@bitgo/passkey-crypto 0.0.1 → 0.2.0

package/LICENSE

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2022 BitGo
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/src/deriveEnterpriseSalt.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Derives an enterprise-scoped PRF salt to prevent cross-enterprise key reuse.
+ *
+ * Computes HMAC-SHA256(key=prfSalt_base64url_decoded, data=enterpriseId_utf8).
+ * The baseSalt must always come from the server — never generate it client-side.
+ *
+ * @param baseSalt - Server-provided base64url-encoded PRF salt
+ * @param enterpriseId - Enterprise identifier
+ * @returns Base64-encoded HMAC-SHA256 digest
+ */
+export declare function deriveEnterpriseSalt(baseSalt: string, enterpriseId: string): string;
+//# sourceMappingURL=deriveEnterpriseSalt.d.ts.map

package/dist/src/deriveEnterpriseSalt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveEnterpriseSalt.d.ts","sourceRoot":"","sources":["../../src/deriveEnterpriseSalt.ts"],"names":[],"mappings":"AASA;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAUnF"}

package/dist/src/deriveEnterpriseSalt.js

@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveEnterpriseSalt = deriveEnterpriseSalt;
+const sjcl = __importStar(require("@bitgo/sjcl"));
+/**
+ * Derives an enterprise-scoped PRF salt to prevent cross-enterprise key reuse.
+ *
+ * Computes HMAC-SHA256(key=prfSalt_base64url_decoded, data=enterpriseId_utf8).
+ * The baseSalt must always come from the server — never generate it client-side.
+ *
+ * @param baseSalt - Server-provided base64url-encoded PRF salt
+ * @param enterpriseId - Enterprise identifier
+ * @returns Base64-encoded HMAC-SHA256 digest
+ */
+function deriveEnterpriseSalt(baseSalt, enterpriseId) {
+    const { misc, codec, hash } = sjcl;
+    const keyBits = codec.base64url.toBits(baseSalt);
+    const dataBits = codec.utf8String.toBits(enterpriseId);
+    const hmacInstance = new misc.hmac(keyBits, hash.sha256);
+    const resultBits = hmacInstance.mac(dataBits);
+    return codec.base64.fromBits(resultBits);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZlRW50ZXJwcmlzZVNhbHQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGVyaXZlRW50ZXJwcmlzZVNhbHQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFtQkEsb0RBVUM7QUE3QkQsa0RBQW9DO0FBU3BDOzs7Ozs7Ozs7R0FTRztBQUNILFNBQWdCLG9CQUFvQixDQUFDLFFBQWdCLEVBQUUsWUFBb0I7SUFDekUsTUFBTSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEdBQUcsSUFBMkIsQ0FBQztJQUUxRCxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNqRCxNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUV2RCxNQUFNLFlBQVksR0FBRyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN6RCxNQUFNLFVBQVUsR0FBRyxZQUFZLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRTlDLE9BQU8sS0FBSyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7QUFDM0MsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIHNqY2wgZnJvbSAnQGJpdGdvL3NqY2wnO1xuaW1wb3J0IHR5cGUgeyBTamNsQ29kZWNzLCBTamNsSGFzaGVzLCBTamNsTWlzYyB9IGZyb20gJ0BiaXRnby9zamNsJztcblxudHlwZSBTamNsVHlwZSA9IHtcbiAgaGFzaDogU2pjbEhhc2hlcztcbiAgY29kZWM6IFNqY2xDb2RlY3M7XG4gIG1pc2M6IFNqY2xNaXNjO1xufTtcblxuLyoqXG4gKiBEZXJpdmVzIGFuIGVudGVycHJpc2Utc2NvcGVkIFBSRiBzYWx0IHRvIHByZXZlbnQgY3Jvc3MtZW50ZXJwcmlzZSBrZXkgcmV1c2UuXG4gKlxuICogQ29tcHV0ZXMgSE1BQy1TSEEyNTYoa2V5PXByZlNhbHRfYmFzZTY0dXJsX2RlY29kZWQsIGRhdGE9ZW50ZXJwcmlzZUlkX3V0ZjgpLlxuICogVGhlIGJhc2VTYWx0IG11c3QgYWx3YXlzIGNvbWUgZnJvbSB0aGUgc2VydmVyIOKAlCBuZXZlciBnZW5lcmF0ZSBpdCBjbGllbnQtc2lkZS5cbiAqXG4gKiBAcGFyYW0gYmFzZVNhbHQgLSBTZXJ2ZXItcHJvdmlkZWQgYmFzZTY0dXJsLWVuY29kZWQgUFJGIHNhbHRcbiAqIEBwYXJhbSBlbnRlcnByaXNlSWQgLSBFbnRlcnByaXNlIGlkZW50aWZpZXJcbiAqIEByZXR1cm5zIEJhc2U2NC1lbmNvZGVkIEhNQUMtU0hBMjU2IGRpZ2VzdFxuICovXG5leHBvcnQgZnVuY3Rpb24gZGVyaXZlRW50ZXJwcmlzZVNhbHQoYmFzZVNhbHQ6IHN0cmluZywgZW50ZXJwcmlzZUlkOiBzdHJpbmcpOiBzdHJpbmcge1xuICBjb25zdCB7IG1pc2MsIGNvZGVjLCBoYXNoIH0gPSBzamNsIGFzIHVua25vd24gYXMgU2pjbFR5cGU7XG5cbiAgY29uc3Qga2V5Qml0cyA9IGNvZGVjLmJhc2U2NHVybC50b0JpdHMoYmFzZVNhbHQpO1xuICBjb25zdCBkYXRhQml0cyA9IGNvZGVjLnV0ZjhTdHJpbmcudG9CaXRzKGVudGVycHJpc2VJZCk7XG5cbiAgY29uc3QgaG1hY0luc3RhbmNlID0gbmV3IG1pc2MuaG1hYyhrZXlCaXRzLCBoYXNoLnNoYTI1Nik7XG4gIGNvbnN0IHJlc3VsdEJpdHMgPSBobWFjSW5zdGFuY2UubWFjKGRhdGFCaXRzKTtcblxuICByZXR1cm4gY29kZWMuYmFzZTY0LmZyb21CaXRzKHJlc3VsdEJpdHMpO1xufVxuIl19

package/dist/src/derivePassword.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Derives a wallet passphrase from a WebAuthn PRF result.
+ *
+ * The PRF output (ArrayBuffer) is hex-encoded and used directly as the
+ * walletPassphrase for SJCL-based encryption (bitgo.encrypt).
+ *
+ * @param prfResult - Raw PRF output from WebAuthn credential assertion
+ * @returns Lowercase hex string to use as walletPassphrase
+ */
+export declare function derivePassword(prfResult: ArrayBuffer): string;
+//# sourceMappingURL=derivePassword.d.ts.map

package/dist/src/derivePassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivePassword.d.ts","sourceRoot":"","sources":["../../src/derivePassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,WAAW,GAAG,MAAM,CAE7D"}

package/dist/src/derivePassword.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.derivePassword = derivePassword;
+/**
+ * Derives a wallet passphrase from a WebAuthn PRF result.
+ *
+ * The PRF output (ArrayBuffer) is hex-encoded and used directly as the
+ * walletPassphrase for SJCL-based encryption (bitgo.encrypt).
+ *
+ * @param prfResult - Raw PRF output from WebAuthn credential assertion
+ * @returns Lowercase hex string to use as walletPassphrase
+ */
+function derivePassword(prfResult) {
+    return Buffer.from(prfResult).toString('hex');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZlUGFzc3dvcmQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGVyaXZlUGFzc3dvcmQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFTQSx3Q0FFQztBQVhEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBZ0IsY0FBYyxDQUFDLFNBQXNCO0lBQ25ELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDaEQsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogRGVyaXZlcyBhIHdhbGxldCBwYXNzcGhyYXNlIGZyb20gYSBXZWJBdXRobiBQUkYgcmVzdWx0LlxuICpcbiAqIFRoZSBQUkYgb3V0cHV0IChBcnJheUJ1ZmZlcikgaXMgaGV4LWVuY29kZWQgYW5kIHVzZWQgZGlyZWN0bHkgYXMgdGhlXG4gKiB3YWxsZXRQYXNzcGhyYXNlIGZvciBTSkNMLWJhc2VkIGVuY3J5cHRpb24gKGJpdGdvLmVuY3J5cHQpLlxuICpcbiAqIEBwYXJhbSBwcmZSZXN1bHQgLSBSYXcgUFJGIG91dHB1dCBmcm9tIFdlYkF1dGhuIGNyZWRlbnRpYWwgYXNzZXJ0aW9uXG4gKiBAcmV0dXJucyBMb3dlcmNhc2UgaGV4IHN0cmluZyB0byB1c2UgYXMgd2FsbGV0UGFzc3BocmFzZVxuICovXG5leHBvcnQgZnVuY3Rpb24gZGVyaXZlUGFzc3dvcmQocHJmUmVzdWx0OiBBcnJheUJ1ZmZlcik6IHN0cmluZyB7XG4gIHJldHVybiBCdWZmZXIuZnJvbShwcmZSZXN1bHQpLnRvU3RyaW5nKCdoZXgnKTtcbn1cbiJdfQ==

package/dist/src/index.d.ts

@@ -0,0 +1,5 @@
+export { derivePassword } from './derivePassword';
+export { deriveEnterpriseSalt } from './deriveEnterpriseSalt';
+export { buildEvalByCredential, matchDeviceByCredentialId } from './prfHelpers';
+export type { WebAuthnOtpDevice, PasskeyAuthResult, PasskeyGetOptions, WebAuthnProvider } from './webAuthnTypes';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAChF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchDeviceByCredentialId = exports.buildEvalByCredential = exports.deriveEnterpriseSalt = exports.derivePassword = void 0;
+var derivePassword_1 = require("./derivePassword");
+Object.defineProperty(exports, "derivePassword", { enumerable: true, get: function () { return derivePassword_1.derivePassword; } });
+var deriveEnterpriseSalt_1 = require("./deriveEnterpriseSalt");
+Object.defineProperty(exports, "deriveEnterpriseSalt", { enumerable: true, get: function () { return deriveEnterpriseSalt_1.deriveEnterpriseSalt; } });
+var prfHelpers_1 = require("./prfHelpers");
+Object.defineProperty(exports, "buildEvalByCredential", { enumerable: true, get: function () { return prfHelpers_1.buildEvalByCredential; } });
+Object.defineProperty(exports, "matchDeviceByCredentialId", { enumerable: true, get: function () { return prfHelpers_1.matchDeviceByCredentialId; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbURBQWtEO0FBQXpDLGdIQUFBLGNBQWMsT0FBQTtBQUN2QiwrREFBOEQ7QUFBckQsNEhBQUEsb0JBQW9CLE9BQUE7QUFDN0IsMkNBQWdGO0FBQXZFLG1IQUFBLHFCQUFxQixPQUFBO0FBQUUsdUhBQUEseUJBQXlCLE9BQUEiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgeyBkZXJpdmVQYXNzd29yZCB9IGZyb20gJy4vZGVyaXZlUGFzc3dvcmQnO1xuZXhwb3J0IHsgZGVyaXZlRW50ZXJwcmlzZVNhbHQgfSBmcm9tICcuL2Rlcml2ZUVudGVycHJpc2VTYWx0JztcbmV4cG9ydCB7IGJ1aWxkRXZhbEJ5Q3JlZGVudGlhbCwgbWF0Y2hEZXZpY2VCeUNyZWRlbnRpYWxJZCB9IGZyb20gJy4vcHJmSGVscGVycyc7XG5leHBvcnQgdHlwZSB7IFdlYkF1dGhuT3RwRGV2aWNlLCBQYXNza2V5QXV0aFJlc3VsdCwgUGFzc2tleUdldE9wdGlvbnMsIFdlYkF1dGhuUHJvdmlkZXIgfSBmcm9tICcuL3dlYkF1dGhuVHlwZXMnO1xuIl19

package/dist/src/prfHelpers.d.ts

@@ -0,0 +1,15 @@
+import type { WebauthnDevice } from '@bitgo/public-types';
+/**
+ * Builds the PRF eval map and credential-to-device lookup from a wallet
+ * keychain's webauthn devices. Devices without a prfSalt are skipped.
+ */
+export declare function buildEvalByCredential(devices: WebauthnDevice[]): {
+    evalByCredential: Record<string, string>;
+    credIdToDevice: Map<string, WebauthnDevice>;
+};
+/**
+ * Returns the WebauthnDevice matching the given credential ID.
+ * @throws if no matching device is found
+ */
+export declare function matchDeviceByCredentialId(devices: WebauthnDevice[], credentialId: string): WebauthnDevice;
+//# sourceMappingURL=prfHelpers.d.ts.map

package/dist/src/prfHelpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prfHelpers.d.ts","sourceRoot":"","sources":["../../src/prfHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG;IAChE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC7C,CAYA;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,cAAc,CAMzG"}

package/dist/src/prfHelpers.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildEvalByCredential = buildEvalByCredential;
+exports.matchDeviceByCredentialId = matchDeviceByCredentialId;
+/**
+ * Builds the PRF eval map and credential-to-device lookup from a wallet
+ * keychain's webauthn devices. Devices without a prfSalt are skipped.
+ */
+function buildEvalByCredential(devices) {
+    const evalByCredential = {};
+    const credIdToDevice = new Map();
+    for (const device of devices) {
+        if (!device.prfSalt)
+            continue;
+        const { credID } = device.authenticatorInfo;
+        evalByCredential[credID] = device.prfSalt;
+        credIdToDevice.set(credID, device);
+    }
+    return { evalByCredential, credIdToDevice };
+}
+/**
+ * Returns the WebauthnDevice matching the given credential ID.
+ * @throws if no matching device is found
+ */
+function matchDeviceByCredentialId(devices, credentialId) {
+    const device = devices.find((d) => d.authenticatorInfo.credID === credentialId);
+    if (!device) {
+        throw new Error('Could not identify which passkey device was used');
+    }
+    return device;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJmSGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcmZIZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBTUEsc0RBZUM7QUFNRCw4REFNQztBQS9CRDs7O0dBR0c7QUFDSCxTQUFnQixxQkFBcUIsQ0FBQyxPQUF5QjtJQUk3RCxNQUFNLGdCQUFnQixHQUEyQixFQUFFLENBQUM7SUFDcEQsTUFBTSxjQUFjLEdBQUcsSUFBSSxHQUFHLEVBQTBCLENBQUM7SUFFekQsS0FBSyxNQUFNLE1BQU0sSUFBSSxPQUFPLEVBQUUsQ0FBQztRQUM3QixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU87WUFBRSxTQUFTO1FBQzlCLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLENBQUMsaUJBQWlCLENBQUM7UUFDNUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUMxQyxjQUFjLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBRUQsT0FBTyxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxDQUFDO0FBQzlDLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFnQix5QkFBeUIsQ0FBQyxPQUF5QixFQUFFLFlBQW9CO0lBQ3ZGLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLENBQUM7SUFDaEYsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ1osTUFBTSxJQUFJLEtBQUssQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHR5cGUgeyBXZWJhdXRobkRldmljZSB9IGZyb20gJ0BiaXRnby9wdWJsaWMtdHlwZXMnO1xuXG4vKipcbiAqIEJ1aWxkcyB0aGUgUFJGIGV2YWwgbWFwIGFuZCBjcmVkZW50aWFsLXRvLWRldmljZSBsb29rdXAgZnJvbSBhIHdhbGxldFxuICoga2V5Y2hhaW4ncyB3ZWJhdXRobiBkZXZpY2VzLiBEZXZpY2VzIHdpdGhvdXQgYSBwcmZTYWx0IGFyZSBza2lwcGVkLlxuICovXG5leHBvcnQgZnVuY3Rpb24gYnVpbGRFdmFsQnlDcmVkZW50aWFsKGRldmljZXM6IFdlYmF1dGhuRGV2aWNlW10pOiB7XG4gIGV2YWxCeUNyZWRlbnRpYWw6IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG4gIGNyZWRJZFRvRGV2aWNlOiBNYXA8c3RyaW5nLCBXZWJhdXRobkRldmljZT47XG59IHtcbiAgY29uc3QgZXZhbEJ5Q3JlZGVudGlhbDogUmVjb3JkPHN0cmluZywgc3RyaW5nPiA9IHt9O1xuICBjb25zdCBjcmVkSWRUb0RldmljZSA9IG5ldyBNYXA8c3RyaW5nLCBXZWJhdXRobkRldmljZT4oKTtcblxuICBmb3IgKGNvbnN0IGRldmljZSBvZiBkZXZpY2VzKSB7XG4gICAgaWYgKCFkZXZpY2UucHJmU2FsdCkgY29udGludWU7XG4gICAgY29uc3QgeyBjcmVkSUQgfSA9IGRldmljZS5hdXRoZW50aWNhdG9ySW5mbztcbiAgICBldmFsQnlDcmVkZW50aWFsW2NyZWRJRF0gPSBkZXZpY2UucHJmU2FsdDtcbiAgICBjcmVkSWRUb0RldmljZS5zZXQoY3JlZElELCBkZXZpY2UpO1xuICB9XG5cbiAgcmV0dXJuIHsgZXZhbEJ5Q3JlZGVudGlhbCwgY3JlZElkVG9EZXZpY2UgfTtcbn1cblxuLyoqXG4gKiBSZXR1cm5zIHRoZSBXZWJhdXRobkRldmljZSBtYXRjaGluZyB0aGUgZ2l2ZW4gY3JlZGVudGlhbCBJRC5cbiAqIEB0aHJvd3MgaWYgbm8gbWF0Y2hpbmcgZGV2aWNlIGlzIGZvdW5kXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBtYXRjaERldmljZUJ5Q3JlZGVudGlhbElkKGRldmljZXM6IFdlYmF1dGhuRGV2aWNlW10sIGNyZWRlbnRpYWxJZDogc3RyaW5nKTogV2ViYXV0aG5EZXZpY2Uge1xuICBjb25zdCBkZXZpY2UgPSBkZXZpY2VzLmZpbmQoKGQpID0+IGQuYXV0aGVudGljYXRvckluZm8uY3JlZElEID09PSBjcmVkZW50aWFsSWQpO1xuICBpZiAoIWRldmljZSkge1xuICAgIHRocm93IG5ldyBFcnJvcignQ291bGQgbm90IGlkZW50aWZ5IHdoaWNoIHBhc3NrZXkgZGV2aWNlIHdhcyB1c2VkJyk7XG4gIH1cbiAgcmV0dXJuIGRldmljZTtcbn1cbiJdfQ==

package/dist/src/webAuthnTypes.d.ts

@@ -0,0 +1,18 @@
+export type { WebAuthnOtpDevice } from '@bitgo/public-types';
+/** Result of a WebAuthn assertion with the PRF extension. */
+export interface PasskeyAuthResult {
+    prfResult: ArrayBuffer | undefined;
+    credentialId: string;
+    otpCode: string;
+}
+/** Options for WebAuthnProvider.get(). */
+export interface PasskeyGetOptions {
+    publicKey: PublicKeyCredentialRequestOptions;
+    evalByCredential?: Record<string, string>;
+}
+/** Abstraction over the WebAuthn credential API. */
+export interface WebAuthnProvider {
+    create(options: PublicKeyCredentialCreationOptions): Promise<PublicKeyCredential>;
+    get(options: PasskeyGetOptions): Promise<PasskeyAuthResult>;
+}
+//# sourceMappingURL=webAuthnTypes.d.ts.map

package/dist/src/webAuthnTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webAuthnTypes.d.ts","sourceRoot":"","sources":["../../src/webAuthnTypes.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,WAAW,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,iCAAiC,CAAC;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,OAAO,EAAE,kCAAkC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClF,GAAG,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC7D"}

package/dist/src/webAuthnTypes.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid2ViQXV0aG5UeXBlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy93ZWJBdXRoblR5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgdHlwZSB7IFdlYkF1dGhuT3RwRGV2aWNlIH0gZnJvbSAnQGJpdGdvL3B1YmxpYy10eXBlcyc7XG5cbi8qKiBSZXN1bHQgb2YgYSBXZWJBdXRobiBhc3NlcnRpb24gd2l0aCB0aGUgUFJGIGV4dGVuc2lvbi4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUGFzc2tleUF1dGhSZXN1bHQge1xuICBwcmZSZXN1bHQ6IEFycmF5QnVmZmVyIHwgdW5kZWZpbmVkO1xuICBjcmVkZW50aWFsSWQ6IHN0cmluZztcbiAgb3RwQ29kZTogc3RyaW5nO1xufVxuXG4vKiogT3B0aW9ucyBmb3IgV2ViQXV0aG5Qcm92aWRlci5nZXQoKS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUGFzc2tleUdldE9wdGlvbnMge1xuICBwdWJsaWNLZXk6IFB1YmxpY0tleUNyZWRlbnRpYWxSZXF1ZXN0T3B0aW9ucztcbiAgZXZhbEJ5Q3JlZGVudGlhbD86IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG59XG5cbi8qKiBBYnN0cmFjdGlvbiBvdmVyIHRoZSBXZWJBdXRobiBjcmVkZW50aWFsIEFQSS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgV2ViQXV0aG5Qcm92aWRlciB7XG4gIGNyZWF0ZShvcHRpb25zOiBQdWJsaWNLZXlDcmVkZW50aWFsQ3JlYXRpb25PcHRpb25zKTogUHJvbWlzZTxQdWJsaWNLZXlDcmVkZW50aWFsPjtcbiAgZ2V0KG9wdGlvbnM6IFBhc3NrZXlHZXRPcHRpb25zKTogUHJvbWlzZTxQYXNza2V5QXV0aFJlc3VsdD47XG59XG4iXX0=

package/dist/test/unit/deriveEnterpriseSalt.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deriveEnterpriseSalt.test.d.ts.map

package/dist/test/unit/deriveEnterpriseSalt.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveEnterpriseSalt.test.d.ts","sourceRoot":"","sources":["../../../test/unit/deriveEnterpriseSalt.test.ts"],"names":[],"mappings":""}

package/dist/test/unit/deriveEnterpriseSalt.test.js

@@ -0,0 +1,73 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = __importStar(require("assert"));
+const src_1 = require("../../src");
+// Real fixture values captured from a live environment (DB + browser devtools)
+const REAL_FIXTURE = {
+    basePrfSalt: 'ZqJ64M2dL65zn2-Jxd58SMN2ILc9QjbCFxUTGHd_LC8',
+    enterpriseId: '69c2aea1a3d7bc07f7f775c0ca86b0ec',
+    expectedDerivedSalt: 'oiasOqzkuyuEz/8043+3IXYghSu3LV4N/a1MLIRzmU8=',
+};
+describe('deriveEnterpriseSalt', function () {
+    it('produces the correct derived salt for real fixture values', function () {
+        // Verifies SDK output matches what the retail UI produces for the same inputs,
+        // ensuring clients can move between SDK and retail app seamlessly.
+        assert.strictEqual((0, src_1.deriveEnterpriseSalt)(REAL_FIXTURE.basePrfSalt, REAL_FIXTURE.enterpriseId), REAL_FIXTURE.expectedDerivedSalt);
+    });
+    it('is deterministic — same inputs always produce the same salt', function () {
+        const first = (0, src_1.deriveEnterpriseSalt)(REAL_FIXTURE.basePrfSalt, REAL_FIXTURE.enterpriseId);
+        const second = (0, src_1.deriveEnterpriseSalt)(REAL_FIXTURE.basePrfSalt, REAL_FIXTURE.enterpriseId);
+        assert.ok(first);
+        assert.strictEqual(first, second);
+    });
+    it('produces different salts for different enterpriseIds with the same prfSalt', function () {
+        const saltA = (0, src_1.deriveEnterpriseSalt)(REAL_FIXTURE.basePrfSalt, REAL_FIXTURE.enterpriseId);
+        const saltB = (0, src_1.deriveEnterpriseSalt)(REAL_FIXTURE.basePrfSalt, 'different-enterprise-id');
+        assert.notStrictEqual(saltA, saltB);
+    });
+    it('produces different salts for different prfSalts with the same enterpriseId', function () {
+        const saltA = (0, src_1.deriveEnterpriseSalt)(REAL_FIXTURE.basePrfSalt, REAL_FIXTURE.enterpriseId);
+        const saltB = (0, src_1.deriveEnterpriseSalt)('deadbeefcafebabe0102030405060708', REAL_FIXTURE.enterpriseId);
+        assert.notStrictEqual(saltA, saltB);
+    });
+    it('returns a non-empty base64 string', function () {
+        const result = (0, src_1.deriveEnterpriseSalt)(REAL_FIXTURE.basePrfSalt, REAL_FIXTURE.enterpriseId);
+        assert.strictEqual(typeof result, 'string');
+        assert.ok(result.length > 0);
+        assert.match(result, /^[A-Za-z0-9+/]+=*$/);
+    });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZlRW50ZXJwcmlzZVNhbHQudGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3Rlc3QvdW5pdC9kZXJpdmVFbnRlcnByaXNlU2FsdC50ZXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsK0NBQWlDO0FBQ2pDLG1DQUFpRDtBQUVqRCwrRUFBK0U7QUFDL0UsTUFBTSxZQUFZLEdBQUc7SUFDbkIsV0FBVyxFQUFFLDZDQUE2QztJQUMxRCxZQUFZLEVBQUUsa0NBQWtDO0lBQ2hELG1CQUFtQixFQUFFLDhDQUE4QztDQUNwRSxDQUFDO0FBRUYsUUFBUSxDQUFDLHNCQUFzQixFQUFFO0lBQy9CLEVBQUUsQ0FBQywyREFBMkQsRUFBRTtRQUM5RCwrRUFBK0U7UUFDL0UsbUVBQW1FO1FBQ25FLE1BQU0sQ0FBQyxXQUFXLENBQ2hCLElBQUEsMEJBQW9CLEVBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxZQUFZLENBQUMsWUFBWSxDQUFDLEVBQ3pFLFlBQVksQ0FBQyxtQkFBbUIsQ0FDakMsQ0FBQztJQUNKLENBQUMsQ0FBQyxDQUFDO0lBRUgsRUFBRSxDQUFDLDZEQUE2RCxFQUFFO1FBQ2hFLE1BQU0sS0FBSyxHQUFHLElBQUEsMEJBQW9CLEVBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxZQUFZLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDeEYsTUFBTSxNQUFNLEdBQUcsSUFBQSwwQkFBb0IsRUFBQyxZQUFZLENBQUMsV0FBVyxFQUFFLFlBQVksQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN6RixNQUFNLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2pCLE1BQU0sQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3BDLENBQUMsQ0FBQyxDQUFDO0lBRUgsRUFBRSxDQUFDLDRFQUE0RSxFQUFFO1FBQy9FLE1BQU0sS0FBSyxHQUFHLElBQUEsMEJBQW9CLEVBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxZQUFZLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDeEYsTUFBTSxLQUFLLEdBQUcsSUFBQSwwQkFBb0IsRUFBQyxZQUFZLENBQUMsV0FBVyxFQUFFLHlCQUF5QixDQUFDLENBQUM7UUFDeEYsTUFBTSxDQUFDLGNBQWMsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDdEMsQ0FBQyxDQUFDLENBQUM7SUFFSCxFQUFFLENBQUMsNEVBQTRFLEVBQUU7UUFDL0UsTUFBTSxLQUFLLEdBQUcsSUFBQSwwQkFBb0IsRUFBQyxZQUFZLENBQUMsV0FBVyxFQUFFLFlBQVksQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN4RixNQUFNLEtBQUssR0FBRyxJQUFBLDBCQUFvQixFQUFDLGtDQUFrQyxFQUFFLFlBQVksQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNsRyxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQztJQUN0QyxDQUFDLENBQUMsQ0FBQztJQUVILEVBQUUsQ0FBQyxtQ0FBbUMsRUFBRTtRQUN0QyxNQUFNLE1BQU0sR0FBRyxJQUFBLDBCQUFvQixFQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsWUFBWSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3pGLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDNUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQzdCLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLG9CQUFvQixDQUFDLENBQUM7SUFDN0MsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGFzc2VydCBmcm9tICdhc3NlcnQnO1xuaW1wb3J0IHsgZGVyaXZlRW50ZXJwcmlzZVNhbHQgfSBmcm9tICcuLi8uLi9zcmMnO1xuXG4vLyBSZWFsIGZpeHR1cmUgdmFsdWVzIGNhcHR1cmVkIGZyb20gYSBsaXZlIGVudmlyb25tZW50IChEQiArIGJyb3dzZXIgZGV2dG9vbHMpXG5jb25zdCBSRUFMX0ZJWFRVUkUgPSB7XG4gIGJhc2VQcmZTYWx0OiAnWnFKNjRNMmRMNjV6bjItSnhkNThTTU4ySUxjOVFqYkNGeFVUR0hkX0xDOCcsXG4gIGVudGVycHJpc2VJZDogJzY5YzJhZWExYTNkN2JjMDdmN2Y3NzVjMGNhODZiMGVjJyxcbiAgZXhwZWN0ZWREZXJpdmVkU2FsdDogJ29pYXNPcXprdXl1RXovODA0MyszSVhZZ2hTdTNMVjROL2ExTUxJUnptVTg9Jyxcbn07XG5cbmRlc2NyaWJlKCdkZXJpdmVFbnRlcnByaXNlU2FsdCcsIGZ1bmN0aW9uICgpIHtcbiAgaXQoJ3Byb2R1Y2VzIHRoZSBjb3JyZWN0IGRlcml2ZWQgc2FsdCBmb3IgcmVhbCBmaXh0dXJlIHZhbHVlcycsIGZ1bmN0aW9uICgpIHtcbiAgICAvLyBWZXJpZmllcyBTREsgb3V0cHV0IG1hdGNoZXMgd2hhdCB0aGUgcmV0YWlsIFVJIHByb2R1Y2VzIGZvciB0aGUgc2FtZSBpbnB1dHMsXG4gICAgLy8gZW5zdXJpbmcgY2xpZW50cyBjYW4gbW92ZSBiZXR3ZWVuIFNESyBhbmQgcmV0YWlsIGFwcCBzZWFtbGVzc2x5LlxuICAgIGFzc2VydC5zdHJpY3RFcXVhbChcbiAgICAgIGRlcml2ZUVudGVycHJpc2VTYWx0KFJFQUxfRklYVFVSRS5iYXNlUHJmU2FsdCwgUkVBTF9GSVhUVVJFLmVudGVycHJpc2VJZCksXG4gICAgICBSRUFMX0ZJWFRVUkUuZXhwZWN0ZWREZXJpdmVkU2FsdFxuICAgICk7XG4gIH0pO1xuXG4gIGl0KCdpcyBkZXRlcm1pbmlzdGljIOKAlCBzYW1lIGlucHV0cyBhbHdheXMgcHJvZHVjZSB0aGUgc2FtZSBzYWx0JywgZnVuY3Rpb24gKCkge1xuICAgIGNvbnN0IGZpcnN0ID0gZGVyaXZlRW50ZXJwcmlzZVNhbHQoUkVBTF9GSVhUVVJFLmJhc2VQcmZTYWx0LCBSRUFMX0ZJWFRVUkUuZW50ZXJwcmlzZUlkKTtcbiAgICBjb25zdCBzZWNvbmQgPSBkZXJpdmVFbnRlcnByaXNlU2FsdChSRUFMX0ZJWFRVUkUuYmFzZVByZlNhbHQsIFJFQUxfRklYVFVSRS5lbnRlcnByaXNlSWQpO1xuICAgIGFzc2VydC5vayhmaXJzdCk7XG4gICAgYXNzZXJ0LnN0cmljdEVxdWFsKGZpcnN0LCBzZWNvbmQpO1xuICB9KTtcblxuICBpdCgncHJvZHVjZXMgZGlmZmVyZW50IHNhbHRzIGZvciBkaWZmZXJlbnQgZW50ZXJwcmlzZUlkcyB3aXRoIHRoZSBzYW1lIHByZlNhbHQnLCBmdW5jdGlvbiAoKSB7XG4gICAgY29uc3Qgc2FsdEEgPSBkZXJpdmVFbnRlcnByaXNlU2FsdChSRUFMX0ZJWFRVUkUuYmFzZVByZlNhbHQsIFJFQUxfRklYVFVSRS5lbnRlcnByaXNlSWQpO1xuICAgIGNvbnN0IHNhbHRCID0gZGVyaXZlRW50ZXJwcmlzZVNhbHQoUkVBTF9GSVhUVVJFLmJhc2VQcmZTYWx0LCAnZGlmZmVyZW50LWVudGVycHJpc2UtaWQnKTtcbiAgICBhc3NlcnQubm90U3RyaWN0RXF1YWwoc2FsdEEsIHNhbHRCKTtcbiAgfSk7XG5cbiAgaXQoJ3Byb2R1Y2VzIGRpZmZlcmVudCBzYWx0cyBmb3IgZGlmZmVyZW50IHByZlNhbHRzIHdpdGggdGhlIHNhbWUgZW50ZXJwcmlzZUlkJywgZnVuY3Rpb24gKCkge1xuICAgIGNvbnN0IHNhbHRBID0gZGVyaXZlRW50ZXJwcmlzZVNhbHQoUkVBTF9GSVhUVVJFLmJhc2VQcmZTYWx0LCBSRUFMX0ZJWFRVUkUuZW50ZXJwcmlzZUlkKTtcbiAgICBjb25zdCBzYWx0QiA9IGRlcml2ZUVudGVycHJpc2VTYWx0KCdkZWFkYmVlZmNhZmViYWJlMDEwMjAzMDQwNTA2MDcwOCcsIFJFQUxfRklYVFVSRS5lbnRlcnByaXNlSWQpO1xuICAgIGFzc2VydC5ub3RTdHJpY3RFcXVhbChzYWx0QSwgc2FsdEIpO1xuICB9KTtcblxuICBpdCgncmV0dXJucyBhIG5vbi1lbXB0eSBiYXNlNjQgc3RyaW5nJywgZnVuY3Rpb24gKCkge1xuICAgIGNvbnN0IHJlc3VsdCA9IGRlcml2ZUVudGVycHJpc2VTYWx0KFJFQUxfRklYVFVSRS5iYXNlUHJmU2FsdCwgUkVBTF9GSVhUVVJFLmVudGVycHJpc2VJZCk7XG4gICAgYXNzZXJ0LnN0cmljdEVxdWFsKHR5cGVvZiByZXN1bHQsICdzdHJpbmcnKTtcbiAgICBhc3NlcnQub2socmVzdWx0Lmxlbmd0aCA+IDApO1xuICAgIGFzc2VydC5tYXRjaChyZXN1bHQsIC9eW0EtWmEtejAtOSsvXSs9KiQvKTtcbiAgfSk7XG59KTtcbiJdfQ==

package/dist/test/unit/derivePassword.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=derivePassword.test.d.ts.map

package/dist/test/unit/derivePassword.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivePassword.test.d.ts","sourceRoot":"","sources":["../../../test/unit/derivePassword.test.ts"],"names":[],"mappings":""}

package/dist/test/unit/derivePassword.test.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = __importStar(require("assert"));
+const src_1 = require("../../src");
+// Real fixture values captured from a live environment (browser devtools)
+const REAL_FIXTURE = {
+    prfOutputBase64: 'Hly0eFbg+8ZX9B2GWuDlNTRkvSLF0nHRTTOvw+ljAzs=',
+    expectedPasswordHex: '1e5cb47856e0fbc657f41d865ae0e5353464bd22c5d271d14d33afc3e963033b',
+};
+describe('derivePassword', function () {
+    it('produces the correct hex password for real PRF output fixture', function () {
+        // Verifies SDK output matches what the retail UI produces for the same PRF result,
+        // ensuring clients can move between SDK and retail app seamlessly.
+        const prfBuffer = Buffer.from(REAL_FIXTURE.prfOutputBase64, 'base64');
+        assert.strictEqual((0, src_1.derivePassword)(new Uint8Array(prfBuffer).buffer), REAL_FIXTURE.expectedPasswordHex);
+    });
+    it('converts an ArrayBuffer of zeros to a hex string of zeros', function () {
+        assert.strictEqual((0, src_1.derivePassword)(new ArrayBuffer(4)), '00000000');
+    });
+    it('returns a lowercase hex string', function () {
+        const input = new Uint8Array([0xab, 0xcd]).buffer;
+        const result = (0, src_1.derivePassword)(input);
+        assert.strictEqual(result, result.toLowerCase());
+    });
+    it('returns a string of length 2x the input byte length', function () {
+        assert.strictEqual((0, src_1.derivePassword)(new ArrayBuffer(32)).length, 64);
+    });
+    it('is deterministic — same inputs produce same output', function () {
+        const input = new Uint8Array([1, 2, 3, 4, 5]).buffer;
+        assert.strictEqual((0, src_1.derivePassword)(input), (0, src_1.derivePassword)(input));
+    });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZlUGFzc3dvcmQudGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3Rlc3QvdW5pdC9kZXJpdmVQYXNzd29yZC50ZXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsK0NBQWlDO0FBQ2pDLG1DQUEyQztBQUUzQywwRUFBMEU7QUFDMUUsTUFBTSxZQUFZLEdBQUc7SUFDbkIsZUFBZSxFQUFFLDhDQUE4QztJQUMvRCxtQkFBbUIsRUFBRSxrRUFBa0U7Q0FDeEYsQ0FBQztBQUVGLFFBQVEsQ0FBQyxnQkFBZ0IsRUFBRTtJQUN6QixFQUFFLENBQUMsK0RBQStELEVBQUU7UUFDbEUsbUZBQW1GO1FBQ25GLG1FQUFtRTtRQUNuRSxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDdEUsTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFBLG9CQUFjLEVBQUMsSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQUUsWUFBWSxDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDekcsQ0FBQyxDQUFDLENBQUM7SUFFSCxFQUFFLENBQUMsMkRBQTJELEVBQUU7UUFDOUQsTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFBLG9CQUFjLEVBQUMsSUFBSSxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNyRSxDQUFDLENBQUMsQ0FBQztJQUVILEVBQUUsQ0FBQyxnQ0FBZ0MsRUFBRTtRQUNuQyxNQUFNLEtBQUssR0FBRyxJQUFJLFVBQVUsQ0FBQyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztRQUNsRCxNQUFNLE1BQU0sR0FBRyxJQUFBLG9CQUFjLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDckMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFDbkQsQ0FBQyxDQUFDLENBQUM7SUFFSCxFQUFFLENBQUMscURBQXFELEVBQUU7UUFDeEQsTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFBLG9CQUFjLEVBQUMsSUFBSSxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDckUsQ0FBQyxDQUFDLENBQUM7SUFFSCxFQUFFLENBQUMsb0RBQW9ELEVBQUU7UUFDdkQsTUFBTSxLQUFLLEdBQUcsSUFBSSxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7UUFDckQsTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFBLG9CQUFjLEVBQUMsS0FBSyxDQUFDLEVBQUUsSUFBQSxvQkFBYyxFQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDbkUsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGFzc2VydCBmcm9tICdhc3NlcnQnO1xuaW1wb3J0IHsgZGVyaXZlUGFzc3dvcmQgfSBmcm9tICcuLi8uLi9zcmMnO1xuXG4vLyBSZWFsIGZpeHR1cmUgdmFsdWVzIGNhcHR1cmVkIGZyb20gYSBsaXZlIGVudmlyb25tZW50IChicm93c2VyIGRldnRvb2xzKVxuY29uc3QgUkVBTF9GSVhUVVJFID0ge1xuICBwcmZPdXRwdXRCYXNlNjQ6ICdIbHkwZUZiZys4Wlg5QjJHV3VEbE5UUmt2U0xGMG5IUlRUT3Z3K2xqQXpzPScsXG4gIGV4cGVjdGVkUGFzc3dvcmRIZXg6ICcxZTVjYjQ3ODU2ZTBmYmM2NTdmNDFkODY1YWUwZTUzNTM0NjRiZDIyYzVkMjcxZDE0ZDMzYWZjM2U5NjMwMzNiJyxcbn07XG5cbmRlc2NyaWJlKCdkZXJpdmVQYXNzd29yZCcsIGZ1bmN0aW9uICgpIHtcbiAgaXQoJ3Byb2R1Y2VzIHRoZSBjb3JyZWN0IGhleCBwYXNzd29yZCBmb3IgcmVhbCBQUkYgb3V0cHV0IGZpeHR1cmUnLCBmdW5jdGlvbiAoKSB7XG4gICAgLy8gVmVyaWZpZXMgU0RLIG91dHB1dCBtYXRjaGVzIHdoYXQgdGhlIHJldGFpbCBVSSBwcm9kdWNlcyBmb3IgdGhlIHNhbWUgUFJGIHJlc3VsdCxcbiAgICAvLyBlbnN1cmluZyBjbGllbnRzIGNhbiBtb3ZlIGJldHdlZW4gU0RLIGFuZCByZXRhaWwgYXBwIHNlYW1sZXNzbHkuXG4gICAgY29uc3QgcHJmQnVmZmVyID0gQnVmZmVyLmZyb20oUkVBTF9GSVhUVVJFLnByZk91dHB1dEJhc2U2NCwgJ2Jhc2U2NCcpO1xuICAgIGFzc2VydC5zdHJpY3RFcXVhbChkZXJpdmVQYXNzd29yZChuZXcgVWludDhBcnJheShwcmZCdWZmZXIpLmJ1ZmZlciksIFJFQUxfRklYVFVSRS5leHBlY3RlZFBhc3N3b3JkSGV4KTtcbiAgfSk7XG5cbiAgaXQoJ2NvbnZlcnRzIGFuIEFycmF5QnVmZmVyIG9mIHplcm9zIHRvIGEgaGV4IHN0cmluZyBvZiB6ZXJvcycsIGZ1bmN0aW9uICgpIHtcbiAgICBhc3NlcnQuc3RyaWN0RXF1YWwoZGVyaXZlUGFzc3dvcmQobmV3IEFycmF5QnVmZmVyKDQpKSwgJzAwMDAwMDAwJyk7XG4gIH0pO1xuXG4gIGl0KCdyZXR1cm5zIGEgbG93ZXJjYXNlIGhleCBzdHJpbmcnLCBmdW5jdGlvbiAoKSB7XG4gICAgY29uc3QgaW5wdXQgPSBuZXcgVWludDhBcnJheShbMHhhYiwgMHhjZF0pLmJ1ZmZlcjtcbiAgICBjb25zdCByZXN1bHQgPSBkZXJpdmVQYXNzd29yZChpbnB1dCk7XG4gICAgYXNzZXJ0LnN0cmljdEVxdWFsKHJlc3VsdCwgcmVzdWx0LnRvTG93ZXJDYXNlKCkpO1xuICB9KTtcblxuICBpdCgncmV0dXJucyBhIHN0cmluZyBvZiBsZW5ndGggMnggdGhlIGlucHV0IGJ5dGUgbGVuZ3RoJywgZnVuY3Rpb24gKCkge1xuICAgIGFzc2VydC5zdHJpY3RFcXVhbChkZXJpdmVQYXNzd29yZChuZXcgQXJyYXlCdWZmZXIoMzIpKS5sZW5ndGgsIDY0KTtcbiAgfSk7XG5cbiAgaXQoJ2lzIGRldGVybWluaXN0aWMg4oCUIHNhbWUgaW5wdXRzIHByb2R1Y2Ugc2FtZSBvdXRwdXQnLCBmdW5jdGlvbiAoKSB7XG4gICAgY29uc3QgaW5wdXQgPSBuZXcgVWludDhBcnJheShbMSwgMiwgMywgNCwgNV0pLmJ1ZmZlcjtcbiAgICBhc3NlcnQuc3RyaWN0RXF1YWwoZGVyaXZlUGFzc3dvcmQoaW5wdXQpLCBkZXJpdmVQYXNzd29yZChpbnB1dCkpO1xuICB9KTtcbn0pO1xuIl19

package/dist/test/unit/prfHelpers.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=prfHelpers.test.d.ts.map

package/dist/test/unit/prfHelpers.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prfHelpers.test.d.ts","sourceRoot":"","sources":["../../../test/unit/prfHelpers.test.ts"],"names":[],"mappings":""}