@volr/sdk-core 0.1.90 → 0.1.92

package/dist/index.d.cts

@@ -208,22 +208,25 @@ declare function unsealMasterSeed(cipher: Uint8Array, wrapKey: WrapKey, aad: Uin
 
 /**
  * PRF input parameters for wrap key derivation
+ *
+ * Note: origin is NOT included in PrfInput because:
+ * - Different domains should be able to share the same wallet
+ * - WebAuthn rpId binding already provides domain security
+ * - Including origin would prevent cross-domain wallet usage
  */
 type PrfInput = {
-    /** Origin (e.g., "https://example.com") */
-    origin: string;
     /** Project ID */
     projectId: string;
     /** Credential ID from WebAuthn */
     credentialId: string;
-    /** Optional salt (defaults to SHA256 of concatenated inputs) */
+    /** Optional salt (defaults to SHA256 of projectId) */
     salt?: Uint8Array;
 };
 /**
  * Derive wrap key from PRF inputs using HKDF
  *
- * PRF input domain is fixed: rpId|projectId (credentialId excluded)
- * This ensures consistent wrap key derivation across sessions
+ * Salt derivation uses only projectId to enable cross-domain wallet sharing.
+ * WebAuthn's rpId binding already provides domain-level security.
  *
  * Note: credentialId is NOT included in salt derivation because:
  * - During enrollment, actual credentialId is not known until after credential creation
@@ -240,7 +243,6 @@ type PrfInput = {
  * @example
  * ```ts
  * const wrapKey = deriveWrapKey({
- *   origin: 'https://example.com',
  *   projectId: 'project-123',
  *   credentialId: 'cred-456' // stored for authentication, but not used in salt derivation
  * });
@@ -1300,7 +1302,7 @@ type PasskeyProviderOptions = {
  * @example
  * ```ts
  * const provider = createPasskeyProvider(passkeyAdapter, {
- *   prfInput: { origin, projectId, credentialId },
+ *   prfInput: { projectId, credentialId },
  *   encryptedBlob: { cipher, nonce }
  * });
  * await provider.ensureSession({ interactive: true, force: true });

package/dist/index.d.ts

@@ -208,22 +208,25 @@ declare function unsealMasterSeed(cipher: Uint8Array, wrapKey: WrapKey, aad: Uin
 
 /**
  * PRF input parameters for wrap key derivation
+ *
+ * Note: origin is NOT included in PrfInput because:
+ * - Different domains should be able to share the same wallet
+ * - WebAuthn rpId binding already provides domain security
+ * - Including origin would prevent cross-domain wallet usage
  */
 type PrfInput = {
-    /** Origin (e.g., "https://example.com") */
-    origin: string;
     /** Project ID */
     projectId: string;
     /** Credential ID from WebAuthn */
     credentialId: string;
-    /** Optional salt (defaults to SHA256 of concatenated inputs) */
+    /** Optional salt (defaults to SHA256 of projectId) */
     salt?: Uint8Array;
 };
 /**
  * Derive wrap key from PRF inputs using HKDF
  *
- * PRF input domain is fixed: rpId|projectId (credentialId excluded)
- * This ensures consistent wrap key derivation across sessions
+ * Salt derivation uses only projectId to enable cross-domain wallet sharing.
+ * WebAuthn's rpId binding already provides domain-level security.
  *
  * Note: credentialId is NOT included in salt derivation because:
  * - During enrollment, actual credentialId is not known until after credential creation
@@ -240,7 +243,6 @@ type PrfInput = {
  * @example
  * ```ts
  * const wrapKey = deriveWrapKey({
- *   origin: 'https://example.com',
  *   projectId: 'project-123',
  *   credentialId: 'cred-456' // stored for authentication, but not used in salt derivation
  * });
@@ -1300,7 +1302,7 @@ type PasskeyProviderOptions = {
  * @example
  * ```ts
  * const provider = createPasskeyProvider(passkeyAdapter, {
- *   prfInput: { origin, projectId, credentialId },
+ *   prfInput: { projectId, credentialId },
  *   encryptedBlob: { cipher, nonce }
  * });
  * await provider.ensureSession({ interactive: true, force: true });

package/dist/index.js

@@ -223,14 +223,13 @@ function createMasterKeyProvider() {
   };
 }
 function deriveWrapKey(input) {
-  const { origin, projectId, salt } = input;
-  const rpId = typeof window !== "undefined" && origin ? new URL(origin).hostname : origin;
-  const prfInput = new TextEncoder().encode(`${rpId}|${projectId}`);
-  const prfOutput = sha256(prfInput);
+  const { projectId, salt } = input;
+  const prfInputBytes = new TextEncoder().encode(`volr|${projectId}`);
+  const prfOutput = sha256(prfInputBytes);
   const defaultSalt = salt || sha256(
-    new TextEncoder().encode(`volr/salt|${rpId}|${projectId}`)
+    new TextEncoder().encode(`volr/salt|${projectId}`)
   );
-  const info = `volr/wrap-key/v1|${rpId}|${projectId}`;
+  const info = `volr/wrap-key/v1|${projectId}`;
   const wrapKey = hkdfSha256(prfOutput, defaultSalt, info, 32);
   return wrapKey;
 }