@learncard/sss-key-manager 0.1.19 → 0.1.21

package/dist/sss-strategy.d.ts

@@ -0,0 +1,82 @@
+/**
+ * SSS Key Derivation Strategy
+ *
+ * Implements KeyDerivationStrategy using Shamir's Secret Sharing.
+ * This is the default key derivation strategy for LearnCard.
+ *
+ * The strategy owns:
+ * - Local key storage (IndexedDB device share)
+ * - Key splitting and reconstruction (SSS 2-of-4)
+ * - Server communication for auth shares
+ * - Optional email backup share delivery
+ * - Recovery method execution and setup
+ * - Storage cleanup knowledge
+ */
+import type { SSSKeyDerivationStrategy } from './types';
+export interface SSSStorageFunctions {
+    storeDeviceShare: (share: string, id?: string) => Promise<void>;
+    getDeviceShare: (id?: string) => Promise<string | null>;
+    hasDeviceShare: (id?: string) => Promise<boolean>;
+    clearAllShares: (id?: string) => Promise<void>;
+    storeShareVersion: (version: number, id?: string) => Promise<void>;
+    getShareVersion: (id?: string) => Promise<number | null>;
+}
+export interface SSSStrategyConfig {
+    /** Server URL for key share operations */
+    serverUrl: string;
+    /** Custom storage functions (defaults to IndexedDB) */
+    storage?: SSSStorageFunctions;
+    /**
+     * Whether to automatically send a backup share to the user's email
+     * during key setup and recovery. The share is relayed through the server
+     * but never persisted — fire-and-forget.
+     *
+     * Defaults to false. Controlled by VITE_ENABLE_EMAIL_BACKUP_SHARE env var.
+     */
+    enableEmailBackupShare?: boolean;
+    /**
+     * Tenant identifier forwarded as `X-Tenant-Id` on every server request.
+     * The lca-api uses this to brand recovery / OTP emails for the active
+     * tenant. Defaults to the server's fallback tenant (learncard) when unset.
+     */
+    tenantId?: string;
+}
+/**
+ * Format an email share with a 4-character hex version prefix.
+ *
+ * Example: version 12 + share "47dee4…" → "000c47dee4…"
+ *
+ * The 4-hex-digit prefix keeps the entire string as one contiguous
+ * hex blob, so double-clicking in an email selects the whole thing
+ * (no word-boundary characters like ":" to trip up selection).
+ */
+export declare const VERSION_PREFIX_LEN = 4;
+export declare const formatVersionedEmailShare: (emailShare: string, shareVersion: number) => string;
+/**
+ * Parse a versioned email share string back into its components.
+ * Expects a 4-char hex version prefix followed by the hex share.
+ * Returns the raw hex share and the version number (if present).
+ */
+export declare const parseVersionedEmailShare: (input: string) => {
+    share: string;
+    version: number | undefined;
+};
+/**
+ * Create an SSS key derivation strategy.
+ *
+ * @example
+ * ```ts
+ * const sssStrategy = createSSSStrategy({
+ *     serverUrl: 'https://api.learncard.com',
+ * });
+ *
+ * // Use with AuthCoordinator
+ * const coordinator = createAuthCoordinator({
+ *     authProvider,
+ *     keyDerivation: sssStrategy,
+ * });
+ * ```
+ */
+export declare function createSSSStrategy(config: SSSStrategyConfig): SSSKeyDerivationStrategy;
+export type { SSSKeyDerivationStrategy };
+//# sourceMappingURL=sss-strategy.d.ts.map

package/dist/sss-strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sss-strategy.d.ts","sourceRoot":"","sources":["../src/sss-strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACR,wBAAwB,EAU3B,MAAM,SAAS,CAAC;AA4BjB,MAAM,WAAW,mBAAmB;IAChC,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,eAAe,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAC9B,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAElB,uDAAuD;IACvD,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAE9B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAmID;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,eAAO,MAAM,yBAAyB,GAAI,YAAY,MAAM,EAAE,cAAc,MAAM,KAAG,MACT,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACjC,OAAO,MAAM,KACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAY9C,CAAC;AAqGF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,wBAAwB,CA8uBrF;AAED,YAAY,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/sss.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Shamir Secret Sharing operations
+ */
+export declare const SSS_TOTAL_SHARES = 4;
+export declare const SSS_THRESHOLD = 2;
+export interface SSSShares {
+    deviceShare: string;
+    authShare: string;
+    recoveryShare: string;
+    emailShare: string;
+}
+export declare function splitPrivateKey(privateKeyHex: string): Promise<SSSShares>;
+export declare function reconstructPrivateKey(share1Hex: string, share2Hex: string): Promise<string>;
+export declare function reconstructFromShares(shares: string[]): Promise<string>;
+//# sourceMappingURL=sss.d.ts.map

package/dist/sss.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sss.d.ts","sourceRoot":"","sources":["../src/sss.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,aAAa,IAAI,CAAC;AAE/B,MAAM,WAAW,SAAS;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAW/E;AAED,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOjG;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAS7E"}

package/dist/storage.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Device-side storage for SSS shares
+ * Reuses patterns from webSecureStorage but specialized for SSS
+ */
+export declare function storeDeviceShare(share: string, id?: string): Promise<void>;
+/**
+ * Store the share version alongside a device share.
+ * Stored as a separate key `{id}:version` to avoid changing the encryption format.
+ */
+export declare function storeShareVersion(version: number, id?: string): Promise<void>;
+/**
+ * Retrieve the share version for a device share.
+ * Returns null if no version is stored (legacy shares).
+ */
+export declare function getShareVersion(id?: string): Promise<number | null>;
+export declare function getDeviceShare(id?: string): Promise<string | null>;
+export declare function hasDeviceShare(id?: string): Promise<boolean>;
+export declare function deleteDeviceShare(id?: string): Promise<void>;
+export interface DeviceShareEntry {
+    id: string;
+    preview: string;
+    shareVersion?: number;
+}
+/**
+ * List all device shares stored in IndexedDB.
+ * Returns the storage key and a truncated preview for each share.
+ * Useful for debugging multi-account storage.
+ */
+export declare function listAllDeviceShares(): Promise<DeviceShareEntry[]>;
+export declare function isPublicComputerMode(): boolean;
+export declare function setPublicComputerMode(enabled: boolean): void;
+/**
+ * Create storage functions that dynamically route to sessionStorage (public
+ * computer mode) or IndexedDB (normal mode) based on the `lc-session-mode`
+ * flag in sessionStorage. Checked at call time, not at creation time.
+ */
+export declare function createAdaptiveStorage(): {
+    storeDeviceShare: (share: string, id?: string) => Promise<void>;
+    getDeviceShare: (id?: string) => Promise<string | null>;
+    hasDeviceShare: (id?: string) => Promise<boolean>;
+    clearAllShares: (id?: string) => Promise<void>;
+    storeShareVersion: (version: number, id?: string) => Promise<void>;
+    getShareVersion: (id?: string) => Promise<number | null>;
+};
+export declare function clearAllShares(id?: string): Promise<void>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgJH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAE,MAAgC,GAAG,OAAO,CAAC,IAAI,CAAC,CASzG;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAE,MAAgC,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5G;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,EAAE,GAAE,MAAgC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYlG;AAED,wBAAsB,cAAc,CAAC,EAAE,GAAE,MAAgC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCjG;AAED,wBAAsB,cAAc,CAAC,EAAE,GAAE,MAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAG3F;AAED,wBAAsB,iBAAiB,CAAC,EAAE,GAAE,MAAgC,GAAG,OAAO,CAAC,IAAI,CAAC,CAU3F;AAED,MAAM,WAAW,gBAAgB;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoDvE;AAYD,wBAAgB,oBAAoB,IAAI,OAAO,CAO9C;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAU5D;AAiDD;;;;GAIG;AACH,wBAAgB,qBAAqB;8BAEH,MAAM,OAAO,MAAM;0BAKvB,MAAM;0BAKN,MAAM;0BAKN,MAAM;iCAKC,MAAM,OAAO,MAAM;2BAKzB,MAAM;EAKpC;AAED,wBAAsB,cAAc,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC/D"}

package/dist/types.d.ts

@@ -0,0 +1,155 @@
+/**
+ * SSS Key Manager Types
+ *
+ * Re-exports provider-agnostic interfaces from @learncard/types
+ * and defines SSS-specific types (recovery shapes, backup files, etc.).
+ */
+export { AuthSessionError, type AuthProviderType, type AuthUser, type AuthProvider, type RecoveryMethodInfo, type RecoveryResult, type ServerKeyStatus, type KeyDerivationStrategy, } from '@learncard/types';
+import type { AuthProvider, AuthProviderType, KeyDerivationStrategy, RecoveryMethodInfo } from '@learncard/types';
+export type ContactMethodType = 'email' | 'phone';
+export interface ContactMethod {
+    type: ContactMethodType;
+    value: string;
+}
+export interface AuthProviderMapping {
+    type: AuthProviderType;
+    id: string;
+}
+export type SecurityLevel = 'basic' | 'enhanced' | 'advanced';
+export declare const SecurityLevels: readonly SecurityLevel[];
+/**
+ * SSS recovery method type identifiers.
+ * These are the specific recovery methods supported by the SSS strategy.
+ */
+export type RecoveryMethodType = 'passkey' | 'backup' | 'phrase' | 'email';
+export interface PasskeyRecoveryMethod {
+    type: 'passkey';
+    credentialId?: string;
+}
+export interface BackupFileRecoveryMethod {
+    type: 'backup';
+    fileContents: string;
+    password: string;
+}
+export interface RecoveryPhraseRecoveryMethod {
+    type: 'phrase';
+    phrase: string;
+}
+/** @deprecated Use RecoveryInput instead. Kept for legacy SSSKeyManager class. */
+export type RecoveryMethod = PasskeyRecoveryMethod | BackupFileRecoveryMethod | RecoveryPhraseRecoveryMethod;
+/**
+ * SSS-specific recovery input — what the user provides to recover their key.
+ */
+export type RecoveryInput = {
+    method: 'passkey';
+    credentialId: string;
+} | {
+    method: 'phrase';
+    phrase: string;
+} | {
+    method: 'backup';
+    fileContents: string;
+    password: string;
+} | {
+    method: 'email';
+    emailShare: string;
+};
+/**
+ * SSS-specific recovery setup input — what the user provides to set up a method.
+ */
+export type RecoverySetupInput = {
+    method: 'passkey';
+} | {
+    method: 'phrase';
+} | {
+    method: 'backup';
+    password: string;
+    did: string;
+} | {
+    method: 'email';
+};
+/**
+ * SSS-specific recovery setup result.
+ */
+export type RecoverySetupResult = {
+    method: 'passkey';
+    credentialId: string;
+} | {
+    method: 'phrase';
+    phrase: string;
+} | {
+    method: 'backup';
+    backupFile: BackupFile;
+} | {
+    method: 'email';
+};
+export interface EncryptedShare {
+    encryptedData: string;
+    iv: string;
+    salt?: string;
+}
+export interface ServerEncryptedShare {
+    encryptedData: string;
+    encryptedDek: string;
+    iv: string;
+}
+export interface UserKeyRecord {
+    contactMethod: ContactMethod;
+    authProviders: AuthProviderMapping[];
+    primaryDid: string;
+    linkedDids: string[];
+    keyProvider: 'web3auth' | 'sss';
+    authShare?: ServerEncryptedShare;
+    securityLevel: SecurityLevel;
+    recoveryMethods: RecoveryMethodInfo[];
+    migratedFromWeb3Auth: boolean;
+    migratedAt?: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface BackupFile {
+    version: 1;
+    createdAt: string;
+    primaryDid: string;
+    shareVersion?: number;
+    encryptedShare: {
+        ciphertext: string;
+        iv: string;
+        salt: string;
+        kdfParams: {
+            algorithm: 'argon2id';
+            timeCost: number;
+            memoryCost: number;
+            parallelism: number;
+        };
+    };
+}
+export interface SSSKeyManagerConfig {
+    serverUrl: string;
+    authProvider: AuthProvider;
+    deviceStorageKey?: string;
+}
+/**
+ * The SSS key derivation strategy — a KeyDerivationStrategy narrowed
+ * with SSS-specific recovery input/output types.
+ */
+export type SSSKeyDerivationStrategy = KeyDerivationStrategy<RecoveryInput, RecoverySetupInput, RecoverySetupResult>;
+/** @deprecated Use KeyDerivationStrategy instead. Kept for legacy SSSKeyManager class. */
+export interface KeyDerivationProvider {
+    readonly name: string;
+    connect(): Promise<string>;
+    disconnect(): Promise<void>;
+    isInitialized(): boolean;
+    hasLocalKey(): Promise<boolean>;
+    canMigrate?(): Promise<boolean>;
+    migrate?(privateKey: string): Promise<void>;
+}
+/** @deprecated Use KeyDerivationStrategy instead. Kept for legacy SSSKeyManager class. */
+export interface SSSKeyDerivationProvider extends KeyDerivationProvider {
+    addRecoveryMethod(method: RecoveryMethod): Promise<void>;
+    getRecoveryMethods(): Promise<RecoveryMethodInfo[]>;
+    recover(method: RecoveryMethod): Promise<string>;
+    getSecurityLevel(): Promise<SecurityLevel>;
+    exportBackup(password: string): Promise<BackupFile>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EACH,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,GAC7B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAMlH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,aAAa;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;CACd;AAMD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAE,SAAS,aAAa,EAA+C,CAAC;AAMnG;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IAClC,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACrC,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,kFAAkF;AAClF,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,wBAAwB,GAAG,4BAA4B,CAAC;AAE7G;;GAEG;AACH,MAAM,MAAM,aAAa,GACnB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;GAEG;AACH,MAAM,MAAM,kBAAkB,GACxB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,mBAAmB,GACzB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAM1B,MAAM,WAAW,cAAc;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;CACd;AAMD,MAAM,WAAW,aAAa;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,UAAU,GAAG,KAAK,CAAC;IAChC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE;YACP,SAAS,EAAE,UAAU,CAAC;YACtB,QAAQ,EAAE,MAAM,CAAC;YACjB,UAAU,EAAE,MAAM,CAAC;YACnB,WAAW,EAAE,MAAM,CAAC;SACvB,CAAC;KACL,CAAC;CACL;AAMD,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAMrH,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,aAAa,IAAI,OAAO,CAAC;IACzB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,UAAU,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,0FAA0F;AAC1F,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACnE,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACvD"}

package/package.json

@@ -1,20 +1,21 @@
 {
     "name": "@learncard/sss-key-manager",
-    "version": "0.1.19",
+    "version": "0.1.21",
     "description": "Shamir Secret Sharing key manager for LearnCard - replaces Web3Auth SFA",
     "main": "./dist/index.js",
     "module": "./dist/sss-key-manager.esm.js",
-    "types": "./dist/sss-key-manager.d.ts",
+    "types": "./dist/index.d.ts",
     "files": [
         "dist",
         "src"
     ],
     "scripts": {
-        "build": "node ./scripts/build.mjs && shx cp ./scripts/mixedEntrypoint.js ./dist/index.js && dts-bundle-generator src/index.ts -o dist/sss-key-manager.d.ts --no-check",
+        "build": "node ./scripts/build.mjs && shx cp ./scripts/mixedEntrypoint.js ./dist/index.js && tsc --p tsconfig.json",
         "dev": "node ./scripts/build.mjs --watch",
         "test": "vitest run",
         "test:watch": "vitest",
-        "typecheck": "tsc --noEmit"
+        "typecheck": "tsc --noEmit",
+        "test:coverage": "vitest run --coverage"
     },
     "author": "Learning Economy Foundation (www.learningeconomy.io)",
     "license": "MIT",
@@ -29,16 +30,15 @@
     "devDependencies": {
         "@esbuild-plugins/node-resolve": "^0.1.4",
         "@types/node": "^18.7.19",
-        "dts-bundle-generator": "^6.10.0",
         "esbuild": "^0.27.1",
         "fake-indexeddb": "^6.2.5",
         "jsdom": "^24.0.0",
         "shx": "^0.3.4",
         "typescript": "^5.0.0",
-        "vitest": "^1.0.0"
+        "vitest": "4.1.10"
     },
     "dependencies": {
-        "@learncard/types": "5.18.1",
+        "@learncard/types": "5.18.3",
         "@noble/ed25519": "^2.0.0",
         "@scure/bip39": "^1.2.1",
         "hash-wasm": "^4.11.0",
@@ -55,7 +55,7 @@
     "exports": {
         ".": {
             "development": "./src/index.ts",
-            "types": "./dist/sss-key-manager.d.ts",
+            "types": "./dist/index.d.ts",
             "import": "./dist/sss-key-manager.esm.js",
             "require": "./dist/index.js",
             "default": "./dist/sss-key-manager.esm.js"

package/src/crypto.ts

@@ -32,7 +32,7 @@ export function bufferToBase64(buf: ArrayBuffer): string {
     return btoa(binary);
 }
 
-export function base64ToBuffer(b64: string): Uint8Array {
+export function base64ToBuffer(b64: string): Uint8Array<ArrayBuffer> {
     const binary = atob(b64);
     const bytes = new Uint8Array(binary.length);
     for (let i = 0; i < binary.length; i++) {
@@ -41,7 +41,7 @@ export function base64ToBuffer(b64: string): Uint8Array {
     return bytes;
 }
 
-export function hexToBytes(hex: string): Uint8Array {
+export function hexToBytes(hex: string): Uint8Array<ArrayBuffer> {
     const bytes = new Uint8Array(hex.length / 2);
     for (let i = 0; i < hex.length; i += 2) {
         bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
@@ -59,7 +59,7 @@ export async function deriveKeyFromPassword(
     password: string,
     salt: Uint8Array,
     params: KdfParams = DEFAULT_KDF_PARAMS
-): Promise<Uint8Array> {
+): Promise<Uint8Array<ArrayBuffer>> {
     const hash = await argon2id({
         password,
         salt: salt as unknown as Uint8Array,
@@ -69,7 +69,7 @@ export async function deriveKeyFromPassword(
         hashLength: ARGON2_HASH_LENGTH,
         outputType: 'binary',
     });
-    return new Uint8Array(hash as ArrayBuffer);
+    return Uint8Array.from(hash);
 }
 
 export async function encryptWithPassword(
@@ -148,11 +148,7 @@ export async function encryptShare(
         encryptParams.additionalData = encoder.encode(aad);
     }
 
-    const ciphertextBuffer = await crypto.subtle.encrypt(
-        encryptParams,
-        key,
-        encoder.encode(share) as ArrayBuffer
-    );
+    const ciphertextBuffer = await crypto.subtle.encrypt(encryptParams, key, encoder.encode(share));
 
     return {
         encryptedData: bufferToBase64(ciphertextBuffer),
@@ -186,11 +182,10 @@ export async function decryptShare(
 }
 
 export async function generateAesKey(): Promise<CryptoKey> {
-    return crypto.subtle.generateKey(
-        { name: 'AES-GCM', length: 256 },
-        true,
-        ['encrypt', 'decrypt']
-    );
+    return crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, [
+        'encrypt',
+        'decrypt',
+    ]);
 }
 
 export function generateRandomBytes(length: number): Uint8Array {

package/src/recovery-phrase.ts

@@ -27,7 +27,7 @@ function bytesToBits(bytes: Uint8Array): string {
         .join('');
 }
 
-function bitsToBytes(bits: string): Uint8Array {
+function bitsToBytes(bits: string): Uint8Array<ArrayBuffer> {
     const bytes = new Uint8Array(Math.ceil(bits.length / 8));
     for (let i = 0; i < bytes.length; i++) {
         bytes[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, '0'), 2);
@@ -35,7 +35,7 @@ function bitsToBytes(bits: string): Uint8Array {
     return bytes;
 }
 
-async function computeChecksum(data: Uint8Array): Promise<string> {
+async function computeChecksum(data: Uint8Array<ArrayBuffer>): Promise<string> {
     const hash = await crypto.subtle.digest('SHA-256', data);
     const hashBits = bytesToBits(new Uint8Array(hash));
     const checksumLength = Math.floor(data.length / 4);
@@ -98,7 +98,7 @@ export async function recoveryPhraseToShare(phrase: string): Promise<string> {
 
     const checksumLength = Math.floor(dataByteCount / 4);
     const dataBitCount = dataByteCount * 8;
-    
+
     const dataBits = bits.slice(0, dataBitCount);
     const checksumBits = bits.slice(dataBitCount, dataBitCount + checksumLength);
 
@@ -127,5 +127,8 @@ export async function validateRecoveryPhrase(phrase: string): Promise<boolean> {
 }
 
 export function countWords(phrase: string): number {
-    return phrase.trim().split(/\s+/).filter(w => w.length > 0).length;
+    return phrase
+        .trim()
+        .split(/\s+/)
+        .filter(w => w.length > 0).length;
 }