function wrapDataKeyForPassword
wrapDataKeyForPassword(
dataKey: CryptoKey,
password: string,
passwordHash: PasswordHash,
): Promise<WrappedKey>

Wrap a DATA_KEY under the password-bound (v2) KEK in one step. The single place new wrapped_data_keys are produced — setup, login migration, invite acceptance, password change, and superuser creation all go through here, so the derive-then-wrap pair lives in exactly one spot.

Parameters

dataKey: CryptoKey
password: string
passwordHash: PasswordHash

Return Type

Promise<WrappedKey>

Usage

import { wrapDataKeyForPassword } from "docs/crypto.ts";