@1shotapi/ows-signer 0.3.2 → 0.3.4

package/README.md

@@ -58,6 +58,7 @@ Ceremony UI params (optional on WebAuthn-triggering methods): `explanationHeader
 - `rpName` — relying party display name in passkey UI (default `"OWS"`); does not affect `rpId`
 - `userDisplayName` — friendly account label (defaults to `name`)
 - `userId` — stable user handle bytes (base64); random if omitted
+- `deferKeyDerivation` — when true, skip the PRF follow-up get; `CredentialCreated` includes `credentialId` + `cosePublicKey` only (no `KeyDerived` / no `secp256k1PublicKey`)
 
 ## Signing schemes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1shotapi/ows-signer",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "OWS Signing Layer — plain JavaScript WebAuthn PRF key custody with curve-based signing (on-chain via EIP-8244)",
   "type": "module",
   "files": [

package/src/handlers.js

@@ -37,6 +37,7 @@ import {
   promptPassphrase,
   promptPrivateKey,
   showPrivateKey,
+  updateCeremonyCopy,
 } from "./ui.js";
 import {
   createPasskeyCredential,
@@ -202,9 +203,14 @@ function ceremonyFieldsFromParams(params) {
  *
  * @param {PublicKeyCredential} credential
  * @param {string} [credentialId]
+ * @param {(() => void) | undefined} [onBeforeFollowUpGet]
  * @returns {Promise<PublicKeyCredential>}
  */
-async function credentialForKeyDerivation(credential, credentialId) {
+async function credentialForKeyDerivation(
+  credential,
+  credentialId,
+  onBeforeFollowUpGet,
+) {
   debugLog("ceremony extension results", describePrfExtensionResults(credential));
 
   const rawPrf = credential.getClientExtensionResults()?.prf?.results?.first;
@@ -217,7 +223,11 @@ async function credentialForKeyDerivation(credential, credentialId) {
   debugLog("no PRF results on registration; running assertion with prf.eval", {
     credentialId: id,
   });
-  // Same RPC — no second Confirm (one screen per call).
+  if (typeof onBeforeFollowUpGet === "function") {
+    onBeforeFollowUpGet();
+  }
+  // Prefer keeping the parent Confirm panel open (call from runOnConfirm) so
+  // the user still sees why this second WebAuthn prompt appears.
   const assertion = await getPasskeyAssertion(undefined, id);
   debugLog(
     "assertion extension results",
@@ -239,20 +249,54 @@ async function handleCreateCredential(params, correlationId, targetOrigin) {
   }
   const options =
     params.options && typeof params.options === "object"
-      ? /** @type {{ rpName?: string, userDisplayName?: string, userId?: string, explanationHeader?: string, explanationText?: string, confirmButtonText?: string, denyButtonText?: string }} */ (
+      ? /** @type {{ rpName?: string, userDisplayName?: string, userId?: string, deferKeyDerivation?: boolean, explanationHeader?: string, explanationText?: string, confirmButtonText?: string, denyButtonText?: string }} */ (
           params.options
         )
       : {};
+  const deferKeyDerivation = options.deferKeyDerivation === true;
 
   await withCeremony(async () => {
-    const credential = await promptCeremonyConfirm(options, () =>
-      createPasskeyCredential(name, options),
-    );
-    const credentialId = getCredentialId(credential);
-    const prfCredential = await credentialForKeyDerivation(
-      credential,
-      credentialId,
-    );
+    /** @type {PublicKeyCredential | undefined} */
+    let registrationCredential;
+
+    if (deferKeyDerivation) {
+      // Registration only — opener (or another signer session) will unlock later.
+      await promptCeremonyConfirm(options, async () => {
+        registrationCredential = await createPasskeyCredential(name, options);
+      });
+      if (!registrationCredential) {
+        throw new Error("createCredential: registration credential missing");
+      }
+      emitEvent(window.parent, targetOrigin, "CredentialCreated", correlationId, {
+        credentialId: getCredentialId(registrationCredential),
+        cosePublicKey: getCosePublicKeyBase64Url(registrationCredential),
+      });
+      return;
+    }
+
+    // Create + optional PRF follow-up get stay under one Confirm panel so the
+    // explanation remains visible for every WebAuthn prompt in this RPC.
+    const prfCredential = await promptCeremonyConfirm(options, async () => {
+      registrationCredential = await createPasskeyCredential(name, options);
+      const credentialId = getCredentialId(registrationCredential);
+      return credentialForKeyDerivation(
+        registrationCredential,
+        credentialId,
+        () => {
+          updateCeremonyCopy({
+            explanationHeader: "Unlock your new passkey",
+            explanationText:
+              "Confirm with your passkey again to finish setting up this wallet.",
+            confirmButtonText: options.confirmButtonText,
+            denyButtonText: options.denyButtonText,
+          });
+        },
+      );
+    });
+    if (!registrationCredential) {
+      throw new Error("createCredential: registration credential missing");
+    }
+    const credentialId = getCredentialId(registrationCredential);
     const keys = await deriveKeysFromCredential(prfCredential);
     emitKeyDerived(
       targetOrigin,
@@ -263,7 +307,7 @@ async function handleCreateCredential(params, correlationId, targetOrigin) {
 
     emitEvent(window.parent, targetOrigin, "CredentialCreated", correlationId, {
       credentialId,
-      cosePublicKey: getCosePublicKeyBase64Url(credential),
+      cosePublicKey: getCosePublicKeyBase64Url(registrationCredential),
       secp256k1PublicKey: to0xHex(keys.secp256k1PublicKey),
     });
     zeroize(keys.secp256k1PrivateKey);

package/src/ui.js

@@ -131,6 +131,22 @@ export function resolveCeremonyUi(fields) {
   };
 }
 
+/**
+ * Update header/body on an open ceremony Confirm panel (e.g. before a follow-up
+ * WebAuthn get). No-op if the ceremony UI is not showing.
+ *
+ * @param {CeremonyUiFields | Record<string, unknown> | undefined} fields
+ */
+export function updateCeremonyCopy(fields) {
+  if (!root) return;
+  const header = root.querySelector(".ows-ceremony-header");
+  const text = root.querySelector(".ows-ceremony-text");
+  if (!header && !text) return;
+  const ui = resolveCeremonyUi(fields);
+  if (header) header.textContent = ui.header;
+  if (text) text.textContent = ui.explanation;
+}
+
 /**
  * Show Confirm/Cancel. On Confirm, runs `runOnConfirm` **synchronously from the
  * click handler** so WebAuthn keeps user activation / document focus on mobile.