@1shotapi/ows-signer 0.3.3 → 0.3.4

package/README.md

@@ -58,6 +58,7 @@ Ceremony UI params (optional on WebAuthn-triggering methods): `explanationHeader
 - `rpName` — relying party display name in passkey UI (default `"OWS"`); does not affect `rpId`
 - `userDisplayName` — friendly account label (defaults to `name`)
 - `userId` — stable user handle bytes (base64); random if omitted
+- `deferKeyDerivation` — when true, skip the PRF follow-up get; `CredentialCreated` includes `credentialId` + `cosePublicKey` only (no `KeyDerived` / no `secp256k1PublicKey`)
 
 ## Signing schemes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1shotapi/ows-signer",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "OWS Signing Layer — plain JavaScript WebAuthn PRF key custody with curve-based signing (on-chain via EIP-8244)",
   "type": "module",
   "files": [

package/src/handlers.js

@@ -249,16 +249,33 @@ async function handleCreateCredential(params, correlationId, targetOrigin) {
   }
   const options =
     params.options && typeof params.options === "object"
-      ? /** @type {{ rpName?: string, userDisplayName?: string, userId?: string, explanationHeader?: string, explanationText?: string, confirmButtonText?: string, denyButtonText?: string }} */ (
+      ? /** @type {{ rpName?: string, userDisplayName?: string, userId?: string, deferKeyDerivation?: boolean, explanationHeader?: string, explanationText?: string, confirmButtonText?: string, denyButtonText?: string }} */ (
           params.options
         )
       : {};
+  const deferKeyDerivation = options.deferKeyDerivation === true;
 
   await withCeremony(async () => {
-    // Create + optional PRF follow-up get stay under one Confirm panel so the
-    // explanation remains visible for every WebAuthn prompt in this RPC.
     /** @type {PublicKeyCredential | undefined} */
     let registrationCredential;
+
+    if (deferKeyDerivation) {
+      // Registration only — opener (or another signer session) will unlock later.
+      await promptCeremonyConfirm(options, async () => {
+        registrationCredential = await createPasskeyCredential(name, options);
+      });
+      if (!registrationCredential) {
+        throw new Error("createCredential: registration credential missing");
+      }
+      emitEvent(window.parent, targetOrigin, "CredentialCreated", correlationId, {
+        credentialId: getCredentialId(registrationCredential),
+        cosePublicKey: getCosePublicKeyBase64Url(registrationCredential),
+      });
+      return;
+    }
+
+    // Create + optional PRF follow-up get stay under one Confirm panel so the
+    // explanation remains visible for every WebAuthn prompt in this RPC.
     const prfCredential = await promptCeremonyConfirm(options, async () => {
       registrationCredential = await createPasskeyCredential(name, options);
       const credentialId = getCredentialId(registrationCredential);