@kubun/credential 0.17.2 → 0.17.4

package/lib/index.d.ts

@@ -24,3 +24,4 @@ export type { Argon2Cost, CredentialSuite, FactorInput, FactorInputs, SecretFact
 export { DEFAULT_ARGON2_COST, getSuite, isSupportedSuite, SUITE_KUBUN_CRED_1 } from './suite.js';
 export { assertValidCredentialShape } from './validate.js';
 export { CREDENTIAL_ADMINISTER_ACTION, credentialUserResource } from './vocabulary.js';
+export { wrappableDID } from './wrappable.js';

package/lib/index.js

@@ -12,3 +12,4 @@ export { RefreshingCredentialProvider } from './refreshing-credential-provider.j
 export { DEFAULT_ARGON2_COST, getSuite, isSupportedSuite, SUITE_KUBUN_CRED_1 } from './suite.js';
 export { assertValidCredentialShape } from './validate.js';
 export { CREDENTIAL_ADMINISTER_ACTION, credentialUserResource } from './vocabulary.js';
+export { wrappableDID } from './wrappable.js';

package/lib/manager.js

@@ -8,6 +8,7 @@ import { createCredentialOpSigner, selectWinningBranch } from './op.js';
 import { createPinThrottle } from './pin-throttle.js';
 import { entryProvenanceFields } from './provenance.js';
 import { getSuite, isSupportedSuite, SUITE_KUBUN_CRED_1 } from './suite.js';
+import { wrappableDID } from './wrappable.js';
 /** Kinds a user can be prompted for, as opposed to ones held as key material. */ const SECRET_FACTOR_KINDS = [
     'passphrase',
     'pin'
@@ -538,7 +539,7 @@ export function createCredentialManager(params) {
             if (createParams.factors != null && createParams.wrappings != null) {
                 throw new InvalidCredentialFactors('pass either "factors" or "wrappings", not both');
             }
-            // The headless default: one wrapping to this device's own identity. Taking
+            // The headless default: one wrapping to this device's wrappable form. Taking
             // it without a decrypting identity would mint a key whose only wrapping
             // this device can never open, so it refuses here rather than at first read.
             const explicit = createParams.wrappings ?? (createParams.factors && [
@@ -548,7 +549,7 @@ export function createCredentialManager(params) {
                 [
                     {
                         kind: 'did',
-                        recipientDID: identity.id
+                        recipientDID: wrappableDID(identity)
                     }
                 ]
             ];

package/lib/provider.js

@@ -15,6 +15,9 @@ export function serializeCredential(credential) {
     if (credential.metadata != null) {
         serialized.metadata = credential.metadata;
     }
+    if (credential.providerAccount != null) {
+        serialized.providerAccount = credential.providerAccount;
+    }
     return JSON.stringify(serialized);
 }
 export function deserializeCredential(raw) {
@@ -36,6 +39,9 @@ export function deserializeCredential(raw) {
     if (parsed.metadata != null) {
         credential.metadata = parsed.metadata;
     }
+    if (parsed.providerAccount != null) {
+        credential.providerAccount = parsed.providerAccount;
+    }
     return credential;
 }
 export class DBCredentialProvider {

package/lib/refreshing-credential-provider.js

@@ -146,7 +146,8 @@ export class RefreshingCredentialProvider {
             expiresAt: tokenData.expires_in != null ? new Date(Date.now() + tokenData.expires_in * 1000) : undefined,
             scopes: tokenData.scope?.split(' ') ?? credential.scopes,
             accountLabel: credential.accountLabel,
-            metadata: credential.metadata
+            metadata: credential.metadata,
+            providerAccount: credential.providerAccount
         };
         let write;
         try {

package/lib/validate.js

@@ -27,4 +27,10 @@ export function assertValidCredentialShape(value) {
     if (c.metadata != null && (typeof c.metadata !== 'object' || Array.isArray(c.metadata))) {
         throw new CredentialInvalidEntry('metadata must be an object when present');
     }
+    if (c.providerAccount != null) {
+        const pa = c.providerAccount;
+        if (typeof pa !== 'object' || Array.isArray(c.providerAccount) || typeof pa.iss !== 'string' || pa.iss.length === 0 || typeof pa.sub !== 'string' || pa.sub.length === 0) {
+            throw new CredentialInvalidEntry('providerAccount must have non-empty string iss and sub when present');
+        }
+    }
 }

package/lib/wrappable.d.ts

@@ -0,0 +1,14 @@
+import type { Identity } from '@kokuin/token';
+/**
+ * The spelling of a DID that can be encrypted to.
+ *
+ * `Identity` declares `id` alone, but a `did:peer:4` identity is a
+ * `MultiKeyIdentity` and carries `longForm` on the value. The short form
+ * resolves no document and so no agreement key — `deriveSharedSecret` refuses it
+ * outright, which is the good failure. The bad one is a key derived from the
+ * wrong branch, which throws nothing and yields ciphertext nobody can open.
+ *
+ * For `did:key` the two forms are the same string, so this is the identity's own
+ * `id`.
+ */
+export declare function wrappableDID(identity: Identity): string;

package/lib/wrappable.js

@@ -0,0 +1,15 @@
+/**
+ * The spelling of a DID that can be encrypted to.
+ *
+ * `Identity` declares `id` alone, but a `did:peer:4` identity is a
+ * `MultiKeyIdentity` and carries `longForm` on the value. The short form
+ * resolves no document and so no agreement key — `deriveSharedSecret` refuses it
+ * outright, which is the good failure. The bad one is a key derived from the
+ * wrong branch, which throws nothing and yields ciphertext nobody can open.
+ *
+ * For `did:key` the two forms are the same string, so this is the identity's own
+ * `id`.
+ */ export function wrappableDID(identity) {
+    const longForm = identity.longForm;
+    return typeof longForm === 'string' ? longForm : identity.id;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/credential",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -16,9 +16,9 @@
   ],
   "dependencies": {
     "@kokuin/jwe": "^0.1.0",
-    "@kokuin/oauth": "^0.1.0",
+    "@kokuin/oauth": "^0.1.1",
     "@kokuin/token": "^0.5.0",
-    "@kubun/credential-types": "^0.17.1",
+    "@kubun/credential-types": "^0.17.2",
     "@kubun/db": "^0.17.0",
     "@kubun/hlc": "^0.17.0",
     "@kubun/id": "^0.17.0",