Add browser support: CryptoKey signing, generateKeyPair, and browser-safe base64

- Accept CryptoKey handle for signing when JWK has no private key material
- Add generateKeyPair() utility with extractable option
- Replace Node.js Buffer with btoa/atob for browser compatibility

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dickhardt

httpsig/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hellocoop/httpsig",
-    "version": "1.3.0",
+    "version": "1.4.0",
     "description": "HTTP Message Signatures (RFC 9421) with Signature-Key header support",
     "repository": {
         "type": "git",

httpsig/src/fetch.ts

@@ -99,6 +99,7 @@ export async function fetch(
 ): Promise<Response | { headers: Headers }> {
     const {
         signingKey,
+        signingCryptoKey,
         signatureKey,
         label = 'sig',
         components: customComponents,
@@ -109,12 +110,27 @@ export async function fetch(
         ...fetchOptions
     } = options
 
-    // Validate signing key
+    // Validate signing key JWK structure
     validateJwk(signingKey)
 
-    // Import private key
-    const privateKey = await importPrivateKey(signingKey)
-    const algorithm = getAlgorithmFromJwk(signingKey)
+    // Determine private key and algorithm
+    let privateKey: CryptoKey
+    let algorithm: ReturnType<typeof getAlgorithmFromJwk>
+
+    if (signingKey.d) {
+        // Full private JWK — import it
+        privateKey = await importPrivateKey(signingKey)
+        algorithm = getAlgorithmFromJwk(signingKey)
+    } else {
+        // Public-only JWK — must have a CryptoKey handle
+        if (!signingCryptoKey) {
+            throw new Error(
+                'signingCryptoKey is required when signingKey does not contain private key material',
+            )
+        }
+        privateKey = signingCryptoKey
+        algorithm = getAlgorithmFromJwk(signingKey)
+    }
 
     // Get public key for hwk type
     const publicJwk = getPublicJwk(signingKey)

httpsig/src/index.ts

@@ -20,6 +20,9 @@ export {
     parseAcceptSignature,
 } from './utils/signature.js'
 
+export { generateKeyPair } from './utils/crypto.js'
+export type { GenerateKeyPairOptions, KeyPair } from './utils/crypto.js'
+
 export type {
     HttpSigFetchOptions,
     SignatureKeyType,

httpsig/src/types.ts

@@ -51,9 +51,12 @@ export type SignatureKeyType =
 // See: https://github.com/PeculiarVentures/x509
 
 export interface HttpSigFetchOptions extends RequestInit {
-    // Required: Private key as JWK
+    // Required: Key as JWK (private key with 'd' param, or public key without)
     signingKey: JsonWebKey
 
+    // Required when signingKey is a public JWK (no 'd' param): CryptoKey handle for signing
+    signingCryptoKey?: CryptoKey
+
     // Required: Signature-Key header configuration
     signatureKey: SignatureKeyType
 

httpsig/src/utils/base64.ts

@@ -2,14 +2,37 @@
  * Base64 encoding/decoding utilities for HTTP Message Signatures
  */
 
+/**
+ * Convert Uint8Array to base64 string (browser-safe, no Buffer dependency)
+ */
+function bytesToBase64(bytes: Uint8Array): string {
+    let binary = ''
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i])
+    }
+    return btoa(binary)
+}
+
+/**
+ * Convert base64 string to Uint8Array (browser-safe, no Buffer dependency)
+ */
+function base64ToBytes(base64: string): Uint8Array {
+    const binary = atob(base64)
+    const bytes = new Uint8Array(binary.length)
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i)
+    }
+    return bytes
+}
+
 /**
  * Encode data to base64url format (RFC 4648 Section 5)
  */
 export function base64urlEncode(data: Uint8Array | string): string {
     const bytes =
         typeof data === 'string' ? new TextEncoder().encode(data) : data
 
-    const base64 = Buffer.from(bytes).toString('base64')
+    const base64 = bytesToBase64(bytes)
 
     return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '')
 }
@@ -28,7 +51,7 @@ export function base64urlDecode(data: string): Uint8Array {
     // Convert base64url to base64
     const base64 = padded.replace(/-/g, '+').replace(/_/g, '/')
 
-    return new Uint8Array(Buffer.from(base64, 'base64'))
+    return base64ToBytes(base64)
 }
 
 /**
@@ -38,14 +61,14 @@ export function base64Encode(data: Uint8Array | string): string {
     const bytes =
         typeof data === 'string' ? new TextEncoder().encode(data) : data
 
-    return Buffer.from(bytes).toString('base64')
+    return bytesToBase64(bytes)
 }
 
 /**
  * Decode standard base64 to Uint8Array
  */
 export function base64Decode(data: string): Uint8Array {
-    return new Uint8Array(Buffer.from(data, 'base64'))
+    return base64ToBytes(data)
 }
 
 /**

httpsig/src/utils/crypto.ts

@@ -79,6 +79,60 @@ export async function verify(
     return await crypto.subtle.verify(algorithm, publicKey, signature, data)
 }
 
+/**
+ * Options for key pair generation
+ */
+export interface GenerateKeyPairOptions {
+    algorithm?: 'Ed25519' | 'ES256' // default: 'Ed25519'
+    extractable?: boolean // default: true
+}
+
+/**
+ * Generated key pair
+ */
+export interface KeyPair {
+    privateKey: CryptoKey // CryptoKey handle for signing
+    publicKey: JsonWebKey // Public key as JWK (always exportable)
+}
+
+/**
+ * Generate a signing key pair
+ */
+export async function generateKeyPair(
+    options?: GenerateKeyPairOptions,
+): Promise<KeyPair> {
+    const algorithm = options?.algorithm ?? 'Ed25519'
+    const extractable = options?.extractable ?? true
+
+    let genAlgorithm:
+        | AlgorithmIdentifier
+        | RsaHashedKeyGenParams
+        | EcKeyGenParams
+    let keyUsages: KeyUsage[] = ['sign', 'verify']
+
+    if (algorithm === 'Ed25519') {
+        genAlgorithm = { name: 'Ed25519' }
+    } else if (algorithm === 'ES256') {
+        genAlgorithm = { name: 'ECDSA', namedCurve: 'P-256' }
+    } else {
+        throw new Error(`Unsupported algorithm: ${algorithm}`)
+    }
+
+    const keyPair = (await crypto.subtle.generateKey(
+        genAlgorithm,
+        extractable,
+        keyUsages,
+    )) as CryptoKeyPair
+
+    // Public key is always exportable
+    const publicKey = await crypto.subtle.exportKey('jwk', keyPair.publicKey)
+
+    return {
+        privateKey: keyPair.privateKey,
+        publicKey,
+    }
+}
+
 /**
  * Validate JWK structure
  */