@tinfoilsh/passkey-kit 0.2.1 → 0.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +15 -1
  2. package/dist/crypto.d.ts +14 -0
  3. package/dist/crypto.d.ts.map +1 -1
  4. package/dist/crypto.js +22 -6
  5. package/dist/crypto.js.map +1 -1
  6. package/dist/index.d.ts +1 -0
  7. package/dist/index.d.ts.map +1 -1
  8. package/dist/index.js +1 -0
  9. package/dist/index.js.map +1 -1
  10. package/dist/webauthn.d.ts.map +1 -1
  11. package/dist/webauthn.js +27 -2
  12. package/dist/webauthn.js.map +1 -1
  13. package/package.json +1 -1
  14. package/src/crypto.ts +22 -6
  15. package/src/index.ts +1 -0
  16. package/src/webauthn.ts +28 -3
package/README.md CHANGED
@@ -88,6 +88,13 @@ insecure because same-origin scripts can read the cached secret material.
88
88
  recovery. `wrapKeyWithPRFResult` and `unwrapKeyWithPRFResult` perform explicit
89
89
  crypto-only operations without starting a ceremony or accessing storage.
90
90
 
91
+ The standalone `wrapKey(profile, credentialId, prfOutput, key)` and
92
+ `unwrapKey(profile, prfOutput, wrappedKey)` functions expose the same
93
+ crypto-only operations without constructing a manager, for migration and
94
+ interoperability tooling that already holds raw PRF output. They apply the
95
+ same validation as the manager methods and treat the PRF output as secret
96
+ key material.
97
+
91
98
  ## Swift quickstart
92
99
 
93
100
  Add this repository as a Swift Package Manager dependency and link the
@@ -135,6 +142,11 @@ Advanced flows can call `evaluateCredential(credentialIds:interaction:)`.
135
142
  Its `prfResult.output` is raw secret key material. Do not log, transmit, or
136
143
  retain it longer than necessary.
137
144
 
145
+ The standalone `wrapKey(profile:credentialId:prfOutput:key:)` and
146
+ `unwrapKey(profile:prfOutput:wrapped:)` functions expose the same crypto-only
147
+ operations without constructing a manager or providing a presentation anchor,
148
+ for migration and interoperability tooling that already holds raw PRF output.
149
+
138
150
  Apple hosts must pass a `PasskeyPresentationAnchorProviding` implementation to
139
151
  the manager as `presentationAnchorProvider`. The provider returns the iOS or
140
152
  macOS window AuthenticationServices uses for interactive presentation. Making
@@ -147,7 +159,9 @@ generic Apple adapter that stores cached PRF output with
147
159
  `kSecAttrAccessibleWhenUnlockedThisDeviceOnly`. Its records are device-bound and
148
160
  unavailable while the device is locked, but any process context that can read
149
161
  the item can recover keys without another passkey prompt. Choose storage based
150
- on the host app's threat model. The host app must also provide the
162
+ on the host app's threat model. Hosts migrating from a pre-kit cache format can
163
+ pass the optional `decodeCachedRecord` hook to decode non-canonical stored
164
+ payloads instead of forking the adapter. The host app must also provide the
151
165
  `webcredentials` associated-domain entitlement for its relying-party domain.
152
166
  Keychain operations are synchronous and can block the manager's main actor.
153
167
 
package/dist/crypto.d.ts CHANGED
@@ -7,6 +7,20 @@ export declare function validateCredentialId(credentialId: string): void;
7
7
  export declare function validateKey(key: Uint8Array, operation?: string): void;
8
8
  export declare function validateWrappedKey(wrapped: WrappedKey, profile: PasskeyKeyProfile): void;
9
9
  export declare function deriveWrappingKey(prfOutput: Uint8Array, profile: PasskeyKeyProfile): Promise<CryptoKey>;
10
+ /**
11
+ * Wraps exactly 32 key bytes with a key derived from raw WebAuthn PRF
12
+ * output, without starting a ceremony or accessing storage. The PRF
13
+ * output is secret key material: callers must avoid logging,
14
+ * transmitting, or retaining it longer than necessary. High-level
15
+ * applications should prefer a manager's `createAndWrapKey`.
16
+ */
10
17
  export declare function wrapKey(profile: PasskeyKeyProfile, credentialId: string, prfOutput: Uint8Array, key: Uint8Array, operation?: string): Promise<WrappedKey>;
18
+ /**
19
+ * Unwraps a `WrappedKey` with a key derived from raw WebAuthn PRF
20
+ * output, without starting a ceremony or accessing storage. The PRF
21
+ * output is secret key material: callers must avoid logging,
22
+ * transmitting, or retaining it longer than necessary. High-level
23
+ * applications should prefer a manager's `recoverKey`.
24
+ */
11
25
  export declare function unwrapKey(profile: PasskeyKeyProfile, prfOutput: Uint8Array, wrapped: WrappedKey, operation?: string): Promise<Uint8Array>;
12
26
  //# sourceMappingURL=crypto.d.ts.map
package/dist/crypto.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMhE,eAAO,MAAM,YAAY,+DAKf,CAAC;AAQX,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CAqBpF;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAST;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAmBlF;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAmBxF;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,SAAS,CAAC,CAwBpB;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,iBAAiB,EAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,EACf,SAAS,SAAqB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED,wBAAsB,SAAS,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,SAAe,GACvB,OAAO,CAAC,UAAU,CAAC,CAgBrB"}
1
+ {"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMhE,eAAO,MAAM,YAAY,+DAKf,CAAC;AAQX,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CAqBpF;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAST;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAmBlF;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAmBxF;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,SAAS,CAAC,CAwBpB;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,iBAAiB,EAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,EACf,SAAS,SAAY,GACpB,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,SAAc,GACtB,OAAO,CAAC,UAAU,CAAC,CAiBrB"}
package/dist/crypto.js CHANGED
@@ -116,15 +116,23 @@ export async function deriveWrappingKey(prfOutput, profile) {
116
116
  throw operationFailed("failed to derive wrapping key", cause);
117
117
  }
118
118
  }
119
- export async function wrapKey(profile, credentialId, prfOutput, key, operation = "createAndWrapKey") {
119
+ /**
120
+ * Wraps exactly 32 key bytes with a key derived from raw WebAuthn PRF
121
+ * output, without starting a ceremony or accessing storage. The PRF
122
+ * output is secret key material: callers must avoid logging,
123
+ * transmitting, or retaining it longer than necessary. High-level
124
+ * applications should prefer a manager's `createAndWrapKey`.
125
+ */
126
+ export async function wrapKey(profile, credentialId, prfOutput, key, operation = "wrapKey") {
127
+ const validatedProfile = copyAndValidateProfile(profile);
120
128
  validateCredentialId(credentialId);
121
129
  validateKey(key, operation);
122
130
  try {
123
- const wrappingKey = await deriveWrappingKey(prfOutput, profile);
131
+ const wrappingKey = await deriveWrappingKey(prfOutput, validatedProfile);
124
132
  const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
125
133
  const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, wrappingKey, key);
126
134
  return {
127
- profile: copyAndValidateProfile(profile),
135
+ profile: validatedProfile,
128
136
  credentialId,
129
137
  kekIvHex: bytesToHex(iv),
130
138
  wrappedKeyHex: bytesToHex(new Uint8Array(ciphertext)),
@@ -136,10 +144,18 @@ export async function wrapKey(profile, credentialId, prfOutput, key, operation =
136
144
  throw operationFailed("failed to wrap key", cause, operation);
137
145
  }
138
146
  }
139
- export async function unwrapKey(profile, prfOutput, wrapped, operation = "recoverKey") {
140
- validateWrappedKey(wrapped, profile);
147
+ /**
148
+ * Unwraps a `WrappedKey` with a key derived from raw WebAuthn PRF
149
+ * output, without starting a ceremony or accessing storage. The PRF
150
+ * output is secret key material: callers must avoid logging,
151
+ * transmitting, or retaining it longer than necessary. High-level
152
+ * applications should prefer a manager's `recoverKey`.
153
+ */
154
+ export async function unwrapKey(profile, prfOutput, wrapped, operation = "unwrapKey") {
155
+ const validatedProfile = copyAndValidateProfile(profile);
156
+ validateWrappedKey(wrapped, validatedProfile);
141
157
  try {
142
- const wrappingKey = await deriveWrappingKey(prfOutput, profile);
158
+ const wrappingKey = await deriveWrappingKey(prfOutput, validatedProfile);
143
159
  const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: hexToBytes(wrapped.kekIvHex) }, wrappingKey, hexToBytes(wrapped.wrappedKeyHex));
144
160
  const key = new Uint8Array(plaintext);
145
161
  validateKey(key, operation);
package/dist/crypto.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG7E,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,UAAU;CACF,CAAC;AAEX,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY,EAAE,UAAU,GAAG,KAAK;IACnE,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,YAAY,CAAC,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,YAAY,CAAC,gCAAgC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtF,MAAM,YAAY,CAAC,mDAAmD,CAAC,CAAC;IAC1E,CAAC;IACD,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAChD,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAuB,EACvB,KAAwB;IAExB,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;QAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,KAAa;IACpE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/B,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EACtB,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC5D,MAAM,YAAY,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,YAAY,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,wBAAwB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,SAAkB;IAC7D,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,YAAY,CAAC,uBAAuB,SAAS,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAmB,EAAE,OAA0B;IAChF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,yBAAyB,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACrD,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,gDAAgD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,mBAAmB,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,mBAAmB,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClF,MAAM,YAAY,CAAC,+CAA+C,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAqB,EACrB,OAA0B;IAE1B,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChF,MAAM,YAAY,CAAC,8BAA8B,gBAAgB,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YACjF,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,UAAU,EAAkB;YACtC,IAAI,EAAE,OAAO,CAAC,QAAwB;SACvC,EACD,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAA0B,EAC1B,YAAoB,EACpB,SAAqB,EACrB,GAAe,EACf,SAAS,GAAG,kBAAkB;IAE9B,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,EAC3C,WAAW,EACX,GAAmB,CACpB,CAAC;QACF,OAAO;YACL,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC;YACxC,YAAY;YACZ,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACxB,aAAa,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SACtD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA0B,EAC1B,SAAqB,EACrB,OAAmB,EACnB,SAAS,GAAG,YAAY;IAExB,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAiB,EAAE,EACrE,WAAW,EACX,UAAU,CAAC,OAAO,CAAC,aAAa,CAAiB,CAClD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACtC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,uBAAuB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG7E,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,UAAU;CACF,CAAC;AAEX,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY,EAAE,UAAU,GAAG,KAAK;IACnE,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,YAAY,CAAC,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,YAAY,CAAC,gCAAgC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtF,MAAM,YAAY,CAAC,mDAAmD,CAAC,CAAC;IAC1E,CAAC;IACD,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAChD,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAuB,EACvB,KAAwB;IAExB,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;QAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,KAAa;IACpE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/B,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EACtB,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC5D,MAAM,YAAY,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,YAAY,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,wBAAwB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,SAAkB;IAC7D,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,YAAY,CAAC,uBAAuB,SAAS,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAmB,EAAE,OAA0B;IAChF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,yBAAyB,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACrD,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,gDAAgD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,mBAAmB,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,mBAAmB,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClF,MAAM,YAAY,CAAC,+CAA+C,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAqB,EACrB,OAA0B;IAE1B,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChF,MAAM,YAAY,CAAC,8BAA8B,gBAAgB,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YACjF,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,UAAU,EAAkB;YACtC,IAAI,EAAE,OAAO,CAAC,QAAwB;SACvC,EACD,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAA0B,EAC1B,YAAoB,EACpB,SAAqB,EACrB,GAAe,EACf,SAAS,GAAG,SAAS;IAErB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzD,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,EAC3C,WAAW,EACX,GAAmB,CACpB,CAAC;QACF,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,YAAY;YACZ,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACxB,aAAa,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SACtD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA0B,EAC1B,SAAqB,EACrB,OAAmB,EACnB,SAAS,GAAG,WAAW;IAEvB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzD,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAiB,EAAE,EACrE,WAAW,EACX,UAAU,CAAC,OAAO,CAAC,aAAa,CAAiB,CAClD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACtC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,eAAe,CAAC,uBAAuB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}
package/dist/index.d.ts CHANGED
@@ -1,6 +1,7 @@
1
1
  export { PasskeyKeyError } from "./errors.js";
2
2
  export type { PasskeyKeyErrorCategory } from "./errors.js";
3
3
  export { createPasskeyKeyManager } from "./kit.js";
4
+ export { unwrapKey, wrapKey } from "./crypto.js";
4
5
  export { decodeWrappedKeyRecord, encodeWrappedKeyRecord, } from "./wrapped-key-record-codec.js";
5
6
  export { createInsecureBrowserLocalStoragePasskeyKeyStorage, createMemoryPasskeyKeyStorage, } from "./storage.js";
6
7
  export type { CachedPRFResult, PasskeyKeyStorage } from "./storage.js";
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kDAAkD,EAClD,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,eAAe,EACf,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,gBAAgB,GACjB,MAAM,YAAY,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kDAAkD,EAClD,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,eAAe,EACf,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,gBAAgB,GACjB,MAAM,YAAY,CAAC"}
package/dist/index.js CHANGED
@@ -1,5 +1,6 @@
1
1
  export { PasskeyKeyError } from "./errors.js";
2
2
  export { createPasskeyKeyManager } from "./kit.js";
3
+ export { unwrapKey, wrapKey } from "./crypto.js";
3
4
  export { decodeWrappedKeyRecord, encodeWrappedKeyRecord, } from "./wrapped-key-record-codec.js";
4
5
  export { createInsecureBrowserLocalStoragePasskeyKeyStorage, createMemoryPasskeyKeyStorage, } from "./storage.js";
5
6
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kDAAkD,EAClD,6BAA6B,GAC9B,MAAM,cAAc,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kDAAkD,EAClD,6BAA6B,GAC9B,MAAM,cAAc,CAAC"}
package/dist/webauthn.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,UAAU,CAAC;IACtB,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAmCD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAqD5B;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,eAAe,EACxB,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAwB5B"}
1
+ {"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAO9C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,UAAU,CAAC;IACtB,uBAAuB,EAAE,OAAO,CAAC;CAClC;AA2DD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAqD5B;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,eAAe,EACxB,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAwB5B"}
package/dist/webauthn.js CHANGED
@@ -1,8 +1,9 @@
1
- import { base64UrlToBytes, bufferSourceToArrayBuffer, bytesToBase64Url } from "./codec.js";
1
+ import { base64UrlToBytes, bytesToBase64Url } from "./codec.js";
2
2
  import { invalidInput, PasskeyKeyError } from "./errors.js";
3
3
  const CHALLENGE_BYTES = 32;
4
4
  const MAX_USER_HANDLE_BYTES = 64;
5
5
  const PRF_OUTPUT_BYTES = 32;
6
+ const MAX_BYTE_VALUE = 255;
6
7
  function extensionResults(credential) {
7
8
  return credential.getClientExtensionResults();
8
9
  }
@@ -17,7 +18,31 @@ function resultFromCredential(credential) {
17
18
  if (!first) {
18
19
  throw new PasskeyKeyError("unsupported", "the authenticator returned no PRF output");
19
20
  }
20
- const prfOutput = new Uint8Array(bufferSourceToArrayBuffer(first));
21
+ let prfOutput;
22
+ if (Array.isArray(first)) {
23
+ // 1Password's browser extension can return a plain array instead of BufferSource.
24
+ if (first.length !== PRF_OUTPUT_BYTES) {
25
+ throw invalidInput(`PRF output must be ${PRF_OUTPUT_BYTES} bytes`);
26
+ }
27
+ prfOutput = new Uint8Array(PRF_OUTPUT_BYTES);
28
+ for (let index = 0; index < PRF_OUTPUT_BYTES; index++) {
29
+ const byte = first[index];
30
+ if (!Object.prototype.hasOwnProperty.call(first, index) ||
31
+ !Number.isInteger(byte) || byte < 0 || byte > MAX_BYTE_VALUE) {
32
+ throw invalidInput("PRF output must contain only integer bytes");
33
+ }
34
+ prfOutput[index] = byte;
35
+ }
36
+ }
37
+ else if (first instanceof ArrayBuffer || ArrayBuffer.isView(first)) {
38
+ const bytes = first instanceof ArrayBuffer
39
+ ? new Uint8Array(first)
40
+ : new Uint8Array(first.buffer, first.byteOffset, first.byteLength);
41
+ prfOutput = bytes.slice();
42
+ }
43
+ else {
44
+ throw invalidInput("PRF output must be a buffer or byte array");
45
+ }
21
46
  if (prfOutput.length !== PRF_OUTPUT_BYTES) {
22
47
  throw invalidInput(`PRF output must be ${PRF_OUTPUT_BYTES} bytes`);
23
48
  }
package/dist/webauthn.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG5D,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAsB5B,SAAS,gBAAgB,CAAC,UAA+B;IACvD,OAAO,UAAU,CAAC,yBAAyB,EAAyB,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,UAA+B;IACnD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,YAAY,CAAC,iCAAiC,CAAC,CAAC;IAC9E,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,UAA+B;IAC3D,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,0CAA0C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,YAAY,CAAC,sBAAsB,gBAAgB,QAAQ,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,YAAY,CAAC,UAAU,CAAC;QACtC,SAAS;QACT,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,KAAK,UAAU;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAwB,EACxB,IAAiB,EACjB,MAAmB;IAEnB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,YAAY,CAAC,wCAAwC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC3C,MAAM,YAAY,CAAC,2BAA2B,qBAAqB,QAAQ,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClG,MAAM,YAAY,CAAC,6CAA6C,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;QACrD,MAAM;QACN,SAAS,EAAE;YACT,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;YAC9C,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;aAC3C;YACD,gBAAgB,EAAE;gBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;gBAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;aAClC;YACD,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,UAAU;gBACnC,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,UAAU;aAC7B;YACD,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE;aACX;SAC1C;KACF,CAAC,CAA+B,CAAC;IAElC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEtE,OAAO,qBAAqB,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAwB,EACxB,aAAuB,EACvB,MAAmB;IAEnB,MAAM,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;QACjD,MAAM;QACN,SAAS,EAAE;YACT,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,gBAAgB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;gBACrD,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,gBAAgB,CAAC,YAAY,CAAiB;aACnD,CAAC,CAAC;YACH,gBAAgB,EAAE,UAAU;YAC5B,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE;aACX;SAC1C;KACF,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC"}
1
+ {"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG5D,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,cAAc,GAAG,GAAG,CAAC;AAsB3B,SAAS,gBAAgB,CAAC,UAA+B;IACvD,OAAO,UAAU,CAAC,yBAAyB,EAAyB,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,UAA+B;IACnD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,YAAY,CAAC,iCAAiC,CAAC,CAAC;IAC9E,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,UAA+B;IAC3D,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,0CAA0C,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,SAAqB,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,kFAAkF;QAClF,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACtC,MAAM,YAAY,CAAC,sBAAsB,gBAAgB,QAAQ,CAAC,CAAC;QACrE,CAAC;QACD,SAAS,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gBAAgB,EAAE,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;gBACnD,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,cAAc,EAC5D,CAAC;gBACD,MAAM,YAAY,CAAC,4CAA4C,CAAC,CAAC;YACnE,CAAC;YACD,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,YAAY,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,KAAK,YAAY,WAAW;YACxC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACrE,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,CAAC,2CAA2C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,YAAY,CAAC,sBAAsB,gBAAgB,QAAQ,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,YAAY,CAAC,UAAU,CAAC;QACtC,SAAS;QACT,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,KAAK,UAAU;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAwB,EACxB,IAAiB,EACjB,MAAmB;IAEnB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,YAAY,CAAC,wCAAwC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC3C,MAAM,YAAY,CAAC,2BAA2B,qBAAqB,QAAQ,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClG,MAAM,YAAY,CAAC,6CAA6C,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;QACrD,MAAM;QACN,SAAS,EAAE;YACT,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;YAC9C,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;aAC3C;YACD,gBAAgB,EAAE;gBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;gBAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;aAClC;YACD,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,UAAU;gBACnC,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,UAAU;aAC7B;YACD,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE;aACX;SAC1C;KACF,CAAC,CAA+B,CAAC;IAElC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEtE,OAAO,qBAAqB,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAwB,EACxB,aAAuB,EACvB,MAAmB;IAEnB,MAAM,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;QACjD,MAAM;QACN,SAAS,EAAE;YACT,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,gBAAgB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;gBACrD,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,gBAAgB,CAAC,YAAY,CAAiB;aACnD,CAAC,CAAC;YACH,gBAAgB,EAAE,UAAU;YAC5B,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE;aACX;SAC1C;KACF,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@tinfoilsh/passkey-kit",
3
- "version": "0.2.1",
3
+ "version": "0.2.3",
4
4
  "description": "WebAuthn PRF passkey SDK for protecting encryption keys with passkey-derived keys.",
5
5
  "license": "Apache-2.0",
6
6
  "type": "module",
package/src/crypto.ts CHANGED
@@ -142,17 +142,25 @@ export async function deriveWrappingKey(
142
142
  }
143
143
  }
144
144
 
145
+ /**
146
+ * Wraps exactly 32 key bytes with a key derived from raw WebAuthn PRF
147
+ * output, without starting a ceremony or accessing storage. The PRF
148
+ * output is secret key material: callers must avoid logging,
149
+ * transmitting, or retaining it longer than necessary. High-level
150
+ * applications should prefer a manager's `createAndWrapKey`.
151
+ */
145
152
  export async function wrapKey(
146
153
  profile: PasskeyKeyProfile,
147
154
  credentialId: string,
148
155
  prfOutput: Uint8Array,
149
156
  key: Uint8Array,
150
- operation = "createAndWrapKey",
157
+ operation = "wrapKey",
151
158
  ): Promise<WrappedKey> {
159
+ const validatedProfile = copyAndValidateProfile(profile);
152
160
  validateCredentialId(credentialId);
153
161
  validateKey(key, operation);
154
162
  try {
155
- const wrappingKey = await deriveWrappingKey(prfOutput, profile);
163
+ const wrappingKey = await deriveWrappingKey(prfOutput, validatedProfile);
156
164
  const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
157
165
  const ciphertext = await crypto.subtle.encrypt(
158
166
  { name: "AES-GCM", iv: iv as BufferSource },
@@ -160,7 +168,7 @@ export async function wrapKey(
160
168
  key as BufferSource,
161
169
  );
162
170
  return {
163
- profile: copyAndValidateProfile(profile),
171
+ profile: validatedProfile,
164
172
  credentialId,
165
173
  kekIvHex: bytesToHex(iv),
166
174
  wrappedKeyHex: bytesToHex(new Uint8Array(ciphertext)),
@@ -171,15 +179,23 @@ export async function wrapKey(
171
179
  }
172
180
  }
173
181
 
182
+ /**
183
+ * Unwraps a `WrappedKey` with a key derived from raw WebAuthn PRF
184
+ * output, without starting a ceremony or accessing storage. The PRF
185
+ * output is secret key material: callers must avoid logging,
186
+ * transmitting, or retaining it longer than necessary. High-level
187
+ * applications should prefer a manager's `recoverKey`.
188
+ */
174
189
  export async function unwrapKey(
175
190
  profile: PasskeyKeyProfile,
176
191
  prfOutput: Uint8Array,
177
192
  wrapped: WrappedKey,
178
- operation = "recoverKey",
193
+ operation = "unwrapKey",
179
194
  ): Promise<Uint8Array> {
180
- validateWrappedKey(wrapped, profile);
195
+ const validatedProfile = copyAndValidateProfile(profile);
196
+ validateWrappedKey(wrapped, validatedProfile);
181
197
  try {
182
- const wrappingKey = await deriveWrappingKey(prfOutput, profile);
198
+ const wrappingKey = await deriveWrappingKey(prfOutput, validatedProfile);
183
199
  const plaintext = await crypto.subtle.decrypt(
184
200
  { name: "AES-GCM", iv: hexToBytes(wrapped.kekIvHex) as BufferSource },
185
201
  wrappingKey,
package/src/index.ts CHANGED
@@ -1,6 +1,7 @@
1
1
  export { PasskeyKeyError } from "./errors.js";
2
2
  export type { PasskeyKeyErrorCategory } from "./errors.js";
3
3
  export { createPasskeyKeyManager } from "./kit.js";
4
+ export { unwrapKey, wrapKey } from "./crypto.js";
4
5
  export {
5
6
  decodeWrappedKeyRecord,
6
7
  encodeWrappedKeyRecord,
package/src/webauthn.ts CHANGED
@@ -1,10 +1,11 @@
1
- import { base64UrlToBytes, bufferSourceToArrayBuffer, bytesToBase64Url } from "./codec.js";
1
+ import { base64UrlToBytes, bytesToBase64Url } from "./codec.js";
2
2
  import { invalidInput, PasskeyKeyError } from "./errors.js";
3
3
  import type { PasskeyUser } from "./types.js";
4
4
 
5
5
  const CHALLENGE_BYTES = 32;
6
6
  const MAX_USER_HANDLE_BYTES = 64;
7
7
  const PRF_OUTPUT_BYTES = 32;
8
+ const MAX_BYTE_VALUE = 255;
8
9
 
9
10
  export interface CeremonyContext {
10
11
  rpId: string;
@@ -22,7 +23,7 @@ export interface InternalPrfResult {
22
23
  interface PrfExtensionResults {
23
24
  prf?: {
24
25
  enabled?: boolean;
25
- results?: { first?: BufferSource };
26
+ results?: { first?: unknown };
26
27
  };
27
28
  }
28
29
 
@@ -41,7 +42,31 @@ function resultFromCredential(credential: PublicKeyCredential): InternalPrfResul
41
42
  if (!first) {
42
43
  throw new PasskeyKeyError("unsupported", "the authenticator returned no PRF output");
43
44
  }
44
- const prfOutput = new Uint8Array(bufferSourceToArrayBuffer(first));
45
+ let prfOutput: Uint8Array;
46
+ if (Array.isArray(first)) {
47
+ // 1Password's browser extension can return a plain array instead of BufferSource.
48
+ if (first.length !== PRF_OUTPUT_BYTES) {
49
+ throw invalidInput(`PRF output must be ${PRF_OUTPUT_BYTES} bytes`);
50
+ }
51
+ prfOutput = new Uint8Array(PRF_OUTPUT_BYTES);
52
+ for (let index = 0; index < PRF_OUTPUT_BYTES; index++) {
53
+ const byte = first[index];
54
+ if (
55
+ !Object.prototype.hasOwnProperty.call(first, index) ||
56
+ !Number.isInteger(byte) || byte < 0 || byte > MAX_BYTE_VALUE
57
+ ) {
58
+ throw invalidInput("PRF output must contain only integer bytes");
59
+ }
60
+ prfOutput[index] = byte;
61
+ }
62
+ } else if (first instanceof ArrayBuffer || ArrayBuffer.isView(first)) {
63
+ const bytes = first instanceof ArrayBuffer
64
+ ? new Uint8Array(first)
65
+ : new Uint8Array(first.buffer, first.byteOffset, first.byteLength);
66
+ prfOutput = bytes.slice();
67
+ } else {
68
+ throw invalidInput("PRF output must be a buffer or byte array");
69
+ }
45
70
  if (prfOutput.length !== PRF_OUTPUT_BYTES) {
46
71
  throw invalidInput(`PRF output must be ${PRF_OUTPUT_BYTES} bytes`);
47
72
  }