@laceio/sdk 0.1.1-canary.2 → 0.1.1

package/dist/key-source-5oUBFiC7.cjs

@@ -1,583 +0,0 @@
-const require_codecs = require("./codecs-Cswkg7Tm.cjs");
-const require_english = require("./english-Byb9M0E_.cjs");
-const require_esm = require("./esm-LZuaZjMf.cjs");
-//#region ../../packages/lib/crypto/src/value-objects/entropy-hex.vo.ts
-const ENTROPY_BYTE_LENGTH = 32;
-const ENTROPY_HEX_LENGTH = ENTROPY_BYTE_LENGTH * 2;
-const HEX_PATTERN = /^[0-9a-fA-F]+$/;
-/**
-* Types 32 bytes of entropy, as 64 hex characters, for `Mnemonic.deriveFrom`.
-* Throws when the value has another length or is not hex.
-*/
-const EntropyHex = (value) => {
-	if (value.length !== ENTROPY_HEX_LENGTH) throw new Error(`EntropyHex must be ${ENTROPY_BYTE_LENGTH} bytes (${ENTROPY_HEX_LENGTH} hex characters), got ${value.length}`);
-	if (!HEX_PATTERN.test(value)) throw new Error("EntropyHex must be a hex-encoded string");
-	return value;
-};
-//#endregion
-//#region ../../packages/lib/crypto/node_modules/@scure/bip39/esm/index.js
-/**
-* Audited & minimal JS implementation of
-* [BIP39 mnemonic phrases](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
-* @module
-* @example
-```js
-import * as bip39 from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english';
-const mn = bip39.generateMnemonic(wordlist);
-console.log(mn);
-const ent = bip39.mnemonicToEntropy(mn, wordlist)
-bip39.entropyToMnemonic(ent, wordlist);
-bip39.validateMnemonic(mn, wordlist);
-await bip39.mnemonicToSeed(mn, 'password');
-bip39.mnemonicToSeedSync(mn, 'password');
-
-// Wordlists
-import { wordlist as czech } from '@scure/bip39/wordlists/czech';
-import { wordlist as english } from '@scure/bip39/wordlists/english';
-import { wordlist as french } from '@scure/bip39/wordlists/french';
-import { wordlist as italian } from '@scure/bip39/wordlists/italian';
-import { wordlist as japanese } from '@scure/bip39/wordlists/japanese';
-import { wordlist as korean } from '@scure/bip39/wordlists/korean';
-import { wordlist as portuguese } from '@scure/bip39/wordlists/portuguese';
-import { wordlist as simplifiedChinese } from '@scure/bip39/wordlists/simplified-chinese';
-import { wordlist as spanish } from '@scure/bip39/wordlists/spanish';
-import { wordlist as traditionalChinese } from '@scure/bip39/wordlists/traditional-chinese';
-```
-*/
-/*! scure-bip39 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) */
-const isJapanese = (wordlist) => wordlist[0] === "あいこくしん";
-function nfkd(str) {
-	if (typeof str !== "string") throw new TypeError("invalid mnemonic type: " + typeof str);
-	return str.normalize("NFKD");
-}
-function normalize(str) {
-	const norm = nfkd(str);
-	const words = norm.split(" ");
-	if (![
-		12,
-		15,
-		18,
-		21,
-		24
-	].includes(words.length)) throw new Error("Invalid mnemonic");
-	return {
-		nfkd: norm,
-		words
-	};
-}
-function aentropy(ent) {
-	require_codecs.abytes(ent, 16, 20, 24, 28, 32);
-}
-const calcChecksum = (entropy) => {
-	const bitsLeft = 8 - entropy.length / 4;
-	return new Uint8Array([require_codecs.sha256(entropy)[0] >> bitsLeft << bitsLeft]);
-};
-function getCoder(wordlist) {
-	if (!Array.isArray(wordlist) || wordlist.length !== 2048 || typeof wordlist[0] !== "string") throw new Error("Wordlist: expected array of 2048 strings");
-	wordlist.forEach((i) => {
-		if (typeof i !== "string") throw new Error("wordlist: non-string element: " + i);
-	});
-	return require_esm.utils.chain(require_esm.utils.checksum(1, calcChecksum), require_esm.utils.radix2(11, true), require_esm.utils.alphabet(wordlist));
-}
-/**
-* Reversible: Converts raw entropy in form of byte array to mnemonic string.
-* @param entropy byte array
-* @param wordlist imported wordlist for specific language
-* @returns 12-24 words
-* @example
-* const ent = new Uint8Array([
-*   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f,
-*   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f
-* ]);
-* entropyToMnemonic(ent, wordlist);
-* // 'legal winner thank year wave sausage worth useful legal winner thank yellow'
-*/
-function entropyToMnemonic(entropy, wordlist) {
-	aentropy(entropy);
-	return getCoder(wordlist).encode(entropy).join(isJapanese(wordlist) ? "　" : " ");
-}
-const psalt = (passphrase) => nfkd("mnemonic" + passphrase);
-/**
-* Irreversible: Uses KDF to derive 64 bytes of key data from mnemonic + optional password.
-* @param mnemonic 12-24 words
-* @param passphrase string that will additionally protect the key
-* @returns 64 bytes of key data
-* @example
-* const mnem = 'legal winner thank year wave sausage worth useful legal winner thank yellow';
-* mnemonicToSeedSync(mnem, 'password');
-* // new Uint8Array([...64 bytes])
-*/
-function mnemonicToSeedSync(mnemonic, passphrase = "") {
-	return require_codecs.pbkdf2(require_codecs.sha512, normalize(mnemonic).nfkd, psalt(passphrase), {
-		c: 2048,
-		dkLen: 64
-	});
-}
-//#endregion
-//#region ../../packages/lib/crypto/src/value-objects/mnemonic.vo.ts
-/**
-* Types a list of words as a BIP-39 mnemonic; it checks nothing.
-* `Mnemonic.deriveFrom(entropy)` derives 24 words from 32 bytes of entropy,
-* and `Mnemonic.toSeed(words)` gives their BIP-39 seed.
-*/
-const Mnemonic = (words) => words;
-/**
-* Derives a 24-word BIP39 mnemonic from 32 bytes of hex-encoded entropy.
-* Uses HKDF for domain separation, so the raw entropy is never used
-* directly as seed material. The entropy bytes and the expanded key are zeroed once the
-* words exist; the words themselves are strings and cannot be.
-*/
-Mnemonic.deriveFrom = (entropyHex) => {
-	const rawKey = require_codecs.hexToBytes(entropyHex);
-	const derived = require_codecs.hkdf(require_codecs.sha256, rawKey, "lace", "wallet-seed", 32);
-	try {
-		return Mnemonic(entropyToMnemonic(derived, require_english.wordlist).split(" "));
-	} finally {
-		rawKey.fill(0);
-		derived.fill(0);
-	}
-};
-/**
-* The 64-byte BIP39 seed of the mnemonic with an empty passphrase: the seed
-* that wallets deriving their keys from the BIP39 seed consume, so secrets
-* derived from it match what such a wallet built from the same words would
-* derive. The caller owns the bytes and zeroes them after use.
-*/
-Mnemonic.toSeed = (words) => mnemonicToSeedSync(words.join(" "));
-//#endregion
-//#region ../../packages/lib/passkey/src/constants.ts
-/** The label of the first PRF salt, whose output is the device secret. */
-const PRF_SALT_AUTHORISER_LABEL = "lace-passport/prf/authoriser/v1";
-/** The label of the second PRF salt, whose output is the root every named derivation starts from. */
-const PRF_SALT_ROOT_LABEL = "lace/prf/root/v1";
-/** The HKDF info label under which the record sealing key derives from the root. */
-const HKDF_RECORD_KEY_INFO = "lace-passport/hkdf/record-key/v1";
-/** The HKDF info label under which the wallet entropy, and from it the recovery words, derives from the root. */
-const HKDF_WALLET_ENTROPY_INFO = "lace/hkdf/wallet-entropy/v1";
-//#endregion
-//#region ../../packages/lib/passkey/src/errors.ts
-/** The user dismissed a WebAuthn ceremony. */
-var PasskeyCeremonyCancelledError = class extends Error {
-	code = "ceremony-cancelled";
-	constructor() {
-		super("The passkey ceremony was cancelled.");
-		this.name = "PasskeyCeremonyCancelledError";
-	}
-};
-/** The authenticator did not supply both PRF outputs. */
-var PasskeyPrfUnsupportedError = class extends Error {
-	code = "prf-unsupported";
-	constructor() {
-		super("The platform authenticator does not support the PRF extension.");
-		this.name = "PasskeyPrfUnsupportedError";
-	}
-};
-/** The selected credential differs from the imported wallet credential. */
-var PasskeyCredentialMismatchError = class extends Error {
-	code = "credential-mismatch";
-	constructor() {
-		super("The selected passkey does not match the wallet credential.");
-		this.name = "PasskeyCredentialMismatchError";
-	}
-};
-/**
-* The browser refused to open the signer popup (`popup-blocked`); it must be
-* opened inside a user gesture.
-*/
-var SignerPopupBlockedError = class extends Error {
-	code = "popup-blocked";
-	constructor() {
-		super("The browser blocked the signer popup.");
-		this.name = "SignerPopupBlockedError";
-	}
-};
-/**
-* The signer answered a request with a failure; `code` is the code it
-* reported, such as `ceremony-cancelled` when the user rejects the request
-* or `malformed-request` when the signer cannot describe it for consent,
-* and `details` the values it declared alongside, when any. Both come from
-* the signer page, so a reader validates `details` before acting on it.
-*/
-var RemoteSignerError = class extends Error {
-	code;
-	details;
-	constructor(code, message, details) {
-		super(message);
-		this.code = code;
-		this.details = details;
-		this.name = "RemoteSignerError";
-	}
-};
-/**
-* The signer popup closed, as when the user closes the window, while requests
-* were still pending (`ceremony-cancelled`).
-*/
-var SignerClosedError = class extends Error {
-	code = "ceremony-cancelled";
-	constructor() {
-		super("The signer popup was closed.");
-		this.name = "SignerClosedError";
-	}
-};
-//#endregion
-//#region ../../packages/lib/passkey/src/ceremony.ts
-const DEFAULT_RP_NAME = "Lace";
-const CHALLENGE_LENGTH = 32;
-const USER_ID_LENGTH = 16;
-const WALLET_ENTROPY_LENGTH = 32;
-const MAX_CREDENTIAL_ID_LENGTH = 1023;
-const ES256 = -7;
-const RS256 = -257;
-const RECIPE_VERSION = "v1";
-const encodeId = (id) => btoa(String.fromCharCode(...new Uint8Array(id))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-const decodeId = (id) => {
-	if (!/^[A-Za-z0-9_-]+$/.test(id) || id.length > Math.ceil(MAX_CREDENTIAL_ID_LENGTH * 4 / 3)) throw new Error("Invalid passkey credential ID.");
-	let bytes;
-	try {
-		bytes = Uint8Array.from(atob(id.replaceAll("-", "+").replaceAll("_", "/")), (character) => character.charCodeAt(0));
-	} catch {
-		throw new Error("Invalid passkey credential ID.");
-	}
-	if (bytes.length > MAX_CREDENTIAL_ID_LENGTH || encodeId(bytes.buffer) !== id) throw new Error("Invalid passkey credential ID.");
-	return bytes.buffer;
-};
-const utf8 = (value) => new TextEncoder().encode(value);
-/** PRF salts are public domain separators: SHA-256 of their label. */
-const prfSalt = async (label) => new Uint8Array(await crypto.subtle.digest("SHA-256", utf8(label)));
-const isCancellation = (error) => error instanceof Object && "name" in error && error.name === "NotAllowedError";
-const toBytes = (source) => source instanceof ArrayBuffer ? new Uint8Array(source) : new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
-/** Zeroes every PRF output of one assertion. */
-const zeroOutputs = (outputs) => {
-	outputs.device?.fill(0);
-	outputs.root.fill(0);
-};
-/**
-* The wallet entropy is HKDF-SHA256 over the root with an empty salt and a
-* fixed info label. The expanded bytes are zeroed once encoded; the hex
-* string is what leaves this function, and only for the caller's use.
-*/
-const deriveWalletEntropy = (root) => {
-	const raw = require_codecs.hkdf(require_codecs.sha256, root, void 0, HKDF_WALLET_ENTROPY_INFO, WALLET_ENTROPY_LENGTH);
-	try {
-		return EntropyHex(require_codecs.bytesToHex(raw));
-	} finally {
-		raw.fill(0);
-	}
-};
-/**
-* Runs a fresh assertion and confines the words its root derives to `consume`.
-* The outputs are zeroed and the credential released on success and failure
-* alike; the credential is committed only when `consume` succeeds.
-*/
-const withCeremonyMnemonic = async (ceremony, consume) => {
-	const { outputs, credential } = await ceremony();
-	try {
-		const result = await consume(Mnemonic.deriveFrom(deriveWalletEntropy(outputs.root)));
-		credential.commit();
-		return result;
-	} finally {
-		credential.release();
-		zeroOutputs(outputs);
-	}
-};
-/**
-* The credential handling every key source shares: enrolment, the pinned
-* credential, and assertions evaluating the PRF at the root salt and, when
-* `deviceSaltLabel` is given, at that salt first. The root output is the
-* same either way, so every key source over one passkey derives the same
-* words.
-*
-* Ceremonies pin `allowCredentials` to the credential id captured from
-* passkey creation or a previous assertion; before one is known the key
-* is omitted, which is how WebAuthn asks for a discoverable credential,
-* so the browser offers any resident passkey for the origin. A dismissed
-* prompt maps to PasskeyCeremonyCancelledError and an authenticator without
-* PRF support to PasskeyPrfUnsupportedError.
-*
-* Enrolment asks for a platform authenticator, so the passkey is created
-* on the device the user is on and syncs through their platform
-* credential manager. Without that constraint a browser with no passkey
-* for the origin yet offers to scan a QR code and enrol another device
-* instead.
-*/
-const createPasskeyCeremonies = ({ credentials, rpName = DEFAULT_RP_NAME, rpId = globalThis.location?.hostname, credentialId: importedCredentialId }, deviceSaltLabel) => {
-	if (!rpId) throw new Error("A passkey RP ID is required.");
-	const container = credentials ?? navigator.credentials;
-	let credentialPin = importedCredentialId !== void 0 ? {
-		credentialId: decodeId(importedCredentialId),
-		committed: true,
-		holders: 0
-	} : void 0;
-	const prfEval = async () => {
-		const rootSalt = await prfSalt(PRF_SALT_ROOT_LABEL);
-		return deviceSaltLabel === void 0 ? { first: rootSalt } : {
-			first: await prfSalt(deviceSaltLabel),
-			second: rootSalt
-		};
-	};
-	const toOutputs = (results) => {
-		if (deviceSaltLabel === void 0) {
-			if (!results?.first) throw new PasskeyPrfUnsupportedError();
-			return { root: toBytes(results.first) };
-		}
-		if (!results?.first || !results.second) throw new PasskeyPrfUnsupportedError();
-		return {
-			device: toBytes(results.first),
-			root: toBytes(results.second)
-		};
-	};
-	const credentialRef = () => credentialPin ? {
-		credentialId: encodeId(credentialPin.credentialId),
-		rpId,
-		recipeVersion: RECIPE_VERSION
-	} : void 0;
-	const releaseCredentialPin = (pin) => {
-		pin.holders -= 1;
-		if (!pin.committed && pin.holders === 0 && credentialPin === pin) credentialPin = void 0;
-	};
-	const createCredential = async () => {
-		const evaluation = await prfEval();
-		let created;
-		try {
-			created = await container.create({ publicKey: {
-				rp: {
-					name: rpName,
-					id: rpId
-				},
-				user: {
-					id: crypto.getRandomValues(new Uint8Array(USER_ID_LENGTH)),
-					name: rpName,
-					displayName: rpName
-				},
-				challenge: crypto.getRandomValues(new Uint8Array(CHALLENGE_LENGTH)),
-				pubKeyCredParams: [{
-					type: "public-key",
-					alg: ES256
-				}, {
-					type: "public-key",
-					alg: RS256
-				}],
-				authenticatorSelection: {
-					authenticatorAttachment: "platform",
-					residentKey: "required",
-					userVerification: "required"
-				},
-				extensions: { prf: { eval: evaluation } }
-			} });
-		} catch (error) {
-			if (isCancellation(error)) throw new PasskeyCeremonyCancelledError();
-			throw error;
-		}
-		if (!created) throw new PasskeyCeremonyCancelledError();
-		const credential = created;
-		if (!credential.getClientExtensionResults().prf?.enabled) throw new PasskeyPrfUnsupportedError();
-		credentialPin = {
-			credentialId: credential.rawId,
-			committed: true,
-			holders: 0
-		};
-		return credentialRef();
-	};
-	let enrolment;
-	const ensureCredential = async () => {
-		const existing = credentialRef();
-		if (existing) return existing;
-		enrolment ??= createCredential().finally(() => {
-			enrolment = void 0;
-		});
-		return enrolment;
-	};
-	const ceremony = async () => {
-		const evaluation = await prfEval();
-		const expectedPin = credentialPin;
-		const expectedCredentialId = expectedPin?.credentialId;
-		if (expectedPin) expectedPin.holders += 1;
-		let asserted;
-		try {
-			asserted = await container.get({ publicKey: {
-				challenge: crypto.getRandomValues(new Uint8Array(CHALLENGE_LENGTH)),
-				rpId,
-				...expectedCredentialId && { allowCredentials: [{
-					type: "public-key",
-					id: expectedCredentialId
-				}] },
-				userVerification: "required",
-				extensions: { prf: { eval: evaluation } }
-			} });
-		} catch (error) {
-			if (expectedPin) releaseCredentialPin(expectedPin);
-			if (isCancellation(error)) throw new PasskeyCeremonyCancelledError();
-			throw error;
-		}
-		if (!asserted) {
-			if (expectedPin) releaseCredentialPin(expectedPin);
-			throw new PasskeyCeremonyCancelledError();
-		}
-		let heldPin = expectedPin;
-		try {
-			const credential = asserted;
-			if (expectedCredentialId && encodeId(credential.rawId) !== encodeId(expectedCredentialId)) throw new PasskeyCredentialMismatchError();
-			const outputs = toOutputs(credential.getClientExtensionResults().prf?.results);
-			if (!heldPin) {
-				const currentPin = credentialPin;
-				if (currentPin && encodeId(credential.rawId) !== encodeId(currentPin.credentialId)) throw new PasskeyCredentialMismatchError();
-				if (currentPin) {
-					currentPin.holders += 1;
-					heldPin = currentPin;
-				} else {
-					heldPin = {
-						credentialId: credential.rawId,
-						committed: false,
-						holders: 1
-					};
-					credentialPin = heldPin;
-				}
-			}
-			const selectedPin = heldPin;
-			let isReleased = false;
-			return {
-				outputs,
-				credential: {
-					commit: () => {
-						selectedPin.committed = true;
-					},
-					release: () => {
-						if (isReleased) return;
-						isReleased = true;
-						releaseCredentialPin(selectedPin);
-					}
-				}
-			};
-		} catch (error) {
-			if (heldPin) releaseCredentialPin(heldPin);
-			throw error;
-		}
-	};
-	return {
-		ensureCredential,
-		credentialRef,
-		ceremony
-	};
-};
-//#endregion
-//#region ../../packages/lib/passkey/src/key-source.ts
-/**
-* Creates the key source of one passkey: it runs the WebAuthn PRF ceremony
-* and derives the passkey's wallet words, handing them only to the callback
-* of `withPasskeyMnemonic`.
-*
-* @remarks
-* A {@link PasskeyKeySource} over the WebAuthn PRF extension. Each call to
-* `withPasskeyMnemonic` is its own assertion: the PRF output is the root,
-* the words derive from it through HKDF and BIP-39, and the root is zeroed
-* once the callback settles, on success and failure alike. Nothing is kept
-* between calls except the credential id.
-*
-* Ceremonies pin `allowCredentials` to the credential id captured from
-* passkey creation or a previous assertion; before one is known the key is
-* omitted, so the browser offers any resident passkey for the origin. A
-* dismissed prompt rejects with a `ceremony-cancelled` error and an
-* authenticator without PRF support with a `prf-unsupported` one.
-*
-* Enrolment asks for a platform authenticator, so the passkey is created on
-* the device the user is on and syncs through their platform credential
-* manager. Without that constraint a browser with no passkey for the origin
-* yet offers to scan a QR code and enrol another device instead.
-*
-* @param props - The relying party, a saved credential ID and the WebAuthn
-*   entry point, each optional.
-*/
-const createPasskeyKeySource = (props = {}) => {
-	const { ensureCredential, credentialRef, ceremony } = createPasskeyCeremonies(props);
-	return {
-		ensureCredential,
-		credentialRef,
-		withPasskeyMnemonic: async (use) => withCeremonyMnemonic(ceremony, use)
-	};
-};
-//#endregion
-Object.defineProperty(exports, "EntropyHex", {
-	enumerable: true,
-	get: function() {
-		return EntropyHex;
-	}
-});
-Object.defineProperty(exports, "HKDF_RECORD_KEY_INFO", {
-	enumerable: true,
-	get: function() {
-		return HKDF_RECORD_KEY_INFO;
-	}
-});
-Object.defineProperty(exports, "Mnemonic", {
-	enumerable: true,
-	get: function() {
-		return Mnemonic;
-	}
-});
-Object.defineProperty(exports, "PRF_SALT_AUTHORISER_LABEL", {
-	enumerable: true,
-	get: function() {
-		return PRF_SALT_AUTHORISER_LABEL;
-	}
-});
-Object.defineProperty(exports, "PasskeyCeremonyCancelledError", {
-	enumerable: true,
-	get: function() {
-		return PasskeyCeremonyCancelledError;
-	}
-});
-Object.defineProperty(exports, "PasskeyPrfUnsupportedError", {
-	enumerable: true,
-	get: function() {
-		return PasskeyPrfUnsupportedError;
-	}
-});
-Object.defineProperty(exports, "RemoteSignerError", {
-	enumerable: true,
-	get: function() {
-		return RemoteSignerError;
-	}
-});
-Object.defineProperty(exports, "SignerClosedError", {
-	enumerable: true,
-	get: function() {
-		return SignerClosedError;
-	}
-});
-Object.defineProperty(exports, "SignerPopupBlockedError", {
-	enumerable: true,
-	get: function() {
-		return SignerPopupBlockedError;
-	}
-});
-Object.defineProperty(exports, "createPasskeyCeremonies", {
-	enumerable: true,
-	get: function() {
-		return createPasskeyCeremonies;
-	}
-});
-Object.defineProperty(exports, "createPasskeyKeySource", {
-	enumerable: true,
-	get: function() {
-		return createPasskeyKeySource;
-	}
-});
-Object.defineProperty(exports, "deriveWalletEntropy", {
-	enumerable: true,
-	get: function() {
-		return deriveWalletEntropy;
-	}
-});
-Object.defineProperty(exports, "withCeremonyMnemonic", {
-	enumerable: true,
-	get: function() {
-		return withCeremonyMnemonic;
-	}
-});
-Object.defineProperty(exports, "zeroOutputs", {
-	enumerable: true,
-	get: function() {
-		return zeroOutputs;
-	}
-});