@kubun/credential 0.17.3 → 0.17.4

package/lib/index.d.ts

@@ -24,3 +24,4 @@ export type { Argon2Cost, CredentialSuite, FactorInput, FactorInputs, SecretFact
 export { DEFAULT_ARGON2_COST, getSuite, isSupportedSuite, SUITE_KUBUN_CRED_1 } from './suite.js';
 export { assertValidCredentialShape } from './validate.js';
 export { CREDENTIAL_ADMINISTER_ACTION, credentialUserResource } from './vocabulary.js';
+export { wrappableDID } from './wrappable.js';

package/lib/index.js

@@ -12,3 +12,4 @@ export { RefreshingCredentialProvider } from './refreshing-credential-provider.j
 export { DEFAULT_ARGON2_COST, getSuite, isSupportedSuite, SUITE_KUBUN_CRED_1 } from './suite.js';
 export { assertValidCredentialShape } from './validate.js';
 export { CREDENTIAL_ADMINISTER_ACTION, credentialUserResource } from './vocabulary.js';
+export { wrappableDID } from './wrappable.js';

package/lib/manager.js

@@ -8,6 +8,7 @@ import { createCredentialOpSigner, selectWinningBranch } from './op.js';
 import { createPinThrottle } from './pin-throttle.js';
 import { entryProvenanceFields } from './provenance.js';
 import { getSuite, isSupportedSuite, SUITE_KUBUN_CRED_1 } from './suite.js';
+import { wrappableDID } from './wrappable.js';
 /** Kinds a user can be prompted for, as opposed to ones held as key material. */ const SECRET_FACTOR_KINDS = [
     'passphrase',
     'pin'
@@ -538,7 +539,7 @@ export function createCredentialManager(params) {
             if (createParams.factors != null && createParams.wrappings != null) {
                 throw new InvalidCredentialFactors('pass either "factors" or "wrappings", not both');
             }
-            // The headless default: one wrapping to this device's own identity. Taking
+            // The headless default: one wrapping to this device's wrappable form. Taking
             // it without a decrypting identity would mint a key whose only wrapping
             // this device can never open, so it refuses here rather than at first read.
             const explicit = createParams.wrappings ?? (createParams.factors && [
@@ -548,7 +549,7 @@ export function createCredentialManager(params) {
                 [
                     {
                         kind: 'did',
-                        recipientDID: identity.id
+                        recipientDID: wrappableDID(identity)
                     }
                 ]
             ];

package/lib/wrappable.d.ts

@@ -0,0 +1,14 @@
+import type { Identity } from '@kokuin/token';
+/**
+ * The spelling of a DID that can be encrypted to.
+ *
+ * `Identity` declares `id` alone, but a `did:peer:4` identity is a
+ * `MultiKeyIdentity` and carries `longForm` on the value. The short form
+ * resolves no document and so no agreement key — `deriveSharedSecret` refuses it
+ * outright, which is the good failure. The bad one is a key derived from the
+ * wrong branch, which throws nothing and yields ciphertext nobody can open.
+ *
+ * For `did:key` the two forms are the same string, so this is the identity's own
+ * `id`.
+ */
+export declare function wrappableDID(identity: Identity): string;

package/lib/wrappable.js

@@ -0,0 +1,15 @@
+/**
+ * The spelling of a DID that can be encrypted to.
+ *
+ * `Identity` declares `id` alone, but a `did:peer:4` identity is a
+ * `MultiKeyIdentity` and carries `longForm` on the value. The short form
+ * resolves no document and so no agreement key — `deriveSharedSecret` refuses it
+ * outright, which is the good failure. The bad one is a key derived from the
+ * wrong branch, which throws nothing and yields ciphertext nobody can open.
+ *
+ * For `did:key` the two forms are the same string, so this is the identity's own
+ * `id`.
+ */ export function wrappableDID(identity) {
+    const longForm = identity.longForm;
+    return typeof longForm === 'string' ? longForm : identity.id;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/credential",
-  "version": "0.17.3",
+  "version": "0.17.4",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,