parseSecretVault

Parses and validates untrusted vault data into the typed PasskeySecretVault the other vault functions accept.

Import

import { parseSecretVault } from "@category-labs/mera";

Usage

const vault = parseSecretVault(localStorage.getItem("vault"));

Parameters

value

• Type: unknown
• Required

The secret vault as JSON text or an untrusted object. Strings are JSON-parsed first; objects are validated directly. Anything else fails validation, including the null a storage read returns when nothing is stored.

Returns

A validated PasskeySecretVault. Its credential ID, PRF salt, nonce, and ciphertext are canonical base64url with checked lengths (salt 32 bytes, nonce 12 bytes, ciphertext at least the 16-byte GCM tag). Unknown fields are dropped.

Errors

• VAULT_FORMAT_INVALID: the required structure, version, or encoded data is invalid. The underlying parse failure, when there is one, is attached as cause.

See also

• Secret vault format: the v1 schema this function enforces.
• Use an existing secret: parse-then-unlock in context.