPKIMessage(privateKey) {
+  return encodeSequence([encodeInteger(Uint8Array.from([1])),
+  // header
+  encodeOctetString(fromString(privateKey.d ?? '', 'base64url')),
+  // body
+  encodeSequence([getOID(privateKey.crv)], 0xA0), encodeSequence([encodeBitString(new Uint8ArrayList(Uint8Array.from([0x04]), fromString(privateKey.x ?? '', 'base64url'), fromString(privateKey.y ?? '', 'base64url')))], 0xA1)]).subarray();
+}
+function publicKeyToPKIMessage(publicKey) {
+  return encodeSequence([encodeInteger(Uint8Array.from([1])),
+  // header
+  encodeSequence([getOID(publicKey.crv)], 0xA0), encodeSequence([encodeBitString(new Uint8ArrayList(Uint8Array.from([0x04]), fromString(publicKey.x ?? '', 'base64url'), fromString(publicKey.y ?? '', 'base64url')))], 0xA1)]).subarray();
+}
+function getOID(curve) {
+  if (curve === 'P-256') {
+    return OID_256;
+  }
+  if (curve === 'P-384') {
+    return OID_384;
+  }
+  if (curve === 'P-521') {
+    return OID_521;
+  }
+  throw new InvalidParametersError(`Invalid curve ${curve}`);
+}
+async function generateECDSAKeyPair() {
+  let curve = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 'P-256';
+  const key = await generateECDSAKey(curve);
+  return new ECDSAPrivateKey(key.privateKey);
+}
+
+export { generateECDSAKeyPair, pkiMessageToECDSAPrivateKey, pkiMessageToECDSAPublicKey, privateKeyToPKIMessage, publicKeyToPKIMessage, unmarshalECDSAPublicKey };