@weaveprotocol/core 0.1.0

package/dist/identity/did.js

@@ -0,0 +1,37 @@
+import { base58 } from '@scure/base';
+import { concatBytes } from '../utils/encoding.js';
+/**
+ * Multicodec `p256-pub` (0x1200) as a varint. Per the did:key spec the key that
+ * follows is the 33-byte compressed point, which is why P-256 DIDs start `zDn`.
+ */
+export const P256_MULTICODEC = new Uint8Array([0x80, 0x24]);
+/**
+ * Converts a public key to a did:key string.
+ * @param {Uint8Array} publicKeyBytes The public key bytes.
+ * @param {Uint8Array} multicodecPrefix The multicodec prefix for the key type.
+ * @returns {string} The formatted did:key string.
+ */
+export function publicKeyToDid(publicKeyBytes, multicodecPrefix) {
+    const prefixedKey = concatBytes(multicodecPrefix, publicKeyBytes);
+    return `did:key:z${base58.encode(prefixedKey)}`;
+}
+/**
+ * Parses a did:key string into its public key and multicodec prefix.
+ * @param {string} did The did:key string.
+ * @returns {{ publicKeyBytes: Uint8Array; multicodecPrefix: Uint8Array }} The parsed components.
+ */
+export function didToPublicKey(did) {
+    if (!did.startsWith('did:key:z')) {
+        throw new Error('Invalid did:key format');
+    }
+    const base58Str = did.slice(9);
+    const bytes = base58.decode(base58Str);
+    let prefixLen = 1;
+    while (prefixLen < bytes.length && (bytes[prefixLen - 1] & 0x80) !== 0) {
+        prefixLen++;
+    }
+    const multicodecPrefix = bytes.slice(0, prefixLen);
+    const publicKeyBytes = bytes.slice(prefixLen);
+    return { multicodecPrefix, publicKeyBytes };
+}
+//# sourceMappingURL=did.js.map

package/dist/identity/did.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did.js","sourceRoot":"","sources":["../../src/identity/did.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,cAA0B,EAAE,gBAA4B;IACrF,MAAM,WAAW,GAAG,WAAW,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAClE,OAAO,YAAY,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEvC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,SAAS,EAAE,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE9C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;AAC9C,CAAC"}

package/dist/identity/folder-account.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @module folder-account
+ * The account file at the root of a data folder.
+ *
+ * Once the folder is the store, the account belongs in it too — otherwise you
+ * have data that travels between origins and a key that does not, which is the
+ * problem the folder was meant to solve. Choosing the folder becomes most of
+ * signing in; unlocking it is the rest.
+ *
+ * The seed is never written in the clear. What the file holds is a set of
+ * wrapped copies of it, one per way of unlocking — see {@link module:account-vault},
+ * which owns the cryptography. This module owns the file: reading it, writing
+ * it, and recognising the older format that kept the seed in plain sight.
+ */
+import type { DirectoryHandleLike } from '../storage/folder-adapter.js';
+import type { AccountVault, SeedWrap } from './account-vault.js';
+export declare const ACCOUNT_FILE = "weave-account.json";
+/** What a folder turned out to hold */
+export interface FolderState {
+    /** The locked account, or null when the folder has no account yet */
+    readonly vault: AccountVault | null;
+    /**
+     * The seed, when the folder still uses the format that stored it in the clear.
+     *
+     * Present means the folder opens without asking for anything, which is the
+     * situation the vault exists to end: a caller that finds this should get the
+     * user to put a lock on it rather than carrying on quietly.
+     */
+    readonly unlockedSeed: Uint8Array | null;
+    readonly label: string;
+    readonly did: string | null;
+}
+/**
+ * Reads whatever account a folder holds.
+ *
+ * @param dir The data folder
+ * @returns Its account, the legacy seed if it predates locking, or an empty state
+ */
+export declare function readFolderVault(dir: DirectoryHandleLike): Promise<FolderState>;
+/**
+ * Writes the account file, replacing whatever was there.
+ *
+ * @param dir The data folder
+ * @param vault The locked account to record
+ */
+export declare function writeFolderVault(dir: DirectoryHandleLike, vault: AccountVault): Promise<void>;
+/**
+ * Assembles a fresh locked account.
+ *
+ * Pure — it neither generates the seed nor touches the disk, so a caller stays
+ * in charge of both the entropy and when it lands.
+ *
+ * @param params.did The DID the seed derives
+ * @param params.wraps Shortcuts for getting in. May be empty: the account code
+ *   is the seed written out, so it opens the account with nothing stored —
+ *   which is exactly what a brand new account has.
+ * @param params.label What to call this account
+ * @returns The account, ready for {@link writeFolderVault}
+ */
+export declare function createVault(params: {
+    did: string;
+    wraps: ReadonlyArray<SeedWrap>;
+    label?: string;
+}): AccountVault;
+//# sourceMappingURL=folder-account.d.ts.map

package/dist/identity/folder-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder-account.d.ts","sourceRoot":"","sources":["../../src/identity/folder-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAKjE,eAAO,MAAM,YAAY,uBAAuB,CAAC;AA+BjD,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAKD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAoCpF;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAInG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,YAAY,CAQf"}

package/dist/identity/folder-account.js

@@ -0,0 +1,115 @@
+/**
+ * @module folder-account
+ * The account file at the root of a data folder.
+ *
+ * Once the folder is the store, the account belongs in it too — otherwise you
+ * have data that travels between origins and a key that does not, which is the
+ * problem the folder was meant to solve. Choosing the folder becomes most of
+ * signing in; unlocking it is the rest.
+ *
+ * The seed is never written in the clear. What the file holds is a set of
+ * wrapped copies of it, one per way of unlocking — see {@link module:account-vault},
+ * which owns the cryptography. This module owns the file: reading it, writing
+ * it, and recognising the older format that kept the seed in plain sight.
+ */
+import { readFolderFile, writeFolderFile } from '../storage/folder-adapter.js';
+import { isValidRecoveryCode, recoveryCodeToSeed } from './recovery-code.js';
+import { utf8Encode, utf8Decode } from '../utils/encoding.js';
+import { protocolError } from '../utils/errors.js';
+export const ACCOUNT_FILE = 'weave-account.json';
+const README_FILE = 'README.txt';
+const README = `This folder is your data.
+
+  weave-account.json    your identity, locked
+  stores/             your spaces, their contents, and the index over them
+
+Any app that can open this folder — and unlock it — is a view on what is in it.
+Point a second app at this same folder and it sees the same lists, signed by the
+same key, with no account to create.
+
+The account file does not contain your seed. It contains that seed encrypted,
+once per way of unlocking it: under each app's passkey, and under your
+passphrase if you set one. Adding an app adds an entry. Copying this folder
+somewhere is not enough to read it; you need one of those too.
+
+Your recovery code is the exception, and it is deliberately not in here. It is
+the seed itself, written out, and it opens this folder anywhere — including on a
+phone, or in Safari or Firefox, which cannot open folders at all. Keep it
+somewhere you would keep a spare key.
+
+Nothing here is a database. Every file under stores/*/expressions is one signed
+record named after its own hash, so two copies of this folder merge by keeping
+the union of their files.
+
+What is not encrypted, so you know: the author, timestamp and collection of
+every record, and the contents of any space you made public. Locking those too
+would mean you could no longer open this folder and see what is in it.
+`;
+/** An empty folder, ready to have an account started in it. */
+const EMPTY = { vault: null, unlockedSeed: null, label: 'My data', did: null };
+/**
+ * Reads whatever account a folder holds.
+ *
+ * @param dir The data folder
+ * @returns Its account, the legacy seed if it predates locking, or an empty state
+ */
+export async function readFolderVault(dir) {
+    const bytes = await readFolderFile(dir, ACCOUNT_FILE);
+    if (!bytes)
+        return EMPTY;
+    // Deliberately loose: version 1 and version 2 are different shapes, and an
+    // intersection of the two is uninhabited. Narrowing happens below.
+    let parsed;
+    try {
+        parsed = JSON.parse(utf8Decode(bytes));
+    }
+    catch {
+        throw protocolError('FOLDER_ACCOUNT_UNREADABLE', `${ACCOUNT_FILE} in that folder is not valid JSON.`, 'Either the file was edited by hand, or this is not a data folder. Choose a ' +
+            'different folder, or move the broken file aside to start fresh.');
+    }
+    const label = typeof parsed.label === 'string' ? parsed.label : 'My data';
+    const did = typeof parsed.did === 'string' ? parsed.did : null;
+    if (parsed.version === 2 && Array.isArray(parsed.wraps)) {
+        return { vault: parsed, unlockedSeed: null, label, did };
+    }
+    // The first format kept the seed as a recovery code, in the clear.
+    if (typeof parsed.recoveryCode === 'string' && isValidRecoveryCode(parsed.recoveryCode)) {
+        return { vault: null, unlockedSeed: recoveryCodeToSeed(parsed.recoveryCode), label, did };
+    }
+    throw protocolError('FOLDER_ACCOUNT_UNREADABLE', `${ACCOUNT_FILE} in that folder is not an account this version understands.`, 'It may have been written by a newer build. Update the app, or move the file ' +
+        'aside and sign in with your recovery code to write a new one.');
+}
+/**
+ * Writes the account file, replacing whatever was there.
+ *
+ * @param dir The data folder
+ * @param vault The locked account to record
+ */
+export async function writeFolderVault(dir, vault) {
+    await writeFolderFile(dir, ACCOUNT_FILE, utf8Encode(`${JSON.stringify(vault, null, 2)}\n`));
+    // Rewritten each time, so a folder that predates it picks it up on first save.
+    await writeFolderFile(dir, README_FILE, utf8Encode(README));
+}
+/**
+ * Assembles a fresh locked account.
+ *
+ * Pure — it neither generates the seed nor touches the disk, so a caller stays
+ * in charge of both the entropy and when it lands.
+ *
+ * @param params.did The DID the seed derives
+ * @param params.wraps Shortcuts for getting in. May be empty: the account code
+ *   is the seed written out, so it opens the account with nothing stored —
+ *   which is exactly what a brand new account has.
+ * @param params.label What to call this account
+ * @returns The account, ready for {@link writeFolderVault}
+ */
+export function createVault(params) {
+    return {
+        version: 2,
+        label: params.label ?? 'My data',
+        did: params.did,
+        createdAt: new Date().toISOString(),
+        wraps: params.wraps,
+    };
+}
+//# sourceMappingURL=folder-account.js.map

package/dist/identity/folder-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder-account.js","sourceRoot":"","sources":["../../src/identity/folder-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Bd,CAAC;AAkBF,+DAA+D;AAC/D,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAwB;IAC5D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAA4B,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CACjB,2BAA2B,EAC3B,GAAG,YAAY,oCAAoC,EACnD,6EAA6E;YAC3E,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/D,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,MAAiC,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACtF,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,aAAa,CACjB,2BAA2B,EAC3B,GAAG,YAAY,6DAA6D,EAC5E,8EAA8E;QAC5E,+DAA+D,CAClE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAwB,EAAE,KAAmB;IAClF,MAAM,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,+EAA+E;IAC/E,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,MAI3B;IACC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;QAChC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}

package/dist/identity/identity-manager.d.ts

@@ -0,0 +1,36 @@
+import { CryptoProvider } from '../types.js';
+export interface IdentityConfig {
+    readonly provider?: CryptoProvider;
+    readonly rpId?: string;
+    readonly rpName?: string;
+}
+export interface Identity {
+    readonly did: string;
+    readonly credentialId?: string;
+    readonly publicKey: CryptoKey;
+    readonly privateKey: CryptoKey;
+    readonly publicKeyBytes: Uint8Array;
+}
+/** How a passkey ceremony should be steered */
+export interface CeremonyPreferences {
+    /** Favour the platform passkey over an installed credential manager */
+    readonly preferPlatform?: boolean;
+}
+export interface IdentityManager {
+    register(userName: string, preferences?: CeremonyPreferences): Promise<Identity>;
+    /** Signs in with a known passkey, or any discoverable one when no id is given. */
+    authenticate(credentialId?: string, preferences?: CeremonyPreferences): Promise<Identity>;
+    fromPassword(password: string, salt?: Uint8Array): Promise<Identity>;
+    /** Derives the root identity from a written-down recovery code (no passkey needed) */
+    fromRecoveryCode(code: string): Promise<Identity>;
+    /** Derives the root identity straight from seed bytes */
+    fromSeed(seed: Uint8Array): Promise<Identity>;
+    getProvider(): CryptoProvider;
+}
+/**
+ * Creates an IdentityManager instance.
+ * @param {IdentityConfig} [config] Configuration options.
+ * @returns {IdentityManager} The identity manager instance.
+ */
+export declare function createIdentityManager(config?: IdentityConfig): IdentityManager;
+//# sourceMappingURL=identity-manager.d.ts.map

package/dist/identity/identity-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-manager.d.ts","sourceRoot":"","sources":["../../src/identity/identity-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAQ7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC;CACrC;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjF,kFAAkF;IAClF,YAAY,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1F,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrE,sFAAsF;IACtF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,WAAW,IAAI,cAAc,CAAC;CAC/B;AAmBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,eAAe,CA2G9E"}

package/dist/identity/identity-manager.js

@@ -0,0 +1,115 @@
+import { createP256Provider } from './crypto-p256.js';
+import { registerPasskey, authenticatePasskey } from './webauthn.js';
+import { deriveKeyPair, deriveKeyFromPassword } from './keys.js';
+import { publicKeyToDid, P256_MULTICODEC } from './did.js';
+import { protocolError } from '../utils/errors.js';
+import { recoveryCodeToSeed } from './recovery-code.js';
+/**
+ * The error raised when a passkey yields no PRF secret, with the remedies that
+ * actually help — a passkey only carries PRF if it was requested when the
+ * credential was created, so an older passkey cannot be upgraded in place.
+ * @returns A tagged PRF_UNSUPPORTED error
+ */
+function prfUnsupported() {
+    return protocolError('PRF_UNSUPPORTED', 'This passkey returned no PRF secret, so no identity key can be derived from it.', 'PRF has to be requested when a passkey is created, so one made before your ' +
+        'provider supported it will never return a secret — create a new passkey. ' +
+        'If it still fails, the authenticator itself lacks PRF (hmac-secret): try a ' +
+        'platform passkey (Touch ID, Windows Hello) or an up-to-date password manager.');
+}
+/**
+ * Creates an IdentityManager instance.
+ * @param {IdentityConfig} [config] Configuration options.
+ * @returns {IdentityManager} The identity manager instance.
+ */
+export function createIdentityManager(config) {
+    const provider = config?.provider || createP256Provider();
+    // Use globalThis.location if available, fallback to localhost for Node/testing
+    const defaultRpId = typeof globalThis.location !== 'undefined' ? globalThis.location.hostname : 'localhost';
+    const rpId = config?.rpId || defaultRpId;
+    const rpName = config?.rpName || 'Weave';
+    return Object.freeze({
+        async register(userName, preferences) {
+            const platformOnly = preferences?.preferPlatform
+                ? { hints: ['client-device'], attachment: 'platform' }
+                : {};
+            const registration = await registerPasskey({
+                rpId,
+                rpName,
+                userName,
+                ...platformOnly
+            });
+            // Some authenticators return the PRF secret from the creation ceremony.
+            // The rest need an assertion to produce it — including providers that
+            // report nothing (or `enabled: false`) at creation and then evaluate PRF
+            // without complaint, so the declaration is never grounds to give up.
+            let prfOutput = registration.prfOutput;
+            if (!prfOutput) {
+                const auth = await authenticatePasskey(registration.credentialId, {
+                    rpId,
+                    ...(preferences?.preferPlatform ? { hints: ['client-device'] } : {})
+                });
+                prfOutput = auth.prfOutput;
+            }
+            if (!prfOutput) {
+                throw prfUnsupported();
+            }
+            const keyPair = await deriveKeyPair(prfOutput, provider);
+            const did = publicKeyToDid(keyPair.publicKeyBytes, P256_MULTICODEC);
+            return Object.freeze({
+                did,
+                credentialId: registration.credentialId,
+                publicKey: keyPair.publicKey,
+                privateKey: keyPair.privateKey,
+                publicKeyBytes: keyPair.publicKeyBytes
+            });
+        },
+        async authenticate(credentialId, preferences) {
+            const auth = await authenticatePasskey(credentialId, {
+                rpId,
+                ...(preferences?.preferPlatform ? { hints: ['client-device'] } : {})
+            });
+            if (!auth.prfOutput) {
+                throw prfUnsupported();
+            }
+            const keyPair = await deriveKeyPair(auth.prfOutput, provider);
+            const did = publicKeyToDid(keyPair.publicKeyBytes, P256_MULTICODEC);
+            return Object.freeze({
+                did,
+                credentialId: auth.credentialId,
+                publicKey: keyPair.publicKey,
+                privateKey: keyPair.privateKey,
+                publicKeyBytes: keyPair.publicKeyBytes
+            });
+        },
+        async fromPassword(password, salt) {
+            const actualSalt = salt || new TextEncoder().encode('default-weave-salt');
+            const keyPair = await deriveKeyFromPassword(password, actualSalt, provider);
+            const did = publicKeyToDid(keyPair.publicKeyBytes, P256_MULTICODEC);
+            return Object.freeze({
+                did,
+                publicKey: keyPair.publicKey,
+                privateKey: keyPair.privateKey,
+                publicKeyBytes: keyPair.publicKeyBytes
+            });
+        },
+        async fromRecoveryCode(code) {
+            return this.fromSeed(recoveryCodeToSeed(code));
+        },
+        async fromSeed(seed) {
+            // The seed already carries 128 bits of entropy, so it goes straight into
+            // HKDF — no password stretching to slow down what is not a password.
+            const keyPair = await deriveKeyPair(seed, provider);
+            const did = publicKeyToDid(keyPair.publicKeyBytes, P256_MULTICODEC);
+            return Object.freeze({
+                did,
+                publicKey: keyPair.publicKey,
+                privateKey: keyPair.privateKey,
+                publicKeyBytes: keyPair.publicKeyBytes
+            });
+        },
+        getProvider() {
+            return provider;
+        }
+    });
+}
+//# sourceMappingURL=identity-manager.js.map

package/dist/identity/identity-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-manager.js","sourceRoot":"","sources":["../../src/identity/identity-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAkCxD;;;;;GAKG;AACH,SAAS,cAAc;IACrB,OAAO,aAAa,CAClB,iBAAiB,EACjB,iFAAiF,EACjF,6EAA6E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E,CAClF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IAE1D,+EAA+E;IAC/E,MAAM,WAAW,GAAG,OAAO,UAAU,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5G,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC;IAEzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,WAAiC;YAChE,MAAM,YAAY,GAAG,WAAW,EAAE,cAAc;gBAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAU,EAAE,UAAU,EAAE,UAAmB,EAAE;gBACxE,CAAC,CAAC,EAAE,CAAC;YAEP,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC;gBACzC,IAAI;gBACJ,MAAM;gBACN,QAAQ;gBACR,GAAG,YAAY;aAChB,CAAC,CAAC;YAEH,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;YACvC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,YAAY,EAAE;oBAChE,IAAI;oBACJ,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9E,CAAC,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,cAAc,EAAE,CAAC;YACzB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAEpE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG;gBACH,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,YAAqB,EAAE,WAAiC;YACzE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE;gBACnD,IAAI;gBACJ,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,cAAc,EAAE,CAAC;YACzB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAEpE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG;gBACH,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAiB;YACpD,MAAM,UAAU,GAAG,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAEpE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG;gBACH,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,IAAY;YACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAgB;YAC7B,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAEpE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG;gBACH,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;QACL,CAAC;QAED,WAAW;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/index.d.ts

@@ -0,0 +1,10 @@
+export * from './crypto-p256.js';
+export * from './webauthn.js';
+export * from './keys.js';
+export * from './did.js';
+export * from './identity-manager.js';
+export * from './ucan.js';
+export * from './agent-note.js';
+export * from './passkey-diagnostics.js';
+export * from './recovery-code.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC"}

package/dist/identity/index.js

@@ -0,0 +1,10 @@
+export * from './crypto-p256.js';
+export * from './webauthn.js';
+export * from './keys.js';
+export * from './did.js';
+export * from './identity-manager.js';
+export * from './ucan.js';
+export * from './agent-note.js';
+export * from './passkey-diagnostics.js';
+export * from './recovery-code.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC"}

package/dist/identity/keys.d.ts

@@ -0,0 +1,24 @@
+import { CryptoProvider } from '../types.js';
+export interface DerivedKeyPair {
+    readonly publicKey: CryptoKey;
+    readonly privateKey: CryptoKey;
+    readonly publicKeyBytes: Uint8Array;
+}
+/**
+ * Derives a key pair from seed bytes: an account seed, a PRF output, or a
+ * stretched password. One KDF step, owned by the provider, since how many bytes
+ * a curve needs to reach a key without bias is a property of the curve.
+ * @param {Uint8Array} seed At least 16 uniformly random bytes.
+ * @param {CryptoProvider} provider The cryptography provider.
+ * @returns {Promise<DerivedKeyPair>} The derived key pair.
+ */
+export declare function deriveKeyPair(seed: Uint8Array, provider: CryptoProvider): Promise<DerivedKeyPair>;
+/**
+ * Derives a key pair from a password and salt.
+ * @param {string} password The password.
+ * @param {Uint8Array} salt The salt.
+ * @param {CryptoProvider} provider The cryptography provider.
+ * @returns {Promise<DerivedKeyPair>} The derived key pair.
+ */
+export declare function deriveKeyFromPassword(password: string, salt: Uint8Array, provider: CryptoProvider): Promise<DerivedKeyPair>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/identity/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/identity/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAWvG;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAsBjI"}

package/dist/identity/keys.js

@@ -0,0 +1,38 @@
+/**
+ * Derives a key pair from seed bytes: an account seed, a PRF output, or a
+ * stretched password. One KDF step, owned by the provider, since how many bytes
+ * a curve needs to reach a key without bias is a property of the curve.
+ * @param {Uint8Array} seed At least 16 uniformly random bytes.
+ * @param {CryptoProvider} provider The cryptography provider.
+ * @returns {Promise<DerivedKeyPair>} The derived key pair.
+ */
+export async function deriveKeyPair(seed, provider) {
+    // The provider turns the seed into a key pair whose public key genuinely
+    // matches the private one — that correspondence is what makes a DID verifiable.
+    const keyPair = await provider.deriveKeyPairFromSeed(seed);
+    const publicKeyBytes = await provider.exportPublicKey(keyPair.publicKey);
+    return Object.freeze({
+        publicKey: keyPair.publicKey,
+        privateKey: keyPair.privateKey,
+        publicKeyBytes
+    });
+}
+/**
+ * Derives a key pair from a password and salt.
+ * @param {string} password The password.
+ * @param {Uint8Array} salt The salt.
+ * @param {CryptoProvider} provider The cryptography provider.
+ * @returns {Promise<DerivedKeyPair>} The derived key pair.
+ */
+export async function deriveKeyFromPassword(password, salt, provider) {
+    const encoder = new TextEncoder();
+    const passwordKey = await globalThis.crypto.subtle.importKey('raw', encoder.encode(password), { name: 'PBKDF2' }, false, ['deriveBits']);
+    const derivedBits = await globalThis.crypto.subtle.deriveBits({
+        name: 'PBKDF2',
+        hash: 'SHA-256',
+        salt: salt,
+        iterations: 100000
+    }, passwordKey, 256);
+    return deriveKeyPair(new Uint8Array(derivedBits), provider);
+}
+//# sourceMappingURL=keys.js.map

package/dist/identity/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/identity/keys.ts"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB,EAAE,QAAwB;IAC5E,yEAAyE;IACzE,gFAAgF;IAChF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB,EAAE,IAAgB,EAAE,QAAwB;IACtG,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAC1D,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EACxB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAC3D;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAoB;QAC1B,UAAU,EAAE,MAAM;KACnB,EACD,WAAW,EACX,GAAG,CACJ,CAAC;IAEF,OAAO,aAAa,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9D,CAAC"}

package/dist/identity/pairing.d.ts

@@ -0,0 +1,83 @@
+/**
+ * @module pairing
+ * Handing an account to a phone.
+ *
+ * A phone cannot open a folder — no mobile browser has the File System Access
+ * API — so it keeps its own copy of the data, like any other peer. What it needs
+ * from the desktop is two things: who you are, and which lists exist.
+ *
+ * The first fits in a QR code. The second does not, and does not need to: once
+ * both sides know the seed they can each work out the same private meeting room
+ * and the same key, meet there over the ordinary peer connection, and hand the
+ * list of lists across encrypted. So the code stays small enough for a phone
+ * camera to read from across a desk.
+ *
+ * Deriving the room from the *seed* rather than from the DID matters. A DID
+ * appears in every expression the account has ever signed, so a room named after
+ * one would be a room anyone could find. A room named after the seed can only be
+ * found by someone who already has it.
+ *
+ * What this is not: the phone does not become a satellite of the desktop. It
+ * derives the same identity and becomes a full peer, syncing with anyone in the
+ * space. The desktop was a bootstrap, and can go offline immediately afterwards.
+ */
+/** What the QR code carries */
+export interface PairingTicket {
+    readonly v: 1;
+    /** The recovery code — the seed, in the form that survives a camera */
+    readonly code: string;
+    /** Where to meet. Must be an address the phone can actually reach. */
+    readonly relay: string;
+}
+/**
+ * The room both devices meet in.
+ *
+ * Derived from the seed, so finding it already requires the secret. Both sides
+ * compute it independently and neither has to send it.
+ *
+ * @param seed The account seed
+ * @returns An opaque room id for the signaling relay
+ */
+export declare function pairingRoomId(seed: Uint8Array): Promise<string>;
+/**
+ * The key the handover is encrypted with.
+ *
+ * Separate from the vault key and from the signing key, so that a relay
+ * operator watching the room learns nothing but the size of the payload.
+ *
+ * @param seed The account seed
+ * @returns An AES-GCM key
+ */
+export declare function derivePairingKey(seed: Uint8Array): Promise<CryptoKey>;
+/**
+ * Packs a ticket for a URL fragment.
+ *
+ * A fragment, because browsers never put one in a request — so the seed reaches
+ * the phone without passing through the server hosting the page, the same way a
+ * space invite carries its key.
+ *
+ * @param ticket What the phone needs to know
+ * @returns A compact string for after the `#`
+ */
+export declare function encodePairingTicket(ticket: PairingTicket): string;
+/**
+ * Unpacks a ticket from a URL fragment.
+ * @param encoded The string after `#pair=`
+ * @returns The ticket it stands for
+ */
+export declare function decodePairingTicket(encoded: string): PairingTicket;
+/**
+ * Encrypts the handover payload.
+ * @param plaintext What to send
+ * @param key From {@link derivePairingKey}
+ * @returns Nonce followed by ciphertext
+ */
+export declare function sealPairingPayload(plaintext: Uint8Array, key: CryptoKey): Promise<Uint8Array>;
+/**
+ * Decrypts the handover payload.
+ * @param sealed What arrived
+ * @param key From {@link derivePairingKey}
+ * @returns The plaintext
+ */
+export declare function openPairingPayload(sealed: Uint8Array, key: CryptoKey): Promise<Uint8Array>;
+//# sourceMappingURL=pairing.d.ts.map

package/dist/identity/pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/identity/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH,+BAA+B;AAC/B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAoB3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAclE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAQnG;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAmBhG"}