@keyneom/sync-kit 0.1.0

package/dist/crypto/envelope.js

@@ -0,0 +1,109 @@
+import { SyncKitError, asSyncKitError } from "../core/errors.js";
+import { base64UrlToBytes, bytesToBase64Url } from "./base64url.js";
+import { V1_ALGORITHM } from "./profiles.js";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+export function parseSyncEnvelopeV1(value, profile) {
+    let parsed;
+    try {
+        parsed =
+            typeof value === "string"
+                ? JSON.parse(value)
+                : value;
+    }
+    catch (error) {
+        throw new SyncKitError("compatibility", `The ${profile.appId} snapshot is not valid JSON.`, { cause: error });
+    }
+    if (parsed?.schemaVersion !== 1 ||
+        parsed.algorithm !== V1_ALGORITHM ||
+        (parsed.compression !== undefined && parsed.compression !== "gzip") ||
+        (profile.compression === "none" && parsed.compression !== undefined) ||
+        !nonEmpty(parsed.credentialId) ||
+        !nonEmpty(parsed.rpId) ||
+        !nonEmpty(parsed.prfInput) ||
+        !nonEmpty(parsed.kdfSalt) ||
+        !nonEmpty(parsed.nonce) ||
+        !nonEmpty(parsed.ciphertext) ||
+        !nonEmpty(parsed.updatedAt)) {
+        throw new SyncKitError("compatibility", `The file is not a supported ${profile.appId} v1 encrypted snapshot.`);
+    }
+    validateEncodedLength(parsed.nonce, profile.nonceBytes, "nonce");
+    validateEncodedLength(parsed.kdfSalt, profile.kdfSaltBytes, "KDF salt");
+    return parsed;
+}
+export async function deriveContentKey(profile, inputKeyMaterial, salt, backend) {
+    return backend.deriveAesGcmKey(inputKeyMaterial, salt, encoder.encode(profile.hkdfInfo));
+}
+export async function encryptSyncEnvelopeV1(value, key, metadata, profile, codec, backend, options = {}) {
+    const nonce = options.nonce ?? backend.randomBytes(profile.nonceBytes);
+    if (nonce.length !== profile.nonceBytes) {
+        throw new SyncKitError("crypto", "AES-GCM nonce must be 12 bytes.");
+    }
+    let plaintext;
+    try {
+        plaintext = encoder.encode(JSON.stringify(codec.serialize(value)));
+    }
+    catch (error) {
+        throw new SyncKitError("serialization", "Snapshot serialization failed.", {
+            cause: error,
+        });
+    }
+    let compression;
+    if (profile.compression === "gzip-if-smaller") {
+        const compressed = await backend.gzip(plaintext);
+        if (compressed.length < plaintext.length) {
+            plaintext = compressed;
+            compression = "gzip";
+        }
+    }
+    const ciphertext = await backend.encryptAesGcm(key, nonce, encoder.encode(profile.aad), plaintext);
+    const updatedAt = codec.updatedAt?.(value) ??
+        options.now?.().toISOString() ??
+        new Date().toISOString();
+    return {
+        schemaVersion: 1,
+        algorithm: V1_ALGORITHM,
+        ...(compression ? { compression } : {}),
+        credentialId: metadata.credentialId,
+        rpId: metadata.rpId,
+        prfInput: bytesToBase64Url(metadata.prfInput),
+        kdfSalt: bytesToBase64Url(metadata.kdfSalt),
+        nonce: bytesToBase64Url(nonce),
+        ciphertext: bytesToBase64Url(ciphertext),
+        updatedAt,
+    };
+}
+export async function decryptSyncEnvelopeV1(input, key, profile, codec, backend) {
+    const envelope = parseSyncEnvelopeV1(input, profile);
+    try {
+        let plaintext = await backend.decryptAesGcm(key, base64UrlToBytes(envelope.nonce), encoder.encode(profile.aad), base64UrlToBytes(envelope.ciphertext));
+        if (envelope.compression === "gzip") {
+            plaintext = await backend.gunzip(plaintext);
+        }
+        return codec.parse(JSON.parse(decoder.decode(plaintext)));
+    }
+    catch (error) {
+        throw asSyncKitError(error, "crypto", `The key could not decrypt the ${profile.appId} snapshot.`);
+    }
+}
+export function createV1EnvelopeCrypto(profile, codec, backend) {
+    return {
+        encrypt: (value, key, metadata) => encryptSyncEnvelopeV1(value, key, metadata, profile, codec, backend),
+        decrypt: (envelope, key) => decryptSyncEnvelopeV1(envelope, key, profile, codec, backend),
+        metadataFromEnvelope: (envelope) => ({
+            credentialId: envelope.credentialId,
+            rpId: envelope.rpId,
+            prfInput: base64UrlToBytes(envelope.prfInput),
+            kdfSalt: base64UrlToBytes(envelope.kdfSalt),
+        }),
+    };
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function validateEncodedLength(value, expected, label) {
+    if (base64UrlToBytes(value).length !== expected) {
+        throw new SyncKitError("compatibility", `The v1 envelope ${label} has an invalid length.`);
+    }
+}
+//# sourceMappingURL=envelope.js.map

package/dist/crypto/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/crypto/envelope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAsBlC,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,OAA+B;IAE/B,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM;YACJ,OAAO,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAA6B;gBAChD,CAAC,CAAE,KAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,OAAO,OAAO,CAAC,KAAK,8BAA8B,EAClD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,IACE,MAAM,EAAE,aAAa,KAAK,CAAC;QAC3B,MAAM,CAAC,SAAS,KAAK,YAAY;QACjC,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC;QACnE,CAAC,OAAO,CAAC,WAAW,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC;QACpE,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACtB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC1B,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;QACzB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACvB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC5B,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAC3B,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,+BAA+B,OAAO,CAAC,KAAK,yBAAyB,CACtE,CAAC;IACJ,CAAC;IACD,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjE,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACxE,OAAO,MAAwB,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA+B,EAC/B,gBAA4B,EAC5B,IAAgB,EAChB,OAAyB;IAEzB,OAAO,OAAO,CAAC,eAAe,CAC5B,gBAAgB,EAChB,IAAI,EACJ,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAQ,EACR,GAAM,EACN,QAAuB,EACvB,OAA+B,EAC/B,KAAoD,EACpD,OAAyB,EACzB,UAAoD,EAAE;IAEtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,gCAAgC,EAAE;YACxE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,WAA+B,CAAC;IACpC,IAAI,OAAO,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;YACzC,SAAS,GAAG,UAAU,CAAC;YACvB,WAAW,GAAG,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAC5C,GAAG,EACH,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAC3B,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC;QACxB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE;QAC7B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3B,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,YAAY;QACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC3C,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAC9B,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;QACxC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAqB,EACrB,GAAM,EACN,OAA+B,EAC/B,KAAkC,EAClC,OAAyB;IAEzB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CACzC,GAAG,EACH,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAChC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAC3B,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtC,CAAC;QACF,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACpC,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,cAAc,CAClB,KAAK,EACL,QAAQ,EACR,iCAAiC,OAAO,CAAC,KAAK,YAAY,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAA+B,EAC/B,KAAmB,EACnB,OAAyB;IAEzB,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAChC,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;QACtE,OAAO,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CACzB,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;QAC/D,oBAAoB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7C,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC;SAC5C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAa,EACb,QAAgB,EAChB,KAAa;IAEb,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,mBAAmB,KAAK,yBAAyB,CAClD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/crypto/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./base64url.js";
+export * from "./canonical.js";
+export * from "./envelope.js";
+export * from "./profiles.js";
+export * from "./runtime.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/crypto/index.js

@@ -0,0 +1,6 @@
+export * from "./base64url.js";
+export * from "./canonical.js";
+export * from "./envelope.js";
+export * from "./profiles.js";
+export * from "./runtime.js";
+//# sourceMappingURL=index.js.map

package/dist/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/crypto/profiles.d.ts

@@ -0,0 +1,73 @@
+export declare const V1_ALGORITHM: "AES-256-GCM+HKDF-SHA-256";
+export type V1Compression = "none" | "gzip-if-smaller";
+export type PasskeyProfile = {
+    rpName: string;
+    userName: string;
+    userDisplayName: string;
+    algorithm: -7;
+    residentKey: "required";
+    userVerification: "required";
+    timeoutMs: number;
+};
+export type V1CompatibilityProfile = {
+    appId: string;
+    filename: string;
+    aad: string;
+    hkdfInfo: string;
+    algorithm: typeof V1_ALGORITHM;
+    readVersions: readonly [1];
+    writeVersion: 1;
+    compression: V1Compression;
+    nonceBytes: 12;
+    kdfSaltBytes: 32;
+    prfInputBytes: 32;
+    tagBits: 128;
+    passkey: PasskeyProfile;
+};
+export declare const easyBcV1Profile: {
+    readonly appId: "easy-bc";
+    readonly filename: "easybc-sync-v1.json";
+    readonly aad: "easy-bc-sync-envelope-v1";
+    readonly hkdfInfo: "easy-bc-cloud-content-key-v1";
+    readonly algorithm: "AES-256-GCM+HKDF-SHA-256";
+    readonly readVersions: readonly [1];
+    readonly writeVersion: 1;
+    readonly compression: "gzip-if-smaller";
+    readonly nonceBytes: 12;
+    readonly kdfSaltBytes: 32;
+    readonly prfInputBytes: 32;
+    readonly tagBits: 128;
+    readonly passkey: {
+        readonly rpName: "EasyBC";
+        readonly userName: "encrypted-sync";
+        readonly userDisplayName: "EasyBC encrypted sync";
+        readonly algorithm: -7;
+        readonly residentKey: "required";
+        readonly userVerification: "required";
+        readonly timeoutMs: 60000;
+    };
+};
+export declare const familyChoresV1Profile: {
+    readonly appId: "family-chores";
+    readonly filename: "family-chores-sync-v1.json";
+    readonly aad: "family-chores-sync-envelope-v1";
+    readonly hkdfInfo: "family-chores-cloud-content-key-v1";
+    readonly algorithm: "AES-256-GCM+HKDF-SHA-256";
+    readonly readVersions: readonly [1];
+    readonly writeVersion: 1;
+    readonly compression: "none";
+    readonly nonceBytes: 12;
+    readonly kdfSaltBytes: 32;
+    readonly prfInputBytes: 32;
+    readonly tagBits: 128;
+    readonly passkey: {
+        readonly rpName: "Family Chores";
+        readonly userName: "encrypted-sync";
+        readonly userDisplayName: "Family Chores encrypted sync";
+        readonly algorithm: -7;
+        readonly residentKey: "required";
+        readonly userVerification: "required";
+        readonly timeoutMs: 60000;
+    };
+};
+//# sourceMappingURL=profiles.d.ts.map

package/dist/crypto/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/crypto/profiles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,EAAG,0BAAmC,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,iBAAiB,CAAC;AAEvD,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,CAAC;IACd,WAAW,EAAE,UAAU,CAAC;IACxB,gBAAgB,EAAE,UAAU,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,YAAY,CAAC;IAC/B,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC;IAChB,WAAW,EAAE,aAAa,CAAC;IAC3B,UAAU,EAAE,EAAE,CAAC;IACf,YAAY,EAAE,EAAE,CAAC;IACjB,aAAa,EAAE,EAAE,CAAC;IAClB,OAAO,EAAE,GAAG,CAAC;IACb,OAAO,EAAE,cAAc,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;CAsBe,CAAC;AAE5C,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;CAsBS,CAAC"}

package/dist/crypto/profiles.js

@@ -0,0 +1,48 @@
+export const V1_ALGORITHM = "AES-256-GCM+HKDF-SHA-256";
+export const easyBcV1Profile = {
+    appId: "easy-bc",
+    filename: "easybc-sync-v1.json",
+    aad: "easy-bc-sync-envelope-v1",
+    hkdfInfo: "easy-bc-cloud-content-key-v1",
+    algorithm: V1_ALGORITHM,
+    readVersions: [1],
+    writeVersion: 1,
+    compression: "gzip-if-smaller",
+    nonceBytes: 12,
+    kdfSaltBytes: 32,
+    prfInputBytes: 32,
+    tagBits: 128,
+    passkey: {
+        rpName: "EasyBC",
+        userName: "encrypted-sync",
+        userDisplayName: "EasyBC encrypted sync",
+        algorithm: -7,
+        residentKey: "required",
+        userVerification: "required",
+        timeoutMs: 60_000,
+    },
+};
+export const familyChoresV1Profile = {
+    appId: "family-chores",
+    filename: "family-chores-sync-v1.json",
+    aad: "family-chores-sync-envelope-v1",
+    hkdfInfo: "family-chores-cloud-content-key-v1",
+    algorithm: V1_ALGORITHM,
+    readVersions: [1],
+    writeVersion: 1,
+    compression: "none",
+    nonceBytes: 12,
+    kdfSaltBytes: 32,
+    prfInputBytes: 32,
+    tagBits: 128,
+    passkey: {
+        rpName: "Family Chores",
+        userName: "encrypted-sync",
+        userDisplayName: "Family Chores encrypted sync",
+        algorithm: -7,
+        residentKey: "required",
+        userVerification: "required",
+        timeoutMs: 60_000,
+    },
+};
+//# sourceMappingURL=profiles.js.map

package/dist/crypto/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/crypto/profiles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,0BAAmC,CAAC;AA8BhE,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,qBAAqB;IAC/B,GAAG,EAAE,0BAA0B;IAC/B,QAAQ,EAAE,8BAA8B;IACxC,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,CAAC,CAAC,CAAC;IACjB,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,EAAE;IACjB,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE;QACP,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,uBAAuB;QACxC,SAAS,EAAE,CAAC,CAAC;QACb,WAAW,EAAE,UAAU;QACvB,gBAAgB,EAAE,UAAU;QAC5B,SAAS,EAAE,MAAM;KAClB;CACwC,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,eAAe;IACtB,QAAQ,EAAE,4BAA4B;IACtC,GAAG,EAAE,gCAAgC;IACrC,QAAQ,EAAE,oCAAoC;IAC9C,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,CAAC,CAAC,CAAC;IACjB,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,EAAE;IACjB,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE;QACP,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,8BAA8B;QAC/C,SAAS,EAAE,CAAC,CAAC;QACb,WAAW,EAAE,UAAU;QACvB,gBAAgB,EAAE,UAAU;QAC5B,SAAS,EAAE,MAAM;KAClB;CACwC,CAAC"}

package/dist/crypto/runtime.d.ts

@@ -0,0 +1,11 @@
+export interface CryptoBackend<K> {
+    randomBytes(length: number): Uint8Array;
+    deriveAesGcmKey(inputKeyMaterial: Uint8Array, salt: Uint8Array, info: Uint8Array): Promise<K>;
+    encryptAesGcm(key: K, nonce: Uint8Array, aad: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
+    decryptAesGcm(key: K, nonce: Uint8Array, aad: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array>;
+    gzip(plaintext: Uint8Array): Promise<Uint8Array>;
+    gunzip(compressed: Uint8Array): Promise<Uint8Array>;
+}
+export declare function createWebCryptoBackend(cryptoImplementation?: Crypto): CryptoBackend<CryptoKey>;
+export declare function copyBuffer(bytes: Uint8Array): ArrayBuffer;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/crypto/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/crypto/runtime.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACxC,eAAe,CACb,gBAAgB,EAAE,UAAU,EAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,aAAa,CACX,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,aAAa,CACX,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,UAAU,EACf,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrD;AAED,wBAAgB,sBAAsB,CACpC,oBAAoB,GAAE,MAA0B,GAC/C,aAAa,CAAC,SAAS,CAAC,CAmE1B;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAEzD"}

package/dist/crypto/runtime.js

@@ -0,0 +1,57 @@
+import { SyncKitError } from "../core/errors.js";
+export function createWebCryptoBackend(cryptoImplementation = globalThis.crypto) {
+    if (!cryptoImplementation?.subtle) {
+        throw new SyncKitError("configuration", "A WebCrypto implementation is required.");
+    }
+    return {
+        randomBytes(length) {
+            return cryptoImplementation.getRandomValues(new Uint8Array(length));
+        },
+        async deriveAesGcmKey(inputKeyMaterial, salt, info) {
+            const material = await cryptoImplementation.subtle.importKey("raw", copyBuffer(inputKeyMaterial), "HKDF", false, ["deriveKey"]);
+            return cryptoImplementation.subtle.deriveKey({
+                name: "HKDF",
+                hash: "SHA-256",
+                salt: copyBuffer(salt),
+                info: copyBuffer(info),
+            }, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+        },
+        async encryptAesGcm(key, nonce, aad, plaintext) {
+            return new Uint8Array(await cryptoImplementation.subtle.encrypt({
+                name: "AES-GCM",
+                iv: copyBuffer(nonce),
+                additionalData: copyBuffer(aad),
+                tagLength: 128,
+            }, key, copyBuffer(plaintext)));
+        },
+        async decryptAesGcm(key, nonce, aad, ciphertext) {
+            return new Uint8Array(await cryptoImplementation.subtle.decrypt({
+                name: "AES-GCM",
+                iv: copyBuffer(nonce),
+                additionalData: copyBuffer(aad),
+                tagLength: 128,
+            }, key, copyBuffer(ciphertext)));
+        },
+        gzip(value) {
+            return transformBytes(value, new CompressionStream("gzip"));
+        },
+        gunzip(value) {
+            return transformBytes(value, new DecompressionStream("gzip"));
+        },
+    };
+}
+export function copyBuffer(bytes) {
+    return Uint8Array.from(bytes).buffer;
+}
+async function transformBytes(bytes, stream) {
+    try {
+        const input = new Blob([copyBuffer(bytes)]).stream().pipeThrough(stream);
+        return new Uint8Array(await new Response(input).arrayBuffer());
+    }
+    catch (error) {
+        throw new SyncKitError(stream instanceof DecompressionStream ? "decompression" : "crypto", stream instanceof DecompressionStream
+            ? "The encrypted snapshot contains invalid gzip data."
+            : "The snapshot could not be compressed.", { cause: error });
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/crypto/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/crypto/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAyBjD,MAAM,UAAU,sBAAsB,CACpC,uBAA+B,UAAU,CAAC,MAAM;IAEhD,IAAI,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,CAAC,MAAM;YAChB,OAAO,oBAAoB,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI;YAChD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAC1D,KAAK,EACL,UAAU,CAAC,gBAAgB,CAAC,EAC5B,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;YACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAC1C;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;aACvB,EACD,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS;YAC5C,OAAO,IAAI,UAAU,CACnB,MAAM,oBAAoB,CAAC,MAAM,CAAC,OAAO,CACvC;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;gBACrB,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC;gBAC/B,SAAS,EAAE,GAAG;aACf,EACD,GAAG,EACH,UAAU,CAAC,SAAS,CAAC,CACtB,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU;YAC7C,OAAO,IAAI,UAAU,CACnB,MAAM,oBAAoB,CAAC,MAAM,CAAC,OAAO,CACvC;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;gBACrB,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC;gBAC/B,SAAS,EAAE,GAAG;aACf,EACD,GAAG,EACH,UAAU,CAAC,UAAU,CAAC,CACvB,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK;YACR,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,KAAK;YACV,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAiB,EACjB,MAA+C;IAE/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzE,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,MAAM,YAAY,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,EAClE,MAAM,YAAY,mBAAmB;YACnC,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,uCAAuC,EAC3C,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./core/index.js";
+export * from "./crypto/index.js";
+export * from "./snapshot/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from "./core/index.js";
+export * from "./crypto/index.js";
+export * from "./snapshot/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}

package/dist/keys/web-passkey/index.d.ts

@@ -0,0 +1,34 @@
+import type { KeyProvider } from "../../core/types.js";
+import { type CryptoBackend, type SyncEnvelopeV1, type V1CompatibilityProfile, type V1KeyMetadata } from "../../crypto/index.js";
+export type WebPasskeyProviderOptions<K> = {
+    rpId: string;
+    deriveKey: (secret: Uint8Array, salt: Uint8Array) => Promise<K>;
+    crypto?: Pick<Crypto, "getRandomValues">;
+    navigator?: Navigator;
+    secureContext?: () => boolean;
+};
+export declare class WebPasskeyProvider<K> implements KeyProvider<SyncEnvelopeV1, K, V1KeyMetadata> {
+    private readonly profile;
+    private readonly options;
+    private cached;
+    private pending;
+    constructor(profile: V1CompatibilityProfile, options: WebPasskeyProviderOptions<K>);
+    create(): Promise<{
+        metadata: V1KeyMetadata;
+        key: K;
+    }>;
+    unlock(envelope: SyncEnvelopeV1): Promise<K>;
+    clear(): void;
+    supported(): boolean;
+    private unlockNow;
+    private evaluatePrf;
+    private deriveAndZero;
+    private assertSupported;
+    private crypto;
+    private navigator;
+    private tryNavigator;
+}
+export declare function createWebPasskeyProvider(profile: V1CompatibilityProfile, options: Omit<WebPasskeyProviderOptions<CryptoKey>, "deriveKey"> & {
+    backend?: CryptoBackend<CryptoKey>;
+}): WebPasskeyProvider<CryptoKey>;
+//# sourceMappingURL=index.d.ts.map

package/dist/keys/web-passkey/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/keys/web-passkey/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAe/B,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC;CAC/B,CAAC;AAEF,qBAAa,kBAAkB,CAAC,CAAC,CAC/B,YAAW,WAAW,CAAC,cAAc,EAAE,CAAC,EAAE,aAAa,CAAC;IAMtD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,OAAO,CAA0D;gBAGtD,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAGlD,MAAM,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,GAAG,EAAE,CAAC,CAAA;KAAE,CAAC;IAsDtD,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAqBlD,KAAK,IAAI,IAAI;IAKb,SAAS,IAAI,OAAO;YASN,SAAS;YAkBT,WAAW;YA6BX,aAAa;IAW3B,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,YAAY;CAMrB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,GAAG;IACjE,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;CACpC,GACA,kBAAkB,CAAC,SAAS,CAAC,CAO/B"}

package/dist/keys/web-passkey/index.js

@@ -0,0 +1,186 @@
+import { SyncKitError } from "../../core/errors.js";
+import { base64UrlToBytes, bytesToBase64Url, createWebCryptoBackend, deriveContentKey, } from "../../crypto/index.js";
+import { copyBuffer } from "../../crypto/runtime.js";
+export class WebPasskeyProvider {
+    profile;
+    options;
+    cached = null;
+    pending = null;
+    constructor(profile, options) {
+        this.profile = profile;
+        this.options = options;
+    }
+    async create() {
+        this.assertSupported();
+        const cryptoImplementation = this.crypto();
+        const prfInput = randomBytes(this.profile.prfInputBytes, cryptoImplementation);
+        const kdfSalt = randomBytes(this.profile.kdfSaltBytes, cryptoImplementation);
+        const credential = asPublicKeyCredential(await this.navigator().credentials.create({
+            publicKey: {
+                rp: {
+                    id: this.options.rpId,
+                    name: this.profile.passkey.rpName,
+                },
+                user: {
+                    id: copyBuffer(randomBytes(32, cryptoImplementation)),
+                    name: this.profile.passkey.userName,
+                    displayName: this.profile.passkey.userDisplayName,
+                },
+                challenge: copyBuffer(randomBytes(32, cryptoImplementation)),
+                pubKeyCredParams: [
+                    { type: "public-key", alg: this.profile.passkey.algorithm },
+                ],
+                authenticatorSelection: {
+                    residentKey: this.profile.passkey.residentKey,
+                    requireResidentKey: true,
+                    userVerification: this.profile.passkey.userVerification,
+                },
+                timeout: this.profile.passkey.timeoutMs,
+                attestation: "none",
+                extensions: prfExtensions(prfInput),
+            },
+        }));
+        const credentialId = new Uint8Array(credential.rawId);
+        const returnedSecret = prfSecret(credential);
+        const secret = returnedSecret ??
+            (await this.evaluatePrf(credentialId, prfInput, this.options.rpId));
+        const key = await this.deriveAndZero(secret, kdfSalt);
+        const metadata = {
+            credentialId: bytesToBase64Url(credentialId),
+            rpId: this.options.rpId,
+            prfInput,
+            kdfSalt,
+        };
+        this.cached = { identity: metadataIdentity(metadata), key };
+        return { metadata, key };
+    }
+    async unlock(envelope) {
+        if (envelope.rpId !== this.options.rpId) {
+            throw new SyncKitError("compatibility", `The snapshot belongs to ${envelope.rpId}, not ${this.options.rpId}.`);
+        }
+        const identity = envelopeIdentity(envelope);
+        if (this.cached?.identity === identity)
+            return this.cached.key;
+        if (this.cached)
+            this.clear();
+        if (this.pending?.identity === identity)
+            return this.pending.promise;
+        const promise = this.unlockNow(envelope, identity);
+        this.pending = { identity, promise };
+        try {
+            return await promise;
+        }
+        finally {
+            if (this.pending?.promise === promise)
+                this.pending = null;
+        }
+    }
+    clear() {
+        this.cached = null;
+        this.pending = null;
+    }
+    supported() {
+        const navigatorImplementation = this.tryNavigator();
+        return ((this.options.secureContext?.() ??
+            (typeof window !== "undefined" && window.isSecureContext)) &&
+            Boolean(navigatorImplementation?.credentials));
+    }
+    async unlockNow(envelope, identity) {
+        this.assertSupported();
+        const secret = await this.evaluatePrf(base64UrlToBytes(envelope.credentialId), base64UrlToBytes(envelope.prfInput), envelope.rpId);
+        const key = await this.deriveAndZero(secret, base64UrlToBytes(envelope.kdfSalt));
+        this.cached = { identity, key };
+        return key;
+    }
+    async evaluatePrf(credentialId, prfInput, rpId) {
+        const credential = asPublicKeyCredential(await this.navigator().credentials.get({
+            publicKey: {
+                challenge: copyBuffer(randomBytes(32, this.crypto())),
+                rpId,
+                allowCredentials: [
+                    { type: "public-key", id: copyBuffer(credentialId) },
+                ],
+                userVerification: this.profile.passkey.userVerification,
+                timeout: this.profile.passkey.timeoutMs,
+                extensions: prfExtensions(prfInput),
+            },
+        }));
+        const secret = prfSecret(credential);
+        if (!secret) {
+            throw new SyncKitError("key", "The passkey provider did not return a PRF secret.");
+        }
+        return secret;
+    }
+    async deriveAndZero(secret, salt) {
+        try {
+            return await this.options.deriveKey(secret, salt);
+        }
+        finally {
+            secret.fill(0);
+        }
+    }
+    assertSupported() {
+        if (!this.supported()) {
+            throw new SyncKitError("key", "Passkeys with PRF support require a secure, compatible runtime.");
+        }
+    }
+    crypto() {
+        const implementation = this.options.crypto ?? globalThis.crypto;
+        if (!implementation) {
+            throw new SyncKitError("configuration", "Crypto randomness is unavailable.");
+        }
+        return implementation;
+    }
+    navigator() {
+        const implementation = this.tryNavigator();
+        if (!implementation) {
+            throw new SyncKitError("configuration", "Credential APIs are unavailable.");
+        }
+        return implementation;
+    }
+    tryNavigator() {
+        return (this.options.navigator ??
+            (typeof navigator === "undefined" ? undefined : navigator));
+    }
+}
+export function createWebPasskeyProvider(profile, options) {
+    const backend = options.backend ?? createWebCryptoBackend();
+    return new WebPasskeyProvider(profile, {
+        ...options,
+        deriveKey: (secret, salt) => deriveContentKey(profile, secret, salt, backend),
+    });
+}
+function asPublicKeyCredential(value) {
+    if (!value ||
+        !("rawId" in value) ||
+        typeof value
+            .getClientExtensionResults !==
+            "function") {
+        throw new SyncKitError("key", "Passkey creation or selection was cancelled.");
+    }
+    return value;
+}
+function prfSecret(credential) {
+    const first = credential.getClientExtensionResults().prf
+        ?.results?.first;
+    return first ? new Uint8Array(first) : null;
+}
+function prfExtensions(prfInput) {
+    return {
+        prf: { eval: { first: copyBuffer(prfInput) } },
+    };
+}
+function randomBytes(length, cryptoImplementation) {
+    return cryptoImplementation.getRandomValues(new Uint8Array(length));
+}
+function envelopeIdentity(envelope) {
+    return [envelope.rpId, envelope.credentialId, envelope.kdfSalt].join("\n");
+}
+function metadataIdentity(metadata) {
+    return [
+        metadata.rpId,
+        metadata.credentialId,
+        bytesToBase64Url(metadata.kdfSalt),
+    ].join("\n");
+}
+//# sourceMappingURL=index.js.map

package/dist/keys/web-passkey/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/keys/web-passkey/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAsBrD,MAAM,OAAO,kBAAkB;IAOV;IACA;IALX,MAAM,GAAwC,IAAI,CAAC;IACnD,OAAO,GAAqD,IAAI,CAAC;IAEzE,YACmB,OAA+B,EAC/B,OAAqC;QADrC,YAAO,GAAP,OAAO,CAAwB;QAC/B,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,WAAW,CAC1B,IAAI,CAAC,OAAO,CAAC,aAAa,EAC1B,oBAAoB,CACrB,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CACzB,IAAI,CAAC,OAAO,CAAC,YAAY,EACzB,oBAAoB,CACrB,CAAC;QACF,MAAM,UAAU,GAAG,qBAAqB,CACtC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YACxC,SAAS,EAAE;gBACT,EAAE,EAAE;oBACF,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACrB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM;iBAClC;gBACD,IAAI,EAAE;oBACJ,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;oBACrD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ;oBACnC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe;iBAClD;gBACD,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBAC5D,gBAAgB,EAAE;oBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;iBAC5D;gBACD,sBAAsB,EAAE;oBACtB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW;oBAC7C,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;iBACxD;gBACD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;gBACvC,WAAW,EAAE,MAAM;gBACnB,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC;aACpC;SACF,CAAC,CACH,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GACV,cAAc;YACd,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG;YACf,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC;YAC5C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,QAAQ;YACR,OAAO;SACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAwB;QACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,2BAA2B,QAAQ,CAAC,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAErE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,SAAS;QACP,MAAM,uBAAuB,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO,CACL,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE;YAC7B,CAAC,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC;YAC5D,OAAO,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAC9C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,QAAwB,EACxB,QAAgB;QAEhB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EACvC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACnC,QAAQ,CAAC,IAAI,CACd,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,MAAM,EACN,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,YAAwB,EACxB,QAAoB,EACpB,IAAY;QAEZ,MAAM,UAAU,GAAG,qBAAqB,CACtC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;YACrC,SAAS,EAAE;gBACT,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,IAAI;gBACJ,gBAAgB,EAAE;oBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE;iBACrD;gBACD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;gBACvD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;gBACvC,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC;aACpC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAkB,EAClB,IAAgB;QAEhB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM;QACZ,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,SAAS;QACf,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,YAAY;QAClB,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,CAAC,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3D,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,OAA+B,EAC/B,OAEC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sBAAsB,EAAE,CAAC;IAC5D,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE;QACrC,GAAG,OAAO;QACV,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAC1B,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAwB;IAExB,IACE,CAAC,KAAK;QACN,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QACnB,OAAQ,KAA4C;aACjD,yBAAyB;YAC1B,UAAU,EACZ,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,KAA2C,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,UAAmC;IACpD,MAAM,KAAK,GAAI,UAAU,CAAC,yBAAyB,EAAgB,CAAC,GAAG;QACrE,EAAE,OAAO,EAAE,KAAK,CAAC;IACnB,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CACpB,QAAoB;IAEpB,OAAO;QACL,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,oBAAqD;IAErD,OAAO,oBAAoB,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAuB;IAC/C,OAAO;QACL,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,YAAY;QACrB,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC;KACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/snapshot/controller.d.ts

@@ -0,0 +1,23 @@
+import type { AuthorizationProvider, CloudStore, EnvelopeCrypto, KeyProvider, SyncCodec, SyncReason, SyncResult } from "../core/types.js";
+export type SnapshotSyncOptions<T, E, K, M, A> = {
+    appId: string;
+    codec: SyncCodec<T>;
+    envelopeCrypto: EnvelopeCrypto<T, E, K, M>;
+    keyProvider: KeyProvider<E, K, M>;
+    authorizationProvider: AuthorizationProvider<A>;
+    cloudStore: CloudStore<E, A>;
+    readLocal(): Promise<T> | T;
+    applyMerged(value: T): Promise<void> | void;
+    envelopeUpdatedAt(envelope: E): string;
+};
+export interface SnapshotSyncController<T> {
+    setup(): Promise<SyncResult<T>>;
+    enable(): Promise<SyncResult<T>>;
+    sync(reason: SyncReason): Promise<SyncResult<T>>;
+    reset(): Promise<SyncResult<T>>;
+    delete(): Promise<void>;
+    lock(): void;
+    operationInProgress(): boolean;
+}
+export declare function createSnapshotSync<T, E, K, M, A>(options: SnapshotSyncOptions<T, E, K, M, A>): SnapshotSyncController<T>;
+//# sourceMappingURL=controller.d.ts.map

package/dist/snapshot/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/snapshot/controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,UAAU,EACV,cAAc,EACd,WAAW,EACX,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,mBAAmB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACpB,cAAc,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,WAAW,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAChD,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,WAAW,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5C,iBAAiB,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC;CACxC,CAAC;AAEF,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,IAAI,IAAI,CAAC;IACb,mBAAmB,IAAI,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAC9C,OAAO,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAC1C,sBAAsB,CAAC,CAAC,CAAC,CAsN3B"}