@weaveprotocol/core 0.1.0

package/dist/identity/account-store.js

@@ -0,0 +1,305 @@
+/**
+ * @module account-store
+ * The accounts that live somewhere — in a folder, or in this browser.
+ *
+ * A folder is a disk, not a person. Several people can keep accounts in one, and
+ * one person can keep several: work and personal, or a spare for testing. So the
+ * folder holds a list of who has an account in it, and a subtree per account.
+ *
+ * ```
+ * <folder>/
+ *   accounts.json                  name, DID and id of each account
+ *   accounts/<id>/account.json     that account's keys, locked
+ *   accounts/<id>/stores/...       that account's spaces
+ * ```
+ *
+ * **The list is readable without unlocking anything**, which it has to be — you
+ * cannot offer someone a choice of accounts without knowing their names. So
+ * whoever holds the folder can see how many accounts are in it and what they
+ * are called. What they cannot do is open one.
+ *
+ * A browser with no folder keeps the same shape in IndexedDB, so the app above
+ * has one model rather than two.
+ */
+import { readFolderFile, writeFolderFile } from '../storage/folder-adapter.js';
+import { readFolderVault } from './folder-account.js';
+import { base64UrlEncode, utf8Encode, utf8Decode } from '../utils/encoding.js';
+import { protocolError } from '../utils/errors.js';
+const LIST_FILE = 'accounts.json';
+const ACCOUNTS_DIR = 'accounts';
+const VAULT_FILE = 'account.json';
+/** Where a single-account folder kept its spaces, before there was a list. */
+const LEGACY_DATA_PATH = 'stores';
+/** Where a brand new account keeps its spaces. */
+export function accountDataPath(id) {
+    return `${ACCOUNTS_DIR}/${id}/stores`;
+}
+/** A short, stable, filename-safe id for a new account. */
+export function newAccountId() {
+    return base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(8)))
+        .replace(/[^a-z0-9]/gi, '')
+        .toLowerCase()
+        .slice(0, 12);
+}
+/**
+ * Whether an id has the shape {@link newAccountId} gives one.
+ *
+ * An id names a directory, and `remove` deletes that directory with everything
+ * in it. The list it comes from is a plain file in a folder that may be synced
+ * or shared, so an id is checked before it is trusted with a path.
+ */
+export function isAccountId(id) {
+    return typeof id === 'string' && /^[a-z0-9]{1,12}$/.test(id);
+}
+/**
+ * Whether a row points somewhere this store could have put it.
+ *
+ * `dataPath` is carried, not computed, but there are only two shapes it can
+ * honestly have: an account subtree, or the folder's root store from before
+ * there was a list. Usually the subtree is the row's own — though a row filed
+ * again under a fresh id keeps the one its data already lives in. Anything
+ * else, `../../elsewhere` above all, is someone editing the list to aim an
+ * account at files outside the folder.
+ */
+function isTrustworthy(account) {
+    if (!isAccountId(account?.id) || typeof account.dataPath !== 'string')
+        return false;
+    if (account.dataPath === LEGACY_DATA_PATH)
+        return true;
+    const [accounts, id, stores, ...more] = account.dataPath.split('/');
+    return accounts === ACCOUNTS_DIR && isAccountId(id) && stores === 'stores' && more.length === 0;
+}
+function checkId(id) {
+    if (!isAccountId(id))
+        throw new TypeError(`Not an account id: ${JSON.stringify(id)}`);
+}
+/** Most recently used first, so the picker opens on the likely one. */
+function byRecency(a, b) {
+    return (b.lastUsedAt ?? b.createdAt).localeCompare(a.lastUsedAt ?? a.createdAt);
+}
+/**
+ * Most recently used first, one row per identity.
+ *
+ * A summary is a label on an identity, so two of them for one DID means the
+ * same person listed twice — which is confusing at best and, once they point
+ * at different data paths, a way to lose track of where anything is.
+ *
+ * @param accounts Whatever the store had
+ * @returns The list to show
+ */
+function collapse(accounts) {
+    const seen = new Set();
+    return [...accounts].sort(byRecency).filter((account) => {
+        if (seen.has(account.did))
+            return false;
+        seen.add(account.did);
+        return true;
+    });
+}
+function parseList(bytes) {
+    if (!bytes)
+        return [];
+    try {
+        const parsed = JSON.parse(utf8Decode(bytes));
+        // A row that fails the check is skipped, not repaired: it was not written
+        // by this store, so there is no telling what it was meant to be.
+        return Array.isArray(parsed?.accounts) ? parsed.accounts.filter(isTrustworthy) : [];
+    }
+    catch {
+        throw protocolError('FOLDER_ACCOUNT_UNREADABLE', `${LIST_FILE} in that folder is not valid JSON.`, 'Move it aside and sign in with your code to write a fresh one — no account ' +
+            'data is lost, only the list of which accounts exist.');
+    }
+}
+/**
+ * Opens the accounts kept in a folder.
+ *
+ * @param dir The data folder
+ * @returns A store over it
+ */
+export function createFolderAccountStore(dir) {
+    async function readList() {
+        return parseList(await readFolderFile(dir, LIST_FILE));
+    }
+    async function writeList(accounts) {
+        await writeFolderFile(dir, LIST_FILE, utf8Encode(`${JSON.stringify({ version: 1, accounts }, null, 2)}\n`));
+    }
+    /** The directory holding one account's keys. */
+    async function accountDir(id, create) {
+        try {
+            const accounts = await dir.getDirectoryHandle(ACCOUNTS_DIR, { create });
+            return await accounts.getDirectoryHandle(id, { create });
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === 'NotFoundError')
+                return null;
+            throw error;
+        }
+    }
+    return Object.freeze({
+        kind: 'folder',
+        async list() {
+            return collapse(await readList());
+        },
+        async read(id) {
+            if (!isAccountId(id))
+                return null;
+            const home = await accountDir(id, false);
+            if (!home)
+                return null;
+            const bytes = await readFolderFile(home, VAULT_FILE);
+            if (!bytes)
+                return null;
+            try {
+                return JSON.parse(utf8Decode(bytes));
+            }
+            catch {
+                throw protocolError('FOLDER_ACCOUNT_UNREADABLE', `The keys for that account could not be read.`, 'The file may have been edited by hand. Sign in with your code to write a new one.');
+            }
+        },
+        async write(summary, vault) {
+            if (!isTrustworthy(summary)) {
+                throw new TypeError(`Account ${JSON.stringify(summary.id)} does not have a valid id and data path`);
+            }
+            const home = await accountDir(summary.id, true);
+            if (!home)
+                throw new Error(`Could not open a home for account ${summary.id}`);
+            await writeFolderFile(home, VAULT_FILE, utf8Encode(`${JSON.stringify(vault, null, 2)}\n`));
+            // Drops any row for the same identity as well as the same id: the caller
+            // has just said which account this is.
+            const accounts = (await readList()).filter((account) => account.id !== summary.id && account.did !== summary.did);
+            await writeList([...accounts, summary]);
+        },
+        async remove(id) {
+            checkId(id);
+            await writeList((await readList()).filter((account) => account.id !== id));
+            try {
+                const accounts = await dir.getDirectoryHandle(ACCOUNTS_DIR);
+                await accounts.removeEntry(id, { recursive: true });
+            }
+            catch (error) {
+                // Already gone, or the browser will not recurse. The list no longer
+                // mentions it either way.
+                if (!(error instanceof Error) || error.name !== 'NotFoundError')
+                    throw error;
+            }
+        },
+    });
+}
+// ─── Accounts kept in this browser ─────────────────────────────────────
+const DB_NAME = 'weave-accounts';
+const STORE = 'accounts';
+const LIST_KEY = '__list';
+function openDb(dbName) {
+    return new Promise((resolve, reject) => {
+        const request = globalThis.indexedDB.open(dbName, 1);
+        request.onupgradeneeded = () => {
+            if (!request.result.objectStoreNames.contains(STORE)) {
+                request.result.createObjectStore(STORE);
+            }
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+}
+function idbGet(db, key) {
+    return new Promise((resolve, reject) => {
+        const request = db.transaction(STORE, 'readonly').objectStore(STORE).get(key);
+        request.onsuccess = () => resolve(request.result ?? null);
+        request.onerror = () => reject(request.error);
+    });
+}
+function idbPut(db, key, value) {
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE, 'readwrite');
+        tx.objectStore(STORE).put(value, key);
+        tx.oncomplete = () => resolve();
+        tx.onerror = () => reject(tx.error);
+    });
+}
+function idbDelete(db, key) {
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE, 'readwrite');
+        tx.objectStore(STORE).delete(key);
+        tx.oncomplete = () => resolve();
+        tx.onerror = () => reject(tx.error);
+    });
+}
+/**
+ * Opens the accounts kept in this browser, for when there is no folder.
+ *
+ * Same shape as a folder store, so nothing above has to know which it got —
+ * the difference is only that no other origin can read this one.
+ *
+ * @param dbName Overridable for tests
+ * @returns A store over this origin's database
+ */
+export async function createBrowserAccountStore(dbName = DB_NAME) {
+    const db = await openDb(dbName);
+    return Object.freeze({
+        kind: 'browser',
+        async list() {
+            return collapse((await idbGet(db, LIST_KEY)) ?? []);
+        },
+        async read(id) {
+            return idbGet(db, id);
+        },
+        async write(summary, vault) {
+            await idbPut(db, summary.id, vault);
+            const accounts = ((await idbGet(db, LIST_KEY)) ?? []).filter((account) => account.id !== summary.id && account.did !== summary.did);
+            await idbPut(db, LIST_KEY, [...accounts, summary]);
+        },
+        async remove(id) {
+            await idbDelete(db, id);
+            const accounts = ((await idbGet(db, LIST_KEY)) ?? []).filter((account) => account.id !== id);
+            await idbPut(db, LIST_KEY, accounts);
+        },
+    });
+}
+// ─── Folders written before they could hold more than one account ──────
+/**
+ * Finds the account in a folder that predates the list, so it can join it.
+ *
+ * Its data stays exactly where it is. Moving it would mean copying every file
+ * by hand — the File System Access API cannot rename across directories — for
+ * no benefit, so the summary records where the spaces already live instead.
+ *
+ * @param dir The data folder
+ * @param existing Accounts already listed, so one is not adopted twice
+ * @returns What to write into the list, or null when there is nothing to adopt
+ */
+export async function adoptLegacyFolderAccount(dir, existing) {
+    const legacy = await readFolderVault(dir);
+    // Nothing there, or a folder from before locking existed — that one cannot
+    // be adopted silently, because it has no keys to copy. The app asks the user
+    // to put a password on it instead.
+    if (!legacy.vault)
+        return null;
+    if (existing.some((account) => account.did === legacy.vault.did))
+        return null;
+    return {
+        summary: {
+            id: newAccountId(),
+            name: legacy.label,
+            did: legacy.vault.did,
+            createdAt: legacy.vault.createdAt,
+            dataPath: LEGACY_DATA_PATH,
+        },
+        vault: legacy.vault,
+    };
+}
+/**
+ * Lists a folder's accounts, adopting a pre-list one if it finds it.
+ *
+ * @param dir The data folder
+ * @param store The store over it
+ * @returns Every account, including one just adopted
+ */
+export async function listFolderAccounts(dir, store) {
+    const listed = await store.list();
+    const adopted = await adoptLegacyFolderAccount(dir, listed);
+    if (!adopted)
+        return listed;
+    await store.write(adopted.summary, adopted.vault);
+    return store.list();
+}
+//# sourceMappingURL=account-store.js.map

package/dist/identity/account-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-store.js","sourceRoot":"","sources":["../../src/identity/account-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAuCnD,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,kDAAkD;AAClD,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,GAAG,YAAY,IAAI,EAAE,SAAS,CAAC;AACxC,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY;IAC1B,OAAO,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;SACzE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,EAAW;IACrC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,OAAuB;IAC5C,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpF,IAAI,OAAO,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,EAAE,CAAC,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IACzB,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,CAAiB,EAAE,CAAiB;IACrD,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,QAAuC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACtD,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAwB;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAoC,CAAC;QAChF,0EAA0E;QAC1E,iEAAiE;QACjE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CACjB,2BAA2B,EAC3B,GAAG,SAAS,oCAAoC,EAChD,6EAA6E;YAC3E,sDAAsD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAwB;IAC/D,KAAK,UAAU,QAAQ;QACrB,OAAO,SAAS,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,QAAuC;QAC9D,MAAM,eAAe,CACnB,GAAG,EACH,SAAS,EACT,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,MAAe;QACnD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,OAAO,MAAM,QAAQ,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;gBAAE,OAAO,IAAI,CAAC;YAC1E,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAiB;QAEvB,KAAK,CAAC,IAAI;YACR,OAAO,QAAQ,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAU;YACnB,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAiB,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,aAAa,CACjB,2BAA2B,EAC3B,8CAA8C,EAC9C,mFAAmF,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,OAAuB,EAAE,KAAmB;YACtD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAAC;YACtG,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAE9E,MAAM,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAE3F,yEAAyE;YACzE,uCAAuC;YACvC,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,MAAM,CACxC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CACtE,CAAC;YACF,MAAM,SAAS,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAU;YACrB,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,MAAM,SAAS,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAE3E,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBAC5D,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oEAAoE;gBACpE,0BAA0B;gBAC1B,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;oBAAE,MAAM,KAAK,CAAC;YAC/E,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAE1E,MAAM,OAAO,GAAG,gBAAgB,CAAC;AACjC,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAE1B,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAI,EAAe,EAAE,GAAW;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9E,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAE,OAAO,CAAC,MAAY,IAAI,IAAI,CAAC,CAAC;QACjE,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,EAAe,EAAE,GAAW,EAAE,KAAc;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,EAAe,EAAE,GAAW;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAiB,OAAO;IACtE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAEhC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,SAAkB;QAExB,KAAK,CAAC,IAAI;YACR,OAAO,QAAQ,CAAC,CAAC,MAAM,MAAM,CAAmB,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAU;YACnB,OAAO,MAAM,CAAe,EAAE,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,OAAuB,EAAE,KAAmB;YACtD,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,MAAM,CAAmB,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5E,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CACtE,CAAC;YACF,MAAM,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAU;YACrB,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,MAAM,CAAmB,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5E,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAC/B,CAAC;YACF,MAAM,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAE1E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAwB,EACxB,QAAuC;IAEvC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAE1C,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC;IACnC,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAE/B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,KAAM,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/E,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,YAAY,EAAE;YAClB,IAAI,EAAE,MAAM,CAAC,KAAK;YAClB,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG;YACrB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;YACjC,QAAQ,EAAE,gBAAgB;SAC3B;QACD,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAwB,EACxB,KAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAE5B,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/identity/account-vault.d.ts

@@ -0,0 +1,199 @@
+/**
+ * @module account-vault
+ * The lock on a data folder.
+ *
+ * A folder that holds its seed in the clear is a bearer token: whoever copies it
+ * is you, and the AES key for every private space sits in the same directory as
+ * the ciphertext it opens. So the seed is never stored — only **wrapped copies**
+ * of it are, one per way of unlocking.
+ *
+ * ```
+ * account seed (16 bytes, never written in the clear)
+ *   ├── HKDF → vault key ──encrypts──> space keys and space records at rest
+ *   └── stored only as wraps:
+ *         device     a random key in this origin's storage, gated by a passkey
+ *         passphrase PBKDF2-SHA256 → AES-GCM
+ * ```
+ *
+ * Both wraps are shortcuts for one origin, and neither carries the account
+ * anywhere — that is what the code is for. Adding an app means adding a wrap
+ * there, and two shortcuts end up meaning one account without a delegation
+ * chain anywhere in sight.
+ *
+ * The recovery code needs no wrap at all: it *is* the seed, in printable form.
+ * It is shown once and never stored, and it is the way in when no wrap fits —
+ * a phone, Safari, or an origin that has never seen this folder.
+ *
+ * ## What this does not protect
+ *
+ * Expression files keep their author DID, timestamps and collection names in
+ * the clear, and public spaces keep their bodies that way by design. Locking
+ * those too would mean an opaque blob store, which would cost the property that
+ * makes a folder worth having — that you can open it and see what is in it.
+ */
+/**
+ * PBKDF2 rounds for a passphrase wrap.
+ *
+ * Tuned to roughly a quarter-second in a browser, on the reasoning that this
+ * runs once per unlock and the thing it guards is an identity rather than a
+ * session.
+ */
+export declare const PASSPHRASE_ITERATIONS = 600000;
+/** Fields every wrap carries, whatever unlocks it */
+interface WrapBase {
+    /** Distinguishes wraps within one file */
+    readonly id: string;
+    /** Shown when asking which one to use */
+    readonly label: string;
+    readonly addedAt: string;
+    readonly salt: string;
+    readonly iv: string;
+    readonly ciphertext: string;
+}
+/**
+ * A seed wrapped under a key held on one device.
+ *
+ * The key is not derived from the passkey — a passkey only yields key material
+ * through the PRF extension, which several widely used providers do not
+ * implement. It is a random key in this origin's storage, and the passkey in
+ * front of it is a user-verification gate rather than the source of the
+ * secret. See {@link module:device-key} for what that does and does not
+ * protect against.
+ */
+export interface DeviceWrap extends WrapBase {
+    readonly kind: 'device';
+    /**
+     * The origin this belongs to. The key it names lives in that origin's
+     * storage, so a wrap from another app is not merely likely to fail — it is
+     * unreachable from here.
+     */
+    readonly rpId: string;
+    /** Which local key opens it. Missing from this device means unopenable here. */
+    readonly deviceKeyId: string;
+    /** The passkey that gates it, when one was used */
+    readonly credentialId?: string;
+    /** That passkey's user handle, base64url — what renaming its label needs */
+    readonly userHandle?: string;
+}
+/** A seed wrapped under a passphrase */
+export interface PassphraseWrap extends WrapBase {
+    readonly kind: 'passphrase';
+    readonly iterations: number;
+}
+export type SeedWrap = DeviceWrap | PassphraseWrap;
+/** The account file at the root of a data folder, in its locked form */
+export interface AccountVault {
+    readonly version: 2;
+    readonly label: string;
+    /** The DID the seed derives. Public, and useful for recognising the folder. */
+    readonly did: string;
+    readonly createdAt: string;
+    readonly wraps: ReadonlyArray<SeedWrap>;
+}
+/**
+ * Wraps a seed under this device's key.
+ *
+ * The key is random and lives in this origin's storage; the passkey recorded
+ * alongside is the gate in front of it, not the source of it. See
+ * {@link module:device-key}.
+ *
+ * @param seed The account seed
+ * @param deviceKey The local key, from `createDeviceKey`
+ * @param meta Which origin this belongs to, and the passkey gating it
+ * @returns A wrap ready to append to the account file
+ */
+export declare function wrapSeedWithDeviceKey(seed: Uint8Array, deviceKey: {
+    id: string;
+    key: CryptoKey;
+}, meta: {
+    rpId: string;
+    credentialId?: string;
+    userHandle?: string;
+    label?: string;
+}): Promise<DeviceWrap>;
+/**
+ * Opens a device wrap.
+ * @param wrap The wrap to open
+ * @param deviceKey The local key it names
+ * @returns The seed
+ */
+export declare function unwrapSeedWithDeviceKey(wrap: DeviceWrap, deviceKey: CryptoKey): Promise<Uint8Array>;
+/**
+ * Wraps a seed under a passphrase — the portable way back in.
+ * @param seed The account seed
+ * @param passphrase What the user chose
+ * @param label What to call this wrap
+ * @returns A wrap ready to append to the account file
+ */
+export declare function wrapSeedWithPassphrase(seed: Uint8Array, passphrase: string, label?: string): Promise<PassphraseWrap>;
+/**
+ * Opens a passphrase wrap.
+ * @param wrap The wrap to open
+ * @param passphrase What the user typed
+ * @returns The seed
+ */
+export declare function unwrapSeedWithPassphrase(wrap: PassphraseWrap, passphrase: string): Promise<Uint8Array>;
+/**
+ * The vault key as raw bytes.
+ *
+ * {@link deriveVaultKey} returns a key that cannot be exported, which is right
+ * for a page — it should not be able to leak what it was given. A node derives
+ * the account registry from the key, so it is handed the bytes directly
+ * rather than the protocol relaxing that for everyone.
+ *
+ * Identical material to `deriveVaultKey`: same input, same info, same length.
+ * If those ever drift, the registry and the folder would be sealed under two
+ * different keys.
+ *
+ * @param seed The account seed
+ * @returns 32 bytes, ready to import as AES-GCM
+ */
+export declare function deriveVaultKeyBytes(seed: Uint8Array): Promise<Uint8Array>;
+/**
+ * Derives the key that encrypts a folder's contents at rest.
+ *
+ * Separate from the signing key, and from every wrapping key, so that handing
+ * one out never implies the others.
+ *
+ * @param seed The account seed
+ * @returns An AES-GCM key for space keys and space records
+ */
+export declare function deriveVaultKey(seed: Uint8Array): Promise<CryptoKey>;
+/**
+ * The device wraps this origin could actually attempt.
+ *
+ * The key a wrap names lives in the storage of the origin that made it, so one
+ * from another app is not merely likely to fail — it is unreachable from here.
+ *
+ * @param vault The account file
+ * @param rpId This origin's relying-party id, usually its hostname
+ * @returns The device wraps belonging to this origin
+ */
+export declare function deviceWrapsFor(vault: AccountVault, rpId: string): ReadonlyArray<DeviceWrap>;
+/** Whether a passphrase would get anyone in. */
+export declare function hasPassphraseWrap(vault: AccountVault): boolean;
+/**
+ * Adds a wrap, replacing any earlier one for the same passkey.
+ *
+ * Re-registering on an origin should leave one usable wrap rather than a pile of
+ * stale ones, and a wrap whose credential is gone is only clutter.
+ *
+ * @param vault The account file
+ * @param wrap The wrap to add
+ * @returns The updated account file
+ */
+export declare function withWrap(vault: AccountVault, wrap: SeedWrap): AccountVault;
+/**
+ * Removes a wrap by id.
+ *
+ * Removing the last one is allowed, and leaves the account in the state a new
+ * one starts in: openable by its code and nothing else. The wraps are
+ * shortcuts, not the keys to the building.
+ *
+ * @param vault The account file
+ * @param id The wrap to remove
+ * @returns The updated account file
+ */
+export declare function withoutWrap(vault: AccountVault, id: string): AccountVault;
+export {};
+//# sourceMappingURL=account-vault.d.ts.map

package/dist/identity/account-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-vault.d.ts","sourceRoot":"","sources":["../../src/identity/account-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAI7C,qDAAqD;AACrD,UAAU,QAAQ;IAChB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAW,SAAQ,QAAQ;IAC1C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wCAAwC;AACxC,MAAM,WAAW,cAAe,SAAQ,QAAQ;IAC9C,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC;AAEnD,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAgFD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,EACzC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACjF,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,UAAU,CAAC,CAErB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAqB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAazB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAqB/E;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAoBzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAI3F;AAED,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAE9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,GAAG,YAAY,CAO1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAEzE"}