@weaveprotocol/core 0.1.0

package/dist/identity/pairing.js

@@ -0,0 +1,120 @@
+/**
+ * @module pairing
+ * Handing an account to a phone.
+ *
+ * A phone cannot open a folder — no mobile browser has the File System Access
+ * API — so it keeps its own copy of the data, like any other peer. What it needs
+ * from the desktop is two things: who you are, and which lists exist.
+ *
+ * The first fits in a QR code. The second does not, and does not need to: once
+ * both sides know the seed they can each work out the same private meeting room
+ * and the same key, meet there over the ordinary peer connection, and hand the
+ * list of lists across encrypted. So the code stays small enough for a phone
+ * camera to read from across a desk.
+ *
+ * Deriving the room from the *seed* rather than from the DID matters. A DID
+ * appears in every expression the account has ever signed, so a room named after
+ * one would be a room anyone could find. A room named after the seed can only be
+ * found by someone who already has it.
+ *
+ * What this is not: the phone does not become a satellite of the desktop. It
+ * derives the same identity and becomes a full peer, syncing with anyone in the
+ * space. The desktop was a bootstrap, and can go offline immediately afterwards.
+ */
+import { base64UrlEncode, base64UrlDecode, utf8Encode, utf8Decode, concatBytes } from '../utils/encoding.js';
+import { cidFromBytes } from '../utils/hash.js';
+import { protocolError } from '../utils/errors.js';
+const ROOM_PREFIX = utf8Encode('weave-pairing-room-v1');
+const PAIRING_KEY_INFO = utf8Encode('weave-pairing-key-v1');
+const IV_BYTES = 12;
+/**
+ * The room both devices meet in.
+ *
+ * Derived from the seed, so finding it already requires the secret. Both sides
+ * compute it independently and neither has to send it.
+ *
+ * @param seed The account seed
+ * @returns An opaque room id for the signaling relay
+ */
+export async function pairingRoomId(seed) {
+    return cidFromBytes(concatBytes(ROOM_PREFIX, seed));
+}
+/**
+ * The key the handover is encrypted with.
+ *
+ * Separate from the vault key and from the signing key, so that a relay
+ * operator watching the room learns nothing but the size of the payload.
+ *
+ * @param seed The account seed
+ * @returns An AES-GCM key
+ */
+export async function derivePairingKey(seed) {
+    const material = await globalThis.crypto.subtle.importKey('raw', seed, { name: 'HKDF' }, false, ['deriveKey']);
+    return globalThis.crypto.subtle.deriveKey({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: new Uint8Array(0),
+        info: PAIRING_KEY_INFO,
+    }, material, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+/**
+ * Packs a ticket for a URL fragment.
+ *
+ * A fragment, because browsers never put one in a request — so the seed reaches
+ * the phone without passing through the server hosting the page, the same way a
+ * space invite carries its key.
+ *
+ * @param ticket What the phone needs to know
+ * @returns A compact string for after the `#`
+ */
+export function encodePairingTicket(ticket) {
+    return base64UrlEncode(utf8Encode(JSON.stringify(ticket)));
+}
+/**
+ * Unpacks a ticket from a URL fragment.
+ * @param encoded The string after `#pair=`
+ * @returns The ticket it stands for
+ */
+export function decodePairingTicket(encoded) {
+    try {
+        const ticket = JSON.parse(utf8Decode(base64UrlDecode(encoded.trim())));
+        if (ticket?.v !== 1 || typeof ticket.code !== 'string' || typeof ticket.relay !== 'string') {
+            throw new Error('unexpected shape');
+        }
+        return ticket;
+    }
+    catch {
+        throw protocolError('PAIRING_TICKET_UNREADABLE', 'That pairing link could not be read.', 'It may have been truncated, or produced by a different app. Show the code again.');
+    }
+}
+/**
+ * Encrypts the handover payload.
+ * @param plaintext What to send
+ * @param key From {@link derivePairingKey}
+ * @returns Nonce followed by ciphertext
+ */
+export async function sealPairingPayload(plaintext, key) {
+    const iv = globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
+    const ciphertext = await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv: iv }, key, plaintext);
+    return concatBytes(iv, new Uint8Array(ciphertext));
+}
+/**
+ * Decrypts the handover payload.
+ * @param sealed What arrived
+ * @param key From {@link derivePairingKey}
+ * @returns The plaintext
+ */
+export async function openPairingPayload(sealed, key) {
+    if (sealed.length <= IV_BYTES) {
+        throw protocolError('PAIRING_TICKET_UNREADABLE', 'That handover was too short to be real.');
+    }
+    try {
+        const plain = await globalThis.crypto.subtle.decrypt({ name: 'AES-GCM', iv: sealed.slice(0, IV_BYTES) }, key, sealed.slice(IV_BYTES));
+        return new Uint8Array(plain);
+    }
+    catch {
+        // Someone else in the room, or a ticket for a different account.
+        throw protocolError('PAIRING_TICKET_UNREADABLE', 'That handover was not meant for this account.');
+    }
+}
+//# sourceMappingURL=pairing.js.map

package/dist/identity/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/identity/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,WAAW,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAAC;AACxD,MAAM,gBAAgB,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;AAC5D,MAAM,QAAQ,GAAG,EAAE,CAAC;AAWpB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB;IAClD,OAAO,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAgB;IACrD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACvD,KAAK,EACL,IAAoB,EACpB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;IACF,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAiB;QACvC,IAAI,EAAE,gBAAgC;KACvC,EACD,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,OAAO,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAkB,CAAC;QACxF,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CACjB,2BAA2B,EAC3B,sCAAsC,EACtC,kFAAkF,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAqB,EAAE,GAAc;IAC5E,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CACvD,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,EAC3C,GAAG,EACH,SAAyB,CAC1B,CAAC;IACF,OAAO,WAAW,CAAC,EAAE,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,GAAc;IACzE,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,aAAa,CAAC,2BAA2B,EAAE,yCAAyC,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAClD,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAiB,EAAE,EAClE,GAAG,EACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAiB,CACvC,CAAC;QACF,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,MAAM,aAAa,CACjB,2BAA2B,EAC3B,+CAA+C,CAChD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/passkey-diagnostics.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @module passkey-diagnostics
+ * Reports what a browser and credential provider actually do with the PRF
+ * extension, so a failure can be pinned on a specific link in the chain rather
+ * than guessed at.
+ */
+/** Where a ceremony's PRF request ended up */
+export interface CeremonyReport {
+    readonly attempted: boolean;
+    /** Raw client extension results, with binary values summarized */
+    readonly extensionResults: Record<string, unknown> | null;
+    /** Bytes of PRF output this ceremony produced, or null for none */
+    readonly prfOutputBytes: number | null;
+    readonly error?: string;
+}
+export interface PasskeyDiagnostics {
+    readonly webauthnAvailable: boolean;
+    readonly platformAuthenticatorAvailable: boolean;
+    /** AAGUID of the authenticator that answered, and its name when recognized */
+    readonly provider: {
+        readonly aaguid: string | null;
+        readonly name: string | null;
+    };
+    /** Whether the creation ceremony reported `prf.enabled` */
+    readonly prfDeclaredAtCreate: boolean | undefined;
+    readonly create: CeremonyReport;
+    readonly assert: CeremonyReport;
+    /** The only question that matters: did a secret come back? */
+    readonly prfWorks: boolean;
+    /** A sentence naming the most likely culprit */
+    readonly summary: string;
+    readonly credentialId: string | null;
+}
+export interface DiagnosticsOptions {
+    readonly rpId?: string;
+    readonly rpName?: string;
+    /**
+     * Test this existing credential instead of creating one. Without it the run
+     * creates a throwaway passkey, which will appear in the user's authenticator.
+     */
+    readonly credentialId?: string;
+    readonly userName?: string;
+}
+/**
+ * Runs the PRF ceremonies and reports what came back at each step.
+ *
+ * Creating a passkey and asserting it are separate conversations with the
+ * provider, and PRF can be dropped in either — this shows which.
+ *
+ * @param options Which credential to test, and how to identify the site
+ * @returns A structured report, safe to display or copy into a bug report
+ */
+export declare function inspectPasskeyPrf(options?: DiagnosticsOptions): Promise<PasskeyDiagnostics>;
+//# sourceMappingURL=passkey-diagnostics.d.ts.map

package/dist/identity/passkey-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-diagnostics.d.ts","sourceRoot":"","sources":["../../src/identity/passkey-diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,8BAA8B,EAAE,OAAO,CAAC;IACjD,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpF,2DAA2D;IAC3D,QAAQ,CAAC,mBAAmB,EAAE,OAAO,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AA8CD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAwHjG"}

package/dist/identity/passkey-diagnostics.js

@@ -0,0 +1,178 @@
+/**
+ * @module passkey-diagnostics
+ * Reports what a browser and credential provider actually do with the PRF
+ * extension, so a failure can be pinned on a specific link in the chain rather
+ * than guessed at.
+ */
+import { base64UrlEncode, base64UrlDecode } from '../utils/encoding.js';
+const PRF_SALT = new TextEncoder().encode('weave-protocol-key-v1');
+/** AAGUIDs of providers common enough to be worth naming. */
+const KNOWN_AAGUIDS = {
+    'd548826e-79b4-db40-a3d8-11116f7e8349': 'Bitwarden',
+    'bada5566-a7aa-401f-bd96-45619a55120d': '1Password',
+    'fbfc3007-154e-4ecc-8c0b-6e020557d7bd': 'iCloud Keychain',
+    'ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4': 'Google Password Manager',
+    '08987058-cadc-4b81-b6e1-30de50dcbe96': 'Windows Hello',
+    '531126d6-e717-415c-9320-3d9aa6981239': 'Dashlane',
+    'fdb141b2-5d84-443e-8a35-4698c205a502': 'KeePassXC',
+    '00000000-0000-0000-0000-000000000000': 'Platform authenticator (no AAGUID)',
+};
+/** Formats the 16 AAGUID bytes that sit at offset 37 of attested credential data. */
+function readAaguid(authenticatorData) {
+    if (!authenticatorData || authenticatorData.byteLength < 53)
+        return null;
+    const bytes = new Uint8Array(authenticatorData).slice(37, 53);
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/** Replaces binary values with a readable summary so the report can be shown or copied. */
+function summarizeExtensions(results) {
+    if (!results || typeof results !== 'object')
+        return null;
+    const walk = (value) => {
+        if (value instanceof ArrayBuffer)
+            return `<${value.byteLength} bytes>`;
+        if (ArrayBuffer.isView(value))
+            return `<${value.byteLength} bytes>`;
+        if (Array.isArray(value))
+            return value.map(walk);
+        if (value && typeof value === 'object') {
+            return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, walk(v)]));
+        }
+        return value;
+    };
+    return walk(results);
+}
+function prfOutputLength(results) {
+    const first = results?.prf?.results?.first;
+    return first ? first.byteLength : null;
+}
+/**
+ * Runs the PRF ceremonies and reports what came back at each step.
+ *
+ * Creating a passkey and asserting it are separate conversations with the
+ * provider, and PRF can be dropped in either — this shows which.
+ *
+ * @param options Which credential to test, and how to identify the site
+ * @returns A structured report, safe to display or copy into a bug report
+ */
+export async function inspectPasskeyPrf(options) {
+    const webauthnAvailable = !!globalThis.navigator?.credentials?.create;
+    const rpId = options?.rpId ?? (typeof globalThis.location !== 'undefined' ? globalThis.location.hostname : 'localhost');
+    let platformAuthenticatorAvailable = false;
+    try {
+        platformAuthenticatorAvailable =
+            (await globalThis.PublicKeyCredential?.isUserVerifyingPlatformAuthenticatorAvailable?.()) ?? false;
+    }
+    catch {
+        platformAuthenticatorAvailable = false;
+    }
+    const create = { attempted: false, extensionResults: null, prfOutputBytes: null };
+    const assert = { attempted: false, extensionResults: null, prfOutputBytes: null };
+    let credentialId = options?.credentialId ?? null;
+    let aaguid = null;
+    let prfDeclaredAtCreate;
+    if (!webauthnAvailable) {
+        return Object.freeze({
+            webauthnAvailable,
+            platformAuthenticatorAvailable,
+            provider: { aaguid: null, name: null },
+            prfDeclaredAtCreate: undefined,
+            create: Object.freeze(create),
+            assert: Object.freeze(assert),
+            prfWorks: false,
+            summary: 'WebAuthn is unavailable in this browser, so passkeys cannot be used at all.',
+            credentialId: null,
+        });
+    }
+    // 1. Creation — unless we were pointed at an existing credential.
+    if (!credentialId) {
+        create.attempted = true;
+        try {
+            const credential = (await globalThis.navigator.credentials.create({
+                publicKey: {
+                    rp: { id: rpId, name: options?.rpName ?? 'PRF diagnostic' },
+                    user: {
+                        id: globalThis.crypto.getRandomValues(new Uint8Array(32)),
+                        name: options?.userName ?? 'prf-diagnostic',
+                        displayName: options?.userName ?? 'PRF diagnostic (safe to delete)',
+                    },
+                    challenge: globalThis.crypto.getRandomValues(new Uint8Array(32)),
+                    pubKeyCredParams: [
+                        { type: 'public-key', alg: -7 },
+                        { type: 'public-key', alg: -257 },
+                    ],
+                    authenticatorSelection: {
+                        residentKey: 'required',
+                        requireResidentKey: true,
+                        userVerification: 'required',
+                    },
+                    extensions: { prf: { eval: { first: PRF_SALT } } },
+                },
+            }));
+            const results = credential.getClientExtensionResults();
+            create.extensionResults = summarizeExtensions(results);
+            create.prfOutputBytes = prfOutputLength(results);
+            prfDeclaredAtCreate = results.prf?.enabled;
+            credentialId = base64UrlEncode(new Uint8Array(credential.rawId));
+            const response = credential.response;
+            aaguid = readAaguid(response.getAuthenticatorData?.());
+        }
+        catch (error) {
+            create.error = error instanceof Error ? `${error.name}: ${error.message}` : 'Creation failed';
+        }
+    }
+    // 2. Assertion — the ceremony that actually has to yield a secret.
+    if (credentialId) {
+        assert.attempted = true;
+        try {
+            const credential = (await globalThis.navigator.credentials.get({
+                publicKey: {
+                    challenge: globalThis.crypto.getRandomValues(new Uint8Array(32)),
+                    rpId,
+                    userVerification: 'required',
+                    allowCredentials: [{ type: 'public-key', id: base64UrlDecode(credentialId) }],
+                    extensions: { prf: { eval: { first: PRF_SALT } } },
+                },
+            }));
+            const results = credential.getClientExtensionResults();
+            assert.extensionResults = summarizeExtensions(results);
+            assert.prfOutputBytes = prfOutputLength(results);
+        }
+        catch (error) {
+            assert.error = error instanceof Error ? `${error.name}: ${error.message}` : 'Assertion failed';
+        }
+    }
+    const prfWorks = (assert.prfOutputBytes ?? 0) > 0 || (create.prfOutputBytes ?? 0) > 0;
+    const providerName = aaguid ? (KNOWN_AAGUIDS[aaguid] ?? null) : null;
+    return Object.freeze({
+        webauthnAvailable,
+        platformAuthenticatorAvailable,
+        provider: Object.freeze({ aaguid, name: providerName }),
+        prfDeclaredAtCreate,
+        create: Object.freeze(create),
+        assert: Object.freeze(assert),
+        prfWorks,
+        summary: describe({ prfWorks, prfDeclaredAtCreate, create, assert, providerName }),
+        credentialId,
+    });
+}
+/** Turns the raw findings into one sentence naming the likely culprit. */
+function describe(facts) {
+    const who = facts.providerName ? `${facts.providerName} ` : 'This provider ';
+    if (facts.create.error)
+        return `The passkey could not be created: ${facts.create.error}`;
+    if (facts.prfWorks)
+        return `${who}supports PRF — identity derivation will work with this passkey.`;
+    if (facts.assert.error)
+        return `The assertion failed before PRF could be evaluated: ${facts.assert.error}`;
+    const sawPrfKey = facts.create.extensionResults !== null && 'prf' in facts.create.extensionResults;
+    if (!sawPrfKey) {
+        return `${who}returned no \`prf\` entry at all, which usually means the extension was dropped before reaching the authenticator — the provider handling the ceremony does not implement PRF.`;
+    }
+    if (facts.prfDeclaredAtCreate === false) {
+        return `${who}explicitly reported PRF as unavailable for this credential (\`prf.enabled: false\`).`;
+    }
+    return `${who}acknowledged the PRF extension but evaluated no secret, so the credential has no hmac-secret to derive from.`;
+}
+//# sourceMappingURL=passkey-diagnostics.js.map

package/dist/identity/passkey-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-diagnostics.js","sourceRoot":"","sources":["../../src/identity/passkey-diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAuCxE,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAEnE,6DAA6D;AAC7D,MAAM,aAAa,GAA2B;IAC5C,sCAAsC,EAAE,WAAW;IACnD,sCAAsC,EAAE,WAAW;IACnD,sCAAsC,EAAE,iBAAiB;IACzD,sCAAsC,EAAE,yBAAyB;IACjE,sCAAsC,EAAE,eAAe;IACvD,sCAAsC,EAAE,UAAU;IAClD,sCAAsC,EAAE,WAAW;IACnD,sCAAsC,EAAE,oCAAoC;CAC7E,CAAC;AAEF,qFAAqF;AACrF,SAAS,UAAU,CAAC,iBAA0C;IAC5D,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,UAAU,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,2FAA2F;AAC3F,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAW,EAAE;QACvC,IAAI,KAAK,YAAY,WAAW;YAAE,OAAO,IAAI,KAAK,CAAC,UAAU,SAAS,CAAC;QACvE,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,KAAK,CAAC,UAAU,SAAS,CAAC;QACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,OAAO,CAA4B,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAAI,OAA2D,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IAChG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA4B;IAClE,MAAM,iBAAiB,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;IACtE,MAAM,IAAI,GACR,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,UAAU,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAE7G,IAAI,8BAA8B,GAAG,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,8BAA8B;YAC5B,CAAC,MAAM,UAAU,CAAC,mBAAmB,EAAE,6CAA6C,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B,GAAG,KAAK,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAKR,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAEvE,MAAM,MAAM,GAKR,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAEvE,IAAI,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACjD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,mBAAwC,CAAC;IAE7C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,iBAAiB;YACjB,8BAA8B;YAC9B,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;YACtC,mBAAmB,EAAE,SAAS;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,6EAA6E;YACtF,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;gBAChE,SAAS,EAAE;oBACT,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE;oBAC3D,IAAI,EAAE;wBACJ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAiB;wBACzE,IAAI,EAAE,OAAO,EAAE,QAAQ,IAAI,gBAAgB;wBAC3C,WAAW,EAAE,OAAO,EAAE,QAAQ,IAAI,iCAAiC;qBACpE;oBACD,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;oBAChE,gBAAgB,EAAE;wBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;wBAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;qBAClC;oBACD,sBAAsB,EAAE;wBACtB,WAAW,EAAE,UAAU;wBACvB,kBAAkB,EAAE,IAAI;wBACxB,gBAAgB,EAAE,UAAU;qBAC7B;oBACD,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAA0C;iBAC3F;aACF,CAAC,CAAwB,CAAC;YAE3B,MAAM,OAAO,GAAG,UAAU,CAAC,yBAAyB,EAAE,CAAC;YACvD,MAAM,CAAC,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACjD,mBAAmB,GAAI,OAA2C,CAAC,GAAG,EAAE,OAAO,CAAC;YAChF,YAAY,GAAG,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAEjE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;YACzE,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChG,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;gBAC7D,SAAS,EAAE;oBACT,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;oBAChE,IAAI;oBACJ,gBAAgB,EAAE,UAAU;oBAC5B,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,eAAe,CAAC,YAAY,CAAiB,EAAE,CAAC;oBAC7F,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAA0C;iBAC3F;aACF,CAAC,CAAwB,CAAC;YAE3B,MAAM,OAAO,GAAG,UAAU,CAAC,yBAAyB,EAAE,CAAC;YACvD,MAAM,CAAC,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACjG,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAErE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,iBAAiB;QACjB,8BAA8B;QAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACvD,mBAAmB;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAClF,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,QAAQ,CAAC,KAMjB;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAE7E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,qCAAqC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzF,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,GAAG,GAAG,iEAAiE,CAAC;IACnG,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,uDAAuD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAE3G,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,CAAC,gBAAgB,KAAK,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAEnF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,GAAG,gLAAgL,CAAC;IAChM,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO,GAAG,GAAG,sFAAsF,CAAC;IACtG,CAAC;IACD,OAAO,GAAG,GAAG,8GAA8G,CAAC;AAC9H,CAAC"}

package/dist/identity/recovery-code.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @module recovery-code
+ * A PRF-free way to anchor an identity: 128 bits of entropy the user can write
+ * down, type on another device, and derive the exact same root key from.
+ *
+ * Encoded in Crockford base32 — no padding, no ambiguity between 0/O or 1/I/L,
+ * and case-insensitive, so it survives being copied by hand.
+ */
+/** How many bytes a seed is. Anything else cannot be written as a code. */
+export declare const RECOVERY_SEED_BYTES = 16;
+/**
+ * Generates a fresh seed.
+ * @returns 128 bits of entropy, ready to derive an identity from
+ */
+export declare function generateSeed(): Uint8Array;
+/**
+ * Writes a seed out as a code a person can copy.
+ *
+ * The inverse of {@link recoveryCodeToSeed} — which matters once the seed is
+ * kept wrapped rather than written down, because showing the user their code
+ * then means encoding a seed that already exists rather than minting one.
+ *
+ * @param seed The seed bytes
+ * @returns A grouped code such as `K7M2-9QPX-...`
+ */
+export declare function seedToRecoveryCode(seed: Uint8Array): string;
+/**
+ * Generates a fresh recovery code.
+ * @returns A grouped code such as `K7M2-9QPX-...`
+ */
+export declare function generateRecoveryCode(): string;
+/**
+ * Strips formatting and resolves look-alike characters.
+ * @param code A code as typed by a user
+ * @returns The canonical, ungrouped form
+ */
+export declare function normalizeRecoveryCode(code: string): string;
+/**
+ * Checks whether a code could decode to a seed.
+ * @param code A code as typed by a user
+ * @returns Whether it is well formed
+ */
+export declare function isValidRecoveryCode(code: string): boolean;
+/**
+ * Decodes a recovery code into the seed bytes it stands for.
+ * @param code A code as typed by a user
+ * @returns The seed, ready for key derivation
+ */
+export declare function recoveryCodeToSeed(code: string): Uint8Array;
+//# sourceMappingURL=recovery-code.d.ts.map

package/dist/identity/recovery-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-code.d.ts","sourceRoot":"","sources":["../../src/identity/recovery-code.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,KAAa,CAAC;AAE9C;;;GAGG;AACH,wBAAgB,YAAY,IAAI,UAAU,CAEzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAK3D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO1D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAqB3D"}

package/dist/identity/recovery-code.js

@@ -0,0 +1,116 @@
+/**
+ * @module recovery-code
+ * A PRF-free way to anchor an identity: 128 bits of entropy the user can write
+ * down, type on another device, and derive the exact same root key from.
+ *
+ * Encoded in Crockford base32 — no padding, no ambiguity between 0/O or 1/I/L,
+ * and case-insensitive, so it survives being copied by hand.
+ */
+const ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+/** Crockford's substitutions for characters people confuse when transcribing. */
+const SUBSTITUTIONS = { O: '0', I: '1', L: '1', U: 'V' };
+/** 128 bits: 16 bytes, 26 base32 characters, shown in groups of four. */
+const SEED_BYTES = 16;
+/** How many bytes a seed is. Anything else cannot be written as a code. */
+export const RECOVERY_SEED_BYTES = SEED_BYTES;
+/**
+ * Generates a fresh seed.
+ * @returns 128 bits of entropy, ready to derive an identity from
+ */
+export function generateSeed() {
+    return globalThis.crypto.getRandomValues(new Uint8Array(SEED_BYTES));
+}
+/**
+ * Writes a seed out as a code a person can copy.
+ *
+ * The inverse of {@link recoveryCodeToSeed} — which matters once the seed is
+ * kept wrapped rather than written down, because showing the user their code
+ * then means encoding a seed that already exists rather than minting one.
+ *
+ * @param seed The seed bytes
+ * @returns A grouped code such as `K7M2-9QPX-...`
+ */
+export function seedToRecoveryCode(seed) {
+    if (seed.length !== SEED_BYTES) {
+        throw new Error(`A recovery code carries exactly ${SEED_BYTES} bytes, not ${seed.length}.`);
+    }
+    return formatRecoveryCode(encodeBase32(seed));
+}
+/**
+ * Generates a fresh recovery code.
+ * @returns A grouped code such as `K7M2-9QPX-...`
+ */
+export function generateRecoveryCode() {
+    return seedToRecoveryCode(generateSeed());
+}
+/**
+ * Strips formatting and resolves look-alike characters.
+ * @param code A code as typed by a user
+ * @returns The canonical, ungrouped form
+ */
+export function normalizeRecoveryCode(code) {
+    return code
+        .toUpperCase()
+        .replace(/[\s-]/g, '')
+        .split('')
+        .map((char) => SUBSTITUTIONS[char] ?? char)
+        .join('');
+}
+/**
+ * Checks whether a code could decode to a seed.
+ * @param code A code as typed by a user
+ * @returns Whether it is well formed
+ */
+export function isValidRecoveryCode(code) {
+    const normalized = normalizeRecoveryCode(code);
+    if (normalized.length !== Math.ceil((SEED_BYTES * 8) / 5))
+        return false;
+    return normalized.split('').every((char) => ALPHABET.includes(char));
+}
+/**
+ * Decodes a recovery code into the seed bytes it stands for.
+ * @param code A code as typed by a user
+ * @returns The seed, ready for key derivation
+ */
+export function recoveryCodeToSeed(code) {
+    const normalized = normalizeRecoveryCode(code);
+    if (!isValidRecoveryCode(code)) {
+        throw new Error('That recovery code is not valid — check for a missing or mistyped character.');
+    }
+    const bytes = new Uint8Array(SEED_BYTES);
+    let buffer = 0;
+    let bitsInBuffer = 0;
+    let index = 0;
+    for (const char of normalized) {
+        buffer = (buffer << 5) | ALPHABET.indexOf(char);
+        bitsInBuffer += 5;
+        if (bitsInBuffer >= 8 && index < SEED_BYTES) {
+            bitsInBuffer -= 8;
+            bytes[index++] = (buffer >> bitsInBuffer) & 0xff;
+        }
+    }
+    return bytes;
+}
+/** Groups a code into readable blocks of four. */
+function formatRecoveryCode(code) {
+    return (code.match(/.{1,4}/g) ?? []).join('-');
+}
+/** Encodes bytes as Crockford base32, most significant bit first. */
+function encodeBase32(bytes) {
+    let out = '';
+    let buffer = 0;
+    let bitsInBuffer = 0;
+    for (const byte of bytes) {
+        buffer = (buffer << 8) | byte;
+        bitsInBuffer += 8;
+        while (bitsInBuffer >= 5) {
+            bitsInBuffer -= 5;
+            out += ALPHABET[(buffer >> bitsInBuffer) & 0x1f];
+        }
+    }
+    if (bitsInBuffer > 0) {
+        out += ALPHABET[(buffer << (5 - bitsInBuffer)) & 0x1f];
+    }
+    return out;
+}
+//# sourceMappingURL=recovery-code.js.map

package/dist/identity/recovery-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-code.js","sourceRoot":"","sources":["../../src/identity/recovery-code.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD,iFAAiF;AACjF,MAAM,aAAa,GAA2B,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;AAEjF,yEAAyE;AACzE,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,eAAe,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,kBAAkB,CAAC,YAAY,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;SAC1C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,YAAY,IAAI,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;YAC5C,YAAY,IAAI,CAAC,CAAC;YAClB,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kDAAkD;AAClD,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC9B,YAAY,IAAI,CAAC,CAAC;QAClB,OAAO,YAAY,IAAI,CAAC,EAAE,CAAC;YACzB,YAAY,IAAI,CAAC,CAAC;YAClB,GAAG,IAAI,QAAQ,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,GAAG,IAAI,QAAQ,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/identity/root-signer.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @module root-signer
+ * Who holds the identity key, and how a session gets permission from it.
+ *
+ * The root key signs exactly one thing: a note saying "this session key may
+ * write for me, until this time". Everything else is signed by the session key.
+ * That one signature is the only reason an app needs the identity at all — so
+ * it is the only thing that has to be abstracted for the key to live somewhere
+ * other than the page.
+ *
+ * Somewhere else means an account home in another window, or anything that
+ * will hold a secret and answer questions about it. The page asks for a delegation
+ * and gets back a token; the seed never crosses the boundary.
+ *
+ * Everything downstream — DIDs, expressions, validation, sync — is unchanged by
+ * this, because none of it ever sees the root key either.
+ */
+import type { CryptoProvider } from '../types.js';
+import type { Capability, Fact, UCANToken } from './ucan.js';
+/** What a session needs from an identity, wherever that identity is kept */
+export interface RootSigner {
+    /** The identity being acted for */
+    readonly did: string;
+    /**
+     * Where the key lives. Worth showing: "your key is in your account home" and
+     * "your key is in this tab" are different promises to make to someone.
+     */
+    readonly custody: 'local' | 'remote';
+    /**
+     * Signs a delegation from the identity to a session key.
+     *
+     * @param params.audience The session key's DID
+     * @param params.capabilities What it may do
+     * @param params.expiration Unix seconds after which the note is worthless
+     * @param params.facts Facts the note carries — that its key is an agent's, say
+     * @returns The signed token
+     */
+    delegate(params: {
+        audience: string;
+        capabilities: ReadonlyArray<Capability>;
+        expiration: number;
+        facts?: ReadonlyArray<Fact>;
+    }): Promise<UCANToken>;
+}
+/**
+ * A signer for a key this page is holding.
+ *
+ * The ordinary case: the seed was unlocked here, so the key is in memory and
+ * signing is a local operation.
+ *
+ * @param identity The unlocked identity
+ * @param provider Crypto provider for signing
+ * @returns A signer over it
+ */
+export declare function createLocalRootSigner(identity: {
+    did: string;
+    privateKey: CryptoKey;
+}, provider: CryptoProvider): RootSigner;
+//# sourceMappingURL=root-signer.d.ts.map

package/dist/identity/root-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-signer.d.ts","sourceRoot":"","sources":["../../src/identity/root-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG7D,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QACxC,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;KAC7B,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,CAAA;CAAE,EAChD,QAAQ,EAAE,cAAc,GACvB,UAAU,CAuBZ"}