@tinfoilsh/passkey-kit 0.1.0 → 0.2.0

package/dist/webauthn.js

@@ -1,189 +1,101 @@
-/**
- * WebAuthn PRF ceremonies: credential creation and assertion with the PRF
- * extension. Pure ceremony logic — persistence of the results is handled
- * by the kit through the hooks on {@link CeremonyContext}.
- */
-import { base64UrlToBytes, bufferSourceToArrayBuffer, bytesToBase64Url, } from "./codec.js";
-import { PasskeyKitError, PasskeyTimeoutError, PrfNotSupportedError, } from "./errors.js";
-const MAX_USER_HANDLE_BYTE_COUNT = 64;
-async function withStuckTimeout(promise, ctx) {
-    let timer;
-    try {
-        return await Promise.race([
-            promise,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new PasskeyTimeoutError(ctx.errorMessages?.timeout)), ctx.stuckTimeoutMs);
-            }),
-        ]);
+import { base64UrlToBytes, bufferSourceToArrayBuffer, bytesToBase64Url } from "./codec.js";
+import { invalidInput, PasskeyKeyError } from "./errors.js";
+const CHALLENGE_BYTES = 32;
+const MAX_USER_HANDLE_BYTES = 64;
+const PRF_OUTPUT_BYTES = 32;
+function extensionResults(credential) {
+    return credential.getClientExtensionResults();
+}
+function credentialId(credential) {
+    const rawId = new Uint8Array(credential.rawId);
+    if (rawId.length === 0)
+        throw invalidInput("credential ID must not be empty");
+    return bytesToBase64Url(rawId);
+}
+function resultFromCredential(credential) {
+    const first = extensionResults(credential).prf?.results?.first;
+    if (!first) {
+        throw new PasskeyKeyError("unsupported", "the authenticator returned no PRF output");
     }
-    finally {
-        if (timer !== undefined)
-            clearTimeout(timer);
+    const prfOutput = new Uint8Array(bufferSourceToArrayBuffer(first));
+    if (prfOutput.length !== PRF_OUTPUT_BYTES) {
+        throw invalidInput(`PRF output must be ${PRF_OUTPUT_BYTES} bytes`);
     }
+    return {
+        credentialId: credentialId(credential),
+        prfOutput,
+        isPlatformAuthenticator: credential.authenticatorAttachment === "platform",
+    };
 }
-/**
- * Create a new PRF-capable passkey for the given user.
- *
- * Returns the credential ID and PRF output, or null if the user cancels.
- * Throws {@link PrfNotSupportedError} when the authenticator cannot supply
- * PRF output and {@link PasskeyTimeoutError} when the provider hangs.
- */
-export async function createPrfPasskey(ctx, user) {
-    const userIdBytes = new TextEncoder().encode(user.id);
-    if (userIdBytes.byteLength > MAX_USER_HANDLE_BYTE_COUNT) {
-        throw new PasskeyKitError(`passkey-kit: user id must be at most ${MAX_USER_HANDLE_BYTE_COUNT} UTF-8 bytes`);
+export async function createPrfCredential(context, user, signal) {
+    if (!(user?.id instanceof Uint8Array) || user.id.length === 0) {
+        throw invalidInput("user.id must be a non-empty Uint8Array");
     }
-    try {
-        const credential = (await withStuckTimeout(navigator.credentials.create({
-            publicKey: {
-                challenge: crypto.getRandomValues(new Uint8Array(32)),
-                rp: { id: ctx.rpId, name: ctx.rpName },
-                user: {
-                    id: userIdBytes,
-                    name: user.name,
-                    displayName: user.displayName || user.name,
-                },
-                pubKeyCredParams: [
-                    { type: "public-key", alg: -7 }, // ES256
-                    { type: "public-key", alg: -257 }, // RS256 (broader compat)
-                ],
-                authenticatorSelection: {
-                    residentKey: "preferred",
-                    userVerification: "required",
-                },
-                timeout: ctx.webauthnTimeoutMs,
-                extensions: {
-                    prf: { eval: { first: ctx.prfSalt } },
-                },
-            },
-        }), ctx));
-        if (!credential) {
-            return null;
-        }
-        const extensionResults = credential.getClientExtensionResults();
-        const prfResults = extensionResults.prf;
-        if (!prfResults?.enabled) {
-            ctx.logger.info?.("Authenticator does not support PRF", {
-                action: "createPrfPasskey",
-            });
-            throw new PrfNotSupportedError(ctx.errorMessages?.prfNotSupported);
-        }
-        const credentialId = bytesToBase64Url(new Uint8Array(credential.rawId));
-        // Some authenticators return PRF results during creation, others don't.
-        // "Not all authenticators support evaluating the PRFs during credential
-        // creation so outputs may, or may not, be provided."
-        // — https://w3c.github.io/webauthn/#prf-extension (eval description)
-        if (prfResults.results?.first) {
-            const result = {
-                credentialId,
-                prfOutput: bufferSourceToArrayBuffer(prfResults.results.first),
-            };
-            ctx.onPrfResult(result, credential);
-            return result;
-        }
-        // PRF enabled but no results during create — do an immediate get()
-        ctx.logger.info?.("PRF enabled but no results during creation, doing immediate auth", { action: "createPrfPasskey" });
-        // Pass throwOnCancel so a user-cancelled assertion surfaces as a
-        // DOMException we can handle below — otherwise a `null` return would
-        // be indistinguishable from "provider returned no PRF output" and we'd
-        // show the misleading "PRF not supported" error for a plain cancel.
-        const postCreateAuth = await authenticatePrfPasskey(ctx, [credentialId], {
-            throwOnCancel: true,
-        });
-        if (!postCreateAuth) {
-            // The provider claimed PRF support during creation but didn't deliver
-            // a PRF output on the immediately-following assertion. Treat this as
-            // a lack of real PRF support rather than a silent failure.
-            throw new PrfNotSupportedError(ctx.errorMessages?.prfNotSupported);
-        }
-        return postCreateAuth;
+    if (user.id.length > MAX_USER_HANDLE_BYTES) {
+        throw invalidInput(`user.id must be at most ${MAX_USER_HANDLE_BYTES} bytes`);
     }
-    catch (error) {
-        if (error instanceof PrfNotSupportedError)
-            throw error;
-        if (error instanceof PasskeyTimeoutError)
-            throw error;
-        // DOMException with name "NotAllowedError" means the user cancelled
-        if (error instanceof DOMException && error.name === "NotAllowedError") {
-            ctx.logger.info?.("User cancelled passkey creation", {
-                action: "createPrfPasskey",
-            });
-            return null;
-        }
-        ctx.logger.error?.("Failed to create PRF passkey", error, {
-            action: "createPrfPasskey",
-        });
-        throw error;
+    if (typeof user.name !== "string" || user.name.length === 0) {
+        throw invalidInput("user.name must be a non-empty string");
     }
-}
-/**
- * Authenticate with an existing PRF passkey to derive the PRF output.
- *
- * @param credentialIds - base64url-encoded credential IDs to allow. Pass all
- *   known PRF credential IDs so the browser can select the right one.
- * @returns The matched credential ID and PRF output, or null on failure/cancel.
- */
-export async function authenticatePrfPasskey(ctx, credentialIds, options = {}) {
-    const { throwOnCancel = false } = options;
-    const allowCredentials = credentialIds.map((id) => ({
-        id: base64UrlToBytes(id),
-        type: "public-key",
-    }));
-    try {
-        const assertion = (await withStuckTimeout(navigator.credentials.get({
-            publicKey: {
-                challenge: crypto.getRandomValues(new Uint8Array(32)),
-                rpId: ctx.rpId,
-                allowCredentials,
+    if (user.displayName !== undefined && (typeof user.displayName !== "string" || !user.displayName)) {
+        throw invalidInput("user.displayName must be a non-empty string");
+    }
+    const credential = (await navigator.credentials.create({
+        signal,
+        publicKey: {
+            challenge: crypto.getRandomValues(new Uint8Array(CHALLENGE_BYTES)),
+            rp: { id: context.rpId, name: context.rpName },
+            user: {
+                id: user.id.slice(),
+                name: user.name,
+                displayName: user.displayName ?? user.name,
+            },
+            pubKeyCredParams: [
+                { type: "public-key", alg: -7 },
+                { type: "public-key", alg: -257 },
+            ],
+            authenticatorSelection: {
+                authenticatorAttachment: "platform",
+                residentKey: "preferred",
                 userVerification: "required",
-                timeout: ctx.webauthnTimeoutMs,
-                extensions: {
-                    prf: { eval: { first: ctx.prfSalt } },
-                },
             },
-        }), ctx));
-        if (!assertion) {
-            ctx.logger.info?.("passkey assertion returned no credential", {
-                action: "authenticatePrfPasskey",
-                allowedCredentials: credentialIds.length,
-            });
-            return null;
-        }
-        const extensionResults = assertion.getClientExtensionResults();
-        const prfOutput = extensionResults.prf?.results?.first;
-        if (!prfOutput) {
-            ctx.logger.error?.("PRF output missing from assertion", undefined, {
-                action: "authenticatePrfPasskey",
-            });
-            throw new PrfNotSupportedError(ctx.errorMessages?.prfNotSupported);
-        }
-        const result = {
-            credentialId: bytesToBase64Url(new Uint8Array(assertion.rawId)),
-            prfOutput: bufferSourceToArrayBuffer(prfOutput),
-        };
-        ctx.onPrfResult(result, assertion);
-        return result;
+            timeout: context.timeoutMs,
+            extensions: {
+                prf: { eval: { first: context.prfInput.slice() } },
+            },
+        },
+    }));
+    if (!credential) {
+        throw new PasskeyKeyError("cancelled", "credential creation was cancelled or no eligible credential was available");
+    }
+    const extension = extensionResults(credential).prf;
+    if (!extension?.enabled) {
+        throw new PasskeyKeyError("unsupported", "the authenticator does not support PRF");
     }
-    catch (error) {
-        if (error instanceof PasskeyTimeoutError)
-            throw error;
-        if (error instanceof DOMException && error.name === "NotAllowedError") {
-            // NotAllowedError covers both a user cancel and the case where the
-            // provider has no usable credential for any of the allowed ids
-            // (e.g. the passkey was created in a different browser/profile and
-            // never persisted on this device).
-            ctx.logger.info?.("passkey authentication not allowed (cancelled or no usable credential)", {
-                action: "authenticatePrfPasskey",
-                allowedCredentials: credentialIds.length,
-            });
-            if (throwOnCancel)
-                throw error;
-            return null;
-        }
-        ctx.logger.error?.("Failed to authenticate with PRF passkey", error, {
-            action: "authenticatePrfPasskey",
-        });
-        throw error;
+    if (extension.results?.first)
+        return resultFromCredential(credential);
+    return evaluatePrfCredential(context, [credentialId(credential)], signal);
+}
+export async function evaluatePrfCredential(context, credentialIds, signal) {
+    const assertion = (await navigator.credentials.get({
+        signal,
+        publicKey: {
+            challenge: crypto.getRandomValues(new Uint8Array(CHALLENGE_BYTES)),
+            rpId: context.rpId,
+            allowCredentials: credentialIds.map((credentialId) => ({
+                type: "public-key",
+                id: base64UrlToBytes(credentialId),
+            })),
+            userVerification: "required",
+            timeout: context.timeoutMs,
+            extensions: {
+                prf: { eval: { first: context.prfInput.slice() } },
+            },
+        },
+    }));
+    if (!assertion) {
+        throw new PasskeyKeyError("cancelled", "credential evaluation was cancelled or no eligible credential was available");
     }
+    return resultFromCredential(assertion);
 }
 //# sourceMappingURL=webauthn.js.map

package/dist/webauthn.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAsBrB,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC,KAAK,UAAU,gBAAgB,CAC7B,OAAmB,EACnB,GAAoB;IAEpB,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC3B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,EACjE,GAAG,CAAC,cAAc,CACnB,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,IAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,IAAI,WAAW,CAAC,UAAU,GAAG,0BAA0B,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CACvB,wCAAwC,0BAA0B,cAAc,CACjF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,MAAM,gBAAgB,CACxC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;YAC3B,SAAS,EAAE;gBACT,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;gBACrD,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE;gBACtC,IAAI,EAAE;oBACJ,EAAE,EAAE,WAAW;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;iBAC3C;gBACD,gBAAgB,EAAE;oBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ;oBACzC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,yBAAyB;iBAC7D;gBACD,sBAAsB,EAAE;oBACtB,WAAW,EAAE,WAAW;oBACxB,gBAAgB,EAAE,UAAU;iBAC7B;gBACD,OAAO,EAAE,GAAG,CAAC,iBAAiB;gBAC9B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAuB,EAAE,EAAE;iBACtD;aACF;SACF,CAAC,EACF,GAAG,CACJ,CAA+B,CAAC;QAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,yBAAyB,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC;QAExC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,oCAAoC,EAAE;gBACtD,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;YACH,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAExE,wEAAwE;QACxE,wEAAwE;QACxE,qDAAqD;QACrD,qEAAqE;QACrE,IAAI,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAqB;gBAC/B,YAAY;gBACZ,SAAS,EAAE,yBAAyB,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;aAC/D,CAAC;YACF,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,mEAAmE;QACnE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CACf,kEAAkE,EAClE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAC/B,CAAC;QACF,iEAAiE;QACjE,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE;YACvE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,sEAAsE;YACtE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB;YAAE,MAAM,KAAK,CAAC;QACvD,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QAEtD,oEAAoE;QACpE,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,iCAAiC,EAAE;gBACnD,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,8BAA8B,EAAE,KAAK,EAAE;YACxD,MAAM,EAAE,kBAAkB;SAC3B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAoB,EACpB,aAAuB,EACvB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,gBAAgB,GAAoC,aAAa,CAAC,GAAG,CACzE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACP,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAiB;QACxC,IAAI,EAAE,YAAY;KACnB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,MAAM,gBAAgB,CACvC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YACxB,SAAS,EAAE;gBACT,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;gBACrD,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,gBAAgB;gBAChB,gBAAgB,EAAE,UAAU;gBAC5B,OAAO,EAAE,GAAG,CAAC,iBAAiB;gBAC9B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAuB,EAAE,EAAE;iBACtD;aACF;SACF,CAAC,EACF,GAAG,CACJ,CAA+B,CAAC;QAEjC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAA0C,EAAE;gBAC5D,MAAM,EAAE,wBAAwB;gBAChC,kBAAkB,EAAE,aAAa,CAAC,MAAM;aACzC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,SAAS,CAAC,yBAAyB,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;QAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,mCAAmC,EAAE,SAAS,EAAE;gBACjE,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;YACH,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAqB;YAC/B,YAAY,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/D,SAAS,EAAE,yBAAyB,CAAC,SAAS,CAAC;SAChD,CAAC;QACF,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QAEtD,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtE,mEAAmE;YACnE,+DAA+D;YAC/D,mEAAmE;YACnE,mCAAmC;YACnC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CACf,wEAAwE,EACxE;gBACE,MAAM,EAAE,wBAAwB;gBAChC,kBAAkB,EAAE,aAAa,CAAC,MAAM;aACzC,CACF,CAAC;YACF,IAAI,aAAa;gBAAE,MAAM,KAAK,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,yCAAyC,EAAE,KAAK,EAAE;YACnE,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG5D,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAsB5B,SAAS,gBAAgB,CAAC,UAA+B;IACvD,OAAO,UAAU,CAAC,yBAAyB,EAAyB,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,UAA+B;IACnD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,YAAY,CAAC,iCAAiC,CAAC,CAAC;IAC9E,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,UAA+B;IAC3D,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,0CAA0C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,YAAY,CAAC,sBAAsB,gBAAgB,QAAQ,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,YAAY,CAAC,UAAU,CAAC;QACtC,SAAS;QACT,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,KAAK,UAAU;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAwB,EACxB,IAAiB,EACjB,MAAmB;IAEnB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,YAAY,CAAC,wCAAwC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC3C,MAAM,YAAY,CAAC,2BAA2B,qBAAqB,QAAQ,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClG,MAAM,YAAY,CAAC,6CAA6C,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;QACrD,MAAM;QACN,SAAS,EAAE;YACT,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;YAC9C,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;aAC3C;YACD,gBAAgB,EAAE;gBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;gBAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;aAClC;YACD,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,UAAU;gBACnC,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,UAAU;aAC7B;YACD,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE;aACX;SAC1C;KACF,CAAC,CAA+B,CAAC;IAElC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEtE,OAAO,qBAAqB,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAwB,EACxB,aAAuB,EACvB,MAAmB;IAEnB,MAAM,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;QACjD,MAAM;QACN,SAAS,EAAE;YACT,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,gBAAgB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;gBACrD,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,gBAAgB,CAAC,YAAY,CAAiB;aACnD,CAAC,CAAC;YACH,gBAAgB,EAAE,UAAU;YAC5B,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE;aACX;SAC1C;KACF,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC"}

package/dist/wrapped-key-record-codec.d.ts

@@ -0,0 +1,4 @@
+import type { WrappedKey } from "./types.js";
+export declare function encodeWrappedKeyRecord(wrappedKey: WrappedKey): string;
+export declare function decodeWrappedKeyRecord(json: string): WrappedKey;
+//# sourceMappingURL=wrapped-key-record-codec.d.ts.map

package/dist/wrapped-key-record-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapped-key-record-codec.d.ts","sourceRoot":"","sources":["../src/wrapped-key-record-codec.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,YAAY,CAAC;AAgB/D,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAmBrE;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CA+C/D"}

package/dist/wrapped-key-record-codec.js

@@ -0,0 +1,89 @@
+import { bytesToBase64Url } from "./codec.js";
+import { copyAndValidateProfile, decodeCanonicalBase64Url, PROFILE_KEYS, validateWrappedKey, } from "./crypto.js";
+import { invalidInput } from "./errors.js";
+const RECORD_FIELDS = [
+    "version",
+    "profile",
+    "credentialId",
+    "kekIvHex",
+    "wrappedKeyHex",
+];
+function hasExactFields(value, fields) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const keys = Object.keys(value).sort();
+    const expected = [...fields].sort();
+    return keys.length === expected.length && keys.every((key, index) => key === expected[index]);
+}
+export function encodeWrappedKeyRecord(wrappedKey) {
+    if (!wrappedKey || typeof wrappedKey !== "object") {
+        throw invalidInput("wrapped key is required");
+    }
+    const profile = copyAndValidateProfile(wrappedKey.profile);
+    validateWrappedKey(wrappedKey, profile);
+    const record = {
+        version: 1,
+        profile: {
+            version: 1,
+            relyingPartyId: profile.relyingPartyId,
+            prfSalt: bytesToBase64Url(profile.prfSalt),
+            hkdfInfo: bytesToBase64Url(profile.hkdfInfo),
+        },
+        credentialId: wrappedKey.credentialId,
+        kekIvHex: wrappedKey.kekIvHex,
+        wrappedKeyHex: wrappedKey.wrappedKeyHex,
+    };
+    return JSON.stringify(record);
+}
+export function decodeWrappedKeyRecord(json) {
+    if (typeof json !== "string")
+        throw invalidInput("wrapped key JSON must be a string");
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        throw invalidInput("wrapped key JSON is malformed");
+    }
+    if (!hasExactFields(parsed, RECORD_FIELDS)) {
+        throw invalidInput("wrapped key record has unexpected fields");
+    }
+    if (parsed.version !== 1)
+        throw invalidInput("wrapped key record version must be 1");
+    if (!hasExactFields(parsed.profile, PROFILE_KEYS)) {
+        throw invalidInput("wrapped key profile record has unexpected fields");
+    }
+    if (parsed.profile.version !== 1) {
+        throw invalidInput("wrapped key profile version must be 1");
+    }
+    if (typeof parsed.profile.relyingPartyId !== "string") {
+        throw invalidInput("profile.relyingPartyId must be a string");
+    }
+    if (typeof parsed.credentialId !== "string") {
+        throw invalidInput("credentialId must be a string");
+    }
+    if (typeof parsed.kekIvHex !== "string") {
+        throw invalidInput("kekIvHex must be a string");
+    }
+    if (typeof parsed.wrappedKeyHex !== "string") {
+        throw invalidInput("wrappedKeyHex must be a string");
+    }
+    const wrappedKey = {
+        profile: {
+            version: 1,
+            relyingPartyId: parsed.profile.relyingPartyId,
+            prfSalt: decodeCanonicalBase64Url(parsed.profile.prfSalt, "profile.prfSalt"),
+            hkdfInfo: decodeCanonicalBase64Url(parsed.profile.hkdfInfo, "profile.hkdfInfo"),
+        },
+        credentialId: parsed.credentialId,
+        kekIvHex: parsed.kekIvHex,
+        wrappedKeyHex: parsed.wrappedKeyHex,
+    };
+    const profile = copyAndValidateProfile(wrappedKey.profile);
+    validateWrappedKey(wrappedKey, profile);
+    return {
+        ...wrappedKey,
+        profile,
+    };
+}
+//# sourceMappingURL=wrapped-key-record-codec.js.map

package/dist/wrapped-key-record-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapped-key-record-codec.js","sourceRoot":"","sources":["../src/wrapped-key-record-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,YAAY,EACZ,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,aAAa,GAAG;IACpB,SAAS;IACT,SAAS;IACT,cAAc;IACd,UAAU;IACV,eAAe;CACP,CAAC;AACX,SAAS,cAAc,CAAC,KAAc,EAAE,MAAyB;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAsB;IAC3D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,YAAY,CAAC,yBAAyB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3D,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,MAAM,GAAqB;QAC/B,OAAO,EAAE,CAAC;QACV,OAAO,EAAE;YACP,OAAO,EAAE,CAAC;YACV,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1C,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC7C;QACD,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;IACtF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;IACrF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,YAAY,CAAC,kDAAkD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,YAAY,CAAC,uCAAuC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,YAAY,CAAC,yCAAyC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,gCAAgC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,UAAU,GAAe;QAC7B,OAAO,EAAE;YACP,OAAO,EAAE,CAAC;YACV,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc;YAC7C,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC;YAC5E,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SAChF;QACD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;IACF,MAAM,OAAO,GAAG,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3D,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,UAAU;QACb,OAAO;KACR,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinfoilsh/passkey-kit",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "WebAuthn PRF passkey SDK for protecting encryption keys with passkey-derived keys.",
   "license": "Apache-2.0",
   "type": "module",
@@ -16,7 +16,9 @@
   },
   "files": [
     "dist",
-    "src"
+    "src",
+    "LICENSE",
+    "README.md"
   ],
   "scripts": {
     "clean": "node --input-type=module -e \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true })\"",