@1shotapi/ows-signer 0.4.0 → 0.4.2

package/README.md

@@ -68,8 +68,8 @@ Ceremony UI params (optional on WebAuthn-triggering methods): `explanationHeader
 
 ## PRF labels
 
-- `ows-v1/secp256k1`
-- `ows-v1/ed25519` (derived via HKDF from PRF output)
+- `ows-v1/secp256k1` (HKDF from PRF output, rejection sampling into the curve order)
+- `ows-v1/ed25519` (HKDF from the secp256k1 scalar — same material as `signDigest` / recovery)
 - `ows-v1/aes256-gcm` (HKDF from the secp256k1 scalar — same material as `signDigest`)
 
 ## Recovery envelope

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1shotapi/ows-signer",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "OWS Signing Layer — plain JavaScript WebAuthn PRF key custody with curve-based signing (on-chain via EIP-8244)",
   "type": "module",
   "files": [

package/src/constants.js

@@ -4,6 +4,7 @@ export const API_VERSION = 1;
 export const SIGNER_VERSION = "0.1.0";
 
 export const PRF_LABEL_SECP256K1 = new TextEncoder().encode("ows-v1/secp256k1");
+/** HKDF info for Ed25519 — IKM is the secp256k1 scalar (`signDigest` material). */
 export const PRF_LABEL_ED25519 = new TextEncoder().encode("ows-v1/ed25519");
 /** HKDF info for AES-256-GCM — IKM is the secp256k1 scalar (`signDigest` material). */
 export const PRF_LABEL_AES256 = new TextEncoder().encode("ows-v1/aes256-gcm");

package/src/crypto/prf.js

@@ -76,16 +76,27 @@ export async function deriveScalarFromPrf(prfBuffer, infoLabel) {
 }
 
 /**
- * @param {ArrayBuffer} prfBuffer
+ * HKDF info `ows-v1/ed25519` — IKM is the secp256k1 scalar (`signDigest`
+ * material), not raw PRF. Recovery / import only hold that scalar, so Ed25519
+ * must chain through it or a recovery session would emit a different pubkey.
+ *
+ * @param {Uint8Array} secp256k1Scalar
  * @returns {Promise<Uint8Array>}
  */
-export async function deriveEd25519SeedFromPrf(prfBuffer) {
-  return hkdfExpand(prfBuffer, PRF_LABEL_ED25519, 32);
+export async function deriveEd25519SeedFromSecp256k1Scalar(secp256k1Scalar) {
+  return hkdfExpand(
+    secp256k1Scalar.buffer.slice(
+      secp256k1Scalar.byteOffset,
+      secp256k1Scalar.byteOffset + secp256k1Scalar.byteLength,
+    ),
+    PRF_LABEL_ED25519,
+    32,
+  );
 }
 
 /**
  * @param {PublicKeyCredential} credential
- * @returns {Promise<{ secp256k1PrivateKey: Uint8Array, secp256k1PublicKey: Uint8Array, ed25519PublicKey: Uint8Array }>}
+ * @returns {Promise<{ secp256k1PrivateKey: Uint8Array, secp256k1PublicKey: Uint8Array, ed25519Seed: Uint8Array, ed25519PublicKey: Uint8Array }>}
  */
 export async function deriveKeysFromCredential(credential) {
   const rawPrf = /** @type {{ prf?: { results?: { first?: unknown } } }} */ (
@@ -100,12 +111,18 @@ export async function deriveKeysFromCredential(credential) {
     prfBuffer,
     PRF_LABEL_SECP256K1,
   );
-  const ed25519Seed = await deriveEd25519SeedFromPrf(prfBuffer);
+  const ed25519Seed =
+    await deriveEd25519SeedFromSecp256k1Scalar(secp256k1PrivateKey);
   // Uncompressed (0x04 ‖ X ‖ Y) — required by viem `publicKeyToAddress`.
   const secp256k1PublicKey = secpGetPublicKey(secp256k1PrivateKey, false);
   const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
 
-  return { secp256k1PrivateKey, secp256k1PublicKey, ed25519PublicKey };
+  return {
+    secp256k1PrivateKey,
+    secp256k1PublicKey,
+    ed25519Seed,
+    ed25519PublicKey,
+  };
 }
 
 /**

package/src/debug.js

@@ -1,13 +1,74 @@
 const DEBUG_KEY = "ows-signer:debug";
 
+/**
+ * True when a chrome-extension:// (or similar) page is an ancestor.
+ * Chromium exposes this via `location.ancestorOrigins` even when top is
+ * cross-origin — useful for side-panel embeds where WebAuthn often misbehaves.
+ * @returns {boolean}
+ */
+export function isExtensionAncestor() {
+  try {
+    const origins = globalThis.location?.ancestorOrigins;
+    if (!origins || origins.length === 0) return false;
+    for (let i = 0; i < origins.length; i++) {
+      const origin = origins[i];
+      if (
+        typeof origin === "string" &&
+        (origin.startsWith("chrome-extension://") ||
+          origin.startsWith("moz-extension://") ||
+          origin.startsWith("safari-web-extension://"))
+      ) {
+        return true;
+      }
+    }
+  } catch {
+    // ignore
+  }
+  return false;
+}
+
 /** @returns {boolean} */
 export function isDebug() {
   if (typeof globalThis === "undefined") return false;
-  return (
-    globalThis.OWS_SIGNER_DEBUG === true ||
-    (typeof localStorage !== "undefined" &&
-      localStorage.getItem(DEBUG_KEY) === "1")
-  );
+  if (globalThis.OWS_SIGNER_DEBUG === true) return true;
+  // Always log in extension side-panel embeds — GPM get() often hangs with no UI.
+  if (isExtensionAncestor()) return true;
+  try {
+    return (
+      typeof localStorage !== "undefined" &&
+      localStorage.getItem(DEBUG_KEY) === "1"
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** @returns {Record<string, unknown>} */
+export function describeCeremonyEnvironment() {
+  let visibilityState = null;
+  let hasFocus = null;
+  try {
+    visibilityState = document.visibilityState;
+    hasFocus = document.hasFocus?.() ?? null;
+  } catch {
+    // ignore
+  }
+  let ancestorOrigins = null;
+  try {
+    ancestorOrigins = globalThis.location?.ancestorOrigins
+      ? Array.from(globalThis.location.ancestorOrigins)
+      : null;
+  } catch {
+    ancestorOrigins = null;
+  }
+  return {
+    extensionAncestor: isExtensionAncestor(),
+    ancestorOrigins,
+    visibilityState,
+    hasFocus,
+    userActivationActive: navigator.userActivation?.isActive ?? null,
+    userActivationHasBeenActive: navigator.userActivation?.hasBeenActive ?? null,
+  };
 }
 
 /** @param {...unknown} args */

package/src/handlers.js

@@ -1,7 +1,6 @@
 import {
   API_VERSION,
   METHODS,
-  PRF_LABEL_ED25519,
   SIGN_SCHEMES,
   SIGNER_VERSION,
 } from "./constants.js";
@@ -10,9 +9,8 @@ import {
   encryptAes256Batch,
 } from "./crypto/aes256.js";
 import {
-  deriveEd25519SeedFromPrf,
+  deriveEd25519SeedFromSecp256k1Scalar,
   deriveKeysFromCredential,
-  hkdfExpand,
   normalizePrfOutputToArrayBuffer,
 } from "./crypto/prf.js";
 import { getPublicKeyAsync as edGetPublicKeyAsync } from "./crypto/vendor/noble-ed25519.js";
@@ -47,34 +45,6 @@ import {
   getCosePublicKeyBase64Url,
 } from "./webauthn.js";
 
-/**
- * @param {PublicKeyCredential} credential
- * @returns {Promise<Uint8Array>}
- */
-async function ed25519SeedFromCredential(credential) {
-  const prfRaw = /** @type {{ prf?: { results?: { first?: unknown } } }} */ (
-    credential.getClientExtensionResults()
-  ).prf?.results?.first;
-  const prfBuf = normalizePrfOutputToArrayBuffer(prfRaw);
-  if (!prfBuf) throw new Error("noPrf");
-  return deriveEd25519SeedFromPrf(prfBuf);
-}
-
-/**
- * @param {Uint8Array} secp256k1Scalar
- * @returns {Promise<Uint8Array>}
- */
-async function ed25519SeedFromSecp256k1Scalar(secp256k1Scalar) {
-  return hkdfExpand(
-    secp256k1Scalar.buffer.slice(
-      secp256k1Scalar.byteOffset,
-      secp256k1Scalar.byteOffset + secp256k1Scalar.byteLength,
-    ),
-    PRF_LABEL_ED25519,
-    32,
-  );
-}
-
 /**
  * @param {string} targetOrigin
  * @param {string | undefined} correlationId
@@ -311,6 +281,7 @@ async function handleCreateCredential(params, correlationId, targetOrigin) {
       secp256k1PublicKey: to0xHex(keys.secp256k1PublicKey),
     });
     zeroize(keys.secp256k1PrivateKey);
+    zeroize(keys.ed25519Seed);
   });
 }
 
@@ -432,7 +403,7 @@ async function handleSignDigest(params, correlationId, targetOrigin) {
   if (hasRecoverySession()) {
     const cached = getRecoveryPrivateKey();
     if (!cached) throw new Error("recoverySessionEmpty");
-    const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(cached);
+    const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(cached);
     try {
       const results = await signParsedDigests(
         items,
@@ -455,7 +426,6 @@ async function handleSignDigest(params, correlationId, targetOrigin) {
       () => getPasskeyAssertion(undefined, credentialId),
     );
     const keys = await deriveKeysFromCredential(credential);
-    const ed25519Seed = await ed25519SeedFromCredential(credential);
     emitKeyDerived(
       targetOrigin,
       correlationId,
@@ -466,7 +436,7 @@ async function handleSignDigest(params, correlationId, targetOrigin) {
       const results = await signParsedDigests(
         items,
         keys.secp256k1PrivateKey,
-        ed25519Seed,
+        keys.ed25519Seed,
         credentialId ?? getCredentialId(credential),
       );
       emitEvent(window.parent, targetOrigin, "DigestSigned", correlationId, {
@@ -474,7 +444,7 @@ async function handleSignDigest(params, correlationId, targetOrigin) {
       });
     } finally {
       zeroize(keys.secp256k1PrivateKey);
-      zeroize(ed25519Seed);
+      zeroize(keys.ed25519Seed);
     }
   });
 }
@@ -506,6 +476,7 @@ async function handleRevealPrivateKey(params, correlationId, targetOrigin) {
       await dismiss;
     } finally {
       zeroize(keys.secp256k1PrivateKey);
+      zeroize(keys.ed25519Seed);
     }
   });
   emitEvent(
@@ -543,7 +514,7 @@ async function handleImportPrivateKey(_params, correlationId, targetOrigin) {
   setRecoveryPrivateKey(privateKey);
 
   const secp256k1PublicKey = secpGetPublicKey(privateKey, false);
-  const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(privateKey);
+  const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(privateKey);
   const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
   emitKeyDerived(
     targetOrigin,
@@ -607,7 +578,7 @@ async function handleCreateRecoveryData(params, correlationId, targetOrigin) {
     const cached = getRecoveryPrivateKey();
     if (!cached) throw new Error("recoverySessionEmpty");
     const secp256k1PublicKey = secpGetPublicKey(cached, false);
-    const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(cached);
+    const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(cached);
     const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
     emitKeyDerived(
       targetOrigin,
@@ -645,6 +616,7 @@ async function handleCreateRecoveryData(params, correlationId, targetOrigin) {
       passphrase,
     );
     zeroize(keys.secp256k1PrivateKey);
+    zeroize(keys.ed25519Seed);
     emitEvent(
       window.parent,
       targetOrigin,
@@ -683,7 +655,7 @@ async function handleRecoverKey(params, correlationId, targetOrigin) {
   // Emit public keys so OWSSigner can cache addresses (uncompressed secp256k1 —
   // viem publicKeyToAddress requires 0x04 ‖ X ‖ Y).
   const secp256k1PublicKey = secpGetPublicKey(privateKey, false);
-  const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(privateKey);
+  const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(privateKey);
   const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
   emitKeyDerived(
     targetOrigin,
@@ -787,6 +759,7 @@ async function handleEncryptAES256(params, correlationId, targetOrigin) {
       });
     } finally {
       zeroize(keys.secp256k1PrivateKey);
+      zeroize(keys.ed25519Seed);
     }
   });
 }
@@ -847,6 +820,7 @@ async function handleDecryptAES256(params, correlationId, targetOrigin) {
       });
     } finally {
       zeroize(keys.secp256k1PrivateKey);
+      zeroize(keys.ed25519Seed);
     }
   });
 }
@@ -901,6 +875,7 @@ async function handleGetPublicKey(params, correlationId, targetOrigin) {
     }
 
     zeroize(keys.secp256k1PrivateKey);
+    zeroize(keys.ed25519Seed);
   });
 }
 
@@ -1031,7 +1006,6 @@ async function handleExecuteBatch(params, correlationId, targetOrigin) {
         () => getPasskeyAssertion(challenge, credentialId),
       );
       const keys = await deriveKeysFromCredential(credential);
-      const ed25519Seed = await ed25519SeedFromCredential(credential);
       emitKeyDerived(
         targetOrigin,
         correlationId,
@@ -1041,7 +1015,7 @@ async function handleExecuteBatch(params, correlationId, targetOrigin) {
       try {
         await runOps(
           keys.secp256k1PrivateKey,
-          ed25519Seed,
+          keys.ed25519Seed,
           keys.secp256k1PublicKey,
           keys.ed25519PublicKey,
           credentialId ?? getCredentialId(credential),
@@ -1049,7 +1023,7 @@ async function handleExecuteBatch(params, correlationId, targetOrigin) {
         );
       } finally {
         zeroize(keys.secp256k1PrivateKey);
-        zeroize(ed25519Seed);
+        zeroize(keys.ed25519Seed);
       }
     });
     return;
@@ -1057,7 +1031,7 @@ async function handleExecuteBatch(params, correlationId, targetOrigin) {
 
   const cached = getRecoveryPrivateKey();
   if (!cached) throw new Error("recoverySessionEmpty");
-  const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(cached);
+  const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(cached);
   const secp256k1PublicKey = secpGetPublicKey(cached, false);
   const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
   emitKeyDerived(
@@ -1096,6 +1070,13 @@ function handleError(error, correlationId, targetOrigin) {
     return;
   }
 
+  if (name === "AbortError" || message === "ceremonyCancelled") {
+    emitEvent(window.parent, targetOrigin, "SignDenied", correlationId, {
+      reason: "ceremonyCancelled",
+    });
+    return;
+  }
+
   if (name === "NotAllowedError" || message.includes("NotAllowed")) {
     emitEvent(window.parent, targetOrigin, "NotAllowed", correlationId, {
       reason: message || "notAllowed",
@@ -1105,7 +1086,7 @@ function handleError(error, correlationId, targetOrigin) {
 
   if (message === "ceremonyInProgress") {
     emitEvent(window.parent, targetOrigin, "InvalidRequest", correlationId, {
-      reason: "ceremonyInProgress",
+      reason: "A request is already pending.",
     });
     return;
   }

package/src/main.js

@@ -2,6 +2,7 @@ import { handleRequest } from "./handlers.js";
 import {
   abandonCeremony,
   isValidNesting,
+  setCancelConfirmHook,
   setTrustedParentOrigin,
 } from "./state.js";
 import { cancelPendingCeremonyConfirm, initUi } from "./ui.js";
@@ -13,13 +14,14 @@ function bootstrap() {
     throw new Error("OWS signer root element missing");
   }
   initUi(root);
+  setCancelConfirmHook(cancelPendingCeremonyConfirm);
 
   if (!isValidNesting()) {
     console.error("[ows-signer] Must be embedded in a wallet iframe (double iframe).");
     return;
   }
 
-  window.addEventListener("message", async (event) => {
+  window.addEventListener("message", (event) => {
     if (!isValidParentMessage(event)) return;
 
     const data = event.data;
@@ -29,7 +31,9 @@ function bootstrap() {
       /** @type {{ kind?: unknown }} */ (data).kind === "cancel"
     ) {
       setTrustedParentOrigin(event.origin);
-      await abandonCeremony(cancelPendingCeremonyConfirm);
+      // Do not await — parent timeout must unlock immediately even if a prior
+      // handleRequest is still suspended on credentials.get.
+      void abandonCeremony(cancelPendingCeremonyConfirm);
       return;
     }
 
@@ -41,15 +45,18 @@ function bootstrap() {
       data
     );
 
-    // Drop a stuck Confirm wait (e.g. parent timed out) before starting anew.
-    await abandonCeremony(cancelPendingCeremonyConfirm);
-
-    await handleRequest(
-      method,
-      /** @type {Record<string, unknown>} */ (params),
-      correlationId,
-      targetOrigin,
-    );
+    void (async () => {
+      // Drop a stuck Confirm wait (e.g. parent timed out) before starting anew.
+      await abandonCeremony(cancelPendingCeremonyConfirm);
+      await handleRequest(
+        method,
+        /** @type {Record<string, unknown>} */ (params),
+        correlationId,
+        targetOrigin,
+      );
+    })().catch((error) => {
+      console.error("[ows-signer] request handler failed", error);
+    });
   });
 }
 

package/src/state.js

@@ -4,6 +4,9 @@ let recoveryPrivateKey = null;
 /** @type {Promise<unknown> | null} */
 let ceremonyPromise = null;
 
+/** @type {AbortController | null} */
+let ceremonyAbortController = null;
+
 /** @type {string | null} */
 let trustedParentOrigin = null;
 
@@ -70,15 +73,65 @@ export function clearRecoveryPrivateKey() {
   }
 }
 
+/**
+ * AbortSignal for the active ceremony (WebAuthn `credentials.get/create`).
+ * @returns {AbortSignal | undefined}
+ */
+export function getCeremonyAbortSignal() {
+  return ceremonyAbortController?.signal;
+}
+
+/** @type {(() => void) | null} */
+let cancelConfirmHook = null;
+
+/**
+ * Branding/UI registers the Confirm-cancel hook so steal / abandon can dismiss
+ * the panel without a circular import on `ui.js`.
+ *
+ * @param {(() => void) | null} hook
+ */
+export function setCancelConfirmHook(hook) {
+  cancelConfirmHook = hook;
+}
+
+/**
+ * Force-drop the ceremony lock and abort in-flight WebAuthn.
+ * Safe to call when no ceremony is active.
+ */
+function forceUnlockCeremony() {
+  try {
+    cancelConfirmHook?.();
+  } catch {
+    // ignore
+  }
+  const abort = ceremonyAbortController;
+  const pending = ceremonyPromise;
+  ceremonyPromise = null;
+  ceremonyAbortController = null;
+  try {
+    abort?.abort();
+  } catch {
+    // ignore
+  }
+  if (pending) {
+    void pending.catch(() => {
+      // Prior ceremony was cancelled, aborted, or failed.
+    });
+  }
+}
+
 /**
  * @param {() => Promise<T>} fn
  * @returns {Promise<T>}
  * @template T
  */
 export async function withCeremony(fn) {
+  // Steal any leftover lock (e.g. hung credentials.get after parent timeout).
+  // Throwing ceremonyInProgress left Branding retries stuck after RPC timeout.
   if (ceremonyPromise) {
-    throw new Error("ceremonyInProgress");
+    forceUnlockCeremony();
   }
+  ceremonyAbortController = new AbortController();
   const promise = fn();
   ceremonyPromise = promise;
   try {
@@ -86,24 +139,27 @@ export async function withCeremony(fn) {
   } finally {
     if (ceremonyPromise === promise) {
       ceremonyPromise = null;
+      ceremonyAbortController = null;
     }
   }
 }
 
 /**
- * Cancel an open Confirm UI and wait for any in-flight ceremony lock to clear.
- * Used when the parent times out or starts a new RPC.
+ * Cancel Confirm UI, abort in-flight WebAuthn, and unlock the ceremony immediately.
+ * Used when the parent times out or starts a new RPC. Must not wait forever on
+ * hung `credentials.get` — that left Branding retries stuck with ceremonyInProgress.
  *
- * @param {() => void} cancelPendingConfirm
+ * @param {() => void} [_cancelPendingConfirm]
  */
-export async function abandonCeremony(cancelPendingConfirm) {
-  cancelPendingConfirm();
-  const pending = ceremonyPromise;
-  if (!pending) return;
-  try {
-    await pending;
-  } catch {
-    // Prior ceremony was cancelled or failed — lock clears in withCeremony finally.
+export async function abandonCeremony(_cancelPendingConfirm) {
+  // Prefer the registered hook (always current); keep the argument for callers.
+  forceUnlockCeremony();
+  if (typeof _cancelPendingConfirm === "function") {
+    try {
+      _cancelPendingConfirm();
+    } catch {
+      // ignore — hook already ran
+    }
   }
 }
 

package/src/ui.js

@@ -1,4 +1,5 @@
 import { to0xHex } from "./hex.js";
+import { debugLog, describeCeremonyEnvironment } from "./debug.js";
 
 /** @type {HTMLElement | null} */
 let root = null;
@@ -223,6 +224,7 @@ export function promptCeremonyConfirm(fields, runOnConfirm) {
       try {
         // Start WebAuthn in the same turn as the click (no prior await).
         // Keep copy visible until the ceremony settles.
+        debugLog("ceremony Confirm click", describeCeremonyEnvironment());
         Promise.resolve(runOnConfirm()).then(settleSuccess, settleFailure);
       } catch (error) {
         settleFailure(error);

package/src/webauthn.js

@@ -1,7 +1,11 @@
-import { getRpId } from "./state.js";
+import { getCeremonyAbortSignal, getRpId } from "./state.js";
 import { PRF_LABEL_SECP256K1 } from "./constants.js";
 import { bufferToBase64Url } from "./hex.js";
-import { debugLog, describePrfExtensionResults } from "./debug.js";
+import {
+  debugLog,
+  describeCeremonyEnvironment,
+  describePrfExtensionResults,
+} from "./debug.js";
 
 /**
  * @param {Uint8Array} [userId]
@@ -27,10 +31,9 @@ export async function createPasskeyCredential(name, options = {}) {
     ? Uint8Array.from(atob(options.userId), (c) => c.charCodeAt(0))
     : randomUserId();
   const displayName = options.userDisplayName ?? name;
+  const signal = getCeremonyAbortSignal();
 
-  debugLog("createPasskeyCredential userActivation.isActive", {
-    isActive: navigator.userActivation?.isActive ?? false,
-  });
+  debugLog("createPasskeyCredential start", describeCeremonyEnvironment());
 
   const credential = await navigator.credentials.create({
     publicKey: {
@@ -41,7 +44,12 @@ export async function createPasskeyCredential(name, options = {}) {
         displayName,
       },
       challenge: crypto.getRandomValues(new Uint8Array(32)),
-      pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+      // Chromium warns when ES256 (-7) is present without RS256 (-257).
+      // Prefer ES256 (PRF); RS256 is listed for authenticator compatibility.
+      pubKeyCredParams: [
+        { type: "public-key", alg: -7 },
+        { type: "public-key", alg: -257 },
+      ],
       authenticatorSelection: {
         residentKey: "required",
         requireResidentKey: true,
@@ -55,6 +63,7 @@ export async function createPasskeyCredential(name, options = {}) {
         },
       },
     },
+    ...(signal ? { signal } : {}),
   });
 
   if (!credential || !(credential instanceof PublicKeyCredential)) {
@@ -79,27 +88,48 @@ export async function getPasskeyAssertion(challenge, credentialId) {
         },
       ]
     : undefined;
+  const signal = getCeremonyAbortSignal();
 
-  const credential = await navigator.credentials.get({
-    publicKey: {
-      challenge: challenge ?? crypto.getRandomValues(new Uint8Array(32)),
-      rpId,
-      userVerification: "required",
-      allowCredentials,
-      extensions: {
-        prf: {
-          eval: {
-            first: PRF_LABEL_SECP256K1,
+  debugLog("getPasskeyAssertion start", {
+    ...describeCeremonyEnvironment(),
+    rpId,
+    hasChallenge: Boolean(challenge),
+    hasAllowCredentials: Boolean(allowCredentials),
+    credentialIdPrefix:
+      typeof credentialId === "string" ? credentialId.slice(0, 8) : null,
+  });
+
+  let credential;
+  try {
+    credential = await navigator.credentials.get({
+      publicKey: {
+        challenge: challenge ?? crypto.getRandomValues(new Uint8Array(32)),
+        rpId,
+        userVerification: "required",
+        allowCredentials,
+        extensions: {
+          prf: {
+            eval: {
+              first: PRF_LABEL_SECP256K1,
+            },
           },
         },
       },
-    },
-  });
+      ...(signal ? { signal } : {}),
+    });
+  } catch (error) {
+    debugLog("getPasskeyAssertion rejected", {
+      ...describeCeremonyEnvironment(),
+      name: error instanceof Error ? error.name : typeof error,
+      message: error instanceof Error ? error.message : String(error),
+    });
+    throw error;
+  }
 
   if (!credential || !(credential instanceof PublicKeyCredential)) {
     throw new Error("credentialGetFailed");
   }
-  debugLog("getPasskeyAssertion", describePrfExtensionResults(credential));
+  debugLog("getPasskeyAssertion ok", describePrfExtensionResults(credential));
   return credential;
 }