parseSecretVault

Parses and validates untrusted vault data into the typed PasskeySecretVault the other vault functions accept.

Import

import { 
function parseSecretVault(value: unknown): PasskeySecretVault
Parses and validates untrusted secret-vault JSON or objects.
Only version 1 vaults are accepted. The credential ID, PRF salt, nonce, and
ciphertext are validated as canonical base64url and length-checked. Unknown
fields are dropped from the returned vault.
@param ― value - Secret vault as JSON text or an untrusted object.
@returns ― A validated secret vault.
@throws ― MeraError with code VAULT_FORMAT_INVALID when required structure, version, or encoded data is invalid.
parseSecretVault } from "@category-labs/mera";

Usage

const 
const vault: PasskeySecretVault
vault = 
function parseSecretVault(value: unknown): PasskeySecretVault
Parses and validates untrusted secret-vault JSON or objects.
Only version 1 vaults are accepted. The credential ID, PRF salt, nonce, and
ciphertext are validated as canonical base64url and length-checked. Unknown
fields are dropped from the returned vault.
@param ― value - Secret vault as JSON text or an untrusted object.
@returns ― A validated secret vault.
@throws ― MeraError with code VAULT_FORMAT_INVALID when required structure, version, or encoded data is invalid.
parseSecretVault(
var localStorage: Storage
MDN Reference
localStorage.
Storage.getItem(key: string): string | null
The getItem() method of the Storage interface, when passed a key name, will return that key's value, or null if the key does not exist, in the given Storage object.
MDN Reference
getItem("vault"));

Parameters

value

Type: unknown
Required

The secret vault as JSON text or an untrusted object. Strings are JSON-parsed first; objects are validated directly. Anything else fails validation, including the null a storage read returns when nothing is stored.

Returns

import type { 
type PasskeySecretVault = {
    readonly version: 1;
    readonly credential: PasskeyCredentialMetadata;
    readonly prfSalt: string;
    readonly nonce: string;
    readonly ciphertext: string;
}
Versioned JSON-safe vault holding one secret encrypted behind a passkey.
The secret bytes are opaque to the library.
PasskeySecretVault } from "@category-labs/mera";

type 
type ReturnType = {
    readonly version: 1;
    readonly credential: PasskeyCredentialMetadata;
    readonly prfSalt: string;
    readonly nonce: string;
    readonly ciphertext: string;
}
ReturnType = 
type PasskeySecretVault = {
    readonly version: 1;
    readonly credential: PasskeyCredentialMetadata;
    readonly prfSalt: string;
    readonly nonce: string;
    readonly ciphertext: string;
}
Versioned JSON-safe vault holding one secret encrypted behind a passkey.
The secret bytes are opaque to the library.
PasskeySecretVault;

A validated vault with version, credential, prfSalt, nonce, and ciphertext. Its credential ID, PRF salt, nonce, and ciphertext are canonical base64url with checked lengths (salt 32 bytes, nonce 12 bytes, ciphertext at least the 16-byte GCM tag). Unknown fields are dropped. The secret vault format page documents every field.

Errors

VAULT_FORMAT_INVALID: the required structure, version, or encoded data is invalid. The underlying parse failure, when there is one, is attached as cause.

See also

Secret vault format: the v1 schema this function enforces.
Use an existing secret: parse-then-unlock in context.