namirasoft-site 1.5.2 → 1.5.3

package/dist/WebAuthnPrfOperation.d.ts

@@ -0,0 +1,67 @@
+import { IStorage } from "namirasoft-core";
+export interface IWebAuthnPrfOperationOptions {
+    rpName: string;
+    persistent: IStorage;
+    session: IStorage;
+    rpId?: string;
+    userName?: string;
+    userDisplayName?: string;
+    prfSalt?: Uint8Array;
+    idleTimeoutMs?: number;
+    ceremonyTimeoutMs?: number;
+    namespace?: string;
+}
+export interface IWebAuthnPrfRegisterResult {
+    credentialId: Uint8Array;
+    prfEnabled: boolean;
+}
+export interface IWebAuthnPrfStatus {
+    registered: boolean;
+    unlocked: boolean;
+    remainingUnlockMs: number;
+}
+export declare class WebAuthnPrfOperation {
+    private static readonly DEFAULT_SALT;
+    private readonly rpName;
+    private readonly rpId;
+    private readonly userName;
+    private readonly userDisplayName;
+    private readonly prfSalt;
+    private idleTimeoutMs;
+    private readonly ceremonyTimeoutMs;
+    private readonly persistent;
+    private readonly session;
+    private readonly credKey;
+    private readonly cacheKey;
+    private readonly blobPrefix;
+    private readonly indexKey;
+    constructor(options: IWebAuthnPrfOperationOptions);
+    setIdleTimeoutMs(ms: number): void;
+    static isSupported(): boolean;
+    static isPlatformAuthenticatorAvailable(): Promise<boolean>;
+    register(): Promise<IWebAuthnPrfRegisterResult>;
+    isRegistered(): boolean;
+    save(name: string, plaintext: string | Uint8Array): Promise<void>;
+    load(name: string): Promise<string>;
+    loadBytes(name: string): Promise<Uint8Array>;
+    remove(name: string): void;
+    list(): string[];
+    lock(): void;
+    isUnlocked(): boolean;
+    getRemainingUnlockMs(): number;
+    getStatus(): IWebAuthnPrfStatus;
+    reset(): void;
+    unlock(): Promise<void>;
+    private getKey;
+    private derivePrfKey;
+    private readCachedKey;
+    private touchCachedKey;
+    private readIndex;
+    private writeIndex;
+    private addToIndex;
+    private removeFromIndex;
+    private resolveRpId;
+    private assertSupported;
+    private static encodeBase64;
+    private static decodeBase64;
+}

package/dist/WebAuthnPrfOperation.js

@@ -0,0 +1,287 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebAuthnPrfOperation = void 0;
+class WebAuthnPrfOperation {
+    constructor(options) {
+        var _a, _b, _c, _d, _e, _f;
+        this.rpName = options.rpName;
+        this.rpId = options.rpId;
+        this.userName = (_a = options.userName) !== null && _a !== void 0 ? _a : "user";
+        this.userDisplayName = (_b = options.userDisplayName) !== null && _b !== void 0 ? _b : "User";
+        this.prfSalt = (_c = options.prfSalt) !== null && _c !== void 0 ? _c : WebAuthnPrfOperation.DEFAULT_SALT;
+        this.idleTimeoutMs = (_d = options.idleTimeoutMs) !== null && _d !== void 0 ? _d : 2 * 60 * 1000;
+        this.ceremonyTimeoutMs = (_e = options.ceremonyTimeoutMs) !== null && _e !== void 0 ? _e : 60000;
+        this.persistent = options.persistent;
+        this.session = options.session;
+        const ns = (_f = options.namespace) !== null && _f !== void 0 ? _f : "nsp.wapr";
+        this.credKey = `${ns}.credential-id`;
+        this.cacheKey = `${ns}.cached-key`;
+        this.blobPrefix = `${ns}.blob.`;
+        this.indexKey = `${ns}.blob-index`;
+    }
+    setIdleTimeoutMs(ms) {
+        if (ms && ms > 0)
+            this.idleTimeoutMs = ms;
+    }
+    static isSupported() {
+        return typeof window !== "undefined" && typeof window.PublicKeyCredential !== "undefined";
+    }
+    static isPlatformAuthenticatorAvailable() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!WebAuthnPrfOperation.isSupported())
+                return false;
+            try {
+                return yield PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+            }
+            catch (_a) {
+                return false;
+            }
+        });
+    }
+    register() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            this.assertSupported();
+            const challenge = crypto.getRandomValues(new Uint8Array(32));
+            const userId = crypto.getRandomValues(new Uint8Array(16));
+            const credential = yield navigator.credentials.create({
+                publicKey: {
+                    challenge,
+                    rp: { name: this.rpName, id: this.resolveRpId() },
+                    user: {
+                        id: userId,
+                        name: this.userName,
+                        displayName: this.userDisplayName,
+                    },
+                    pubKeyCredParams: [
+                        { type: "public-key", alg: -7 },
+                        { type: "public-key", alg: -257 },
+                    ],
+                    authenticatorSelection: {
+                        residentKey: "preferred",
+                        userVerification: "required",
+                    },
+                    timeout: this.ceremonyTimeoutMs,
+                    extensions: { prf: {} },
+                },
+            });
+            if (!credential)
+                throw new Error("Credential creation was cancelled.");
+            const credentialId = new Uint8Array(credential.rawId);
+            const ext = credential.getClientExtensionResults();
+            const prfEnabled = ((_a = ext.prf) === null || _a === void 0 ? void 0 : _a.enabled) === true;
+            this.persistent.set(this.credKey, WebAuthnPrfOperation.encodeBase64(credentialId));
+            return { credentialId, prfEnabled };
+        });
+    }
+    isRegistered() {
+        return this.persistent.get(this.credKey, "") !== "";
+    }
+    save(name, plaintext) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const key = yield this.getKey();
+            const data = typeof plaintext === "string" ? new TextEncoder().encode(plaintext) : plaintext;
+            const iv = crypto.getRandomValues(new Uint8Array(12));
+            const ct = yield crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, data);
+            const blob = {
+                iv: Array.from(iv),
+                ct: Array.from(new Uint8Array(ct)),
+            };
+            this.persistent.set(this.blobPrefix + name, JSON.stringify(blob));
+            this.addToIndex(name);
+        });
+    }
+    load(name) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const bytes = yield this.loadBytes(name);
+            return new TextDecoder().decode(bytes);
+        });
+    }
+    loadBytes(name) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const raw = this.persistent.get(this.blobPrefix + name, "");
+            if (!raw)
+                throw new Error(`No encrypted blob named "${name}".`);
+            const blob = JSON.parse(raw);
+            const key = yield this.getKey();
+            const pt = yield crypto.subtle.decrypt({ name: "AES-GCM", iv: new Uint8Array(blob.iv) }, key, new Uint8Array(blob.ct));
+            return new Uint8Array(pt);
+        });
+    }
+    remove(name) {
+        this.persistent.del(this.blobPrefix + name);
+        this.removeFromIndex(name);
+    }
+    list() {
+        return this.readIndex();
+    }
+    lock() {
+        this.session.del(this.cacheKey);
+    }
+    isUnlocked() {
+        return this.getRemainingUnlockMs() > 0;
+    }
+    getRemainingUnlockMs() {
+        const raw = this.session.get(this.cacheKey, "");
+        if (!raw)
+            return 0;
+        const cached = JSON.parse(raw);
+        const remaining = cached.expiresAt - Date.now();
+        if (remaining <= 0) {
+            this.session.del(this.cacheKey);
+            return 0;
+        }
+        return remaining;
+    }
+    getStatus() {
+        return {
+            registered: this.isRegistered(),
+            unlocked: this.isUnlocked(),
+            remainingUnlockMs: this.getRemainingUnlockMs(),
+        };
+    }
+    reset() {
+        this.persistent.del(this.credKey);
+        this.session.del(this.cacheKey);
+        for (const name of this.readIndex())
+            this.persistent.del(this.blobPrefix + name);
+        this.persistent.del(this.indexKey);
+    }
+    unlock() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.lock();
+            yield this.derivePrfKey();
+        });
+    }
+    getKey() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const cached = yield this.readCachedKey();
+            if (cached) {
+                this.touchCachedKey();
+                return cached;
+            }
+            return this.derivePrfKey();
+        });
+    }
+    derivePrfKey() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            this.assertSupported();
+            const credEncoded = this.persistent.get(this.credKey, "");
+            if (!credEncoded)
+                throw new Error("No credential registered. Call register() first.");
+            const credentialId = WebAuthnPrfOperation.decodeBase64(credEncoded);
+            const challenge = crypto.getRandomValues(new Uint8Array(32));
+            const assertion = yield navigator.credentials.get({
+                publicKey: {
+                    challenge,
+                    rpId: this.resolveRpId(),
+                    allowCredentials: [{ type: "public-key", id: credentialId }],
+                    userVerification: "required",
+                    timeout: this.ceremonyTimeoutMs,
+                    extensions: {
+                        prf: { eval: { first: this.prfSalt } },
+                    },
+                },
+            });
+            if (!assertion)
+                throw new Error("Authentication was cancelled.");
+            const ext = assertion.getClientExtensionResults();
+            const prfSecret = (_b = (_a = ext.prf) === null || _a === void 0 ? void 0 : _a.results) === null || _b === void 0 ? void 0 : _b.first;
+            if (!prfSecret)
+                throw new Error("Authenticator did not return a PRF result. The authenticator may not support the PRF extension.");
+            const rawBytes = ArrayBuffer.isView(prfSecret)
+                ? new Uint8Array(prfSecret.buffer, prfSecret.byteOffset, prfSecret.byteLength)
+                : new Uint8Array(prfSecret);
+            this.session.set(this.cacheKey, JSON.stringify({
+                rawKey: WebAuthnPrfOperation.encodeBase64(rawBytes),
+                expiresAt: Date.now() + this.idleTimeoutMs,
+            }));
+            return crypto.subtle.importKey("raw", rawBytes, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+        });
+    }
+    readCachedKey() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const raw = this.session.get(this.cacheKey, "");
+            if (!raw)
+                return null;
+            const cached = JSON.parse(raw);
+            if (Date.now() > cached.expiresAt) {
+                this.session.del(this.cacheKey);
+                return null;
+            }
+            const rawBytes = WebAuthnPrfOperation.decodeBase64(cached.rawKey);
+            return crypto.subtle.importKey("raw", rawBytes, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+        });
+    }
+    touchCachedKey() {
+        const raw = this.session.get(this.cacheKey, "");
+        if (!raw)
+            return;
+        const cached = JSON.parse(raw);
+        cached.expiresAt = Date.now() + this.idleTimeoutMs;
+        this.session.set(this.cacheKey, JSON.stringify(cached));
+    }
+    readIndex() {
+        const raw = this.persistent.get(this.indexKey, "");
+        if (!raw)
+            return [];
+        try {
+            return JSON.parse(raw);
+        }
+        catch (_a) {
+            return [];
+        }
+    }
+    writeIndex(names) {
+        this.persistent.set(this.indexKey, JSON.stringify(names));
+    }
+    addToIndex(name) {
+        const names = this.readIndex();
+        if (!names.includes(name)) {
+            names.push(name);
+            this.writeIndex(names);
+        }
+    }
+    removeFromIndex(name) {
+        const names = this.readIndex().filter(n => n !== name);
+        this.writeIndex(names);
+    }
+    resolveRpId() {
+        if (this.rpId)
+            return this.rpId;
+        if (typeof location === "undefined")
+            throw new Error("rpId must be provided when `location` is not available.");
+        return location.hostname;
+    }
+    assertSupported() {
+        if (!WebAuthnPrfOperation.isSupported())
+            throw new Error("WebAuthn is not available in this environment.");
+    }
+    static encodeBase64(bytes) {
+        let s = "";
+        for (let i = 0; i < bytes.length; i++)
+            s += String.fromCharCode(bytes[i]);
+        return btoa(s);
+    }
+    static decodeBase64(s) {
+        const bin = atob(s);
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            out[i] = bin.charCodeAt(i);
+        return out;
+    }
+}
+exports.WebAuthnPrfOperation = WebAuthnPrfOperation;
+WebAuthnPrfOperation.DEFAULT_SALT = new TextEncoder()
+    .encode("namirasoft.webauthn.prf.default.salt.v1");
+//# sourceMappingURL=WebAuthnPrfOperation.js.map

package/dist/WebAuthnPrfOperation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebAuthnPrfOperation.js","sourceRoot":"","sources":["../src/WebAuthnPrfOperation.ts"],"names":[],"mappings":";;;;;;;;;;;;AAyDA,MAAa,oBAAoB;IAqB7B,YAAY,OAAqC;;QAE7C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,MAAM,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,oBAAoB,CAAC,YAAY,CAAC;QACpE,IAAI,CAAC,aAAa,GAAG,MAAA,OAAO,CAAC,aAAa,mCAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5D,IAAI,CAAC,iBAAiB,GAAG,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAK,CAAC;QAE5D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAE/B,MAAM,EAAE,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,UAAU,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,gBAAgB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,GAAG,EAAE,aAAa,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,GAAG,EAAE,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,GAAG,EAAE,aAAa,CAAC;IACvC,CAAC;IAED,gBAAgB,CAAC,EAAU;QAEvB,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;YAAE,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,WAAW;QAEd,OAAO,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,mBAAmB,KAAK,WAAW,CAAC;IAC9F,CAAC;IAED,MAAM,CAAO,gCAAgC;;YAEzC,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE;gBAAE,OAAO,KAAK,CAAC;YACtD,IAAI,CAAC;gBAAC,OAAO,MAAM,mBAAmB,CAAC,6CAA6C,EAAE,CAAC;YAAC,CAAC;YACzF,WAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3B,CAAC;KAAA;IAEK,QAAQ;;;YAEV,IAAI,CAAC,eAAe,EAAE,CAAC;YAEvB,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAE1D,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;gBAClD,SAAS,EAAE;oBACP,SAAS;oBACT,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE;oBACjD,IAAI,EAAE;wBACF,EAAE,EAAE,MAAM;wBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,WAAW,EAAE,IAAI,CAAC,eAAe;qBACpC;oBACD,gBAAgB,EAAE;wBACd,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;wBAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;qBACpC;oBACD,sBAAsB,EAAE;wBACpB,WAAW,EAAE,WAAW;wBACxB,gBAAgB,EAAE,UAAU;qBAC/B;oBACD,OAAO,EAAE,IAAI,CAAC,iBAAiB;oBAC/B,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,EAA0C;iBAClE;aACJ,CAA+B,CAAC;YAEjC,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAEvE,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,UAAU,CAAC,yBAAyB,EAA0B,CAAC;YAC3E,MAAM,UAAU,GAAG,CAAA,MAAA,GAAG,CAAC,GAAG,0CAAE,OAAO,MAAK,IAAI,CAAC;YAE7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;YAEnF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;QACxC,CAAC;KAAA;IAED,YAAY;QAER,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IAEK,IAAI,CAAC,IAAY,EAAE,SAA8B;;YAEnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAoB,CAAC,CAAC;YAC3F,MAAM,IAAI,GAAG;gBACT,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;aACrC,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KAAA;IAEK,IAAI,CAAC,IAAY;;YAEnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;KAAA;IAEK,SAAS,CAAC,IAAY;;YAExB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,IAAI,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmC,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAClC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAChD,GAAG,EACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAC1B,CAAC;YACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;KAAA;IAED,MAAM,CAAC,IAAY;QAEf,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI;QAEA,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI;QAEA,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,UAAU;QAEN,OAAO,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,oBAAoB;QAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,IAAI,SAAS,IAAI,CAAC,EAClB,CAAC;YACG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC;QACb,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,SAAS;QAEL,OAAO;YACH,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;YAC/B,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE;YAC3B,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,EAAE;SACjD,CAAC;IACN,CAAC;IAKD,KAAK;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE;YAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAGK,MAAM;;YAER,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9B,CAAC;KAAA;IAEa,MAAM;;YAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,IAAI,MAAM,EACV,CAAC;gBACG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,OAAO,MAAM,CAAC;YAClB,CAAC;YACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,CAAC;KAAA;IAEa,YAAY;;;YAEtB,IAAI,CAAC,eAAe,EAAE,CAAC;YAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,oBAAoB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAEpE,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7D,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;gBAC9C,SAAS,EAAE;oBACP,SAAS;oBACT,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;oBACxB,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,YAA4B,EAAE,CAAC;oBAC5E,gBAAgB,EAAE,UAAU;oBAC5B,OAAO,EAAE,IAAI,CAAC,iBAAiB;oBAC/B,UAAU,EAAE;wBACR,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE;qBACD;iBAC5C;aACJ,CAA+B,CAAC;YAEjC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAEjE,MAAM,GAAG,GAAG,SAAS,CAAC,yBAAyB,EAA0B,CAAC;YAC1E,MAAM,SAAS,GAAG,MAAA,MAAA,GAAG,CAAC,GAAG,0CAAE,OAAO,0CAAE,KAAK,CAAC;YAC1C,IAAI,CAAC,SAAS;gBACV,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;YAEvH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC1C,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;gBAC9E,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;YAEhC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC3C,MAAM,EAAE,oBAAoB,CAAC,YAAY,CAAC,QAAQ,CAAC;gBACnD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa;aAC7C,CAAC,CAAC,CAAC;YAEJ,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC1B,KAAK,EACL,QAAwB,EACxB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACzB,CAAC;QACN,CAAC;KAAA;IAEa,aAAa;;YAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0C,CAAC;YACxE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EACjC,CAAC;gBACG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChC,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC1B,KAAK,EACL,QAAwB,EACxB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACzB,CAAC;QACN,CAAC;KAAA;IAEO,cAAc;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0C,CAAC;QACxE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAEO,SAAS;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;QAAC,CAAC;QAC3C,WAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IACxB,CAAC;IAEO,UAAU,CAAC,KAAe;QAE9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,UAAU,CAAC,IAAY;QAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EACzB,CAAC;YACG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,IAAY;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW;QAEf,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAChC,IAAI,OAAO,QAAQ,KAAK,WAAW;YAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAEO,eAAe;QAEnB,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE;YACnC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAiB;QAEzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,CAAS;QAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACf,CAAC;;AAxVL,oDAyVC;AAvV2B,iCAAY,GAAe,IAAI,WAAW,EAAE;KAC/D,MAAM,CAAC,yCAAyC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -6,3 +6,4 @@ export * from "./NSHeader";
 export * from "./NSNameParser";
 export * from "./NSReqHeader";
 export * from "./NSResHeader";
+export * from "./WebAuthnPrfOperation";

package/dist/index.js

@@ -22,4 +22,5 @@ __exportStar(require("./NSHeader"), exports);
 __exportStar(require("./NSNameParser"), exports);
 __exportStar(require("./NSReqHeader"), exports);
 __exportStar(require("./NSResHeader"), exports);
+__exportStar(require("./WebAuthnPrfOperation"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,oDAAkC;AAClC,oDAAkC;AAClC,6CAA2B;AAC3B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,oDAAkC;AAClC,oDAAkC;AAClC,6CAA2B;AAC3B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,yDAAuC"}

package/package.json

@@ -8,7 +8,7 @@
     "framework": "npm",
     "application": "package",
     "private": false,
-    "version": "1.5.2",
+    "version": "1.5.3",
     "author": "Amir Abolhasani",
     "license": "MIT",
     "main": "./dist/index.js",
@@ -18,6 +18,6 @@
     },
     "dependencies": {
         "axios": "^1.20.0",
-        "namirasoft-core": "^1.5.12"
+        "namirasoft-core": "^1.5.15"
     }
 }

package/src/WebAuthnPrfOperation.ts

@@ -0,0 +1,403 @@
+// WebAuthn PRF-based secret storage.
+//
+// Uses the WebAuthn `prf` extension (CTAP2 hmac-secret under the hood) to
+// derive a deterministic 32-byte AES key from a platform or roaming
+// authenticator, gated by user verification. The derived key encrypts/decrypts
+// user-supplied blobs. Raw key material is cached in a session-scoped IStorage
+// with a sliding idle timeout so the authenticator prompt only appears when
+// the cache is empty or expired.
+//
+// Nothing persistent ever contains key material: only the public credentialId
+// and AES-GCM ciphertext.
+//
+// Storage model — two IStorage instances, both sync string KV:
+//   - persistent  → survives browser restart. Holds credentialId + ciphertexts.
+//                   Caller passes e.g. IStorageLocal.
+//   - session     → ideally RAM-only / tab-scoped. Holds the derived AES key.
+//                   Caller passes e.g. IStorageSession.
+
+import { IStorage } from "namirasoft-core";
+
+export interface IWebAuthnPrfOperationOptions
+{
+    rpName: string;
+    persistent: IStorage;
+    session: IStorage;
+    rpId?: string;
+    userName?: string;
+    userDisplayName?: string;
+    prfSalt?: Uint8Array;
+    idleTimeoutMs?: number;
+    ceremonyTimeoutMs?: number;
+    namespace?: string;
+}
+
+export interface IWebAuthnPrfRegisterResult
+{
+    credentialId: Uint8Array;
+    prfEnabled: boolean;
+}
+
+export interface IWebAuthnPrfStatus
+{
+    registered: boolean;
+    unlocked: boolean;
+    remainingUnlockMs: number;
+}
+
+// Narrow local type for the PRF extension outputs. Declared inline so the code
+// compiles against DOM lib versions that predate the PRF addition.
+interface IPrfExtensionOutputs
+{
+    prf?: {
+        enabled?: boolean;
+        results?: { first?: ArrayBuffer | ArrayBufferView; second?: ArrayBuffer | ArrayBufferView };
+    };
+}
+
+export class WebAuthnPrfOperation
+{
+    private static readonly DEFAULT_SALT: Uint8Array = new TextEncoder()
+        .encode("namirasoft.webauthn.prf.default.salt.v1");
+
+    private readonly rpName: string;
+    private readonly rpId: string | undefined;
+    private readonly userName: string;
+    private readonly userDisplayName: string;
+    private readonly prfSalt: Uint8Array;
+    private idleTimeoutMs: number;
+    private readonly ceremonyTimeoutMs: number;
+
+    private readonly persistent: IStorage;
+    private readonly session: IStorage;
+
+    private readonly credKey: string;
+    private readonly cacheKey: string;
+    private readonly blobPrefix: string;
+    private readonly indexKey: string;
+
+    constructor(options: IWebAuthnPrfOperationOptions)
+    {
+        this.rpName = options.rpName;
+        this.rpId = options.rpId;
+        this.userName = options.userName ?? "user";
+        this.userDisplayName = options.userDisplayName ?? "User";
+        this.prfSalt = options.prfSalt ?? WebAuthnPrfOperation.DEFAULT_SALT;
+        this.idleTimeoutMs = options.idleTimeoutMs ?? 2 * 60 * 1000;
+        this.ceremonyTimeoutMs = options.ceremonyTimeoutMs ?? 60000;
+
+        this.persistent = options.persistent;
+        this.session = options.session;
+
+        const ns = options.namespace ?? "nsp.wapr";
+        this.credKey = `${ns}.credential-id`;
+        this.cacheKey = `${ns}.cached-key`;
+        this.blobPrefix = `${ns}.blob.`;
+        this.indexKey = `${ns}.blob-index`;
+    }
+
+    setIdleTimeoutMs(ms: number): void
+    {
+        if (ms && ms > 0) this.idleTimeoutMs = ms;
+    }
+
+    static isSupported(): boolean
+    {
+        return typeof window !== "undefined" && typeof window.PublicKeyCredential !== "undefined";
+    }
+
+    static async isPlatformAuthenticatorAvailable(): Promise<boolean>
+    {
+        if (!WebAuthnPrfOperation.isSupported()) return false;
+        try { return await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable(); }
+        catch { return false; }
+    }
+
+    async register(): Promise<IWebAuthnPrfRegisterResult>
+    {
+        this.assertSupported();
+
+        const challenge = crypto.getRandomValues(new Uint8Array(32));
+        const userId = crypto.getRandomValues(new Uint8Array(16));
+
+        const credential = await navigator.credentials.create({
+            publicKey: {
+                challenge,
+                rp: { name: this.rpName, id: this.resolveRpId() },
+                user: {
+                    id: userId,
+                    name: this.userName,
+                    displayName: this.userDisplayName,
+                },
+                pubKeyCredParams: [
+                    { type: "public-key", alg: -7 },    // ES256
+                    { type: "public-key", alg: -257 },  // RS256
+                ],
+                authenticatorSelection: {
+                    residentKey: "preferred",
+                    userVerification: "required",
+                },
+                timeout: this.ceremonyTimeoutMs,
+                extensions: { prf: {} } as AuthenticationExtensionsClientInputs,
+            },
+        }) as PublicKeyCredential | null;
+
+        if (!credential) throw new Error("Credential creation was cancelled.");
+
+        const credentialId = new Uint8Array(credential.rawId);
+        const ext = credential.getClientExtensionResults() as IPrfExtensionOutputs;
+        const prfEnabled = ext.prf?.enabled === true;
+
+        this.persistent.set(this.credKey, WebAuthnPrfOperation.encodeBase64(credentialId));
+
+        return { credentialId, prfEnabled };
+    }
+
+    isRegistered(): boolean
+    {
+        return this.persistent.get(this.credKey, "") !== "";
+    }
+
+    async save(name: string, plaintext: string | Uint8Array): Promise<void>
+    {
+        const key = await this.getKey();
+        const data = typeof plaintext === "string" ? new TextEncoder().encode(plaintext) : plaintext;
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+        const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, data as BufferSource);
+        const blob = {
+            iv: Array.from(iv),
+            ct: Array.from(new Uint8Array(ct)),
+        };
+        this.persistent.set(this.blobPrefix + name, JSON.stringify(blob));
+        this.addToIndex(name);
+    }
+
+    async load(name: string): Promise<string>
+    {
+        const bytes = await this.loadBytes(name);
+        return new TextDecoder().decode(bytes);
+    }
+
+    async loadBytes(name: string): Promise<Uint8Array>
+    {
+        const raw = this.persistent.get(this.blobPrefix + name, "");
+        if (!raw) throw new Error(`No encrypted blob named "${name}".`);
+        const blob = JSON.parse(raw) as { iv: number[]; ct: number[] };
+        const key = await this.getKey();
+        const pt = await crypto.subtle.decrypt(
+            { name: "AES-GCM", iv: new Uint8Array(blob.iv) },
+            key,
+            new Uint8Array(blob.ct),
+        );
+        return new Uint8Array(pt);
+    }
+
+    remove(name: string): void
+    {
+        this.persistent.del(this.blobPrefix + name);
+        this.removeFromIndex(name);
+    }
+
+    list(): string[]
+    {
+        return this.readIndex();
+    }
+
+    lock(): void
+    {
+        this.session.del(this.cacheKey);
+    }
+
+    isUnlocked(): boolean
+    {
+        return this.getRemainingUnlockMs() > 0;
+    }
+
+    getRemainingUnlockMs(): number
+    {
+        const raw = this.session.get(this.cacheKey, "");
+        if (!raw) return 0;
+        const cached = JSON.parse(raw) as { expiresAt: number };
+        const remaining = cached.expiresAt - Date.now();
+        if (remaining <= 0)
+        {
+            this.session.del(this.cacheKey);
+            return 0;
+        }
+        return remaining;
+    }
+
+    getStatus(): IWebAuthnPrfStatus
+    {
+        return {
+            registered: this.isRegistered(),
+            unlocked: this.isUnlocked(),
+            remainingUnlockMs: this.getRemainingUnlockMs(),
+        };
+    }
+
+    // Clears all local state (credentialId, blobs, cached key). The underlying
+    // passkey on the authenticator is NOT removed — the user must delete it
+    // from their OS passkey settings.
+    reset(): void
+    {
+        this.persistent.del(this.credKey);
+        this.session.del(this.cacheKey);
+        for (const name of this.readIndex())
+            this.persistent.del(this.blobPrefix + name);
+        this.persistent.del(this.indexKey);
+    }
+
+    // Forces a fresh PRF ceremony, bypassing the cache.
+    async unlock(): Promise<void>
+    {
+        this.lock();
+        await this.derivePrfKey();
+    }
+
+    private async getKey(): Promise<CryptoKey>
+    {
+        const cached = await this.readCachedKey();
+        if (cached)
+        {
+            this.touchCachedKey();
+            return cached;
+        }
+        return this.derivePrfKey();
+    }
+
+    private async derivePrfKey(): Promise<CryptoKey>
+    {
+        this.assertSupported();
+
+        const credEncoded = this.persistent.get(this.credKey, "");
+        if (!credEncoded) throw new Error("No credential registered. Call register() first.");
+        const credentialId = WebAuthnPrfOperation.decodeBase64(credEncoded);
+
+        const challenge = crypto.getRandomValues(new Uint8Array(32));
+
+        const assertion = await navigator.credentials.get({
+            publicKey: {
+                challenge,
+                rpId: this.resolveRpId(),
+                allowCredentials: [{ type: "public-key", id: credentialId as BufferSource }],
+                userVerification: "required",
+                timeout: this.ceremonyTimeoutMs,
+                extensions: {
+                    prf: { eval: { first: this.prfSalt } },
+                } as AuthenticationExtensionsClientInputs,
+            },
+        }) as PublicKeyCredential | null;
+
+        if (!assertion) throw new Error("Authentication was cancelled.");
+
+        const ext = assertion.getClientExtensionResults() as IPrfExtensionOutputs;
+        const prfSecret = ext.prf?.results?.first;
+        if (!prfSecret)
+            throw new Error("Authenticator did not return a PRF result. The authenticator may not support the PRF extension.");
+
+        const rawBytes = ArrayBuffer.isView(prfSecret)
+            ? new Uint8Array(prfSecret.buffer, prfSecret.byteOffset, prfSecret.byteLength)
+            : new Uint8Array(prfSecret);
+
+        this.session.set(this.cacheKey, JSON.stringify({
+            rawKey: WebAuthnPrfOperation.encodeBase64(rawBytes),
+            expiresAt: Date.now() + this.idleTimeoutMs,
+        }));
+
+        return crypto.subtle.importKey(
+            "raw",
+            rawBytes as BufferSource,
+            { name: "AES-GCM" },
+            false,
+            ["encrypt", "decrypt"],
+        );
+    }
+
+    private async readCachedKey(): Promise<CryptoKey | null>
+    {
+        const raw = this.session.get(this.cacheKey, "");
+        if (!raw) return null;
+        const cached = JSON.parse(raw) as { rawKey: string; expiresAt: number };
+        if (Date.now() > cached.expiresAt)
+        {
+            this.session.del(this.cacheKey);
+            return null;
+        }
+        const rawBytes = WebAuthnPrfOperation.decodeBase64(cached.rawKey);
+        return crypto.subtle.importKey(
+            "raw",
+            rawBytes as BufferSource,
+            { name: "AES-GCM" },
+            false,
+            ["encrypt", "decrypt"],
+        );
+    }
+
+    private touchCachedKey(): void
+    {
+        const raw = this.session.get(this.cacheKey, "");
+        if (!raw) return;
+        const cached = JSON.parse(raw) as { rawKey: string; expiresAt: number };
+        cached.expiresAt = Date.now() + this.idleTimeoutMs;
+        this.session.set(this.cacheKey, JSON.stringify(cached));
+    }
+
+    private readIndex(): string[]
+    {
+        const raw = this.persistent.get(this.indexKey, "");
+        if (!raw) return [];
+        try { return JSON.parse(raw) as string[]; }
+        catch { return []; }
+    }
+
+    private writeIndex(names: string[]): void
+    {
+        this.persistent.set(this.indexKey, JSON.stringify(names));
+    }
+
+    private addToIndex(name: string): void
+    {
+        const names = this.readIndex();
+        if (!names.includes(name))
+        {
+            names.push(name);
+            this.writeIndex(names);
+        }
+    }
+
+    private removeFromIndex(name: string): void
+    {
+        const names = this.readIndex().filter(n => n !== name);
+        this.writeIndex(names);
+    }
+
+    private resolveRpId(): string
+    {
+        if (this.rpId) return this.rpId;
+        if (typeof location === "undefined")
+            throw new Error("rpId must be provided when `location` is not available.");
+        return location.hostname;
+    }
+
+    private assertSupported(): void
+    {
+        if (!WebAuthnPrfOperation.isSupported())
+            throw new Error("WebAuthn is not available in this environment.");
+    }
+
+    private static encodeBase64(bytes: Uint8Array): string
+    {
+        let s = "";
+        for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+        return btoa(s);
+    }
+
+    private static decodeBase64(s: string): Uint8Array
+    {
+        const bin = atob(s);
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+        return out;
+    }
+}

package/src/index.ts

@@ -5,4 +5,5 @@ export * from "./NSCookiesHeader";
 export * from "./NSHeader";
 export * from "./NSNameParser";
 export * from "./NSReqHeader";
-export * from "./NSResHeader";
+export * from "./NSResHeader";
+export * from "./WebAuthnPrfOperation";