@oxy.so/core 1.2.0 → 1.3.0

package/dist/cjs/crypto/identityMove.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Identity move — the crypto of taking a web identity into Commons.
+ *
+ * Both carriers run this: `id.oxy.so` (the initiator, holding the identity) and
+ * Commons (the responder, receiving it). The relay in between sees two ephemeral
+ * public keys and ciphertext; the 6-digit SAS both screens show is what makes a
+ * relay that swapped a key visible to the person.
+ *
+ * PURE: no storage, no network. Contract: `@oxy.so/contracts` `identityMove`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_MOVE_ACTIONS = void 0;
+exports.generateMoveEphemeralKeyPair = generateMoveEphemeralKeyPair;
+exports.deriveMoveKey = deriveMoveKey;
+exports.deriveMoveSas = deriveMoveSas;
+exports.sealIdentityForMove = sealIdentityForMove;
+exports.openMovedIdentity = openMovedIdentity;
+exports.buildMoveMessage = buildMoveMessage;
+exports.signMoveAction = signMoveAction;
+exports.verifyMoveReceipt = verifyMoveReceipt;
+exports.buildMoveQrPayload = buildMoveQrPayload;
+exports.parseMoveQrPayload = parseMoveQrPayload;
+require("./polyfill");
+const bip39_1 = require("@scure/bip39");
+const english_1 = require("@scure/bip39/wordlists/english");
+const utils_1 = require("@noble/hashes/utils");
+const protocol_1 = require("@oxy.so/protocol");
+const secp256k1_1 = require("@oxy.so/protocol/secp256k1");
+const contracts_1 = require("@oxy.so/contracts");
+const aead_1 = require("./aead");
+const ecdh_1 = require("./ecdh");
+const kdf_1 = require("./kdf");
+const webIdentityCarrier_1 = require("./webIdentityCarrier");
+const MOVE_KDF_INFO = (0, utils_1.utf8ToBytes)('oxy-identity-move-v1');
+/** Actions the identity key signs during a move. */
+exports.IDENTITY_MOVE_ACTIONS = {
+    seal: 'identity_move_seal',
+    received: 'identity_move_received',
+};
+/** A fresh ephemeral key pair for one move. Keep the private key in memory only. */
+function generateMoveEphemeralKeyPair() {
+    return (0, secp256k1_1.generateSecp256k1KeyPair)();
+}
+/** The symmetric key both sides derive: HKDF(ECDH, salt = moveId). */
+function deriveMoveKey(ownEphemeralPrivateKey, otherEphemeralPublicKey, moveId) {
+    const shared = (0, ecdh_1.deriveSharedSecret)(ownEphemeralPrivateKey, otherEphemeralPublicKey);
+    try {
+        return (0, kdf_1.hkdfSha256)(shared, (0, utils_1.utf8ToBytes)(moveId.toLowerCase()), MOVE_KDF_INFO, aead_1.AEAD_KEY_LENGTH);
+    }
+    finally {
+        (0, webIdentityCarrier_1.wipeBytes)(shared);
+    }
+}
+/** The 6-digit code both screens show, bound to the move and both ephemeral keys in their roles. */
+function deriveMoveSas(moveId, initiatorEphemeralPublicKey, responderEphemeralPublicKey) {
+    return (0, webIdentityCarrier_1.deriveTransferSas)({ pairingId: moveId, initiatorEphemeralPublicKey, responderEphemeralPublicKey });
+}
+function moveAad(moveId, publicKey) {
+    return (0, utils_1.utf8ToBytes)(JSON.stringify({ v: 1, purpose: 'identity-move', moveId: moveId.toLowerCase(), publicKey: publicKey.toLowerCase() }));
+}
+/** Initiator: seal the identity's entropy for the responder. */
+function sealIdentityForMove(identity, moveKey, moveId) {
+    const entropy = (0, bip39_1.mnemonicToEntropy)(identity.mnemonic, english_1.wordlist);
+    try {
+        const { nonce, ciphertext } = (0, aead_1.encryptAead)(moveKey, entropy, moveAad(moveId, identity.publicKey));
+        return { nonce: (0, utils_1.bytesToHex)(nonce), ciphertext: (0, utils_1.bytesToHex)(ciphertext) };
+    }
+    finally {
+        (0, webIdentityCarrier_1.wipeBytes)(entropy);
+    }
+}
+/**
+ * Responder: open the sealed identity. The derived public key must be the one
+ * the move declared — anything else is refused, never imported.
+ */
+function openMovedIdentity(sealed, moveKey, moveId, expectedPublicKey) {
+    let entropy;
+    try {
+        entropy = (0, aead_1.decryptAead)(moveKey, (0, utils_1.hexToBytes)(sealed.nonce), (0, utils_1.hexToBytes)(sealed.ciphertext), moveAad(moveId, expectedPublicKey));
+    }
+    catch {
+        throw new Error('The identity could not be opened. The codes may not have matched — start again.');
+    }
+    try {
+        const identity = (0, webIdentityCarrier_1.deriveIdentityFromMnemonic)((0, bip39_1.entropyToMnemonic)(entropy, english_1.wordlist));
+        if (identity.publicKey !== expectedPublicKey.toLowerCase()) {
+            throw new Error('The received identity is not the one being moved');
+        }
+        return identity;
+    }
+    finally {
+        (0, webIdentityCarrier_1.wipeBytes)(entropy);
+    }
+}
+/** The exact bytes a move proof or receipt signs. */
+function buildMoveMessage(action, moveId, timestamp) {
+    return JSON.stringify({ action, moveId: moveId.toLowerCase(), timestamp });
+}
+/** Sign a move action with the identity key. */
+async function signMoveAction(identity, action, moveId, timestamp = Date.now()) {
+    return { signature: await (0, protocol_1.signMessage)(buildMoveMessage(action, moveId, timestamp), identity.privateKey), timestamp };
+}
+/**
+ * Initiator: is this receipt really from the identity? Checked locally with the
+ * identity's public key, so a server that claims "completed" without Commons
+ * having the key cannot make the web destroy its copy.
+ */
+function verifyMoveReceipt(publicKey, moveId, receipt) {
+    return (0, protocol_1.verifySignature)(buildMoveMessage(exports.IDENTITY_MOVE_ACTIONS.received, moveId, receipt.timestamp), receipt.signature, publicKey);
+}
+/** The QR payload for a move. */
+function buildMoveQrPayload(moveId) {
+    return `${contracts_1.IDENTITY_MOVE_QR_PREFIX}${moveId.toLowerCase()}`;
+}
+/** The move id in a scanned payload, or `null` when it is not a move QR. */
+function parseMoveQrPayload(raw) {
+    const value = raw.trim();
+    if (!value.toLowerCase().startsWith(contracts_1.IDENTITY_MOVE_QR_PREFIX))
+        return null;
+    const id = value.slice(contracts_1.IDENTITY_MOVE_QR_PREFIX.length).toLowerCase();
+    return /^[0-9a-f]{32}$/.test(id) ? id : null;
+}

package/dist/cjs/crypto/keyManager.js

@@ -752,6 +752,42 @@ class KeyManager {
             return null;
         }
     }
+    /**
+     * Which identity key this device is actually acting as, per slot.
+     *
+     * There are two slots and they can disagree. The shared slot is what every
+     * cross-app reader takes first — `deriveScopedSeed` (so: the FairCoin wallet
+     * Peable derives) and `getSharedPrivateKey` — while the primary slot is what
+     * signing and the server-facing identity use. A disagreement is invisible to
+     * both sides on its own, and it is money: a wallet derived from a stale
+     * shared key watches addresses that the key published in the DID will never
+     * produce, so payments land where the recipient cannot see them.
+     *
+     * `activePublicKey` is the one money derives from — the same `shared ?? primary`
+     * order `deriveScopedSeed` uses, so a caller can compare it against the key
+     * published for the account and refuse to receive rather than watch the wrong
+     * addresses.
+     *
+     * Public keys are canonicalized, so two encodings of the same key compare
+     * equal. On web both slots are null and `inSync` is true: nothing is stored,
+     * so nothing can disagree.
+     */
+    static async getIdentityKeyState() {
+        const [primaryRaw, sharedRaw] = await Promise.all([
+            KeyManager.getPublicKey(),
+            KeyManager.getSharedPublicKey(),
+        ]);
+        const primaryPublicKey = primaryRaw ? KeyManager.canonicalPublicKey(primaryRaw) : null;
+        const sharedPublicKey = sharedRaw ? KeyManager.canonicalPublicKey(sharedRaw) : null;
+        return {
+            primaryPublicKey,
+            sharedPublicKey,
+            activePublicKey: sharedPublicKey ?? primaryPublicKey,
+            // Only a real disagreement is out of sync. A device with just one slot
+            // populated has nothing to contradict.
+            inSync: primaryPublicKey === null || sharedPublicKey === null || primaryPublicKey === sharedPublicKey,
+        };
+    }
     /**
      * Check if a shared identity exists (accessible across all Oxy apps)
      *
@@ -945,49 +981,52 @@ class KeyManager {
         }
     }
     /**
-     * Migrate local identity to shared identity
+     * Make the shared slot hold THIS device's identity key.
      *
-     * Call this when upgrading existing apps to use shared identities.
-     * Copies the device-specific identity to shared storage so it can
-     * be accessed by other Oxy apps.
+     * The shared slot is the one every Oxy app on the device reads, so it has to
+     * agree with the primary slot. This creates it when it is empty (the original
+     * migration, for apps that predate the shared identity) and repairs it when it
+     * holds a different key.
      *
-     * @returns True if migration was successful, false if no local identity exists
+     * @returns True when the shared slot ends up holding the device's key, false
+     *          when there is no identity to share.
      */
-    static async migrateToSharedIdentity() {
+    static async syncSharedIdentity() {
         if (isWebPlatform()) {
             return false;
         }
         try {
-            // Check if we already have a shared identity
-            const hasShared = await KeyManager.hasSharedIdentity();
-            if (hasShared) {
-                if ((0, logger_1.isDev)()) {
-                    logger_1.logger.debug('Shared identity already exists, skipping migration', { component: 'KeyManager' });
-                }
+            const state = await KeyManager.getIdentityKeyState();
+            if (state.sharedPublicKey !== null && (state.inSync || state.primaryPublicKey === null)) {
                 return true;
             }
-            // Get local identity
             const privateKey = await KeyManager.getPrivateKey();
             if (!privateKey) {
-                if ((0, logger_1.isDev)()) {
-                    logger_1.logger.debug('No local identity to migrate', { component: 'KeyManager' });
-                }
-                return false;
+                // Nothing of this device's own to share. A shared slot that is already
+                // populated stays as it is: it is the only identity here.
+                return state.sharedPublicKey !== null;
             }
-            // Import to shared storage
             await KeyManager.importSharedIdentity(privateKey);
-            if ((0, logger_1.isDev)()) {
-                logger_1.logger.debug('Successfully migrated local identity to shared identity', { component: 'KeyManager' });
+            // A slot that held a DIFFERENT key is the dangerous case, so it is said
+            // out loud rather than debug-logged: until this write, cross-app readers
+            // (`deriveScopedSeed`, so Peable's wallet) were deriving from one key
+            // while signing and the server used another.
+            if (state.sharedPublicKey !== null) {
+                logger_1.logger.warn('Shared identity held a different key than this device: repaired it from the primary slot.', { component: 'KeyManager', method: 'syncSharedIdentity' });
             }
             return true;
         }
         catch (error) {
             if ((0, logger_1.isDev)()) {
-                logger_1.logger.error('Failed to migrate to shared identity', error, { component: 'KeyManager' });
+                logger_1.logger.error('Failed to sync the shared identity', error, { component: 'KeyManager' });
             }
             return false;
         }
     }
+    /** @deprecated Renamed to {@link KeyManager.syncSharedIdentity}. */
+    static async migrateToSharedIdentity() {
+        return KeyManager.syncSharedIdentity();
+    }
     // ==================== END SHARED IDENTITY METHODS ====================
     /**
      * Atomically persist a key pair to secure storage with verification + backup.

package/dist/cjs/crypto/webIdentityCarrier.js

@@ -0,0 +1,262 @@
+"use strict";
+/**
+ * Web identity carrier — the crypto of "one identity, two carriers".
+ *
+ * An Oxy identity is a BIP-39 mnemonic; its seed's first 32 bytes are the
+ * secp256k1 key (`recoveryPhrase.ts`). Commons keeps that key in the device
+ * keychain. This module lets a browser carry the SAME identity without Oxy ever
+ * being able to use it:
+ *
+ *   entropy ──AEAD(DEK)──▶ sealedEntropy
+ *   DEK     ──AEAD(KEK_i)─▶ wraps[i]            KEK_i = HKDF(PRF output of passkey i)
+ *
+ * The PRF output is produced inside the user's authenticator, behind user
+ * verification, and never leaves the page that asked for it. The envelope is
+ * therefore safe to store anywhere — the identity origin's IndexedDB and the
+ * server copy alike — and opens only with a registered passkey or the phrase.
+ *
+ * PURE: no storage, no network, no WebAuthn call, no platform globals beyond the
+ * CSPRNG the AEAD polyfill guarantees. The caller runs the ceremony and hands the
+ * PRF output in; everything here is deterministic given its inputs, so it is
+ * identical on web, Node and React Native, and fully unit-testable.
+ *
+ * Contract: `WebIdentityEnvelope` in `@oxy.so/contracts`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebIdentityUnlockError = exports.WEB_IDENTITY_PRF_INPUT = void 0;
+exports.wipeBytes = wipeBytes;
+exports.deriveIdentityFromMnemonic = deriveIdentityFromMnemonic;
+exports.generateWebIdentity = generateWebIdentity;
+exports.generateDataKey = generateDataKey;
+exports.deriveKeyEncryptionKey = deriveKeyEncryptionKey;
+exports.wrapDataKey = wrapDataKey;
+exports.sealWebIdentity = sealWebIdentity;
+exports.unwrapDataKey = unwrapDataKey;
+exports.openWebIdentity = openWebIdentity;
+exports.unlockWebIdentity = unlockWebIdentity;
+exports.addWrap = addWrap;
+exports.removeWrap = removeWrap;
+exports.buildIdentityActionMessage = buildIdentityActionMessage;
+exports.signIdentityAction = signIdentityAction;
+exports.deriveTransferSas = deriveTransferSas;
+require("./polyfill");
+const bip39_1 = require("@scure/bip39");
+const english_1 = require("@scure/bip39/wordlists/english");
+const sha256_1 = require("@noble/hashes/sha256");
+const utils_1 = require("@noble/hashes/utils");
+const protocol_1 = require("@oxy.so/protocol");
+const secp256k1_1 = require("@oxy.so/protocol/secp256k1");
+const contracts_1 = require("@oxy.so/contracts");
+const aead_1 = require("./aead");
+const kdf_1 = require("./kdf");
+/**
+ * The PRF input every identity-carrier ceremony evaluates (`prf.eval.first`).
+ *
+ * Fixed rather than per-wrap: discoverable sign-in has no credential list to key
+ * `evalByCredential` by, and each passkey's output is already distinct. A future
+ * scheme change bumps the label — and with it every KEK — instead of mutating it.
+ */
+exports.WEB_IDENTITY_PRF_INPUT = (0, sha256_1.sha256)((0, utils_1.utf8ToBytes)('oxy-web-identity-carrier/prf/v1'));
+/** HKDF salt of the key-encryption-key schedule. Versioned with the envelope. */
+const KEK_SALT = (0, utils_1.utf8ToBytes)('oxy-web-identity-carrier/kek/v1');
+/** A WebAuthn PRF output is 32 bytes (HMAC-SHA-256). */
+const PRF_OUTPUT_LENGTH = 32;
+class WebIdentityUnlockError extends Error {
+    constructor(failure, message) {
+        super(message);
+        this.failure = failure;
+        this.name = 'WebIdentityUnlockError';
+    }
+}
+exports.WebIdentityUnlockError = WebIdentityUnlockError;
+function aadFor(parts) {
+    return (0, utils_1.utf8ToBytes)(JSON.stringify(parts));
+}
+function entropyAad(publicKey) {
+    return aadFor({ v: contracts_1.WEB_IDENTITY_ENVELOPE_VERSION, purpose: 'entropy', publicKey });
+}
+function wrapAad(publicKey, credentialId) {
+    return aadFor({ v: contracts_1.WEB_IDENTITY_ENVELOPE_VERSION, purpose: 'wrap', publicKey, credentialId });
+}
+/** Overwrite a buffer holding secret material. Best effort — JS gives no stronger guarantee. */
+function wipeBytes(bytes) {
+    bytes.fill(0);
+}
+/**
+ * Derive the identity from a mnemonic exactly as Commons does
+ * (`RecoveryPhraseService`): seed → first 32 bytes → secp256k1.
+ */
+function deriveIdentityFromMnemonic(mnemonic) {
+    const normalized = mnemonic.trim().toLowerCase().split(/\s+/).join(' ');
+    if (!(0, bip39_1.validateMnemonic)(normalized, english_1.wordlist)) {
+        throw new Error('Invalid recovery phrase');
+    }
+    const seed = (0, bip39_1.mnemonicToSeedSync)(normalized);
+    const privateKeyBytes = seed.slice(0, 32);
+    wipeBytes(seed);
+    const privateKey = (0, utils_1.bytesToHex)(privateKeyBytes);
+    wipeBytes(privateKeyBytes);
+    return { mnemonic: normalized, privateKey, publicKey: (0, secp256k1_1.deriveSecp256k1PublicKey)(privateKey) };
+}
+/** A brand-new 12-word identity. Nothing is persisted. */
+function generateWebIdentity() {
+    return deriveIdentityFromMnemonic((0, bip39_1.generateMnemonic)(english_1.wordlist, 128));
+}
+/** A fresh random data key for a new envelope. */
+function generateDataKey() {
+    const key = new Uint8Array(aead_1.AEAD_KEY_LENGTH);
+    globalThis.crypto.getRandomValues(key);
+    return key;
+}
+/** The key-encryption key a passkey's PRF output yields for its own wrap. */
+function deriveKeyEncryptionKey(prfOutput, credentialId) {
+    if (prfOutput.length !== PRF_OUTPUT_LENGTH) {
+        throw new Error(`PRF output must be ${PRF_OUTPUT_LENGTH} bytes, got ${prfOutput.length}`);
+    }
+    return (0, kdf_1.hkdfSha256)(prfOutput, KEK_SALT, (0, utils_1.utf8ToBytes)(credentialId), aead_1.AEAD_KEY_LENGTH);
+}
+/** Wrap `dataKey` for one passkey. */
+function wrapDataKey(dataKey, prfOutput, credentialId, publicKey, now = new Date()) {
+    const kek = deriveKeyEncryptionKey(prfOutput, credentialId);
+    try {
+        const { nonce, ciphertext } = (0, aead_1.encryptAead)(kek, dataKey, wrapAad(publicKey, credentialId));
+        return {
+            credentialId,
+            nonce: (0, utils_1.bytesToHex)(nonce),
+            wrappedKey: (0, utils_1.bytesToHex)(ciphertext),
+            createdAt: now.toISOString(),
+        };
+    }
+    finally {
+        wipeBytes(kek);
+    }
+}
+/**
+ * Seal an identity into a new envelope that opens with the given passkey.
+ *
+ * Returns the data key too, so the caller can add further wraps in the same
+ * session; wipe it when done.
+ */
+function sealWebIdentity(identity, firstWrap, now = new Date()) {
+    const derived = deriveIdentityFromMnemonic(identity.mnemonic);
+    if (derived.publicKey !== identity.publicKey.toLowerCase()) {
+        throw new Error('The recovery phrase does not belong to this identity');
+    }
+    const dataKey = generateDataKey();
+    const entropy = (0, bip39_1.mnemonicToEntropy)(derived.mnemonic, english_1.wordlist);
+    try {
+        const { nonce, ciphertext } = (0, aead_1.encryptAead)(dataKey, entropy, entropyAad(derived.publicKey));
+        const envelope = {
+            version: contracts_1.WEB_IDENTITY_ENVELOPE_VERSION,
+            algorithm: 'xchacha20poly1305',
+            publicKey: derived.publicKey,
+            entropyNonce: (0, utils_1.bytesToHex)(nonce),
+            sealedEntropy: (0, utils_1.bytesToHex)(ciphertext),
+            wraps: [wrapDataKey(dataKey, firstWrap.prfOutput, firstWrap.credentialId, derived.publicKey, now)],
+        };
+        return { envelope, dataKey };
+    }
+    finally {
+        wipeBytes(entropy);
+    }
+}
+/** Recover the data key with one passkey's PRF output. */
+function unwrapDataKey(envelope, prfOutput, credentialId) {
+    const wrap = envelope.wraps.find((entry) => entry.credentialId === credentialId);
+    if (!wrap) {
+        throw new WebIdentityUnlockError('unknown-credential', 'This passkey cannot open this identity');
+    }
+    const kek = deriveKeyEncryptionKey(prfOutput, credentialId);
+    try {
+        return (0, aead_1.decryptAead)(kek, (0, utils_1.hexToBytes)(wrap.nonce), (0, utils_1.hexToBytes)(wrap.wrappedKey), wrapAad(envelope.publicKey, credentialId));
+    }
+    catch {
+        throw new WebIdentityUnlockError('prf-mismatch', 'This passkey returned a different secret than when it was registered');
+    }
+    finally {
+        wipeBytes(kek);
+    }
+}
+/**
+ * Open an envelope with its data key.
+ *
+ * The derived public key is checked against the envelope's own: a sealed entropy
+ * that decrypts into a different identity is treated as corruption, never used.
+ */
+function openWebIdentity(envelope, dataKey) {
+    let entropy;
+    try {
+        entropy = (0, aead_1.decryptAead)(dataKey, (0, utils_1.hexToBytes)(envelope.entropyNonce), (0, utils_1.hexToBytes)(envelope.sealedEntropy), entropyAad(envelope.publicKey));
+    }
+    catch {
+        throw new WebIdentityUnlockError('corrupt', 'The sealed identity could not be opened');
+    }
+    try {
+        const identity = deriveIdentityFromMnemonic((0, bip39_1.entropyToMnemonic)(entropy, english_1.wordlist));
+        if (identity.publicKey !== envelope.publicKey.toLowerCase()) {
+            throw new WebIdentityUnlockError('corrupt', 'The sealed identity does not match its public key');
+        }
+        return identity;
+    }
+    finally {
+        wipeBytes(entropy);
+    }
+}
+/** Unwrap and open in one step. */
+function unlockWebIdentity(envelope, prfOutput, credentialId) {
+    const dataKey = unwrapDataKey(envelope, prfOutput, credentialId);
+    try {
+        return openWebIdentity(envelope, dataKey);
+    }
+    finally {
+        wipeBytes(dataKey);
+    }
+}
+/** Add (or replace) one passkey's wrap. Requires the data key of an unlocked envelope. */
+function addWrap(envelope, dataKey, prfOutput, credentialId, now = new Date()) {
+    // Proves `dataKey` belongs to THIS envelope before anything new can open it.
+    openWebIdentity(envelope, dataKey);
+    const others = envelope.wraps.filter((entry) => entry.credentialId !== credentialId);
+    return {
+        ...envelope,
+        wraps: [...others, wrapDataKey(dataKey, prfOutput, credentialId, envelope.publicKey, now)],
+    };
+}
+/** Remove one passkey's wrap. The last wrap can never be removed — an envelope nobody can open is a loss. */
+function removeWrap(envelope, credentialId) {
+    const remaining = envelope.wraps.filter((entry) => entry.credentialId !== credentialId);
+    if (remaining.length === 0) {
+        throw new Error('An identity envelope must keep at least one passkey');
+    }
+    return { ...envelope, wraps: remaining };
+}
+/**
+ * The message an identity key signs to authorize an account action
+ * (`link_identity`, `web_envelope_delete`, …): `JSON.stringify({ action, userId,
+ * timestamp })`, byte-identical to what the API reconstructs.
+ */
+function buildIdentityActionMessage(action, userId, timestamp) {
+    return JSON.stringify({ action, userId, timestamp });
+}
+/** Sign an identity-action message with an opened identity's key. */
+async function signIdentityAction(identity, action, userId, timestamp = Date.now()) {
+    const signature = await (0, protocol_1.signMessage)(buildIdentityActionMessage(action, userId, timestamp), identity.privateKey);
+    return { signature, timestamp };
+}
+/**
+ * The 6-digit short authentication string both sides of an identity transfer show.
+ *
+ * Bound to the pairing and to BOTH ephemeral public keys in their roles, so a relay
+ * that substitutes either key produces a different code on each screen. The user
+ * comparing the two codes is what makes the transfer safe against the relay itself.
+ */
+function deriveTransferSas(input) {
+    const digest = (0, sha256_1.sha256)((0, utils_1.utf8ToBytes)(JSON.stringify({
+        v: 'oxy-identity-transfer-sas-v1',
+        pairingId: input.pairingId.toLowerCase(),
+        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
+        responder: input.responderEphemeralPublicKey.toLowerCase(),
+    })));
+    const value = ((digest[0] << 24) | (digest[1] << 16) | (digest[2] << 8) | digest[3]) >>> 0;
+    return String(value % 1000000).padStart(6, '0');
+}

package/dist/cjs/i18n/locales/ar-SA.json

@@ -52,19 +52,9 @@
     "signup": {
         "title": "أنشئ حسابك",
         "subtitle": "هوية واحدة لكل النظام البيئي.",
-        "commonsHeadline": "أنشئ هويتك في Commons",
-        "commonsExplainer": "‏Commons هي هوية Oxy الخاصة بك بحفظ ذاتي كامل — تطبيق واحد يعمل في كل مكان.",
         "createInCommons": "أنشئ هويتك في Commons",
-        "passkeyAlternative": "لا تملك Commons؟ أنشئ مفتاح مرور على هذا الجهاز بدلاً من ذلك",
         "createAccount": "إنشاء حساب",
-        "creating": "جارٍ الإنشاء…",
-        "usernamePlaceholder": "اختر اسم مستخدم",
-        "usernameChecking": "جارٍ التحقق…",
-        "usernameAvailable": "متاح",
-        "usernameTaken": "اسم المستخدم هذا مستخدم بالفعل",
         "backToSignInLink": "لديك حساب بالفعل؟ سجّل الدخول",
-        "hubExplainer": "أنشئ هوية Oxy الخاصة بك في نافذة آمنة، ثم عد إلى هنا مباشرة.",
-        "continueInWindow": "المتابعة في نافذة جديدة",
         "welcome": {
             "title": "مرحبًا بك في Oxy!",
             "subtitle": "أنشئ حسابك في خطوات قليلة",
@@ -119,7 +109,6 @@
         "qrHeadline": "سجّل الدخول بهوية Oxy الخاصة بك",
         "signInWithOxy": "تسجيل الدخول باستخدام Oxy",
         "useIdentityOnDevice": "لا تملك Commons؟ استخدم مفتاح مرور على هذا الجهاز بدلاً من ذلك",
-        "passkeySigningIn": "جارٍ تسجيل الدخول…",
         "getCommons": "احصل على Commons",
         "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",
         "showQrAnyway": "لدي Commons على جهاز آخر",
@@ -136,7 +125,20 @@
             "openedInCommons": "تم الفتح في Commons",
             "confirming": "جارٍ تأكيد الهوية",
             "confirmed": "تم تأكيد الهوية"
-        }
+        },
+        "signInFailures": {
+            "denied": "تم رفض تسجيل الدخول في Commons.",
+            "expired": "انتهت صلاحية طلب تسجيل الدخول. يُرجى المحاولة مرة أخرى.",
+            "network": "تعذّر الاتصال بـ Oxy. تحقّق من اتصالك وحاول مرة أخرى.",
+            "notConfigured": "هذا التطبيق غير مُعدّ لتسجيل الدخول بعد.",
+            "unsupportedFlow": "لا يمكن إكمال تسجيل الدخول هنا.",
+            "claimFailed": "تمت الموافقة على تسجيل الدخول، لكن تعذّر إكماله. يُرجى المحاولة مرة أخرى.",
+            "generic": "تعذّر تسجيل الدخول. يُرجى المحاولة مرة أخرى."
+        },
+        "linkOpenFailed": "تعذّر فتح الرابط. يُرجى المحاولة مرة أخرى.",
+        "continueWithPasskey": "متابعة",
+        "passkeyHint": "استخدم بصمتك أو وجهك أو رمز PIN للجهاز.",
+        "otherDeviceCommons": "حسابك على جهاز آخر؟ امسح الرمز باستخدام Commons"
     },
     "common": {
         "actions": {
@@ -277,6 +279,7 @@
         "help": "المساعدة والملاحظات",
         "signOut": "تسجيل الخروج",
         "privacy": "سياسة الخصوصية",
-        "terms": "شروط الخدمة"
+        "terms": "شروط الخدمة",
+        "identity": "هويتك"
     }
 }

package/dist/cjs/i18n/locales/ca-ES.json

@@ -52,19 +52,9 @@
     "signup": {
         "title": "Crea el teu compte",
         "subtitle": "Una identitat per a tot l'ecosistema.",
-        "commonsHeadline": "Crea la teva identitat a Commons",
-        "commonsExplainer": "Commons és la teva identitat d'Oxy amb autocustòdia completa: una app que funciona a tot arreu.",
         "createInCommons": "Crea la teva identitat a Commons",
-        "passkeyAlternative": "No tens Commons? Crea una clau d'accés en aquest dispositiu",
         "createAccount": "Crear compte",
-        "creating": "Creant…",
-        "usernamePlaceholder": "Tria un nom d'usuari",
-        "usernameChecking": "Comprovant…",
-        "usernameAvailable": "Disponible",
-        "usernameTaken": "Aquest nom d'usuari ja està en ús",
         "backToSignInLink": "Ja tens compte? Inicia sessió",
-        "hubExplainer": "Crea la teva Oxy ID en una finestra segura i torna de seguida.",
-        "continueInWindow": "Continua en una finestra nova",
         "welcome": {
             "title": "Benvingut a Oxy!",
             "subtitle": "Crea el teu compte en pocs passos",
@@ -119,7 +109,6 @@
         "qrHeadline": "Inicia sessió amb la teva identitat d'Oxy",
         "signInWithOxy": "Inicia sessió amb Oxy",
         "useIdentityOnDevice": "No tens Commons? Fes servir una clau d'accés en aquest dispositiu",
-        "passkeySigningIn": "Iniciant sessió…",
         "getCommons": "Descarrega Commons",
         "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",
         "showQrAnyway": "Tinc Commons en un altre dispositiu",
@@ -136,7 +125,20 @@
             "openedInCommons": "Obert a Commons",
             "confirming": "Confirmant la identitat",
             "confirmed": "Identitat confirmada"
-        }
+        },
+        "signInFailures": {
+            "denied": "S'ha rebutjat l'inici de sessió a Commons.",
+            "expired": "La sol·licitud d'inici de sessió ha caducat. Torna-ho a provar.",
+            "network": "No s'ha pogut connectar amb Oxy. Comprova la connexió i torna-ho a provar.",
+            "notConfigured": "Aquesta app encara no està preparada per iniciar sessió.",
+            "unsupportedFlow": "Aquest inici de sessió no es pot completar aquí.",
+            "claimFailed": "S'ha aprovat l'inici de sessió, però no l'hem pogut completar. Torna-ho a provar.",
+            "generic": "No s'ha pogut iniciar la sessió. Torna-ho a provar."
+        },
+        "linkOpenFailed": "No s'ha pogut obrir l'enllaç. Torna-ho a provar.",
+        "continueWithPasskey": "Continua",
+        "passkeyHint": "Fes servir l'empremta, la cara o el PIN del dispositiu.",
+        "otherDeviceCommons": "El teu compte és en un altre dispositiu? Escaneja amb Commons"
     },
     "common": {
         "actions": {
@@ -277,6 +279,7 @@
         "help": "Ajuda i comentaris",
         "signOut": "Tancar sessió",
         "privacy": "Política de privacitat",
-        "terms": "Condicions del servei"
+        "terms": "Condicions del servei",
+        "identity": "La teva identitat"
     }
 }