@docknetwork/wallet-sdk-wasm 1.7.0 → 1.7.7-alpha.0

package/lib/services/credential/delegatable-credentials.mjs

@@ -0,0 +1,263 @@
+import * as cedar from '@cedar-policy/cedar-wasm/nodejs';
+export { cedar };
+import { issueCredential, signPresentation, documentLoader, verifyPresentation } from '@docknetwork/credential-sdk/vc';
+import { MAY_CLAIM_IRI } from '@docknetwork/vc-delegation-engine';
+export { MAY_CLAIM_IRI } from '@docknetwork/vc-delegation-engine';
+import { getKeypairFromDoc } from '@docknetwork/universal-wallet/methods/keypairs';
+import { blockchainService } from '../blockchain/service.mjs';
+import '@cosmjs/proto-signing';
+import '@docknetwork/cheqd-blockchain-api';
+import '@docknetwork/cheqd-blockchain-modules';
+import '@docknetwork/credential-sdk/modules';
+import '@docknetwork/credential-sdk/resolver';
+import '@docknetwork/crypto-wasm-ts/lib/index';
+import 'events';
+import '../../core/logger.mjs';
+import '../../modules/event-manager.mjs';
+import 'assert';
+import '../util-crypto/service.mjs';
+import '@docknetwork/credential-sdk/utils';
+import '@scure/bip39';
+import '@scure/bip39/wordlists/english';
+import '../util-crypto/configs.mjs';
+import '@docknetwork/credential-sdk/types';
+import '../blockchain/cached-did-resolver.mjs';
+import '../storage/index.mjs';
+import '../storage/service.mjs';
+import '../storage/service-rpc.mjs';
+import '../rpc-service-client.mjs';
+import '../../rpc-client.mjs';
+import 'json-rpc-2.0';
+import '../../core/crypto.mjs';
+import 'crypto';
+import '../../logger.mjs';
+import '../../rpc-util.mjs';
+
+// @ts-nocheck
+/**
+ * Prepares a key document for signing by creating a proper keypair with signer capability
+ * @param keyDoc - The key document with id, controller, type, and key material
+ * @returns A key document with an active signer
+ */
+function prepareKeyForSigning(keyDoc) {
+    const kp = getKeypairFromDoc(keyDoc);
+    // Get the signer from the keypair - this returns an object with id and sign method
+    const signer = kp.signer();
+    // Set the id on the signer to match the verification method
+    signer.id = keyDoc.id;
+    return {
+        ...keyDoc,
+        keypair: kp,
+        signer,
+    };
+}
+/**
+ * W3C Credentials V1 context URL
+ */
+const W3C_CREDENTIALS_V1 = 'https://www.w3.org/2018/credentials/v1';
+/**
+ * Namespace used by the vc-delegation-engine for delegation properties
+ */
+const DELEGATION_ENGINE_NS = 'https://ld.truvera.io/credentials/delegation#';
+/**
+ * Base delegation context terms required for delegation credentials.
+ * These terms define the JSON-LD mappings needed for the vc-delegation-engine
+ * to properly process delegation chains.
+ *
+ * Use this as a base and extend with your own application-specific terms:
+ * @example
+ * const myContext = [
+ *   W3C_CREDENTIALS_V1,
+ *   {
+ *     ...DELEGATION_CONTEXT_TERMS,
+ *     // Add your custom terms here
+ *     MyCredentialType: 'https://example.org/MyCredentialType',
+ *     myField: 'https://example.org/myField',
+ *   },
+ * ];
+ */
+const DELEGATION_CONTEXT_TERMS = {
+    '@version': 1.1,
+    '@protected': true,
+    DelegationCredential: `${DELEGATION_ENGINE_NS}DelegationCredential`,
+    mayClaim: { '@id': MAY_CLAIM_IRI, '@container': '@set' },
+    rootCredentialId: { '@id': `${DELEGATION_ENGINE_NS}rootCredentialId`, '@type': '@id' },
+    previousCredentialId: { '@id': `${DELEGATION_ENGINE_NS}previousCredentialId`, '@type': '@id' },
+};
+/**
+ * Default context for verifiable presentations
+ */
+const PRESENTATION_CONTEXT = [W3C_CREDENTIALS_V1];
+/**
+ * Issues a delegation credential that grants authority to a delegate
+ * @param keyPair - The key pair to sign the credential
+ * @param params - Delegation parameters
+ * @returns Signed delegation credential
+ */
+async function issueDelegationCredential(keyPair, credential) {
+    const preparedKey = prepareKeyForSigning(keyPair);
+    return issueCredential(preparedKey, credential);
+}
+/**
+ * Issues a credential as a delegate (with delegation chain reference)
+ * @param keyPair - The delegate's key pair to sign the credential
+ * @param params - Credential parameters
+ * @returns Signed credential
+ */
+async function issueDelegatedCredential(keyPair, credential) {
+    const preparedKey = prepareKeyForSigning(keyPair);
+    return issueCredential(preparedKey, credential);
+}
+/**
+ * Creates and signs a verifiable presentation with delegation credentials
+ * @param keyPair - The key pair to sign the presentation
+ * @param params - Presentation parameters
+ * @returns Signed verifiable presentation
+ */
+async function createSignedPresentation(keyPair, params) {
+    const { credentials, holderDid, challenge, domain, context = PRESENTATION_CONTEXT, } = params;
+    const presentation = {
+        '@context': context,
+        type: ['VerifiablePresentation'],
+        holder: holderDid,
+        verifiableCredential: credentials,
+    };
+    // Create key document for signing with proper keypair
+    const keyDoc = {
+        ...keyPair,
+        id: keyPair.id || `${holderDid}#keys-1`,
+        controller: keyPair.controller || holderDid,
+    };
+    const preparedKey = prepareKeyForSigning(keyDoc);
+    return signPresentation(presentation, preparedKey, challenge, domain);
+}
+/**
+ * Verifies a verifiable presentation with optional delegation chain validation
+ * Uses the credential-sdk's verifyPresentation which automatically:
+ * 1. Verifies the presentation signature
+ * 2. Verifies all credentials
+ * 3. Detects delegation credentials
+ * 4. Validates the delegation chain
+ * 5. Applies Cedar policies if provided
+ *
+ * @param vp - The verifiable presentation to verify
+ * @param options - Verification options
+ * @returns Verification result with delegation info if applicable
+ */
+async function verifyDelegatablePresentation(vp, options = {}) {
+    const { challenge = vp.proof?.challenge || 'default-challenge', domain = vp.proof?.domain || 'default-domain', unsignedPresentation = false, failOnUnauthorizedClaims = true, policies, } = options;
+    const verifyOptions = {
+        challenge,
+        domain,
+        documentLoader: documentLoader(blockchainService.resolver),
+        unsignedPresentation,
+        failOnUnauthorizedClaims,
+    };
+    // Add Cedar authorization if policies are provided
+    if (policies) {
+        verifyOptions.cedarAuth = {
+            policies,
+            cedar,
+        };
+    }
+    return verifyPresentation(vp, verifyOptions);
+}
+/**
+ * Creates a Cedar policy for delegation verification
+ * @param config - Policy configuration
+ * @returns Cedar policy object
+ */
+function createCedarPolicy(config) {
+    const { maxDepth = 2, rootIssuer, requiredClaims = {} } = config;
+    let claimsConditions = '';
+    for (const [key, value] of Object.entries(requiredClaims)) {
+        if (typeof value === 'number') {
+            claimsConditions += ` &&\n  context.authorizedClaims.${key} >= ${value}`;
+        }
+        else if (typeof value === 'string') {
+            claimsConditions += ` &&\n  context.authorizedClaims.${key} == "${value}"`;
+        }
+    }
+    const policyText = `
+permit(
+  principal in Credential::Chain::"Action:Verify",
+  action == Credential::Action::"Verify",
+  resource
+) when {
+  principal == context.vpSigner &&
+  context.tailDepth <= ${maxDepth} &&
+  context.rootIssuer == Credential::Actor::"${rootIssuer}"${claimsConditions}
+};
+`;
+    return { staticPolicies: policyText };
+}
+/**
+ * Creates an unsigned verifiable presentation (for testing)
+ * @param credentials - Array of credentials to include
+ * @param proof - Optional proof object
+ * @param context - Optional context
+ * @returns Verifiable presentation object
+ */
+function createUnsignedPresentation(credentials, proof, context = PRESENTATION_CONTEXT) {
+    const vp = {
+        '@context': context,
+        type: ['VerifiablePresentation'],
+        verifiableCredential: credentials,
+    };
+    if (proof) {
+        vp.proof = proof;
+    }
+    return vp;
+}
+/**
+ * Service class for delegatable credentials operations
+ */
+class DelegatableCredentialsService {
+    name = 'delegatable-credentials';
+    rpcMethods = [
+        DelegatableCredentialsService.prototype.issueDelegation,
+        DelegatableCredentialsService.prototype.issueDelegatedCredential,
+        DelegatableCredentialsService.prototype.createPresentation,
+        DelegatableCredentialsService.prototype.verifyPresentation,
+        DelegatableCredentialsService.prototype.createPolicy,
+    ];
+    /**
+     * Issues a delegation credential
+     */
+    async issueDelegation(params) {
+        return issueDelegationCredential(params.keyPair, params);
+    }
+    /**
+     * Issues a credential as a delegate
+     */
+    async issueDelegatedCredential(params) {
+        return issueDelegatedCredential(params.keyPair, params);
+    }
+    /**
+     * Creates and signs a verifiable presentation
+     */
+    async createPresentation(params) {
+        return createSignedPresentation(params.keyPair, params);
+    }
+    /**
+     * Verifies a verifiable presentation with delegation chain
+     */
+    async verifyPresentation(params) {
+        return verifyDelegatablePresentation(params.presentation, {
+            challenge: params.challenge,
+            domain: params.domain,
+            unsignedPresentation: params.unsignedPresentation,
+            failOnUnauthorizedClaims: params.failOnUnauthorizedClaims,
+            policies: params.policies,
+        });
+    }
+    /**
+     * Creates a Cedar policy for delegation verification
+     */
+    createPolicy(params) {
+        return createCedarPolicy(params);
+    }
+}
+const delegatableCredentialsService = new DelegatableCredentialsService();
+
+export { DELEGATION_CONTEXT_TERMS, DELEGATION_ENGINE_NS, PRESENTATION_CONTEXT, W3C_CREDENTIALS_V1, createCedarPolicy, createSignedPresentation, createUnsignedPresentation, delegatableCredentialsService, issueDelegatedCredential, issueDelegationCredential, verifyDelegatablePresentation };

package/lib/services/credential/index.js

@@ -3,6 +3,9 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var services_credential_service = require('./service.js');
+var services_credential_delegatableCredentials = require('./delegatable-credentials.js');
+var cedar = require('@cedar-policy/cedar-wasm/nodejs');
+var vcDelegationEngine = require('@docknetwork/vc-delegation-engine');
 require('./config.js');
 require('assert');
 require('@docknetwork/crypto-wasm-ts');
@@ -60,8 +63,44 @@ require('./sd-jwt.js');
 require('@sd-jwt/sd-jwt-vc');
 require('@sd-jwt/crypto-nodejs');
 
+function _interopNamespace(e) {
+	if (e && e.__esModule) return e;
+	var n = Object.create(null);
+	if (e) {
+		Object.keys(e).forEach(function (k) {
+			if (k !== 'default') {
+				var d = Object.getOwnPropertyDescriptor(e, k);
+				Object.defineProperty(n, k, d.get ? d : {
+					enumerable: true,
+					get: function () { return e[k]; }
+				});
+			}
+		});
+	}
+	n["default"] = e;
+	return Object.freeze(n);
+}
+
+var cedar__namespace = /*#__PURE__*/_interopNamespace(cedar);
+
 // @ts-nocheck
 // TODO: rename it to credentialService, will need to update dock-app
 const credentialServiceRPC = services_credential_service.credentialService;
 
+exports.DELEGATION_CONTEXT_TERMS = services_credential_delegatableCredentials.DELEGATION_CONTEXT_TERMS;
+exports.DELEGATION_ENGINE_NS = services_credential_delegatableCredentials.DELEGATION_ENGINE_NS;
+exports.PRESENTATION_CONTEXT = services_credential_delegatableCredentials.PRESENTATION_CONTEXT;
+exports.W3C_CREDENTIALS_V1 = services_credential_delegatableCredentials.W3C_CREDENTIALS_V1;
+exports.createCedarPolicy = services_credential_delegatableCredentials.createCedarPolicy;
+exports.createSignedPresentation = services_credential_delegatableCredentials.createSignedPresentation;
+exports.createUnsignedPresentation = services_credential_delegatableCredentials.createUnsignedPresentation;
+exports.delegatableCredentialsService = services_credential_delegatableCredentials.delegatableCredentialsService;
+exports.issueDelegatedCredential = services_credential_delegatableCredentials.issueDelegatedCredential;
+exports.issueDelegationCredential = services_credential_delegatableCredentials.issueDelegationCredential;
+exports.verifyDelegatablePresentation = services_credential_delegatableCredentials.verifyDelegatablePresentation;
+exports.cedar = cedar__namespace;
+Object.defineProperty(exports, 'MAY_CLAIM_IRI', {
+	enumerable: true,
+	get: function () { return vcDelegationEngine.MAY_CLAIM_IRI; }
+});
 exports.credentialServiceRPC = credentialServiceRPC;

package/lib/services/credential/index.mjs

@@ -1,4 +1,8 @@
 import { credentialService } from './service.mjs';
+export { DELEGATION_CONTEXT_TERMS, DELEGATION_ENGINE_NS, PRESENTATION_CONTEXT, W3C_CREDENTIALS_V1, createCedarPolicy, createSignedPresentation, createUnsignedPresentation, delegatableCredentialsService, issueDelegatedCredential, issueDelegationCredential, verifyDelegatablePresentation } from './delegatable-credentials.mjs';
+import * as cedar from '@cedar-policy/cedar-wasm/nodejs';
+export { cedar };
+export { MAY_CLAIM_IRI } from '@docknetwork/vc-delegation-engine';
 import './config.mjs';
 import 'assert';
 import '@docknetwork/crypto-wasm-ts';

package/lib/services/credential/pex-helpers.js

@@ -9,10 +9,10 @@ const EPSILON_INT = 1;
 
 const MAX_DATE_PLACEHOLDER = 884541351600000;
 const MIN_DATE_PLACEHOLDER = -17592186044415;
-const MAX_INTEGER = 100 ** 9;
-const MIN_INTEGER = -4294967295;
-const MAX_NUMBER = 100 ** 5;
-const MIN_NUMBER = -4294967294;
+const MAX_INTEGER = Number.MAX_SAFE_INTEGER;
+const MIN_INTEGER = Number.MIN_SAFE_INTEGER;
+const MAX_NUMBER = Number.MAX_SAFE_INTEGER;
+const MIN_NUMBER = Number.MIN_SAFE_INTEGER;
 
 /*
   PEX Filter rules:

package/lib/services/credential/pex-helpers.mjs

@@ -5,10 +5,10 @@ const EPSILON_INT = 1;
 
 const MAX_DATE_PLACEHOLDER = 884541351600000;
 const MIN_DATE_PLACEHOLDER = -17592186044415;
-const MAX_INTEGER = 100 ** 9;
-const MIN_INTEGER = -4294967295;
-const MAX_NUMBER = 100 ** 5;
-const MIN_NUMBER = -4294967294;
+const MAX_INTEGER = Number.MAX_SAFE_INTEGER;
+const MIN_INTEGER = Number.MIN_SAFE_INTEGER;
+const MAX_NUMBER = Number.MAX_SAFE_INTEGER;
+const MIN_NUMBER = Number.MIN_SAFE_INTEGER;
 
 /*
   PEX Filter rules:

package/lib/services/edv/index.js

@@ -25,6 +25,7 @@ require('@docknetwork/credential-sdk/vc/crypto');
 require('@docknetwork/credential-sdk/utils');
 require('@digitalbazaar/x25519-key-agreement-key-2019');
 require('../dids/keypair-utils.js');
+require('futoin-hkdf');
 
 
 

package/lib/services/edv/index.mjs

@@ -21,3 +21,4 @@ import '@docknetwork/credential-sdk/vc/crypto';
 import '@docknetwork/credential-sdk/utils';
 import '@digitalbazaar/x25519-key-agreement-key-2019';
 import '../dids/keypair-utils.mjs';
+import 'futoin-hkdf';

package/lib/services/edv/service-rpc.js

@@ -50,6 +50,29 @@ class EDVServiceRpc extends services_rpcServiceClient.RpcService {
   delete(params     ) {
     return this.call('delete', params);
   }
+
+  deriveBiometricKey(biometricData        , identifier        ) {
+    return this.call('deriveBiometricKey', {biometricData, identifier});
+  }
+
+  deriveBiometricEncryptionKey(biometricData        , identifier        ) {
+    return this.call('deriveBiometricEncryptionKey', {
+      biometricData,
+      identifier,
+    });
+  }
+
+  encryptMasterKey(masterKey            , encryptionKey        , iv        ) {
+    return this.call('encryptMasterKey', {masterKey, encryptionKey, iv});
+  }
+
+  decryptMasterKey(
+    encryptedKey            ,
+    decryptionKey        ,
+    iv        ,
+  ) {
+    return this.call('decryptMasterKey', {encryptedKey, decryptionKey, iv});
+  }
 }
 
 exports.EDVServiceRpc = EDVServiceRpc;

package/lib/services/edv/service-rpc.mjs

@@ -46,6 +46,29 @@ class EDVServiceRpc extends RpcService {
   delete(params     ) {
     return this.call('delete', params);
   }
+
+  deriveBiometricKey(biometricData        , identifier        ) {
+    return this.call('deriveBiometricKey', {biometricData, identifier});
+  }
+
+  deriveBiometricEncryptionKey(biometricData        , identifier        ) {
+    return this.call('deriveBiometricEncryptionKey', {
+      biometricData,
+      identifier,
+    });
+  }
+
+  encryptMasterKey(masterKey            , encryptionKey        , iv        ) {
+    return this.call('encryptMasterKey', {masterKey, encryptionKey, iv});
+  }
+
+  decryptMasterKey(
+    encryptedKey            ,
+    decryptionKey        ,
+    iv        ,
+  ) {
+    return this.call('decryptMasterKey', {encryptedKey, decryptionKey, iv});
+  }
 }
 
 export { EDVServiceRpc };

package/lib/services/edv/service.js

@@ -12,9 +12,10 @@ var keypairs = require('@docknetwork/universal-wallet/methods/keypairs');
 var logger = require('@docknetwork/wallet-sdk-data-store/lib/logger');
 var services_dids_service = require('../dids/service.js');
 var keypairs$1 = require('@docknetwork/credential-sdk/keypairs');
+var hkdf = require('futoin-hkdf');
+var crypto = require('@docknetwork/universal-wallet/crypto');
 require('assert');
 require('base64url-universal');
-require('@docknetwork/universal-wallet/crypto');
 require('@docknetwork/wallet-sdk-dids/lib');
 require('../dids/config.js');
 require('base64url');
@@ -28,8 +29,12 @@ require('../dids/keypair-utils.js');
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
 var EDVHTTPStorageInterface__default = /*#__PURE__*/_interopDefaultLegacy(EDVHTTPStorageInterface);
+var hkdf__default = /*#__PURE__*/_interopDefaultLegacy(hkdf);
+var crypto__default = /*#__PURE__*/_interopDefaultLegacy(crypto);
 
 // @ts-nocheck
+const HKDF_LENGTH = 32;
+const HKDF_HASH = 'SHA-256';
 /**
  * Service class for managing Encrypted Data Vaults
  * @class
@@ -49,6 +54,10 @@ class EDVService {
         EDVService.prototype.update,
         EDVService.prototype.insert,
         EDVService.prototype.delete,
+        EDVService.prototype.deriveBiometricKey,
+        EDVService.prototype.deriveBiometricEncryptionKey,
+        EDVService.prototype.encryptMasterKey,
+        EDVService.prototype.decryptMasterKey,
     ];
     /**
      * Creates a new EDVService instance
@@ -249,6 +258,75 @@ class EDVService {
     delete(params) {
         return this.storageInterface.delete(params);
     }
+    /**
+     * Derives a key from biometric data using HKDF
+     * @param {Buffer} biometricData - Biometric data from provider
+     * @param {string} identifier - User's identifier as salt (email, phone number, etc.)
+     * @returns {Buffer} Derived key
+     * @example
+     * const key = edvService.deriveBiometricKey(biometricData, 'user@example.com');
+     */
+    deriveBiometricKey(biometricData, identifier) {
+        const salt = identifier;
+        return hkdf__default["default"](biometricData, HKDF_LENGTH, { salt, hash: HKDF_HASH });
+    }
+    /**
+     * Generates a key for encrypting/decrypting the master key
+     * @param {Buffer} biometricData - Biometric data from provider
+     * @param {string} identifier - User's identifier as salt (email, phone number, etc.)
+     * @returns {Promise<Object>} Encryption key and IV for AES encryption
+     * @returns {Buffer} returns.key - Encryption key
+     * @returns {Buffer} returns.iv - Initialization vector
+     * @example
+     * const { key, iv } = await edvService.deriveBiometricEncryptionKey(biometricData, 'user@example.com');
+     */
+    async deriveBiometricEncryptionKey(biometricData, identifier) {
+        const key = this.deriveBiometricKey(biometricData, identifier);
+        const randomBytes = crypto__default["default"].getRandomValues(new Uint8Array(16));
+        const iv = Buffer.from(randomBytes);
+        return {
+            key,
+            iv
+        };
+    }
+    /**
+     * Encrypts the master key using a key derived from biometric data
+     * @param {Uint8Array} masterKey - The CloudWalletVault master key to encrypt
+     * @param {Buffer} encryptionKey - Key derived from biometric data
+     * @param {Buffer} iv - Initialization vector
+     * @returns {Promise<Uint8Array>} Encrypted master key
+     * @example
+     * const encrypted = await edvService.encryptMasterKey(masterKey, encryptionKey, iv);
+     */
+    async encryptMasterKey(masterKey, encryptionKey, iv) {
+        const keyData = new Uint8Array(encryptionKey);
+        const ivData = new Uint8Array(iv);
+        const key = await crypto__default["default"].subtle.importKey('raw', keyData, { name: 'AES-GCM' }, false, ['encrypt']);
+        const encryptedBuffer = await crypto__default["default"].subtle.encrypt({ name: 'AES-GCM', iv: ivData }, key, masterKey);
+        return new Uint8Array(encryptedBuffer);
+    }
+    /**
+     * Decrypts the master key using biometric-derived key
+     * @param {Uint8Array} encryptedKey - The encrypted master key
+     * @param {Buffer} decryptionKey - Key derived from biometric data
+     * @param {Buffer} iv - Initialization vector
+     * @returns {Promise<Uint8Array>} The decrypted master key
+     * @throws {Error} If decryption fails
+     * @example
+     * const masterKey = await edvService.decryptMasterKey(encryptedKey, decryptionKey, iv);
+     */
+    async decryptMasterKey(encryptedKey, decryptionKey, iv) {
+        try {
+            const keyData = new Uint8Array(decryptionKey);
+            const ivData = new Uint8Array(iv);
+            const key = await crypto__default["default"].subtle.importKey('raw', keyData, { name: 'AES-GCM' }, false, ['decrypt']);
+            const decryptedBuffer = await crypto__default["default"].subtle.decrypt({ name: 'AES-GCM', iv: ivData }, key, encryptedKey);
+            return new Uint8Array(decryptedBuffer);
+        }
+        catch (error) {
+            throw new Error('Decryption failed: Invalid key or corrupted data');
+        }
+    }
 }
 /**
  * Singleton instance of the EDV service
@@ -287,4 +365,6 @@ class EDVService {
 const edvService = new EDVService();
 
 exports.EDVService = EDVService;
+exports.HKDF_HASH = HKDF_HASH;
+exports.HKDF_LENGTH = HKDF_LENGTH;
 exports.edvService = edvService;

package/lib/services/edv/service.mjs

@@ -8,9 +8,10 @@ import { getKeypairFromDoc } from '@docknetwork/universal-wallet/methods/keypair
 import { logger } from '@docknetwork/wallet-sdk-data-store/lib/logger';
 import { didService } from '../dids/service.mjs';
 import { Ed25519Keypair } from '@docknetwork/credential-sdk/keypairs';
+import hkdf from 'futoin-hkdf';
+import crypto from '@docknetwork/universal-wallet/crypto';
 import 'assert';
 import 'base64url-universal';
-import '@docknetwork/universal-wallet/crypto';
 import '@docknetwork/wallet-sdk-dids/lib';
 import '../dids/config.mjs';
 import 'base64url';
@@ -22,6 +23,8 @@ import '@digitalbazaar/x25519-key-agreement-key-2019';
 import '../dids/keypair-utils.mjs';
 
 // @ts-nocheck
+const HKDF_LENGTH = 32;
+const HKDF_HASH = 'SHA-256';
 /**
  * Service class for managing Encrypted Data Vaults
  * @class
@@ -41,6 +44,10 @@ class EDVService {
         EDVService.prototype.update,
         EDVService.prototype.insert,
         EDVService.prototype.delete,
+        EDVService.prototype.deriveBiometricKey,
+        EDVService.prototype.deriveBiometricEncryptionKey,
+        EDVService.prototype.encryptMasterKey,
+        EDVService.prototype.decryptMasterKey,
     ];
     /**
      * Creates a new EDVService instance
@@ -241,6 +248,75 @@ class EDVService {
     delete(params) {
         return this.storageInterface.delete(params);
     }
+    /**
+     * Derives a key from biometric data using HKDF
+     * @param {Buffer} biometricData - Biometric data from provider
+     * @param {string} identifier - User's identifier as salt (email, phone number, etc.)
+     * @returns {Buffer} Derived key
+     * @example
+     * const key = edvService.deriveBiometricKey(biometricData, 'user@example.com');
+     */
+    deriveBiometricKey(biometricData, identifier) {
+        const salt = identifier;
+        return hkdf(biometricData, HKDF_LENGTH, { salt, hash: HKDF_HASH });
+    }
+    /**
+     * Generates a key for encrypting/decrypting the master key
+     * @param {Buffer} biometricData - Biometric data from provider
+     * @param {string} identifier - User's identifier as salt (email, phone number, etc.)
+     * @returns {Promise<Object>} Encryption key and IV for AES encryption
+     * @returns {Buffer} returns.key - Encryption key
+     * @returns {Buffer} returns.iv - Initialization vector
+     * @example
+     * const { key, iv } = await edvService.deriveBiometricEncryptionKey(biometricData, 'user@example.com');
+     */
+    async deriveBiometricEncryptionKey(biometricData, identifier) {
+        const key = this.deriveBiometricKey(biometricData, identifier);
+        const randomBytes = crypto.getRandomValues(new Uint8Array(16));
+        const iv = Buffer.from(randomBytes);
+        return {
+            key,
+            iv
+        };
+    }
+    /**
+     * Encrypts the master key using a key derived from biometric data
+     * @param {Uint8Array} masterKey - The CloudWalletVault master key to encrypt
+     * @param {Buffer} encryptionKey - Key derived from biometric data
+     * @param {Buffer} iv - Initialization vector
+     * @returns {Promise<Uint8Array>} Encrypted master key
+     * @example
+     * const encrypted = await edvService.encryptMasterKey(masterKey, encryptionKey, iv);
+     */
+    async encryptMasterKey(masterKey, encryptionKey, iv) {
+        const keyData = new Uint8Array(encryptionKey);
+        const ivData = new Uint8Array(iv);
+        const key = await crypto.subtle.importKey('raw', keyData, { name: 'AES-GCM' }, false, ['encrypt']);
+        const encryptedBuffer = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: ivData }, key, masterKey);
+        return new Uint8Array(encryptedBuffer);
+    }
+    /**
+     * Decrypts the master key using biometric-derived key
+     * @param {Uint8Array} encryptedKey - The encrypted master key
+     * @param {Buffer} decryptionKey - Key derived from biometric data
+     * @param {Buffer} iv - Initialization vector
+     * @returns {Promise<Uint8Array>} The decrypted master key
+     * @throws {Error} If decryption fails
+     * @example
+     * const masterKey = await edvService.decryptMasterKey(encryptedKey, decryptionKey, iv);
+     */
+    async decryptMasterKey(encryptedKey, decryptionKey, iv) {
+        try {
+            const keyData = new Uint8Array(decryptionKey);
+            const ivData = new Uint8Array(iv);
+            const key = await crypto.subtle.importKey('raw', keyData, { name: 'AES-GCM' }, false, ['decrypt']);
+            const decryptedBuffer = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: ivData }, key, encryptedKey);
+            return new Uint8Array(decryptedBuffer);
+        }
+        catch (error) {
+            throw new Error('Decryption failed: Invalid key or corrupted data');
+        }
+    }
 }
 /**
  * Singleton instance of the EDV service
@@ -278,4 +354,4 @@ class EDVService {
  */
 const edvService = new EDVService();
 
-export { EDVService, edvService };
+export { EDVService, HKDF_HASH, HKDF_LENGTH, edvService };

package/lib/services/index.js

@@ -77,6 +77,7 @@ require('./edv/hmac.js');
 require('base64url-universal');
 require('@docknetwork/universal-wallet/crypto');
 require('@docknetwork/wallet-sdk-data-store/lib/logger');
+require('futoin-hkdf');
 
 var services = [
   services_blockchain_service.blockchainService,