@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/client/localKeyring/localKeyringPinCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localKeyringPinCode.js","sourceRoot":"","sources":["localKeyringPinCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EAEpB,SAAS,EACT,kCAAkC,EAClC,kBAAkB,EAGlB,0BAA0B,EAC1B,uCAAuC,GAMxC,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,wBAAwB,EAExB,sBAAsB,EACtB,iBAAiB,EACjB,2BAA2B,EAC3B,yBAAyB,EACzB,oCAAoC,EACpC,qBAAqB,EACrB,cAAc,EACd,mCAAmC,GACpC,MAAM,8BAA8B,CAAC;AAqBtC,MAAM,0BAA0B;IACrB,QAAQ,CAAS;IACT,aAAa,CAAsB;IACnC,aAAa,CAAS;IACtB,OAAO,CAAsB;IAE9C,YAAY,OAA0C;QACpD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QAEtD,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAwB;QAC9C,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,KAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,sBAAsB,CACjE,0BAA0B,CAAC,KAAK,CAAC,CAClC,CAAC;QACF,MAAM,QAAQ,GAAG,gCAAgC,CAAC;YAChD,WAAW;YACX,UAAU,EAAE,IAAI,CAAC,aAAa;SAC/B,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,0BAA0B,CAAC,QAAQ,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EACjB,OAAO,EACP,QAAQ,GACe;QACvB,MAAM,EAAE,GAAG,+BAA+B,CAAC;YACzC,SAAS,EAAE,2BAA2B;YACtC,OAAO;YACP,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,IAAI,aAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,aAAa,GAAG,oCAAoC,CAClD,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;gBACE,cAAc,EAAE,qBAAqB,CAAC;oBACpC,OAAO;oBACP,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC;gBACF,EAAE,EAAE,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,SAAS;aAChB,EACD,GAAG,EACH,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC9C,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,uEAAuE,EACvE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QAED,4BAA4B,CAAC;YAC3B,MAAM,EAAE,aAAa,CAAC,OAAO;YAC7B,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IACE,aAAa,CAAC,QAAQ,KAAK,QAAQ,CAAC,aAAa;YACjD,aAAa,CAAC,KAAK,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;YACrC,OAAO;YACP,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EACf,OAAO,EACP,MAAM,EACN,SAAS,GACY;QACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;YACxD,OAAO;YACP,MAAM,EAAE;gBACN,KAAK,EAAE,QAAQ,CAAC,UAAU;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,aAAa;aACjC;YACD,SAAS;SACV,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,cAAc,EAAE,qBAAqB,CAAC;gBACpC,OAAO;gBACP,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC;YACF,EAAE;YACF,IAAI,EAAE,SAAS;SAChB,EACD,GAAG,EACH,mCAAmC,CAAC,aAAa,CAAC,CACnD,CACF,CAAC;QAEF,OAAO,kBAAkB,CAAC;YACxB,SAAS,EAAE,2BAA2B;YACtC,UAAU;YACV,OAAO;YACP,EAAE;YACF,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,QAAoC;IAEpC,OAAO,CACL,QAAQ,CAAC,QAAQ,KAAK,iBAAiB;QACvC,QAAQ,CAAC,SAAS,KAAK,2BAA2B,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,OAAO,kBAAkB,CAAC;QACxB,QAAQ,EAAE,gCAAgC,CAAC;YACzC,aAAa,EAAE,kCAAkC,CAAC;gBAChD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,sEAAsE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,2DAA2D;gBAC3D,sEAAsE;gBACtE,gEAAgE;gBAChE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,QAAQ,EAAE,OAAO,CAAC,mBAAmB;aACtC,CAAC;YACF,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,eAAe;SAClC,CAAC;QACF,aAAa,EAAE,uCAAuC,CAAC,OAAO,CAAC;QAC/D,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { base64ToBytes } from \"@tearleads/encoding\";\nimport {\n  assertUnwrappableAesGcmEnvelope,\n  sealAesGcmEnvelope,\n} from \"./aesGcmWrapping\";\nimport {\n  assertEnvelopeContextMatches,\n  assertNonEmptyString,\n  type BrowserLocalKeyringOptions,\n  copyBytes,\n  createIndexedDbWrappingKeyKeystore,\n  createLocalKeyring,\n  type LocalKeyring,\n  type LocalKeyringScope,\n  normalizeLocalKeyringScope,\n  resolveBrowserLocalKeyringManifestStore,\n  type UnwrapLocalSecretInput,\n  type WrapLocalSecretInput,\n  type WrappedLocalSecretEnvelope,\n  type WrappingKeyHandle,\n  type WrappingKeyKeystore,\n} from \"./index\";\nimport {\n  createPinCodeWrappingKeyId,\n  createPinCodeWrappingKeyMetadata,\n  derivePinCodeWrappingKey,\n  type LocalKeyringPinCode,\n  normalizeKdfIterations,\n  PIN_CODE_PROVIDER,\n  PIN_CODE_WRAPPING_ALGORITHM,\n  parsePinCodeWrappingKeyId,\n  parseWrappedLocalSecretEnvelopeBytes,\n  pinCodeAdditionalData,\n  randomAesGcmIv,\n  serializeWrappedLocalSecretEnvelope,\n} from \"./localKeyringPinCodeSupport\";\n\nexport type { LocalKeyringPinCode };\n\nexport interface PinCodeWrappingKeyKeystoreOptions {\n  readonly innerKeystore: WrappingKeyKeystore;\n  readonly kdfIterations?: number | undefined;\n  readonly pinCode: LocalKeyringPinCode;\n  readonly provider?: string | undefined;\n}\n\nexport type PinCodeBrowserLocalKeyringOptions = Omit<\n  BrowserLocalKeyringOptions,\n  \"provider\"\n> & {\n  readonly kdfIterations?: number | undefined;\n  readonly pinCode: LocalKeyringPinCode;\n  readonly pinCodeProvider?: string | undefined;\n  readonly wrappingKeyProvider?: string | undefined;\n};\n\nclass PinCodeWrappingKeyKeystore implements WrappingKeyKeystore {\n  readonly provider: string;\n  private readonly innerKeystore: WrappingKeyKeystore;\n  private readonly kdfIterations: number;\n  private readonly pinCode: LocalKeyringPinCode;\n\n  constructor(options: PinCodeWrappingKeyKeystoreOptions) {\n    this.innerKeystore = options.innerKeystore;\n    this.kdfIterations = normalizeKdfIterations(options.kdfIterations);\n    this.pinCode = options.pinCode;\n    this.provider = options.provider ?? PIN_CODE_PROVIDER;\n\n    assertNonEmptyString(this.provider, \"PIN code wrapping key provider\");\n  }\n\n  close(): void {\n    this.innerKeystore.close?.();\n  }\n\n  async deleteWrappingKey(scope: LocalKeyringScope): Promise<void> {\n    await this.innerKeystore.deleteWrappingKey(scope);\n  }\n\n  async getOrCreateWrappingKey(\n    scope: LocalKeyringScope,\n  ): Promise<WrappingKeyHandle> {\n    const innerHandle = await this.innerKeystore.getOrCreateWrappingKey(\n      normalizeLocalKeyringScope(scope),\n    );\n    const metadata = createPinCodeWrappingKeyMetadata({\n      innerHandle,\n      iterations: this.kdfIterations,\n    });\n\n    return {\n      keyId: createPinCodeWrappingKeyId(metadata),\n      provider: this.provider,\n    };\n  }\n\n  async unwrapSecret({\n    context,\n    envelope,\n  }: UnwrapLocalSecretInput): Promise<Uint8Array<ArrayBuffer>> {\n    const iv = assertUnwrappableAesGcmEnvelope({\n      algorithm: PIN_CODE_WRAPPING_ALGORITHM,\n      context,\n      envelope,\n      provider: this.provider,\n    });\n\n    const metadata = parsePinCodeWrappingKeyId(envelope.keyId);\n    const key = await derivePinCodeWrappingKey({\n      metadata,\n      pinCode: this.pinCode,\n    });\n\n    let innerEnvelope: WrappedLocalSecretEnvelope;\n    try {\n      innerEnvelope = parseWrappedLocalSecretEnvelopeBytes(\n        await crypto.subtle.decrypt(\n          {\n            additionalData: pinCodeAdditionalData({\n              context,\n              keyId: envelope.keyId,\n              provider: this.provider,\n            }),\n            iv: copyBytes(base64ToBytes(iv)),\n            name: \"AES-GCM\",\n          },\n          key,\n          copyBytes(base64ToBytes(envelope.ciphertext)),\n        ),\n      );\n    } catch (error) {\n      throw new Error(\n        \"PIN code is incorrect or wrapped local secret could not be unwrapped.\",\n        { cause: error },\n      );\n    }\n\n    assertEnvelopeContextMatches({\n      actual: innerEnvelope.context,\n      expected: context,\n    });\n    if (\n      innerEnvelope.provider !== metadata.innerProvider ||\n      innerEnvelope.keyId !== metadata.innerKeyId\n    ) {\n      throw new Error(\"PIN code inner wrapping key does not match.\");\n    }\n\n    return this.innerKeystore.unwrapSecret({\n      context,\n      envelope: innerEnvelope,\n    });\n  }\n\n  async wrapSecret({\n    context,\n    handle,\n    plaintext,\n  }: WrapLocalSecretInput): Promise<WrappedLocalSecretEnvelope> {\n    if (handle.provider !== this.provider) {\n      throw new Error(\"Wrapping key handle provider is unsupported.\");\n    }\n    const metadata = parsePinCodeWrappingKeyId(handle.keyId);\n    const innerEnvelope = await this.innerKeystore.wrapSecret({\n      context,\n      handle: {\n        keyId: metadata.innerKeyId,\n        provider: metadata.innerProvider,\n      },\n      plaintext,\n    });\n    const key = await derivePinCodeWrappingKey({\n      metadata,\n      pinCode: this.pinCode,\n    });\n    const iv = randomAesGcmIv();\n    const ciphertext = new Uint8Array(\n      await crypto.subtle.encrypt(\n        {\n          additionalData: pinCodeAdditionalData({\n            context,\n            keyId: handle.keyId,\n            provider: this.provider,\n          }),\n          iv,\n          name: \"AES-GCM\",\n        },\n        key,\n        serializeWrappedLocalSecretEnvelope(innerEnvelope),\n      ),\n    );\n\n    return sealAesGcmEnvelope({\n      algorithm: PIN_CODE_WRAPPING_ALGORITHM,\n      ciphertext,\n      context,\n      iv,\n      keyId: handle.keyId,\n      provider: this.provider,\n    });\n  }\n}\n\nexport function createPinCodeWrappingKeyKeystore(\n  options: PinCodeWrappingKeyKeystoreOptions,\n): WrappingKeyKeystore {\n  return new PinCodeWrappingKeyKeystore(options);\n}\n\nexport function isPinCodeWrappedLocalSecretEnvelope(\n  envelope: WrappedLocalSecretEnvelope,\n): boolean {\n  return (\n    envelope.provider === PIN_CODE_PROVIDER &&\n    envelope.algorithm === PIN_CODE_WRAPPING_ALGORITHM\n  );\n}\n\nexport function createPinCodeBrowserLocalKeyring(\n  options: PinCodeBrowserLocalKeyringOptions,\n): LocalKeyring {\n  return createLocalKeyring({\n    keystore: createPinCodeWrappingKeyKeystore({\n      innerKeystore: createIndexedDbWrappingKeyKeystore({\n        databaseName: options.databaseName,\n        indexedDB: options.indexedDB,\n        // Must match the non-PIN keyring's mode for the same shell. The inner\n        // keystore reads the wrapping-key record written by whichever keyring\n        // ran first, and the raw-bytes and CryptoKey record formats are not\n        // interchangeable. WKWebView shells (Capacitor/Electrobun)\n        // cannot structured-clone a CryptoKey at all, so without this the PIN\n        // keyring would throw DataCloneError where the plain one works.\n        keyMaterialStorage: options.keyMaterialStorage,\n        objectStoreName: options.objectStoreName,\n        provider: options.wrappingKeyProvider,\n      }),\n      kdfIterations: options.kdfIterations,\n      pinCode: options.pinCode,\n      provider: options.pinCodeProvider,\n    }),\n    manifestStore: resolveBrowserLocalKeyringManifestStore(options),\n    now: options.now,\n  });\n}\n"]}

package/client/localKeyring/localKeyringPinCodeSupport.d.ts

@@ -0,0 +1,34 @@
+import { type LocalSecretContext, type WrappedLocalSecretEnvelope, type WrappingKeyHandle } from "./index.js";
+export type LocalKeyringPinCode = string | (() => Promise<string> | string);
+interface PinCodeWrappingKeyMetadata {
+    readonly format: typeof PIN_CODE_WRAPPING_KEY_FORMAT;
+    readonly innerKeyId: string;
+    readonly innerProvider: string;
+    readonly iterations: number;
+    readonly kdf: "pbkdf2-sha256";
+    readonly salt: string;
+    readonly version: 1;
+}
+export declare const PIN_CODE_PROVIDER = "pin-code";
+export declare const PIN_CODE_WRAPPING_ALGORITHM = "pin-code-pbkdf2-sha256-aes-256-gcm";
+declare const PIN_CODE_WRAPPING_KEY_FORMAT = "tearleads.local-keyring.pin-code-wrapping-key";
+export declare function randomAesGcmIv(): Uint8Array<ArrayBuffer>;
+export declare function normalizeKdfIterations(iterations: number | undefined): number;
+export declare function parseWrappedLocalSecretEnvelopeBytes(bytes: ArrayBuffer): WrappedLocalSecretEnvelope;
+export declare function serializeWrappedLocalSecretEnvelope(envelope: WrappedLocalSecretEnvelope): Uint8Array<ArrayBuffer>;
+export declare function createPinCodeWrappingKeyMetadata(input: {
+    readonly innerHandle: WrappingKeyHandle;
+    readonly iterations: number;
+}): PinCodeWrappingKeyMetadata;
+export declare function createPinCodeWrappingKeyId(metadata: PinCodeWrappingKeyMetadata): string;
+export declare function parsePinCodeWrappingKeyId(keyId: string): PinCodeWrappingKeyMetadata;
+export declare function pinCodeAdditionalData(input: {
+    readonly context: LocalSecretContext;
+    readonly keyId: string;
+    readonly provider: string;
+}): Uint8Array<ArrayBuffer>;
+export declare function derivePinCodeWrappingKey(input: {
+    readonly metadata: PinCodeWrappingKeyMetadata;
+    readonly pinCode: LocalKeyringPinCode;
+}): Promise<CryptoKey>;
+export {};

package/client/localKeyring/localKeyringPinCodeSupport.js

@@ -0,0 +1,135 @@
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { assertWrappedLocalSecretEnvelope, canonicalLocalSecretContext, copyBytes, readObject, readString, readVersion1, readWrappedLocalSecretEnvelope, WRAPPED_LOCAL_SECRET_FORMAT, } from "./index.js";
+export const PIN_CODE_PROVIDER = "pin-code";
+export const PIN_CODE_WRAPPING_ALGORITHM = "pin-code-pbkdf2-sha256-aes-256-gcm";
+const TEXT_DECODER = new TextDecoder();
+const TEXT_ENCODER = new TextEncoder();
+const AES_GCM_IV_BYTES = 12;
+const PIN_CODE_SALT_BYTES = 16;
+const DEFAULT_PIN_CODE_KDF_ITERATIONS = 310_000;
+const PIN_CODE_WRAPPING_KEY_FORMAT = "tearleads.local-keyring.pin-code-wrapping-key";
+const PIN_CODE_WRAPPING_KEY_ID_PREFIX = "pin-code:";
+export function randomAesGcmIv() {
+    return crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
+}
+function randomSalt() {
+    return crypto.getRandomValues(new Uint8Array(PIN_CODE_SALT_BYTES));
+}
+function readPositiveInteger(value, key) {
+    const field = value.get(key);
+    if (typeof field !== "number" || !Number.isInteger(field) || field <= 0) {
+        throw new Error(`${key} must be a positive integer.`);
+    }
+    return field;
+}
+function base64BytesFromString(encoded, label) {
+    try {
+        return copyBytes(base64ToBytes(encoded));
+    }
+    catch {
+        throw new Error(`${label} must be base64.`);
+    }
+}
+export function normalizeKdfIterations(iterations) {
+    if (iterations === undefined) {
+        return DEFAULT_PIN_CODE_KDF_ITERATIONS;
+    }
+    if (!Number.isInteger(iterations) || iterations <= 0) {
+        throw new Error("PIN code wrapping key KDF iterations must be a positive integer.");
+    }
+    return iterations;
+}
+function parseWrappedLocalSecretEnvelope(value) {
+    // The keyring's envelope reader is the single parser for this wire format;
+    // a second hand-rolled parser here would be a drift hazard between what a
+    // PIN unlock accepts and what the manifest path accepts.
+    return readWrappedLocalSecretEnvelope(typeof value === "string" ? JSON.parse(value) : value);
+}
+export function parseWrappedLocalSecretEnvelopeBytes(bytes) {
+    return parseWrappedLocalSecretEnvelope(TEXT_DECODER.decode(bytes));
+}
+export function serializeWrappedLocalSecretEnvelope(envelope) {
+    assertWrappedLocalSecretEnvelope(envelope);
+    return copyBytes(TEXT_ENCODER.encode(JSON.stringify(envelope)));
+}
+function readPinCodeWrappingKeyMetadata(value) {
+    const metadata = readObject(value, "PIN code wrapping key metadata");
+    if (readString(metadata, "format") !== PIN_CODE_WRAPPING_KEY_FORMAT) {
+        throw new Error("PIN code wrapping key format is unsupported.");
+    }
+    if (readString(metadata, "kdf") !== "pbkdf2-sha256") {
+        throw new Error("PIN code wrapping key derivation is unsupported.");
+    }
+    const salt = readString(metadata, "salt");
+    if (base64BytesFromString(salt, "salt").byteLength === 0) {
+        throw new Error("PIN code wrapping key salt must be non-empty.");
+    }
+    return {
+        format: PIN_CODE_WRAPPING_KEY_FORMAT,
+        innerKeyId: readString(metadata, "innerKeyId"),
+        innerProvider: readString(metadata, "innerProvider"),
+        iterations: readPositiveInteger(metadata, "iterations"),
+        kdf: "pbkdf2-sha256",
+        salt,
+        version: readVersion1(metadata),
+    };
+}
+export function createPinCodeWrappingKeyMetadata(input) {
+    return {
+        format: PIN_CODE_WRAPPING_KEY_FORMAT,
+        innerKeyId: input.innerHandle.keyId,
+        innerProvider: input.innerHandle.provider,
+        iterations: input.iterations,
+        kdf: "pbkdf2-sha256",
+        salt: bytesToBase64(randomSalt()),
+        version: 1,
+    };
+}
+export function createPinCodeWrappingKeyId(metadata) {
+    return `${PIN_CODE_WRAPPING_KEY_ID_PREFIX}${bytesToBase64(TEXT_ENCODER.encode(JSON.stringify(metadata)))}`;
+}
+export function parsePinCodeWrappingKeyId(keyId) {
+    if (!keyId.startsWith(PIN_CODE_WRAPPING_KEY_ID_PREFIX)) {
+        throw new Error("PIN code wrapping key id is unsupported.");
+    }
+    try {
+        return readPinCodeWrappingKeyMetadata(JSON.parse(TEXT_DECODER.decode(base64ToBytes(keyId.slice(PIN_CODE_WRAPPING_KEY_ID_PREFIX.length)))));
+    }
+    catch (error) {
+        throw new Error("PIN code wrapping key id is invalid.", { cause: error });
+    }
+}
+export function pinCodeAdditionalData(input) {
+    return copyBytes(TEXT_ENCODER.encode(JSON.stringify({
+        algorithm: PIN_CODE_WRAPPING_ALGORITHM,
+        context: JSON.parse(canonicalLocalSecretContext(input.context)),
+        format: WRAPPED_LOCAL_SECRET_FORMAT,
+        keyId: input.keyId,
+        provider: input.provider,
+        version: 1,
+    })));
+}
+async function resolvePinCode(pinCode) {
+    const resolved = typeof pinCode === "function" ? await pinCode() : pinCode;
+    if (typeof resolved !== "string" || resolved.length === 0) {
+        throw new Error("Local keyring PIN code must be non-empty.");
+    }
+    return resolved;
+}
+export async function derivePinCodeWrappingKey(input) {
+    const pinCode = await resolvePinCode(input.pinCode);
+    const pinCodeBytes = TEXT_ENCODER.encode(pinCode);
+    try {
+        const material = await crypto.subtle.importKey("raw", pinCodeBytes, "PBKDF2", false, ["deriveKey"]);
+        return await crypto.subtle.deriveKey({
+            hash: "SHA-256",
+            iterations: input.metadata.iterations,
+            name: "PBKDF2",
+            salt: base64BytesFromString(input.metadata.salt, "salt"),
+        }, material, { length: 256, name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+    }
+    finally {
+        pinCodeBytes.fill(0);
+    }
+}
+//# sourceMappingURL=localKeyringPinCodeSupport.js.map

package/client/localKeyring/localKeyringPinCodeSupport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localKeyringPinCodeSupport.js","sourceRoot":"","sources":["localKeyringPinCodeSupport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,SAAS,EAET,UAAU,EACV,UAAU,EACV,YAAY,EACZ,8BAA8B,EAC9B,2BAA2B,GAG5B,MAAM,SAAS,CAAC;AAcjB,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,oCAAoC,CAAC;AAEhF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AACvC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AACvC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,+BAA+B,GAAG,OAAO,CAAC;AAChD,MAAM,4BAA4B,GAChC,+CAA+C,CAAC;AAClD,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAEpD,MAAM,UAAU,cAAc;IAC5B,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAmC,EACnC,GAAW;IAEX,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,8BAA8B,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAA8B;IACnE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAc;IAEd,2EAA2E;IAC3E,0EAA0E;IAC1E,yDAAyD;IACzD,OAAO,8BAA8B,CACnC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAkB;IAElB,OAAO,+BAA+B,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,QAAoC;IAEpC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAc;IAEd,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,4BAA4B,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,eAAe,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,MAAM,EAAE,4BAA4B;QACpC,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC9C,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;QACpD,UAAU,EAAE,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC;QACvD,GAAG,EAAE,eAAe;QACpB,IAAI;QACJ,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAGhD;IACC,OAAO;QACL,MAAM,EAAE,4BAA4B;QACpC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK;QACnC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;QACzC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAoC;IAEpC,OAAO,GAAG,+BAA+B,GAAG,aAAa,CACvD,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAC9C,EAAE,CAAC;AACN,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAa;IAEb,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,8BAA8B,CACnC,IAAI,CAAC,KAAK,CACR,YAAY,CAAC,MAAM,CACjB,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC,CACnE,CACF,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,OAAO,SAAS,CACd,YAAY,CAAC,MAAM,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,2BAA2B;QACtC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,2BAA2B;QACnC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,CAAC;KACX,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAA4B;IACxD,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAG9C;IACC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;QAEF,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;YACrC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;SACzD,EACD,QAAQ,EACR,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  assertWrappedLocalSecretEnvelope,\n  canonicalLocalSecretContext,\n  copyBytes,\n  type LocalSecretContext,\n  readObject,\n  readString,\n  readVersion1,\n  readWrappedLocalSecretEnvelope,\n  WRAPPED_LOCAL_SECRET_FORMAT,\n  type WrappedLocalSecretEnvelope,\n  type WrappingKeyHandle,\n} from \"./index\";\n\nexport type LocalKeyringPinCode = string | (() => Promise<string> | string);\n\ninterface PinCodeWrappingKeyMetadata {\n  readonly format: typeof PIN_CODE_WRAPPING_KEY_FORMAT;\n  readonly innerKeyId: string;\n  readonly innerProvider: string;\n  readonly iterations: number;\n  readonly kdf: \"pbkdf2-sha256\";\n  readonly salt: string;\n  readonly version: 1;\n}\n\nexport const PIN_CODE_PROVIDER = \"pin-code\";\nexport const PIN_CODE_WRAPPING_ALGORITHM = \"pin-code-pbkdf2-sha256-aes-256-gcm\";\n\nconst TEXT_DECODER = new TextDecoder();\nconst TEXT_ENCODER = new TextEncoder();\nconst AES_GCM_IV_BYTES = 12;\nconst PIN_CODE_SALT_BYTES = 16;\nconst DEFAULT_PIN_CODE_KDF_ITERATIONS = 310_000;\nconst PIN_CODE_WRAPPING_KEY_FORMAT =\n  \"tearleads.local-keyring.pin-code-wrapping-key\";\nconst PIN_CODE_WRAPPING_KEY_ID_PREFIX = \"pin-code:\";\n\nexport function randomAesGcmIv(): Uint8Array<ArrayBuffer> {\n  return crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));\n}\n\nfunction randomSalt(): Uint8Array<ArrayBuffer> {\n  return crypto.getRandomValues(new Uint8Array(PIN_CODE_SALT_BYTES));\n}\n\nfunction readPositiveInteger(\n  value: ReadonlyMap<string, unknown>,\n  key: string,\n): number {\n  const field = value.get(key);\n  if (typeof field !== \"number\" || !Number.isInteger(field) || field <= 0) {\n    throw new Error(`${key} must be a positive integer.`);\n  }\n\n  return field;\n}\n\nfunction base64BytesFromString(\n  encoded: string,\n  label: string,\n): Uint8Array<ArrayBuffer> {\n  try {\n    return copyBytes(base64ToBytes(encoded));\n  } catch {\n    throw new Error(`${label} must be base64.`);\n  }\n}\n\nexport function normalizeKdfIterations(iterations: number | undefined): number {\n  if (iterations === undefined) {\n    return DEFAULT_PIN_CODE_KDF_ITERATIONS;\n  }\n  if (!Number.isInteger(iterations) || iterations <= 0) {\n    throw new Error(\n      \"PIN code wrapping key KDF iterations must be a positive integer.\",\n    );\n  }\n\n  return iterations;\n}\n\nfunction parseWrappedLocalSecretEnvelope(\n  value: unknown,\n): WrappedLocalSecretEnvelope {\n  // The keyring's envelope reader is the single parser for this wire format;\n  // a second hand-rolled parser here would be a drift hazard between what a\n  // PIN unlock accepts and what the manifest path accepts.\n  return readWrappedLocalSecretEnvelope(\n    typeof value === \"string\" ? JSON.parse(value) : value,\n  );\n}\n\nexport function parseWrappedLocalSecretEnvelopeBytes(\n  bytes: ArrayBuffer,\n): WrappedLocalSecretEnvelope {\n  return parseWrappedLocalSecretEnvelope(TEXT_DECODER.decode(bytes));\n}\n\nexport function serializeWrappedLocalSecretEnvelope(\n  envelope: WrappedLocalSecretEnvelope,\n): Uint8Array<ArrayBuffer> {\n  assertWrappedLocalSecretEnvelope(envelope);\n  return copyBytes(TEXT_ENCODER.encode(JSON.stringify(envelope)));\n}\n\nfunction readPinCodeWrappingKeyMetadata(\n  value: unknown,\n): PinCodeWrappingKeyMetadata {\n  const metadata = readObject(value, \"PIN code wrapping key metadata\");\n  if (readString(metadata, \"format\") !== PIN_CODE_WRAPPING_KEY_FORMAT) {\n    throw new Error(\"PIN code wrapping key format is unsupported.\");\n  }\n  if (readString(metadata, \"kdf\") !== \"pbkdf2-sha256\") {\n    throw new Error(\"PIN code wrapping key derivation is unsupported.\");\n  }\n  const salt = readString(metadata, \"salt\");\n  if (base64BytesFromString(salt, \"salt\").byteLength === 0) {\n    throw new Error(\"PIN code wrapping key salt must be non-empty.\");\n  }\n\n  return {\n    format: PIN_CODE_WRAPPING_KEY_FORMAT,\n    innerKeyId: readString(metadata, \"innerKeyId\"),\n    innerProvider: readString(metadata, \"innerProvider\"),\n    iterations: readPositiveInteger(metadata, \"iterations\"),\n    kdf: \"pbkdf2-sha256\",\n    salt,\n    version: readVersion1(metadata),\n  };\n}\n\nexport function createPinCodeWrappingKeyMetadata(input: {\n  readonly innerHandle: WrappingKeyHandle;\n  readonly iterations: number;\n}): PinCodeWrappingKeyMetadata {\n  return {\n    format: PIN_CODE_WRAPPING_KEY_FORMAT,\n    innerKeyId: input.innerHandle.keyId,\n    innerProvider: input.innerHandle.provider,\n    iterations: input.iterations,\n    kdf: \"pbkdf2-sha256\",\n    salt: bytesToBase64(randomSalt()),\n    version: 1,\n  };\n}\n\nexport function createPinCodeWrappingKeyId(\n  metadata: PinCodeWrappingKeyMetadata,\n): string {\n  return `${PIN_CODE_WRAPPING_KEY_ID_PREFIX}${bytesToBase64(\n    TEXT_ENCODER.encode(JSON.stringify(metadata)),\n  )}`;\n}\n\nexport function parsePinCodeWrappingKeyId(\n  keyId: string,\n): PinCodeWrappingKeyMetadata {\n  if (!keyId.startsWith(PIN_CODE_WRAPPING_KEY_ID_PREFIX)) {\n    throw new Error(\"PIN code wrapping key id is unsupported.\");\n  }\n\n  try {\n    return readPinCodeWrappingKeyMetadata(\n      JSON.parse(\n        TEXT_DECODER.decode(\n          base64ToBytes(keyId.slice(PIN_CODE_WRAPPING_KEY_ID_PREFIX.length)),\n        ),\n      ),\n    );\n  } catch (error) {\n    throw new Error(\"PIN code wrapping key id is invalid.\", { cause: error });\n  }\n}\n\nexport function pinCodeAdditionalData(input: {\n  readonly context: LocalSecretContext;\n  readonly keyId: string;\n  readonly provider: string;\n}): Uint8Array<ArrayBuffer> {\n  return copyBytes(\n    TEXT_ENCODER.encode(\n      JSON.stringify({\n        algorithm: PIN_CODE_WRAPPING_ALGORITHM,\n        context: JSON.parse(canonicalLocalSecretContext(input.context)),\n        format: WRAPPED_LOCAL_SECRET_FORMAT,\n        keyId: input.keyId,\n        provider: input.provider,\n        version: 1,\n      }),\n    ),\n  );\n}\n\nasync function resolvePinCode(pinCode: LocalKeyringPinCode): Promise<string> {\n  const resolved = typeof pinCode === \"function\" ? await pinCode() : pinCode;\n  if (typeof resolved !== \"string\" || resolved.length === 0) {\n    throw new Error(\"Local keyring PIN code must be non-empty.\");\n  }\n\n  return resolved;\n}\n\nexport async function derivePinCodeWrappingKey(input: {\n  readonly metadata: PinCodeWrappingKeyMetadata;\n  readonly pinCode: LocalKeyringPinCode;\n}): Promise<CryptoKey> {\n  const pinCode = await resolvePinCode(input.pinCode);\n  const pinCodeBytes = TEXT_ENCODER.encode(pinCode);\n  try {\n    const material = await crypto.subtle.importKey(\n      \"raw\",\n      pinCodeBytes,\n      \"PBKDF2\",\n      false,\n      [\"deriveKey\"],\n    );\n\n    return await crypto.subtle.deriveKey(\n      {\n        hash: \"SHA-256\",\n        iterations: input.metadata.iterations,\n        name: \"PBKDF2\",\n        salt: base64BytesFromString(input.metadata.salt, \"salt\"),\n      },\n      material,\n      { length: 256, name: \"AES-GCM\" },\n      false,\n      [\"encrypt\", \"decrypt\"],\n    );\n  } finally {\n    pinCodeBytes.fill(0);\n  }\n}\n"]}

package/client/localKeyring/localStorageManifestStore.d.ts

@@ -0,0 +1,6 @@
+import type { LocalKeyringManifestStorage, LocalKeyringManifestStore } from "./types.js";
+export interface LocalStorageLocalKeyringManifestStoreOptions {
+    readonly prefix?: string | undefined;
+    readonly storage?: LocalKeyringManifestStorage | undefined;
+}
+export declare function createLocalStorageLocalKeyringManifestStore(options?: LocalStorageLocalKeyringManifestStoreOptions): LocalKeyringManifestStore;

package/client/localKeyring/localStorageManifestStore.js

@@ -0,0 +1,34 @@
+import { parseLocalKeyringManifest, serializeLocalKeyringManifest, } from "./manifest.js";
+import { localKeyringScopeKey } from "./scope.js";
+const LOCAL_STORAGE_MANIFEST_PREFIX = "tearleads.local-keyring.manifest:";
+function getDefaultLocalKeyringManifestStorage() {
+    if (typeof globalThis.localStorage === "undefined") {
+        throw new Error("Browser local keyring manifest storage is unavailable.");
+    }
+    return globalThis.localStorage;
+}
+class LocalStorageLocalKeyringManifestStore {
+    prefix;
+    storage;
+    constructor(options) {
+        this.prefix = options?.prefix ?? LOCAL_STORAGE_MANIFEST_PREFIX;
+        this.storage = options?.storage ?? getDefaultLocalKeyringManifestStorage();
+    }
+    async deleteManifest(scope) {
+        this.storage.removeItem(this.storageKey(scope));
+    }
+    async loadManifest(scope) {
+        const serialized = this.storage.getItem(this.storageKey(scope));
+        return serialized ? parseLocalKeyringManifest(serialized) : null;
+    }
+    async saveManifest(manifest) {
+        this.storage.setItem(this.storageKey(manifest.scope), serializeLocalKeyringManifest(manifest));
+    }
+    storageKey(scope) {
+        return `${this.prefix}${localKeyringScopeKey(scope)}`;
+    }
+}
+export function createLocalStorageLocalKeyringManifestStore(options = {}) {
+    return new LocalStorageLocalKeyringManifestStore(options);
+}
+//# sourceMappingURL=localStorageManifestStore.js.map

package/client/localKeyring/localStorageManifestStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localStorageManifestStore.js","sourceRoot":"","sources":["localStorageManifestStore.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAQ/C,MAAM,6BAA6B,GAAG,mCAAmC,CAAC;AAO1E,SAAS,qCAAqC;IAC5C,IAAI,OAAO,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,UAAU,CAAC,YAAY,CAAC;AACjC,CAAC;AAED,MAAM,qCAAqC;IAGxB,MAAM,CAAS;IACf,OAAO,CAA8B;IAEtD,YACE,OAAiE;QAEjE,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,6BAA6B,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,qCAAqC,EAAE,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAAwB;QAExB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,OAAO,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAA8B;QAC/C,IAAI,CAAC,OAAO,CAAC,OAAO,CAClB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC/B,6BAA6B,CAAC,QAAQ,CAAC,CACxC,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,KAAwB;QACzC,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;IACxD,CAAC;CACF;AAED,MAAM,UAAU,2CAA2C,CACzD,UAAwD,EAAE;IAE1D,OAAO,IAAI,qCAAqC,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC","sourcesContent":["import {\n  parseLocalKeyringManifest,\n  serializeLocalKeyringManifest,\n} from \"./manifest\";\nimport { localKeyringScopeKey } from \"./scope\";\nimport type {\n  LocalKeyringManifest,\n  LocalKeyringManifestStorage,\n  LocalKeyringManifestStore,\n  LocalKeyringScope,\n} from \"./types\";\n\nconst LOCAL_STORAGE_MANIFEST_PREFIX = \"tearleads.local-keyring.manifest:\";\n\nexport interface LocalStorageLocalKeyringManifestStoreOptions {\n  readonly prefix?: string | undefined;\n  readonly storage?: LocalKeyringManifestStorage | undefined;\n}\n\nfunction getDefaultLocalKeyringManifestStorage(): LocalKeyringManifestStorage {\n  if (typeof globalThis.localStorage === \"undefined\") {\n    throw new Error(\"Browser local keyring manifest storage is unavailable.\");\n  }\n\n  return globalThis.localStorage;\n}\n\nclass LocalStorageLocalKeyringManifestStore\n  implements LocalKeyringManifestStore\n{\n  private readonly prefix: string;\n  private readonly storage: LocalKeyringManifestStorage;\n\n  constructor(\n    options: LocalStorageLocalKeyringManifestStoreOptions | undefined,\n  ) {\n    this.prefix = options?.prefix ?? LOCAL_STORAGE_MANIFEST_PREFIX;\n    this.storage = options?.storage ?? getDefaultLocalKeyringManifestStorage();\n  }\n\n  async deleteManifest(scope: LocalKeyringScope): Promise<void> {\n    this.storage.removeItem(this.storageKey(scope));\n  }\n\n  async loadManifest(\n    scope: LocalKeyringScope,\n  ): Promise<LocalKeyringManifest | null> {\n    const serialized = this.storage.getItem(this.storageKey(scope));\n    return serialized ? parseLocalKeyringManifest(serialized) : null;\n  }\n\n  async saveManifest(manifest: LocalKeyringManifest): Promise<void> {\n    this.storage.setItem(\n      this.storageKey(manifest.scope),\n      serializeLocalKeyringManifest(manifest),\n    );\n  }\n\n  private storageKey(scope: LocalKeyringScope): string {\n    return `${this.prefix}${localKeyringScopeKey(scope)}`;\n  }\n}\n\nexport function createLocalStorageLocalKeyringManifestStore(\n  options: LocalStorageLocalKeyringManifestStoreOptions = {},\n): LocalKeyringManifestStore {\n  return new LocalStorageLocalKeyringManifestStore(options);\n}\n"]}

package/client/localKeyring/manifest.d.ts

@@ -0,0 +1,5 @@
+import { type LocalKeyringManifest } from "./types.js";
+export declare function assertLocalKeyringManifest(manifest: LocalKeyringManifest): void;
+export declare function serializeLocalKeyringManifest(manifest: LocalKeyringManifest): string;
+export declare function parseLocalKeyringManifest(value: unknown): LocalKeyringManifest;
+export declare function cloneManifest(manifest: LocalKeyringManifest): LocalKeyringManifest;

package/client/localKeyring/manifest.js

@@ -0,0 +1,43 @@
+import { assertEnvelopeContextMatches, assertWrappedLocalSecretEnvelope, readLocalKeyringScope, readWrappedLocalSecretEnvelope, } from "./envelope.js";
+import { readExactString, readObject, readString, readVersion1, } from "./jsonReaders.js";
+import { assertNonEmptyString } from "./primitives.js";
+import { localSecretContext, normalizeLocalKeyringScope } from "./scope.js";
+import { LOCAL_KEYRING_MANIFEST_FORMAT, } from "./types.js";
+export function assertLocalKeyringManifest(manifest) {
+    if (manifest.format !== LOCAL_KEYRING_MANIFEST_FORMAT) {
+        throw new Error("Local keyring manifest format is unsupported.");
+    }
+    if (manifest.version !== 1) {
+        throw new Error("Local keyring manifest version is unsupported.");
+    }
+    assertNonEmptyString(manifest.createdAt, "Local keyring manifest createdAt");
+    assertNonEmptyString(manifest.updatedAt, "Local keyring manifest updatedAt");
+    const scope = normalizeLocalKeyringScope(manifest.scope);
+    assertWrappedLocalSecretEnvelope(manifest.rootKeyEnvelope);
+    assertEnvelopeContextMatches({
+        actual: manifest.rootKeyEnvelope.context,
+        expected: localSecretContext(scope, "account-root"),
+    });
+}
+export function serializeLocalKeyringManifest(manifest) {
+    assertLocalKeyringManifest(manifest);
+    return JSON.stringify(manifest);
+}
+export function parseLocalKeyringManifest(value) {
+    const parsedValue = typeof value === "string" ? JSON.parse(value) : value;
+    const manifest = readObject(parsedValue, "manifest");
+    const parsed = {
+        createdAt: readString(manifest, "createdAt"),
+        format: readExactString(manifest, "format", LOCAL_KEYRING_MANIFEST_FORMAT),
+        rootKeyEnvelope: readWrappedLocalSecretEnvelope(manifest.get("rootKeyEnvelope")),
+        scope: readLocalKeyringScope(manifest.get("scope")),
+        updatedAt: readString(manifest, "updatedAt"),
+        version: readVersion1(manifest),
+    };
+    assertLocalKeyringManifest(parsed);
+    return parsed;
+}
+export function cloneManifest(manifest) {
+    return parseLocalKeyringManifest(serializeLocalKeyringManifest(manifest));
+}
+//# sourceMappingURL=manifest.js.map

package/client/localKeyring/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,EAChC,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,UAAU,EACV,UAAU,EACV,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EACL,6BAA6B,GAE9B,MAAM,SAAS,CAAC;AAEjB,MAAM,UAAU,0BAA0B,CACxC,QAA8B;IAE9B,IAAI,QAAQ,CAAC,MAAM,KAAK,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,oBAAoB,CAAC,QAAQ,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IAC7E,oBAAoB,CAAC,QAAQ,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,gCAAgC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC3D,4BAA4B,CAAC;QAC3B,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,OAAO;QACxC,QAAQ,EAAE,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAA8B;IAE9B,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,MAAM,WAAW,GACf,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC5C,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,6BAA6B,CAAC;QAC1E,eAAe,EAAE,8BAA8B,CAC7C,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAChC;QACD,KAAK,EAAE,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC5C,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC;KACD,CAAC;IACjC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,QAA8B;IAE9B,OAAO,yBAAyB,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import {\n  assertEnvelopeContextMatches,\n  assertWrappedLocalSecretEnvelope,\n  readLocalKeyringScope,\n  readWrappedLocalSecretEnvelope,\n} from \"./envelope\";\nimport {\n  readExactString,\n  readObject,\n  readString,\n  readVersion1,\n} from \"./jsonReaders\";\nimport { assertNonEmptyString } from \"./primitives\";\nimport { localSecretContext, normalizeLocalKeyringScope } from \"./scope\";\nimport {\n  LOCAL_KEYRING_MANIFEST_FORMAT,\n  type LocalKeyringManifest,\n} from \"./types\";\n\nexport function assertLocalKeyringManifest(\n  manifest: LocalKeyringManifest,\n): void {\n  if (manifest.format !== LOCAL_KEYRING_MANIFEST_FORMAT) {\n    throw new Error(\"Local keyring manifest format is unsupported.\");\n  }\n  if (manifest.version !== 1) {\n    throw new Error(\"Local keyring manifest version is unsupported.\");\n  }\n  assertNonEmptyString(manifest.createdAt, \"Local keyring manifest createdAt\");\n  assertNonEmptyString(manifest.updatedAt, \"Local keyring manifest updatedAt\");\n  const scope = normalizeLocalKeyringScope(manifest.scope);\n  assertWrappedLocalSecretEnvelope(manifest.rootKeyEnvelope);\n  assertEnvelopeContextMatches({\n    actual: manifest.rootKeyEnvelope.context,\n    expected: localSecretContext(scope, \"account-root\"),\n  });\n}\n\nexport function serializeLocalKeyringManifest(\n  manifest: LocalKeyringManifest,\n): string {\n  assertLocalKeyringManifest(manifest);\n  return JSON.stringify(manifest);\n}\n\nexport function parseLocalKeyringManifest(\n  value: unknown,\n): LocalKeyringManifest {\n  const parsedValue: unknown =\n    typeof value === \"string\" ? JSON.parse(value) : value;\n  const manifest = readObject(parsedValue, \"manifest\");\n  const parsed = {\n    createdAt: readString(manifest, \"createdAt\"),\n    format: readExactString(manifest, \"format\", LOCAL_KEYRING_MANIFEST_FORMAT),\n    rootKeyEnvelope: readWrappedLocalSecretEnvelope(\n      manifest.get(\"rootKeyEnvelope\"),\n    ),\n    scope: readLocalKeyringScope(manifest.get(\"scope\")),\n    updatedAt: readString(manifest, \"updatedAt\"),\n    version: readVersion1(manifest),\n  } satisfies LocalKeyringManifest;\n  assertLocalKeyringManifest(parsed);\n  return parsed;\n}\n\nexport function cloneManifest(\n  manifest: LocalKeyringManifest,\n): LocalKeyringManifest {\n  return parseLocalKeyringManifest(serializeLocalKeyringManifest(manifest));\n}\n"]}

package/client/localKeyring/memory.d.ts

@@ -0,0 +1,3 @@
+import type { LocalKeyringManifestStore, WrappingKeyKeystore } from "./types.js";
+export declare function createMemoryLocalKeyringManifestStore(): LocalKeyringManifestStore;
+export declare function createMemoryWrappingKeyKeystore(): WrappingKeyKeystore;

package/client/localKeyring/memory.js

@@ -0,0 +1,64 @@
+import { unwrapAesGcmSecret, wrapAesGcmSecret } from "./aesGcmWrapping.js";
+import { cloneManifest } from "./manifest.js";
+import { localKeyringScopeKey, localWrappingKeyScopeHash, normalizeLocalKeyringScope, } from "./scope.js";
+/**
+ * Process-local keyring backends for tests and development wiring. Neither is a
+ * durable or platform-secure keychain: everything they hold dies with the
+ * process.
+ */
+class MemoryLocalKeyringManifestStore {
+    manifestsByScopeKey = new Map();
+    async deleteManifest(scope) {
+        this.manifestsByScopeKey.delete(localKeyringScopeKey(scope));
+    }
+    async loadManifest(scope) {
+        const manifest = this.manifestsByScopeKey.get(localKeyringScopeKey(scope));
+        return manifest ? cloneManifest(manifest) : null;
+    }
+    async saveManifest(manifest) {
+        this.manifestsByScopeKey.set(localKeyringScopeKey(manifest.scope), cloneManifest(manifest));
+    }
+}
+async function memoryWrappingKeyId(scope) {
+    return `memory:${await localWrappingKeyScopeHash(scope)}`;
+}
+class MemoryWrappingKeyKeystore {
+    provider = "memory";
+    keysById = new Map();
+    async deleteWrappingKey(scope) {
+        const keyId = await memoryWrappingKeyId(normalizeLocalKeyringScope(scope));
+        this.keysById.delete(keyId);
+    }
+    async getOrCreateWrappingKey(scope) {
+        const normalizedScope = normalizeLocalKeyringScope(scope);
+        const keyId = await memoryWrappingKeyId(normalizedScope);
+        if (!this.keysById.has(keyId)) {
+            this.keysById.set(keyId, await crypto.subtle.generateKey({ length: 256, name: "AES-GCM" }, false, ["encrypt", "decrypt"]));
+        }
+        return { keyId, provider: this.provider };
+    }
+    async unwrapSecret({ context, envelope, }) {
+        return unwrapAesGcmSecret({
+            context,
+            envelope,
+            provider: this.provider,
+            resolveKey: (keyId) => this.keysById.get(keyId) ?? null,
+        });
+    }
+    async wrapSecret({ context, handle, plaintext, }) {
+        return wrapAesGcmSecret({
+            context,
+            handle,
+            plaintext,
+            provider: this.provider,
+            resolveKey: (keyId) => this.keysById.get(keyId) ?? null,
+        });
+    }
+}
+export function createMemoryLocalKeyringManifestStore() {
+    return new MemoryLocalKeyringManifestStore();
+}
+export function createMemoryWrappingKeyKeystore() {
+    return new MemoryWrappingKeyKeystore();
+}
+//# sourceMappingURL=memory.js.map

package/client/localKeyring/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,SAAS,CAAC;AAajB;;;;GAIG;AACH,MAAM,+BAA+B;IAClB,mBAAmB,GAAG,IAAI,GAAG,EAG3C,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAA8B;QAC/C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAC1B,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,EACpC,aAAa,CAAC,QAAQ,CAAC,CACxB,CAAC;IACJ,CAAC;CACF;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAkC;IAElC,OAAO,UAAU,MAAM,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,yBAAyB;IACpB,QAAQ,GAAG,QAAQ,CAAC;IACZ,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEzD,KAAK,CAAC,iBAAiB,CAAC,KAAwB;QAC9C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,KAAwB;QAExB,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,KAAK,EACL,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC7B,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EACjB,OAAO,EACP,QAAQ,GACe;QACvB,OAAO,kBAAkB,CAAC;YACxB,OAAO;YACP,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EACf,OAAO,EACP,MAAM,EACN,SAAS,GACY;QACrB,OAAO,gBAAgB,CAAC;YACtB,OAAO;YACP,MAAM;YACN,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI;SACxD,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,qCAAqC;IACnD,OAAO,IAAI,+BAA+B,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO,IAAI,yBAAyB,EAAE,CAAC;AACzC,CAAC","sourcesContent":["import { unwrapAesGcmSecret, wrapAesGcmSecret } from \"./aesGcmWrapping\";\nimport { cloneManifest } from \"./manifest\";\nimport {\n  localKeyringScopeKey,\n  localWrappingKeyScopeHash,\n  normalizeLocalKeyringScope,\n} from \"./scope\";\nimport type {\n  LocalKeyringManifest,\n  LocalKeyringManifestStore,\n  LocalKeyringScope,\n  NormalizedLocalKeyringScope,\n  UnwrapLocalSecretInput,\n  WrapLocalSecretInput,\n  WrappedLocalSecretEnvelope,\n  WrappingKeyHandle,\n  WrappingKeyKeystore,\n} from \"./types\";\n\n/**\n * Process-local keyring backends for tests and development wiring. Neither is a\n * durable or platform-secure keychain: everything they hold dies with the\n * process.\n */\nclass MemoryLocalKeyringManifestStore implements LocalKeyringManifestStore {\n  private readonly manifestsByScopeKey = new Map<\n    string,\n    LocalKeyringManifest\n  >();\n\n  async deleteManifest(scope: LocalKeyringScope): Promise<void> {\n    this.manifestsByScopeKey.delete(localKeyringScopeKey(scope));\n  }\n\n  async loadManifest(\n    scope: LocalKeyringScope,\n  ): Promise<LocalKeyringManifest | null> {\n    const manifest = this.manifestsByScopeKey.get(localKeyringScopeKey(scope));\n    return manifest ? cloneManifest(manifest) : null;\n  }\n\n  async saveManifest(manifest: LocalKeyringManifest): Promise<void> {\n    this.manifestsByScopeKey.set(\n      localKeyringScopeKey(manifest.scope),\n      cloneManifest(manifest),\n    );\n  }\n}\n\nasync function memoryWrappingKeyId(\n  scope: NormalizedLocalKeyringScope,\n): Promise<string> {\n  return `memory:${await localWrappingKeyScopeHash(scope)}`;\n}\n\nclass MemoryWrappingKeyKeystore implements WrappingKeyKeystore {\n  readonly provider = \"memory\";\n  private readonly keysById = new Map<string, CryptoKey>();\n\n  async deleteWrappingKey(scope: LocalKeyringScope): Promise<void> {\n    const keyId = await memoryWrappingKeyId(normalizeLocalKeyringScope(scope));\n    this.keysById.delete(keyId);\n  }\n\n  async getOrCreateWrappingKey(\n    scope: LocalKeyringScope,\n  ): Promise<WrappingKeyHandle> {\n    const normalizedScope = normalizeLocalKeyringScope(scope);\n    const keyId = await memoryWrappingKeyId(normalizedScope);\n    if (!this.keysById.has(keyId)) {\n      this.keysById.set(\n        keyId,\n        await crypto.subtle.generateKey(\n          { length: 256, name: \"AES-GCM\" },\n          false,\n          [\"encrypt\", \"decrypt\"],\n        ),\n      );\n    }\n\n    return { keyId, provider: this.provider };\n  }\n\n  async unwrapSecret({\n    context,\n    envelope,\n  }: UnwrapLocalSecretInput): Promise<Uint8Array<ArrayBuffer>> {\n    return unwrapAesGcmSecret({\n      context,\n      envelope,\n      provider: this.provider,\n      resolveKey: (keyId) => this.keysById.get(keyId) ?? null,\n    });\n  }\n\n  async wrapSecret({\n    context,\n    handle,\n    plaintext,\n  }: WrapLocalSecretInput): Promise<WrappedLocalSecretEnvelope> {\n    return wrapAesGcmSecret({\n      context,\n      handle,\n      plaintext,\n      provider: this.provider,\n      resolveKey: (keyId) => this.keysById.get(keyId) ?? null,\n    });\n  }\n}\n\nexport function createMemoryLocalKeyringManifestStore(): LocalKeyringManifestStore {\n  return new MemoryLocalKeyringManifestStore();\n}\n\nexport function createMemoryWrappingKeyKeystore(): WrappingKeyKeystore {\n  return new MemoryWrappingKeyKeystore();\n}\n"]}

package/client/localKeyring/primitives.d.ts

@@ -0,0 +1,4 @@
+export declare function copyBytes(bytes: Uint8Array): Uint8Array<ArrayBuffer>;
+export declare function randomBytes(byteLength: number): Uint8Array<ArrayBuffer>;
+export declare function assertNonEmptyString(value: string, label: string): void;
+export declare function hashHex(bytes: Uint8Array): Promise<string>;

package/client/localKeyring/primitives.js

@@ -0,0 +1,18 @@
+export function copyBytes(bytes) {
+    const copy = new Uint8Array(bytes.byteLength);
+    copy.set(bytes);
+    return copy;
+}
+export function randomBytes(byteLength) {
+    return crypto.getRandomValues(new Uint8Array(byteLength));
+}
+export function assertNonEmptyString(value, label) {
+    if (value.length === 0) {
+        throw new Error(`${label} must be non-empty.`);
+    }
+}
+export async function hashHex(bytes) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", copyBytes(bytes)));
+    return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//# sourceMappingURL=primitives.js.map

package/client/localKeyring/primitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.js","sourceRoot":"","sources":["primitives.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,KAAa;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAiB;IAC7C,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAC1E,EAAE,CACH,CAAC;AACJ,CAAC","sourcesContent":["export function copyBytes(bytes: Uint8Array): Uint8Array<ArrayBuffer> {\n  const copy = new Uint8Array(bytes.byteLength);\n  copy.set(bytes);\n  return copy;\n}\n\nexport function randomBytes(byteLength: number): Uint8Array<ArrayBuffer> {\n  return crypto.getRandomValues(new Uint8Array(byteLength));\n}\n\nexport function assertNonEmptyString(value: string, label: string): void {\n  if (value.length === 0) {\n    throw new Error(`${label} must be non-empty.`);\n  }\n}\n\nexport async function hashHex(bytes: Uint8Array): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest(\"SHA-256\", copyBytes(bytes)),\n  );\n  return Array.from(digest, (byte) => byte.toString(16).padStart(2, \"0\")).join(\n    \"\",\n  );\n}\n"]}

package/client/localKeyring/rootKey.js

@@ -0,0 +1,22 @@
+import { copyBytes } from "./primitives.js";
+import { localKeyringSalt, localSecretAdditionalData, localSecretContext, } from "./scope.js";
+export const LOCAL_ROOT_KEY_BYTES = 32;
+async function importHkdfRootKey(rootKey) {
+    if (rootKey.byteLength !== LOCAL_ROOT_KEY_BYTES) {
+        throw new Error("Local keyring root key must be 32 bytes.");
+    }
+    return crypto.subtle.importKey("raw", copyBytes(rootKey), "HKDF", false, [
+        "deriveBits",
+    ]);
+}
+export async function deriveLocalSecretKey(input) {
+    const rootCryptoKey = await importHkdfRootKey(input.rootKey);
+    const bits = await crypto.subtle.deriveBits({
+        hash: "SHA-256",
+        info: localSecretAdditionalData(localSecretContext(input.scope, input.purpose)),
+        name: "HKDF",
+        salt: localKeyringSalt(input.scope),
+    }, rootCryptoKey, 256);
+    return new Uint8Array(bits);
+}
+//# sourceMappingURL=rootKey.js.map

package/client/localKeyring/rootKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootKey.js","sourceRoot":"","sources":["rootKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,SAAS,CAAC;AAGjB,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC,KAAK,UAAU,iBAAiB,CAAC,OAAmB;IAClD,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACvE,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,yBAAyB,CAC7B,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAC/C;QACD,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;KACpC,EACD,aAAa,EACb,GAAG,CACJ,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { copyBytes } from \"./primitives\";\nimport {\n  localKeyringSalt,\n  localSecretAdditionalData,\n  localSecretContext,\n} from \"./scope\";\nimport type { LocalKeyPurpose, NormalizedLocalKeyringScope } from \"./types\";\n\nexport const LOCAL_ROOT_KEY_BYTES = 32;\n\nasync function importHkdfRootKey(rootKey: Uint8Array): Promise<CryptoKey> {\n  if (rootKey.byteLength !== LOCAL_ROOT_KEY_BYTES) {\n    throw new Error(\"Local keyring root key must be 32 bytes.\");\n  }\n\n  return crypto.subtle.importKey(\"raw\", copyBytes(rootKey), \"HKDF\", false, [\n    \"deriveBits\",\n  ]);\n}\n\nexport async function deriveLocalSecretKey(input: {\n  readonly purpose: LocalKeyPurpose;\n  readonly rootKey: Uint8Array;\n  readonly scope: NormalizedLocalKeyringScope;\n}): Promise<Uint8Array<ArrayBuffer>> {\n  const rootCryptoKey = await importHkdfRootKey(input.rootKey);\n  const bits = await crypto.subtle.deriveBits(\n    {\n      hash: \"SHA-256\",\n      info: localSecretAdditionalData(\n        localSecretContext(input.scope, input.purpose),\n      ),\n      name: \"HKDF\",\n      salt: localKeyringSalt(input.scope),\n    },\n    rootCryptoKey,\n    256,\n  );\n\n  return new Uint8Array(bits);\n}\n"]}

package/client/localKeyring/scope.d.ts

@@ -0,0 +1,8 @@
+import type { LocalKeyPurpose, LocalKeyringScope, LocalSecretContext, NormalizedLocalKeyringScope } from "./types.js";
+export declare function normalizeLocalKeyringScope(scope: LocalKeyringScope): NormalizedLocalKeyringScope;
+export declare function localKeyringScopeKey(scope: LocalKeyringScope): string;
+export declare function localSecretContext(scope: NormalizedLocalKeyringScope, purpose: LocalKeyPurpose): LocalSecretContext;
+export declare function canonicalLocalSecretContext(context: LocalSecretContext): string;
+export declare function localSecretAdditionalData(context: LocalSecretContext): Uint8Array<ArrayBuffer>;
+export declare function localKeyringSalt(scope: NormalizedLocalKeyringScope): Uint8Array<ArrayBuffer>;
+export declare function localWrappingKeyScopeHash(scope: NormalizedLocalKeyringScope): Promise<string>;

package/client/localKeyring/scope.js

@@ -0,0 +1,46 @@
+import { assertNonEmptyString, copyBytes, hashHex } from "./primitives.js";
+const TEXT_ENCODER = new TextEncoder();
+function normalizeOptionalString(value, label) {
+    if (value === undefined || value === null) {
+        return null;
+    }
+    assertNonEmptyString(value, label);
+    return value;
+}
+export function normalizeLocalKeyringScope(scope) {
+    assertNonEmptyString(scope.namespace, "Local keyring namespace");
+    return {
+        accountId: normalizeOptionalString(scope.accountId, "Local keyring account id"),
+        namespace: scope.namespace,
+        signingFingerprint: normalizeOptionalString(scope.signingFingerprint, "Local keyring signing fingerprint"),
+    };
+}
+export function localKeyringScopeKey(scope) {
+    const normalizedScope = normalizeLocalKeyringScope(scope);
+    return JSON.stringify([
+        normalizedScope.namespace,
+        normalizedScope.accountId,
+        normalizedScope.signingFingerprint,
+    ]);
+}
+export function localSecretContext(scope, purpose) {
+    assertNonEmptyString(purpose, "Local key purpose");
+    return { purpose, scope };
+}
+export function canonicalLocalSecretContext(context) {
+    return JSON.stringify({
+        purpose: context.purpose,
+        scope: normalizeLocalKeyringScope(context.scope),
+    });
+}
+export function localSecretAdditionalData(context) {
+    return copyBytes(TEXT_ENCODER.encode(canonicalLocalSecretContext(context)));
+}
+export function localKeyringSalt(scope) {
+    return copyBytes(TEXT_ENCODER.encode(`tearleads.local-keyring.v1.${localKeyringScopeKey(scope)}`));
+}
+export async function localWrappingKeyScopeHash(scope) {
+    const keyMaterial = TEXT_ENCODER.encode(`tearleads.local-wrapping-key.v1.${localKeyringScopeKey(scope)}`);
+    return hashHex(keyMaterial);
+}
+//# sourceMappingURL=scope.js.map

package/client/localKeyring/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAQxE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,SAAS,uBAAuB,CAC9B,KAAgC,EAChC,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAwB;IAExB,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAEjE,OAAO;QACL,SAAS,EAAE,uBAAuB,CAChC,KAAK,CAAC,SAAS,EACf,0BAA0B,CAC3B;QACD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,uBAAuB,CACzC,KAAK,CAAC,kBAAkB,EACxB,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,eAAe,CAAC,SAAS;QACzB,eAAe,CAAC,SAAS;QACzB,eAAe,CAAC,kBAAkB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAkC,EAClC,OAAwB;IAExB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,OAA2B;IAE3B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAA2B;IAE3B,OAAO,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAkC;IAElC,OAAO,SAAS,CACd,YAAY,CAAC,MAAM,CACjB,8BAA8B,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAC5D,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAkC;IAElC,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CACrC,mCAAmC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CACjE,CAAC;IACF,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["import { assertNonEmptyString, copyBytes, hashHex } from \"./primitives\";\nimport type {\n  LocalKeyPurpose,\n  LocalKeyringScope,\n  LocalSecretContext,\n  NormalizedLocalKeyringScope,\n} from \"./types\";\n\nconst TEXT_ENCODER = new TextEncoder();\n\nfunction normalizeOptionalString(\n  value: string | null | undefined,\n  label: string,\n): string | null {\n  if (value === undefined || value === null) {\n    return null;\n  }\n  assertNonEmptyString(value, label);\n  return value;\n}\n\nexport function normalizeLocalKeyringScope(\n  scope: LocalKeyringScope,\n): NormalizedLocalKeyringScope {\n  assertNonEmptyString(scope.namespace, \"Local keyring namespace\");\n\n  return {\n    accountId: normalizeOptionalString(\n      scope.accountId,\n      \"Local keyring account id\",\n    ),\n    namespace: scope.namespace,\n    signingFingerprint: normalizeOptionalString(\n      scope.signingFingerprint,\n      \"Local keyring signing fingerprint\",\n    ),\n  };\n}\n\nexport function localKeyringScopeKey(scope: LocalKeyringScope): string {\n  const normalizedScope = normalizeLocalKeyringScope(scope);\n  return JSON.stringify([\n    normalizedScope.namespace,\n    normalizedScope.accountId,\n    normalizedScope.signingFingerprint,\n  ]);\n}\n\nexport function localSecretContext(\n  scope: NormalizedLocalKeyringScope,\n  purpose: LocalKeyPurpose,\n): LocalSecretContext {\n  assertNonEmptyString(purpose, \"Local key purpose\");\n  return { purpose, scope };\n}\n\nexport function canonicalLocalSecretContext(\n  context: LocalSecretContext,\n): string {\n  return JSON.stringify({\n    purpose: context.purpose,\n    scope: normalizeLocalKeyringScope(context.scope),\n  });\n}\n\nexport function localSecretAdditionalData(\n  context: LocalSecretContext,\n): Uint8Array<ArrayBuffer> {\n  return copyBytes(TEXT_ENCODER.encode(canonicalLocalSecretContext(context)));\n}\n\nexport function localKeyringSalt(\n  scope: NormalizedLocalKeyringScope,\n): Uint8Array<ArrayBuffer> {\n  return copyBytes(\n    TEXT_ENCODER.encode(\n      `tearleads.local-keyring.v1.${localKeyringScopeKey(scope)}`,\n    ),\n  );\n}\n\nexport async function localWrappingKeyScopeHash(\n  scope: NormalizedLocalKeyringScope,\n): Promise<string> {\n  const keyMaterial = TEXT_ENCODER.encode(\n    `tearleads.local-wrapping-key.v1.${localKeyringScopeKey(scope)}`,\n  );\n  return hashHex(keyMaterial);\n}\n"]}

package/client/localKeyring/service.d.ts

@@ -0,0 +1,2 @@
+import { type LocalKeyring, type LocalKeyringOptions } from "./types.js";
+export declare function createLocalKeyring(options: LocalKeyringOptions): LocalKeyring;