@oxy.so/core 1.16.0 → 1.18.1

package/src/server/securityHeaders.ts

@@ -372,9 +372,9 @@ export interface OxyPagesHeadersOptions {
    * violation for a script we never asked for. The rest of the value is Pages'
    * own default, so caching is unchanged.
    *
-   * And, because this origin is the web identity carrier — where a person's
-   * self-custody root is created, opened, recovered and moved (ADR 0028) — the
-   * rest of the holder policy: no `<base>` and no form posts (`base-uri` /
+   * And, because this origin is where a web account is created, recovered and
+   * deleted and every Oxy passkey is asserted (ADR 0028, ADR 0029) — the rest
+   * of the holder policy: no `<base>` and no form posts (`base-uri` /
    * `form-action 'none'`), no Referer to anyone, passkeys for this origin only
    * with every other powerful feature off (`Permissions-Policy`), and its
    * responses readable by no other origin (`Cross-Origin-Resource-Policy`).

package/src/utils/authWebUrl.ts

@@ -17,10 +17,9 @@
 export const CENTRAL_IDP_APEX = 'oxy.so';
 
 /**
- * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface AND the
- * web identity carrier: where a person signs in or creates an account with a
- * passkey from another origin's popup, and the one origin that may create,
- * open, recover or move their self-custody identity (one identity, two
- * carriers). Apps open it; they never handle the identity themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface and the
+ * one origin that asserts Oxy passkeys: where a person signs in, creates,
+ * recovers or deletes a web account, in the window an app opens (ADR 0029).
+ * Apps open it; they never run the passkey themselves.
  */
 export const AUTH_WEB_ORIGIN = `https://auth.${CENTRAL_IDP_APEX}`;

package/dist/cjs/crypto/identityMove.js

@@ -1,142 +0,0 @@
-"use strict";
-/**
- * Identity move — the crypto of giving a web root to Commons (ADR 0024 D6).
- *
- * Both sides run this: the web holder (the initiator, holding the root) and
- * Commons (the responder, receiving it). The relay in between sees a commitment,
- * two ephemeral public keys and ciphertext. The initiator commits to its key
- * before the responder chooses one and reveals it only afterwards, so the 6-digit
- * code both screens show exposes a relay that substituted a key — it cannot grind
- * one until the codes agree. The receipt binds the move, the root, both keys and
- * the ciphertext actually relayed.
- *
- * PURE: no storage, no network. Contract: `@oxy.so/contracts` `identityMove`.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateMoveEphemeralKeyPair = generateMoveEphemeralKeyPair;
-exports.deriveMoveKey = deriveMoveKey;
-exports.createMoveCommitment = createMoveCommitment;
-exports.verifyMoveCommitment = verifyMoveCommitment;
-exports.deriveMoveSas = deriveMoveSas;
-exports.digestMoveCiphertext = digestMoveCiphertext;
-exports.signMoveReceipt = signMoveReceipt;
-exports.verifyMoveReceipt = verifyMoveReceipt;
-exports.sealIdentityForMove = sealIdentityForMove;
-exports.openMovedIdentity = openMovedIdentity;
-exports.buildMoveQrPayload = buildMoveQrPayload;
-exports.parseMoveQrPayload = parseMoveQrPayload;
-require("./polyfill");
-const bip39_1 = require("@scure/bip39");
-const english_1 = require("@scure/bip39/wordlists/english");
-const sha256_1 = require("@noble/hashes/sha256");
-const utils_1 = require("@noble/hashes/utils");
-const protocol_1 = require("@oxy.so/protocol");
-const secp256k1_1 = require("@oxy.so/protocol/secp256k1");
-const contracts_1 = require("@oxy.so/contracts");
-const aead_1 = require("./aead");
-const ecdh_1 = require("./ecdh");
-const kdf_1 = require("./kdf");
-const webIdentityCarrier_1 = require("./webIdentityCarrier");
-const MOVE_KDF_INFO = (0, utils_1.utf8ToBytes)('oxy-identity-move-v1');
-function sha256Hex(input) {
-    return (0, utils_1.bytesToHex)((0, sha256_1.sha256)((0, utils_1.utf8ToBytes)(input)));
-}
-/** A fresh ephemeral key pair for one move. Keep the private key in memory only. */
-function generateMoveEphemeralKeyPair() {
-    return (0, secp256k1_1.generateSecp256k1KeyPair)();
-}
-/** The symmetric key both sides derive: HKDF(ECDH, salt = moveId). */
-function deriveMoveKey(ownEphemeralPrivateKey, otherEphemeralPublicKey, moveId) {
-    const shared = (0, ecdh_1.deriveSharedSecret)(ownEphemeralPrivateKey, otherEphemeralPublicKey);
-    try {
-        return (0, kdf_1.hkdfSha256)(shared, (0, utils_1.utf8ToBytes)(moveId.toLowerCase()), MOVE_KDF_INFO, aead_1.AEAD_KEY_LENGTH);
-    }
-    finally {
-        (0, webIdentityCarrier_1.wipeBytes)(shared);
-    }
-}
-/** Initiator: commit to the ephemeral key before anyone else's key is known. The nonce stays in memory until the reveal. */
-function createMoveCommitment(initiatorEphemeralPublicKey) {
-    const nonceBytes = new Uint8Array(32);
-    globalThis.crypto.getRandomValues(nonceBytes);
-    const nonce = (0, utils_1.bytesToHex)(nonceBytes);
-    return { commitment: sha256Hex((0, contracts_1.buildMoveCommitmentInput)(initiatorEphemeralPublicKey, nonce)), nonce };
-}
-/** Responder: does the revealed key match the commitment read before joining? */
-function verifyMoveCommitment(initiatorEphemeralPublicKey, nonce, commitment) {
-    return sha256Hex((0, contracts_1.buildMoveCommitmentInput)(initiatorEphemeralPublicKey, nonce)) === commitment.toLowerCase();
-}
-/** The 6-digit code, bound to the move, both keys in their roles, and the commitment. */
-function deriveMoveSas(input) {
-    const digest = (0, sha256_1.sha256)((0, utils_1.utf8ToBytes)((0, contracts_1.buildMoveSasInput)(input)));
-    const value = ((digest[0] << 24) | (digest[1] << 16) | (digest[2] << 8) | digest[3]) >>> 0;
-    return String(value % 1000000).padStart(6, '0');
-}
-/** The digest a receipt binds: what was actually relayed. */
-function digestMoveCiphertext(sealed) {
-    return sha256Hex((0, contracts_1.buildMoveCiphertextDigestInput)(sealed));
-}
-/**
- * Responder: sign the receipt with a signer that reads the root back from durable
- * storage (Commons passes its keychain signer), so a receipt exists only for a
- * root that was actually stored.
- */
-async function signMoveReceipt(sign, claims) {
-    return { signature: await sign((0, contracts_1.buildMoveReceiptMessage)(claims)) };
-}
-/** Initiator: is this receipt the root's, for exactly this move and ciphertext? */
-function verifyMoveReceipt(claims, signature) {
-    return (0, protocol_1.verifySignature)((0, contracts_1.buildMoveReceiptMessage)(claims), signature, claims.rootPublicKey);
-}
-function moveAad(moveId, publicKey) {
-    return (0, utils_1.utf8ToBytes)(JSON.stringify({ v: 1, purpose: 'identity-move', moveId: moveId.toLowerCase(), publicKey: publicKey.toLowerCase() }));
-}
-/** Initiator: seal the phrase entropy (12–24 words) for the responder. */
-function sealIdentityForMove(identity, moveKey, moveId) {
-    if (typeof identity.mnemonic !== 'string' || !identity.mnemonic) {
-        throw new Error('Only an identity with a recovery phrase can be moved this way');
-    }
-    const entropy = (0, bip39_1.mnemonicToEntropy)(identity.mnemonic, english_1.wordlist);
-    try {
-        const { nonce, ciphertext } = (0, aead_1.encryptAead)(moveKey, entropy, moveAad(moveId, identity.publicKey));
-        return { nonce: (0, utils_1.bytesToHex)(nonce), ciphertext: (0, utils_1.bytesToHex)(ciphertext) };
-    }
-    finally {
-        (0, webIdentityCarrier_1.wipeBytes)(entropy);
-    }
-}
-/**
- * Responder: open the sealed identity. The derived public key must be the one
- * the move declared — anything else is refused, never imported.
- */
-function openMovedIdentity(sealed, moveKey, moveId, expectedPublicKey) {
-    let entropy;
-    try {
-        entropy = (0, aead_1.decryptAead)(moveKey, (0, utils_1.hexToBytes)(sealed.nonce), (0, utils_1.hexToBytes)(sealed.ciphertext), moveAad(moveId, expectedPublicKey));
-    }
-    catch {
-        throw new Error('The identity could not be opened. The codes may not have matched — start again.');
-    }
-    try {
-        const identity = (0, webIdentityCarrier_1.deriveIdentityFromMnemonic)((0, bip39_1.entropyToMnemonic)(entropy, english_1.wordlist));
-        if (identity.publicKey !== expectedPublicKey.toLowerCase()) {
-            throw new Error('The received identity is not the one being moved');
-        }
-        return identity;
-    }
-    finally {
-        (0, webIdentityCarrier_1.wipeBytes)(entropy);
-    }
-}
-/** The QR payload for a move. */
-function buildMoveQrPayload(moveId) {
-    return `${contracts_1.IDENTITY_MOVE_QR_PREFIX}${moveId.toLowerCase()}`;
-}
-/** The move id in a scanned payload, or `null` when it is not a move QR. */
-function parseMoveQrPayload(raw) {
-    const value = raw.trim();
-    if (!value.toLowerCase().startsWith(contracts_1.IDENTITY_MOVE_QR_PREFIX))
-        return null;
-    const id = value.slice(contracts_1.IDENTITY_MOVE_QR_PREFIX.length).toLowerCase();
-    return /^[0-9a-f]{32}$/.test(id) ? id : null;
-}

package/dist/cjs/crypto/webIdentityCarrier.js

@@ -1,325 +0,0 @@
-"use strict";
-/**
- * Web identity holder — the crypto of a browser holding a personal root (ADR 0024).
- *
- * An Oxy root is usually a BIP-39 mnemonic whose seed's first 32 bytes are the
- * secp256k1 key (`recoveryPhrase.ts`), and for a few imported identities a raw
- * private key with no phrase. Commons keeps it in the device keychain. This
- * module lets a browser hold the SAME root without Oxy ever being able to use it:
- *
-    secret  ──AEAD(DEK)──▶ sealed secret        (phrase entropy or raw key)
- *   DEK     ──AEAD(KEK_i)─▶ wraps[i]            KEK_i = HKDF(PRF output of passkey i)
- *
- * The PRF output is produced inside the user's authenticator, behind user
- * verification, and never leaves the page that asked for it. The envelope is
- * therefore safe to store anywhere — auth.oxy.so's IndexedDB and the server
- * copy alike — and opens only with a registered passkey or the recovery material.
- *
- * PURE: no storage, no network, no WebAuthn call, no platform globals beyond the
- * CSPRNG the AEAD polyfill guarantees. The caller runs the ceremony and hands the
- * PRF output in; everything here is deterministic given its inputs, so it is
- * identical on web, Node and React Native, and fully unit-testable.
- *
- * Contract: `WebIdentityEnvelope` in `@oxy.so/contracts`.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebIdentityUnlockError = exports.WEB_IDENTITY_PRF_OUTPUT_LENGTH = exports.WEB_IDENTITY_PRF_INPUT = void 0;
-exports.wipeBytes = wipeBytes;
-exports.wipeOpenedIdentity = wipeOpenedIdentity;
-exports.normalizeMnemonic = normalizeMnemonic;
-exports.deriveIdentityFromMnemonic = deriveIdentityFromMnemonic;
-exports.deriveIdentityFromPrivateKey = deriveIdentityFromPrivateKey;
-exports.parseRecoveryMaterial = parseRecoveryMaterial;
-exports.deriveIdentityFromRecoveryMaterial = deriveIdentityFromRecoveryMaterial;
-exports.generateWebIdentity = generateWebIdentity;
-exports.generateDataKey = generateDataKey;
-exports.isUsablePrfOutput = isUsablePrfOutput;
-exports.deriveKeyEncryptionKey = deriveKeyEncryptionKey;
-exports.sealWebIdentity = sealWebIdentity;
-exports.unwrapDataKey = unwrapDataKey;
-exports.openWebIdentity = openWebIdentity;
-exports.unlockWebIdentity = unlockWebIdentity;
-exports.addWrap = addWrap;
-exports.markWrapVerified = markWrapVerified;
-exports.removeWrap = removeWrap;
-require("./polyfill");
-const bip39_1 = require("@scure/bip39");
-const english_1 = require("@scure/bip39/wordlists/english");
-const sha256_1 = require("@noble/hashes/sha256");
-const utils_1 = require("@noble/hashes/utils");
-const secp256k1_1 = require("@oxy.so/protocol/secp256k1");
-const contracts_1 = require("@oxy.so/contracts");
-const aead_1 = require("./aead");
-const kdf_1 = require("./kdf");
-/**
- * The PRF input every identity-carrier ceremony evaluates (`prf.eval.first`).
- *
- * Fixed rather than per-wrap: discoverable sign-in has no credential list to key
- * `evalByCredential` by, and each passkey's output is already distinct. A future
- * scheme change bumps the label — and with it every KEK — instead of mutating it.
- */
-exports.WEB_IDENTITY_PRF_INPUT = (0, sha256_1.sha256)((0, utils_1.utf8ToBytes)('oxy-web-identity-carrier/prf/v1'));
-/** HKDF salt of the key-encryption-key schedule. Shared by envelope versions 1 and 2. */
-const KEK_SALT = (0, utils_1.utf8ToBytes)('oxy-web-identity-carrier/kek/v1');
-/** A WebAuthn PRF output is 32 bytes (HMAC-SHA-256). Nothing shorter or longer is usable. */
-exports.WEB_IDENTITY_PRF_OUTPUT_LENGTH = 32;
-class WebIdentityUnlockError extends Error {
-    constructor(failure, message) {
-        super(message);
-        this.failure = failure;
-        this.name = 'WebIdentityUnlockError';
-    }
-}
-exports.WebIdentityUnlockError = WebIdentityUnlockError;
-function aadFor(parts) {
-    return (0, utils_1.utf8ToBytes)(JSON.stringify(parts));
-}
-function secretAad(publicKey, secretKind) {
-    return aadFor({ v: contracts_1.WEB_IDENTITY_ENVELOPE_VERSION, purpose: 'secret', secretKind, publicKey });
-}
-function wrapAad(publicKey, credentialId, rpId) {
-    return aadFor({ v: contracts_1.WEB_IDENTITY_ENVELOPE_VERSION, purpose: 'wrap', publicKey, credentialId, rpId });
-}
-/** Overwrite a buffer holding secret material. Best effort — JS gives no stronger guarantee. */
-function wipeBytes(bytes) {
-    bytes.fill(0);
-}
-/** Best-effort removal of secret strings from an opened identity. */
-function wipeOpenedIdentity(identity) {
-    identity.privateKey = '';
-    if (identity.kind === 'mnemonic')
-        identity.mnemonic = '';
-}
-/** Normalize a typed phrase: trimmed, lowercase, single spaces. */
-function normalizeMnemonic(mnemonic) {
-    return mnemonic.trim().toLowerCase().split(/\s+/).join(' ');
-}
-/**
- * Derive the identity from a mnemonic exactly as Commons does
- * (`RecoveryPhraseService`): seed → first 32 bytes → secp256k1. Any standard
- * BIP-39 length (12, 15, 18, 21, 24 words) is accepted; the derivation does not
- * depend on the length.
- */
-function deriveIdentityFromMnemonic(mnemonic) {
-    const normalized = normalizeMnemonic(mnemonic);
-    if (!(0, bip39_1.validateMnemonic)(normalized, english_1.wordlist)) {
-        throw new Error('Invalid recovery phrase');
-    }
-    const seed = (0, bip39_1.mnemonicToSeedSync)(normalized);
-    const privateKeyBytes = seed.slice(0, 32);
-    wipeBytes(seed);
-    const privateKey = (0, utils_1.bytesToHex)(privateKeyBytes);
-    wipeBytes(privateKeyBytes);
-    return { kind: 'mnemonic', mnemonic: normalized, privateKey, publicKey: (0, secp256k1_1.deriveSecp256k1PublicKey)(privateKey) };
-}
-/** A raw 32-byte private key (hex, optional `0x`) as an identity. Never gains a phrase. */
-function deriveIdentityFromPrivateKey(privateKey) {
-    const normalized = privateKey.trim().toLowerCase().replace(/^0x/, '');
-    if (!/^[0-9a-f]{64}$/.test(normalized)) {
-        throw new Error('Invalid private key');
-    }
-    let publicKey;
-    try {
-        publicKey = (0, secp256k1_1.deriveSecp256k1PublicKey)(normalized);
-    }
-    catch {
-        throw new Error('Invalid private key');
-    }
-    return { kind: 'raw-key', mnemonic: null, privateKey: normalized, publicKey };
-}
-/**
- * Read what a person typed as recovery material: a BIP-39 phrase, or a 64-hex
- * private key. Throws `Invalid recovery material` for anything else.
- */
-function parseRecoveryMaterial(input) {
-    const trimmed = input.trim();
-    if (/^(0x)?[0-9a-fA-F]{64}$/.test(trimmed))
-        return { kind: 'raw-key', privateKey: trimmed };
-    const words = normalizeMnemonic(trimmed);
-    if (words && (0, bip39_1.validateMnemonic)(words, english_1.wordlist))
-        return { kind: 'mnemonic', mnemonic: words };
-    throw new Error('Invalid recovery material');
-}
-/** Derive the identity recovery material names. */
-function deriveIdentityFromRecoveryMaterial(material) {
-    return material.kind === 'mnemonic'
-        ? deriveIdentityFromMnemonic(material.mnemonic)
-        : deriveIdentityFromPrivateKey(material.privateKey);
-}
-/** A brand-new 12-word identity. Nothing is persisted. */
-function generateWebIdentity() {
-    return deriveIdentityFromMnemonic((0, bip39_1.generateMnemonic)(english_1.wordlist, 128));
-}
-/** A fresh random data key for a new envelope. */
-function generateDataKey() {
-    const key = new Uint8Array(aead_1.AEAD_KEY_LENGTH);
-    globalThis.crypto.getRandomValues(key);
-    return key;
-}
-/** Whether `bytes` is a usable PRF output: exactly 32 bytes. */
-function isUsablePrfOutput(bytes) {
-    return bytes instanceof Uint8Array && bytes.byteLength === exports.WEB_IDENTITY_PRF_OUTPUT_LENGTH;
-}
-/** The key-encryption key a passkey's PRF output yields for its own wrap. */
-function deriveKeyEncryptionKey(prfOutput, credentialId) {
-    if (prfOutput.length !== exports.WEB_IDENTITY_PRF_OUTPUT_LENGTH) {
-        throw new Error(`PRF output must be ${exports.WEB_IDENTITY_PRF_OUTPUT_LENGTH} bytes, got ${prfOutput.length}`);
-    }
-    return (0, kdf_1.hkdfSha256)(prfOutput, KEK_SALT, (0, utils_1.utf8ToBytes)(credentialId), aead_1.AEAD_KEY_LENGTH);
-}
-function wrapFor(publicKey, dataKey, input, now) {
-    const kek = deriveKeyEncryptionKey(input.prfOutput, input.credentialId);
-    try {
-        const { nonce, ciphertext } = (0, aead_1.encryptAead)(kek, dataKey, wrapAad(publicKey, input.credentialId, input.rpId));
-        return {
-            credentialId: input.credentialId,
-            nonce: (0, utils_1.bytesToHex)(nonce),
-            wrappedKey: (0, utils_1.bytesToHex)(ciphertext),
-            createdAt: now.toISOString(),
-            rpId: input.rpId,
-            ...(input.verifiedAt ? { verifiedAt: input.verifiedAt } : {}),
-        };
-    }
-    finally {
-        wipeBytes(kek);
-    }
-}
-function secretOf(identity) {
-    if (identity.kind === 'mnemonic') {
-        return { kind: 'mnemonic-entropy', bytes: (0, bip39_1.mnemonicToEntropy)(identity.mnemonic, english_1.wordlist) };
-    }
-    return { kind: 'raw-private-key', bytes: (0, utils_1.hexToBytes)(identity.privateKey) };
-}
-/**
- * Seal an identity into a new envelope that opens with the given passkey.
- *
- * Returns the data key too, so the caller can add further wraps in the same
- * session; wipe it when done.
- */
-function sealWebIdentity(identity, firstWrap, now = new Date()) {
-    const derived = identity.kind === 'raw-key' ? deriveIdentityFromPrivateKey(identity.privateKey) : deriveIdentityFromMnemonic(identity.mnemonic);
-    const publicKey = identity.publicKey.toLowerCase();
-    if (derived.publicKey !== publicKey) {
-        wipeOpenedIdentity(derived);
-        throw new Error('The recovery material does not belong to this identity');
-    }
-    const secret = secretOf(derived);
-    wipeOpenedIdentity(derived);
-    const dataKey = generateDataKey();
-    try {
-        const { nonce, ciphertext } = (0, aead_1.encryptAead)(dataKey, secret.bytes, secretAad(publicKey, secret.kind));
-        const envelope = {
-            version: contracts_1.WEB_IDENTITY_ENVELOPE_VERSION,
-            algorithm: 'xchacha20poly1305',
-            publicKey,
-            secretKind: secret.kind,
-            secretNonce: (0, utils_1.bytesToHex)(nonce),
-            sealedSecret: (0, utils_1.bytesToHex)(ciphertext),
-            wraps: [wrapFor(publicKey, dataKey, firstWrap, now)],
-        };
-        return { envelope, dataKey };
-    }
-    catch (error) {
-        wipeBytes(dataKey);
-        throw error;
-    }
-    finally {
-        wipeBytes(secret.bytes);
-    }
-}
-/** Recover the data key with one passkey's PRF output. */
-function unwrapDataKey(envelope, prfOutput, credentialId) {
-    const wrap = envelope.wraps.find((entry) => entry.credentialId === credentialId);
-    if (!wrap) {
-        throw new WebIdentityUnlockError('unknown-credential', 'This passkey cannot open this identity');
-    }
-    const kek = deriveKeyEncryptionKey(prfOutput, credentialId);
-    try {
-        return (0, aead_1.decryptAead)(kek, (0, utils_1.hexToBytes)(wrap.nonce), (0, utils_1.hexToBytes)(wrap.wrappedKey), wrapAad(envelope.publicKey, credentialId, wrap.rpId));
-    }
-    catch {
-        throw new WebIdentityUnlockError('prf-mismatch', 'This passkey returned a different secret than when it was registered');
-    }
-    finally {
-        wipeBytes(kek);
-    }
-}
-/**
- * Open an envelope with its data key.
- *
- * The derived public key is checked against the envelope's own: a sealed secret
- * that decrypts into a different identity is treated as corruption, never used.
- */
-function openWebIdentity(envelope, dataKey) {
-    const publicKey = envelope.publicKey.toLowerCase();
-    const kind = envelope.secretKind;
-    let secret;
-    try {
-        secret = (0, aead_1.decryptAead)(dataKey, (0, utils_1.hexToBytes)(envelope.secretNonce), (0, utils_1.hexToBytes)(envelope.sealedSecret), secretAad(envelope.publicKey, kind));
-    }
-    catch {
-        throw new WebIdentityUnlockError('corrupt', 'The sealed identity could not be opened');
-    }
-    try {
-        let identity;
-        try {
-            identity =
-                kind === 'mnemonic-entropy'
-                    ? deriveIdentityFromMnemonic((0, bip39_1.entropyToMnemonic)(secret, english_1.wordlist))
-                    : deriveIdentityFromPrivateKey((0, utils_1.bytesToHex)(secret));
-        }
-        catch {
-            throw new WebIdentityUnlockError('corrupt', 'The sealed identity is malformed');
-        }
-        if (identity.publicKey !== publicKey) {
-            wipeOpenedIdentity(identity);
-            throw new WebIdentityUnlockError('corrupt', 'The sealed identity does not match its public key');
-        }
-        return identity;
-    }
-    finally {
-        wipeBytes(secret);
-    }
-}
-/** Unwrap and open in one step. */
-function unlockWebIdentity(envelope, prfOutput, credentialId) {
-    const dataKey = unwrapDataKey(envelope, prfOutput, credentialId);
-    try {
-        return openWebIdentity(envelope, dataKey);
-    }
-    finally {
-        wipeBytes(dataKey);
-    }
-}
-/** Add (or replace) one passkey's wrap. Requires the data key of an unlocked envelope. */
-function addWrap(envelope, dataKey, wrapInput, now = new Date()) {
-    // Proves `dataKey` belongs to THIS envelope before anything new can open it.
-    wipeOpenedIdentity(openWebIdentity(envelope, dataKey));
-    const others = envelope.wraps.filter((entry) => entry.credentialId !== wrapInput.credentialId);
-    return {
-        ...envelope,
-        wraps: [...others, wrapFor(envelope.publicKey, dataKey, wrapInput, now)],
-    };
-}
-/**
- * Record that a wrap's passkey opened the envelope in a ceremony of its own. The
- * AEAD does not cover `verifiedAt`; it is holder metadata the owner writes with a
- * root proof, not a cryptographic claim.
- */
-function markWrapVerified(envelope, credentialId, now = new Date()) {
-    if (!envelope.wraps.some((entry) => entry.credentialId === credentialId)) {
-        throw new WebIdentityUnlockError('unknown-credential', 'This passkey cannot open this identity');
-    }
-    return {
-        ...envelope,
-        wraps: envelope.wraps.map((entry) => entry.credentialId === credentialId ? { ...entry, verifiedAt: now.toISOString() } : entry),
-    };
-}
-/** Remove one passkey's wrap. The last wrap can never be removed — an envelope nobody can open is a loss. */
-function removeWrap(envelope, credentialId) {
-    const remaining = envelope.wraps.filter((entry) => entry.credentialId !== credentialId);
-    if (remaining.length === 0) {
-        throw new Error('An identity envelope must keep at least one passkey');
-    }
-    return { ...envelope, wraps: remaining };
-}

package/dist/esm/crypto/identityMove.js

@@ -1,128 +0,0 @@
-/**
- * Identity move — the crypto of giving a web root to Commons (ADR 0024 D6).
- *
- * Both sides run this: the web holder (the initiator, holding the root) and
- * Commons (the responder, receiving it). The relay in between sees a commitment,
- * two ephemeral public keys and ciphertext. The initiator commits to its key
- * before the responder chooses one and reveals it only afterwards, so the 6-digit
- * code both screens show exposes a relay that substituted a key — it cannot grind
- * one until the codes agree. The receipt binds the move, the root, both keys and
- * the ciphertext actually relayed.
- *
- * PURE: no storage, no network. Contract: `@oxy.so/contracts` `identityMove`.
- */
-import './polyfill.js';
-import { entropyToMnemonic, mnemonicToEntropy } from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils';
-import { verifySignature } from '@oxy.so/protocol';
-import { generateSecp256k1KeyPair } from '@oxy.so/protocol/secp256k1';
-import { IDENTITY_MOVE_QR_PREFIX, buildMoveCiphertextDigestInput, buildMoveCommitmentInput, buildMoveReceiptMessage, buildMoveSasInput, } from '@oxy.so/contracts';
-import { decryptAead, encryptAead, AEAD_KEY_LENGTH } from './aead.js';
-import { deriveSharedSecret } from './ecdh.js';
-import { hkdfSha256 } from './kdf.js';
-import { deriveIdentityFromMnemonic, wipeBytes } from './webIdentityCarrier.js';
-const MOVE_KDF_INFO = utf8ToBytes('oxy-identity-move-v1');
-function sha256Hex(input) {
-    return bytesToHex(sha256(utf8ToBytes(input)));
-}
-/** A fresh ephemeral key pair for one move. Keep the private key in memory only. */
-export function generateMoveEphemeralKeyPair() {
-    return generateSecp256k1KeyPair();
-}
-/** The symmetric key both sides derive: HKDF(ECDH, salt = moveId). */
-export function deriveMoveKey(ownEphemeralPrivateKey, otherEphemeralPublicKey, moveId) {
-    const shared = deriveSharedSecret(ownEphemeralPrivateKey, otherEphemeralPublicKey);
-    try {
-        return hkdfSha256(shared, utf8ToBytes(moveId.toLowerCase()), MOVE_KDF_INFO, AEAD_KEY_LENGTH);
-    }
-    finally {
-        wipeBytes(shared);
-    }
-}
-/** Initiator: commit to the ephemeral key before anyone else's key is known. The nonce stays in memory until the reveal. */
-export function createMoveCommitment(initiatorEphemeralPublicKey) {
-    const nonceBytes = new Uint8Array(32);
-    globalThis.crypto.getRandomValues(nonceBytes);
-    const nonce = bytesToHex(nonceBytes);
-    return { commitment: sha256Hex(buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce)), nonce };
-}
-/** Responder: does the revealed key match the commitment read before joining? */
-export function verifyMoveCommitment(initiatorEphemeralPublicKey, nonce, commitment) {
-    return sha256Hex(buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce)) === commitment.toLowerCase();
-}
-/** The 6-digit code, bound to the move, both keys in their roles, and the commitment. */
-export function deriveMoveSas(input) {
-    const digest = sha256(utf8ToBytes(buildMoveSasInput(input)));
-    const value = ((digest[0] << 24) | (digest[1] << 16) | (digest[2] << 8) | digest[3]) >>> 0;
-    return String(value % 1000000).padStart(6, '0');
-}
-/** The digest a receipt binds: what was actually relayed. */
-export function digestMoveCiphertext(sealed) {
-    return sha256Hex(buildMoveCiphertextDigestInput(sealed));
-}
-/**
- * Responder: sign the receipt with a signer that reads the root back from durable
- * storage (Commons passes its keychain signer), so a receipt exists only for a
- * root that was actually stored.
- */
-export async function signMoveReceipt(sign, claims) {
-    return { signature: await sign(buildMoveReceiptMessage(claims)) };
-}
-/** Initiator: is this receipt the root's, for exactly this move and ciphertext? */
-export function verifyMoveReceipt(claims, signature) {
-    return verifySignature(buildMoveReceiptMessage(claims), signature, claims.rootPublicKey);
-}
-function moveAad(moveId, publicKey) {
-    return utf8ToBytes(JSON.stringify({ v: 1, purpose: 'identity-move', moveId: moveId.toLowerCase(), publicKey: publicKey.toLowerCase() }));
-}
-/** Initiator: seal the phrase entropy (12–24 words) for the responder. */
-export function sealIdentityForMove(identity, moveKey, moveId) {
-    if (typeof identity.mnemonic !== 'string' || !identity.mnemonic) {
-        throw new Error('Only an identity with a recovery phrase can be moved this way');
-    }
-    const entropy = mnemonicToEntropy(identity.mnemonic, wordlist);
-    try {
-        const { nonce, ciphertext } = encryptAead(moveKey, entropy, moveAad(moveId, identity.publicKey));
-        return { nonce: bytesToHex(nonce), ciphertext: bytesToHex(ciphertext) };
-    }
-    finally {
-        wipeBytes(entropy);
-    }
-}
-/**
- * Responder: open the sealed identity. The derived public key must be the one
- * the move declared — anything else is refused, never imported.
- */
-export function openMovedIdentity(sealed, moveKey, moveId, expectedPublicKey) {
-    let entropy;
-    try {
-        entropy = decryptAead(moveKey, hexToBytes(sealed.nonce), hexToBytes(sealed.ciphertext), moveAad(moveId, expectedPublicKey));
-    }
-    catch {
-        throw new Error('The identity could not be opened. The codes may not have matched — start again.');
-    }
-    try {
-        const identity = deriveIdentityFromMnemonic(entropyToMnemonic(entropy, wordlist));
-        if (identity.publicKey !== expectedPublicKey.toLowerCase()) {
-            throw new Error('The received identity is not the one being moved');
-        }
-        return identity;
-    }
-    finally {
-        wipeBytes(entropy);
-    }
-}
-/** The QR payload for a move. */
-export function buildMoveQrPayload(moveId) {
-    return `${IDENTITY_MOVE_QR_PREFIX}${moveId.toLowerCase()}`;
-}
-/** The move id in a scanned payload, or `null` when it is not a move QR. */
-export function parseMoveQrPayload(raw) {
-    const value = raw.trim();
-    if (!value.toLowerCase().startsWith(IDENTITY_MOVE_QR_PREFIX))
-        return null;
-    const id = value.slice(IDENTITY_MOVE_QR_PREFIX.length).toLowerCase();
-    return /^[0-9a-f]{32}$/.test(id) ? id : null;
-}