@sudp-protocol/authorizer 0.1.0

package/dist/webauthn.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `@sudp-protocol/authorizer/webauthn` — WebAuthn adapter for the Authorizer side.
+ *
+ * The core `@sudp-protocol/authorizer` package is intentionally **signer-agnostic**:
+ * it accepts a 32-byte `userKey` (= `y_c`) and does not care how the
+ * Authorizer obtained it. This subpath is the WebAuthn-specific glue:
+ *
+ *  - it runs HKDF over the raw PRF extension output to produce `y_c`;
+ *  - it shapes a `PublicKeyCredential` assertion into the wire form the
+ *    custodian expects.
+ *
+ * Other realisations (Yubikey static, secure-enclave, HSM, mock for tests)
+ * live in their own adapters and never touch this file.
+ */
+/**
+ * Default HKDF `info` for WebAuthn PRF → userKey derivation. Identifies
+ * this specific adapter on the wire.
+ */
+export declare const DEFAULT_PRF_INFO: Uint8Array<ArrayBufferLike>;
+/**
+ * Options for {@link prfToUserKey}.
+ */
+export interface PrfToUserKeyOptions {
+    /**
+     * HKDF `info` parameter. Defaults to {@link DEFAULT_PRF_INFO}; deployments
+     * that need to differentiate multiple WebAuthn-PRF surfaces under the same
+     * custodian may override it.
+     */
+    readonly info?: Uint8Array;
+    /**
+     * HKDF `salt` parameter. Defaults to a 32-byte zero salt (extract-only
+     * HKDF when the IKM is already uniform, per RFC 5869 §3.1).
+     */
+    readonly salt?: Uint8Array;
+}
+/**
+ * Derive a 32-byte `userKey` (= `y_c`) from the WebAuthn PRF extension's
+ * raw first-output bytes.
+ *
+ *     y_c = HKDF-SHA-256(prfOutput, salt, info)
+ *
+ * The `info` string is what makes this adapter distinct from other ways of
+ * producing `y_c` — picking the same `info` in a different authenticator
+ * would lock you to compatible wire bytes.
+ */
+export declare function prfToUserKey(prfOutput: Uint8Array, options?: PrfToUserKeyOptions): Promise<Uint8Array>;
+/**
+ * Wire-shape of a WebAuthn assertion that the custodian's WebAuthn
+ * `Authenticator` realisation can verify. Field names match the daemon's
+ * expected wire format.
+ */
+export interface AssertionWire {
+    readonly credentialId: Uint8Array;
+    readonly authenticatorData: Uint8Array;
+    readonly clientDataJSON: Uint8Array;
+    readonly signature: Uint8Array;
+}
+/**
+ * Extract the four fields a custodian needs from a `PublicKeyCredential`
+ * assertion.
+ *
+ * Note: this returns raw bytes. Callers that need base64url wire
+ * encoding can run the fields through `bytesToB64Url` from the core
+ * package.
+ */
+export declare function assertionToWire(assertion: PublicKeyCredential): AssertionWire;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,6BAAuC,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC5B;AAID;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,mBAAmB,GAC7B,aAAa,CAQf"}

package/dist/webauthn.js

@@ -0,0 +1,61 @@
+/**
+ * `@sudp-protocol/authorizer/webauthn` — WebAuthn adapter for the Authorizer side.
+ *
+ * The core `@sudp-protocol/authorizer` package is intentionally **signer-agnostic**:
+ * it accepts a 32-byte `userKey` (= `y_c`) and does not care how the
+ * Authorizer obtained it. This subpath is the WebAuthn-specific glue:
+ *
+ *  - it runs HKDF over the raw PRF extension output to produce `y_c`;
+ *  - it shapes a `PublicKeyCredential` assertion into the wire form the
+ *    custodian expects.
+ *
+ * Other realisations (Yubikey static, secure-enclave, HSM, mock for tests)
+ * live in their own adapters and never touch this file.
+ */
+import { utf8 } from "./bytes.js";
+/**
+ * Default HKDF `info` for WebAuthn PRF → userKey derivation. Identifies
+ * this specific adapter on the wire.
+ */
+export const DEFAULT_PRF_INFO = utf8("sudp/v1/webauthn-prf-userkey");
+const DEFAULT_PRF_SALT = new Uint8Array(32);
+/**
+ * Derive a 32-byte `userKey` (= `y_c`) from the WebAuthn PRF extension's
+ * raw first-output bytes.
+ *
+ *     y_c = HKDF-SHA-256(prfOutput, salt, info)
+ *
+ * The `info` string is what makes this adapter distinct from other ways of
+ * producing `y_c` — picking the same `info` in a different authenticator
+ * would lock you to compatible wire bytes.
+ */
+export async function prfToUserKey(prfOutput, options) {
+    const info = options?.info ?? DEFAULT_PRF_INFO;
+    const salt = options?.salt ?? DEFAULT_PRF_SALT;
+    const km = await crypto.subtle.importKey("raw", prfOutput, "HKDF", false, ["deriveBits"]);
+    const bits = await crypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: salt,
+        info: info,
+    }, km, 256);
+    return new Uint8Array(bits);
+}
+/**
+ * Extract the four fields a custodian needs from a `PublicKeyCredential`
+ * assertion.
+ *
+ * Note: this returns raw bytes. Callers that need base64url wire
+ * encoding can run the fields through `bytesToB64Url` from the core
+ * package.
+ */
+export function assertionToWire(assertion) {
+    const r = assertion.response;
+    return {
+        credentialId: new Uint8Array(assertion.rawId),
+        authenticatorData: new Uint8Array(r.authenticatorData),
+        clientDataJSON: new Uint8Array(r.clientDataJSON),
+        signature: new Uint8Array(r.signature),
+    };
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,8BAA8B,CAAC,CAAC;AAmBrE,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAqB,EACrB,OAA6B;IAE7B,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC/C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,SAAmC,EACnC,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAA8B;QACpC,IAAI,EAAE,IAA8B;KACrC,EACD,EAAE,EACF,GAAG,CACJ,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA8B;IAE9B,MAAM,CAAC,GAAG,SAAS,CAAC,QAA0C,CAAC;IAC/D,OAAO;QACL,YAAY,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;QAC7C,iBAAiB,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACtD,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;QAChD,SAAS,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;KACvC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@sudp-protocol/authorizer",
+  "version": "0.1.0",
+  "description": "Authorizer-side primitives for SUDP (Secret-Use Delegation Protocol): canonical JSON, β computation, wrapping-key derivation, AEAD-as-wrap, plus a WebAuthn adapter under the ./webauthn subpath.",
+  "license": "Apache-2.0",
+  "author": "Miracle <xhyumiracle@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/xhyumiracle/sudp",
+    "directory": "authorizer/ts"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./webauthn": {
+      "types": "./dist/webauthn.d.ts",
+      "import": "./dist/webauthn.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@noble/ciphers": "^2.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^6.0.0",
+    "vitest": "^2.1.0"
+  },
+  "keywords": [
+    "sudp",
+    "secret-use-delegation",
+    "authorizer",
+    "passkey",
+    "webauthn",
+    "agent-security"
+  ],
+  "engines": {
+    "node": ">=20"
+  }
+}

package/src/aad.ts

@@ -0,0 +1,34 @@
+import { concatBytes, u16beBytes, utf8 } from "./bytes.js";
+
+export const DS_WRAP = utf8("sudp/v1/wrap");
+export const DS_SEAL = utf8("sudp/v1/seal");
+
+/**
+ * Current wrap version. Bumped together on both ends of the protocol if the
+ * AAD shape ever changes.
+ */
+export const WRAP_VERSION = 0x0001;
+
+/**
+ * Canonical AAD for the AEAD-as-wrap profile:
+ *
+ *     DS_WRAP ‖ credentialId ‖ ver_be(u16, big-endian)
+ *
+ * Bound as associated data when sealing/opening `K̂_c` under `W_c`, so a
+ * peer-wrapped record cannot be substituted across credentials or versions.
+ */
+export function wrapBindingAd(
+  credentialId: Uint8Array,
+  wrapVersion: number = WRAP_VERSION,
+): Uint8Array {
+  return concatBytes(DS_WRAP, credentialId, u16beBytes(wrapVersion));
+}
+
+/**
+ * Canonical AAD for the sealed-body AEAD layer:
+ *
+ *     DS_SEAL ‖ ver_be(u16, big-endian)
+ */
+export function sealAd(wrapVersion: number = WRAP_VERSION): Uint8Array {
+  return concatBytes(DS_SEAL, u16beBytes(wrapVersion));
+}

package/src/aead.ts

@@ -0,0 +1,65 @@
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+
+const XNONCE_LEN = 24;
+const XTAG_LEN = 16;
+
+/**
+ * XChaCha20-Poly1305 raw encrypt with a caller-supplied nonce.
+ *
+ * Output is `ciphertext ‖ tag` (no nonce prefix). Use {@link aeadSeal} for
+ * the standard SUDP wire format that prepends a freshly random nonce.
+ *
+ * MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::primitives::Aead::encrypt`.
+ */
+export function aeadEncrypt(
+  key: Uint8Array,
+  nonce: Uint8Array,
+  plaintext: Uint8Array,
+  aad: Uint8Array,
+): Uint8Array {
+  if (nonce.byteLength !== XNONCE_LEN) {
+    throw new Error(`aeadEncrypt: nonce must be ${XNONCE_LEN} bytes, got ${nonce.byteLength}`);
+  }
+  return xchacha20poly1305(key, nonce, aad).encrypt(plaintext);
+}
+
+/**
+ * XChaCha20-Poly1305 thin wrapper.
+ *
+ * Wire layout (MUST match `sudp::primitives::Aead::seal`):
+ *
+ *     nonce(24 bytes) ‖ ciphertext ‖ tag(16 bytes)
+ *
+ * The 24-byte nonce is freshly generated per call. The caller supplies the
+ * canonical AAD (see {@link wrapBindingAd}, {@link sealAd}).
+ */
+export function aeadSeal(
+  key: Uint8Array,
+  plaintext: Uint8Array,
+  aad: Uint8Array,
+): Uint8Array {
+  const nonce = crypto.getRandomValues(new Uint8Array(XNONCE_LEN));
+  const ct = aeadEncrypt(key, nonce, plaintext, aad);
+  const out = new Uint8Array(XNONCE_LEN + ct.byteLength);
+  out.set(nonce, 0);
+  out.set(ct, XNONCE_LEN);
+  return out;
+}
+
+/**
+ * Counterpart to {@link aeadSeal}. Throws if the AAD/nonce/ciphertext are
+ * not authentic under `key`.
+ */
+export function aeadOpen(
+  key: Uint8Array,
+  sealed: Uint8Array,
+  aad: Uint8Array,
+): Uint8Array {
+  if (sealed.byteLength <= XNONCE_LEN + XTAG_LEN) {
+    throw new Error("aeadOpen: sealed blob is too short");
+  }
+  const nonce = sealed.slice(0, XNONCE_LEN);
+  const ct = sealed.slice(XNONCE_LEN);
+  return xchacha20poly1305(key, nonce, aad).decrypt(ct);
+}

package/src/binding.ts

@@ -0,0 +1,33 @@
+import { concatBytes, utf8 } from "./bytes.js";
+import { canonicalize } from "./canonical.js";
+import { sha256 } from "./hash.js";
+
+/**
+ * Domain separation tag for the Phase II.2 binding hash. Matches the Rust
+ * crate's `sudp::primitives::domain::DS_BIND` byte-for-byte.
+ *
+ *     β = SHA-256(DS_BIND ‖ r ‖ SHA-256(canonical(o)))
+ */
+export const DS_BIND = utf8("sudp/v1/bind");
+
+/**
+ * Compute the binding hash `β` for a given operation, freshness `r`, and
+ * domain separation tag.
+ *
+ *     β = SHA-256(domain ‖ r ‖ SHA-256(canonical(op)))
+ *
+ * The Authorizer signs `β` with its authenticator. The custodian recomputes
+ * `β` from the redeemed grant's `(o, r)` and verifies the signature.
+ *
+ * Pass {@link DS_BIND} for the default profile; other domains may be used
+ * by adjacent ceremonies (e.g. setup attestation) and live in the
+ * deployment.
+ */
+export async function computeBinding(
+  domain: Uint8Array,
+  r: Uint8Array,
+  op: unknown,
+): Promise<Uint8Array> {
+  const opHash = await sha256(canonicalize(op));
+  return sha256(concatBytes(domain, r, opHash));
+}

package/src/bytes.ts

@@ -0,0 +1,89 @@
+const enc = new TextEncoder();
+
+export function utf8(s: string): Uint8Array {
+  return enc.encode(s);
+}
+
+export function concatBytes(...parts: readonly Uint8Array[]): Uint8Array {
+  let total = 0;
+  for (const p of parts) total += p.byteLength;
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.byteLength;
+  }
+  return out;
+}
+
+export function u16beBytes(n: number): Uint8Array {
+  if (!Number.isInteger(n) || n < 0 || n > 0xffff) {
+    throw new Error(`u16beBytes: out of range: ${n}`);
+  }
+  return new Uint8Array([(n >> 8) & 0xff, n & 0xff]);
+}
+
+const B64URL_ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const B64URL_LOOKUP = (() => {
+  const t = new Int8Array(256).fill(-1);
+  for (let i = 0; i < B64URL_ALPHA.length; i++) t[B64URL_ALPHA.charCodeAt(i)] = i;
+  return t;
+})();
+
+function alpha(i: number): string {
+  // Index is always masked to 0..63, so B64URL_ALPHA[i] is defined.
+  return B64URL_ALPHA[i]!;
+}
+
+export function bytesToB64Url(b: Uint8Array): string {
+  let out = "";
+  let i = 0;
+  for (; i + 3 <= b.length; i += 3) {
+    const x = (b[i]! << 16) | (b[i + 1]! << 8) | b[i + 2]!;
+    out += alpha((x >> 18) & 0x3f) + alpha((x >> 12) & 0x3f) + alpha((x >> 6) & 0x3f) + alpha(x & 0x3f);
+  }
+  const rem = b.length - i;
+  if (rem === 1) {
+    const x = b[i]! << 16;
+    out += alpha((x >> 18) & 0x3f) + alpha((x >> 12) & 0x3f);
+  } else if (rem === 2) {
+    const x = (b[i]! << 16) | (b[i + 1]! << 8);
+    out += alpha((x >> 18) & 0x3f) + alpha((x >> 12) & 0x3f) + alpha((x >> 6) & 0x3f);
+  }
+  return out;
+}
+
+export function b64UrlToBytes(s: string): Uint8Array {
+  const norm = s.replace(/=+$/, "");
+  const len = norm.length;
+  const fullGroups = Math.floor(len / 4);
+  const rem = len - fullGroups * 4;
+  if (rem === 1) throw new Error("b64UrlToBytes: invalid length");
+  const out = new Uint8Array(fullGroups * 3 + (rem === 0 ? 0 : rem - 1));
+  let outOff = 0;
+  let i = 0;
+  for (; i + 4 <= len; i += 4) {
+    const a = B64URL_LOOKUP[norm.charCodeAt(i)]!;
+    const b = B64URL_LOOKUP[norm.charCodeAt(i + 1)]!;
+    const c = B64URL_LOOKUP[norm.charCodeAt(i + 2)]!;
+    const d = B64URL_LOOKUP[norm.charCodeAt(i + 3)]!;
+    if ((a | b | c | d) < 0) throw new Error("b64UrlToBytes: invalid character");
+    out[outOff++] = (a << 2) | (b >> 4);
+    out[outOff++] = ((b & 0x0f) << 4) | (c >> 2);
+    out[outOff++] = ((c & 0x03) << 6) | d;
+  }
+  if (rem === 2) {
+    const a = B64URL_LOOKUP[norm.charCodeAt(i)]!;
+    const b = B64URL_LOOKUP[norm.charCodeAt(i + 1)]!;
+    if ((a | b) < 0) throw new Error("b64UrlToBytes: invalid character");
+    out[outOff++] = (a << 2) | (b >> 4);
+  } else if (rem === 3) {
+    const a = B64URL_LOOKUP[norm.charCodeAt(i)]!;
+    const b = B64URL_LOOKUP[norm.charCodeAt(i + 1)]!;
+    const c = B64URL_LOOKUP[norm.charCodeAt(i + 2)]!;
+    if ((a | b | c) < 0) throw new Error("b64UrlToBytes: invalid character");
+    out[outOff++] = (a << 2) | (b >> 4);
+    out[outOff++] = ((b & 0x0f) << 4) | (c >> 2);
+  }
+  return out;
+}

package/src/canonical.ts

@@ -0,0 +1,54 @@
+import { utf8 } from "./bytes.js";
+
+/**
+ * JCS-style canonical JSON encoder (RFC 8785 subset).
+ *
+ * Properties:
+ *  - Object keys are sorted lexicographically by UTF-16 code unit.
+ *  - Strings use `JSON.stringify` escaping.
+ *  - Numbers must be finite. Floats are rejected — they have no
+ *    byte-reproducible canonical form across endpoints and would be a
+ *    substitution vector against `H(o)`. Use integers, strings, booleans,
+ *    nulls, arrays, or nested objects.
+ *  - `undefined` is treated as `null`.
+ *
+ * This MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::canonical::canonicalize_strict`. The `protocol/test_vectors/`
+ * directory carries the conformance suite.
+ */
+export function canonicalize(value: unknown): Uint8Array {
+  return utf8(canonicalizeStr(value));
+}
+
+function canonicalizeStr(v: unknown): string {
+  if (v === null || v === undefined) return "null";
+  if (typeof v === "boolean") return v ? "true" : "false";
+  if (typeof v === "number") {
+    if (!Number.isFinite(v)) {
+      throw new Error("canonicalize: non-finite number is not allowed");
+    }
+    if (!Number.isInteger(v)) {
+      throw new Error(
+        "canonicalize: float values are rejected (no byte-reproducible canonical form)",
+      );
+    }
+    return v.toString();
+  }
+  if (typeof v === "bigint") return v.toString();
+  if (typeof v === "string") return JSON.stringify(v);
+  if (Array.isArray(v)) {
+    return "[" + v.map(canonicalizeStr).join(",") + "]";
+  }
+  if (typeof v === "object") {
+    const obj = v as Record<string, unknown>;
+    const keys = Object.keys(obj).sort();
+    return (
+      "{" +
+      keys
+        .map((k) => JSON.stringify(k) + ":" + canonicalizeStr(obj[k]))
+        .join(",") +
+      "}"
+    );
+  }
+  throw new Error(`canonicalize: unsupported value type: ${typeof v}`);
+}

package/src/hash.ts

@@ -0,0 +1,8 @@
+/**
+ * SHA-256 over a byte buffer. Thin wrapper over the platform's WebCrypto.
+ */
+export async function sha256(data: Uint8Array): Promise<Uint8Array> {
+  // `crypto.subtle` is available in modern browsers and Node >= 20.
+  const buf = await crypto.subtle.digest("SHA-256", data as unknown as ArrayBuffer);
+  return new Uint8Array(buf);
+}

package/src/index.ts

@@ -0,0 +1,27 @@
+/**
+ * `@sudp-protocol/authorizer` — Authorizer-side primitives for the
+ * Secret-Use Delegation Protocol.
+ *
+ * This entry point is **carrier-agnostic**: it carries only the protocol
+ * cryptography (canonical JSON, β computation, wrapping-key derivation,
+ * AEAD-as-wrap) and intentionally does **not** know about WebAuthn,
+ * passkeys, HTTP, or any specific authenticator.
+ *
+ * For the WebAuthn PRF → y_c adapter and assertion helpers, import from
+ * `@sudp-protocol/authorizer/webauthn`.
+ */
+
+export {
+  utf8,
+  concatBytes,
+  u16beBytes,
+  bytesToB64Url,
+  b64UrlToBytes,
+} from "./bytes.js";
+
+export { canonicalize } from "./canonical.js";
+export { sha256 } from "./hash.js";
+export { computeBinding, DS_BIND } from "./binding.js";
+export { deriveWrappingKey } from "./kdf.js";
+export { wrapBindingAd, sealAd, DS_WRAP, DS_SEAL, WRAP_VERSION } from "./aad.js";
+export { aeadEncrypt, aeadSeal, aeadOpen } from "./aead.js";

package/src/kdf.ts

@@ -0,0 +1,43 @@
+import { concatBytes, u16beBytes } from "./bytes.js";
+import { DS_WRAP, WRAP_VERSION } from "./aad.js";
+
+/**
+ * Derive the per-credential wrapping key `W_c` from the Authorizer's
+ * user-key `y_c` (a 32-byte secret produced by the authenticator).
+ *
+ *     W_c = HKDF-SHA-256(y_c, salt = prf_salt, info = DS_WRAP ‖ credId ‖ ver_be)
+ *
+ * `y_c` must arrive at the Authorizer side already shaped to 32 bytes; how
+ * it is produced is authenticator-specific and outside the SUDP core (see
+ * `./webauthn` for the WebAuthn PRF → y_c adapter, but custom authenticators
+ * may provide y_c directly).
+ *
+ * MUST stay byte-for-byte aligned with the Rust crate's
+ * `sudp::crypto::kdf::derive_wrapping_key`.
+ */
+export async function deriveWrappingKey(
+  userKey: Uint8Array,
+  prfSalt: Uint8Array,
+  credentialId: Uint8Array,
+  wrapVersion: number = WRAP_VERSION,
+): Promise<Uint8Array> {
+  const km = await crypto.subtle.importKey(
+    "raw",
+    userKey as unknown as ArrayBuffer,
+    "HKDF",
+    false,
+    ["deriveBits"],
+  );
+  const info = concatBytes(DS_WRAP, credentialId, u16beBytes(wrapVersion));
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: prfSalt as unknown as ArrayBuffer,
+      info: info as unknown as ArrayBuffer,
+    },
+    km,
+    256,
+  );
+  return new Uint8Array(bits);
+}

package/src/webauthn.ts

@@ -0,0 +1,109 @@
+/**
+ * `@sudp-protocol/authorizer/webauthn` — WebAuthn adapter for the Authorizer side.
+ *
+ * The core `@sudp-protocol/authorizer` package is intentionally **signer-agnostic**:
+ * it accepts a 32-byte `userKey` (= `y_c`) and does not care how the
+ * Authorizer obtained it. This subpath is the WebAuthn-specific glue:
+ *
+ *  - it runs HKDF over the raw PRF extension output to produce `y_c`;
+ *  - it shapes a `PublicKeyCredential` assertion into the wire form the
+ *    custodian expects.
+ *
+ * Other realisations (Yubikey static, secure-enclave, HSM, mock for tests)
+ * live in their own adapters and never touch this file.
+ */
+
+import { utf8 } from "./bytes.js";
+
+/**
+ * Default HKDF `info` for WebAuthn PRF → userKey derivation. Identifies
+ * this specific adapter on the wire.
+ */
+export const DEFAULT_PRF_INFO = utf8("sudp/v1/webauthn-prf-userkey");
+
+/**
+ * Options for {@link prfToUserKey}.
+ */
+export interface PrfToUserKeyOptions {
+  /**
+   * HKDF `info` parameter. Defaults to {@link DEFAULT_PRF_INFO}; deployments
+   * that need to differentiate multiple WebAuthn-PRF surfaces under the same
+   * custodian may override it.
+   */
+  readonly info?: Uint8Array;
+  /**
+   * HKDF `salt` parameter. Defaults to a 32-byte zero salt (extract-only
+   * HKDF when the IKM is already uniform, per RFC 5869 §3.1).
+   */
+  readonly salt?: Uint8Array;
+}
+
+const DEFAULT_PRF_SALT = new Uint8Array(32);
+
+/**
+ * Derive a 32-byte `userKey` (= `y_c`) from the WebAuthn PRF extension's
+ * raw first-output bytes.
+ *
+ *     y_c = HKDF-SHA-256(prfOutput, salt, info)
+ *
+ * The `info` string is what makes this adapter distinct from other ways of
+ * producing `y_c` — picking the same `info` in a different authenticator
+ * would lock you to compatible wire bytes.
+ */
+export async function prfToUserKey(
+  prfOutput: Uint8Array,
+  options?: PrfToUserKeyOptions,
+): Promise<Uint8Array> {
+  const info = options?.info ?? DEFAULT_PRF_INFO;
+  const salt = options?.salt ?? DEFAULT_PRF_SALT;
+  const km = await crypto.subtle.importKey(
+    "raw",
+    prfOutput as unknown as ArrayBuffer,
+    "HKDF",
+    false,
+    ["deriveBits"],
+  );
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: salt as unknown as ArrayBuffer,
+      info: info as unknown as ArrayBuffer,
+    },
+    km,
+    256,
+  );
+  return new Uint8Array(bits);
+}
+
+/**
+ * Wire-shape of a WebAuthn assertion that the custodian's WebAuthn
+ * `Authenticator` realisation can verify. Field names match the daemon's
+ * expected wire format.
+ */
+export interface AssertionWire {
+  readonly credentialId: Uint8Array;
+  readonly authenticatorData: Uint8Array;
+  readonly clientDataJSON: Uint8Array;
+  readonly signature: Uint8Array;
+}
+
+/**
+ * Extract the four fields a custodian needs from a `PublicKeyCredential`
+ * assertion.
+ *
+ * Note: this returns raw bytes. Callers that need base64url wire
+ * encoding can run the fields through `bytesToB64Url` from the core
+ * package.
+ */
+export function assertionToWire(
+  assertion: PublicKeyCredential,
+): AssertionWire {
+  const r = assertion.response as AuthenticatorAssertionResponse;
+  return {
+    credentialId: new Uint8Array(assertion.rawId),
+    authenticatorData: new Uint8Array(r.authenticatorData),
+    clientDataJSON: new Uint8Array(r.clientDataJSON),
+    signature: new Uint8Array(r.signature),
+  };
+}