@learncard/sss-key-manager 0.1.14 → 0.1.16

package/README.md

@@ -8,19 +8,19 @@ This package provides a secure, self-hosted alternative to Web3Auth Single Facto
 
 ## Features
 
-- **Key Splitting**: Split ed25519 private keys into 3 shares with 2-of-3 threshold
-- **Device Storage**: Encrypted local storage using AES-GCM with IndexedDB
-- **Server Storage**: Encrypted auth share stored on server with envelope encryption
-- **Recovery Methods**:
-  - Password-based (Argon2id KDF)
-  - Passkey/WebAuthn PRF (coming soon)
-  - Backup file export/import
-- **Migration**: Seamless migration from Web3Auth SFA
+-   **Key Splitting**: Split ed25519 private keys into 3 shares with 2-of-3 threshold
+-   **Device Storage**: Encrypted local storage using AES-GCM with IndexedDB
+-   **Server Storage**: Encrypted auth share stored on server with envelope encryption
+-   **Recovery Methods**:
+    -   Password-based (Argon2id KDF)
+    -   Passkey/WebAuthn PRF (coming soon)
+    -   Backup file export/import
+-   **Migration**: Seamless migration from Web3Auth SFA
 
 ## Installation
 
 ```bash
-pnpm add @learncard/sss-key-manager
+bun add @learncard/sss-key-manager
 ```
 
 ## Usage
@@ -115,19 +115,19 @@ const privateKey = await keyManager.recover({
 
 ## Security Model
 
-- **Device Share**: Encrypted with non-extractable AES-GCM key stored in IndexedDB
-- **Auth Share**: Server-side envelope encryption (DEK + KMS-encrypted DEK)
-- **Recovery Share**: Password-based uses Argon2id KDF with secure parameters
-- **Threshold**: Any 2 of 3 shares can reconstruct the key
+-   **Device Share**: Encrypted with non-extractable AES-GCM key stored in IndexedDB
+-   **Auth Share**: Server-side envelope encryption (DEK + KMS-encrypted DEK)
+-   **Recovery Share**: Password-based uses Argon2id KDF with secure parameters
+-   **Threshold**: Any 2 of 3 shares can reconstruct the key
 
 ## Auth Provider Support
 
 The package is designed to work with any authentication provider:
 
-- Firebase Authentication (default for production)
-- SuperTokens (recommended for self-hosting/local dev)
-- Keycloak (enterprise SSO)
-- Any OIDC-compliant provider
+-   Firebase Authentication (default for production)
+-   SuperTokens (recommended for self-hosting/local dev)
+-   Keycloak (enterprise SSO)
+-   Any OIDC-compliant provider
 
 ## API Reference
 

package/dist/sss-key-manager.cjs.development.js

@@ -7,11 +7,7 @@ var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __commonJS = (cb, mod) => function __require() {
-  try {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-  } catch (e) {
-    throw mod = 0, e;
-  }
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -17356,7 +17352,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       includePersonalData: external_exports.boolean().optional().default(false),
       format: external_exports.enum(["prompt", "structured"]).optional().default("prompt"),
       instructions: external_exports.string().optional(),
-      detailLevel: external_exports.enum(["compact", "expanded"]).optional().default("compact")
+      detailLevel: external_exports.enum(["compact", "expanded"]).optional().default("compact"),
+      waitForSync: external_exports.boolean().optional().default(false)
     });
     var SummaryCredentialKeywordValidator = external_exports.object({
       occupations: external_exports.array(external_exports.string()).nullable(),
@@ -19100,7 +19097,15 @@ function createSSSStrategy(config) {
       };
     },
     async storeAuthShare(token, providerType, authShare, primaryDid, didAuthVp) {
-      const { shareVersion } = await putAuthShare(serverUrl, token, providerType, authShare, primaryDid, didAuthVp, tenantId);
+      const { shareVersion } = await putAuthShare(
+        serverUrl,
+        token,
+        providerType,
+        authShare,
+        primaryDid,
+        didAuthVp,
+        tenantId
+      );
       await storage.storeShareVersion(shareVersion, activeStorageId);
       lastShareVersion = shareVersion;
     },
@@ -19193,7 +19198,14 @@ function createSSSStrategy(config) {
         throw new Error("No auth share found on server");
       }
       const authShareStr = typeof serverData.authShare === "object" ? serverData.authShare.encryptedData : serverData.authShare;
-      const privateKey = await reconstructFromShares([recoveryShare, authShareStr]);
+      let privateKey;
+      try {
+        privateKey = await reconstructFromShares([recoveryShare, authShareStr]);
+      } catch {
+        throw new Error(
+          "Recovery produced an incorrect key. The recovery key may be outdated. Please try a different recovery method."
+        );
+      }
       const primaryDid = serverData.primaryDid || "";
       if (primaryDid && didFromPrivateKey) {
         const derivedDid = await didFromPrivateKey(privateKey);
@@ -19224,13 +19236,44 @@ function createSSSStrategy(config) {
       const { shares } = await splitAndVerify(privateKey);
       lastEmailShare = shares.emailShare;
       await storage.storeDeviceShare(shares.deviceShare, activeStorageId);
-      const serverData = await fetchAuthShareRaw(serverUrl, token, providerType, void 0, tenantId);
+      const serverData = await fetchAuthShareRaw(
+        serverUrl,
+        token,
+        providerType,
+        void 0,
+        tenantId
+      );
       const primaryDid = serverData?.primaryDid || "";
-      const { shareVersion } = await putAuthShare(serverUrl, token, providerType, shares.authShare, primaryDid, vpJwt, tenantId);
+      const { shareVersion } = await putAuthShare(
+        serverUrl,
+        token,
+        providerType,
+        shares.authShare,
+        primaryDid,
+        vpJwt,
+        tenantId
+      );
       await storage.storeShareVersion(shareVersion, activeStorageId);
       if (enableEmailBackupShare && input.method !== "email" && lastEmailShare) {
-        const resend = hasRecoveryEmail ? sendEmailShareToRecoveryEmail(serverUrl, token, providerType, lastEmailShare, shareVersion, tenantId) : authUser?.email ? sendEmailBackupShare(serverUrl, token, providerType, lastEmailShare, authUser.email, shareVersion, tenantId) : Promise.resolve();
-        resend.catch((e) => console.warn("Email backup share re-send failed (non-fatal):", e));
+        const resend = hasRecoveryEmail ? sendEmailShareToRecoveryEmail(
+          serverUrl,
+          token,
+          providerType,
+          lastEmailShare,
+          shareVersion,
+          tenantId
+        ) : authUser?.email ? sendEmailBackupShare(
+          serverUrl,
+          token,
+          providerType,
+          lastEmailShare,
+          authUser.email,
+          shareVersion,
+          tenantId
+        ) : Promise.resolve();
+        resend.catch(
+          (e) => console.warn("Email backup share re-send failed (non-fatal):", e)
+        );
         lastEmailShare = void 0;
       }
       switch (input.method) {
@@ -19240,27 +19283,44 @@ function createSSSStrategy(config) {
             shares.recoveryShare,
             credential.credentialId
           );
-          await postRecoveryMethod(serverUrl, token, providerType, {
-            type: "passkey",
-            encryptedShare: {
-              encryptedData: encryptedShare.encryptedData,
-              iv: encryptedShare.iv
+          await postRecoveryMethod(
+            serverUrl,
+            token,
+            providerType,
+            {
+              type: "passkey",
+              encryptedShare: {
+                encryptedData: encryptedShare.encryptedData,
+                iv: encryptedShare.iv
+              },
+              credentialId: credential.credentialId,
+              shareVersion
             },
-            credentialId: credential.credentialId,
-            shareVersion
-          }, vpJwt, tenantId);
+            vpJwt,
+            tenantId
+          );
           return { method: "passkey", credentialId: credential.credentialId };
         }
         case "phrase": {
           const phrase = await shareToRecoveryPhrase(shares.recoveryShare);
-          await postRecoveryMethod(serverUrl, token, providerType, {
-            type: "phrase",
-            shareVersion
-          }, vpJwt, tenantId);
+          await postRecoveryMethod(
+            serverUrl,
+            token,
+            providerType,
+            {
+              type: "phrase",
+              shareVersion
+            },
+            vpJwt,
+            tenantId
+          );
           return { method: "phrase", phrase };
         }
         case "backup": {
-          const encrypted = await encryptWithPassword(shares.recoveryShare, input.password);
+          const encrypted = await encryptWithPassword(
+            shares.recoveryShare,
+            input.password
+          );
           const backupFile = {
             version: 1,
             createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -19273,10 +19333,17 @@ function createSSSStrategy(config) {
               kdfParams: encrypted.kdfParams
             }
           };
-          await postRecoveryMethod(serverUrl, token, providerType, {
-            type: "backup",
-            shareVersion
-          }, vpJwt, tenantId);
+          await postRecoveryMethod(
+            serverUrl,
+            token,
+            providerType,
+            {
+              type: "backup",
+              shareVersion
+            },
+            vpJwt,
+            tenantId
+          );
           return { method: "backup", backupFile };
         }
         case "email": {
@@ -19288,10 +19355,17 @@ function createSSSStrategy(config) {
             shareVersion,
             tenantId
           );
-          await postRecoveryMethod(serverUrl, token, providerType, {
-            type: "email",
-            shareVersion
-          }, vpJwt, tenantId);
+          await postRecoveryMethod(
+            serverUrl,
+            token,
+            providerType,
+            {
+              type: "email",
+              shareVersion
+            },
+            vpJwt,
+            tenantId
+          );
           hasRecoveryEmail = true;
           return { method: "email" };
         }
@@ -19299,7 +19373,13 @@ function createSSSStrategy(config) {
     },
     async getAvailableRecoveryMethods(token, providerType) {
       try {
-        const serverData = await fetchAuthShareRaw(serverUrl, token, providerType, void 0, tenantId);
+        const serverData = await fetchAuthShareRaw(
+          serverUrl,
+          token,
+          providerType,
+          void 0,
+          tenantId
+        );
         const methods = serverData?.recoveryMethods || [];
         if (enableEmailBackupShare && !methods.some((m) => m.type === "email")) {
           methods.push({ type: "email", createdAt: /* @__PURE__ */ new Date() });
@@ -19335,7 +19415,9 @@ function createSSSStrategy(config) {
     async sendEmailBackupShare(token, providerType, _privateKey, email) {
       if (!enableEmailBackupShare) return;
       if (!lastEmailShare) {
-        console.warn("Cannot send email backup share: no cached email share from splitKey()");
+        console.warn(
+          "Cannot send email backup share: no cached email share from splitKey()"
+        );
         return;
       }
       if (hasRecoveryEmail) {
@@ -19352,7 +19434,15 @@ function createSSSStrategy(config) {
           console.warn("Cannot send email backup share: no email address");
           return;
         }
-        await sendEmailBackupShare(serverUrl, token, providerType, lastEmailShare, email, lastShareVersion, tenantId);
+        await sendEmailBackupShare(
+          serverUrl,
+          token,
+          providerType,
+          lastEmailShare,
+          email,
+          lastShareVersion,
+          tenantId
+        );
       }
       lastEmailShare = void 0;
       lastShareVersion = void 0;