@learncard/sss-key-manager 0.1.19 → 0.1.21

package/dist/api-client.d.ts

@@ -0,0 +1,49 @@
+/**
+ * API client for SSS Key Manager server routes
+ */
+import type { AuthProvider, ServerEncryptedShare, RecoveryMethodInfo, EncryptedShare, SecurityLevel } from './types';
+export interface GetAuthShareResponse {
+    authShare: ServerEncryptedShare | null;
+    primaryDid: string | null;
+    securityLevel: SecurityLevel;
+    recoveryMethods: RecoveryMethodInfo[];
+    keyProvider: 'web3auth' | 'sss';
+    maskedRecoveryEmail?: string | null;
+}
+export interface StoreAuthShareInput {
+    authShare: ServerEncryptedShare;
+    primaryDid: string;
+    securityLevel?: SecurityLevel;
+}
+export interface StoreRecoveryShareInput {
+    type: 'passkey' | 'backup' | 'phrase' | 'email';
+    encryptedShare?: EncryptedShare;
+    credentialId?: string;
+    shareVersion?: number;
+}
+export interface ApiClientConfig {
+    serverUrl: string;
+    authProvider: AuthProvider;
+}
+export declare class SSSApiClient {
+    private serverUrl;
+    private authProvider;
+    constructor(config: ApiClientConfig);
+    private getAuthHeaders;
+    private getContactMethodFromUser;
+    getAuthShare(): Promise<GetAuthShareResponse | null>;
+    storeAuthShare(input: StoreAuthShareInput): Promise<void>;
+    addRecoveryMethod(input: StoreRecoveryShareInput): Promise<void>;
+    getRecoveryShare(type: 'passkey' | 'backup' | 'phrase' | 'email', credentialId?: string): Promise<{
+        encryptedShare?: EncryptedShare;
+        shareVersion?: number;
+    } | null>;
+    markMigrated(): Promise<void>;
+    sendEmailBackupShare(emailShare: string, overrideEmail?: string): Promise<void>;
+    addRecoveryEmail(email: string): Promise<void>;
+    verifyRecoveryEmail(code: string): Promise<{
+        maskedEmail: string;
+    }>;
+    deleteUserKey(): Promise<void>;
+}
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACR,YAAY,EAGZ,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,aAAa,EAChB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,oBAAoB;IACjC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC,WAAW,EAAE,UAAU,GAAG,KAAK,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,oBAAoB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACpC,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IAChD,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;CAC9B;AAED,qBAAa,YAAY;IACrB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAe;gBAEvB,MAAM,EAAE,eAAe;YAKrB,cAAc;YAQd,wBAAwB;IAahC,YAAY,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAoBpD,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzD,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBhE,gBAAgB,CAClB,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,EAC/C,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC;QAAE,cAAc,CAAC,EAAE,cAAc,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IA+BvE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAe7B,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC/E,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAkBnE,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;CAcvC"}

package/dist/atomic-operations.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Atomic Share Operations
+ *
+ * Provides verified split operations and atomic updates with rollback capability.
+ * These functions ensure that private keys can NEVER be lost due to partial failures.
+ */
+import { type SSSShares } from './sss';
+export interface AtomicSplitResult {
+    privateKey: string;
+    shares: SSSShares;
+    verified: boolean;
+}
+export interface AtomicUpdateOptions {
+    previousDeviceShare?: string;
+    previousAuthShare?: string;
+    onRollback?: (reason: string) => void;
+}
+export interface StorageOperations {
+    storeDevice: (share: string) => Promise<void>;
+    storeAuth: (share: string) => Promise<void>;
+    getDevice?: () => Promise<string | null>;
+    getAuth?: () => Promise<string | null>;
+}
+export declare class ShareVerificationError extends Error {
+    readonly combination: string;
+    readonly expected: string;
+    readonly got: string;
+    constructor(message: string, combination: string, expected: string, got: string);
+}
+export declare class AtomicUpdateError extends Error {
+    readonly phase: 'split' | 'verify' | 'store_device' | 'store_auth' | 'verify_stored';
+    readonly rolledBack: boolean;
+    readonly cause?: Error | undefined;
+    constructor(message: string, phase: 'split' | 'verify' | 'store_device' | 'store_auth' | 'verify_stored', rolledBack: boolean, cause?: Error | undefined);
+}
+/**
+ * Split a private key into shares and verify ALL combinations reconstruct correctly.
+ *
+ * This function will NOT return until verification passes. If verification fails,
+ * it throws an error - no shares are ever returned that don't reconstruct the key.
+ *
+ * @param privateKey - The private key to split (hex string)
+ * @returns Verified shares that are guaranteed to reconstruct the key
+ * @throws ShareVerificationError if any share combination fails verification
+ */
+export declare function splitAndVerify(privateKey: string): Promise<AtomicSplitResult>;
+/**
+ * Atomically update shares with rollback on failure.
+ *
+ * This function ensures that either:
+ * 1. Both device and auth shares are updated successfully, OR
+ * 2. The previous state is restored (rollback)
+ *
+ * The operation flow:
+ * 1. Generate and verify new shares
+ * 2. Store device share locally
+ * 3. Store auth share on server
+ * 4. If step 3 fails, rollback step 2
+ *
+ * @param privateKey - The private key to split
+ * @param storage - Storage operations for device and auth shares
+ * @param options - Options including previous shares for rollback
+ * @returns The new verified shares
+ * @throws AtomicUpdateError with rollback status
+ */
+export declare function atomicShareUpdate(privateKey: string, storage: StorageOperations, options?: AtomicUpdateOptions): Promise<SSSShares>;
+/**
+ * Verify that stored shares can reconstruct the expected private key.
+ *
+ * This is a health check that should be run after recovery or on login
+ * to ensure the user's shares are in a consistent state.
+ *
+ * @param storage - Storage operations to retrieve shares
+ * @param expectedDid - The expected DID (used to verify the reconstructed key)
+ * @param didFromPrivateKey - Function to derive DID from private key
+ * @returns Object with health status and details
+ */
+export declare function verifyStoredShares(storage: Pick<StorageOperations, 'getDevice' | 'getAuth'>, expectedDid: string, didFromPrivateKey: (privateKey: string) => Promise<string>): Promise<{
+    healthy: boolean;
+    hasDeviceShare: boolean;
+    hasAuthShare: boolean;
+    didMatches: boolean;
+    error?: string;
+}>;
+/**
+ * Create a recovery operation that atomically updates all shares.
+ *
+ * This is used during recovery when we reconstruct from recovery+auth shares
+ * and need to generate a new device share.
+ *
+ * @param recoveryShare - The decrypted recovery share
+ * @param authShareData - The auth share from server
+ * @param storage - Storage operations
+ * @param options - Atomic update options
+ * @returns The reconstructed private key and new shares
+ */
+export declare function atomicRecovery(recoveryShare: string, authShareData: string, storage: StorageOperations, options?: AtomicUpdateOptions): Promise<{
+    privateKey: string;
+    newShares: SSSShares;
+}>;
+//# sourceMappingURL=atomic-operations.d.ts.map

package/dist/atomic-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-operations.d.ts","sourceRoot":"","sources":["../src/atomic-operations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE/E,MAAM,WAAW,iBAAiB;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAC9B,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;aAGzB,WAAW,EAAE,MAAM;aACnB,QAAQ,EAAE,MAAM;aAChB,GAAG,EAAE,MAAM;gBAH3B,OAAO,EAAE,MAAM,EACC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM;CAKlC;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aAGpB,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,cAAc,GAAG,YAAY,GAAG,eAAe;aAC3E,UAAU,EAAE,OAAO;aACnB,KAAK,CAAC,EAAE,KAAK;gBAH7B,OAAO,EAAE,MAAM,EACC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,cAAc,GAAG,YAAY,GAAG,eAAe,EAC3E,UAAU,EAAE,OAAO,EACnB,KAAK,CAAC,EAAE,KAAK,YAAA;CAKpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+BnF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE,mBAAwB,GAClC,OAAO,CAAC,SAAS,CAAC,CAuDpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,SAAS,CAAC,EACzD,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAC3D,OAAO,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC,CA6CD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAChC,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE,mBAAwB,GAClC,OAAO,CAAC;IACP,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;CACxB,CAAC,CAWD"}

package/dist/auth-coordinator.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @deprecated AuthCoordinator has moved to learn-card-base/auth-coordinator.
+ * This file is kept only as a stub during migration.
+ * Import from 'learn-card-base' instead:
+ *
+ * ```ts
+ * import { AuthCoordinator, createAuthCoordinator } from 'learn-card-base';
+ * ```
+ */
+//# sourceMappingURL=auth-coordinator.d.ts.map

package/dist/auth-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-coordinator.d.ts","sourceRoot":"","sources":["../src/auth-coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/crypto.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Cryptographic utilities for SSS Key Manager
+ */
+export interface KdfParams {
+    algorithm: 'argon2id';
+    timeCost: number;
+    memoryCost: number;
+    parallelism: number;
+}
+export declare const DEFAULT_KDF_PARAMS: KdfParams;
+export declare function bufferToBase64(buf: ArrayBuffer): string;
+export declare function base64ToBuffer(b64: string): Uint8Array<ArrayBuffer>;
+export declare function hexToBytes(hex: string): Uint8Array<ArrayBuffer>;
+export declare function bytesToHex(bytes: Uint8Array): string;
+export declare function deriveKeyFromPassword(password: string, salt: Uint8Array, params?: KdfParams): Promise<Uint8Array<ArrayBuffer>>;
+export declare function encryptWithPassword(plaintext: string, password: string): Promise<{
+    ciphertext: string;
+    iv: string;
+    salt: string;
+    kdfParams: KdfParams;
+}>;
+export declare function decryptWithPassword(ciphertext: string, iv: string, salt: string, password: string, params?: KdfParams): Promise<string>;
+export declare function encryptShare(share: string, key: CryptoKey, aad?: string): Promise<{
+    encryptedData: string;
+    iv: string;
+}>;
+export declare function decryptShare(encryptedData: string, iv: string, key: CryptoKey, aad?: string): Promise<string>;
+export declare function generateAesKey(): Promise<CryptoKey>;
+export declare function generateRandomBytes(length: number): Uint8Array;
+export declare function generateEd25519PrivateKey(): Promise<string>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,WAAW,SAAS;IACtB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB,EAAE,SAKhC,CAAC;AAEF,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAOvD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAOnE;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAM/D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,MAAM,GAAE,SAA8B,GACvC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAWlC;AAED,wBAAsB,mBAAmB,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CA2BjF;AAED,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,SAA8B,GACvC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED,wBAAsB,YAAY,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,SAAS,EACd,GAAG,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAehD;AAED,wBAAsB,YAAY,CAC9B,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,SAAS,EACd,GAAG,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,SAAS,CAAC,CAKzD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAE9D;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAGjE"}

package/dist/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @learncard/sss-key-manager
+ *
+ * Shamir Secret Sharing key manager for LearnCard - replaces Web3Auth SFA
+ */
+export { SSSKeyManager, createSSSKeyManager } from './key-manager';
+export { SSSApiClient } from './api-client';
+export { splitPrivateKey, reconstructPrivateKey, reconstructFromShares, SSS_TOTAL_SHARES, SSS_THRESHOLD, } from './sss';
+export { storeDeviceShare, getDeviceShare, hasDeviceShare, deleteDeviceShare, clearAllShares, listAllDeviceShares, storeShareVersion, getShareVersion, isPublicComputerMode, setPublicComputerMode, createAdaptiveStorage, } from './storage';
+export type { DeviceShareEntry } from './storage';
+export { encryptWithPassword, decryptWithPassword, deriveKeyFromPassword, generateEd25519PrivateKey, hexToBytes, bytesToHex, bufferToBase64, base64ToBuffer, DEFAULT_KDF_PARAMS, } from './crypto';
+export { createPasskeyCredential, deriveKeyFromPasskey, encryptShareWithPasskey, decryptShareWithPasskey, isWebAuthnSupported, isPRFSupported, } from './passkey';
+export type { PasskeyCredential, PasskeyEncryptedShare } from './passkey';
+export { shareToRecoveryPhrase, recoveryPhraseToShare, generateRecoveryPhrase, validateRecoveryPhrase, countWords, } from './recovery-phrase';
+export type { RecoveryPhraseData } from './recovery-phrase';
+export { splitAndVerify, atomicShareUpdate, verifyStoredShares, atomicRecovery, ShareVerificationError, AtomicUpdateError, } from './atomic-operations';
+export type { AtomicSplitResult, AtomicUpdateOptions, StorageOperations, } from './atomic-operations';
+export { createSSSStrategy } from './sss-strategy';
+export type { SSSStorageFunctions, SSSStrategyConfig } from './sss-strategy';
+export { generateEphemeralKeypair, encryptShareForTransfer, decryptShareFromTransfer, } from './qr-crypto';
+export type { EphemeralKeypair, EncryptedSharePayload } from './qr-crypto';
+export { createQrLoginSession, pollQrLoginSession, pollUntilApproved, getQrLoginSessionInfo, approveQrLoginSession, notifyDevicesForQrSession, } from './qr-login';
+export type { QrLoginSession, QrLoginSessionInfo, QrLoginClientConfig, QrPayload, PollResult, NotifyDevicesResult, } from './qr-login';
+export { AuthSessionError } from './types';
+export type { SSSKeyManagerConfig, SSSKeyDerivationProvider, KeyDerivationProvider, KeyDerivationStrategy, SSSKeyDerivationStrategy, ServerKeyStatus, AuthProvider, AuthUser, AuthProviderType, ContactMethod, ContactMethodType, RecoveryMethod, RecoveryMethodType, RecoveryMethodInfo, RecoveryInput, RecoveryResult, RecoverySetupInput, RecoverySetupResult, PasskeyRecoveryMethod, BackupFileRecoveryMethod, RecoveryPhraseRecoveryMethod, SecurityLevel, BackupFile, EncryptedShare, ServerEncryptedShare, UserKeyRecord, AuthProviderMapping, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,GACb,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACH,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACR,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EACH,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACtB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EACR,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACtB,MAAM,SAAS,CAAC"}

package/dist/key-manager.d.ts

@@ -0,0 +1,30 @@
+/**
+ * SSS Key Manager - Main class
+ */
+import type { SSSKeyManagerConfig, SSSKeyDerivationProvider, RecoveryMethod, RecoveryMethodInfo, SecurityLevel, BackupFile } from './types';
+export declare class SSSKeyManager implements SSSKeyDerivationProvider {
+    readonly name = "sss";
+    private config;
+    private apiClient;
+    private initialized;
+    private currentPrivateKey;
+    constructor(config: SSSKeyManagerConfig);
+    isInitialized(): boolean;
+    hasLocalKey(): Promise<boolean>;
+    connect(): Promise<string>;
+    disconnect(): Promise<void>;
+    setupNewKey(): Promise<string>;
+    setupWithKey(privateKey: string, primaryDid?: string): Promise<void>;
+    migrate(privateKey: string): Promise<void>;
+    canMigrate(): Promise<boolean>;
+    addRecoveryMethod(method: RecoveryMethod): Promise<void>;
+    generateRecoveryPhrase(): Promise<string>;
+    getRecoveryMethods(): Promise<RecoveryMethodInfo[]>;
+    recover(method: RecoveryMethod): Promise<string>;
+    getSecurityLevel(): Promise<SecurityLevel>;
+    exportBackup(password: string): Promise<BackupFile>;
+    clearLocalData(): Promise<void>;
+    deleteAccount(): Promise<void>;
+}
+export declare function createSSSKeyManager(config: SSSKeyManagerConfig): SSSKeyManager;
+//# sourceMappingURL=key-manager.d.ts.map

package/dist/key-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-manager.d.ts","sourceRoot":"","sources":["../src/key-manager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACR,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,UAAU,EAEb,MAAM,SAAS,CAAC;AA4BjB,qBAAa,aAAc,YAAW,wBAAwB;IAC1D,QAAQ,CAAC,IAAI,SAAS;IAEtB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,iBAAiB,CAAuB;gBAEpC,MAAM,EAAE,mBAAmB;IAQvC,aAAa,IAAI,OAAO;IAIlB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IA4B1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAM9B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpE,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1C,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAK9B,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCxD,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;IAWzC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKnD,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IA2FhD,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC;IAK1C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuBnD,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAM/B,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;CAMvC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAE9E"}

package/dist/passkey.d.ts

@@ -0,0 +1,23 @@
+/**
+ * WebAuthn Passkey utilities for SSS recovery
+ * Uses the PRF (Pseudo-Random Function) extension to derive encryption keys
+ */
+export interface PasskeyCredential {
+    credentialId: string;
+    publicKey: string;
+    transports?: AuthenticatorTransport[];
+}
+export interface PasskeyEncryptedShare {
+    encryptedData: string;
+    iv: string;
+    credentialId: string;
+}
+declare function isWebAuthnSupported(): boolean;
+declare function isPRFSupported(): Promise<boolean>;
+export declare function createPasskeyCredential(userId: string, userName: string): Promise<PasskeyCredential>;
+export declare function deriveKeyFromPasskey(credentialId: string): Promise<CryptoKey>;
+export declare function encryptShareWithPasskey(share: string, credentialId: string): Promise<PasskeyEncryptedShare>;
+export declare function decryptShareWithPasskey(encryptedShare: PasskeyEncryptedShare): Promise<string>;
+export declare function listStoredPasskeys(): Promise<PasskeyCredential[]>;
+export { isWebAuthnSupported, isPRFSupported };
+//# sourceMappingURL=passkey.d.ts.map

package/dist/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,iBAAiB;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;CACxB;AAOD,iBAAS,mBAAmB,IAAI,OAAO,CAItC;AAED,iBAAe,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAShD;AAED,wBAAsB,uBAAuB,CACzC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAgE5B;AAED,wBAAsB,oBAAoB,CACtC,YAAY,EAAE,MAAM,GACrB,OAAO,CAAC,SAAS,CAAC,CAkDpB;AAED,wBAAsB,uBAAuB,CACzC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACrB,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;AAED,wBAAsB,uBAAuB,CACzC,cAAc,EAAE,qBAAqB,GACtC,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAevE;AAED,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC"}

package/dist/qr-crypto.d.ts

@@ -0,0 +1,56 @@
+/**
+ * QR Login Crypto Helpers
+ *
+ * X25519 ECDH key exchange + AES-256-GCM encryption for cross-device
+ * share transfer. Uses the Web Crypto API exclusively — no external deps.
+ *
+ * Flow:
+ *   Device B generates an ephemeral X25519 keypair, shares the public key.
+ *   Device A derives a shared secret via ECDH, encrypts the device share
+ *   with AES-256-GCM, and sends the ciphertext.
+ *   Device B decrypts with the same derived shared secret.
+ */
+export interface EphemeralKeypair {
+    /** Base64-encoded X25519 public key (sent to server / encoded in QR) */
+    publicKey: string;
+    /** Raw CryptoKey — kept in memory on Device B, never leaves the device */
+    privateKey: CryptoKey;
+}
+export interface EncryptedSharePayload {
+    /** Base64-encoded AES-256-GCM ciphertext */
+    ciphertext: string;
+    /** Base64-encoded 12-byte IV */
+    iv: string;
+    /** Base64-encoded ephemeral public key of the *sender* (Device A) */
+    senderPublicKey: string;
+}
+/**
+ * Generate an ephemeral X25519 keypair for the new device (Device B).
+ * The public key is shared via QR / short code; the private key stays in memory.
+ */
+export declare const generateEphemeralKeypair: () => Promise<EphemeralKeypair>;
+/**
+ * Encrypt a device share for transfer to Device B.
+ *
+ * Called by Device A (the logged-in device):
+ *   1. Generates its own ephemeral X25519 keypair
+ *   2. Derives a shared secret from its private key + Device B's public key
+ *   3. Encrypts the share with AES-256-GCM
+ *   4. Returns the ciphertext + IV + Device A's ephemeral public key
+ *
+ * @param deviceShare - Plaintext device share to encrypt
+ * @param recipientPublicKey - Base64-encoded X25519 public key from Device B
+ */
+export declare const encryptShareForTransfer: (deviceShare: string, recipientPublicKey: string) => Promise<EncryptedSharePayload>;
+/**
+ * Decrypt a device share received from Device A.
+ *
+ * Called by Device B (the new device):
+ *   1. Derives the shared secret from its private key + Device A's public key
+ *   2. Decrypts the ciphertext with AES-256-GCM
+ *
+ * @param payload - The encrypted payload from Device A
+ * @param recipientPrivateKey - Device B's ephemeral private CryptoKey
+ */
+export declare const decryptShareFromTransfer: (payload: EncryptedSharePayload, recipientPrivateKey: CryptoKey) => Promise<string>;
+//# sourceMappingURL=qr-crypto.d.ts.map

package/dist/qr-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr-crypto.d.ts","sourceRoot":"","sources":["../src/qr-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,MAAM,WAAW,gBAAgB;IAC7B,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAElB,0EAA0E;IAC1E,UAAU,EAAE,SAAS,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IAClC,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IAEnB,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;IAEX,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;CAC3B;AAMD;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAa,OAAO,CAAC,gBAAgB,CAoBzE,CAAC;AAsEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAChC,aAAa,MAAM,EACnB,oBAAoB,MAAM,KAC3B,OAAO,CAAC,qBAAqB,CAsB/B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GACjC,SAAS,qBAAqB,EAC9B,qBAAqB,SAAS,KAC/B,OAAO,CAAC,MAAM,CAiBhB,CAAC"}

package/dist/qr-login.d.ts

@@ -0,0 +1,122 @@
+/**
+ * QR Login Client
+ *
+ * High-level orchestrator for cross-device login via QR code or short code.
+ * Coordinates between the relay API and the ECDH crypto layer.
+ *
+ * Two roles:
+ *   - **Requester** (Device B, new device): creates session, renders QR, polls
+ *   - **Approver** (Device A, logged-in device): reads QR/code, encrypts share, approves
+ */
+import type { EphemeralKeypair } from './qr-crypto';
+export interface QrLoginSession {
+    sessionId: string;
+    shortCode: string;
+    expiresInSeconds: number;
+}
+export interface QrLoginSessionInfo {
+    sessionId: string;
+    publicKey: string;
+    status: 'pending' | 'approved';
+    encryptedPayload?: string;
+    approverDid?: string;
+}
+export interface QrLoginClientConfig {
+    serverUrl: string;
+}
+export interface QrPayload {
+    /** Session ID for the relay */
+    sessionId: string;
+    /** Base64-encoded ephemeral X25519 public key */
+    publicKey: string;
+    /** Server URL for the relay */
+    serverUrl: string;
+}
+/** Result of polling — either still waiting or the device share is ready */
+export type PollResult = {
+    status: 'pending';
+} | {
+    status: 'approved';
+    deviceShare: string;
+    approverDid: string;
+    accountHint?: string;
+    shareVersion?: number;
+};
+/**
+ * Create a QR login session and generate the ephemeral keypair.
+ *
+ * Returns everything Device B needs to display a QR and start polling.
+ * The ephemeral private key is kept in memory — never serialized.
+ */
+export declare const createQrLoginSession: (config: QrLoginClientConfig) => Promise<{
+    session: QrLoginSession;
+    ephemeralKeypair: EphemeralKeypair;
+    qrPayload: QrPayload;
+}>;
+/**
+ * Poll a QR login session for approval.
+ *
+ * When Device A approves, this returns the decrypted device share.
+ *
+ * @param config - Server config
+ * @param sessionId - The session to poll
+ * @param ephemeralPrivateKey - Device B's ephemeral private key (for decryption)
+ */
+export declare const pollQrLoginSession: (config: QrLoginClientConfig, sessionId: string, ephemeralPrivateKey: CryptoKey) => Promise<PollResult>;
+/**
+ * Convenience: poll in a loop until approved or timeout.
+ *
+ * @param config - Server config
+ * @param sessionId - The session to poll
+ * @param ephemeralPrivateKey - Device B's ephemeral private key
+ * @param intervalMs - Polling interval (default 2000ms)
+ * @param timeoutMs - Total timeout (default 120000ms)
+ * @param onPoll - Optional callback on each poll (for UI updates)
+ */
+export declare const pollUntilApproved: (config: QrLoginClientConfig, sessionId: string, ephemeralPrivateKey: CryptoKey, options?: {
+    intervalMs?: number;
+    timeoutMs?: number;
+    onPoll?: (attempt: number) => void;
+    signal?: AbortSignal;
+}) => Promise<{
+    deviceShare: string;
+    approverDid: string;
+    accountHint?: string;
+    shareVersion?: number;
+}>;
+/**
+ * Fetch a QR login session's public key (for Device A to encrypt against).
+ *
+ * @param config - Server config
+ * @param lookup - Session ID or 6-digit short code
+ */
+export declare const getQrLoginSessionInfo: (config: QrLoginClientConfig, lookup: string) => Promise<QrLoginSessionInfo>;
+/**
+ * Approve a QR login session by encrypting and pushing the device share.
+ *
+ * Called by Device A (the logged-in device).
+ *
+ * @param config - Server config
+ * @param sessionId - The session to approve
+ * @param deviceShare - Plaintext device share from Device A's local storage
+ * @param approverDid - DID of the approving device
+ * @param recipientPublicKey - Base64 X25519 public key from the session
+ * @param accountHint - Optional email or phone of the approver's account (sent to Device B as a login hint)
+ * @param shareVersion - Optional share version so Device B can fetch the matching auth share
+ */
+export declare const approveQrLoginSession: (config: QrLoginClientConfig, sessionId: string, deviceShare: string, approverDid: string, recipientPublicKey: string, accountHint?: string, shareVersion?: number) => Promise<void>;
+export interface NotifyDevicesResult {
+    sent: boolean;
+    deviceCount: number;
+}
+/**
+ * Send a push notification to the authenticated user's other devices,
+ * prompting them to open the approver flow for the given QR session.
+ *
+ * Called by Device B (in needs_recovery) after creating a session.
+ * Requires the user's Firebase (or other auth provider) token.
+ *
+ * This is fire-and-forget — failure does not block the QR login flow.
+ */
+export declare const notifyDevicesForQrSession: (config: QrLoginClientConfig, sessionId: string, shortCode: string, authToken: string, providerType?: string) => Promise<NotifyDevicesResult>;
+//# sourceMappingURL=qr-login.d.ts.map

package/dist/qr-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr-login.d.ts","sourceRoot":"","sources":["../src/qr-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,OAAO,KAAK,EAAE,gBAAgB,EAAyB,MAAM,aAAa,CAAC;AAM3E,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACtB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAElB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAElB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAChB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBpH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAC7B,QAAQ,mBAAmB,KAC5B,OAAO,CAAC;IACP,OAAO,EAAE,cAAc,CAAC;IACxB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;CACxB,CAsBA,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC3B,QAAQ,mBAAmB,EAC3B,WAAW,MAAM,EACjB,qBAAqB,SAAS,KAC/B,OAAO,CAAC,UAAU,CAkCpB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC1B,QAAQ,mBAAmB,EAC3B,WAAW,MAAM,EACjB,qBAAqB,SAAS,EAC9B,UAAU;IACN,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB,KACF,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAwCnG,CAAC;AAMF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAC9B,QAAQ,mBAAmB,EAC3B,QAAQ,MAAM,KACf,OAAO,CAAC,kBAAkB,CAW5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,GAC9B,QAAQ,mBAAmB,EAC3B,WAAW,MAAM,EACjB,aAAa,MAAM,EACnB,aAAa,MAAM,EACnB,oBAAoB,MAAM,EAC1B,cAAc,MAAM,EACpB,eAAe,MAAM,KACtB,OAAO,CAAC,IAAI,CAoBd,CAAC;AAMF,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAClC,QAAQ,mBAAmB,EAC3B,WAAW,MAAM,EACjB,WAAW,MAAM,EACjB,WAAW,MAAM,EACjB,eAAc,MAAmB,KAClC,OAAO,CAAC,mBAAmB,CAqB7B,CAAC"}

package/dist/recovery-phrase.d.ts

@@ -0,0 +1,14 @@
+/**
+ * BIP39 Recovery Phrase utilities for SSS recovery
+ * The recovery phrase directly encodes a share (not encryption)
+ */
+export interface RecoveryPhraseData {
+    phrase: string;
+    shareHex: string;
+}
+export declare function shareToRecoveryPhrase(shareHex: string): Promise<string>;
+export declare function recoveryPhraseToShare(phrase: string): Promise<string>;
+export declare function generateRecoveryPhrase(shareHex: string): Promise<RecoveryPhraseData>;
+export declare function validateRecoveryPhrase(phrase: string): Promise<boolean>;
+export declare function countWords(phrase: string): number;
+//# sourceMappingURL=recovery-phrase.d.ts.map

package/dist/recovery-phrase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-phrase.d.ts","sourceRoot":"","sources":["../src/recovery-phrase.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CACpB;AAkCD,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc7E;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoD3E;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAG1F;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO7E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKjD"}

package/dist/sss-key-manager.cjs.development.js

@@ -197,6 +197,12 @@ var require_types_cjs_development = __commonJS({
       LCNBoostClaimLinkSigningAuthorityValidator: /* @__PURE__ */ __name(() => LCNBoostClaimLinkSigningAuthorityValidator, "LCNBoostClaimLinkSigningAuthorityValidator"),
       LCNBoostStatus: /* @__PURE__ */ __name(() => LCNBoostStatus, "LCNBoostStatus"),
       LCNConnectionProfileValidator: /* @__PURE__ */ __name(() => LCNConnectionProfileValidator, "LCNConnectionProfileValidator"),
+      LCNConnectionPromptActionResultValidator: /* @__PURE__ */ __name(() => LCNConnectionPromptActionResultValidator, "LCNConnectionPromptActionResultValidator"),
+      LCNConnectionPromptActionStatusValidator: /* @__PURE__ */ __name(() => LCNConnectionPromptActionStatusValidator, "LCNConnectionPromptActionStatusValidator"),
+      LCNConnectionPromptMetadataValidator: /* @__PURE__ */ __name(() => LCNConnectionPromptMetadataValidator, "LCNConnectionPromptMetadataValidator"),
+      LCNConnectionPromptStatusValidator: /* @__PURE__ */ __name(() => LCNConnectionPromptStatusValidator, "LCNConnectionPromptStatusValidator"),
+      LCNConnectionPromptSurfaceValidator: /* @__PURE__ */ __name(() => LCNConnectionPromptSurfaceValidator, "LCNConnectionPromptSurfaceValidator"),
+      LCNConnectionPromptValidator: /* @__PURE__ */ __name(() => LCNConnectionPromptValidator, "LCNConnectionPromptValidator"),
       LCNDomainOrOriginValidator: /* @__PURE__ */ __name(() => LCNDomainOrOriginValidator, "LCNDomainOrOriginValidator"),
       LCNInboxContactMethodValidator: /* @__PURE__ */ __name(() => LCNInboxContactMethodValidator, "LCNInboxContactMethodValidator"),
       LCNInboxStatusEnumValidator: /* @__PURE__ */ __name(() => LCNInboxStatusEnumValidator, "LCNInboxStatusEnumValidator"),
@@ -208,6 +214,7 @@ var require_types_cjs_development = __commonJS({
       LCNNotificationDataValidator: /* @__PURE__ */ __name(() => LCNNotificationDataValidator, "LCNNotificationDataValidator"),
       LCNNotificationInboxValidator: /* @__PURE__ */ __name(() => LCNNotificationInboxValidator, "LCNNotificationInboxValidator"),
       LCNNotificationMessageValidator: /* @__PURE__ */ __name(() => LCNNotificationMessageValidator, "LCNNotificationMessageValidator"),
+      LCNNotificationMetadataValidator: /* @__PURE__ */ __name(() => LCNNotificationMetadataValidator, "LCNNotificationMetadataValidator"),
       LCNNotificationTypeEnumValidator: /* @__PURE__ */ __name(() => LCNNotificationTypeEnumValidator, "LCNNotificationTypeEnumValidator"),
       LCNNotificationValidator: /* @__PURE__ */ __name(() => LCNNotificationValidator, "LCNNotificationValidator"),
       LCNProfileConnectionStatusEnum: /* @__PURE__ */ __name(() => LCNProfileConnectionStatusEnum, "LCNProfileConnectionStatusEnum"),
@@ -16232,6 +16239,31 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       isServiceProfile: true,
       display: true
     });
+    var LCNConnectionPromptStatusValidator = external_exports.enum(["PENDING", "SKIPPED", "CONNECTED"]);
+    var LCNConnectionPromptSurfaceValidator = external_exports.enum(["POST_CLAIM", "NOTIFICATION"]);
+    var LCNConnectionPromptActionStatusValidator = external_exports.enum([
+      "PENDING",
+      "SKIPPED",
+      "CONNECTED",
+      "STALE"
+    ]);
+    var LCNConnectionPromptValidator = external_exports.object({
+      promptId: external_exports.string().uuid(),
+      status: LCNConnectionPromptStatusValidator,
+      surface: LCNConnectionPromptSurfaceValidator,
+      triggerId: external_exports.string(),
+      triggeredAt: external_exports.iso.datetime(),
+      updatedAt: external_exports.iso.datetime(),
+      counterpart: LCNPublicProfileValidator
+    });
+    var LCNConnectionPromptActionResultValidator = external_exports.object({
+      promptId: external_exports.string().uuid(),
+      status: LCNConnectionPromptActionStatusValidator
+    });
+    var LCNConnectionPromptMetadataValidator = external_exports.object({
+      promptId: external_exports.string().uuid(),
+      counterpartProfileId: external_exports.string()
+    });
     var LCNAuthedProfileValidator = LCNPublicProfileValidator.extend({
       bio: LCNProfileValidator.shape.bio,
       websiteLink: LCNProfileValidator.shape.websiteLink,
@@ -16240,7 +16272,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       did: LCNProfileValidator.shape.did
     });
     var LCNConnectionProfileValidator = LCNAuthedProfileValidator.extend({
-      email: LCNProfileValidator.shape.email
+      email: LCNProfileValidator.shape.email,
+      connectedAt: external_exports.iso.datetime().optional().describe("When the viewer and this profile became connected.")
     });
     var LCNVisibleProfileValidator = external_exports.union([
       LCNConnectionProfileValidator.strict(),
@@ -16796,12 +16829,15 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }),
       timestamp: external_exports.iso.datetime().optional()
     });
+    var LCNNotificationMetadataValidator = external_exports.object({
+      connectionPrompt: LCNConnectionPromptMetadataValidator.optional()
+    }).catchall(external_exports.unknown());
     var LCNNotificationDataValidator = external_exports.object({
       vcUris: external_exports.array(external_exports.string()).optional(),
       vpUris: external_exports.array(external_exports.string()).optional(),
       transaction: ConsentFlowTransactionValidator.optional(),
       inbox: LCNNotificationInboxValidator.optional(),
-      metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+      metadata: LCNNotificationMetadataValidator.optional()
     }).loose();
     var LCNNotificationValidator = external_exports.object({
       type: LCNNotificationTypeEnumValidator,
@@ -17964,7 +18000,7 @@ async function deriveKeyFromPassword(password, salt, params = DEFAULT_KDF_PARAMS
     hashLength: ARGON2_HASH_LENGTH,
     outputType: "binary"
   });
-  return new Uint8Array(hash);
+  return Uint8Array.from(hash);
 }
 __name(deriveKeyFromPassword, "deriveKeyFromPassword");
 async function encryptWithPassword(plaintext, password) {