@tinfoilsh/passkey-kit 0.1.0 → 0.2.1

package/dist/kit.js

@@ -1,198 +1,374 @@
-/**
- * The main SDK entry point. `createPasskeyKit(config)` binds relying-party
- * configuration, protocol constants, and local persistence into a single
- * object exposing both high-level flows (enroll / unlock / rewrap) and the
- * lower-level ceremony + crypto building blocks.
- */
-import { base64ToBytes, bytesToBase64 } from "./codec.js";
-import { deriveKeyEncryptionKey as deriveKekFromPrf, unwrapCek, wrapCek, } from "./crypto.js";
-import { TINFOIL_HKDF_INFO_V1, TINFOIL_PRF_SALT_INPUT_V1 } from "./protocol.js";
-import { browserLocalStorageAdapter } from "./storage.js";
-import { detectPrfSupport } from "./support.js";
-import { authenticatePrfPasskey, createPrfPasskey, } from "./webauthn.js";
-const DEFAULT_STORAGE_KEYS = {
-    prfResult: "tinfoil-secret-passkey-prf-output",
-    localCredentialId: "tinfoil-local-passkey-credential-id",
-};
-const DEFAULT_WEBAUTHN_TIMEOUT_MS = 30000;
-// Internal hard timeout to guard against providers (e.g. some
-// password-manager browser extensions) that never resolve the
-// credentials.create/get promise. Kept tight so users aren't left staring
-// at an indefinite spinner; the WebAuthn flow itself should complete well
-// within this window once the provider actually prompts.
-const DEFAULT_STUCK_TIMEOUT_MS = 60000;
-export function createPasskeyKit(config) {
-    const logger = config.logger ?? {};
-    const storage = config.storage === undefined ? browserLocalStorageAdapter : config.storage;
-    const storageKeys = {
-        ...DEFAULT_STORAGE_KEYS,
-        ...config.storageKeys,
+import { copyAndValidateProfile, profilesEqual, unwrapKey, validateCredentialId, validateKey, validateWrappedKey, wrapKey, } from "./crypto.js";
+import { invalidInput, PasskeyKeyError } from "./errors.js";
+import { capability as detectCapability } from "./support.js";
+import { createPrfCredential, evaluatePrfCredential, } from "./webauthn.js";
+const DEFAULT_TIMEOUT_MS = 60000;
+const MIN_TIMEOUT_MS = 1;
+const MAX_TIMEOUT_MS = 2147483647;
+function mapCeremonyError(error, operation) {
+    if (error instanceof PasskeyKeyError) {
+        if (error.operation)
+            return error;
+        return new PasskeyKeyError(error.category, error.message, {
+            cause: error.cause,
+            operation,
+        });
+    }
+    if (error instanceof DOMException && error.name === "NotAllowedError") {
+        return new PasskeyKeyError("cancelled", "the prompt was dismissed or no eligible credential was available", { cause: error, operation });
+    }
+    if (error instanceof DOMException && error.name === "AbortError") {
+        return new PasskeyKeyError("cancelled", "the passkey operation was cancelled", {
+            cause: error,
+            operation,
+        });
+    }
+    return new PasskeyKeyError("operation_failed", "the passkey operation failed", {
+        cause: error,
+        operation,
+    });
+}
+function context(profile, relyingPartyName, timeoutMs) {
+    return {
+        rpId: profile.relyingPartyId,
+        rpName: relyingPartyName,
+        prfInput: profile.prfSalt,
+        timeoutMs,
     };
-    // Byte inputs are snapshotted so later caller-side buffer reuse cannot
-    // silently change the PRF domain or KEK derivation between ceremonies.
-    const prfSalt = typeof config.prfSaltInput === "string" || config.prfSaltInput === undefined
-        ? new TextEncoder().encode(config.prfSaltInput ?? TINFOIL_PRF_SALT_INPUT_V1)
-        : config.prfSaltInput.slice();
-    const hkdfInfo = config.hkdfInfo === undefined
-        ? TINFOIL_HKDF_INFO_V1
-        : typeof config.hkdfInfo === "string"
-            ? config.hkdfInfo
-            : config.hkdfInfo.slice();
-    let prfSupportCache = null;
-    function cachePrfResult(result) {
-        if (!storage)
-            return;
-        const entry = {
-            credentialId: result.credentialId,
-            prfOutput: bytesToBase64(new Uint8Array(result.prfOutput)),
+}
+function copyUser(user) {
+    if (!user || typeof user !== "object")
+        throw invalidInput("user is required");
+    return {
+        id: user.id instanceof Uint8Array ? user.id.slice() : user.id,
+        name: user.name,
+        displayName: user.displayName,
+    };
+}
+function copyWrappedKeys(wrappedKeys) {
+    if (!Array.isArray(wrappedKeys) || wrappedKeys.length === 0) {
+        throw invalidInput("at least one wrapped key is required");
+    }
+    return wrappedKeys.map((wrapped) => {
+        if (!wrapped || typeof wrapped !== "object") {
+            throw invalidInput("wrapped key is required");
+        }
+        return {
+            ...wrapped,
+            profile: copyAndValidateProfile(wrapped.profile),
         };
+    });
+}
+export function createPasskeyKeyManager(config) {
+    if (!config || typeof config !== "object")
+        throw invalidInput("manager config is required");
+    const profile = copyAndValidateProfile(config.profile);
+    if (typeof config.relyingPartyName !== "string" ||
+        config.relyingPartyName.length === 0) {
+        throw invalidInput("relyingPartyName must be a non-empty string");
+    }
+    const relyingPartyName = config.relyingPartyName;
+    if (config.timeoutMs !== undefined &&
+        (!Number.isFinite(config.timeoutMs) ||
+            config.timeoutMs < MIN_TIMEOUT_MS ||
+            config.timeoutMs > MAX_TIMEOUT_MS)) {
+        throw invalidInput(`timeoutMs must be between ${MIN_TIMEOUT_MS} and ${MAX_TIMEOUT_MS}`);
+    }
+    const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let activeCeremony = null;
+    async function runCeremony(operation, callerSignal, perform) {
+        if (activeCeremony) {
+            throw new PasskeyKeyError("operation_in_progress", "another passkey ceremony is in progress", { operation });
+        }
+        if (callerSignal?.aborted) {
+            throw new PasskeyKeyError("cancelled", "the passkey operation was cancelled", {
+                cause: callerSignal.reason,
+                operation,
+            });
+        }
+        const token = Symbol(operation);
+        const controller = new AbortController();
+        let rejectInterruption;
+        const interrupted = new Promise((_, reject) => {
+            rejectInterruption = reject;
+        });
+        const cancel = (error) => {
+            rejectInterruption?.(error);
+            controller.abort(error);
+        };
+        activeCeremony = { token, operation, cancel };
+        const cancelFromCaller = () => cancel(new PasskeyKeyError("cancelled", "the passkey operation was cancelled", {
+            cause: callerSignal?.reason,
+            operation,
+        }));
+        callerSignal?.addEventListener("abort", cancelFromCaller, { once: true });
+        const timeout = setTimeout(() => cancel(new PasskeyKeyError("timeout", "the passkey operation timed out", {
+            operation,
+        })), timeoutMs);
         try {
-            storage.setItem(storageKeys.prfResult, JSON.stringify(entry));
+            return await Promise.race([perform(controller.signal), interrupted]);
+        }
+        catch (error) {
+            throw mapCeremonyError(error, operation);
+        }
+        finally {
+            clearTimeout(timeout);
+            callerSignal?.removeEventListener("abort", cancelFromCaller);
+            if (activeCeremony?.token === token)
+                activeCeremony = null;
+        }
+    }
+    function recordSuccessfulCredential(result) {
+        try {
+            config.storage?.saveCachedPRFResult({
+                profile: copyAndValidateProfile(profile),
+                credentialId: result.credentialId,
+                prfOutput: result.prfOutput.slice(),
+            });
         }
         catch {
-            // best-effort
+            // Storage is best-effort and cannot invalidate a successful ceremony.
+        }
+        if (result.isPlatformAuthenticator) {
+            try {
+                config.storage?.saveLocalCredentialId(result.credentialId);
+            }
+            catch {
+                // Storage is best-effort and cannot invalidate a successful ceremony.
+            }
         }
     }
-    function getCachedPrfResult() {
-        if (!storage)
+    function loadCachedResult() {
+        let result;
+        try {
+            result = config.storage?.loadCachedPRFResult() ?? null;
+        }
+        catch {
+            return null;
+        }
+        if (!result)
             return null;
+        let cachedProfile;
         try {
-            const raw = storage.getItem(storageKeys.prfResult);
-            if (!raw)
-                return null;
-            const entry = JSON.parse(raw);
-            return {
-                credentialId: entry.credentialId,
-                prfOutput: base64ToBytes(entry.prfOutput).buffer,
-            };
+            cachedProfile = copyAndValidateProfile(result.profile);
+            validateCredentialId(result.credentialId);
+        }
+        catch {
+            return null;
+        }
+        if (!profilesEqual(cachedProfile, profile) ||
+            !(result.prfOutput instanceof Uint8Array) ||
+            result.prfOutput.length !== 32)
+            return null;
+        return {
+            profile: cachedProfile,
+            credentialId: result.credentialId,
+            prfOutput: result.prfOutput.slice(),
+        };
+    }
+    function loadPreferredCredentialId() {
+        try {
+            return config.storage?.loadLocalCredentialId() ?? null;
         }
         catch {
             return null;
         }
     }
-    function setLocalCredentialId(credentialId) {
-        storage?.setItem(storageKeys.localCredentialId, credentialId);
+    function orderedCredentialIds(credentialIds, preferredCredentialId) {
+        if (!Array.isArray(credentialIds) || credentialIds.length === 0) {
+            throw invalidInput("at least one credentialId is required");
+        }
+        // Skip candidates that are not canonical base64url instead of
+        // failing the ceremony: one malformed ID (e.g. a legacy record
+        // written by another client) must not block assertion against
+        // the valid ones.
+        const unique = [...new Set(credentialIds)].filter((credentialId) => {
+            try {
+                validateCredentialId(credentialId);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (unique.length === 0) {
+            throw invalidInput("no credentialId is valid unpadded base64url");
+        }
+        const preferred = preferredCredentialId ?? loadPreferredCredentialId();
+        if (!preferred || !unique.includes(preferred))
+            return unique;
+        return [preferred, ...unique.filter((credentialId) => credentialId !== preferred)];
+    }
+    function copyPRFOutput(prfResult, operation) {
+        if (!prfResult ||
+            typeof prfResult !== "object" ||
+            !(prfResult.output instanceof Uint8Array) ||
+            prfResult.output.length !== 32) {
+            throw invalidInput("prfResult.output must be exactly 32 bytes", operation);
+        }
+        return prfResult.output.slice();
+    }
+    async function wrapKeyWithPRFResult(input, operation = "wrapKeyWithPRFResult") {
+        if (!input || typeof input !== "object")
+            throw invalidInput("input is required", operation);
+        validateKey(input.keyMaterial, operation);
+        validateCredentialId(input.credentialId);
+        const keyMaterial = input.keyMaterial.slice();
+        const prfOutput = copyPRFOutput(input.prfResult, operation);
+        return wrapKey(profile, input.credentialId, prfOutput, keyMaterial, operation);
     }
-    // Cross-device hybrid (QR-paired phone, etc.) reports
-    // `authenticatorAttachment === 'cross-platform'` on the resulting
-    // credential. Caching the cred id in that case would make this
-    // device look like it has its own passkey when in reality the user
-    // just borrowed another device's passkey for a one-shot unlock.
-    // Per WebAuthn L3 §5.2.1, we only treat `authenticatorAttachment`
-    // of `'platform'` as "this device truly owns this credential".
-    function onPrfResult(result, credential) {
-        cachePrfResult(result);
-        if (credential.authenticatorAttachment === "platform") {
+    async function unwrapKeyWithPRFResult(input, operation = "unwrapKeyWithPRFResult") {
+        if (!input || typeof input !== "object")
+            throw invalidInput("input is required", operation);
+        const wrappedKey = {
+            ...input.wrappedKey,
+            profile: copyAndValidateProfile(input.wrappedKey?.profile),
+        };
+        validateWrappedKey(wrappedKey, profile);
+        const prfOutput = copyPRFOutput(input.prfResult, operation);
+        return unwrapKey(profile, prfOutput, wrappedKey, operation);
+    }
+    async function createAndWrapKey(input) {
+        if (!input || typeof input !== "object")
+            throw invalidInput("input is required");
+        validateKey(input.key, "createAndWrapKey");
+        const key = input.key.slice();
+        const user = copyUser(input.user);
+        const result = await runCeremony("createAndWrapKey", input.signal, (signal) => createPrfCredential(context(profile, relyingPartyName, timeoutMs), user, signal));
+        recordSuccessfulCredential(result);
+        const wrappedKey = await wrapKeyWithPRFResult({
+            keyMaterial: key,
+            credentialId: result.credentialId,
+            prfResult: { output: result.prfOutput },
+        }, "createAndWrapKey");
+        return { credentialId: result.credentialId, wrappedKey };
+    }
+    function prepareRecovery(input) {
+        if (!input || typeof input !== "object")
+            throw invalidInput("input is required");
+        // Skip malformed candidates (wrong profile, non-canonical
+        // credential ID, bad lengths) rather than failing the whole set,
+        // so one corrupt or foreign bundle cannot block recovery from the
+        // healthy ones. Throw only when no usable candidate remains.
+        if (!Array.isArray(input.wrappedKeys) || input.wrappedKeys.length === 0) {
+            throw invalidInput("at least one wrapped key is required");
+        }
+        const wrappedKeys = [];
+        for (const candidate of input.wrappedKeys) {
             try {
-                setLocalCredentialId(result.credentialId);
+                const [wrapped] = copyWrappedKeys([candidate]);
+                validateWrappedKey(wrapped, profile);
+                wrappedKeys.push(wrapped);
             }
             catch {
-                // best-effort: a throwing custom adapter must not discard the
-                // ceremony result
+                // Skipped: malformed candidate.
             }
         }
+        if (wrappedKeys.length === 0) {
+            throw invalidInput("no wrapped key matches this profile and format");
+        }
+        return wrappedKeys;
     }
-    const ceremonyContext = {
-        rpId: config.rpId,
-        rpName: config.rpName,
-        prfSalt,
-        webauthnTimeoutMs: config.webauthnTimeoutMs ?? DEFAULT_WEBAUTHN_TIMEOUT_MS,
-        stuckTimeoutMs: config.stuckTimeoutMs ?? DEFAULT_STUCK_TIMEOUT_MS,
-        errorMessages: config.errorMessages,
-        logger,
-        onPrfResult,
-    };
-    const deriveKek = (prfOutput) => deriveKekFromPrf(prfOutput, hkdfInfo);
-    async function wrapWithPrfResult(prfResult, cek) {
-        const kek = await deriveKek(prfResult.prfOutput);
-        return wrapCek({ credentialId: prfResult.credentialId, kek, cek });
+    async function evaluateCredential(input, operation = "evaluateCredential") {
+        if (!input || typeof input !== "object")
+            throw invalidInput("input is required");
+        const interaction = input.interaction ?? "interactive";
+        if (interaction !== "interactive" && interaction !== "immediatelyAvailable") {
+            throw invalidInput("interaction must be interactive or immediatelyAvailable", operation);
+        }
+        if (interaction === "immediatelyAvailable") {
+            throw new PasskeyKeyError("unsupported", "immediatelyAvailable credential evaluation is not supported in browsers", { operation });
+        }
+        const credentialIds = orderedCredentialIds(input.credentialIds, input.preferredCredentialId);
+        const result = await runCeremony(operation, input.signal, (signal) => evaluatePrfCredential(context(profile, relyingPartyName, timeoutMs), credentialIds, signal));
+        recordSuccessfulCredential(result);
+        return {
+            credentialId: result.credentialId,
+            prfResult: { output: result.prfOutput.slice() },
+        };
     }
     return {
-        async isPrfSupported() {
-            if (prfSupportCache !== null)
-                return prfSupportCache;
-            prfSupportCache = await detectPrfSupport();
-            return prfSupportCache;
-        },
-        resetPrfSupportCache() {
-            prfSupportCache = null;
+        async capability(input) {
+            if (!input ||
+                typeof input !== "object" ||
+                (input.operation !== "enroll" && input.operation !== "recover")) {
+                throw invalidInput("operation must be enroll or recover", "capability");
+            }
+            return detectCapability(input.operation);
         },
-        createPasskey(user) {
-            return createPrfPasskey(ceremonyContext, user);
+        createAndWrapKey,
+        evaluateCredential(input) {
+            return evaluateCredential(input);
         },
-        async authenticate(credentialIds, options = {}) {
-            // An empty allowCredentials list would start a discoverable-passkey
-            // ceremony against ANY credential, breaking the "only the supplied
-            // ids" contract.
-            if (credentialIds.length === 0)
-                return null;
-            return authenticatePrfPasskey(ceremonyContext, credentialIds, options);
+        wrapKeyWithPRFResult(input) {
+            return wrapKeyWithPRFResult(input);
         },
-        deriveKek,
-        async enroll(opts) {
-            const prfResult = await createPrfPasskey(ceremonyContext, opts.user);
-            if (!prfResult)
-                return null;
-            const wrappedCek = await wrapWithPrfResult(prfResult, opts.cek);
-            return { credentialId: prfResult.credentialId, wrappedCek, prfResult };
+        unwrapKeyWithPRFResult(input) {
+            return unwrapKeyWithPRFResult(input);
         },
-        async unlock(wrappedCeks) {
-            if (wrappedCeks.length === 0)
-                return null;
-            const prfResult = await authenticatePrfPasskey(ceremonyContext, wrappedCeks.map((w) => w.credentialId));
-            if (!prfResult)
-                return null;
-            const match = wrappedCeks.find((w) => w.credentialId === prfResult.credentialId);
-            if (!match) {
-                logger.error?.("assertion matched a credential with no wrapped CEK", undefined, { action: "unlock", credentialId: prfResult.credentialId });
-                return null;
-            }
-            const kek = await deriveKek(prfResult.prfOutput);
-            const cek = await unwrapCek(kek, match);
-            return { credentialId: prfResult.credentialId, cek };
+        async recoverKey(input) {
+            const wrappedKeys = prepareRecovery(input);
+            const result = await evaluateCredential({
+                credentialIds: wrappedKeys.map((wrapped) => wrapped.credentialId),
+                preferredCredentialId: input.preferredCredentialId,
+                signal: input.signal,
+                interaction: input.interaction,
+            }, "recoverKey");
+            const wrapped = wrappedKeys.find((candidate) => candidate.credentialId === result.credentialId);
+            if (!wrapped)
+                throw invalidInput("credential has no matching wrapped key", "recoverKey");
+            return {
+                credentialId: result.credentialId,
+                key: await unwrapKeyWithPRFResult({ wrappedKey: wrapped, prfResult: result.prfResult }, "recoverKey"),
+            };
         },
-        async unlockWithCachedPrf(wrappedCeks) {
-            const cached = getCachedPrfResult();
+        async recoverKeyFromCache(input) {
+            const wrappedKeys = prepareRecovery(input);
+            const cached = loadCachedResult();
             if (!cached)
                 return null;
-            const match = wrappedCeks.find((w) => w.credentialId === cached.credentialId);
-            if (!match)
+            const wrapped = wrappedKeys.find((candidate) => candidate.credentialId === cached.credentialId);
+            if (!wrapped)
                 return null;
             try {
-                const kek = await deriveKek(cached.prfOutput);
-                const cek = await unwrapCek(kek, match);
-                return { credentialId: cached.credentialId, cek };
-            }
-            catch (error) {
-                logger.error?.("failed to unwrap CEK with cached PRF output", error, {
-                    action: "unlockWithCachedPrf",
+                return {
                     credentialId: cached.credentialId,
-                });
+                    key: await unwrapKeyWithPRFResult({
+                        wrappedKey: wrapped,
+                        prfResult: { output: cached.prfOutput },
+                    }, "recoverKeyFromCache"),
+                };
+            }
+            catch {
                 return null;
             }
         },
-        async rewrapWithCachedPrf(cek) {
-            const cached = getCachedPrfResult();
+        async rewrapKeyFromCache(input) {
+            if (!input || typeof input !== "object")
+                throw invalidInput("input is required");
+            validateKey(input.key, "rewrapKeyFromCache");
+            const cached = loadCachedResult();
             if (!cached)
                 return null;
-            return wrapWithPrfResult(cached, cek);
-        },
-        wrapWithPrfResult,
-        async unwrapWithPrfResult(prfResult, wrapped) {
-            const kek = await deriveKek(prfResult.prfOutput);
-            return unwrapCek(kek, wrapped);
-        },
-        getCachedPrfResult,
-        clearCachedPrfResult() {
-            storage?.removeItem(storageKeys.prfResult);
-        },
-        getLocalCredentialId() {
-            return storage?.getItem(storageKeys.localCredentialId) ?? null;
+            return wrapKeyWithPRFResult({
+                keyMaterial: input.key,
+                credentialId: cached.credentialId,
+                prfResult: { output: cached.prfOutput },
+            }, "rewrapKeyFromCache");
         },
-        setLocalCredentialId,
         clearLocalState() {
-            storage?.removeItem(storageKeys.prfResult);
-            storage?.removeItem(storageKeys.localCredentialId);
+            try {
+                config.storage?.clear();
+            }
+            catch {
+                // Storage is best-effort.
+            }
+        },
+        cancelActiveCeremony() {
+            const operation = activeCeremony?.operation;
+            activeCeremony?.cancel(new PasskeyKeyError("cancelled", "the passkey operation was cancelled", {
+                operation,
+            }));
         },
     };
 }

package/dist/kit.js.map

@@ -1 +1 @@
-{"version":3,"file":"kit.js","sourceRoot":"","sources":["../src/kit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,sBAAsB,IAAI,gBAAgB,EAC1C,SAAS,EACT,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAuB,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUhD,OAAO,EACL,sBAAsB,EACtB,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AAEvB,MAAM,oBAAoB,GAA0B;IAClD,SAAS,EAAE,mCAAmC;IAC9C,iBAAiB,EAAE,qCAAqC;CACzD,CAAC;AAEF,MAAM,2BAA2B,GAAG,KAAM,CAAC;AAE3C,8DAA8D;AAC9D,8DAA8D;AAC9D,0EAA0E;AAC1E,0EAA0E;AAC1E,yDAAyD;AACzD,MAAM,wBAAwB,GAAG,KAAM,CAAC;AAwExC,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7E,MAAM,WAAW,GAA0B;QACzC,GAAG,oBAAoB;QACvB,GAAG,MAAM,CAAC,WAAW;KACtB,CAAC;IACF,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAC1E,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,MAAM,CAAC,YAAY,IAAI,yBAAyB,CACjD;QACH,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,QAAQ,GACZ,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAEhC,IAAI,eAAe,GAAmB,IAAI,CAAC;IAE3C,SAAS,cAAc,CAAC,MAAwB;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,KAAK,GAAkB;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SAC3D,CAAC;QACF,IAAI,CAAC;YACH,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,SAAS,kBAAkB;QACzB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAC/C,OAAO;gBACL,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAqB;aAChE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,oBAAoB,CAAC,YAAoB;QAChD,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IACtD,kEAAkE;IAClE,+DAA+D;IAC/D,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,+DAA+D;IAC/D,SAAS,WAAW,CAClB,MAAwB,EACxB,UAA+B;QAE/B,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,UAAU,CAAC,uBAAuB,KAAK,UAAU,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,kBAAkB;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAoB;QACvC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO;QACP,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,2BAA2B;QAC1E,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,wBAAwB;QACjE,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,MAAM;QACN,WAAW;KACZ,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,SAAmC,EAAE,EAAE,CACxD,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAExC,KAAK,UAAU,iBAAiB,CAC9B,SAA2B,EAC3B,GAAe;QAEf,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,cAAc;YAClB,IAAI,eAAe,KAAK,IAAI;gBAAE,OAAO,eAAe,CAAC;YACrD,eAAe,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAC3C,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,oBAAoB;YAClB,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,aAAa,CAAC,IAAiB;YAC7B,OAAO,gBAAgB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,aAAuB,EACvB,UAAuC,EAAE;YAEzC,oEAAoE;YACpE,mEAAmE;YACnE,iBAAiB;YACjB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,OAAO,sBAAsB,CAAC,eAAe,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;QAED,SAAS;QAET,KAAK,CAAC,MAAM,CAAC,IAGZ;YACC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAChE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACzE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,WAAyB;YACpC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC5C,eAAe,EACf,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CACvC,CAAC;YACF,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,CACjD,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,EAAE,CACZ,oDAAoD,EACpD,SAAS,EACT,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAC3D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC;QACvD,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,WAAyB;YAEzB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAC9C,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACxC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,CAAC,6CAA6C,EAAE,KAAK,EAAE;oBACnE,MAAM,EAAE,qBAAqB;oBAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,GAAe;YACvC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,iBAAiB;QAEjB,KAAK,CAAC,mBAAmB,CACvB,SAA2B,EAC3B,OAAuD;YAEvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACjD,OAAO,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QAED,kBAAkB;QAElB,oBAAoB;YAClB,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAED,oBAAoB;YAClB,OAAO,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACjE,CAAC;QAED,oBAAoB;QAEpB,eAAe;YACb,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"kit.js","sourceRoot":"","sources":["../src/kit.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAa9D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,eAAe,CAAC;AAEvB,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,cAAc,GAAG,UAAa,CAAC;AAQrC,SAAS,gBAAgB,CAAC,KAAc,EAAE,SAAiB;IACzD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtE,OAAO,IAAI,eAAe,CACxB,WAAW,EACX,kEAAkE,EAClE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjE,OAAO,IAAI,eAAe,CAAC,WAAW,EAAE,qCAAqC,EAAE;YAC7E,KAAK,EAAE,KAAK;YACZ,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,kBAAkB,EAAE,8BAA8B,EAAE;QAC7E,KAAK,EAAE,KAAK;QACZ,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACd,OAAkC,EAClC,gBAAwB,EACxB,SAAiB;IAEjB,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,cAAc;QAC5B,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,SAAS;KACV,CAAC;AACJ,CAAC;AAID,SAAS,QAAQ,CAAC,IAAiB;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC9E,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;QAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,WAAyB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAChD,CAAC;QACD,OAAO;YACL,GAAG,OAAO;YACV,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,4BAA4B,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,IACE,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;QAC3C,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EACpC,CAAC;QACD,MAAM,YAAY,CAAC,6CAA6C,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACjD,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YACjC,MAAM,CAAC,SAAS,GAAG,cAAc;YACjC,MAAM,CAAC,SAAS,GAAG,cAAc,CAAC,EACpC,CAAC;QACD,MAAM,YAAY,CAChB,6BAA6B,cAAc,QAAQ,cAAc,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACzD,IAAI,cAAc,GAA0B,IAAI,CAAC;IAEjD,KAAK,UAAU,WAAW,CACxB,SAAiB,EACjB,YAAqC,EACrC,OAA4D;QAE5D,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACvB,uBAAuB,EACvB,yCAAyC,EACzC,EAAE,SAAS,EAAE,CACd,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,EAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,qCAAqC,EAAE;gBAC5E,KAAK,EAAE,YAAY,CAAC,MAAM;gBAC1B,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,kBAAkE,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,OAAO,CAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/D,kBAAkB,GAAG,MAAM,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,EAAE;YACxC,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC;YAC5B,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,cAAc,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9C,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAC5B,MAAM,CACJ,IAAI,eAAe,CAAC,WAAW,EAAE,qCAAqC,EAAE;YACtE,KAAK,EAAE,YAAY,EAAE,MAAM;YAC3B,SAAS;SACV,CAAC,CACH,CAAC;QACJ,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CACH,MAAM,CACJ,IAAI,eAAe,CAAC,SAAS,EAAE,iCAAiC,EAAE;YAChE,SAAS;SACV,CAAC,CACH,EACH,SAAS,CACV,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,YAAY,EAAE,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAC7D,IAAI,cAAc,EAAE,KAAK,KAAK,KAAK;gBAAE,cAAc,GAAG,IAAI,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,SAAS,0BAA0B,CAAC,MAAyB;QAC3D,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAClC,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC;gBACxC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,gBAAgB;QACvB,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,IAAI,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,aAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,aAAa,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,SAAS,YAAY,UAAU,CAAC;YACzC,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE;YAC9B,OAAO,IAAI,CAAC;QACd,OAAO;YACL,OAAO,EAAE,aAAa;YACtB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,SAAS,yBAAyB;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,oBAAoB,CAC3B,aAAuB,EACvB,qBAA8B;QAE9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,YAAY,CAAC,uCAAuC,CAAC,CAAC;QAC9D,CAAC;QACD,8DAA8D;QAC9D,+DAA+D;QAC/D,8DAA8D;QAC9D,kBAAkB;QAClB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE;YACjE,IAAI,CAAC;gBACH,oBAAoB,CAAC,YAAY,CAAC,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,YAAY,CAAC,6CAA6C,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,IAAI,yBAAyB,EAAE,CAAC;QACvE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,MAAM,CAAC;QAC7D,OAAO,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,SAAS,aAAa,CACpB,SAAiC,EACjC,SAAiB;QAEjB,IACE,CAAC,SAAS;YACV,OAAO,SAAS,KAAK,QAAQ;YAC7B,CAAC,CAAC,SAAS,CAAC,MAAM,YAAY,UAAU,CAAC;YACzC,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAC9B,CAAC;YACD,MAAM,YAAY,CAAC,2CAA2C,EAAE,SAAS,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,KAAgC,EAChC,SAAS,GAAG,sBAAsB;QAElC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;QAC5F,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC1C,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,OAAO,CACZ,OAAO,EACP,KAAK,CAAC,YAAY,EAClB,SAAS,EACT,WAAW,EACX,SAAS,CACV,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,sBAAsB,CACnC,KAAkC,EAClC,SAAS,GAAG,wBAAwB;QAEpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK,CAAC,UAAU;YACnB,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;SAC3D,CAAC;QACF,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,KAA4B;QAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;QACjF,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5E,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CACjF,CAAC;QACF,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAC3C;YACE,WAAW,EAAE,GAAG;YAChB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE;SACxC,EACD,kBAAkB,CACnB,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3D,CAAC;IAED,SAAS,eAAe,CAAC,KAAsB;QAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;QACjF,0DAA0D;QAC1D,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC/C,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACrC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,YAAY,CAAC,gDAAgD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,KAA8B,EAC9B,SAAS,GAAG,oBAAoB;QAEhC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;QACjF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,aAAa,CAAC;QACvD,IAAI,WAAW,KAAK,aAAa,IAAI,WAAW,KAAK,sBAAsB,EAAE,CAAC;YAC5E,MAAM,YAAY,CAAC,yDAAyD,EAAE,SAAS,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,WAAW,KAAK,sBAAsB,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,yEAAyE,EACzE,EAAE,SAAS,EAAE,CACd,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,oBAAoB,CACxC,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,qBAAqB,CAC5B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,qBAAqB,CACnB,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAC7C,aAAa,EACb,MAAM,CACP,CACF,CAAC;QACF,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,IACE,CAAC,KAAK;gBACN,OAAO,KAAK,KAAK,QAAQ;gBACzB,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,EAC/D,CAAC;gBACD,MAAM,YAAY,CAAC,qCAAqC,EAAE,YAAY,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,gBAAgB;QAEhB,kBAAkB,CAAC,KAAK;YACtB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,oBAAoB,CAAC,KAAK;YACxB,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,sBAAsB,CAAC,KAAK;YAC1B,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC;gBACE,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;gBACjE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;gBAClD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,EACD,YAAY,CACb,CAAC;YACF,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAC9D,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,MAAM,YAAY,CAAC,wCAAwC,EAAE,YAAY,CAAC,CAAC;YACzF,OAAO;gBACL,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,EAAE,MAAM,sBAAsB,CAC/B,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EACpD,YAAY,CACb;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAC9D,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO;oBACL,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,GAAG,EAAE,MAAM,sBAAsB,CAC/B;wBACE,UAAU,EAAE,OAAO;wBACnB,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE;qBACxC,EACD,qBAAqB,CACtB;iBACF,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;YACjF,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,oBAAoB,CACzB;gBACE,WAAW,EAAE,KAAK,CAAC,GAAG;gBACtB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE;aACxC,EACD,oBAAoB,CACrB,CAAC;QACJ,CAAC;QAED,eAAe;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QAED,oBAAoB;YAClB,MAAM,SAAS,GAAG,cAAc,EAAE,SAAS,CAAC;YAC5C,cAAc,EAAE,MAAM,CACpB,IAAI,eAAe,CAAC,WAAW,EAAE,qCAAqC,EAAE;gBACtE,SAAS;aACV,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/storage.d.ts

@@ -1,31 +1,17 @@
-/**
- * Pluggable local persistence for the SDK's device-side state: the cached
- * PRF output and the credential id this device owns. Adapters are
- * synchronous by design (mirroring the Web Storage API) so callers can
- * read cached state without awaiting.
- *
- * SECURITY: the PRF output cached through an adapter is raw key material —
- * anyone who can read it can re-derive the KEK and unwrap the CEK. The
- * default `localStorage` adapter stores it in plaintext, which is only as
- * strong as the origin's script-injection defenses (an XSS attacker could
- * equally just run the ceremony or exfiltrate decrypted data). Hosts with
- * stricter requirements should supply their own adapter with at-rest
- * protection, or pass `storage: null` to disable caching and re-prompt
- * biometrics instead.
- */
-export interface StorageAdapter {
-    getItem(key: string): string | null;
-    setItem(key: string, value: string): void;
-    removeItem(key: string): void;
+import type { PasskeyKeyProfile } from "./types.js";
+export interface CachedPRFResult {
+    profile: PasskeyKeyProfile;
+    credentialId: string;
+    prfOutput: Uint8Array;
 }
-/**
- * Default adapter backed by `window.localStorage`. Every operation is
- * best-effort: quota errors, privacy-mode failures, blocked-storage
- * contexts (e.g. sandboxed frames, where even touching `localStorage`
- * throws), and SSR (no window) all degrade to no-ops so storage problems
- * never interrupt a passkey ceremony.
- */
-export declare const browserLocalStorageAdapter: StorageAdapter;
-/** In-memory adapter for tests and non-browser environments. */
-export declare function createMemoryStorageAdapter(): StorageAdapter;
+export interface PasskeyKeyStorage {
+    loadCachedPRFResult(): CachedPRFResult | null;
+    saveCachedPRFResult(result: CachedPRFResult): void;
+    loadLocalCredentialId(): string | null;
+    saveLocalCredentialId(credentialId: string): void;
+    clear(): void;
+}
+export declare function createMemoryPasskeyKeyStorage(): PasskeyKeyStorage;
+/** Stores raw PRF output unencrypted in localStorage under an explicit namespace. */
+export declare function createInsecureBrowserLocalStoragePasskeyKeyStorage(namespace: string): PasskeyKeyStorage;
 //# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,cAyBxC,CAAA;AAED,gEAAgE;AAChE,wBAAgB,0BAA0B,IAAI,cAAc,CAW3D"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,IAAI,eAAe,GAAG,IAAI,CAAC;IAC9C,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IACnD,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAAC;IACvC,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAClD,KAAK,IAAI,IAAI,CAAC;CACf;AAkBD,wBAAgB,6BAA6B,IAAI,iBAAiB,CAqBjE;AAWD,qFAAqF;AACrF,wBAAgB,kDAAkD,CAChE,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAkEnB"}