@parlor/capabilities 0.0.0-stage → 0.2.0

package/dist/deep-link/tauri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tauri.js","sourceRoot":"","sources":["../../src/deep-link/tauri.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAQ/C,MAAM,UAAU,aAAa,CAC3B,IAAI,GAAuC,GAAG,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC;IAEvF,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,KAAK,OAAO;QAC7C,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;oBAClB,IAAI,SAAS,GAAG,KAAK,CAAC;oBACtB,MAAM,OAAO,GAAG,CAAC,IAAqB,EAAE,EAAE;wBACxC,IAAI,SAAS;4BAAE,OAAO;wBACtB,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE;4BAAE,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC7C,CAAC,CAAC;oBACF,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC3C,OAAO,GAAG,EAAE;wBACV,SAAS,GAAG,IAAI,CAAC;wBACjB,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;oBACvC,CAAC,CAAC;gBACJ,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { CapabilityAdapter } from \"../capability.js\";\nimport { detectPlatform } from \"../runtime.js\";\nimport type { DeepLink } from \"./interface.js\";\n\nexport interface TauriDeepLinkModule {\n  getCurrent(): Promise<string[] | null>;\n  onOpenUrl(handler: (urls: string[]) => void): Promise<() => void>;\n}\n\nexport function tauriDeepLink(\n  load: () => Promise<TauriDeepLinkModule> = () => import(\"@tauri-apps/plugin-deep-link\"),\n): CapabilityAdapter<DeepLink> {\n  return {\n    platform: \"tauri\",\n    available: () => detectPlatform() === \"tauri\",\n    create: async () => {\n      const plugin = await load();\n      return {\n        onOpen: (handler) => {\n          let cancelled = false;\n          const deliver = (urls: string[] | null) => {\n            if (cancelled) return;\n            for (const url of urls ?? []) handler(url);\n          };\n          void plugin.getCurrent().then(deliver);\n          const unlisten = plugin.onOpenUrl(deliver);\n          return () => {\n            cancelled = true;\n            void unlisten.then((stop) => stop());\n          };\n        },\n      };\n    },\n  };\n}\n"]}

package/dist/deep-link/web.d.ts

@@ -0,0 +1,4 @@
+import type { CapabilityAdapter } from "../capability.js";
+import type { DeepLink } from "./interface.js";
+export declare function webDeepLink(currentUrl?: () => string | undefined): CapabilityAdapter<DeepLink>;
+//# sourceMappingURL=web.d.ts.map

package/dist/deep-link/web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/deep-link/web.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,wBAAgB,WAAW,CACzB,UAAU,GAAE,MAAM,MAAM,GAAG,SAA2C,GACrE,iBAAiB,CAAC,QAAQ,CAAC,CAiB7B"}

package/dist/deep-link/web.js

@@ -0,0 +1,20 @@
+export function webDeepLink(currentUrl = () => globalThis.location?.href) {
+    return {
+        platform: "web",
+        available: () => currentUrl() !== undefined,
+        create: () => ({
+            onOpen: (handler) => {
+                let cancelled = false;
+                queueMicrotask(() => {
+                    const url = currentUrl();
+                    if (!cancelled && url)
+                        handler(url);
+                });
+                return () => {
+                    cancelled = true;
+                };
+            },
+        }),
+    };
+}
+//# sourceMappingURL=web.js.map

package/dist/deep-link/web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.js","sourceRoot":"","sources":["../../src/deep-link/web.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,WAAW,CACzB,UAAU,GAA6B,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI;IAEtE,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,SAAS;QAC3C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;gBAClB,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,cAAc,CAAC,GAAG,EAAE;oBAClB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;oBACzB,IAAI,CAAC,SAAS,IAAI,GAAG;wBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,EAAE;oBACV,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC,CAAC;YACJ,CAAC;SACF,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["import type { CapabilityAdapter } from \"../capability.js\";\nimport type { DeepLink } from \"./interface.js\";\n\nexport function webDeepLink(\n  currentUrl: () => string | undefined = () => globalThis.location?.href,\n): CapabilityAdapter<DeepLink> {\n  return {\n    platform: \"web\",\n    available: () => currentUrl() !== undefined,\n    create: () => ({\n      onOpen: (handler) => {\n        let cancelled = false;\n        queueMicrotask(() => {\n          const url = currentUrl();\n          if (!cancelled && url) handler(url);\n        });\n        return () => {\n          cancelled = true;\n        };\n      },\n    }),\n  };\n}\n"]}

package/dist/device-key/capacitor.d.ts

@@ -0,0 +1,32 @@
+import type { CapabilityAdapter } from "../capability.js";
+import type { DeviceKey } from "./interface.js";
+/** The `ParlorDeviceKey` native plugin: the Secure Enclave, or a Keychain key, on iOS. */
+export interface CapacitorDeviceKeyModule {
+    ParlorDeviceKey: {
+        publicKeys(options: {
+            presence: boolean;
+            challenge: string;
+        }): Promise<{
+            signing: {
+                keyId: string;
+                publicKey: JsonWebKey;
+            };
+            presence?: {
+                keyId: string;
+                publicKey: JsonWebKey;
+            };
+            proof: {
+                signature: string;
+            };
+        }>;
+        /** A presence key carries a biometry-or-passcode access control the hardware enforces. */
+        sign(options: {
+            keyId: string;
+            payload: string;
+        }): Promise<{
+            signature: string;
+        }>;
+    };
+}
+export declare function capacitorDeviceKey(load?: () => Promise<CapacitorDeviceKeyModule>): CapabilityAdapter<DeviceKey>;
+//# sourceMappingURL=capacitor.d.ts.map

package/dist/device-key/capacitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capacitor.d.ts","sourceRoot":"","sources":["../../src/device-key/capacitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE;QACf,UAAU,CAAC,OAAO,EAAE;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YACrE,OAAO,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,UAAU,CAAA;aAAE,CAAC;YAClD,QAAQ,CAAC,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,UAAU,CAAA;aAAE,CAAC;YACpD,KAAK,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAA;aAAE,CAAC;SAC9B,CAAC,CAAC;QACH,0FAA0F;QAC1F,IAAI,CAAC,OAAO,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACnF,CAAC;CACH;AAED,wBAAgB,kBAAkB,CAChC,IAAI,GAAE,MAAM,OAAO,CAAC,wBAAwB,CACJ,GACvC,iBAAiB,CAAC,SAAS,CAAC,CAM9B"}

package/dist/device-key/capacitor.js

@@ -0,0 +1,9 @@
+import { hasIosPlugin, nativeDeviceKey } from "./native.js";
+export function capacitorDeviceKey(load = () => import("@parlor/capacitor-device-key")) {
+    return {
+        platform: "capacitor",
+        available: hasIosPlugin,
+        create: async () => nativeDeviceKey((await load()).ParlorDeviceKey),
+    };
+}
+//# sourceMappingURL=capacitor.js.map

package/dist/device-key/capacitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capacitor.js","sourceRoot":"","sources":["../../src/device-key/capacitor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAe5D,MAAM,UAAU,kBAAkB,CAChC,IAAI,GAA4C,GAAG,EAAE,CACnD,MAAM,CAAC,8BAA8B,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,YAAY;QACvB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC;KACpE,CAAC;AACJ,CAAC","sourcesContent":["import type { CapabilityAdapter } from \"../capability.js\";\nimport type { DeviceKey } from \"./interface.js\";\nimport { hasIosPlugin, nativeDeviceKey } from \"./native.js\";\n\n/** The `ParlorDeviceKey` native plugin: the Secure Enclave, or a Keychain key, on iOS. */\nexport interface CapacitorDeviceKeyModule {\n  ParlorDeviceKey: {\n    publicKeys(options: { presence: boolean; challenge: string }): Promise<{\n      signing: { keyId: string; publicKey: JsonWebKey };\n      presence?: { keyId: string; publicKey: JsonWebKey };\n      proof: { signature: string };\n    }>;\n    /** A presence key carries a biometry-or-passcode access control the hardware enforces. */\n    sign(options: { keyId: string; payload: string }): Promise<{ signature: string }>;\n  };\n}\n\nexport function capacitorDeviceKey(\n  load: () => Promise<CapacitorDeviceKeyModule> = () =>\n    import(\"@parlor/capacitor-device-key\"),\n): CapabilityAdapter<DeviceKey> {\n  return {\n    platform: \"capacitor\",\n    available: hasIosPlugin,\n    create: async () => nativeDeviceKey((await load()).ParlorDeviceKey),\n  };\n}\n"]}

package/dist/device-key/encoding.d.ts

@@ -0,0 +1,12 @@
+import type { PresencePublicKey } from "./interface.js";
+export declare function encodeBase64url(bytes: Uint8Array): string;
+export declare function decodeBase64url(text: string): Uint8Array<ArrayBuffer>;
+/** Sorted-key JSON at every level, UTF-8: the same bytes on every device and host. */
+export declare function canonicalBytes(value: unknown): Uint8Array;
+export declare function publicPoint(key: JsonWebKey): JsonWebKey;
+export declare function enrollmentBytes(input: {
+    readonly challenge: Uint8Array;
+    readonly signing: JsonWebKey;
+    readonly presence: PresencePublicKey | undefined;
+}): Uint8Array;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/device-key/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/device-key/encoding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAIrE;AAcD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEzD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAEvD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAClD,GAAG,UAAU,CAab"}

package/dist/device-key/encoding.js

@@ -0,0 +1,45 @@
+export function encodeBase64url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+export function decodeBase64url(text) {
+    const padded = text.replaceAll("-", "+").replaceAll("_", "/");
+    const binary = atob(padded.padEnd(Math.ceil(padded.length / 4) * 4, "="));
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function serialize(value) {
+    if (Array.isArray(value))
+        return `[${value.map(serialize).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const members = Object.entries(value)
+            .filter(([, member]) => member !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([key, member]) => `${JSON.stringify(key)}:${serialize(member)}`);
+        return `{${members.join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+/** Sorted-key JSON at every level, UTF-8: the same bytes on every device and host. */
+export function canonicalBytes(value) {
+    return new TextEncoder().encode(serialize(value));
+}
+export function publicPoint(key) {
+    return { kty: key.kty, crv: key.crv, x: key.x, y: key.y };
+}
+export function enrollmentBytes(input) {
+    const { presence } = input;
+    return canonicalBytes({
+        challenge: encodeBase64url(input.challenge),
+        signing: publicPoint(input.signing),
+        presence: presence
+            ? {
+                format: presence.format,
+                id: presence.format === "webauthn" ? presence.credentialId : presence.keyId,
+                publicKey: publicPoint(presence.publicKey),
+            }
+            : null,
+    });
+}
+//# sourceMappingURL=encoding.js.map

package/dist/device-key/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/device-key/encoding.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC;aAC5C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAE,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAI/B;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,OAAO,cAAc,CAAC;QACpB,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;QAC3C,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,QAAQ,EAAE,QAAQ;YAChB,CAAC,CAAC;gBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;gBAC3E,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;aAC3C;YACH,CAAC,CAAC,IAAI;KACT,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { PresencePublicKey } from \"./interface.js\";\n\nexport function encodeBase64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\n\nexport function decodeBase64url(text: string): Uint8Array<ArrayBuffer> {\n  const padded = text.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\");\n  const binary = atob(padded.padEnd(Math.ceil(padded.length / 4) * 4, \"=\"));\n  return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n}\n\nfunction serialize(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(serialize).join(\",\")}]`;\n  if (value !== null && typeof value === \"object\") {\n    const members = Object.entries(value)\n      .filter(([, member]) => member !== undefined)\n      .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))\n      .map(([key, member]) => `${JSON.stringify(key)}:${serialize(member)}`);\n    return `{${members.join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n\n/** Sorted-key JSON at every level, UTF-8: the same bytes on every device and host. */\nexport function canonicalBytes(value: unknown): Uint8Array {\n  return new TextEncoder().encode(serialize(value));\n}\n\nexport function publicPoint(key: JsonWebKey): JsonWebKey {\n  return { kty: key.kty!, crv: key.crv!, x: key.x!, y: key.y! };\n}\n\nexport function enrollmentBytes(input: {\n  readonly challenge: Uint8Array;\n  readonly signing: JsonWebKey;\n  readonly presence: PresencePublicKey | undefined;\n}): Uint8Array {\n  const { presence } = input;\n  return canonicalBytes({\n    challenge: encodeBase64url(input.challenge),\n    signing: publicPoint(input.signing),\n    presence: presence\n      ? {\n          format: presence.format,\n          id: presence.format === \"webauthn\" ? presence.credentialId : presence.keyId,\n          publicKey: publicPoint(presence.publicKey),\n        }\n      : null,\n  });\n}\n"]}

package/dist/device-key/index.d.ts

@@ -0,0 +1,8 @@
+import type { DeviceKey } from "./interface.js";
+export { capacitorDeviceKey, type CapacitorDeviceKeyModule } from "./capacitor.js";
+export { PresenceSetupCancelled } from "./interface.js";
+export type { DeviceKey, DevicePublicKeys, DeviceSignature, PresenceEnrollment, PresencePublicKey, PresenceSignature, } from "./interface.js";
+export { tauriDeviceKey, type TauriInvoke } from "./tauri.js";
+export { webDeviceKey, type WebDeviceKeyApis } from "./web.js";
+export declare const deviceKey: import("../capability.js").CapabilityDefinition<DeviceKey>;
+//# sourceMappingURL=index.d.ts.map

package/dist/device-key/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/device-key/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAEnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE/D,eAAO,MAAM,SAAS,4DAGpB,CAAC"}

package/dist/device-key/index.js

@@ -0,0 +1,11 @@
+import { platformAdapters } from "#adapters";
+import { defineCapability } from "../capability.js";
+export { capacitorDeviceKey } from "./capacitor.js";
+export { PresenceSetupCancelled } from "./interface.js";
+export { tauriDeviceKey } from "./tauri.js";
+export { webDeviceKey } from "./web.js";
+export const deviceKey = defineCapability({
+    name: "deviceKey",
+    adapters: platformAdapters.deviceKey,
+});
+//# sourceMappingURL=index.js.map

package/dist/device-key/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/device-key/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAiC,MAAM,gBAAgB,CAAC;AAEnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AASxD,OAAO,EAAE,cAAc,EAAoB,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAyB,MAAM,UAAU,CAAC;AAE/D,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAY;IACnD,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,gBAAgB,CAAC,SAAS;CACrC,CAAC,CAAC","sourcesContent":["import { platformAdapters } from \"#adapters\";\n\nimport { defineCapability } from \"../capability.js\";\nimport type { DeviceKey } from \"./interface.js\";\n\nexport { capacitorDeviceKey, type CapacitorDeviceKeyModule } from \"./capacitor.js\";\n\nexport { PresenceSetupCancelled } from \"./interface.js\";\nexport type {\n  DeviceKey,\n  DevicePublicKeys,\n  DeviceSignature,\n  PresenceEnrollment,\n  PresencePublicKey,\n  PresenceSignature,\n} from \"./interface.js\";\nexport { tauriDeviceKey, type TauriInvoke } from \"./tauri.js\";\nexport { webDeviceKey, type WebDeviceKeyApis } from \"./web.js\";\n\nexport const deviceKey = defineCapability<DeviceKey>({\n  name: \"deviceKey\",\n  adapters: platformAdapters.deviceKey,\n});\n"]}

package/dist/device-key/interface.d.ts

@@ -0,0 +1,74 @@
+/**
+ * A device's signing identity; its private keys never leave the platform keystore. The
+ * signing key signs prompts with no user present. The presence key signs answers to an
+ * agent's own permission prompts and always needs Touch ID, Face ID or a passkey.
+ */
+export interface DeviceKey {
+    /**
+     * Creates the keys on first use; stable afterwards. `presence: false` settles this device
+     * without a presence key. Throws `PresenceSetupCancelled`, keeping nothing, when the user
+     * dismisses the platform's prompt, so a later call can ask again.
+     */
+    publicKeys(enrollment: PresenceEnrollment, options?: {
+        readonly presence?: boolean;
+    }): Promise<DevicePublicKeys>;
+    /**
+     * `needed` while the next `publicKeys` would show a platform prompt (a passkey on the web),
+     * so the app can explain it first. Absent where creating the keys never prompts.
+     */
+    presenceSetup?(): Promise<"needed" | "done">;
+    sign(payload: Uint8Array, options: {
+        readonly presence: false;
+    }): Promise<DeviceSignature>;
+    sign(payload: Uint8Array, options: {
+        readonly presence: true;
+    }): Promise<PresenceSignature>;
+}
+export declare class PresenceSetupCancelled extends Error {
+    readonly name = "PresenceSetupCancelled";
+    constructor();
+}
+export interface PresenceEnrollment {
+    readonly rpId: string;
+    readonly userId: string;
+    readonly userName: string;
+    /** Server-issued, single use; the proof of possession signs it. */
+    readonly challenge: Uint8Array;
+}
+export interface DevicePublicKeys {
+    readonly signing: {
+        readonly keyId: string;
+        readonly publicKey: JsonWebKey;
+    };
+    /** Absent where the platform has no presence authenticator. */
+    readonly presence?: PresencePublicKey | undefined;
+    readonly proof: DeviceSignature;
+}
+export type PresencePublicKey = {
+    readonly format: "webauthn";
+    readonly credentialId: string;
+    readonly publicKey: JsonWebKey;
+    /** The attestation object, verified by the server once at enrollment. */
+    readonly attestation: string;
+} | {
+    readonly format: "es256-raw";
+    readonly keyId: string;
+    readonly publicKey: JsonWebKey;
+};
+export interface DeviceSignature {
+    readonly keyId: string;
+    readonly presence: "none" | "user";
+    readonly format: "es256-raw" | "webauthn";
+    /** base64url */
+    readonly signature: string;
+    readonly authenticatorData?: string | undefined;
+    readonly clientDataJSON?: string | undefined;
+}
+declare const presenceBrand: unique symbol;
+/** Only `sign(..., { presence: true })` produces one, so an ordinary signature never passes for it. */
+export type PresenceSignature = DeviceSignature & {
+    readonly presence: "user";
+    readonly [presenceBrand]: true;
+};
+export {};
+//# sourceMappingURL=interface.d.ts.map

package/dist/device-key/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/device-key/interface.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,UAAU,CACR,UAAU,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;IAC7C,IAAI,CACF,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;KAAE,GACpC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,IAAI,CACF,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,GACnC,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,SAAkB,IAAI,4BAA4B;IAClD,cAEC;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC;IAC7E,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,CAAC;IAC1C,gBAAgB;IAChB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED,OAAO,CAAC,MAAM,aAAa,EAAE,OAAO,MAAM,CAAC;AAE3C,uGAAuG;AACvG,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;CAChC,CAAC"}

package/dist/device-key/interface.js

@@ -0,0 +1,7 @@
+export class PresenceSetupCancelled extends Error {
+    name = "PresenceSetupCancelled";
+    constructor() {
+        super("The passkey was not created.");
+    }
+}
+//# sourceMappingURL=interface.js.map

package/dist/device-key/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/device-key/interface.ts"],"names":[],"mappings":"AA8BA,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC7B,IAAI,GAAG,wBAAwB,CAAC;IAClD;QACE,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACxC,CAAC;CACF","sourcesContent":["/**\n * A device's signing identity; its private keys never leave the platform keystore. The\n * signing key signs prompts with no user present. The presence key signs answers to an\n * agent's own permission prompts and always needs Touch ID, Face ID or a passkey.\n */\nexport interface DeviceKey {\n  /**\n   * Creates the keys on first use; stable afterwards. `presence: false` settles this device\n   * without a presence key. Throws `PresenceSetupCancelled`, keeping nothing, when the user\n   * dismisses the platform's prompt, so a later call can ask again.\n   */\n  publicKeys(\n    enrollment: PresenceEnrollment,\n    options?: { readonly presence?: boolean },\n  ): Promise<DevicePublicKeys>;\n  /**\n   * `needed` while the next `publicKeys` would show a platform prompt (a passkey on the web),\n   * so the app can explain it first. Absent where creating the keys never prompts.\n   */\n  presenceSetup?(): Promise<\"needed\" | \"done\">;\n  sign(\n    payload: Uint8Array,\n    options: { readonly presence: false },\n  ): Promise<DeviceSignature>;\n  sign(\n    payload: Uint8Array,\n    options: { readonly presence: true },\n  ): Promise<PresenceSignature>;\n}\n\nexport class PresenceSetupCancelled extends Error {\n  override readonly name = \"PresenceSetupCancelled\";\n  constructor() {\n    super(\"The passkey was not created.\");\n  }\n}\n\nexport interface PresenceEnrollment {\n  readonly rpId: string;\n  readonly userId: string;\n  readonly userName: string;\n  /** Server-issued, single use; the proof of possession signs it. */\n  readonly challenge: Uint8Array;\n}\n\nexport interface DevicePublicKeys {\n  readonly signing: { readonly keyId: string; readonly publicKey: JsonWebKey };\n  /** Absent where the platform has no presence authenticator. */\n  readonly presence?: PresencePublicKey | undefined;\n  readonly proof: DeviceSignature;\n}\n\nexport type PresencePublicKey =\n  | {\n      readonly format: \"webauthn\";\n      readonly credentialId: string;\n      readonly publicKey: JsonWebKey;\n      /** The attestation object, verified by the server once at enrollment. */\n      readonly attestation: string;\n    }\n  | {\n      readonly format: \"es256-raw\";\n      readonly keyId: string;\n      readonly publicKey: JsonWebKey;\n    };\n\nexport interface DeviceSignature {\n  readonly keyId: string;\n  readonly presence: \"none\" | \"user\";\n  readonly format: \"es256-raw\" | \"webauthn\";\n  /** base64url */\n  readonly signature: string;\n  readonly authenticatorData?: string | undefined;\n  readonly clientDataJSON?: string | undefined;\n}\n\ndeclare const presenceBrand: unique symbol;\n\n/** Only `sign(..., { presence: true })` produces one, so an ordinary signature never passes for it. */\nexport type PresenceSignature = DeviceSignature & {\n  readonly presence: \"user\";\n  readonly [presenceBrand]: true;\n};\n"]}

package/dist/device-key/native.d.ts

@@ -0,0 +1,38 @@
+import type { DeviceKey } from "./interface.js";
+export interface NativePublicKeys {
+    readonly signing: {
+        readonly keyId: string;
+        readonly publicKey: JsonWebKey;
+    };
+    readonly presence?: {
+        readonly keyId: string;
+        readonly publicKey: JsonWebKey;
+    };
+    readonly proof: {
+        readonly signature: string;
+    };
+}
+export interface NativeKeystore {
+    publicKeys(options: {
+        readonly presence: boolean;
+        readonly challenge: string;
+    }): Promise<NativePublicKeys>;
+    sign(options: {
+        readonly keyId: string;
+        readonly payload: string;
+    }): Promise<{
+        readonly signature: string;
+    }>;
+}
+export declare function nativeDeviceKey(keystore: NativeKeystore): DeviceKey;
+interface Invoker {
+    invoke<T>(command: string, args?: Record<string, unknown>): Promise<T>;
+}
+/**
+ * Whether the shell carries a working native command: one an older generated project lacks
+ * ("not found") or a platform without a keystore refuses ("unsupported") is unavailable.
+ */
+export declare function hasNativeCommand(load: () => Promise<Invoker>, command: string, args?: Record<string, unknown>): Promise<boolean>;
+export declare function hasIosPlugin(): boolean;
+export {};
+//# sourceMappingURL=native.d.ts.map

package/dist/device-key/native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/device-key/native.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,SAAS,EAIV,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC;IAC/E,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,OAAO,EAAE;QAClB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE;QACZ,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7C;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAwDnE;AAED,UAAU,OAAO;IACf,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACxE;AAID;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC5B,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,wBAAgB,YAAY,IAAI,OAAO,CAGtC"}

package/dist/device-key/native.js

@@ -0,0 +1,67 @@
+import { detectPlatform } from "../runtime.js";
+import { encodeBase64url } from "./encoding.js";
+export function nativeDeviceKey(keystore) {
+    let known;
+    const keysOf = () => (known ??= keystore.publicKeys({ presence: true, challenge: "" }));
+    const signature = async (keyId, presence, payload) => ({
+        keyId,
+        presence,
+        format: "es256-raw",
+        signature: (await keystore.sign({ keyId, payload: encodeBase64url(payload) }))
+            .signature,
+    });
+    async function sign(payload, options) {
+        const keys = await keysOf();
+        if (!options.presence)
+            return signature(keys.signing.keyId, "none", payload);
+        if (!keys.presence)
+            throw new Error("This device has no presence key.");
+        return (await signature(keys.presence.keyId, "user", payload));
+    }
+    return {
+        async publicKeys(enrollment) {
+            const pending = keystore.publicKeys({
+                presence: true,
+                challenge: encodeBase64url(enrollment.challenge),
+            });
+            known = pending;
+            const keys = await pending;
+            return {
+                signing: keys.signing,
+                presence: keys.presence && {
+                    format: "es256-raw",
+                    keyId: keys.presence.keyId,
+                    publicKey: keys.presence.publicKey,
+                },
+                proof: {
+                    keyId: keys.signing.keyId,
+                    presence: "none",
+                    format: "es256-raw",
+                    signature: keys.proof.signature,
+                },
+            };
+        },
+        sign,
+    };
+}
+const UNAVAILABLE = /not found|unsupported/i;
+/**
+ * Whether the shell carries a working native command: one an older generated project lacks
+ * ("not found") or a platform without a keystore refuses ("unsupported") is unavailable.
+ */
+export async function hasNativeCommand(load, command, args) {
+    if (detectPlatform() !== "tauri")
+        return false;
+    try {
+        await (await load()).invoke(command, args);
+        return true;
+    }
+    catch (error) {
+        return !UNAVAILABLE.test(error instanceof Error ? error.message : String(error));
+    }
+}
+export function hasIosPlugin() {
+    const { Capacitor } = globalThis;
+    return detectPlatform() === "capacitor" && Capacitor?.getPlatform?.() === "ios";
+}
+//# sourceMappingURL=native.js.map

package/dist/device-key/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../../src/device-key/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAyBhD,MAAM,UAAU,eAAe,CAAC,QAAwB;IACtD,IAAI,KAA4C,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAExF,MAAM,SAAS,GAAG,KAAK,EACrB,KAAa,EACb,QAAyB,EACzB,OAAmB,EACO,EAAE,CAAC,CAAC;QAC9B,KAAK;QACL,QAAQ;QACR,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aAC3E,SAAS;KACb,CAAC,CAAC;IAUH,KAAK,UAAU,IAAI,CAAC,OAAmB,EAAE,OAAuC;QAC9E,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxE,OAAO,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAsB,CAAC;IACtF,CAAC;IAED,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,UAAU;YACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC;gBAClC,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC;aACjD,CAAC,CAAC;YACH,KAAK,GAAG,OAAO,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI;oBACzB,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;oBAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;iBACnC;gBACD,KAAK,EAAE;oBACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;oBACzB,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,WAAW;oBACnB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;iBAChC;aACF,CAAC;QACJ,CAAC;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAMD,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAA4B,EAC5B,OAAe,EACf,IAA8B;IAE9B,IAAI,cAAc,EAAE,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,UAA4D,CAAC;IACnF,OAAO,cAAc,EAAE,KAAK,WAAW,IAAI,SAAS,EAAE,WAAW,EAAE,EAAE,KAAK,KAAK,CAAC;AAClF,CAAC","sourcesContent":["import { detectPlatform } from \"../runtime.js\";\nimport { encodeBase64url } from \"./encoding.js\";\nimport type {\n  DeviceKey,\n  DevicePublicKeys,\n  DeviceSignature,\n  PresenceSignature,\n} from \"./interface.js\";\n\nexport interface NativePublicKeys {\n  readonly signing: { readonly keyId: string; readonly publicKey: JsonWebKey };\n  readonly presence?: { readonly keyId: string; readonly publicKey: JsonWebKey };\n  readonly proof: { readonly signature: string };\n}\n\nexport interface NativeKeystore {\n  publicKeys(options: {\n    readonly presence: boolean;\n    readonly challenge: string;\n  }): Promise<NativePublicKeys>;\n  sign(options: {\n    readonly keyId: string;\n    readonly payload: string;\n  }): Promise<{ readonly signature: string }>;\n}\n\nexport function nativeDeviceKey(keystore: NativeKeystore): DeviceKey {\n  let known: Promise<NativePublicKeys> | undefined;\n  const keysOf = () => (known ??= keystore.publicKeys({ presence: true, challenge: \"\" }));\n\n  const signature = async (\n    keyId: string,\n    presence: \"none\" | \"user\",\n    payload: Uint8Array,\n  ): Promise<DeviceSignature> => ({\n    keyId,\n    presence,\n    format: \"es256-raw\",\n    signature: (await keystore.sign({ keyId, payload: encodeBase64url(payload) }))\n      .signature,\n  });\n\n  async function sign(\n    payload: Uint8Array,\n    options: { readonly presence: false },\n  ): Promise<DeviceSignature>;\n  async function sign(\n    payload: Uint8Array,\n    options: { readonly presence: true },\n  ): Promise<PresenceSignature>;\n  async function sign(payload: Uint8Array, options: { readonly presence: boolean }) {\n    const keys = await keysOf();\n    if (!options.presence) return signature(keys.signing.keyId, \"none\", payload);\n    if (!keys.presence) throw new Error(\"This device has no presence key.\");\n    return (await signature(keys.presence.keyId, \"user\", payload)) as PresenceSignature;\n  }\n\n  return {\n    async publicKeys(enrollment): Promise<DevicePublicKeys> {\n      const pending = keystore.publicKeys({\n        presence: true,\n        challenge: encodeBase64url(enrollment.challenge),\n      });\n      known = pending;\n      const keys = await pending;\n      return {\n        signing: keys.signing,\n        presence: keys.presence && {\n          format: \"es256-raw\",\n          keyId: keys.presence.keyId,\n          publicKey: keys.presence.publicKey,\n        },\n        proof: {\n          keyId: keys.signing.keyId,\n          presence: \"none\",\n          format: \"es256-raw\",\n          signature: keys.proof.signature,\n        },\n      };\n    },\n    sign,\n  };\n}\n\ninterface Invoker {\n  invoke<T>(command: string, args?: Record<string, unknown>): Promise<T>;\n}\n\nconst UNAVAILABLE = /not found|unsupported/i;\n\n/**\n * Whether the shell carries a working native command: one an older generated project lacks\n * (\"not found\") or a platform without a keystore refuses (\"unsupported\") is unavailable.\n */\nexport async function hasNativeCommand(\n  load: () => Promise<Invoker>,\n  command: string,\n  args?: Record<string, unknown>,\n): Promise<boolean> {\n  if (detectPlatform() !== \"tauri\") return false;\n  try {\n    await (await load()).invoke(command, args);\n    return true;\n  } catch (error) {\n    return !UNAVAILABLE.test(error instanceof Error ? error.message : String(error));\n  }\n}\n\nexport function hasIosPlugin(): boolean {\n  const { Capacitor } = globalThis as { Capacitor?: { getPlatform?: () => string } };\n  return detectPlatform() === \"capacitor\" && Capacitor?.getPlatform?.() === \"ios\";\n}\n"]}

package/dist/device-key/tauri.d.ts

@@ -0,0 +1,8 @@
+import type { CapabilityAdapter } from "../capability.js";
+import type { DeviceKey } from "./interface.js";
+export interface TauriInvoke {
+    invoke<T>(command: string, args?: Record<string, unknown>): Promise<T>;
+}
+/** The generated `parlor_device_key_public` and `parlor_device_key_sign` commands, probed with a sign request for a key that cannot exist. */
+export declare function tauriDeviceKey(load?: () => Promise<TauriInvoke>): CapabilityAdapter<DeviceKey>;
+//# sourceMappingURL=tauri.d.ts.map

package/dist/device-key/tauri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tauri.d.ts","sourceRoot":"","sources":["../../src/device-key/tauri.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACxE;AAED,8IAA8I;AAC9I,wBAAgB,cAAc,CAC5B,IAAI,GAAE,MAAM,OAAO,CAAC,WAAW,CAAwC,GACtE,iBAAiB,CAAC,SAAS,CAAC,CAe9B"}

package/dist/device-key/tauri.js

@@ -0,0 +1,16 @@
+import { hasNativeCommand, nativeDeviceKey } from "./native.js";
+/** The generated `parlor_device_key_public` and `parlor_device_key_sign` commands, probed with a sign request for a key that cannot exist. */
+export function tauriDeviceKey(load = () => import("@tauri-apps/api/core")) {
+    return {
+        platform: "tauri",
+        available: () => hasNativeCommand(load, "parlor_device_key_sign", { keyId: "", payload: "" }),
+        create: async () => {
+            const { invoke } = await load();
+            return nativeDeviceKey({
+                publicKeys: (options) => invoke("parlor_device_key_public", { ...options }),
+                sign: (options) => invoke("parlor_device_key_sign", { ...options }),
+            });
+        },
+    };
+}
+//# sourceMappingURL=tauri.js.map

package/dist/device-key/tauri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tauri.js","sourceRoot":"","sources":["../../src/device-key/tauri.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAyB,MAAM,aAAa,CAAC;AAMvF,8IAA8I;AAC9I,MAAM,UAAU,cAAc,CAC5B,IAAI,GAA+B,GAAG,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC;IAEvE,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,GAAG,EAAE,CACd,gBAAgB,CAAC,IAAI,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC9E,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YAChC,OAAO,eAAe,CAAC;gBACrB,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CACtB,MAAM,CAAmB,0BAA0B,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC;gBACtE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAChB,MAAM,CAAwB,wBAAwB,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC;aAC1E,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { CapabilityAdapter } from \"../capability.js\";\nimport type { DeviceKey } from \"./interface.js\";\nimport { hasNativeCommand, nativeDeviceKey, type NativePublicKeys } from \"./native.js\";\n\nexport interface TauriInvoke {\n  invoke<T>(command: string, args?: Record<string, unknown>): Promise<T>;\n}\n\n/** The generated `parlor_device_key_public` and `parlor_device_key_sign` commands, probed with a sign request for a key that cannot exist. */\nexport function tauriDeviceKey(\n  load: () => Promise<TauriInvoke> = () => import(\"@tauri-apps/api/core\"),\n): CapabilityAdapter<DeviceKey> {\n  return {\n    platform: \"tauri\",\n    available: () =>\n      hasNativeCommand(load, \"parlor_device_key_sign\", { keyId: \"\", payload: \"\" }),\n    create: async () => {\n      const { invoke } = await load();\n      return nativeDeviceKey({\n        publicKeys: (options) =>\n          invoke<NativePublicKeys>(\"parlor_device_key_public\", { ...options }),\n        sign: (options) =>\n          invoke<{ signature: string }>(\"parlor_device_key_sign\", { ...options }),\n      });\n    },\n  };\n}\n"]}

package/dist/device-key/web.d.ts

@@ -0,0 +1,11 @@
+import type { CapabilityAdapter } from "../capability.js";
+import { type DeviceKey } from "./interface.js";
+export interface WebDeviceKeyApis {
+    readonly subtle: SubtleCrypto | undefined;
+    readonly indexedDB: IDBFactory | undefined;
+    readonly credentials: CredentialsContainer | undefined;
+    /** Whether a platform authenticator (Touch ID, Windows Hello) can make the passkey. */
+    readonly platformAuthenticator?: (() => Promise<boolean>) | undefined;
+}
+export declare function webDeviceKey(apis?: () => WebDeviceKeyApis): CapabilityAdapter<DeviceKey>;
+//# sourceMappingURL=web.d.ts.map

package/dist/device-key/web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/device-key/web.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAO1D,OAAO,EACL,KAAK,SAAS,EAOf,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACvD,uFAAuF;IACvF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACvE;AAmQD,wBAAgB,YAAY,CAC1B,IAAI,GAAE,MAAM,gBAKV,GACD,iBAAiB,CAAC,SAAS,CAAC,CAoB9B"}