@learncard/sss-key-manager 0.2.7 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -0
- package/dist/escrow-authority.d.ts +4 -3
- package/dist/escrow-authority.d.ts.map +1 -1
- package/dist/escrow-authority.types.d.ts +15 -0
- package/dist/escrow-authority.types.d.ts.map +1 -1
- package/dist/escrow-crypto.d.ts +19 -1
- package/dist/escrow-crypto.d.ts.map +1 -1
- package/dist/escrow-enrollment-intent.d.ts.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/sss-key-manager.cjs.development.js +720 -73
- package/dist/sss-key-manager.cjs.development.js.map +3 -3
- package/dist/sss-key-manager.cjs.production.min.js +30 -30
- package/dist/sss-key-manager.cjs.production.min.js.map +4 -4
- package/dist/sss-key-manager.esm.js +722 -73
- package/dist/sss-key-manager.esm.js.map +3 -3
- package/dist/sss-strategy.d.ts +26 -0
- package/dist/sss-strategy.d.ts.map +1 -1
- package/package.json +2 -2
- package/src/__fixtures__/escrow-authority-brand-names-v1.json +29 -0
- package/src/__fixtures__/escrow-carry-contact-contract-v1.json +25 -1
- package/src/__fixtures__/escrow-email-brand-contract-v1.json +225 -0
- package/src/escrow-authority.test.ts +2 -0
- package/src/escrow-authority.ts +24 -7
- package/src/escrow-authority.types.ts +27 -0
- package/src/escrow-crypto.test.ts +75 -0
- package/src/escrow-crypto.ts +43 -1
- package/src/escrow-enrollment-intent.ts +2 -1
- package/src/index.ts +8 -1
- package/src/sss-authority.test.ts +392 -32
- package/src/sss-strategy.ts +66 -8
package/README.md
CHANGED
|
@@ -76,6 +76,15 @@ The escrow P-256 SPKI comes only from signed `user_data`, not the NSM `public_ke
|
|
|
76
76
|
mode. The strategy sends a fresh hex nonce on each attestation GET; software mode ignores the nonce
|
|
77
77
|
and continues to require a pinned public key.
|
|
78
78
|
|
|
79
|
+
### Escrow authority tenant
|
|
80
|
+
|
|
81
|
+
`escrow.authorityTenant` is the enclave's measured authority label. The strategy uses it for every
|
|
82
|
+
value the enclave signs or verifies (intent tenant, authority state, hold and code-delivery records,
|
|
83
|
+
persisted recovery expectations); `tenantId` stays the `X-Tenant-Id` and branding tenant. It defaults
|
|
84
|
+
to `tenantId`, then `'learncard'`. Set it when an app shares another tenant's enclave (VetPass will use
|
|
85
|
+
`'learncard'` once its escrow is on). Validly signed evidence for another label throws `EscrowAuthorityTenantMismatchError`,
|
|
86
|
+
a subclass of `EscrowEvidenceError`.
|
|
87
|
+
|
|
79
88
|
- **Device Share**: Encrypted with non-extractable AES-GCM key stored in IndexedDB
|
|
80
89
|
- **Auth Share**: Server-side envelope encryption (DEK + KMS-encrypted DEK)
|
|
81
90
|
- **Recovery Share**: Password-based uses Argon2id KDF with secure parameters
|
|
@@ -115,12 +115,13 @@ export declare const resolveEscrowEnrollmentAction: (current: Pick<EscrowAuthori
|
|
|
115
115
|
/** P2-d cross-language contract: mirrors the enclave's Carry contact-field
|
|
116
116
|
* rejection rule (`apply_enrollment_intent` in authority.rs) — true means
|
|
117
117
|
* the enclave would refuse this target blob. The enclave always fills
|
|
118
|
-
* recoveryEmail/recoveryLanguage
|
|
119
|
-
* target that already claims
|
|
118
|
+
* recoveryEmail/recoveryLanguage (and, D21, the sealed recoveryBrand) in from
|
|
119
|
+
* the source blob on carry, so a target that already claims any of them is
|
|
120
|
+
* refused. Shared by
|
|
120
121
|
* `escrow-carry-contact-contract-v1.json`'s TS and Rust tests, and by any
|
|
121
122
|
* caller (e.g. a test fake) that wants to fail the same way the real
|
|
122
123
|
* enclave does instead of accepting a shape it would reject. */
|
|
123
|
-
export declare const violatesCarryContactRule: (action: EscrowEnrollmentIntent["action"], target: Pick<EscrowBlobPlaintext, "recoveryEmail" | "recoveryLanguage"> | null) => boolean;
|
|
124
|
+
export declare const violatesCarryContactRule: (action: EscrowEnrollmentIntent["action"], target: Pick<EscrowBlobPlaintext, "recoveryEmail" | "recoveryLanguage" | "recoveryBrand"> | null) => boolean;
|
|
124
125
|
/** Owner-only mutation selection. Recovery itself never calls this helper.
|
|
125
126
|
* P9.1 (attack C): `recoveryEmail`/`recoveryLanguage` are always supplied by the
|
|
126
127
|
* caller (the device's authenticated account email + app locale) but are only
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"escrow-authority.d.ts","sourceRoot":"","sources":["../src/escrow-authority.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"escrow-authority.d.ts","sourceRoot":"","sources":["../src/escrow-authority.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAMvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,KAAK,EACR,sBAAsB,EACtB,4BAA4B,EAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EACR,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,0BAA0B,CAAC;AAMlC;kFACkF;AAClF,eAAO,MAAM,qBAAqB,GAC9B,UAAU;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,EAC5B,OAAO,MAAM,EACb,UAAU;IACN,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB,EACD,UAAU,uBAAuB,KAClC,OAAO,CAAC;IACP,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IACtE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,SAAS,GAAG,aAAa,CAAC;CAC7C,CAiCA,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,GACjC,UAAU;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,EAC/C,UAAU;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC7E,UAAU,uBAAuB,KAClC,OAAO,CAAC,OAAO,CAajB,CAAC;AA4EF;uFACuF;AACvF,eAAO,MAAM,2BAA2B,GACpC,QAAQ,uBAAuB,KAChC,OAAO,CAAC,MAAM,EAAE,CAclB,CAAC;AA2IF,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,GACnC,UAAU,OAAO,EACjB,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,KAAK,MAAM,EACX,UAAU,uBAAuB,KAClC,OAAO,CAAC,oBAAoB,CAiB9B,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,4BAA4B,GACrC,UAAU,OAAO,EACjB,QAAQ,sBAAsB,EAC9B,UAAU,uBAAuB,KAClC,OAAO,CAAC,sBAAsB,CA0ChC,CAAC;AAEF;;8DAE8D;AAC9D,MAAM,WAAW,oBAAoB;IACjC,IAAI,EAAE;QACF,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,KAAK,CAAC;QAC9B,wBAAwB,EAAE,MAAM,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACtB;AAiCD;;;;;;;;;;iFAUiF;AACjF,eAAO,MAAM,sBAAsB,GAC/B,QAAQ,oBAAoB,EAC5B,UAAU;IACN,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,wBAAwB,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAClB,EACD,UAAU,uBAAuB,EACjC,aAAa,wBAAwB,KACtC,OAAO,CAAC,kBAAkB,CAgC5B,CAAC;AAEF;;;;;;;;;;;6DAW6D;AAC7D,eAAO,MAAM,4BAA4B,GACrC,SAAS,OAAO,EAChB,QAAQ,oBAAoB,EAC5B,UAAU;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,EACtE,UAAU,uBAAuB,KAClC,OAAO,CAAC,qBAAqB,CAoC/B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,WAAW,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpF;;;;;;;;;yEASyE;AACzE,eAAO,MAAM,6BAA6B,GACtC,SAAS,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,QAAQ,CAAC,EACxD,OAAO,2BAA2B,KACnC;IACC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACzC,SAAS,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,oBAAoB,EAAE,OAAO,CAAC;CAsBjC,CAAC;AAEF;;;;;;;;gEAQgE;AAChE,eAAO,MAAM,wBAAwB,GACjC,QAAQ,sBAAsB,CAAC,QAAQ,CAAC,EACxC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,eAAe,GAAG,kBAAkB,GAAG,eAAe,CAAC,GAAG,IAAI,KACjG,OAGgF,CAAC;AAEpF;;;;6EAI6E;AAC7E,eAAO,MAAM,4BAA4B,GAAU,OAAO;IACtD,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,2BAA2B,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC5B,KAAG,OAAO,CAAC,4BAA4B,CAoCvC,CAAC"}
|
|
@@ -3,6 +3,21 @@ import type { EscrowEnvelope } from './escrow-crypto';
|
|
|
3
3
|
export declare class EscrowEvidenceError extends Error {
|
|
4
4
|
constructor();
|
|
5
5
|
}
|
|
6
|
+
/** Shape of an escrow authority tenant label (mirrors the enclave's measured label check). */
|
|
7
|
+
export declare const ESCROW_AUTHORITY_TENANT_PATTERN: RegExp;
|
|
8
|
+
/**
|
|
9
|
+
* Validly signed evidence bound to a different authority tenant than this client expects.
|
|
10
|
+
* The enclave is single-tenant (its measured `ESCROW_AUTHORITY_TENANT` label), so this is
|
|
11
|
+
* a deployment misconfiguration, not a forgery: the app's `escrowAuthorityTenant` does not
|
|
12
|
+
* match the enclave it talks to. Still an {@link EscrowEvidenceError}, so every existing
|
|
13
|
+
* fail-closed path treats it the same way; only the message is specific. Labels are public
|
|
14
|
+
* deployment identifiers, never user data.
|
|
15
|
+
*/
|
|
16
|
+
export declare class EscrowAuthorityTenantMismatchError extends EscrowEvidenceError {
|
|
17
|
+
readonly expectedTenant: string;
|
|
18
|
+
readonly signedTenant: string;
|
|
19
|
+
constructor(expectedTenant: string, signedTenant: string);
|
|
20
|
+
}
|
|
6
21
|
/** Opt-in for previously issued hold evidence only. Measurements are SHA-256
|
|
7
22
|
* hashes of complete configured PCR0/1/2 tuples, never server-supplied values.
|
|
8
23
|
* The original authority generation and current attested ledger key remain pinned.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"escrow-authority.types.d.ts","sourceRoot":"","sources":["../src/escrow-authority.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,yFAAyF;AACzF,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED;;;qFAGqF;AACrF,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,IAAI,CAAC;IACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,mBAAmB,EAAE,MAAM,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,WAAW,uBAAuB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AAED,MAAM,WAAW,qBAAqB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;IACxC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACnC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,qBAAqB,CAAC;CAClC"}
|
|
1
|
+
{"version":3,"file":"escrow-authority.types.d.ts","sourceRoot":"","sources":["../src/escrow-authority.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,yFAAyF;AACzF,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AAExE;;;;;;;GAOG;AACH,qBAAa,kCAAmC,SAAQ,mBAAmB;IACvE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAElB,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CAU3D;AAED;;;qFAGqF;AACrF,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,IAAI,CAAC;IACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,mBAAmB,EAAE,MAAM,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,WAAW,uBAAuB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AAED,MAAM,WAAW,qBAAqB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;IACxC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACnC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,qBAAqB,CAAC;CAClC"}
|
package/dist/escrow-crypto.d.ts
CHANGED
|
@@ -24,7 +24,11 @@ export declare const RECOVERY_LANGUAGES: readonly ["en", "es", "fr", "ar"];
|
|
|
24
24
|
/** Recovery share bound to an identity and a positive share version.
|
|
25
25
|
* `recoveryEmail`/`recoveryLanguage`: bound by the user's own device at
|
|
26
26
|
* enrollment, never by lca-api. Always both-present or both-absent; changing
|
|
27
|
-
* the address requires a fresh `replace` enrollment, not an edit.
|
|
27
|
+
* the address requires a fresh `replace` enrollment, not an edit.
|
|
28
|
+
* `recoveryBrand` (D21): display name for enclave-sent recovery emails, sealed
|
|
29
|
+
* by the owner's device at enrollment alongside the contact. Not in the signed
|
|
30
|
+
* intent; canonical per `canonicalEscrowEmailBrand`, and silently dropped
|
|
31
|
+
* (never an error) when invalid so recovery is never refused over display text. */
|
|
28
32
|
export interface EscrowBlobPlaintext {
|
|
29
33
|
version: typeof ESCROW_ENVELOPE_VERSION;
|
|
30
34
|
recoveryShare: string;
|
|
@@ -33,11 +37,25 @@ export interface EscrowBlobPlaintext {
|
|
|
33
37
|
pinVerifier?: string;
|
|
34
38
|
recoveryEmail?: string;
|
|
35
39
|
recoveryLanguage?: string;
|
|
40
|
+
recoveryBrand?: string;
|
|
36
41
|
}
|
|
37
42
|
/** Released recovery share additionally bound to its recovery hold. */
|
|
38
43
|
export interface EscrowReleasePlaintext extends EscrowBlobPlaintext {
|
|
39
44
|
holdId: string;
|
|
40
45
|
}
|
|
46
|
+
/** D21: longest canonical email brand, in characters (ASCII only, so also bytes). */
|
|
47
|
+
export declare const MAX_ESCROW_EMAIL_BRAND_LENGTH = 32;
|
|
48
|
+
/** D21: most digits an escrow email brand may contain, in total (not per run). */
|
|
49
|
+
export declare const MAX_ESCROW_EMAIL_BRAND_DIGITS = 3;
|
|
50
|
+
/** D21: canonical form of an owner-sealed escrow email brand, or `undefined` if
|
|
51
|
+
* it is not acceptable display text. Mirrors the enclave's `canonical_brand`
|
|
52
|
+
* (crypto.rs) exactly; both are pinned by escrow-email-brand-contract-v1.json.
|
|
53
|
+
* Trims and collapses runs of ASCII space only (every other whitespace or
|
|
54
|
+
* control character rejects); allows only `A-Z a-z 0-9`, space, `-`, `'`, `&`;
|
|
55
|
+
* must start with a letter, be 1-32 characters, contain at most 3 digits in total
|
|
56
|
+
* (not per run, so `Code 123 456 78` rejects) and no `http`/`www` in any case. ASCII-only by design: no URL, address, bidi or
|
|
57
|
+
* homoglyph can be formed, and no RFC 2047 encoding is ever needed. */
|
|
58
|
+
export declare const canonicalEscrowEmailBrand: (raw: unknown) => string | undefined;
|
|
41
59
|
/** Validate an untrusted envelope before decryption, copying only recognized fields. */
|
|
42
60
|
export declare const parseEscrowEnvelope: (value: unknown) => EscrowEnvelope;
|
|
43
61
|
/** Validate blob plaintext, normalize hex to lowercase, and omit unknown fields. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"escrow-crypto.d.ts","sourceRoot":"","sources":["../src/escrow-crypto.ts"],"names":[],"mappings":"AAQA,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,EAAG,CAAU,CAAC;AAClD,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,+BAAwC,CAAC;AACzE,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAC3D,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AAEtD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,OAAO,uBAAuB,CAAC;IACxC,SAAS,EAAE,OAAO,gBAAgB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;yFACyF;AACzF,eAAO,MAAM,kBAAkB,mCAAoC,CAAC;AAEpE
|
|
1
|
+
{"version":3,"file":"escrow-crypto.d.ts","sourceRoot":"","sources":["../src/escrow-crypto.ts"],"names":[],"mappings":"AAQA,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,EAAG,CAAU,CAAC;AAClD,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,+BAAwC,CAAC;AACzE,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAC3D,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AAEtD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,OAAO,uBAAuB,CAAC;IACxC,SAAS,EAAE,OAAO,gBAAgB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;yFACyF;AACzF,eAAO,MAAM,kBAAkB,mCAAoC,CAAC;AAEpE;;;;;;;mFAOmF;AACnF,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,OAAO,uBAAuB,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IAC/D,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,qFAAqF;AACrF,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C;;;;;;;uEAOuE;AACvE,eAAO,MAAM,yBAAyB,GAAI,KAAK,OAAO,KAAG,MAAM,GAAG,SAgBjE,CAAC;AA+BF,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,cAkBpD,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,mBAiEzD,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,GAAI,OAAO,OAAO,KAAG,sBAQ5D,CAAC;AA0BF,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACtB,CAUA,CAAC;AA8FF,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAC1B,OAAO,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,EAC3C,yBAAyB,MAAM,EAC/B,OAAO,MAAM,KACd,OAAO,CAAC,cAAc,CASxB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,GAC1B,UAAU,OAAO,EACjB,2BAA2B,MAAM,KAClC,OAAO,CAAC,mBAAmB,CAGzB,CAAC;AAEN,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,GAC1B,OAAO,IAAI,CAAC,sBAAsB,EAAE,SAAS,CAAC,EAC9C,iCAAiC,MAAM,KACxC,OAAO,CAAC,cAAc,CASxB,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,GAC1B,UAAU,OAAO,EACjB,mCAAmC,MAAM,KAC1C,OAAO,CAAC,sBAAsB,CAG5B,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"escrow-enrollment-intent.d.ts","sourceRoot":"","sources":["../src/escrow-enrollment-intent.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"escrow-enrollment-intent.d.ts","sourceRoot":"","sources":["../src/escrow-enrollment-intent.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACR,sBAAsB,EACtB,4BAA4B,EAC/B,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,+BAA+B,4CAA4C,CAAC;AAkFzF,uFAAuF;AACvF,eAAO,MAAM,4BAA4B,GACrC,QAAQ,sBAAsB,KAC/B,UAAU,CAAC,WAAW,CA8ExB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,GACnC,QAAQ,sBAAsB,EAC9B,YAAY,MAAM,KACnB,OAAO,CAAC,4BAA4B,CAgBtC,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,GAAU,OAAO,cAAc,KAAG,OAAO,CAAC,MAAM,CAiCjF,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -11,12 +11,12 @@ export type { DeviceShareEntry } from './storage';
|
|
|
11
11
|
export { encryptWithPassword, decryptWithPassword, deriveKeyFromPassword, generateEd25519PrivateKey, hexToBytes, bytesToHex, bufferToBase64, base64ToBuffer, DEFAULT_KDF_PARAMS, } from './crypto';
|
|
12
12
|
export { EMAIL_RELAY_ALGORITHM, EMAIL_RELAY_ENVELOPE_VERSION, encryptEmailRelayPayload, decryptEmailRelayPayload, generateEmailRelayConfirmationCode, parseEmailRelayEnvelope, parseEmailRelayPlaintext, } from './email-relay-crypto';
|
|
13
13
|
export type { EmailRelayBranding, EmailRelayEnvelope, EmailRelayPlaintext, } from './email-relay-crypto';
|
|
14
|
-
export { ESCROW_ENVELOPE_VERSION, ESCROW_ALGORITHM, ESCROW_BLOB_INFO, ESCROW_RELEASE_INFO, ESCROW_CLIENT_KEY_ID, parseEscrowEnvelope, parseEscrowBlobPlaintext, parseEscrowReleasePlaintext, generateEscrowKeyPair, encryptEscrowBlob, decryptEscrowBlob, sealEscrowRelease, openEscrowRelease, } from './escrow-crypto';
|
|
14
|
+
export { ESCROW_ENVELOPE_VERSION, ESCROW_ALGORITHM, ESCROW_BLOB_INFO, ESCROW_RELEASE_INFO, ESCROW_CLIENT_KEY_ID, parseEscrowEnvelope, parseEscrowBlobPlaintext, parseEscrowReleasePlaintext, canonicalEscrowEmailBrand, MAX_ESCROW_EMAIL_BRAND_LENGTH, MAX_ESCROW_EMAIL_BRAND_DIGITS, generateEscrowKeyPair, encryptEscrowBlob, decryptEscrowBlob, sealEscrowRelease, openEscrowRelease, } from './escrow-crypto';
|
|
15
15
|
export type { EscrowEnvelope, EscrowBlobPlaintext, EscrowReleasePlaintext } from './escrow-crypto';
|
|
16
16
|
export { encodeEscrowEnrollmentIntent, signEscrowEnrollmentIntent, getEscrowBlobIdentity, ESCROW_ENROLLMENT_INTENT_DOMAIN, } from './escrow-enrollment-intent';
|
|
17
17
|
export type { EscrowEnrollmentIntent, SignedEscrowEnrollmentIntent, } from './escrow-enrollment-intent.types';
|
|
18
18
|
export { verifyEnclaveAttestation } from './escrow-attestation';
|
|
19
|
-
export { EscrowEvidenceError } from './escrow-authority.types';
|
|
19
|
+
export { EscrowEvidenceError, EscrowAuthorityTenantMismatchError, ESCROW_AUTHORITY_TENANT_PATTERN, } from './escrow-authority.types';
|
|
20
20
|
export type { HistoricalEscrowEvidence } from './escrow-authority.types';
|
|
21
21
|
export type { EscrowRecoveryExpectations } from '@learncard/types';
|
|
22
22
|
export { verifyEscrowAuthorityState, verifyEscrowHoldState, verifyEscrowCodeDelivery, verifyEscrowEnrollmentCommit, createEscrowEnrollmentIntent, resolveEscrowEnrollmentAction, violatesCarryContactRule, } from './escrow-authority';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,GAClC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACR,sBAAsB,EACtB,4BAA4B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,GAClC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACR,sBAAsB,EACtB,4BAA4B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACH,mBAAmB,EACnB,kCAAkC,EAClC,+BAA+B,GAClC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,wBAAwB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnG,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EACR,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,EACzB,mBAAmB,GACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,mCAAmC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACH,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACR,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,iBAAiB,EACjB,6BAA6B,EAC7B,oCAAoC,EACpC,kBAAkB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACR,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACH,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACtB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EACR,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACtB,MAAM,SAAS,CAAC"}
|