@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.149

package/dist/account-key.d.ts

@@ -0,0 +1,176 @@
+/** Why an account-key operation failed. Never carries secret material. */
+export type AccountKeyErrorCode = 
+/** The password is too short, too long, or (in the facade) too weak. */
+"weak_password"
+/** Wrong password or recovery key (authentication failed after the KDF), or a recovery key for another account key. */
+ | "wrong_secret"
+/** A typed recovery key is not well formed (prefix, length, character or check). */
+ | "invalid_recovery_key"
+/** KDF parameters outside the bounds a client will run. */
+ | "params"
+/** Not a well-formed, canonical v1 bundle. */
+ | "encoding"
+/** The control plane limited this account's fetches or writes. */
+ | "rate_limited"
+/** The account is in strict mode: no account key exists. */
+ | "strict_mode"
+/** The account has no account key yet. */
+ | "no_account_key"
+/** The caller's signal aborted. */
+ | "cancelled"
+/** The account key changed underneath this operation (version conflict); fetch and retry. */
+ | "conflict"
+/** This account key is already set up (setup refused). */
+ | "already_set_up"
+/** The operation needs the key unlocked on this device first. */
+ | "locked"
+/** The control plane or replica refused or was unreachable; the local state is unchanged. */
+ | "unavailable"
+/** An invalid response or an SDK bug. */
+ | "internal";
+export declare class AccountKeyError extends Error {
+    readonly code: AccountKeyErrorCode;
+    /** A machine-readable detail: `too_short`, `too_long`, `strength`, `wrong_prefix`, `checksum`, …, or a control-plane error code. */
+    readonly reason?: string;
+    readonly retryAfterMs?: number;
+    constructor(code: AccountKeyErrorCode, message: string, extra?: {
+        reason?: string;
+        retryAfterMs?: number;
+    });
+}
+/** `H(tag, m) = SHA-256(u8(len(tag)) ‖ tag ‖ m)` (`00-overview.md` §4). */
+export declare function domainHash(tag: string, m: Uint8Array): Uint8Array;
+/** Wipe a secret buffer (best effort). */
+export declare function wipe(...buffers: Uint8Array[]): void;
+/** Random bytes from the platform CSPRNG. Hosts may inject their own in tests. */
+export type Entropy = (n: number) => Uint8Array;
+export declare const platformEntropy: Entropy;
+export declare function uuidBytes(id: string): Uint8Array;
+/** A fresh account secret `R`. */
+export declare function generateRecoveryKey(entropy?: Entropy): Uint8Array;
+/**
+ * The text to show once and have the user write down:
+ * `MDB1-XXXXX-…` (Crockford base32 of `R ‖ check`, 55 characters in groups of five).
+ */
+export declare function formatRecoveryKey(secret: Uint8Array): string;
+/**
+ * Parse what the user typed or pasted. Case, spaces and dashes don't matter, and the
+ * Crockford look-alikes `O`→`0`, `I`/`L`→`1` are accepted. The check catches typos
+ * only; it is not a secret.
+ */
+export declare function parseRecoveryKey(input: string): Uint8Array;
+/** The recovery device a recovery key derives for one collection (`sealed-envelope.md` §5.4). */
+export interface RecoveryDevice {
+    /** `first 16 bytes of H("mdbase/v1/recovery-id", collection ‖ sign_pk)`, as a UUID. */
+    device: string;
+    /** Ed25519 seed (secret). */
+    signSeed: Uint8Array;
+    signPk: Uint8Array;
+    /** X25519 private key (secret). */
+    kemSk: Uint8Array;
+    kemPk: Uint8Array;
+    /** The recovery device has no Noise key: 32 zero bytes. */
+    noisePk: Uint8Array;
+}
+/**
+ * Derive this collection's recovery device from `R`:
+ * `seed = HKDF-SHA256(ikm = R, salt = collection, info = "mdbase/v1/recovery-sign" | "-kem")`.
+ */
+export declare function deriveRecoveryDevice(secret: Uint8Array, collection: string): RecoveryDevice;
+/** Sign with the recovery device (the proof of possession for enrolment, AK1 §5.3). */
+export declare function recoverySign(d: RecoveryDevice, message: Uint8Array): Uint8Array;
+/** Wipe a derived recovery device's secrets. */
+export declare function wipeRecoveryDevice(d: RecoveryDevice): void;
+/**
+ * The account key's proof signer: `seed = HKDF-SHA256(ikm = R, salt = account, info =
+ * "mdbase/v1/account-key-proof")`, an Ed25519 key registered with the bundle. Replacing
+ * a bundle (change password, recover) must be signed by it, so a signed-in device alone
+ * cannot overwrite the bundle with junk.
+ */
+export interface AccountKeyProof {
+    /** Ed25519 seed (secret). */
+    seed: Uint8Array;
+    pk: Uint8Array;
+}
+export declare function deriveAccountKeyProof(secret: Uint8Array, account: string): AccountKeyProof;
+/** `H("mdbase/v1/account-key-rewrap", cbor[account, sha256(bundle), expected_version])`, signed by the proof key. */
+export declare function accountKeyRewrapDigest(account: string, bundleBytes: Uint8Array, expectedVersion: number): Uint8Array;
+export declare function signAccountKeyRewrap(proof: AccountKeyProof, account: string, bundleBytes: Uint8Array, expectedVersion: number): Uint8Array;
+export declare const BUNDLE_VERSION = 1;
+export declare const KDF_ARGON2ID = 1;
+export declare const MAX_BUNDLE_BYTES = 512;
+/** Minimum password length, in Unicode scalar values after NFKC. */
+export declare const MIN_PASSWORD_CHARS = 12;
+/** Maximum password length, in UTF-8 bytes before and after NFKC. */
+export declare const MAX_PASSWORD_BYTES = 1024;
+/** v1 defaults: within the 32 MiB mobile/webview budget. */
+export declare const DEFAULT_KDF: {
+    readonly mKib: 19456;
+    readonly t: 3;
+    readonly p: 1;
+};
+export interface KdfParams {
+    /** Memory in KiB. */
+    mKib: number;
+    /** Passes. */
+    t: number;
+    /** Lanes. */
+    p: number;
+    /** 16 random bytes. */
+    salt: Uint8Array;
+}
+export interface Bundle {
+    kdf: KdfParams;
+    /** 24 bytes. */
+    nonce: Uint8Array;
+    /** `R` sealed: 32 + 16 bytes. */
+    ct: Uint8Array;
+    /** `keyId(R)`. */
+    keyId: Uint8Array;
+}
+/** The public id of an account key: which `R` a bundle wraps. */
+export declare function keyId(secret: Uint8Array): Uint8Array;
+export declare function checkKdfParams(k: KdfParams): void;
+/** Canonical encoding. */
+export declare function encodeBundle(b: Bundle): Uint8Array;
+/** Strict decoding: canonical bytes only, bounded size, exact shape. */
+export declare function decodeBundle(bytes: Uint8Array): Bundle;
+/** NFKC, bounded before and after normalisation; at least 12 scalar values. */
+export declare function normalizePassword(password: string): Uint8Array;
+/** Length policy only (the strength meter is `passwordStrength`). */
+export declare function checkPassword(password: string): void;
+/**
+ * Runs Argon2id. Hosts replace the default to move the work off the UI thread (a
+ * Worker, or native code); the result must equal RFC 9106 Argon2id v1.3 with the
+ * given cost and a 32-byte output. Parameters are already bounded when called.
+ */
+export type Argon2idRunner = (password: Uint8Array, salt: Uint8Array, params: {
+    mKib: number;
+    t: number;
+    p: number;
+}, signal?: AbortSignal) => Promise<Uint8Array>;
+/**
+ * The default runner: noble's asynchronous Argon2id on the calling thread, yielding to
+ * the event loop and cancelling at the next progress tick after `signal` aborts. It
+ * blocks UI frames between ticks; browser and native hosts should supply a Worker.
+ */
+export declare const inlineArgon2id: Argon2idRunner;
+export interface SealOptions {
+    /** Default: the v1 cost with a fresh salt. */
+    kdf?: KdfParams;
+    /** Default: 24 random bytes. */
+    nonce?: Uint8Array;
+    entropy?: Entropy;
+    argon2id?: Argon2idRunner;
+    signal?: AbortSignal;
+}
+/** Seal `secret` under `password` for `account`. */
+export declare function sealBundle(secret: Uint8Array, password: string, account: string, options?: SealOptions): Promise<Bundle>;
+export interface OpenOptions {
+    argon2id?: Argon2idRunner;
+    signal?: AbortSignal;
+}
+/** Open a bundle with `password` for `account`; checks the key id of what it opens. */
+export declare function openBundle(b: Bundle, password: string, account: string, options?: OpenOptions): Promise<Uint8Array>;
+/** Accept a typed recovery key as the account key of `bundle` (forgotten password). */
+export declare function checkRecoveryKey(secret: Uint8Array, b: Bundle): void;

package/dist/account-key.js

@@ -0,0 +1,409 @@
+/**
+ * The account key (AK1, account-key bundle design):
+ * the user's account secret `R` (their recovery key), sealed under their encryption
+ * password for the control plane to store and hand back to a signed-in device.
+ *
+ * Byte-for-byte the Rust `mdbn-replica` `crypto::account_key` and `crypto::recovery`
+ * modules; `conformance/crypto/account-key/` and `conformance/crypto/recovery-key/`
+ * pin both.
+ *
+ * ```text
+ * key_id = H("mdbase/v1/account-key-id", R)
+ * kek    = Argon2id(NFKC(password), salt, m_kib, t, p, out = 32)
+ * aad    = H("mdbase/v1/account-key-bundle", cbor[1, account, key_id, kdf])
+ * ct     = XChaCha20-Poly1305(kek, nonce, R, aad)
+ * bundle = cbor{0: 1, 1: kdf, 2: nonce, 3: ct, 4: key_id}
+ * kdf    = [1 (Argon2id v1.3), m_kib, t, p, salt(16)]
+ * ```
+ *
+ * The control plane never sees `R` or the password. KDF parameters come from the
+ * (untrusted) bundle, so they are bounded both ways before any memory is allocated.
+ * Secrets are `Uint8Array`s wiped after use (best effort; JS strings cannot be wiped).
+ */
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { ed25519, x25519 } from "@noble/curves/ed25519.js";
+import { argon2idAsync } from "@noble/hashes/argon2.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesEqual, decode, encode, structMap } from "./cbor.js";
+export class AccountKeyError extends Error {
+    code;
+    /** A machine-readable detail: `too_short`, `too_long`, `strength`, `wrong_prefix`, `checksum`, …, or a control-plane error code. */
+    reason;
+    retryAfterMs;
+    constructor(code, message, extra = {}) {
+        super(message);
+        this.name = "AccountKeyError";
+        this.code = code;
+        if (extra.reason !== undefined)
+            this.reason = extra.reason;
+        if (extra.retryAfterMs !== undefined)
+            this.retryAfterMs = extra.retryAfterMs;
+    }
+}
+const err = (code, message, reason) => new AccountKeyError(code, message, reason === undefined ? {} : { reason });
+// ------------------------------------------------------------------ hashing
+const utf8 = new TextEncoder();
+/** `H(tag, m) = SHA-256(u8(len(tag)) ‖ tag ‖ m)` (`00-overview.md` §4). */
+export function domainHash(tag, m) {
+    const t = utf8.encode(tag);
+    if (t.length > 255)
+        throw err("internal", "domain tag longer than 255 bytes");
+    return sha256(concat(Uint8Array.of(t.length), t, m));
+}
+function concat(...parts) {
+    let n = 0;
+    for (const p of parts)
+        n += p.length;
+    const out = new Uint8Array(n);
+    let o = 0;
+    for (const p of parts) {
+        out.set(p, o);
+        o += p.length;
+    }
+    return out;
+}
+/** Constant-time equality for short secrets. */
+function ctEq(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let d = 0;
+    for (let i = 0; i < a.length; i++)
+        d |= a[i] ^ b[i];
+    return d === 0;
+}
+/** Wipe a secret buffer (best effort). */
+export function wipe(...buffers) {
+    for (const b of buffers)
+        b.fill(0);
+}
+export const platformEntropy = (n) => crypto.getRandomValues(new Uint8Array(n));
+// ------------------------------------------------------------------ UUIDs
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function uuidBytes(id) {
+    if (!UUID.test(id))
+        throw err("internal", "not a UUID");
+    const hex = id.replace(/-/g, "").toLowerCase();
+    const out = new Uint8Array(16);
+    for (let i = 0; i < 16; i++)
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return out;
+}
+function uuidText(b) {
+    let h = "";
+    for (const x of b)
+        h += x.toString(16).padStart(2, "0");
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+// ------------------------------------------------------------------ recovery key
+const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"; // Crockford: no I, L, O, U
+const PREFIX = "MDB1";
+const SECRET_LEN = 32;
+const CHECK_LEN = 2;
+const BODY_CHARS = 55; // ceil(34 * 8 / 5)
+/** A fresh account secret `R`. */
+export function generateRecoveryKey(entropy = platformEntropy) {
+    const r = entropy(SECRET_LEN);
+    if (r.length !== SECRET_LEN)
+        throw err("internal", "entropy returned the wrong length");
+    return r;
+}
+function check(secret) {
+    return domainHash("mdbase/v1/recovery-key-check", secret).subarray(0, CHECK_LEN);
+}
+/**
+ * The text to show once and have the user write down:
+ * `MDB1-XXXXX-…` (Crockford base32 of `R ‖ check`, 55 characters in groups of five).
+ */
+export function formatRecoveryKey(secret) {
+    if (secret.length !== SECRET_LEN)
+        throw err("internal", "recovery secret is 32 bytes");
+    const raw = concat(secret, check(secret));
+    let body = "";
+    let acc = 0;
+    let bits = 0;
+    for (const b of raw) {
+        acc = (acc << 8) | b;
+        bits += 8;
+        while (bits >= 5) {
+            body += ALPHABET[(acc >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+        acc &= (1 << bits) - 1;
+    }
+    if (bits > 0)
+        body += ALPHABET[(acc << (5 - bits)) & 31];
+    wipe(raw);
+    return [PREFIX, ...body.match(/.{1,5}/g)].join("-");
+}
+/**
+ * Parse what the user typed or pasted. Case, spaces and dashes don't matter, and the
+ * Crockford look-alikes `O`→`0`, `I`/`L`→`1` are accepted. The check catches typos
+ * only; it is not a secret.
+ */
+export function parseRecoveryKey(input) {
+    if (typeof input !== "string" || input.length > 4096)
+        throw err("invalid_recovery_key", "Not a recovery key.", "wrong_length");
+    let s = input.toUpperCase().replace(/[\s-]/g, "").replace(/O/g, "0").replace(/[IL]/g, "1");
+    if (!s.startsWith(PREFIX))
+        throw err("invalid_recovery_key", "A recovery key starts with MDB1.", "wrong_prefix");
+    s = s.slice(PREFIX.length);
+    if (s.length !== BODY_CHARS)
+        throw err("invalid_recovery_key", "A recovery key has 55 characters after MDB1.", "wrong_length");
+    const raw = new Uint8Array(SECRET_LEN + CHECK_LEN);
+    let acc = 0;
+    let bits = 0;
+    let o = 0;
+    for (const ch of s) {
+        const v = ALPHABET.indexOf(ch);
+        if (v < 0)
+            throw err("invalid_recovery_key", "A recovery key uses only Crockford base32 characters.", "bad_character");
+        acc = (acc << 5) | v;
+        bits += 5;
+        if (bits >= 8) {
+            if (o < raw.length)
+                raw[o++] = (acc >>> (bits - 8)) & 0xff;
+            bits -= 8;
+        }
+        acc &= (1 << bits) - 1;
+    }
+    // 55 × 5 = 275 bits: 272 data bits and 3 zero padding bits (one spelling per key).
+    if (o !== raw.length || acc !== 0)
+        throw err("invalid_recovery_key", "Not a recovery key.", "bad_character");
+    const secret = raw.slice(0, SECRET_LEN);
+    const ok = ctEq(check(secret), raw.subarray(SECRET_LEN));
+    wipe(raw);
+    if (!ok) {
+        wipe(secret);
+        throw err("invalid_recovery_key", "The recovery key has a typo (check failed).", "checksum");
+    }
+    return secret;
+}
+/**
+ * Derive this collection's recovery device from `R`:
+ * `seed = HKDF-SHA256(ikm = R, salt = collection, info = "mdbase/v1/recovery-sign" | "-kem")`.
+ */
+export function deriveRecoveryDevice(secret, collection) {
+    if (secret.length !== SECRET_LEN)
+        throw err("internal", "recovery secret is 32 bytes");
+    const c = uuidBytes(collection);
+    const signSeed = hkdf(sha256, secret, c, utf8.encode("mdbase/v1/recovery-sign"), 32);
+    const kemSk = hkdf(sha256, secret, c, utf8.encode("mdbase/v1/recovery-kem"), 32);
+    const signPk = ed25519.getPublicKey(signSeed);
+    const kemPk = x25519.getPublicKey(kemSk);
+    const device = uuidText(domainHash("mdbase/v1/recovery-id", concat(c, signPk)).subarray(0, 16));
+    return { device, signSeed, signPk, kemSk, kemPk, noisePk: new Uint8Array(32) };
+}
+/** Sign with the recovery device (the proof of possession for enrolment, AK1 §5.3). */
+export function recoverySign(d, message) {
+    return ed25519.sign(message, d.signSeed);
+}
+/** Wipe a derived recovery device's secrets. */
+export function wipeRecoveryDevice(d) {
+    wipe(d.signSeed, d.kemSk);
+}
+export function deriveAccountKeyProof(secret, account) {
+    if (secret.length !== SECRET_LEN)
+        throw err("internal", "recovery secret is 32 bytes");
+    const seed = hkdf(sha256, secret, uuidBytes(account), utf8.encode("mdbase/v1/account-key-proof"), 32);
+    return { seed, pk: ed25519.getPublicKey(seed) };
+}
+/** `H("mdbase/v1/account-key-rewrap", cbor[account, sha256(bundle), expected_version])`, signed by the proof key. */
+export function accountKeyRewrapDigest(account, bundleBytes, expectedVersion) {
+    if (!Number.isSafeInteger(expectedVersion) || expectedVersion < 0)
+        throw err("internal", "expected_version");
+    return domainHash("mdbase/v1/account-key-rewrap", encode([uuidBytes(account), sha256(bundleBytes), expectedVersion]));
+}
+export function signAccountKeyRewrap(proof, account, bundleBytes, expectedVersion) {
+    return ed25519.sign(accountKeyRewrapDigest(account, bundleBytes, expectedVersion), proof.seed);
+}
+// ------------------------------------------------------------------ bundle
+export const BUNDLE_VERSION = 1;
+export const KDF_ARGON2ID = 1;
+export const MAX_BUNDLE_BYTES = 512;
+/** Minimum password length, in Unicode scalar values after NFKC. */
+export const MIN_PASSWORD_CHARS = 12;
+/** Maximum password length, in UTF-8 bytes before and after NFKC. */
+export const MAX_PASSWORD_BYTES = 1024;
+/** v1 defaults: within the 32 MiB mobile/webview budget. */
+export const DEFAULT_KDF = { mKib: 19_456, t: 3, p: 1 };
+/** Parameters a client will run, whatever a bundle says (checked before allocating). */
+const MIN_M_KIB = 19_456;
+const MAX_M_KIB = 24_576;
+const MIN_T = 2;
+const MAX_T = 10;
+const MAX_P = 4;
+/** The public id of an account key: which `R` a bundle wraps. */
+export function keyId(secret) {
+    return domainHash("mdbase/v1/account-key-id", secret);
+}
+const uint = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+export function checkKdfParams(k) {
+    const ok = uint(k.mKib) && uint(k.t) && uint(k.p)
+        && k.mKib >= MIN_M_KIB && k.mKib <= MAX_M_KIB && k.t >= MIN_T && k.t <= MAX_T && k.p >= 1 && k.p <= MAX_P
+        && k.mKib >= 8 * k.p && k.salt instanceof Uint8Array && k.salt.length === 16;
+    if (!ok)
+        throw err("params", "Unsupported key derivation parameters.");
+}
+function kdfCbor(k) {
+    return [KDF_ARGON2ID, k.mKib, k.t, k.p, k.salt];
+}
+function kdfFromCbor(v) {
+    if (!Array.isArray(v) || v.length !== 5)
+        throw err("encoding", "Not an account key bundle.");
+    const [alg, m, t, p, salt] = v;
+    if (!uint(alg) || !uint(m) || !uint(t) || !uint(p) || !(salt instanceof Uint8Array) || salt.length !== 16) {
+        throw err("encoding", "Not an account key bundle.");
+    }
+    if (alg !== KDF_ARGON2ID || m > 0xffff_ffff || t > 0xffff_ffff || p > 0xffff_ffff)
+        throw err("params", "Unsupported key derivation parameters.");
+    return { mKib: m, t, p, salt };
+}
+/** Canonical encoding. */
+export function encodeBundle(b) {
+    return encode(structMap([
+        [0, BUNDLE_VERSION],
+        [1, kdfCbor(b.kdf)],
+        [2, b.nonce],
+        [3, b.ct],
+        [4, b.keyId],
+    ]));
+}
+/** Strict decoding: canonical bytes only, bounded size, exact shape. */
+export function decodeBundle(bytes) {
+    if (!(bytes instanceof Uint8Array) || bytes.length > MAX_BUNDLE_BYTES)
+        throw err("encoding", "Not an account key bundle.");
+    let v;
+    try {
+        v = decode(bytes);
+    }
+    catch {
+        throw err("encoding", "Not an account key bundle.");
+    }
+    if (!(v instanceof Map) || v.size !== 5 || [...v.keys()].join() !== "0,1,2,3,4")
+        throw err("encoding", "Not an account key bundle.");
+    const m = v;
+    const nonce = m.get(2);
+    const ct = m.get(3);
+    const id = m.get(4);
+    if (m.get(0) !== BUNDLE_VERSION || !(nonce instanceof Uint8Array) || nonce.length !== 24
+        || !(ct instanceof Uint8Array) || ct.length !== 48 || !(id instanceof Uint8Array) || id.length !== 32) {
+        throw err("encoding", "Not an account key bundle.");
+    }
+    const b = { kdf: kdfFromCbor(m.get(1)), nonce, ct, keyId: id };
+    if (!bytesEqual(encodeBundle(b), bytes))
+        throw err("encoding", "Not an account key bundle.");
+    return b;
+}
+// ------------------------------------------------------------------ password
+/** NFKC, bounded before and after normalisation; at least 12 scalar values. */
+export function normalizePassword(password) {
+    if (typeof password !== "string")
+        throw err("weak_password", "The password is required.", "too_short");
+    if (utf8.encode(password).length > MAX_PASSWORD_BYTES)
+        throw err("weak_password", "The password is too long.", "too_long");
+    const n = password.normalize("NFKC");
+    const bytes = utf8.encode(n);
+    if (bytes.length > MAX_PASSWORD_BYTES)
+        throw err("weak_password", "The password is too long.", "too_long");
+    if ([...n].length < MIN_PASSWORD_CHARS) {
+        wipe(bytes);
+        throw err("weak_password", `The password needs at least ${MIN_PASSWORD_CHARS} characters.`, "too_short");
+    }
+    return bytes;
+}
+/** Length policy only (the strength meter is `passwordStrength`). */
+export function checkPassword(password) {
+    wipe(normalizePassword(password));
+}
+/**
+ * The default runner: noble's asynchronous Argon2id on the calling thread, yielding to
+ * the event loop and cancelling at the next progress tick after `signal` aborts. It
+ * blocks UI frames between ticks; browser and native hosts should supply a Worker.
+ */
+export const inlineArgon2id = async (password, salt, params, signal) => {
+    const aborted = () => err("cancelled", "Key derivation cancelled.");
+    if (signal?.aborted)
+        throw aborted();
+    try {
+        return await argon2idAsync(password, salt, {
+            t: params.t,
+            m: params.mKib,
+            p: params.p,
+            dkLen: 32,
+            version: 0x13,
+            maxmem: MAX_M_KIB * 1024 + (1 << 20),
+            asyncTick: 20,
+            onProgress: () => {
+                if (signal?.aborted)
+                    throw aborted();
+            },
+        });
+    }
+    catch (e) {
+        if (e instanceof AccountKeyError)
+            throw e;
+        throw err("params", "Key derivation failed.");
+    }
+};
+async function kek(password, kdf, run, signal) {
+    checkKdfParams(kdf);
+    const pw = normalizePassword(password);
+    try {
+        const out = await run(pw, kdf.salt, { mKib: kdf.mKib, t: kdf.t, p: kdf.p }, signal);
+        if (!(out instanceof Uint8Array) || out.length !== 32)
+            throw err("internal", "The KDF runner returned the wrong length.");
+        return out;
+    }
+    finally {
+        wipe(pw);
+    }
+}
+function aad(account, id, kdf) {
+    return domainHash("mdbase/v1/account-key-bundle", encode([BUNDLE_VERSION, uuidBytes(account), id, kdfCbor(kdf)]));
+}
+/** Seal `secret` under `password` for `account`. */
+export async function sealBundle(secret, password, account, options = {}) {
+    if (secret.length !== SECRET_LEN)
+        throw err("internal", "recovery secret is 32 bytes");
+    checkPassword(password);
+    const entropy = options.entropy ?? platformEntropy;
+    const kdf = options.kdf ?? { ...DEFAULT_KDF, salt: entropy(16) };
+    const nonce = options.nonce ?? entropy(24);
+    if (nonce.length !== 24)
+        throw err("internal", "nonce is 24 bytes");
+    const id = keyId(secret);
+    const k = await kek(password, kdf, options.argon2id ?? inlineArgon2id, options.signal);
+    try {
+        const ct = xchacha20poly1305(k, nonce, aad(account, id, kdf)).encrypt(secret);
+        return { kdf, nonce, ct, keyId: id };
+    }
+    finally {
+        wipe(k);
+    }
+}
+/** Open a bundle with `password` for `account`; checks the key id of what it opens. */
+export async function openBundle(b, password, account, options = {}) {
+    const k = await kek(password, b.kdf, options.argon2id ?? inlineArgon2id, options.signal);
+    let plain;
+    try {
+        plain = xchacha20poly1305(k, b.nonce, aad(account, b.keyId, b.kdf)).decrypt(b.ct);
+    }
+    catch {
+        throw err("wrong_secret", "Wrong password.");
+    }
+    finally {
+        wipe(k);
+    }
+    if (plain.length !== SECRET_LEN || !ctEq(keyId(plain), b.keyId)) {
+        wipe(plain);
+        throw err("wrong_secret", "Wrong password.");
+    }
+    return plain;
+}
+/** Accept a typed recovery key as the account key of `bundle` (forgotten password). */
+export function checkRecoveryKey(secret, b) {
+    if (secret.length !== SECRET_LEN || !ctEq(keyId(secret), b.keyId))
+        throw err("wrong_secret", "This recovery key belongs to a different account key.");
+}
+//# sourceMappingURL=account-key.js.map

package/dist/account-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-key.js","sourceRoot":"","sources":["../src/account-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAkB,MAAM,WAAW,CAAC;AAmClF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAsB;IACnC,oIAAoI;IAC3H,MAAM,CAAU;IAChB,YAAY,CAAU;IAC/B,YAAY,IAAyB,EAAE,OAAe,EAAE,QAAoD,EAAE;QAC5G,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC/E,CAAC;CACF;AAED,MAAM,GAAG,GAAG,CAAC,IAAyB,EAAE,OAAe,EAAE,MAAe,EAAE,EAAE,CAC1E,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAE7E,6EAA6E;AAE7E,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,CAAa;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,kCAAkC,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gDAAgD;AAChD,SAAS,IAAI,CAAC,CAAa,EAAE,CAAa;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAI,CAAC,CAAC,CAAC,CAAY,CAAC;IAC5E,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,IAAI,CAAC,GAAG,OAAqB;IAC3C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAID,MAAM,CAAC,MAAM,eAAe,GAAY,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzF,2EAA2E;AAE3E,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAa;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,kFAAkF;AAElF,MAAM,QAAQ,GAAG,kCAAkC,CAAC,CAAC,2BAA2B;AAChF,MAAM,MAAM,GAAG,MAAM,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,mBAAmB;AAE1C,kCAAkC;AAClC,MAAM,UAAU,mBAAmB,CAAC,UAAmB,eAAe;IACpE,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,mCAAmC,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,MAAkB;IAC/B,OAAO,UAAU,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,MAAM,EAAE,GAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAC/H,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,GAAG,CAAC,sBAAsB,EAAE,kCAAkC,EAAE,cAAc,CAAC,CAAC;IACjH,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,GAAG,CAAC,sBAAsB,EAAE,8CAA8C,EAAE,cAAc,CAAC,CAAC;IAC/H,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC,sBAAsB,EAAE,uDAAuD,EAAE,eAAe,CAAC,CAAC;QACvH,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAC3D,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,mFAAmF;IACnF,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC;QAAE,MAAM,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,eAAe,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,MAAM,GAAG,CAAC,sBAAsB,EAAE,6CAA6C,EAAE,UAAU,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB,EAAE,UAAkB;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,CAAiB,EAAE,OAAmB;IACjE,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,kBAAkB,CAAC,CAAiB;IAClD,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAC,MAAkB,EAAE,OAAe;IACvE,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,EAAE,EAAE,CAAC,CAAC;IACtG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,WAAuB,EAAE,eAAuB;IACtG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC7G,OAAO,UAAU,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAsB,EAAE,OAAe,EAAE,WAAuB,EAAE,eAAuB;IAC5H,OAAO,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,4EAA4E;AAE5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AACjE,wFAAwF;AACxF,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,KAAK,GAAG,CAAC,CAAC;AAChB,MAAM,KAAK,GAAG,EAAE,CAAC;AACjB,MAAM,KAAK,GAAG,CAAC,CAAC;AAuBhB,iEAAiE;AACjE,MAAM,UAAU,KAAK,CAAC,MAAkB;IACtC,OAAO,UAAU,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAErG,MAAM,UAAU,cAAc,CAAC,CAAY;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;WAC5C,CAAC,CAAC,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;WACtG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC;IAC/E,IAAI,CAAC,EAAE;QAAE,MAAM,GAAG,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,CAAY;IAC3B,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,CAAY;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1G,MAAM,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,WAAW;QAAE,MAAM,GAAG,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAC;IACjJ,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,MAAM,CAAC,SAAS,CAAC;QACtB,CAAC,CAAC,EAAE,cAAc,CAAC;QACnB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACT,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;KACb,CAAC,CAAC,CAAC;AACN,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAC3H,IAAI,CAAY,CAAC;IACjB,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,WAAW;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IACrI,MAAM,CAAC,GAAG,CAA2B,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;WACnF,CAAC,CAAC,EAAE,YAAY,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,YAAY,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxG,MAAM,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,GAAW,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAc,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACpF,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,eAAe,EAAE,2BAA2B,EAAE,WAAW,CAAC,CAAC;IACvG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,kBAAkB;QAAE,MAAM,GAAG,CAAC,eAAe,EAAE,2BAA2B,EAAE,UAAU,CAAC,CAAC;IAC3H,MAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,MAAM,GAAG,CAAC,eAAe,EAAE,2BAA2B,EAAE,UAAU,CAAC,CAAC;IAC3G,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,MAAM,GAAG,CAAC,eAAe,EAAE,+BAA+B,kBAAkB,cAAc,EAAE,WAAW,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpC,CAAC;AAgBD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACrF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;IACpE,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE;YACzC,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,IAAI;YACd,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,GAAG,EAAE;gBACf,IAAI,MAAM,EAAE,OAAO;oBAAE,MAAM,OAAO,EAAE,CAAC;YACvC,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,eAAe;YAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC;AAEF,KAAK,UAAU,GAAG,CAAC,QAAgB,EAAE,GAAc,EAAE,GAAmB,EAAE,MAAoB;IAC5F,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpF,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,GAAG,CAAC,UAAU,EAAE,2CAA2C,CAAC,CAAC;QAC1H,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,OAAe,EAAE,EAAc,EAAE,GAAc;IAC1D,OAAO,UAAU,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpH,CAAC;AAYD,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,QAAgB,EAAE,OAAe,EAAE,UAAuB,EAAE;IAC/G,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACvF,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,GAAG,GAAc,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAOD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,QAAgB,EAAE,OAAe,EAAE,UAAuB,EAAE;IACtG,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACzF,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,MAAM,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,CAAS;IAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,GAAG,CAAC,cAAc,EAAE,uDAAuD,CAAC,CAAC;AACxJ,CAAC"}

package/dist/account.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `@mdbase-dev/sdk/account`: the private (E2E) multi-device enrolment surface (AK1 §7).
+ * Separate from the root entry because it carries Argon2id, Ed25519 and the strength
+ * meter, which the thin client never loads.
+ */
+export { AccountKeyError, BUNDLE_VERSION, DEFAULT_KDF, MAX_BUNDLE_BYTES, MAX_PASSWORD_BYTES, MIN_PASSWORD_CHARS, checkKdfParams, accountKeyRewrapDigest, checkPassword, checkRecoveryKey, decodeBundle, deriveAccountKeyProof, deriveRecoveryDevice, domainHash, encodeBundle, formatRecoveryKey, generateRecoveryKey, inlineArgon2id, keyId, normalizePassword, openBundle, parseRecoveryKey, recoverySign, sealBundle, signAccountKeyRewrap, wipe, wipeRecoveryDevice, } from "./account-key.js";
+export type { AccountKeyErrorCode, AccountKeyProof, Argon2idRunner, Bundle, Entropy, KdfParams, OpenOptions, RecoveryDevice, SealOptions, } from "./account-key.js";
+export { PrivateAccount, memorySecretStore } from "./private-account.js";
+export type { AccountKeyControlPort, AccountKeyMode, AccountKeyReplicaPort, AccountSecretStore, PrivateAccountPorts, PrivateAccountRequestOptions, PrivateAccountStatus, SetupResult, StrictPendingTarget, StrictResult, UnlockResult, } from "./private-account.js";
+export { passwordStrength } from "./strength.js";
+export type { Strength } from "./strength.js";

package/dist/account.js

@@ -0,0 +1,9 @@
+/**
+ * `@mdbase-dev/sdk/account`: the private (E2E) multi-device enrolment surface (AK1 §7).
+ * Separate from the root entry because it carries Argon2id, Ed25519 and the strength
+ * meter, which the thin client never loads.
+ */
+export { AccountKeyError, BUNDLE_VERSION, DEFAULT_KDF, MAX_BUNDLE_BYTES, MAX_PASSWORD_BYTES, MIN_PASSWORD_CHARS, checkKdfParams, accountKeyRewrapDigest, checkPassword, checkRecoveryKey, decodeBundle, deriveAccountKeyProof, deriveRecoveryDevice, domainHash, encodeBundle, formatRecoveryKey, generateRecoveryKey, inlineArgon2id, keyId, normalizePassword, openBundle, parseRecoveryKey, recoverySign, sealBundle, signAccountKeyRewrap, wipe, wipeRecoveryDevice, } from "./account-key.js";
+export { PrivateAccount, memorySecretStore } from "./private-account.js";
+export { passwordStrength } from "./strength.js";
+//# sourceMappingURL=account.js.map

package/dist/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EACtH,sBAAsB,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAC/J,mBAAmB,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAC3I,IAAI,EAAE,kBAAkB,GACzB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAKzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}