@forgezero/runtime 0.1.0

package/dist/outbox.js

@@ -0,0 +1,236 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/outbox.ts
+class OutboxError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "OutboxError";
+  }
+}
+var EVENT_STATES = ["pending", "delivering", "delivered", "dead"];
+var DEFAULT_POLICY = {
+  maxAttempts: 8,
+  baseDelayMs: 1000,
+  maxDelayMs: 300000,
+  jitter: 0.3,
+  claimTtlMs: 60000
+};
+function backoffMs(attempts, policy = DEFAULT_POLICY, random = Math.random) {
+  const exponential = Math.min(policy.baseDelayMs * 2 ** Math.max(0, attempts - 1), policy.maxDelayMs);
+  return Math.round(exponential * (1 + policy.jitter * random()));
+}
+function createOutbox(options) {
+  const policy = { ...DEFAULT_POLICY, ...options.policy };
+  const now = options.now ?? Date.now;
+  const random = options.random ?? Math.random;
+  const drainerId = options.drainerId ?? `drainer-${Math.floor(Math.random() * 1e9).toString(36)}`;
+  let sequence = 0;
+  const nextId = () => `evt_${now().toString(36)}_${(sequence += 1).toString(36)}`;
+  async function settleOne(event) {
+    let result;
+    try {
+      result = await options.transport.deliver(event);
+    } catch (cause) {
+      result = { ok: false, error: cause instanceof Error ? cause.message : String(cause) };
+    }
+    if (result.ok) {
+      await options.store.settle(event.id, {
+        state: "delivered",
+        deliveredAtMs: now(),
+        claimedBy: undefined,
+        claimedUntilMs: undefined
+      });
+      return "delivered";
+    }
+    const attempts = event.attempts + 1;
+    const exhausted = result.terminal || attempts >= policy.maxAttempts;
+    if (exhausted) {
+      const dead = {
+        ...event,
+        state: "dead",
+        attempts,
+        lastError: result.error,
+        claimedBy: undefined,
+        claimedUntilMs: undefined
+      };
+      await options.store.settle(event.id, {
+        state: "dead",
+        attempts,
+        lastError: result.error,
+        claimedBy: undefined,
+        claimedUntilMs: undefined
+      });
+      options.onDeadLetter?.(dead);
+      return "dead";
+    }
+    await options.store.settle(event.id, {
+      state: "pending",
+      attempts,
+      lastError: result.error,
+      nextAttemptAtMs: now() + backoffMs(attempts, policy, random),
+      claimedBy: undefined,
+      claimedUntilMs: undefined
+    });
+    return "failed";
+  }
+  return {
+    async publish(input) {
+      const event = {
+        id: input.id ?? nextId(),
+        type: input.type,
+        key: input.key,
+        route: input.route,
+        realm: input.realm,
+        payload: input.payload,
+        state: "pending",
+        attempts: 0,
+        nextAttemptAtMs: input.notBeforeMs ?? now(),
+        createdAtMs: now()
+      };
+      const inserted = await options.store.insert(event);
+      if (!inserted) {
+        return await options.store.get(event.id) ?? event;
+      }
+      return event;
+    },
+    async drain(limit = 32) {
+      const events = await options.store.claim({
+        drainerId,
+        limit,
+        nowMs: now(),
+        claimTtlMs: policy.claimTtlMs
+      });
+      const outcomes = await Promise.all(events.map(settleOne));
+      return {
+        claimed: events.length,
+        delivered: outcomes.filter((outcome) => outcome === "delivered").length,
+        failed: outcomes.filter((outcome) => outcome === "failed").length,
+        dead: outcomes.filter((outcome) => outcome === "dead").length
+      };
+    },
+    deadLetter: (limit = 100) => options.store.byState("dead", limit),
+    async retry(id) {
+      const event = await options.store.get(id);
+      if (!event)
+        throw new OutboxError("UNKNOWN_EVENT", `No event ${id}.`);
+      await options.store.settle(id, {
+        state: "pending",
+        attempts: 0,
+        nextAttemptAtMs: now(),
+        lastError: undefined
+      });
+    },
+    pending: (limit = 100) => options.store.byState("pending", limit),
+    drainerId
+  };
+}
+function outboxJob(outbox, options = {}) {
+  return {
+    key: options.key ?? "outbox.drain",
+    everyMs: options.everyMs ?? 5000,
+    run: async () => {
+      let total = { claimed: 0, delivered: 0, failed: 0, dead: 0 };
+      const batch = options.batch ?? 32;
+      for (let round = 0;round < 20; round += 1) {
+        const report = await outbox.drain(batch);
+        total = {
+          claimed: total.claimed + report.claimed,
+          delivered: total.delivered + report.delivered,
+          failed: total.failed + report.failed,
+          dead: total.dead + report.dead
+        };
+        if (report.claimed < batch)
+          break;
+      }
+      return { ok: total.dead === 0, detail: total };
+    }
+  };
+}
+function memoryStore() {
+  const events = new Map;
+  return {
+    async insert(event) {
+      if (events.has(event.id))
+        return false;
+      events.set(event.id, { ...event });
+      return true;
+    },
+    async claim({ drainerId, limit, nowMs, claimTtlMs }) {
+      const claimed = [];
+      const keysInBatch = new Set;
+      const candidates = [...events.values()].filter((event) => {
+        if (event.state === "delivered" || event.state === "dead")
+          return false;
+        if (event.nextAttemptAtMs > nowMs)
+          return false;
+        if (event.state === "delivering" && (event.claimedUntilMs ?? 0) > nowMs)
+          return false;
+        return true;
+      }).sort((a, b) => a.createdAtMs - b.createdAtMs || a.id.localeCompare(b.id));
+      const blocked = new Set;
+      for (const event of candidates) {
+        if (!event.key) {
+          if (claimed.length >= limit)
+            break;
+          claimed.push(event);
+          continue;
+        }
+        if (blocked.has(event.key) || keysInBatch.has(event.key))
+          continue;
+        if (claimed.length >= limit)
+          break;
+        keysInBatch.add(event.key);
+        blocked.add(event.key);
+        claimed.push(event);
+      }
+      for (const event of claimed) {
+        events.set(event.id, {
+          ...event,
+          state: "delivering",
+          claimedBy: drainerId,
+          claimedUntilMs: nowMs + claimTtlMs
+        });
+      }
+      return claimed.map((event) => ({ ...events.get(event.id) }));
+    },
+    async settle(id, patch) {
+      const event = events.get(id);
+      if (!event)
+        return;
+      const merged = { ...event, ...patch };
+      for (const [key, value] of Object.entries(patch)) {
+        if (value === undefined)
+          delete merged[key];
+      }
+      events.set(id, merged);
+    },
+    async byState(state, limit = 100) {
+      return [...events.values()].filter((event) => event.state === state).sort((a, b) => a.createdAtMs - b.createdAtMs).slice(0, limit);
+    },
+    async get(id) {
+      const event = events.get(id);
+      return event ? { ...event } : null;
+    },
+    all: () => [...events.values()],
+    clear: () => events.clear()
+  };
+}
+var VERSION = "0.1.0";
+export {
+  outboxJob,
+  memoryStore,
+  createOutbox,
+  backoffMs,
+  VERSION,
+  OutboxError,
+  EVENT_STATES,
+  DEFAULT_POLICY
+};

package/dist/passkey.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Passkeys held in the vault, for sites that are not us.
+ *
+ * `security/webauthn.ts` is ForgeZero authenticating a person. This is the
+ * opposite direction: ForgeZero acting as the AUTHENTICATOR for somebody else's
+ * site, so a credential survives a lost laptop.
+ *
+ * ## Phishing resistance is the RP ID, not the hardware
+ *
+ * The reason a passkey cannot be phished is that the credential signs a
+ * structure containing a hash of the relying party it belongs to, and the
+ * browser supplies that from the origin it is actually on. A key living in a
+ * vault is exactly as unphishable as one in a security chip, PROVIDED the RP ID
+ * check is never skipped — which is why it is the first thing this module does
+ * and why it refuses rather than warns.
+ *
+ * Synced passkeys are standardised, not a workaround: WebAuthn calls them
+ * multi-device credentials, and every major manager ships them.
+ *
+ * ## Derived, never stored
+ *
+ * A credential's private half comes from the realm seed and the site it belongs
+ * to. Nothing is kept that could be read: the key is reconstructed inside a
+ * signing call and the same inputs always produce the same credential, so a
+ * restored vault still holds every passkey it ever created.
+ */
+export declare class PasskeyError extends Error {
+    readonly code: 'RP_MISMATCH' | 'BAD_ORIGIN' | 'BAD_CREDENTIAL' | 'BAD_CHALLENGE';
+    constructor(code: 'RP_MISMATCH' | 'BAD_ORIGIN' | 'BAD_CREDENTIAL' | 'BAD_CHALLENGE', message: string);
+}
+/**
+ * Does this origin belong to this relying party?
+ *
+ * The WebAuthn rule: the RP ID must equal the origin's effective domain or be a
+ * registrable suffix of it. `login.example.com` may use a credential for
+ * `example.com`; `example.com.evil.net` may not, and neither may
+ * `notexample.com`.
+ *
+ * The suffix test is on LABELS, not characters. `evil-example.com` ends with
+ * `example.com` as a string and is a different site — that single mistake is
+ * the whole attack.
+ */
+export declare function rpIdMatches(origin: string, rpId: string): boolean;
+export interface StoredPasskey {
+    /** The site. `github.com`, never an origin. */
+    rpId: string;
+    /** Opaque bytes the site gave for the account. */
+    userHandle: string;
+    /** What a person sees in a list. */
+    userName: string;
+    /** Base64url. Derived, so it is reproducible rather than remembered. */
+    credentialId: string;
+    publicKey: string;
+    /** Incremented per assertion. A site may use it to spot a cloned key. */
+    counter: number;
+    createdAtTs: number;
+}
+/**
+ * A credential id that is a function of what it is for.
+ *
+ * Derived rather than random so a restored vault produces the same ids: a
+ * random id would have to be stored, and a credential whose id was lost is one
+ * the site will never recognise again no matter what key you hold.
+ */
+export declare const credentialIdFor: (rpId: string, userHandle: string) => string;
+/** WebAuthn flags. UP is presence, UV is verification, BE/BS are backup state. */
+export declare const FLAG_UP = 1;
+export declare const FLAG_UV = 4;
+export declare const FLAG_BE = 8;
+export declare const FLAG_BS = 16;
+/**
+ * `authenticatorData`, which is the structure the signature actually covers.
+ *
+ *   32  sha256(rpId)   ← the binding, and the whole security argument
+ *    1  flags
+ *    4  signature counter, big-endian
+ *
+ * BE and BS are set because a vault-held credential IS backed up and IS
+ * currently available on more than one device. Claiming otherwise would tell a
+ * relying party this key cannot be recovered, and some of them use that to
+ * decide whether to keep a fallback.
+ */
+export declare function authenticatorData(rpId: string, counter: number, userVerified: boolean): Uint8Array;
+export interface AssertionRequest {
+    passkey: StoredPasskey;
+    /** The origin the browser is actually on. Checked, never trusted. */
+    origin: string;
+    /** The site's challenge, base64url. */
+    challenge: string;
+    userVerified?: boolean;
+    /** Signs 32 bytes with the credential's private half. Never returns it. */
+    sign: (message: Uint8Array) => Uint8Array;
+}
+export interface Assertion {
+    credentialId: string;
+    authenticatorData: string;
+    clientDataJSON: string;
+    signature: string;
+    userHandle: string;
+    counter: number;
+}
+/**
+ * Produce one assertion.
+ *
+ * The origin is checked FIRST, before anything is built and long before
+ * anything is signed. A signature produced and then discarded because the check
+ * failed is a signature that existed, and the only safe place for that check is
+ * ahead of it.
+ */
+export declare function assertPasskey(request: AssertionRequest): Assertion;
+/**
+ * Which stored passkeys may be offered on this page.
+ *
+ * The same shape as the extension's credential matcher and for the same reason:
+ * offering a credential on the wrong site is the failure, and it happens before
+ * anybody clicks anything.
+ */
+export declare const passkeysFor: (passkeys: readonly StoredPasskey[], origin: string) => StoredPasskey[];
+/** Verify one of our own assertions. For tests, and for a caller that wants proof. */
+export declare function verifyAssertion(assertion: Assertion, publicKey: string): boolean;

package/dist/passkey.js

@@ -0,0 +1,105 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/passkey.ts
+import { sha256 } from "@noble/hashes/sha2.js";
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { toBase64Url, fromBase64Url } from "@forgezero/access/security";
+
+class PasskeyError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "PasskeyError";
+  }
+}
+function rpIdMatches(origin, rpId) {
+  let host;
+  try {
+    const url = new URL(origin);
+    if (url.protocol !== "https:" && url.hostname !== "localhost")
+      return false;
+    host = url.hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  const wanted = rpId.trim().toLowerCase();
+  if (!wanted || wanted !== wanted.replace(/[^a-z0-9.-]/g, ""))
+    return false;
+  if (host === wanted)
+    return true;
+  return host.endsWith(`.${wanted}`);
+}
+var credentialIdFor = (rpId, userHandle) => toBase64Url(sha256(new TextEncoder().encode(`fz:passkey:${rpId}:${userHandle}`)));
+var FLAG_UP = 1;
+var FLAG_UV = 4;
+var FLAG_BE = 8;
+var FLAG_BS = 16;
+function authenticatorData(rpId, counter, userVerified) {
+  const rpIdHash = sha256(new TextEncoder().encode(rpId));
+  const out = new Uint8Array(37);
+  out.set(rpIdHash, 0);
+  out[32] = FLAG_UP | FLAG_BE | FLAG_BS | (userVerified ? FLAG_UV : 0);
+  new DataView(out.buffer).setUint32(33, counter, false);
+  return out;
+}
+function assertPasskey(request) {
+  if (!rpIdMatches(request.origin, request.passkey.rpId)) {
+    throw new PasskeyError("RP_MISMATCH", `A credential for ${request.passkey.rpId} will not sign for ${request.origin}. This is what makes a passkey unphishable.`);
+  }
+  if (!request.challenge) {
+    throw new PasskeyError("BAD_CHALLENGE", "The site issued no challenge.");
+  }
+  const counter = request.passkey.counter + 1;
+  const data = authenticatorData(request.passkey.rpId, counter, request.userVerified ?? true);
+  const clientData = JSON.stringify({
+    type: "webauthn.get",
+    challenge: request.challenge,
+    origin: new URL(request.origin).origin,
+    crossOrigin: false
+  });
+  const clientDataHash = sha256(new TextEncoder().encode(clientData));
+  const signed = new Uint8Array(data.length + clientDataHash.length);
+  signed.set(data);
+  signed.set(clientDataHash, data.length);
+  return {
+    credentialId: request.passkey.credentialId,
+    authenticatorData: toBase64Url(data),
+    clientDataJSON: toBase64Url(new TextEncoder().encode(clientData)),
+    signature: toBase64Url(request.sign(signed)),
+    userHandle: request.passkey.userHandle,
+    counter
+  };
+}
+var passkeysFor = (passkeys, origin) => passkeys.filter((passkey) => rpIdMatches(origin, passkey.rpId));
+function verifyAssertion(assertion, publicKey) {
+  const data = fromBase64Url(assertion.authenticatorData);
+  const clientDataHash = sha256(fromBase64Url(assertion.clientDataJSON));
+  const signed = new Uint8Array(data.length + clientDataHash.length);
+  signed.set(data);
+  signed.set(clientDataHash, data.length);
+  try {
+    return ed25519.verify(fromBase64Url(assertion.signature), signed, fromBase64Url(publicKey));
+  } catch {
+    return false;
+  }
+}
+export {
+  verifyAssertion,
+  rpIdMatches,
+  passkeysFor,
+  credentialIdFor,
+  authenticatorData,
+  assertPasskey,
+  PasskeyError,
+  FLAG_UV,
+  FLAG_UP,
+  FLAG_BS,
+  FLAG_BE
+};

package/dist/phrase.d.ts

@@ -0,0 +1,87 @@
+/**
+ * BIP-39 recovery phrases — the custodian's second, offline key.
+ *
+ * Every custodian gets a passkey AND a 24-word phrase. The passkey is the day
+ * to day factor; the phrase is what still works when the laptop holding the
+ * passkey is lost, wiped or dead. See share-envelopes.ts for how the two are
+ * combined (they are alternatives, not a chain).
+ *
+ * ── Why BIP-39, and why 24 words ─────────────────────────────────────────────
+ * We need a key a human can write on paper, read back a year later, and type
+ * without ambiguity. BIP-39's English wordlist is engineered for exactly that:
+ * 2048 words, each identified by its first four letters, no confusable pairs,
+ * and a checksum so a mistyped or transposed word is caught before it becomes a
+ * silent "wrong key" failure hours into a recovery.
+ *
+ * 24 words carries 256 bits of entropy (24 * 11 = 264 bits, of which 8 are the
+ * checksum). That matches the strength of the keys it protects. A 12-word
+ * phrase would be 128 bits — still strong, but it would become the weakest link
+ * in a chain that is otherwise 256-bit throughout, so this module mints and
+ * accepts 24 words only.
+ *
+ * The full 2048-word standard list is used, always. A shortened or custom
+ * wordlist would silently cut the entropy per word and break interoperability
+ * with every offline BIP-39 tool a custodian might use to check their backup.
+ *
+ * ── Key derivation ───────────────────────────────────────────────────────────
+ * `phraseToKey` runs the standard BIP-39 seed derivation (PBKDF2-HMAC-SHA512,
+ * 2048 iterations) and then HKDF-SHA256 with a per-record salt. The PBKDF2 work
+ * factor is a BIP-39 constant and is NOT what provides security here — 2048
+ * iterations would be feeble against a guessable input. It does not need to be
+ * strong: the input is 256 bits of machine-generated entropy, which is not
+ * guessable at any work factor. The per-record salt means the same phrase
+ * yields a different key for every share it protects, so two records never
+ * share a key and one leaked key cannot be tried against another record.
+ *
+ * `phraseVerifier` expands the SAME extracted PRK under a different HKDF info
+ * label. Different info means the two outputs are computationally independent
+ * PRF evaluations: publishing the verifier reveals nothing about the key, and
+ * neither reveals the phrase, since HKDF is one-way. The verifier exists so a
+ * recovery flow can say "that is not the right phrase" immediately instead of
+ * returning an opaque AEAD failure.
+ *
+ * ── Post-quantum ─────────────────────────────────────────────────────────────
+ * Symmetric throughout: PBKDF2-HMAC-SHA512, HKDF-SHA256. Grover's algorithm
+ * takes the 256-bit phrase to a ~128-bit effective search, which is fine. No
+ * public-key primitive is involved, so there is nothing for Shor's algorithm.
+ *
+ * ── Handling ─────────────────────────────────────────────────────────────────
+ * The words are shown to the custodian once, at issue time, and are never
+ * stored by the platform in any form from which they can be recovered. Only the
+ * salt and the verifier are persisted.
+ */
+/** 24 words. 256 bits of entropy plus an 8-bit checksum. */
+export declare const PHRASE_WORDS = 24;
+/** Per-record HKDF salt. 128 bits is ample for uniqueness. */
+export declare const PHRASE_SALT_BYTES = 16;
+/**
+ * A fresh 24-word phrase.
+ *
+ * The entropy comes from `crypto.getRandomValues` and is passed to BIP-39
+ * explicitly rather than letting the library pick, so the 256-bit claim is
+ * visible in this file rather than inferred from a strength parameter.
+ */
+export declare function generatePhrase(): string[];
+/**
+ * Real BIP-39 validation: every word must be in the standard list AND the
+ * trailing checksum bits must match the entropy. This is what catches a
+ * transposed or misread word at input time.
+ *
+ * Deliberately narrower than BIP-39: a valid 12-word phrase returns false here,
+ * because ForgeZero issues 24-word phrases and a 12-word one can only have come
+ * from somewhere else.
+ */
+export declare function validatePhrase(words: string[]): boolean;
+/** A fresh per-record salt for `phraseToKey` / `phraseVerifier`. */
+export declare function newSalt(): Uint8Array;
+/**
+ * Derive the 32-byte key this phrase protects a record with. Deterministic:
+ * same words and same salt always give the same key.
+ */
+export declare function phraseToKey(words: string[], salt: Uint8Array): Uint8Array;
+/**
+ * A salted hex digest that proves a phrase is the right one without being able
+ * to reconstruct it — and without being the key, so storing it next to the
+ * ciphertext gives an attacker nothing to decrypt with.
+ */
+export declare function phraseVerifier(words: string[], salt: Uint8Array): string;

package/dist/phrase.js

@@ -0,0 +1,87 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/phrase.ts
+import { entropyToMnemonic, mnemonicToSeedSync, validateMnemonic } from "@scure/bip39";
+import { wordlist } from "@scure/bip39/wordlists/english.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { toHex } from "@forgezero/access/security";
+var ENCODER = new TextEncoder;
+var randomBytes = (length) => crypto.getRandomValues(new Uint8Array(length));
+var PHRASE_WORDS = 24;
+var ENTROPY_BYTES = 32;
+var PHRASE_SALT_BYTES = 16;
+var KEY_BYTES = 32;
+var KEY_INFO = "forgezero:custodian:phrase-key:v1";
+var VERIFIER_INFO = "forgezero:custodian:phrase-verifier:v1";
+function canonical(words) {
+  return words.map((word) => word.normalize("NFKD").trim().toLowerCase()).join(" ");
+}
+function shapeIsValid(words) {
+  if (!Array.isArray(words) || words.length !== PHRASE_WORDS)
+    return false;
+  return words.every((word) => typeof word === "string" && word.trim().length > 0);
+}
+function generatePhrase() {
+  const entropy = randomBytes(ENTROPY_BYTES);
+  try {
+    const words = entropyToMnemonic(entropy, wordlist).split(" ");
+    if (words.length !== PHRASE_WORDS) {
+      throw new Error("phrase: wordlist produced an unexpected phrase length");
+    }
+    return words;
+  } finally {
+    entropy.fill(0);
+  }
+}
+function validatePhrase(words) {
+  if (!shapeIsValid(words))
+    return false;
+  return validateMnemonic(canonical(words), wordlist);
+}
+function newSalt() {
+  return Uint8Array.from(randomBytes(PHRASE_SALT_BYTES));
+}
+function assertSalt(salt) {
+  if (!(salt instanceof Uint8Array) || salt.length < PHRASE_SALT_BYTES) {
+    throw new Error(`phrase: salt must be at least ${PHRASE_SALT_BYTES} bytes`);
+  }
+}
+function bip39Seed(words) {
+  if (!validatePhrase(words))
+    throw new Error("INVALID_PHRASE");
+  return mnemonicToSeedSync(canonical(words));
+}
+function phraseToKey(words, salt) {
+  assertSalt(salt);
+  const seed = bip39Seed(words);
+  try {
+    return hkdf(sha256, seed, salt, ENCODER.encode(KEY_INFO), KEY_BYTES);
+  } finally {
+    seed.fill(0);
+  }
+}
+function phraseVerifier(words, salt) {
+  assertSalt(salt);
+  const seed = bip39Seed(words);
+  try {
+    return toHex(hkdf(sha256, seed, salt, ENCODER.encode(VERIFIER_INFO), KEY_BYTES));
+  } finally {
+    seed.fill(0);
+  }
+}
+export {
+  validatePhrase,
+  phraseVerifier,
+  phraseToKey,
+  newSalt,
+  generatePhrase,
+  PHRASE_WORDS,
+  PHRASE_SALT_BYTES
+};