@tinfoilsh/passkey-kit 0.2.1 → 0.2.2

package/README.md

@@ -88,6 +88,13 @@ insecure because same-origin scripts can read the cached secret material.
 recovery. `wrapKeyWithPRFResult` and `unwrapKeyWithPRFResult` perform explicit
 crypto-only operations without starting a ceremony or accessing storage.
 
+The standalone `wrapKey(profile, credentialId, prfOutput, key)` and
+`unwrapKey(profile, prfOutput, wrappedKey)` functions expose the same
+crypto-only operations without constructing a manager, for migration and
+interoperability tooling that already holds raw PRF output. They apply the
+same validation as the manager methods and treat the PRF output as secret
+key material.
+
 ## Swift quickstart
 
 Add this repository as a Swift Package Manager dependency and link the
@@ -135,6 +142,11 @@ Advanced flows can call `evaluateCredential(credentialIds:interaction:)`.
 Its `prfResult.output` is raw secret key material. Do not log, transmit, or
 retain it longer than necessary.
 
+The standalone `wrapKey(profile:credentialId:prfOutput:key:)` and
+`unwrapKey(profile:prfOutput:wrapped:)` functions expose the same crypto-only
+operations without constructing a manager or providing a presentation anchor,
+for migration and interoperability tooling that already holds raw PRF output.
+
 Apple hosts must pass a `PasskeyPresentationAnchorProviding` implementation to
 the manager as `presentationAnchorProvider`. The provider returns the iOS or
 macOS window AuthenticationServices uses for interactive presentation. Making
@@ -147,7 +159,9 @@ generic Apple adapter that stores cached PRF output with
 `kSecAttrAccessibleWhenUnlockedThisDeviceOnly`. Its records are device-bound and
 unavailable while the device is locked, but any process context that can read
 the item can recover keys without another passkey prompt. Choose storage based
-on the host app's threat model. The host app must also provide the
+on the host app's threat model. Hosts migrating from a pre-kit cache format can
+pass the optional `decodeCachedRecord` hook to decode non-canonical stored
+payloads instead of forking the adapter. The host app must also provide the
 `webcredentials` associated-domain entitlement for its relying-party domain.
 Keychain operations are synchronous and can block the manager's main actor.
 

package/dist/crypto.d.ts

@@ -7,6 +7,20 @@ export declare function validateCredentialId(credentialId: string): void;
 export declare function validateKey(key: Uint8Array, operation?: string): void;
 export declare function validateWrappedKey(wrapped: WrappedKey, profile: PasskeyKeyProfile): void;
 export declare function deriveWrappingKey(prfOutput: Uint8Array, profile: PasskeyKeyProfile): Promise<CryptoKey>;
+/**
+ * Wraps exactly 32 key bytes with a key derived from raw WebAuthn PRF
+ * output, without starting a ceremony or accessing storage. The PRF
+ * output is secret key material: callers must avoid logging,
+ * transmitting, or retaining it longer than necessary. High-level
+ * applications should prefer a manager's `createAndWrapKey`.
+ */
 export declare function wrapKey(profile: PasskeyKeyProfile, credentialId: string, prfOutput: Uint8Array, key: Uint8Array, operation?: string): Promise<WrappedKey>;
+/**
+ * Unwraps a `WrappedKey` with a key derived from raw WebAuthn PRF
+ * output, without starting a ceremony or accessing storage. The PRF
+ * output is secret key material: callers must avoid logging,
+ * transmitting, or retaining it longer than necessary. High-level
+ * applications should prefer a manager's `recoverKey`.
+ */
 export declare function unwrapKey(profile: PasskeyKeyProfile, prfOutput: Uint8Array, wrapped: WrappedKey, operation?: string): Promise<Uint8Array>;
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMhE,eAAO,MAAM,YAAY,+DAKf,CAAC;AAQX,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CAqBpF;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAST;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAmBlF;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAmBxF;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,SAAS,CAAC,CAwBpB;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,iBAAiB,EAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,EACf,SAAS,SAAqB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED,wBAAsB,SAAS,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,SAAe,GACvB,OAAO,CAAC,UAAU,CAAC,CAgBrB"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMhE,eAAO,MAAM,YAAY,+DAKf,CAAC;AAQX,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CAqBpF;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAST;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAmBlF;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAmBxF;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,SAAS,CAAC,CAwBpB;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,iBAAiB,EAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,EACf,SAAS,SAAY,GACpB,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,SAAc,GACtB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}

package/dist/crypto.js

@@ -116,15 +116,23 @@ export async function deriveWrappingKey(prfOutput, profile) {
         throw operationFailed("failed to derive wrapping key", cause);
     }
 }
-export async function wrapKey(profile, credentialId, prfOutput, key, operation = "createAndWrapKey") {
+/**
+ * Wraps exactly 32 key bytes with a key derived from raw WebAuthn PRF
+ * output, without starting a ceremony or accessing storage. The PRF
+ * output is secret key material: callers must avoid logging,
+ * transmitting, or retaining it longer than necessary. High-level
+ * applications should prefer a manager's `createAndWrapKey`.
+ */
+export async function wrapKey(profile, credentialId, prfOutput, key, operation = "wrapKey") {
+    const validatedProfile = copyAndValidateProfile(profile);
     validateCredentialId(credentialId);
     validateKey(key, operation);
     try {
-        const wrappingKey = await deriveWrappingKey(prfOutput, profile);
+        const wrappingKey = await deriveWrappingKey(prfOutput, validatedProfile);
         const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
         const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, wrappingKey, key);
         return {
-            profile: copyAndValidateProfile(profile),
+            profile: validatedProfile,
             credentialId,
             kekIvHex: bytesToHex(iv),
             wrappedKeyHex: bytesToHex(new Uint8Array(ciphertext)),
@@ -136,10 +144,18 @@ export async function wrapKey(profile, credentialId, prfOutput, key, operation =
         throw operationFailed("failed to wrap key", cause, operation);
     }
 }
-export async function unwrapKey(profile, prfOutput, wrapped, operation = "recoverKey") {
-    validateWrappedKey(wrapped, profile);
+/**
+ * Unwraps a `WrappedKey` with a key derived from raw WebAuthn PRF
+ * output, without starting a ceremony or accessing storage. The PRF
+ * output is secret key material: callers must avoid logging,
+ * transmitting, or retaining it longer than necessary. High-level
+ * applications should prefer a manager's `recoverKey`.
+ */
+export async function unwrapKey(profile, prfOutput, wrapped, operation = "unwrapKey") {
+    const validatedProfile = copyAndValidateProfile(profile);
+    validateWrappedKey(wrapped, validatedProfile);
     try {
-        const wrappingKey = await deriveWrappingKey(prfOutput, profile);
+        const wrappingKey = await deriveWrappingKey(prfOutput, validatedProfile);
         const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: hexToBytes(wrapped.kekIvHex) }, wrappingKey, hexToBytes(wrapped.wrappedKeyHex));
         const key = new Uint8Array(plaintext);
         validateKey(key, operation);

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG7E,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,UAAU;CACF,CAAC;AAEX,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY,EAAE,UAAU,GAAG,KAAK;IACnE,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,YAAY,CAAC,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,YAAY,CAAC,gCAAgC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtF,MAAM,YAAY,CAAC,mDAAmD,CAAC,CAAC;IAC1E,CAAC;IACD,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAChD,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAuB,EACvB,KAAwB;IAExB,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;QAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,KAAa;IACpE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/B,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EACtB,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC5D,MAAM,YAAY,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,YAAY,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,wBAAwB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,SAAkB;IAC7D,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,YAAY,CAAC,uBAAuB,SAAS,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAmB,EAAE,OAA0B;IAChF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,yBAAyB,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACrD,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,gDAAgD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,mBAAmB,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,mBAAmB,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClF,MAAM,YAAY,CAAC,+CAA+C,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAqB,EACrB,OAA0B;IAE1B,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChF,MAAM,YAAY,CAAC,8BAA8B,gBAAgB,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YACjF,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,UAAU,EAAkB;YACtC,IAAI,EAAE,OAAO,CAAC,QAAwB;SACvC,EACD,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAA0B,EAC1B,YAAoB,EACpB,SAAqB,EACrB,GAAe,EACf,SAAS,GAAG,kBAAkB;IAE9B,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,EAC3C,WAAW,EACX,GAAmB,CACpB,CAAC;QACF,OAAO;YACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC;YACxC,YAAY;YACZ,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACxB,aAAa,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SACtD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA0B,EAC1B,SAAqB,EACrB,OAAmB,EACnB,SAAS,GAAG,YAAY;IAExB,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAiB,EAAE,EACrE,WAAW,EACX,UAAU,CAAC,OAAO,CAAC,aAAa,CAAiB,CAClD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACtC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,uBAAuB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG7E,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,UAAU;CACF,CAAC;AAEX,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY,EAAE,UAAU,GAAG,KAAK;IACnE,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,YAAY,CAAC,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,YAAY,CAAC,gCAAgC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtF,MAAM,YAAY,CAAC,mDAAmD,CAAC,CAAC;IAC1E,CAAC;IACD,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAChD,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAuB,EACvB,KAAwB;IAExB,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;QAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,KAAa;IACpE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/B,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EACtB,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC5D,MAAM,YAAY,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,YAAY,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,wBAAwB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,SAAkB;IAC7D,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,YAAY,CAAC,uBAAuB,SAAS,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAmB,EAAE,OAA0B;IAChF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,yBAAyB,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACrD,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,gDAAgD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,mBAAmB,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,mBAAmB,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClF,MAAM,YAAY,CAAC,+CAA+C,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAqB,EACrB,OAA0B;IAE1B,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChF,MAAM,YAAY,CAAC,8BAA8B,gBAAgB,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YACjF,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,UAAU,EAAkB;YACtC,IAAI,EAAE,OAAO,CAAC,QAAwB;SACvC,EACD,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAA0B,EAC1B,YAAoB,EACpB,SAAqB,EACrB,GAAe,EACf,SAAS,GAAG,SAAS;IAErB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzD,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,EAC3C,WAAW,EACX,GAAmB,CACpB,CAAC;QACF,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,YAAY;YACZ,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACxB,aAAa,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SACtD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA0B,EAC1B,SAAqB,EACrB,OAAmB,EACnB,SAAS,GAAG,WAAW;IAEvB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzD,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAiB,EAAE,EACrE,WAAW,EACX,UAAU,CAAC,OAAO,CAAC,aAAa,CAAiB,CAClD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACtC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,uBAAuB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { PasskeyKeyError } from "./errors.js";
 export type { PasskeyKeyErrorCategory } from "./errors.js";
 export { createPasskeyKeyManager } from "./kit.js";
+export { unwrapKey, wrapKey } from "./crypto.js";
 export { decodeWrappedKeyRecord, encodeWrappedKeyRecord, } from "./wrapped-key-record-codec.js";
 export { createInsecureBrowserLocalStoragePasskeyKeyStorage, createMemoryPasskeyKeyStorage, } from "./storage.js";
 export type { CachedPRFResult, PasskeyKeyStorage } from "./storage.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kDAAkD,EAClD,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,eAAe,EACf,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,gBAAgB,GACjB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kDAAkD,EAClD,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,eAAe,EACf,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,gBAAgB,GACjB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 export { PasskeyKeyError } from "./errors.js";
 export { createPasskeyKeyManager } from "./kit.js";
+export { unwrapKey, wrapKey } from "./crypto.js";
 export { decodeWrappedKeyRecord, encodeWrappedKeyRecord, } from "./wrapped-key-record-codec.js";
 export { createInsecureBrowserLocalStoragePasskeyKeyStorage, createMemoryPasskeyKeyStorage, } from "./storage.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kDAAkD,EAClD,6BAA6B,GAC9B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kDAAkD,EAClD,6BAA6B,GAC9B,MAAM,cAAc,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinfoilsh/passkey-kit",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "WebAuthn PRF passkey SDK for protecting encryption keys with passkey-derived keys.",
   "license": "Apache-2.0",
   "type": "module",

package/src/crypto.ts

@@ -142,17 +142,25 @@ export async function deriveWrappingKey(
   }
 }
 
+/**
+ * Wraps exactly 32 key bytes with a key derived from raw WebAuthn PRF
+ * output, without starting a ceremony or accessing storage. The PRF
+ * output is secret key material: callers must avoid logging,
+ * transmitting, or retaining it longer than necessary. High-level
+ * applications should prefer a manager's `createAndWrapKey`.
+ */
 export async function wrapKey(
   profile: PasskeyKeyProfile,
   credentialId: string,
   prfOutput: Uint8Array,
   key: Uint8Array,
-  operation = "createAndWrapKey",
+  operation = "wrapKey",
 ): Promise<WrappedKey> {
+  const validatedProfile = copyAndValidateProfile(profile);
   validateCredentialId(credentialId);
   validateKey(key, operation);
   try {
-    const wrappingKey = await deriveWrappingKey(prfOutput, profile);
+    const wrappingKey = await deriveWrappingKey(prfOutput, validatedProfile);
     const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
     const ciphertext = await crypto.subtle.encrypt(
       { name: "AES-GCM", iv: iv as BufferSource },
@@ -160,7 +168,7 @@ export async function wrapKey(
       key as BufferSource,
     );
     return {
-      profile: copyAndValidateProfile(profile),
+      profile: validatedProfile,
       credentialId,
       kekIvHex: bytesToHex(iv),
       wrappedKeyHex: bytesToHex(new Uint8Array(ciphertext)),
@@ -171,15 +179,23 @@ export async function wrapKey(
   }
 }
 
+/**
+ * Unwraps a `WrappedKey` with a key derived from raw WebAuthn PRF
+ * output, without starting a ceremony or accessing storage. The PRF
+ * output is secret key material: callers must avoid logging,
+ * transmitting, or retaining it longer than necessary. High-level
+ * applications should prefer a manager's `recoverKey`.
+ */
 export async function unwrapKey(
   profile: PasskeyKeyProfile,
   prfOutput: Uint8Array,
   wrapped: WrappedKey,
-  operation = "recoverKey",
+  operation = "unwrapKey",
 ): Promise<Uint8Array> {
-  validateWrappedKey(wrapped, profile);
+  const validatedProfile = copyAndValidateProfile(profile);
+  validateWrappedKey(wrapped, validatedProfile);
   try {
-    const wrappingKey = await deriveWrappingKey(prfOutput, profile);
+    const wrappingKey = await deriveWrappingKey(prfOutput, validatedProfile);
     const plaintext = await crypto.subtle.decrypt(
       { name: "AES-GCM", iv: hexToBytes(wrapped.kekIvHex) as BufferSource },
       wrappingKey,

package/src/index.ts

@@ -1,6 +1,7 @@
 export { PasskeyKeyError } from "./errors.js";
 export type { PasskeyKeyErrorCategory } from "./errors.js";
 export { createPasskeyKeyManager } from "./kit.js";
+export { unwrapKey, wrapKey } from "./crypto.js";
 export {
   decodeWrappedKeyRecord,
   encodeWrappedKeyRecord,