@sudp-protocol/authorizer 0.1.0

package/README.md

@@ -0,0 +1,93 @@
+# @sudp-protocol/authorizer
+
+> Authorizer-side primitives for **SUDP** — the Secret-Use Delegation Protocol.
+
+The Authorizer is the party that authorizes a secret-backed operation by
+signing the binding hash `β = SHA-256(DS_BIND ‖ r ‖ H(canonical(o)))`
+with an authenticator. This package ships the carrier-agnostic crypto the
+Authorizer needs, plus an optional WebAuthn adapter.
+
+The Rust counterpart that runs in the Custodian is the
+[`sudp` crate](../../custodian/rust/) in the same repository. Both sides
+must agree byte-for-byte on canonical encoding, β, the AEAD-as-wrap AAD
+shapes, and the wrap-key derivation.
+
+## Layout
+
+```
+@sudp-protocol/authorizer            ← carrier-agnostic protocol primitives
+  canonicalize, sha256, computeBinding,
+  deriveWrappingKey, wrapBindingAd, sealAd,
+  aeadSeal, aeadOpen, base64url helpers,
+  DS_BIND / DS_WRAP / DS_SEAL constants
+
+@sudp-protocol/authorizer/webauthn   ← WebAuthn-specific adapter
+  prfToUserKey(prfOutput) → 32-byte y_c
+  assertionToWire(assertion) → wire-shape assertion
+```
+
+Other authenticator realisations (YubiKey static, secure-enclave, HSM,
+mock) bring their own adapters and do **not** touch the WebAuthn subpath.
+The core remains agnostic of how `y_c` was produced.
+
+## Usage sketch
+
+```ts
+import {
+  computeBinding,
+  DS_BIND,
+  deriveWrappingKey,
+  wrapBindingAd,
+  aeadSeal,
+} from "@sudp-protocol/authorizer";
+import { prfToUserKey, assertionToWire } from "@sudp-protocol/authorizer/webauthn";
+
+// 1) Authorizer-side: compute the binding hash β.
+const beta = await computeBinding(DS_BIND, rFreshness, operation);
+
+// 2) Run the WebAuthn ceremony with `beta` as the challenge. The PRF
+//    extension returns raw bytes — turn them into the 32-byte y_c.
+const cred = (await navigator.credentials.get({
+  publicKey: {
+    challenge: beta,
+    extensions: { prf: { eval: { first: prfSalt } } },
+    /* ... rpId, allowCredentials, userVerification: "required", etc. */
+  } as PublicKeyCredentialRequestOptions,
+})) as PublicKeyCredential;
+
+const prfOut = new Uint8Array(
+  (cred.getClientExtensionResults() as { prf?: { results?: { first?: ArrayBuffer } } })
+    .prf!.results!.first!,
+);
+const yc = await prfToUserKey(prfOut);
+
+// 3) Derive W_c and use it to wrap key material destined for the custodian.
+const Wc = await deriveWrappingKey(yc, prfSalt, credentialId);
+const wrapped = aeadSeal(Wc, plaintext, wrapBindingAd(credentialId));
+
+// 4) Ship `{ assertionToWire(cred), wrapped, ... }` to the custodian as
+//    part of the grant.
+```
+
+## End-to-end protocol walkthrough
+
+For how this package fits with the Rust Custodian and the Requester
+across all three phases:
+
+- Runnable, three-process demo over HTTP:
+  [`../../examples/protocol-demo/`](../../examples/protocol-demo/).
+- Byte-level conformance map: the [top-level
+  README](../../README.md#cross-language-alignment).
+- Authorizer-side walkthrough as a conformance test:
+  [`test/protocol_flow.test.ts`](test/protocol_flow.test.ts).
+
+## Status
+
+Pre-1.0, alongside the Rust crate. Wire format and trait shapes may move
+before the 1.0 cut. See the
+[top-level README](https://github.com/xhyumiracle/sudp) and the
+[Rust crate's CHANGELOG](../../custodian/rust/CHANGELOG.md).
+
+## License
+
+Apache-2.0. See [LICENSE](../../LICENSE).

package/dist/aad.d.ts

@@ -0,0 +1,23 @@
+export declare const DS_WRAP: Uint8Array<ArrayBufferLike>;
+export declare const DS_SEAL: Uint8Array<ArrayBufferLike>;
+/**
+ * Current wrap version. Bumped together on both ends of the protocol if the
+ * AAD shape ever changes.
+ */
+export declare const WRAP_VERSION = 1;
+/**
+ * Canonical AAD for the AEAD-as-wrap profile:
+ *
+ *     DS_WRAP ‖ credentialId ‖ ver_be(u16, big-endian)
+ *
+ * Bound as associated data when sealing/opening `K̂_c` under `W_c`, so a
+ * peer-wrapped record cannot be substituted across credentials or versions.
+ */
+export declare function wrapBindingAd(credentialId: Uint8Array, wrapVersion?: number): Uint8Array;
+/**
+ * Canonical AAD for the sealed-body AEAD layer:
+ *
+ *     DS_SEAL ‖ ver_be(u16, big-endian)
+ */
+export declare function sealAd(wrapVersion?: number): Uint8Array;
+//# sourceMappingURL=aad.d.ts.map

package/dist/aad.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aad.d.ts","sourceRoot":"","sources":["../src/aad.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,6BAAuB,CAAC;AAC5C,eAAO,MAAM,OAAO,6BAAuB,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,YAAY,IAAS,CAAC;AAEnC;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,UAAU,EACxB,WAAW,GAAE,MAAqB,GACjC,UAAU,CAEZ;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,WAAW,GAAE,MAAqB,GAAG,UAAU,CAErE"}

package/dist/aad.js

@@ -0,0 +1,28 @@
+import { concatBytes, u16beBytes, utf8 } from "./bytes.js";
+export const DS_WRAP = utf8("sudp/v1/wrap");
+export const DS_SEAL = utf8("sudp/v1/seal");
+/**
+ * Current wrap version. Bumped together on both ends of the protocol if the
+ * AAD shape ever changes.
+ */
+export const WRAP_VERSION = 0x0001;
+/**
+ * Canonical AAD for the AEAD-as-wrap profile:
+ *
+ *     DS_WRAP ‖ credentialId ‖ ver_be(u16, big-endian)
+ *
+ * Bound as associated data when sealing/opening `K̂_c` under `W_c`, so a
+ * peer-wrapped record cannot be substituted across credentials or versions.
+ */
+export function wrapBindingAd(credentialId, wrapVersion = WRAP_VERSION) {
+    return concatBytes(DS_WRAP, credentialId, u16beBytes(wrapVersion));
+}
+/**
+ * Canonical AAD for the sealed-body AEAD layer:
+ *
+ *     DS_SEAL ‖ ver_be(u16, big-endian)
+ */
+export function sealAd(wrapVersion = WRAP_VERSION) {
+    return concatBytes(DS_SEAL, u16beBytes(wrapVersion));
+}
+//# sourceMappingURL=aad.js.map

package/dist/aad.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aad.js","sourceRoot":"","sources":["../src/aad.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5C,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAwB,EACxB,cAAsB,YAAY;IAElC,OAAO,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,cAAsB,YAAY;IACvD,OAAO,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/aead.d.ts

@@ -0,0 +1,27 @@
+/**
+ * XChaCha20-Poly1305 raw encrypt with a caller-supplied nonce.
+ *
+ * Output is `ciphertext ‖ tag` (no nonce prefix). Use {@link aeadSeal} for
+ * the standard SUDP wire format that prepends a freshly random nonce.
+ *
+ * MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::primitives::Aead::encrypt`.
+ */
+export declare function aeadEncrypt(key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Uint8Array;
+/**
+ * XChaCha20-Poly1305 thin wrapper.
+ *
+ * Wire layout (MUST match `sudp::primitives::Aead::seal`):
+ *
+ *     nonce(24 bytes) ‖ ciphertext ‖ tag(16 bytes)
+ *
+ * The 24-byte nonce is freshly generated per call. The caller supplies the
+ * canonical AAD (see {@link wrapBindingAd}, {@link sealAd}).
+ */
+export declare function aeadSeal(key: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Uint8Array;
+/**
+ * Counterpart to {@link aeadSeal}. Throws if the AAD/nonce/ciphertext are
+ * not authentic under `key`.
+ */
+export declare function aeadOpen(key: Uint8Array, sealed: Uint8Array, aad: Uint8Array): Uint8Array;
+//# sourceMappingURL=aead.d.ts.map

package/dist/aead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.d.ts","sourceRoot":"","sources":["../src/aead.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,GACd,UAAU,CAKZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,GACd,UAAU,CAOZ;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,UAAU,GACd,UAAU,CAOZ"}

package/dist/aead.js

@@ -0,0 +1,49 @@
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+const XNONCE_LEN = 24;
+const XTAG_LEN = 16;
+/**
+ * XChaCha20-Poly1305 raw encrypt with a caller-supplied nonce.
+ *
+ * Output is `ciphertext ‖ tag` (no nonce prefix). Use {@link aeadSeal} for
+ * the standard SUDP wire format that prepends a freshly random nonce.
+ *
+ * MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::primitives::Aead::encrypt`.
+ */
+export function aeadEncrypt(key, nonce, plaintext, aad) {
+    if (nonce.byteLength !== XNONCE_LEN) {
+        throw new Error(`aeadEncrypt: nonce must be ${XNONCE_LEN} bytes, got ${nonce.byteLength}`);
+    }
+    return xchacha20poly1305(key, nonce, aad).encrypt(plaintext);
+}
+/**
+ * XChaCha20-Poly1305 thin wrapper.
+ *
+ * Wire layout (MUST match `sudp::primitives::Aead::seal`):
+ *
+ *     nonce(24 bytes) ‖ ciphertext ‖ tag(16 bytes)
+ *
+ * The 24-byte nonce is freshly generated per call. The caller supplies the
+ * canonical AAD (see {@link wrapBindingAd}, {@link sealAd}).
+ */
+export function aeadSeal(key, plaintext, aad) {
+    const nonce = crypto.getRandomValues(new Uint8Array(XNONCE_LEN));
+    const ct = aeadEncrypt(key, nonce, plaintext, aad);
+    const out = new Uint8Array(XNONCE_LEN + ct.byteLength);
+    out.set(nonce, 0);
+    out.set(ct, XNONCE_LEN);
+    return out;
+}
+/**
+ * Counterpart to {@link aeadSeal}. Throws if the AAD/nonce/ciphertext are
+ * not authentic under `key`.
+ */
+export function aeadOpen(key, sealed, aad) {
+    if (sealed.byteLength <= XNONCE_LEN + XTAG_LEN) {
+        throw new Error("aeadOpen: sealed blob is too short");
+    }
+    const nonce = sealed.slice(0, XNONCE_LEN);
+    const ct = sealed.slice(XNONCE_LEN);
+    return xchacha20poly1305(key, nonce, aad).decrypt(ct);
+}
+//# sourceMappingURL=aead.js.map

package/dist/aead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.js","sourceRoot":"","sources":["../src/aead.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,KAAiB,EACjB,SAAqB,EACrB,GAAe;IAEf,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,eAAe,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,GAAe,EACf,SAAqB,EACrB,GAAe;IAEf,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,GAAe,EACf,MAAkB,EAClB,GAAe;IAEf,IAAI,MAAM,CAAC,UAAU,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/binding.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Domain separation tag for the Phase II.2 binding hash. Matches the Rust
+ * crate's `sudp::primitives::domain::DS_BIND` byte-for-byte.
+ *
+ *     β = SHA-256(DS_BIND ‖ r ‖ SHA-256(canonical(o)))
+ */
+export declare const DS_BIND: Uint8Array<ArrayBufferLike>;
+/**
+ * Compute the binding hash `β` for a given operation, freshness `r`, and
+ * domain separation tag.
+ *
+ *     β = SHA-256(domain ‖ r ‖ SHA-256(canonical(op)))
+ *
+ * The Authorizer signs `β` with its authenticator. The custodian recomputes
+ * `β` from the redeemed grant's `(o, r)` and verifies the signature.
+ *
+ * Pass {@link DS_BIND} for the default profile; other domains may be used
+ * by adjacent ceremonies (e.g. setup attestation) and live in the
+ * deployment.
+ */
+export declare function computeBinding(domain: Uint8Array, r: Uint8Array, op: unknown): Promise<Uint8Array>;
+//# sourceMappingURL=binding.d.ts.map

package/dist/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,OAAO,6BAAuB,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,CAAC,EAAE,UAAU,EACb,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,UAAU,CAAC,CAGrB"}

package/dist/binding.js

@@ -0,0 +1,28 @@
+import { concatBytes, utf8 } from "./bytes.js";
+import { canonicalize } from "./canonical.js";
+import { sha256 } from "./hash.js";
+/**
+ * Domain separation tag for the Phase II.2 binding hash. Matches the Rust
+ * crate's `sudp::primitives::domain::DS_BIND` byte-for-byte.
+ *
+ *     β = SHA-256(DS_BIND ‖ r ‖ SHA-256(canonical(o)))
+ */
+export const DS_BIND = utf8("sudp/v1/bind");
+/**
+ * Compute the binding hash `β` for a given operation, freshness `r`, and
+ * domain separation tag.
+ *
+ *     β = SHA-256(domain ‖ r ‖ SHA-256(canonical(op)))
+ *
+ * The Authorizer signs `β` with its authenticator. The custodian recomputes
+ * `β` from the redeemed grant's `(o, r)` and verifies the signature.
+ *
+ * Pass {@link DS_BIND} for the default profile; other domains may be used
+ * by adjacent ceremonies (e.g. setup attestation) and live in the
+ * deployment.
+ */
+export async function computeBinding(domain, r, op) {
+    const opHash = await sha256(canonicalize(op));
+    return sha256(concatBytes(domain, r, opHash));
+}
+//# sourceMappingURL=binding.js.map

package/dist/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAkB,EAClB,CAAa,EACb,EAAW;IAEX,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/bytes.d.ts

@@ -0,0 +1,6 @@
+export declare function utf8(s: string): Uint8Array;
+export declare function concatBytes(...parts: readonly Uint8Array[]): Uint8Array;
+export declare function u16beBytes(n: number): Uint8Array;
+export declare function bytesToB64Url(b: Uint8Array): string;
+export declare function b64UrlToBytes(s: string): Uint8Array;
+//# sourceMappingURL=bytes.d.ts.map

package/dist/bytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAEA,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C;AAED,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAUvE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAKhD;AAcD,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAgBnD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAiCnD"}

package/dist/bytes.js

@@ -0,0 +1,91 @@
+const enc = new TextEncoder();
+export function utf8(s) {
+    return enc.encode(s);
+}
+export function concatBytes(...parts) {
+    let total = 0;
+    for (const p of parts)
+        total += p.byteLength;
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const p of parts) {
+        out.set(p, off);
+        off += p.byteLength;
+    }
+    return out;
+}
+export function u16beBytes(n) {
+    if (!Number.isInteger(n) || n < 0 || n > 0xffff) {
+        throw new Error(`u16beBytes: out of range: ${n}`);
+    }
+    return new Uint8Array([(n >> 8) & 0xff, n & 0xff]);
+}
+const B64URL_ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const B64URL_LOOKUP = (() => {
+    const t = new Int8Array(256).fill(-1);
+    for (let i = 0; i < B64URL_ALPHA.length; i++)
+        t[B64URL_ALPHA.charCodeAt(i)] = i;
+    return t;
+})();
+function alpha(i) {
+    // Index is always masked to 0..63, so B64URL_ALPHA[i] is defined.
+    return B64URL_ALPHA[i];
+}
+export function bytesToB64Url(b) {
+    let out = "";
+    let i = 0;
+    for (; i + 3 <= b.length; i += 3) {
+        const x = (b[i] << 16) | (b[i + 1] << 8) | b[i + 2];
+        out += alpha((x >> 18) & 0x3f) + alpha((x >> 12) & 0x3f) + alpha((x >> 6) & 0x3f) + alpha(x & 0x3f);
+    }
+    const rem = b.length - i;
+    if (rem === 1) {
+        const x = b[i] << 16;
+        out += alpha((x >> 18) & 0x3f) + alpha((x >> 12) & 0x3f);
+    }
+    else if (rem === 2) {
+        const x = (b[i] << 16) | (b[i + 1] << 8);
+        out += alpha((x >> 18) & 0x3f) + alpha((x >> 12) & 0x3f) + alpha((x >> 6) & 0x3f);
+    }
+    return out;
+}
+export function b64UrlToBytes(s) {
+    const norm = s.replace(/=+$/, "");
+    const len = norm.length;
+    const fullGroups = Math.floor(len / 4);
+    const rem = len - fullGroups * 4;
+    if (rem === 1)
+        throw new Error("b64UrlToBytes: invalid length");
+    const out = new Uint8Array(fullGroups * 3 + (rem === 0 ? 0 : rem - 1));
+    let outOff = 0;
+    let i = 0;
+    for (; i + 4 <= len; i += 4) {
+        const a = B64URL_LOOKUP[norm.charCodeAt(i)];
+        const b = B64URL_LOOKUP[norm.charCodeAt(i + 1)];
+        const c = B64URL_LOOKUP[norm.charCodeAt(i + 2)];
+        const d = B64URL_LOOKUP[norm.charCodeAt(i + 3)];
+        if ((a | b | c | d) < 0)
+            throw new Error("b64UrlToBytes: invalid character");
+        out[outOff++] = (a << 2) | (b >> 4);
+        out[outOff++] = ((b & 0x0f) << 4) | (c >> 2);
+        out[outOff++] = ((c & 0x03) << 6) | d;
+    }
+    if (rem === 2) {
+        const a = B64URL_LOOKUP[norm.charCodeAt(i)];
+        const b = B64URL_LOOKUP[norm.charCodeAt(i + 1)];
+        if ((a | b) < 0)
+            throw new Error("b64UrlToBytes: invalid character");
+        out[outOff++] = (a << 2) | (b >> 4);
+    }
+    else if (rem === 3) {
+        const a = B64URL_LOOKUP[norm.charCodeAt(i)];
+        const b = B64URL_LOOKUP[norm.charCodeAt(i + 1)];
+        const c = B64URL_LOOKUP[norm.charCodeAt(i + 2)];
+        if ((a | b | c) < 0)
+            throw new Error("b64UrlToBytes: invalid character");
+        out[outOff++] = (a << 2) | (b >> 4);
+        out[outOff++] = ((b & 0x0f) << 4) | (c >> 2);
+    }
+    return out;
+}
+//# sourceMappingURL=bytes.js.map

package/dist/bytes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.js","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,IAAI,CAAC,CAAS;IAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAG,KAA4B;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,YAAY,GAAG,kEAAkE,CAAC;AACxF,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,KAAK,CAAC,CAAS;IACtB,kEAAkE;IAClE,OAAO,YAAY,CAAC,CAAC,CAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAa;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QACvD,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACtB,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC7E,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/canonical.d.ts

@@ -0,0 +1,18 @@
+/**
+ * JCS-style canonical JSON encoder (RFC 8785 subset).
+ *
+ * Properties:
+ *  - Object keys are sorted lexicographically by UTF-16 code unit.
+ *  - Strings use `JSON.stringify` escaping.
+ *  - Numbers must be finite. Floats are rejected — they have no
+ *    byte-reproducible canonical form across endpoints and would be a
+ *    substitution vector against `H(o)`. Use integers, strings, booleans,
+ *    nulls, arrays, or nested objects.
+ *  - `undefined` is treated as `null`.
+ *
+ * This MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::canonical::canonicalize_strict`. The `protocol/test_vectors/`
+ * directory carries the conformance suite.
+ */
+export declare function canonicalize(value: unknown): Uint8Array;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEvD"}

package/dist/canonical.js

@@ -0,0 +1,53 @@
+import { utf8 } from "./bytes.js";
+/**
+ * JCS-style canonical JSON encoder (RFC 8785 subset).
+ *
+ * Properties:
+ *  - Object keys are sorted lexicographically by UTF-16 code unit.
+ *  - Strings use `JSON.stringify` escaping.
+ *  - Numbers must be finite. Floats are rejected — they have no
+ *    byte-reproducible canonical form across endpoints and would be a
+ *    substitution vector against `H(o)`. Use integers, strings, booleans,
+ *    nulls, arrays, or nested objects.
+ *  - `undefined` is treated as `null`.
+ *
+ * This MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::canonical::canonicalize_strict`. The `protocol/test_vectors/`
+ * directory carries the conformance suite.
+ */
+export function canonicalize(value) {
+    return utf8(canonicalizeStr(value));
+}
+function canonicalizeStr(v) {
+    if (v === null || v === undefined)
+        return "null";
+    if (typeof v === "boolean")
+        return v ? "true" : "false";
+    if (typeof v === "number") {
+        if (!Number.isFinite(v)) {
+            throw new Error("canonicalize: non-finite number is not allowed");
+        }
+        if (!Number.isInteger(v)) {
+            throw new Error("canonicalize: float values are rejected (no byte-reproducible canonical form)");
+        }
+        return v.toString();
+    }
+    if (typeof v === "bigint")
+        return v.toString();
+    if (typeof v === "string")
+        return JSON.stringify(v);
+    if (Array.isArray(v)) {
+        return "[" + v.map(canonicalizeStr).join(",") + "]";
+    }
+    if (typeof v === "object") {
+        const obj = v;
+        const keys = Object.keys(obj).sort();
+        return ("{" +
+            keys
+                .map((k) => JSON.stringify(k) + ":" + canonicalizeStr(obj[k]))
+                .join(",") +
+            "}");
+    }
+    throw new Error(`canonicalize: unsupported value type: ${typeof v}`);
+}
+//# sourceMappingURL=canonical.js.map

package/dist/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,CACL,GAAG;YACH,IAAI;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC7D,IAAI,CAAC,GAAG,CAAC;YACZ,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC"}

package/dist/hash.d.ts

@@ -0,0 +1,5 @@
+/**
+ * SHA-256 over a byte buffer. Thin wrapper over the platform's WebCrypto.
+ */
+export declare function sha256(data: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=hash.d.ts.map

package/dist/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAIlE"}

package/dist/hash.js

@@ -0,0 +1,9 @@
+/**
+ * SHA-256 over a byte buffer. Thin wrapper over the platform's WebCrypto.
+ */
+export async function sha256(data) {
+    // `crypto.subtle` is available in modern browsers and Node >= 20.
+    const buf = await crypto.subtle.digest("SHA-256", data);
+    return new Uint8Array(buf);
+}
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAgB;IAC3C,kEAAkE;IAClE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAA8B,CAAC,CAAC;IAClF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@sudp-protocol/authorizer` — Authorizer-side primitives for the
+ * Secret-Use Delegation Protocol.
+ *
+ * This entry point is **carrier-agnostic**: it carries only the protocol
+ * cryptography (canonical JSON, β computation, wrapping-key derivation,
+ * AEAD-as-wrap) and intentionally does **not** know about WebAuthn,
+ * passkeys, HTTP, or any specific authenticator.
+ *
+ * For the WebAuthn PRF → y_c adapter and assertion helpers, import from
+ * `@sudp-protocol/authorizer/webauthn`.
+ */
+export { utf8, concatBytes, u16beBytes, bytesToB64Url, b64UrlToBytes, } from "./bytes.js";
+export { canonicalize } from "./canonical.js";
+export { sha256 } from "./hash.js";
+export { computeBinding, DS_BIND } from "./binding.js";
+export { deriveWrappingKey } from "./kdf.js";
+export { wrapBindingAd, sealAd, DS_WRAP, DS_SEAL, WRAP_VERSION } from "./aad.js";
+export { aeadEncrypt, aeadSeal, aeadOpen } from "./aead.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,20 @@
+/**
+ * `@sudp-protocol/authorizer` — Authorizer-side primitives for the
+ * Secret-Use Delegation Protocol.
+ *
+ * This entry point is **carrier-agnostic**: it carries only the protocol
+ * cryptography (canonical JSON, β computation, wrapping-key derivation,
+ * AEAD-as-wrap) and intentionally does **not** know about WebAuthn,
+ * passkeys, HTTP, or any specific authenticator.
+ *
+ * For the WebAuthn PRF → y_c adapter and assertion helpers, import from
+ * `@sudp-protocol/authorizer/webauthn`.
+ */
+export { utf8, concatBytes, u16beBytes, bytesToB64Url, b64UrlToBytes, } from "./bytes.js";
+export { canonicalize } from "./canonical.js";
+export { sha256 } from "./hash.js";
+export { computeBinding, DS_BIND } from "./binding.js";
+export { deriveWrappingKey } from "./kdf.js";
+export { wrapBindingAd, sealAd, DS_WRAP, DS_SEAL, WRAP_VERSION } from "./aad.js";
+export { aeadEncrypt, aeadSeal, aeadOpen } from "./aead.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC"}

package/dist/kdf.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Derive the per-credential wrapping key `W_c` from the Authorizer's
+ * user-key `y_c` (a 32-byte secret produced by the authenticator).
+ *
+ *     W_c = HKDF-SHA-256(y_c, salt = prf_salt, info = DS_WRAP ‖ credId ‖ ver_be)
+ *
+ * `y_c` must arrive at the Authorizer side already shaped to 32 bytes; how
+ * it is produced is authenticator-specific and outside the SUDP core (see
+ * `./webauthn` for the WebAuthn PRF → y_c adapter, but custom authenticators
+ * may provide y_c directly).
+ *
+ * MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::crypto::kdf::derive_wrapping_key`.
+ */
+export declare function deriveWrappingKey(userKey: Uint8Array, prfSalt: Uint8Array, credentialId: Uint8Array, wrapVersion?: number): Promise<Uint8Array>;
+//# sourceMappingURL=kdf.d.ts.map

package/dist/kdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../src/kdf.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,UAAU,EACxB,WAAW,GAAE,MAAqB,GACjC,OAAO,CAAC,UAAU,CAAC,CAoBrB"}

package/dist/kdf.js

@@ -0,0 +1,28 @@
+import { concatBytes, u16beBytes } from "./bytes.js";
+import { DS_WRAP, WRAP_VERSION } from "./aad.js";
+/**
+ * Derive the per-credential wrapping key `W_c` from the Authorizer's
+ * user-key `y_c` (a 32-byte secret produced by the authenticator).
+ *
+ *     W_c = HKDF-SHA-256(y_c, salt = prf_salt, info = DS_WRAP ‖ credId ‖ ver_be)
+ *
+ * `y_c` must arrive at the Authorizer side already shaped to 32 bytes; how
+ * it is produced is authenticator-specific and outside the SUDP core (see
+ * `./webauthn` for the WebAuthn PRF → y_c adapter, but custom authenticators
+ * may provide y_c directly).
+ *
+ * MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::crypto::kdf::derive_wrapping_key`.
+ */
+export async function deriveWrappingKey(userKey, prfSalt, credentialId, wrapVersion = WRAP_VERSION) {
+    const km = await crypto.subtle.importKey("raw", userKey, "HKDF", false, ["deriveBits"]);
+    const info = concatBytes(DS_WRAP, credentialId, u16beBytes(wrapVersion));
+    const bits = await crypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: prfSalt,
+        info: info,
+    }, km, 256);
+    return new Uint8Array(bits);
+}
+//# sourceMappingURL=kdf.js.map

package/dist/kdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../src/kdf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAmB,EACnB,OAAmB,EACnB,YAAwB,EACxB,cAAsB,YAAY;IAElC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,OAAiC,EACjC,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IACF,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAiC;QACvC,IAAI,EAAE,IAA8B;KACrC,EACD,EAAE,EACF,GAAG,CACJ,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}