@tinfoilsh/passkey-kit 0.1.0 → 0.2.0

package/dist/storage.js

@@ -1,67 +1,118 @@
-/**
- * Pluggable local persistence for the SDK's device-side state: the cached
- * PRF output and the credential id this device owns. Adapters are
- * synchronous by design (mirroring the Web Storage API) so callers can
- * read cached state without awaiting.
- *
- * SECURITY: the PRF output cached through an adapter is raw key material —
- * anyone who can read it can re-derive the KEK and unwrap the CEK. The
- * default `localStorage` adapter stores it in plaintext, which is only as
- * strong as the origin's script-injection defenses (an XSS attacker could
- * equally just run the ceremony or exfiltrate decrypted data). Hosts with
- * stricter requirements should supply their own adapter with at-rest
- * protection, or pass `storage: null` to disable caching and re-prompt
- * biometrics instead.
- */
-/**
- * Default adapter backed by `window.localStorage`. Every operation is
- * best-effort: quota errors, privacy-mode failures, blocked-storage
- * contexts (e.g. sandboxed frames, where even touching `localStorage`
- * throws), and SSR (no window) all degrade to no-ops so storage problems
- * never interrupt a passkey ceremony.
- */
-export const browserLocalStorageAdapter = {
-    getItem(key) {
-        try {
-            if (typeof localStorage === 'undefined')
-                return null;
-            return localStorage.getItem(key);
-        }
-        catch {
-            return null;
-        }
-    },
-    setItem(key, value) {
-        try {
-            if (typeof localStorage === 'undefined')
-                return;
-            localStorage.setItem(key, value);
-        }
-        catch {
-            // best-effort
-        }
-    },
-    removeItem(key) {
-        try {
-            if (typeof localStorage === 'undefined')
-                return;
-            localStorage.removeItem(key);
-        }
-        catch {
-            // best-effort
-        }
-    },
-};
-/** In-memory adapter for tests and non-browser environments. */
-export function createMemoryStorageAdapter() {
-    const store = new Map();
+import { base64ToBytes, bytesToBase64 } from "./codec.js";
+function copyProfile(profile) {
+    return {
+        ...profile,
+        prfSalt: profile.prfSalt.slice(),
+        hkdfInfo: profile.hkdfInfo.slice(),
+    };
+}
+function copyCachedResult(result) {
+    return {
+        profile: copyProfile(result.profile),
+        credentialId: result.credentialId,
+        prfOutput: result.prfOutput.slice(),
+    };
+}
+export function createMemoryPasskeyKeyStorage() {
+    let cached = null;
+    let localCredentialId = null;
+    return {
+        loadCachedPRFResult() {
+            return cached ? copyCachedResult(cached) : null;
+        },
+        saveCachedPRFResult(result) {
+            cached = copyCachedResult(result);
+        },
+        loadLocalCredentialId() {
+            return localCredentialId;
+        },
+        saveLocalCredentialId(credentialId) {
+            localCredentialId = credentialId;
+        },
+        clear() {
+            cached = null;
+            localCredentialId = null;
+        },
+    };
+}
+/** Stores raw PRF output unencrypted in localStorage under an explicit namespace. */
+export function createInsecureBrowserLocalStoragePasskeyKeyStorage(namespace) {
+    const prefix = `passkey-key/${encodeURIComponent(namespace)}`;
+    const cachedKey = `${prefix}/cached-prf`;
+    const localCredentialKey = `${prefix}/local-credential`;
     return {
-        getItem: (key) => store.get(key) ?? null,
-        setItem: (key, value) => {
-            store.set(key, value);
+        loadCachedPRFResult() {
+            try {
+                if (typeof localStorage === "undefined")
+                    return null;
+                const value = localStorage.getItem(cachedKey);
+                if (!value)
+                    return null;
+                const stored = JSON.parse(value);
+                return {
+                    profile: {
+                        version: stored.profile.version,
+                        relyingPartyId: stored.profile.relyingPartyId,
+                        prfSalt: base64ToBytes(stored.profile.prfSaltBase64),
+                        hkdfInfo: base64ToBytes(stored.profile.hkdfInfoBase64),
+                    },
+                    credentialId: stored.credentialId,
+                    prfOutput: base64ToBytes(stored.prfOutputBase64),
+                };
+            }
+            catch {
+                return null;
+            }
+        },
+        saveCachedPRFResult(result) {
+            try {
+                if (typeof localStorage === "undefined")
+                    return;
+                const serialized = {
+                    profile: {
+                        version: result.profile.version,
+                        relyingPartyId: result.profile.relyingPartyId,
+                        prfSaltBase64: bytesToBase64(result.profile.prfSalt),
+                        hkdfInfoBase64: bytesToBase64(result.profile.hkdfInfo),
+                    },
+                    credentialId: result.credentialId,
+                    prfOutputBase64: bytesToBase64(result.prfOutput),
+                };
+                localStorage.setItem(cachedKey, JSON.stringify(serialized));
+            }
+            catch { }
+        },
+        loadLocalCredentialId() {
+            try {
+                if (typeof localStorage === "undefined")
+                    return null;
+                return localStorage.getItem(localCredentialKey);
+            }
+            catch {
+                return null;
+            }
+        },
+        saveLocalCredentialId(credentialId) {
+            try {
+                if (typeof localStorage === "undefined")
+                    return;
+                localStorage.setItem(localCredentialKey, credentialId);
+            }
+            catch { }
         },
-        removeItem: (key) => {
-            store.delete(key);
+        clear() {
+            try {
+                if (typeof localStorage === "undefined")
+                    return;
+                localStorage.removeItem(cachedKey);
+            }
+            catch { }
+            try {
+                if (typeof localStorage === "undefined")
+                    return;
+                localStorage.removeItem(localCredentialKey);
+            }
+            catch { }
         },
     };
 }

package/dist/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmB;IACxD,OAAO,CAAC,GAAW;QACjB,IAAI,CAAC;YACH,IAAI,OAAO,YAAY,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAA;YACpD,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC;YACH,IAAI,OAAO,YAAY,KAAK,WAAW;gBAAE,OAAM;YAC/C,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC;YACH,IAAI,OAAO,YAAY,KAAK,WAAW;gBAAE,OAAM;YAC/C,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;CACF,CAAA;AAED,gEAAgE;AAChE,MAAM,UAAU,0BAA0B;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACxC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC;QACD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAiB1D,SAAS,WAAW,CAAC,OAA0B;IAC7C,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAuB;IAC/C,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;QACpC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,IAAI,MAAM,GAA2B,IAAI,CAAC;IAC1C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,OAAO;QACL,mBAAmB;YACjB,OAAO,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;QACD,mBAAmB,CAAC,MAAM;YACxB,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,qBAAqB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,qBAAqB,CAAC,YAAY;YAChC,iBAAiB,GAAG,YAAY,CAAC;QACnC,CAAC;QACD,KAAK;YACH,MAAM,GAAG,IAAI,CAAC;YACd,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,qFAAqF;AACrF,MAAM,UAAU,kDAAkD,CAChE,SAAiB;IAEjB,MAAM,MAAM,GAAG,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,GAAG,MAAM,aAAa,CAAC;IACzC,MAAM,kBAAkB,GAAG,GAAG,MAAM,mBAAmB,CAAC;IACxD,OAAO;QACL,mBAAmB;YACjB,IAAI,CAAC;gBACH,IAAI,OAAO,YAAY,KAAK,WAAW;oBAAE,OAAO,IAAI,CAAC;gBACrD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC;gBACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA8B,CAAC;gBAC9D,OAAO;oBACL,OAAO,EAAE;wBACP,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;wBAC/B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc;wBAC7C,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;wBACpD,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;qBACvD;oBACD,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;iBACjD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,mBAAmB,CAAC,MAAM;YACxB,IAAI,CAAC;gBACH,IAAI,OAAO,YAAY,KAAK,WAAW;oBAAE,OAAO;gBAChD,MAAM,UAAU,GAA8B;oBAC5C,OAAO,EAAE;wBACP,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;wBAC/B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc;wBAC7C,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;wBACpD,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;qBACvD;oBACD,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;iBACjD,CAAC;gBACF,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,qBAAqB;YACnB,IAAI,CAAC;gBACH,IAAI,OAAO,YAAY,KAAK,WAAW;oBAAE,OAAO,IAAI,CAAC;gBACrD,OAAO,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,qBAAqB,CAAC,YAAY;YAChC,IAAI,CAAC;gBACH,IAAI,OAAO,YAAY,KAAK,WAAW;oBAAE,OAAO;gBAChD,YAAY,CAAC,OAAO,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,KAAK;YACH,IAAI,CAAC;gBACH,IAAI,OAAO,YAAY,KAAK,WAAW;oBAAE,OAAO;gBAChD,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,OAAO,YAAY,KAAK,WAAW;oBAAE,OAAO;gBAChD,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/support.d.ts

@@ -1,15 +1,3 @@
-/**
- * PRF support detection.
- *
- * Checks whether the current browser/platform supports the WebAuthn PRF
- * extension. This is an optimistic check — actual PRF support is only
- * confirmed when a credential is created with prf.enabled: true in the
- * response. If creation fails, callers should fall back to a manual flow.
- *
- * Detection strategy:
- * 1. Check window.PublicKeyCredential exists (basic WebAuthn support)
- * 2. Check isUserVerifyingPlatformAuthenticatorAvailable() (biometric/PIN authenticator present)
- * 3. Optionally check getClientCapabilities() for explicit PRF support signal (new API, not universal)
- */
-export declare function detectPrfSupport(): Promise<boolean>;
+import type { PasskeyCapability } from "./types.js";
+export declare function capability(operation: "enroll" | "recover"): Promise<PasskeyCapability>;
 //# sourceMappingURL=support.d.ts.map

package/dist/support.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../src/support.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CA+CzD"}
+{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../src/support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA4BpD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,QAAQ,GAAG,SAAS,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAgB5B"}

package/dist/support.js

@@ -1,58 +1,43 @@
-/**
- * PRF support detection.
- *
- * Checks whether the current browser/platform supports the WebAuthn PRF
- * extension. This is an optimistic check — actual PRF support is only
- * confirmed when a credential is created with prf.enabled: true in the
- * response. If creation fails, callers should fall back to a manual flow.
- *
- * Detection strategy:
- * 1. Check window.PublicKeyCredential exists (basic WebAuthn support)
- * 2. Check isUserVerifyingPlatformAuthenticatorAvailable() (biometric/PIN authenticator present)
- * 3. Optionally check getClientCapabilities() for explicit PRF support signal (new API, not universal)
- */
-export async function detectPrfSupport() {
-    if (typeof window === 'undefined') {
-        return false;
-    }
-    if (!window.PublicKeyCredential) {
-        return false;
-    }
-    // Check that a platform authenticator is available (Face ID, Touch ID, Windows Hello, etc.)
+function hasWebAuthn(operation) {
+    return (typeof navigator !== "undefined" &&
+        !!navigator.credentials &&
+        typeof navigator.credentials[operation === "enroll" ? "create" : "get"] ===
+            "function" &&
+        typeof PublicKeyCredential !== "undefined");
+}
+async function prfCapability() {
+    const credentialClass = PublicKeyCredential;
+    if (typeof credentialClass.getClientCapabilities !== "function")
+        return "unknown";
     try {
-        const available = await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
-        if (!available) {
-            return false;
-        }
+        const capabilities = await credentialClass.getClientCapabilities();
+        const reported = capabilities["extension:prf"];
+        if (reported === true)
+            return "supported";
+        if (reported === false)
+            return "unsupported";
     }
     catch {
-        return false;
+        return "unknown";
+    }
+    return "unknown";
+}
+export async function capability(operation) {
+    if (!hasWebAuthn(operation))
+        return "unsupported";
+    if (operation === "recover")
+        return prfCapability();
+    if (typeof PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable !== "function") {
+        return "unknown";
     }
-    // If getClientCapabilities is available, use it for a more precise check.
-    // This API is newer and may not be present in all browsers.
     try {
-        if (typeof PublicKeyCredential.getClientCapabilities === 'function') {
-            const caps = await PublicKeyCredential.getClientCapabilities();
-            if (caps && typeof caps === 'object') {
-                // The shape of this API varies across browser versions.
-                // Chrome returns a map-like object; check for extension-prf or prf key.
-                const hasPrf = caps['extension-prf'] === true ||
-                    caps['prf'] === true;
-                if (hasPrf) {
-                    return true;
-                }
-                // If getClientCapabilities is available but doesn't report PRF,
-                // that's a strong negative signal on platforms that implement it.
-                // However, since this API is still evolving, we don't treat absence
-                // as definitive — fall through to the optimistic path.
-            }
+        if (!(await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable())) {
+            return "unsupported";
         }
     }
     catch {
-        // getClientCapabilities not available or threw — fall through
+        return "unknown";
     }
-    // Optimistic: platform authenticator is available, WebAuthn is supported.
-    // Actual PRF support will be confirmed during credential creation.
-    return true;
+    return prfCapability();
 }
 //# sourceMappingURL=support.js.map

package/dist/support.js.map

@@ -1 +1 @@
-{"version":3,"file":"support.js","sourceRoot":"","sources":["../src/support.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAChC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,4FAA4F;IAC5F,IAAI,CAAC;QACH,MAAM,SAAS,GACb,MAAM,mBAAmB,CAAC,6CAA6C,EAAE,CAAA;QAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,CAAC;QACH,IAAI,OAAO,mBAAmB,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAA;YAC9D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,wDAAwD;gBACxD,wEAAwE;gBACxE,MAAM,MAAM,GACT,IAAgC,CAAC,eAAe,CAAC,KAAK,IAAI;oBAC1D,IAAgC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAA;gBACnD,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,gEAAgE;gBAChE,kEAAkE;gBAClE,oEAAoE;gBACpE,uDAAuD;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IAED,0EAA0E;IAC1E,mEAAmE;IACnE,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"support.js","sourceRoot":"","sources":["../src/support.ts"],"names":[],"mappings":"AAEA,SAAS,WAAW,CAAC,SAA+B;IAClD,OAAO,CACL,OAAO,SAAS,KAAK,WAAW;QAChC,CAAC,CAAC,SAAS,CAAC,WAAW;QACvB,OAAO,SAAS,CAAC,WAAW,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,UAAU;QACZ,OAAO,mBAAmB,KAAK,WAAW,CAC3C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,eAAe,GAAG,mBAEvB,CAAC;IACF,IAAI,OAAO,eAAe,CAAC,qBAAqB,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,qBAAqB,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC;QAC1C,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,aAAa,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAA+B;IAE/B,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,aAAa,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,aAAa,EAAE,CAAC;IACpD,IACE,OAAO,mBAAmB,CAAC,6CAA6C,KAAK,UAAU,EACvF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,6CAA6C,EAAE,CAAC,EAAE,CAAC;YACjF,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}

package/dist/types.d.ts

@@ -1,101 +1,97 @@
-import type { StorageAdapter } from "./storage.js";
-/** Structured logging hooks; the SDK never writes to the console itself. */
-export interface PasskeyKitLogger {
-    info?(message: string, metadata?: Record<string, unknown>): void;
-    error?(message: string, error?: unknown, metadata?: Record<string, unknown>): void;
-}
-export interface PasskeyKitStorageKeys {
-    /** Key under which the cached PRF result is persisted. */
-    prfResult: string;
-    /** Key under which this device's own credential id is persisted. */
-    localCredentialId: string;
-}
-/**
- * Overrides for the messages on errors the SDK throws. Useful for branding
- * or localization; the error classes themselves stay the same, so
- * `instanceof` checks are unaffected.
- */
-export interface PasskeyKitErrorMessages {
-    /** Message used for `PrfNotSupportedError`. */
-    prfNotSupported?: string;
-    /** Message used for `PasskeyTimeoutError`. */
-    timeout?: string;
-}
-export interface PasskeyKitConfig {
-    /** WebAuthn relying party id (e.g. `example.com`, or `localhost` in dev). */
-    rpId: string;
-    /** Human-readable relying party name shown in passkey prompts. */
-    rpName: string;
-    /**
-     * Input to the PRF `eval.first` salt. Must stay stable across all clients
-     * of the same protocol: changing it changes every derived KEK.
-     * Defaults to the Tinfoil v1 protocol constant.
-     */
-    prfSaltInput?: string | Uint8Array;
-    /**
-     * HKDF info string used for domain separation when deriving the KEK from
-     * the PRF output. Defaults to the Tinfoil v1 protocol constant.
-     */
-    hkdfInfo?: string | Uint8Array;
-    /**
-     * Local persistence for the PRF cache and this device's credential id.
-     * Defaults to a best-effort `localStorage` adapter; pass `null` to
-     * disable local persistence entirely.
-     */
-    storage?: StorageAdapter | null;
-    storageKeys?: Partial<PasskeyKitStorageKeys>;
-    /** Timeout passed to the WebAuthn API (some browsers ignore this). */
-    webauthnTimeoutMs?: number;
-    /**
-     * Hard client-side timeout guarding against providers that never resolve
-     * the WebAuthn promise. When exceeded, `PasskeyTimeoutError` is thrown.
-     */
-    stuckTimeoutMs?: number;
-    /** Custom messages for the errors the SDK throws. */
-    errorMessages?: PasskeyKitErrorMessages;
-    logger?: PasskeyKitLogger;
-}
-/** Identity attached to a newly created passkey. */
+import type { PasskeyKeyStorage } from "./storage.js";
+export interface PasskeyKeyProfile {
+    version: 1;
+    relyingPartyId: string;
+    prfSalt: Uint8Array;
+    hkdfInfo: Uint8Array;
+}
+export interface WrappedKey {
+    profile: PasskeyKeyProfile;
+    credentialId: string;
+    kekIvHex: string;
+    wrappedKeyHex: string;
+}
 export interface PasskeyUser {
-    /** Stable opaque user id (becomes the WebAuthn user handle). */
-    id: string;
-    /** Account identifier shown in passkey pickers (usually an email). */
+    id: Uint8Array;
     name: string;
-    /** Friendly display name; falls back to `name` when omitted. */
     displayName?: string;
 }
-/** Result of a successful PRF ceremony (create or authenticate). */
-export interface PrfPasskeyResult {
-    /** base64url-encoded credential id. */
+export type PasskeyCapability = "supported" | "unsupported" | "unknown";
+export type PasskeyInteraction = "interactive" | "immediatelyAvailable";
+export interface CreateAndWrapKeyInput {
+    user: PasskeyUser;
+    key: Uint8Array;
+    signal?: AbortSignal;
+}
+export interface CreatedWrappedKey {
     credentialId: string;
-    /** Raw 32-byte PRF output; treat as secret key material. */
-    prfOutput: ArrayBuffer;
+    wrappedKey: WrappedKey;
+}
+export interface RecoverKeyInput {
+    wrappedKeys: WrappedKey[];
+    preferredCredentialId?: string;
+    signal?: AbortSignal;
+    interaction?: PasskeyInteraction;
+}
+export interface EvaluateCredentialInput {
+    credentialIds: string[];
+    preferredCredentialId?: string;
+    signal?: AbortSignal;
+    interaction?: PasskeyInteraction;
 }
-/** A CEK wrapped under a passkey-derived KEK with AES-256-GCM. */
-export interface WrappedCek {
-    /** base64url-encoded credential id whose PRF output wraps this CEK. */
+export interface PRFResult {
+    output: Uint8Array;
+}
+export interface EvaluatedCredential {
     credentialId: string;
-    /** 12-byte AES-GCM IV, hex-encoded. */
-    kekIvHex: string;
-    /** Wrapped CEK ciphertext (including GCM tag), hex-encoded. */
-    wrappedKeyHex: string;
+    prfResult: PRFResult;
 }
-/** Result of the high-level enroll flow: create passkey + wrap CEK. */
-export interface EnrollResult {
+export interface WrapKeyWithPRFResultInput {
+    keyMaterial: Uint8Array;
     credentialId: string;
-    /** Ciphertext safe to persist server-side. */
-    wrappedCek: WrappedCek;
-    /**
-     * Device-local secret state (PRF output). Already persisted through the
-     * storage adapter when one is configured; returned so hosts with custom
-     * persistence can store it themselves.
-     */
-    prfResult: PrfPasskeyResult;
-}
-/** Result of the high-level unlock flow: authenticate + unwrap CEK. */
-export interface UnlockResult {
+    prfResult: PRFResult;
+}
+export interface UnwrapKeyWithPRFResultInput {
+    wrappedKey: WrappedKey;
+    prfResult: PRFResult;
+}
+export interface RecoveredKey {
+    credentialId: string;
+    key: Uint8Array;
+}
+export interface RewrapKeyInput {
+    key: Uint8Array;
+}
+export interface PasskeyKeyManagerConfig {
+    profile: PasskeyKeyProfile;
+    relyingPartyName: string;
+    timeoutMs?: number;
+    storage?: PasskeyKeyStorage;
+}
+export interface PasskeyKeyManager {
+    capability(input: {
+        operation: "enroll" | "recover";
+    }): Promise<PasskeyCapability>;
+    createAndWrapKey(input: CreateAndWrapKeyInput): Promise<CreatedWrappedKey>;
+    recoverKey(input: RecoverKeyInput): Promise<RecoveredKey>;
+    evaluateCredential(input: EvaluateCredentialInput): Promise<EvaluatedCredential>;
+    wrapKeyWithPRFResult(input: WrapKeyWithPRFResultInput): Promise<WrappedKey>;
+    unwrapKeyWithPRFResult(input: UnwrapKeyWithPRFResultInput): Promise<Uint8Array>;
+    recoverKeyFromCache(input: RecoverKeyInput): Promise<RecoveredKey | null>;
+    rewrapKeyFromCache(input: RewrapKeyInput): Promise<WrappedKey | null>;
+    clearLocalState(): void;
+    cancelActiveCeremony(): void;
+}
+export interface WrappedKeyRecord {
+    version: 1;
+    profile: {
+        version: 1;
+        relyingPartyId: string;
+        prfSalt: string;
+        hkdfInfo: string;
+    };
     credentialId: string;
-    /** The recovered raw 32-byte CEK. */
-    cek: Uint8Array;
+    kekIvHex: string;
+    wrappedKeyHex: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACjE,KAAK,CAAC,CACJ,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,OAAO,EACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,IAAI,CAAC;CACT;AAED,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7C,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,SAAS,EAAE,WAAW,CAAC;CACxB;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,UAAU,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,SAAS,EAAE,gBAAgB,CAAC;CAC7B;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,GAAG,EAAE,UAAU,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;AACxE,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,sBAAsB,CAAC;AAExE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,UAAU,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,UAAU,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,KAAK,EAAE;QAChB,SAAS,EAAE,QAAQ,GAAG,SAAS,CAAC;KACjC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/B,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChF,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1E,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACtE,eAAe,IAAI,IAAI,CAAC;IACxB,oBAAoB,IAAI,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC;QACX,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB"}

package/dist/webauthn.d.ts

@@ -1,38 +1,15 @@
-/**
- * WebAuthn PRF ceremonies: credential creation and assertion with the PRF
- * extension. Pure ceremony logic — persistence of the results is handled
- * by the kit through the hooks on {@link CeremonyContext}.
- */
-import type { PasskeyKitErrorMessages, PasskeyKitLogger, PasskeyUser, PrfPasskeyResult } from "./types.js";
+import type { PasskeyUser } from "./types.js";
 export interface CeremonyContext {
     rpId: string;
     rpName: string;
-    /** Salt passed to PRF eval.first — the client internally computes
-     *  SHA-256("WebAuthn PRF" || 0x00 || salt). */
-    prfSalt: Uint8Array;
-    webauthnTimeoutMs: number;
-    stuckTimeoutMs: number;
-    errorMessages?: PasskeyKitErrorMessages;
-    logger: PasskeyKitLogger;
-    /** Invoked after every successful PRF ceremony so the kit can cache state. */
-    onPrfResult(result: PrfPasskeyResult, credential: PublicKeyCredential): void;
+    prfInput: Uint8Array;
+    timeoutMs: number;
 }
-/**
- * Create a new PRF-capable passkey for the given user.
- *
- * Returns the credential ID and PRF output, or null if the user cancels.
- * Throws {@link PrfNotSupportedError} when the authenticator cannot supply
- * PRF output and {@link PasskeyTimeoutError} when the provider hangs.
- */
-export declare function createPrfPasskey(ctx: CeremonyContext, user: PasskeyUser): Promise<PrfPasskeyResult | null>;
-/**
- * Authenticate with an existing PRF passkey to derive the PRF output.
- *
- * @param credentialIds - base64url-encoded credential IDs to allow. Pass all
- *   known PRF credential IDs so the browser can select the right one.
- * @returns The matched credential ID and PRF output, or null on failure/cancel.
- */
-export declare function authenticatePrfPasskey(ctx: CeremonyContext, credentialIds: string[], options?: {
-    throwOnCancel?: boolean;
-}): Promise<PrfPasskeyResult | null>;
+export interface InternalPrfResult {
+    credentialId: string;
+    prfOutput: Uint8Array;
+    isPlatformAuthenticator: boolean;
+}
+export declare function createPrfCredential(context: CeremonyContext, user: PasskeyUser, signal: AbortSignal): Promise<InternalPrfResult>;
+export declare function evaluatePrfCredential(context: CeremonyContext, credentialIds: string[], signal: AbortSignal): Promise<InternalPrfResult>;
 //# sourceMappingURL=webauthn.d.ts.map

package/dist/webauthn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EACV,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf;mDAC+C;IAC/C,OAAO,EAAE,UAAU,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,MAAM,EAAE,gBAAgB,CAAC;IACzB,8EAA8E;IAC9E,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC9E;AAwBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqGlC;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA0ElC"}
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,UAAU,CAAC;IACtB,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAmCD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAqD5B;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,eAAe,EACxB,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAwB5B"}