@authsignal/browser 0.0.21 → 0.1.0

package/dist/index.mjs

@@ -3362,18 +3362,1112 @@ var PopupHandler = /** @class */ (function () {
     return PopupHandler;
 }());
 
+/******************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+
+function __rest(s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+}
+
+function __awaiter(thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+}
+
+function __generator(thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+}
+
+/* [@simplewebauthn/browser@7.2.0] */
+function utf8StringToBuffer(value) {
+    return new TextEncoder().encode(value);
+}
+
+function bufferToBase64URLString(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let str = '';
+    for (const charCode of bytes) {
+        str += String.fromCharCode(charCode);
+    }
+    const base64String = btoa(str);
+    return base64String.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+
+function base64URLStringToBuffer(base64URLString) {
+    const base64 = base64URLString.replace(/-/g, '+').replace(/_/g, '/');
+    const padLength = (4 - (base64.length % 4)) % 4;
+    const padded = base64.padEnd(base64.length + padLength, '=');
+    const binary = atob(padded);
+    const buffer = new ArrayBuffer(binary.length);
+    const bytes = new Uint8Array(buffer);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return buffer;
+}
+
+function browserSupportsWebAuthn() {
+    return (window?.PublicKeyCredential !== undefined && typeof window.PublicKeyCredential === 'function');
+}
+
+function toPublicKeyCredentialDescriptor(descriptor) {
+    const { id } = descriptor;
+    return {
+        ...descriptor,
+        id: base64URLStringToBuffer(id),
+        transports: descriptor.transports,
+    };
+}
+
+function isValidDomain(hostname) {
+    return (hostname === 'localhost' || /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(hostname));
+}
+
+class WebAuthnError extends Error {
+    code;
+    constructor({ message, code, cause, name, }) {
+        super(message, { cause });
+        this.name = name ?? cause.name;
+        this.code = code;
+    }
+}
+
+function identifyRegistrationError({ error, options, }) {
+    const { publicKey } = options;
+    if (!publicKey) {
+        throw Error('options was missing required publicKey property');
+    }
+    if (error.name === 'AbortError') {
+        if (options.signal instanceof AbortSignal) {
+            return new WebAuthnError({
+                message: 'Registration ceremony was sent an abort signal',
+                code: 'ERROR_CEREMONY_ABORTED',
+                cause: error,
+            });
+        }
+    }
+    else if (error.name === 'ConstraintError') {
+        if (publicKey.authenticatorSelection?.requireResidentKey === true) {
+            return new WebAuthnError({
+                message: 'Discoverable credentials were required but no available authenticator supported it',
+                code: 'ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT',
+                cause: error,
+            });
+        }
+        else if (publicKey.authenticatorSelection?.userVerification === 'required') {
+            return new WebAuthnError({
+                message: 'User verification was required but no available authenticator supported it',
+                code: 'ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT',
+                cause: error,
+            });
+        }
+    }
+    else if (error.name === 'InvalidStateError') {
+        return new WebAuthnError({
+            message: 'The authenticator was previously registered',
+            code: 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED',
+            cause: error
+        });
+    }
+    else if (error.name === 'NotAllowedError') {
+        return new WebAuthnError({
+            message: error.message,
+            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',
+            cause: error,
+        });
+    }
+    else if (error.name === 'NotSupportedError') {
+        const validPubKeyCredParams = publicKey.pubKeyCredParams.filter(param => param.type === 'public-key');
+        if (validPubKeyCredParams.length === 0) {
+            return new WebAuthnError({
+                message: 'No entry in pubKeyCredParams was of type "public-key"',
+                code: 'ERROR_MALFORMED_PUBKEYCREDPARAMS',
+                cause: error,
+            });
+        }
+        return new WebAuthnError({
+            message: 'No available authenticator supported any of the specified pubKeyCredParams algorithms',
+            code: 'ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG',
+            cause: error,
+        });
+    }
+    else if (error.name === 'SecurityError') {
+        const effectiveDomain = window.location.hostname;
+        if (!isValidDomain(effectiveDomain)) {
+            return new WebAuthnError({
+                message: `${window.location.hostname} is an invalid domain`,
+                code: 'ERROR_INVALID_DOMAIN',
+                cause: error
+            });
+        }
+        else if (publicKey.rp.id !== effectiveDomain) {
+            return new WebAuthnError({
+                message: `The RP ID "${publicKey.rp.id}" is invalid for this domain`,
+                code: 'ERROR_INVALID_RP_ID',
+                cause: error,
+            });
+        }
+    }
+    else if (error.name === 'TypeError') {
+        if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) {
+            return new WebAuthnError({
+                message: 'User ID was not between 1 and 64 characters',
+                code: 'ERROR_INVALID_USER_ID_LENGTH',
+                cause: error,
+            });
+        }
+    }
+    else if (error.name === 'UnknownError') {
+        return new WebAuthnError({
+            message: 'The authenticator was unable to process the specified options, or could not create a new credential',
+            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',
+            cause: error,
+        });
+    }
+    return error;
+}
+
+class WebAuthnAbortService {
+    controller;
+    createNewAbortSignal() {
+        if (this.controller) {
+            const abortError = new Error('Cancelling existing WebAuthn API call for new one');
+            abortError.name = 'AbortError';
+            this.controller.abort(abortError);
+        }
+        const newController = new AbortController();
+        this.controller = newController;
+        return newController.signal;
+    }
+}
+const webauthnAbortService = new WebAuthnAbortService();
+
+const attachments = ['cross-platform', 'platform'];
+function toAuthenticatorAttachment(attachment) {
+    if (!attachment) {
+        return;
+    }
+    if (attachments.indexOf(attachment) < 0) {
+        return;
+    }
+    return attachment;
+}
+
+async function startRegistration(creationOptionsJSON) {
+    if (!browserSupportsWebAuthn()) {
+        throw new Error('WebAuthn is not supported in this browser');
+    }
+    const publicKey = {
+        ...creationOptionsJSON,
+        challenge: base64URLStringToBuffer(creationOptionsJSON.challenge),
+        user: {
+            ...creationOptionsJSON.user,
+            id: utf8StringToBuffer(creationOptionsJSON.user.id),
+        },
+        excludeCredentials: creationOptionsJSON.excludeCredentials?.map(toPublicKeyCredentialDescriptor),
+    };
+    const options = { publicKey };
+    options.signal = webauthnAbortService.createNewAbortSignal();
+    let credential;
+    try {
+        credential = (await navigator.credentials.create(options));
+    }
+    catch (err) {
+        throw identifyRegistrationError({ error: err, options });
+    }
+    if (!credential) {
+        throw new Error('Registration was not completed');
+    }
+    const { id, rawId, response, type } = credential;
+    let transports = undefined;
+    if (typeof response.getTransports === 'function') {
+        transports = response.getTransports();
+    }
+    return {
+        id,
+        rawId: bufferToBase64URLString(rawId),
+        response: {
+            attestationObject: bufferToBase64URLString(response.attestationObject),
+            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),
+            transports,
+        },
+        type,
+        clientExtensionResults: credential.getClientExtensionResults(),
+        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),
+    };
+}
+
+function bufferToUTF8String(value) {
+    return new TextDecoder('utf-8').decode(value);
+}
+
+async function browserSupportsWebAuthnAutofill() {
+    const globalPublicKeyCredential = window.PublicKeyCredential;
+    return (globalPublicKeyCredential.isConditionalMediationAvailable !== undefined &&
+        globalPublicKeyCredential.isConditionalMediationAvailable());
+}
+
+function identifyAuthenticationError({ error, options, }) {
+    const { publicKey } = options;
+    if (!publicKey) {
+        throw Error('options was missing required publicKey property');
+    }
+    if (error.name === 'AbortError') {
+        if (options.signal instanceof AbortSignal) {
+            return new WebAuthnError({
+                message: 'Authentication ceremony was sent an abort signal',
+                code: 'ERROR_CEREMONY_ABORTED',
+                cause: error,
+            });
+        }
+    }
+    else if (error.name === 'NotAllowedError') {
+        return new WebAuthnError({
+            message: error.message,
+            code: 'ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY',
+            cause: error,
+        });
+    }
+    else if (error.name === 'SecurityError') {
+        const effectiveDomain = window.location.hostname;
+        if (!isValidDomain(effectiveDomain)) {
+            return new WebAuthnError({
+                message: `${window.location.hostname} is an invalid domain`,
+                code: 'ERROR_INVALID_DOMAIN',
+                cause: error,
+            });
+        }
+        else if (publicKey.rpId !== effectiveDomain) {
+            return new WebAuthnError({
+                message: `The RP ID "${publicKey.rpId}" is invalid for this domain`,
+                code: 'ERROR_INVALID_RP_ID',
+                cause: error,
+            });
+        }
+    }
+    else if (error.name === 'UnknownError') {
+        return new WebAuthnError({
+            message: 'The authenticator was unable to process the specified options, or could not create a new assertion signature',
+            code: 'ERROR_AUTHENTICATOR_GENERAL_ERROR',
+            cause: error,
+        });
+    }
+    return error;
+}
+
+async function startAuthentication(requestOptionsJSON, useBrowserAutofill = false) {
+    if (!browserSupportsWebAuthn()) {
+        throw new Error('WebAuthn is not supported in this browser');
+    }
+    let allowCredentials;
+    if (requestOptionsJSON.allowCredentials?.length !== 0) {
+        allowCredentials = requestOptionsJSON.allowCredentials?.map(toPublicKeyCredentialDescriptor);
+    }
+    const publicKey = {
+        ...requestOptionsJSON,
+        challenge: base64URLStringToBuffer(requestOptionsJSON.challenge),
+        allowCredentials,
+    };
+    const options = {};
+    if (useBrowserAutofill) {
+        if (!(await browserSupportsWebAuthnAutofill())) {
+            throw Error('Browser does not support WebAuthn autofill');
+        }
+        const eligibleInputs = document.querySelectorAll("input[autocomplete*='webauthn']");
+        if (eligibleInputs.length < 1) {
+            throw Error('No <input> with `"webauthn"` in its `autocomplete` attribute was detected');
+        }
+        options.mediation = 'conditional';
+        publicKey.allowCredentials = [];
+    }
+    options.publicKey = publicKey;
+    options.signal = webauthnAbortService.createNewAbortSignal();
+    let credential;
+    try {
+        credential = (await navigator.credentials.get(options));
+    }
+    catch (err) {
+        throw identifyAuthenticationError({ error: err, options });
+    }
+    if (!credential) {
+        throw new Error('Authentication was not completed');
+    }
+    const { id, rawId, response, type } = credential;
+    let userHandle = undefined;
+    if (response.userHandle) {
+        userHandle = bufferToUTF8String(response.userHandle);
+    }
+    return {
+        id,
+        rawId: bufferToBase64URLString(rawId),
+        response: {
+            authenticatorData: bufferToBase64URLString(response.authenticatorData),
+            clientDataJSON: bufferToBase64URLString(response.clientDataJSON),
+            signature: bufferToBase64URLString(response.signature),
+            userHandle,
+        },
+        type,
+        clientExtensionResults: credential.getClientExtensionResults(),
+        authenticatorAttachment: toAuthenticatorAttachment(credential.authenticatorAttachment),
+    };
+}
+
+// eslint-lint-disable-next-line @typescript-eslint/naming-convention
+class HTTPError extends Error {
+    constructor(response, request, options) {
+        const code = (response.status || response.status === 0) ? response.status : '';
+        const title = response.statusText || '';
+        const status = `${code} ${title}`.trim();
+        const reason = status ? `status code ${status}` : 'an unknown error';
+        super(`Request failed with ${reason}`);
+        Object.defineProperty(this, "response", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "request", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "options", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.name = 'HTTPError';
+        this.response = response;
+        this.request = request;
+        this.options = options;
+    }
+}
+
+class TimeoutError extends Error {
+    constructor(request) {
+        super('Request timed out');
+        Object.defineProperty(this, "request", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.name = 'TimeoutError';
+        this.request = request;
+    }
+}
+
+// eslint-disable-next-line @typescript-eslint/ban-types
+const isObject = (value) => value !== null && typeof value === 'object';
+
+const validateAndMerge = (...sources) => {
+    for (const source of sources) {
+        if ((!isObject(source) || Array.isArray(source)) && typeof source !== 'undefined') {
+            throw new TypeError('The `options` argument must be an object');
+        }
+    }
+    return deepMerge({}, ...sources);
+};
+const mergeHeaders = (source1 = {}, source2 = {}) => {
+    const result = new globalThis.Headers(source1);
+    const isHeadersInstance = source2 instanceof globalThis.Headers;
+    const source = new globalThis.Headers(source2);
+    for (const [key, value] of source.entries()) {
+        if ((isHeadersInstance && value === 'undefined') || value === undefined) {
+            result.delete(key);
+        }
+        else {
+            result.set(key, value);
+        }
+    }
+    return result;
+};
+// TODO: Make this strongly-typed (no `any`).
+const deepMerge = (...sources) => {
+    let returnValue = {};
+    let headers = {};
+    for (const source of sources) {
+        if (Array.isArray(source)) {
+            if (!Array.isArray(returnValue)) {
+                returnValue = [];
+            }
+            returnValue = [...returnValue, ...source];
+        }
+        else if (isObject(source)) {
+            for (let [key, value] of Object.entries(source)) {
+                if (isObject(value) && key in returnValue) {
+                    value = deepMerge(returnValue[key], value);
+                }
+                returnValue = { ...returnValue, [key]: value };
+            }
+            if (isObject(source.headers)) {
+                headers = mergeHeaders(headers, source.headers);
+                returnValue.headers = headers;
+            }
+        }
+    }
+    return returnValue;
+};
+
+const supportsRequestStreams = (() => {
+    let duplexAccessed = false;
+    let hasContentType = false;
+    const supportsReadableStream = typeof globalThis.ReadableStream === 'function';
+    const supportsRequest = typeof globalThis.Request === 'function';
+    if (supportsReadableStream && supportsRequest) {
+        hasContentType = new globalThis.Request('https://a.com', {
+            body: new globalThis.ReadableStream(),
+            method: 'POST',
+            // @ts-expect-error - Types are outdated.
+            get duplex() {
+                duplexAccessed = true;
+                return 'half';
+            },
+        }).headers.has('Content-Type');
+    }
+    return duplexAccessed && !hasContentType;
+})();
+const supportsAbortController = typeof globalThis.AbortController === 'function';
+const supportsResponseStreams = typeof globalThis.ReadableStream === 'function';
+const supportsFormData = typeof globalThis.FormData === 'function';
+const requestMethods = ['get', 'post', 'put', 'patch', 'head', 'delete'];
+const responseTypes = {
+    json: 'application/json',
+    text: 'text/*',
+    formData: 'multipart/form-data',
+    arrayBuffer: '*/*',
+    blob: '*/*',
+};
+// The maximum value of a 32bit int (see issue #117)
+const maxSafeTimeout = 2147483647;
+const stop = Symbol('stop');
+
+const normalizeRequestMethod = (input) => requestMethods.includes(input) ? input.toUpperCase() : input;
+const retryMethods = ['get', 'put', 'head', 'delete', 'options', 'trace'];
+const retryStatusCodes = [408, 413, 429, 500, 502, 503, 504];
+const retryAfterStatusCodes = [413, 429, 503];
+const defaultRetryOptions = {
+    limit: 2,
+    methods: retryMethods,
+    statusCodes: retryStatusCodes,
+    afterStatusCodes: retryAfterStatusCodes,
+    maxRetryAfter: Number.POSITIVE_INFINITY,
+    backoffLimit: Number.POSITIVE_INFINITY,
+};
+const normalizeRetryOptions = (retry = {}) => {
+    if (typeof retry === 'number') {
+        return {
+            ...defaultRetryOptions,
+            limit: retry,
+        };
+    }
+    if (retry.methods && !Array.isArray(retry.methods)) {
+        throw new Error('retry.methods must be an array');
+    }
+    if (retry.statusCodes && !Array.isArray(retry.statusCodes)) {
+        throw new Error('retry.statusCodes must be an array');
+    }
+    return {
+        ...defaultRetryOptions,
+        ...retry,
+        afterStatusCodes: retryAfterStatusCodes,
+    };
+};
+
+// `Promise.race()` workaround (#91)
+async function timeout(request, abortController, options) {
+    return new Promise((resolve, reject) => {
+        const timeoutId = setTimeout(() => {
+            if (abortController) {
+                abortController.abort();
+            }
+            reject(new TimeoutError(request));
+        }, options.timeout);
+        void options
+            .fetch(request)
+            .then(resolve)
+            .catch(reject)
+            .then(() => {
+            clearTimeout(timeoutId);
+        });
+    });
+}
+
+// DOMException is supported on most modern browsers and Node.js 18+.
+// @see https://developer.mozilla.org/en-US/docs/Web/API/DOMException#browser_compatibility
+const isDomExceptionSupported = Boolean(globalThis.DOMException);
+// TODO: When targeting Node.js 18, use `signal.throwIfAborted()` (https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal/throwIfAborted)
+function composeAbortError(signal) {
+    /*
+    NOTE: Use DomException with AbortError name as specified in MDN docs (https://developer.mozilla.org/en-US/docs/Web/API/AbortController/abort)
+    > When abort() is called, the fetch() promise rejects with an Error of type DOMException, with name AbortError.
+    */
+    if (isDomExceptionSupported) {
+        return new DOMException(signal?.reason ?? 'The operation was aborted.', 'AbortError');
+    }
+    // DOMException not supported. Fall back to use of error and override name.
+    const error = new Error(signal?.reason ?? 'The operation was aborted.');
+    error.name = 'AbortError';
+    return error;
+}
+
+// https://github.com/sindresorhus/delay/tree/ab98ae8dfcb38e1593286c94d934e70d14a4e111
+async function delay(ms, { signal }) {
+    return new Promise((resolve, reject) => {
+        if (signal) {
+            if (signal.aborted) {
+                reject(composeAbortError(signal));
+                return;
+            }
+            signal.addEventListener('abort', handleAbort, { once: true });
+        }
+        function handleAbort() {
+            reject(composeAbortError(signal));
+            clearTimeout(timeoutId);
+        }
+        const timeoutId = setTimeout(() => {
+            signal?.removeEventListener('abort', handleAbort);
+            resolve();
+        }, ms);
+    });
+}
+
+class Ky {
+    // eslint-disable-next-line @typescript-eslint/promise-function-async
+    static create(input, options) {
+        const ky = new Ky(input, options);
+        const fn = async () => {
+            if (ky._options.timeout > maxSafeTimeout) {
+                throw new RangeError(`The \`timeout\` option cannot be greater than ${maxSafeTimeout}`);
+            }
+            // Delay the fetch so that body method shortcuts can set the Accept header
+            await Promise.resolve();
+            let response = await ky._fetch();
+            for (const hook of ky._options.hooks.afterResponse) {
+                // eslint-disable-next-line no-await-in-loop
+                const modifiedResponse = await hook(ky.request, ky._options, ky._decorateResponse(response.clone()));
+                if (modifiedResponse instanceof globalThis.Response) {
+                    response = modifiedResponse;
+                }
+            }
+            ky._decorateResponse(response);
+            if (!response.ok && ky._options.throwHttpErrors) {
+                let error = new HTTPError(response, ky.request, ky._options);
+                for (const hook of ky._options.hooks.beforeError) {
+                    // eslint-disable-next-line no-await-in-loop
+                    error = await hook(error);
+                }
+                throw error;
+            }
+            // If `onDownloadProgress` is passed, it uses the stream API internally
+            /* istanbul ignore next */
+            if (ky._options.onDownloadProgress) {
+                if (typeof ky._options.onDownloadProgress !== 'function') {
+                    throw new TypeError('The `onDownloadProgress` option must be a function');
+                }
+                if (!supportsResponseStreams) {
+                    throw new Error('Streams are not supported in your environment. `ReadableStream` is missing.');
+                }
+                return ky._stream(response.clone(), ky._options.onDownloadProgress);
+            }
+            return response;
+        };
+        const isRetriableMethod = ky._options.retry.methods.includes(ky.request.method.toLowerCase());
+        const result = (isRetriableMethod ? ky._retry(fn) : fn());
+        for (const [type, mimeType] of Object.entries(responseTypes)) {
+            result[type] = async () => {
+                // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
+                ky.request.headers.set('accept', ky.request.headers.get('accept') || mimeType);
+                const awaitedResult = await result;
+                const response = awaitedResult.clone();
+                if (type === 'json') {
+                    if (response.status === 204) {
+                        return '';
+                    }
+                    const arrayBuffer = await response.clone().arrayBuffer();
+                    const responseSize = arrayBuffer.byteLength;
+                    if (responseSize === 0) {
+                        return '';
+                    }
+                    if (options.parseJson) {
+                        return options.parseJson(await response.text());
+                    }
+                }
+                return response[type]();
+            };
+        }
+        return result;
+    }
+    // eslint-disable-next-line complexity
+    constructor(input, options = {}) {
+        Object.defineProperty(this, "request", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "abortController", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_retryCount", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
+        Object.defineProperty(this, "_input", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_options", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this._input = input;
+        this._options = {
+            // TODO: credentials can be removed when the spec change is implemented in all browsers. Context: https://www.chromestatus.com/feature/4539473312350208
+            credentials: this._input.credentials || 'same-origin',
+            ...options,
+            headers: mergeHeaders(this._input.headers, options.headers),
+            hooks: deepMerge({
+                beforeRequest: [],
+                beforeRetry: [],
+                beforeError: [],
+                afterResponse: [],
+            }, options.hooks),
+            method: normalizeRequestMethod(options.method ?? this._input.method),
+            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
+            prefixUrl: String(options.prefixUrl || ''),
+            retry: normalizeRetryOptions(options.retry),
+            throwHttpErrors: options.throwHttpErrors !== false,
+            timeout: typeof options.timeout === 'undefined' ? 10000 : options.timeout,
+            fetch: options.fetch ?? globalThis.fetch.bind(globalThis),
+        };
+        if (typeof this._input !== 'string' && !(this._input instanceof URL || this._input instanceof globalThis.Request)) {
+            throw new TypeError('`input` must be a string, URL, or Request');
+        }
+        if (this._options.prefixUrl && typeof this._input === 'string') {
+            if (this._input.startsWith('/')) {
+                throw new Error('`input` must not begin with a slash when using `prefixUrl`');
+            }
+            if (!this._options.prefixUrl.endsWith('/')) {
+                this._options.prefixUrl += '/';
+            }
+            this._input = this._options.prefixUrl + this._input;
+        }
+        if (supportsAbortController) {
+            this.abortController = new globalThis.AbortController();
+            if (this._options.signal) {
+                const originalSignal = this._options.signal;
+                this._options.signal.addEventListener('abort', () => {
+                    this.abortController.abort(originalSignal.reason);
+                });
+            }
+            this._options.signal = this.abortController.signal;
+        }
+        if (supportsRequestStreams) {
+            // @ts-expect-error - Types are outdated.
+            this._options.duplex = 'half';
+        }
+        this.request = new globalThis.Request(this._input, this._options);
+        if (this._options.searchParams) {
+            // eslint-disable-next-line unicorn/prevent-abbreviations
+            const textSearchParams = typeof this._options.searchParams === 'string'
+                ? this._options.searchParams.replace(/^\?/, '')
+                : new URLSearchParams(this._options.searchParams).toString();
+            // eslint-disable-next-line unicorn/prevent-abbreviations
+            const searchParams = '?' + textSearchParams;
+            const url = this.request.url.replace(/(?:\?.*?)?(?=#|$)/, searchParams);
+            // To provide correct form boundary, Content-Type header should be deleted each time when new Request instantiated from another one
+            if (((supportsFormData && this._options.body instanceof globalThis.FormData)
+                || this._options.body instanceof URLSearchParams) && !(this._options.headers && this._options.headers['content-type'])) {
+                this.request.headers.delete('content-type');
+            }
+            // The spread of `this.request` is required as otherwise it misses the `duplex` option for some reason and throws.
+            this.request = new globalThis.Request(new globalThis.Request(url, { ...this.request }), this._options);
+        }
+        if (this._options.json !== undefined) {
+            this._options.body = JSON.stringify(this._options.json);
+            this.request.headers.set('content-type', this._options.headers.get('content-type') ?? 'application/json');
+            this.request = new globalThis.Request(this.request, { body: this._options.body });
+        }
+    }
+    _calculateRetryDelay(error) {
+        this._retryCount++;
+        if (this._retryCount < this._options.retry.limit && !(error instanceof TimeoutError)) {
+            if (error instanceof HTTPError) {
+                if (!this._options.retry.statusCodes.includes(error.response.status)) {
+                    return 0;
+                }
+                const retryAfter = error.response.headers.get('Retry-After');
+                if (retryAfter && this._options.retry.afterStatusCodes.includes(error.response.status)) {
+                    let after = Number(retryAfter);
+                    if (Number.isNaN(after)) {
+                        after = Date.parse(retryAfter) - Date.now();
+                    }
+                    else {
+                        after *= 1000;
+                    }
+                    if (typeof this._options.retry.maxRetryAfter !== 'undefined' && after > this._options.retry.maxRetryAfter) {
+                        return 0;
+                    }
+                    return after;
+                }
+                if (error.response.status === 413) {
+                    return 0;
+                }
+            }
+            const BACKOFF_FACTOR = 0.3;
+            return Math.min(this._options.retry.backoffLimit, BACKOFF_FACTOR * (2 ** (this._retryCount - 1)) * 1000);
+        }
+        return 0;
+    }
+    _decorateResponse(response) {
+        if (this._options.parseJson) {
+            response.json = async () => this._options.parseJson(await response.text());
+        }
+        return response;
+    }
+    async _retry(fn) {
+        try {
+            return await fn();
+            // eslint-disable-next-line @typescript-eslint/no-implicit-any-catch
+        }
+        catch (error) {
+            const ms = Math.min(this._calculateRetryDelay(error), maxSafeTimeout);
+            if (ms !== 0 && this._retryCount > 0) {
+                await delay(ms, { signal: this._options.signal });
+                for (const hook of this._options.hooks.beforeRetry) {
+                    // eslint-disable-next-line no-await-in-loop
+                    const hookResult = await hook({
+                        request: this.request,
+                        options: this._options,
+                        error: error,
+                        retryCount: this._retryCount,
+                    });
+                    // If `stop` is returned from the hook, the retry process is stopped
+                    if (hookResult === stop) {
+                        return;
+                    }
+                }
+                return this._retry(fn);
+            }
+            throw error;
+        }
+    }
+    async _fetch() {
+        for (const hook of this._options.hooks.beforeRequest) {
+            // eslint-disable-next-line no-await-in-loop
+            const result = await hook(this.request, this._options);
+            if (result instanceof Request) {
+                this.request = result;
+                break;
+            }
+            if (result instanceof Response) {
+                return result;
+            }
+        }
+        if (this._options.timeout === false) {
+            return this._options.fetch(this.request.clone());
+        }
+        return timeout(this.request.clone(), this.abortController, this._options);
+    }
+    /* istanbul ignore next */
+    _stream(response, onDownloadProgress) {
+        const totalBytes = Number(response.headers.get('content-length')) || 0;
+        let transferredBytes = 0;
+        if (response.status === 204) {
+            if (onDownloadProgress) {
+                onDownloadProgress({ percent: 1, totalBytes, transferredBytes }, new Uint8Array());
+            }
+            return new globalThis.Response(null, {
+                status: response.status,
+                statusText: response.statusText,
+                headers: response.headers,
+            });
+        }
+        return new globalThis.Response(new globalThis.ReadableStream({
+            async start(controller) {
+                const reader = response.body.getReader();
+                if (onDownloadProgress) {
+                    onDownloadProgress({ percent: 0, transferredBytes: 0, totalBytes }, new Uint8Array());
+                }
+                async function read() {
+                    const { done, value } = await reader.read();
+                    if (done) {
+                        controller.close();
+                        return;
+                    }
+                    if (onDownloadProgress) {
+                        transferredBytes += value.byteLength;
+                        const percent = totalBytes === 0 ? 0 : transferredBytes / totalBytes;
+                        onDownloadProgress({ percent, transferredBytes, totalBytes }, value);
+                    }
+                    controller.enqueue(value);
+                    await read();
+                }
+                await read();
+            },
+        }), {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers,
+        });
+    }
+}
+
+/*! MIT License © Sindre Sorhus */
+const createInstance = (defaults) => {
+    // eslint-disable-next-line @typescript-eslint/promise-function-async
+    const ky = (input, options) => Ky.create(input, validateAndMerge(defaults, options));
+    for (const method of requestMethods) {
+        // eslint-disable-next-line @typescript-eslint/promise-function-async
+        ky[method] = (input, options) => Ky.create(input, validateAndMerge(defaults, options, { method }));
+    }
+    ky.create = (newDefaults) => createInstance(validateAndMerge(newDefaults));
+    ky.extend = (newDefaults) => createInstance(validateAndMerge(defaults, newDefaults));
+    ky.stop = stop;
+    return ky;
+};
+const ky = createInstance();
+var ky$1 = ky;
+
+var PasskeyApiClient = /** @class */ (function () {
+    function PasskeyApiClient(_a) {
+        var baseUrl = _a.baseUrl, tenantId = _a.tenantId;
+        this.tenantId = tenantId;
+        this.api = ky$1.create({
+            prefixUrl: baseUrl
+        });
+    }
+    PasskeyApiClient.prototype.registrationOptions = function (_a) {
+        var token = _a.token, userName = _a.userName;
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, this.api.post("user-authenticators/passkey/registration-options", {
+                            json: { userName: userName },
+                            headers: {
+                                Authorization: "Bearer ".concat(token)
+                            }
+                        })];
+                    case 1:
+                        response = _b.sent();
+                        return [2 /*return*/, response.json()];
+                }
+            });
+        });
+    };
+    PasskeyApiClient.prototype.authenticationOptions = function (_a) {
+        var token = _a.token;
+        return __awaiter(this, void 0, void 0, function () {
+            var authorizationHeader, response;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        authorizationHeader = token ? "Bearer ".concat(token) : "Basic ".concat(Buffer.from(this.tenantId).toString("base64"));
+                        return [4 /*yield*/, this.api.post("user-authenticators/passkey/authentication-options", {
+                                json: {},
+                                headers: {
+                                    Authorization: authorizationHeader
+                                }
+                            })];
+                    case 1:
+                        response = _b.sent();
+                        return [2 /*return*/, response.json()];
+                }
+            });
+        });
+    };
+    PasskeyApiClient.prototype.addAuthenticator = function (_a) {
+        var token = _a.token, rest = __rest(_a, ["token"]);
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, this.api.post("user-authenticators/passkey", {
+                            json: rest,
+                            headers: {
+                                Authorization: "Bearer ".concat(token)
+                            }
+                        })];
+                    case 1:
+                        response = _b.sent();
+                        return [2 /*return*/, response.json()];
+                }
+            });
+        });
+    };
+    PasskeyApiClient.prototype.verify = function (_a) {
+        var token = _a.token, rest = __rest(_a, ["token"]);
+        return __awaiter(this, void 0, void 0, function () {
+            var authorizationHeader, response;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        authorizationHeader = token ? "Bearer ".concat(token) : "Basic ".concat(Buffer.from(this.tenantId).toString("base64"));
+                        return [4 /*yield*/, this.api.post("verify/passkey", {
+                                json: rest,
+                                headers: {
+                                    Authorization: authorizationHeader
+                                }
+                            })];
+                    case 1:
+                        response = _b.sent();
+                        return [2 /*return*/, response.json()];
+                }
+            });
+        });
+    };
+    return PasskeyApiClient;
+}());
+
+var Passkey = /** @class */ (function () {
+    function Passkey(_a) {
+        var baseUrl = _a.baseUrl, tenantId = _a.tenantId;
+        this.api = new PasskeyApiClient({ baseUrl: baseUrl, tenantId: tenantId });
+    }
+    Passkey.prototype.signUp = function (_a) {
+        var userName = _a.userName, token = _a.token;
+        return __awaiter(this, void 0, void 0, function () {
+            var optionsResponse, registrationResponse, addAuthenticatorResponse, error_1;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, this.api.registrationOptions({ userName: userName, token: token })];
+                    case 1:
+                        optionsResponse = _b.sent();
+                        _b.label = 2;
+                    case 2:
+                        _b.trys.push([2, 5, , 6]);
+                        return [4 /*yield*/, startRegistration(optionsResponse.options)];
+                    case 3:
+                        registrationResponse = _b.sent();
+                        return [4 /*yield*/, this.api.addAuthenticator({
+                                challengeId: optionsResponse.challengeId,
+                                registrationCredential: registrationResponse,
+                                token: token
+                            })];
+                    case 4:
+                        addAuthenticatorResponse = _b.sent();
+                        return [2 /*return*/, addAuthenticatorResponse === null || addAuthenticatorResponse === void 0 ? void 0 : addAuthenticatorResponse.accessToken];
+                    case 5:
+                        error_1 = _b.sent();
+                        console.error(error_1);
+                        return [3 /*break*/, 6];
+                    case 6: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    Passkey.prototype.signIn = function (params) {
+        return __awaiter(this, void 0, void 0, function () {
+            var optionsResponse, authenticationResponse, verifyResponse, error_2;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if ((params === null || params === void 0 ? void 0 : params.token) && params.autofill) {
+                            throw new Error("Autofill is not supported when providing a token");
+                        }
+                        return [4 /*yield*/, this.api.authenticationOptions({ token: params === null || params === void 0 ? void 0 : params.token })];
+                    case 1:
+                        optionsResponse = _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 5, , 6]);
+                        return [4 /*yield*/, startAuthentication(optionsResponse.options, params === null || params === void 0 ? void 0 : params.autofill)];
+                    case 3:
+                        authenticationResponse = _a.sent();
+                        return [4 /*yield*/, this.api.verify({
+                                challengeId: optionsResponse.challengeId,
+                                authenticationCredential: authenticationResponse,
+                                token: params === null || params === void 0 ? void 0 : params.token
+                            })];
+                    case 4:
+                        verifyResponse = _a.sent();
+                        return [2 /*return*/, verifyResponse === null || verifyResponse === void 0 ? void 0 : verifyResponse.accessToken];
+                    case 5:
+                        error_2 = _a.sent();
+                        console.error(error_2);
+                        return [3 /*break*/, 6];
+                    case 6: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    return Passkey;
+}());
+
 var DEFAULT_COOKIE_NAME = "__as_aid";
+var DEFAULT_BASE_URL = "https://challenge.authsignal.com/v1";
 var Authsignal = /** @class */ (function () {
     function Authsignal(_a) {
-        var publishableKey = _a.publishableKey, cookieDomain = _a.cookieDomain, cookieName = _a.cookieName;
+        var cookieDomain = _a.cookieDomain, _b = _a.cookieName, cookieName = _b === void 0 ? DEFAULT_COOKIE_NAME : _b, _c = _a.baseUrl, baseUrl = _c === void 0 ? DEFAULT_BASE_URL : _c, tenantId = _a.tenantId;
         this.anonymousId = "";
         this.cookieDomain = "";
         this.anonymousIdCookieName = "";
-        this.publishableKey = "";
         this._token = undefined;
-        this.publishableKey = publishableKey;
         this.cookieDomain = cookieDomain || getCookieDomain();
-        this.anonymousIdCookieName = cookieName || DEFAULT_COOKIE_NAME;
+        this.anonymousIdCookieName = cookieName;
+        this.passkey = new Passkey({ tenantId: tenantId, baseUrl: baseUrl });
         var idCookie = getCookie(this.anonymousIdCookieName);
         if (idCookie) {
             this.anonymousId = idCookie;