@bitgo/passkey-crypto 0.0.1 → 0.3.0

package/LICENSE

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2022 BitGo
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/src/attachPasskeyToWallet.d.ts

@@ -0,0 +1,11 @@
+import { BitGoBase, Keychain } from '@bitgo/sdk-core';
+import { WebAuthnOtpDevice, WebAuthnProvider } from './webAuthnTypes';
+export declare function attachPasskeyToWallet(params: {
+    bitgo: BitGoBase;
+    coin: string;
+    walletId: string;
+    device: WebAuthnOtpDevice;
+    existingPassphrase: string;
+    provider: WebAuthnProvider;
+}): Promise<Keychain>;
+//# sourceMappingURL=attachPasskeyToWallet.d.ts.map

package/dist/src/attachPasskeyToWallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachPasskeyToWallet.d.ts","sourceRoot":"","sources":["../../src/attachPasskeyToWallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAItD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEtE,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqEpB"}

package/dist/src/attachPasskeyToWallet.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attachPasskeyToWallet = attachPasskeyToWallet;
+const base64url_1 = require("./base64url");
+const deriveEnterpriseSalt_1 = require("./deriveEnterpriseSalt");
+const derivePassword_1 = require("./derivePassword");
+async function attachPasskeyToWallet(params) {
+    const { bitgo, coin, walletId, device, existingPassphrase, provider } = params;
+    // Throw early if PRF extension is not supported
+    if (!device.prfSalt) {
+        throw new Error('PRF extension not supported by this device. Please use a different passkey.');
+    }
+    const baseCoin = bitgo.coin(coin);
+    // Fetch wallet and validate it is a hot wallet
+    const wallet = await baseCoin.wallets().get({ id: walletId });
+    if (wallet.type() !== 'hot') {
+        throw new Error(`Wallet ${walletId} is not a hot wallet. Only hot wallets support passkey attachment.`);
+    }
+    const walletData = wallet.toJSON();
+    const enterpriseId = walletData.enterprise;
+    if (!enterpriseId) {
+        throw new Error(`Wallet ${walletId} has no enterprise.`);
+    }
+    // Fetch the user keychain — iterates keys until it finds one with encryptedPrv
+    const keychain = await wallet.getEncryptedUserKeychain();
+    const keychainId = keychain.id;
+    // Derive enterprise-scoped salt (base64url; same encoding is used as the
+    // PRF eval input and as the server-stored prfSalt so the bytes fed to the
+    // authenticator match between attach and derive).
+    const prfSalt = (0, deriveEnterpriseSalt_1.deriveEnterpriseSalt)(device.prfSalt, enterpriseId);
+    // Decrypt private key with existing passphrase
+    const privateKey = bitgo.decrypt({ password: existingPassphrase, input: keychain.encryptedPrv });
+    // Decode credentialId from base64url to ArrayBuffer for allowCredentials.
+    // The WebAuthn spec requires allowCredentials to be non-empty when using evalByCredential,
+    // and each entry must correspond to a key in the evalByCredential map.
+    const credentialIdBuffer = (0, base64url_1.base64UrlToBuffer)(device.credentialId).buffer;
+    // PRF assertion — evalByCredential maps this device's credentialId to the
+    // base64url enterprise salt. The provider layer is responsible for decoding
+    // base64url to raw bytes before handing it to the WebAuthn PRF extension.
+    const authResult = await provider.get({
+        publicKey: {
+            allowCredentials: [{ type: 'public-key', id: credentialIdBuffer }],
+        },
+        evalByCredential: { [device.credentialId]: prfSalt },
+    });
+    if (!authResult.prfResult) {
+        throw new Error('PRF assertion did not return a result.');
+    }
+    const prfPassword = (0, derivePassword_1.derivePassword)(authResult.prfResult);
+    const encryptedPrv = bitgo.encrypt({ password: prfPassword, input: privateKey });
+    const updatedKeychain = await bitgo
+        .put(bitgo.url(`/${coin}/key/${keychainId}`, 2))
+        .send({
+        webauthnInfo: {
+            prfSalt,
+            otpDeviceId: device.id,
+            encryptedPrv,
+        },
+    })
+        .result();
+    return updatedKeychain;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0YWNoUGFzc2tleVRvV2FsbGV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2F0dGFjaFBhc3NrZXlUb1dhbGxldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQU1BLHNEQTRFQztBQWpGRCwyQ0FBZ0Q7QUFDaEQsaUVBQThEO0FBQzlELHFEQUFrRDtBQUczQyxLQUFLLFVBQVUscUJBQXFCLENBQUMsTUFPM0M7SUFDQyxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixFQUFFLFFBQVEsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUUvRSxnREFBZ0Q7SUFDaEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNwQixNQUFNLElBQUksS0FBSyxDQUFDLDZFQUE2RSxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFbEMsK0NBQStDO0lBQy9DLE1BQU0sTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBRTlELElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsVUFBVSxRQUFRLG9FQUFvRSxDQUFDLENBQUM7SUFDMUcsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUNuQyxNQUFNLFlBQVksR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDO0lBQzNDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUNsQixNQUFNLElBQUksS0FBSyxDQUFDLFVBQVUsUUFBUSxxQkFBcUIsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFRCwrRUFBK0U7SUFDL0UsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsd0JBQXdCLEVBQUUsQ0FBQztJQUN6RCxNQUFNLFVBQVUsR0FBRyxRQUFRLENBQUMsRUFBRSxDQUFDO0lBRS9CLHlFQUF5RTtJQUN6RSwwRUFBMEU7SUFDMUUsa0RBQWtEO0lBQ2xELE1BQU0sT0FBTyxHQUFHLElBQUEsMkNBQW9CLEVBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxZQUFZLENBQUMsQ0FBQztJQUVuRSwrQ0FBK0M7SUFDL0MsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFFBQVEsRUFBRSxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsUUFBUSxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUM7SUFFakcsMEVBQTBFO0lBQzFFLDJGQUEyRjtJQUMzRix1RUFBdUU7SUFDdkUsTUFBTSxrQkFBa0IsR0FBRyxJQUFBLDZCQUFpQixFQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFFekUsMEVBQTBFO0lBQzFFLDRFQUE0RTtJQUM1RSwwRUFBMEU7SUFDMUUsTUFBTSxVQUFVLEdBQUcsTUFBTSxRQUFRLENBQUMsR0FBRyxDQUFDO1FBQ3BDLFNBQVMsRUFBRTtZQUNULGdCQUFnQixFQUFFLENBQUMsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLEVBQUUsRUFBRSxrQkFBa0IsRUFBRSxDQUFDO1NBQzlCO1FBQ3RDLGdCQUFnQixFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsT0FBTyxFQUFFO0tBQ3JELENBQUMsQ0FBQztJQUVILElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFFRCxNQUFNLFdBQVcsR0FBRyxJQUFBLCtCQUFjLEVBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3pELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBRWpGLE1BQU0sZUFBZSxHQUFHLE1BQU0sS0FBSztTQUNoQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksUUFBUSxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQztTQUMvQyxJQUFJLENBQUM7UUFDSixZQUFZLEVBQUU7WUFDWixPQUFPO1lBQ1AsV0FBVyxFQUFFLE1BQU0sQ0FBQyxFQUFFO1lBQ3RCLFlBQVk7U0FDYjtLQUNGLENBQUM7U0FDRCxNQUFNLEVBQUUsQ0FBQztJQUVaLE9BQU8sZUFBMkIsQ0FBQztBQUNyQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQml0R29CYXNlLCBLZXljaGFpbiB9IGZyb20gJ0BiaXRnby9zZGstY29yZSc7XG5pbXBvcnQgeyBiYXNlNjRVcmxUb0J1ZmZlciB9IGZyb20gJy4vYmFzZTY0dXJsJztcbmltcG9ydCB7IGRlcml2ZUVudGVycHJpc2VTYWx0IH0gZnJvbSAnLi9kZXJpdmVFbnRlcnByaXNlU2FsdCc7XG5pbXBvcnQgeyBkZXJpdmVQYXNzd29yZCB9IGZyb20gJy4vZGVyaXZlUGFzc3dvcmQnO1xuaW1wb3J0IHsgV2ViQXV0aG5PdHBEZXZpY2UsIFdlYkF1dGhuUHJvdmlkZXIgfSBmcm9tICcuL3dlYkF1dGhuVHlwZXMnO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gYXR0YWNoUGFzc2tleVRvV2FsbGV0KHBhcmFtczoge1xuICBiaXRnbzogQml0R29CYXNlO1xuICBjb2luOiBzdHJpbmc7XG4gIHdhbGxldElkOiBzdHJpbmc7XG4gIGRldmljZTogV2ViQXV0aG5PdHBEZXZpY2U7XG4gIGV4aXN0aW5nUGFzc3BocmFzZTogc3RyaW5nO1xuICBwcm92aWRlcjogV2ViQXV0aG5Qcm92aWRlcjtcbn0pOiBQcm9taXNlPEtleWNoYWluPiB7XG4gIGNvbnN0IHsgYml0Z28sIGNvaW4sIHdhbGxldElkLCBkZXZpY2UsIGV4aXN0aW5nUGFzc3BocmFzZSwgcHJvdmlkZXIgfSA9IHBhcmFtcztcblxuICAvLyBUaHJvdyBlYXJseSBpZiBQUkYgZXh0ZW5zaW9uIGlzIG5vdCBzdXBwb3J0ZWRcbiAgaWYgKCFkZXZpY2UucHJmU2FsdCkge1xuICAgIHRocm93IG5ldyBFcnJvcignUFJGIGV4dGVuc2lvbiBub3Qgc3VwcG9ydGVkIGJ5IHRoaXMgZGV2aWNlLiBQbGVhc2UgdXNlIGEgZGlmZmVyZW50IHBhc3NrZXkuJyk7XG4gIH1cblxuICBjb25zdCBiYXNlQ29pbiA9IGJpdGdvLmNvaW4oY29pbik7XG5cbiAgLy8gRmV0Y2ggd2FsbGV0IGFuZCB2YWxpZGF0ZSBpdCBpcyBhIGhvdCB3YWxsZXRcbiAgY29uc3Qgd2FsbGV0ID0gYXdhaXQgYmFzZUNvaW4ud2FsbGV0cygpLmdldCh7IGlkOiB3YWxsZXRJZCB9KTtcblxuICBpZiAod2FsbGV0LnR5cGUoKSAhPT0gJ2hvdCcpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYFdhbGxldCAke3dhbGxldElkfSBpcyBub3QgYSBob3Qgd2FsbGV0LiBPbmx5IGhvdCB3YWxsZXRzIHN1cHBvcnQgcGFzc2tleSBhdHRhY2htZW50LmApO1xuICB9XG5cbiAgY29uc3Qgd2FsbGV0RGF0YSA9IHdhbGxldC50b0pTT04oKTtcbiAgY29uc3QgZW50ZXJwcmlzZUlkID0gd2FsbGV0RGF0YS5lbnRlcnByaXNlO1xuICBpZiAoIWVudGVycHJpc2VJZCkge1xuICAgIHRocm93IG5ldyBFcnJvcihgV2FsbGV0ICR7d2FsbGV0SWR9IGhhcyBubyBlbnRlcnByaXNlLmApO1xuICB9XG5cbiAgLy8gRmV0Y2ggdGhlIHVzZXIga2V5Y2hhaW4g4oCUIGl0ZXJhdGVzIGtleXMgdW50aWwgaXQgZmluZHMgb25lIHdpdGggZW5jcnlwdGVkUHJ2XG4gIGNvbnN0IGtleWNoYWluID0gYXdhaXQgd2FsbGV0LmdldEVuY3J5cHRlZFVzZXJLZXljaGFpbigpO1xuICBjb25zdCBrZXljaGFpbklkID0ga2V5Y2hhaW4uaWQ7XG5cbiAgLy8gRGVyaXZlIGVudGVycHJpc2Utc2NvcGVkIHNhbHQgKGJhc2U2NHVybDsgc2FtZSBlbmNvZGluZyBpcyB1c2VkIGFzIHRoZVxuICAvLyBQUkYgZXZhbCBpbnB1dCBhbmQgYXMgdGhlIHNlcnZlci1zdG9yZWQgcHJmU2FsdCBzbyB0aGUgYnl0ZXMgZmVkIHRvIHRoZVxuICAvLyBhdXRoZW50aWNhdG9yIG1hdGNoIGJldHdlZW4gYXR0YWNoIGFuZCBkZXJpdmUpLlxuICBjb25zdCBwcmZTYWx0ID0gZGVyaXZlRW50ZXJwcmlzZVNhbHQoZGV2aWNlLnByZlNhbHQsIGVudGVycHJpc2VJZCk7XG5cbiAgLy8gRGVjcnlwdCBwcml2YXRlIGtleSB3aXRoIGV4aXN0aW5nIHBhc3NwaHJhc2VcbiAgY29uc3QgcHJpdmF0ZUtleSA9IGJpdGdvLmRlY3J5cHQoeyBwYXNzd29yZDogZXhpc3RpbmdQYXNzcGhyYXNlLCBpbnB1dDoga2V5Y2hhaW4uZW5jcnlwdGVkUHJ2IH0pO1xuXG4gIC8vIERlY29kZSBjcmVkZW50aWFsSWQgZnJvbSBiYXNlNjR1cmwgdG8gQXJyYXlCdWZmZXIgZm9yIGFsbG93Q3JlZGVudGlhbHMuXG4gIC8vIFRoZSBXZWJBdXRobiBzcGVjIHJlcXVpcmVzIGFsbG93Q3JlZGVudGlhbHMgdG8gYmUgbm9uLWVtcHR5IHdoZW4gdXNpbmcgZXZhbEJ5Q3JlZGVudGlhbCxcbiAgLy8gYW5kIGVhY2ggZW50cnkgbXVzdCBjb3JyZXNwb25kIHRvIGEga2V5IGluIHRoZSBldmFsQnlDcmVkZW50aWFsIG1hcC5cbiAgY29uc3QgY3JlZGVudGlhbElkQnVmZmVyID0gYmFzZTY0VXJsVG9CdWZmZXIoZGV2aWNlLmNyZWRlbnRpYWxJZCkuYnVmZmVyO1xuXG4gIC8vIFBSRiBhc3NlcnRpb24g4oCUIGV2YWxCeUNyZWRlbnRpYWwgbWFwcyB0aGlzIGRldmljZSdzIGNyZWRlbnRpYWxJZCB0byB0aGVcbiAgLy8gYmFzZTY0dXJsIGVudGVycHJpc2Ugc2FsdC4gVGhlIHByb3ZpZGVyIGxheWVyIGlzIHJlc3BvbnNpYmxlIGZvciBkZWNvZGluZ1xuICAvLyBiYXNlNjR1cmwgdG8gcmF3IGJ5dGVzIGJlZm9yZSBoYW5kaW5nIGl0IHRvIHRoZSBXZWJBdXRobiBQUkYgZXh0ZW5zaW9uLlxuICBjb25zdCBhdXRoUmVzdWx0ID0gYXdhaXQgcHJvdmlkZXIuZ2V0KHtcbiAgICBwdWJsaWNLZXk6IHtcbiAgICAgIGFsbG93Q3JlZGVudGlhbHM6IFt7IHR5cGU6ICdwdWJsaWMta2V5JywgaWQ6IGNyZWRlbnRpYWxJZEJ1ZmZlciB9XSxcbiAgICB9IGFzIFB1YmxpY0tleUNyZWRlbnRpYWxSZXF1ZXN0T3B0aW9ucyxcbiAgICBldmFsQnlDcmVkZW50aWFsOiB7IFtkZXZpY2UuY3JlZGVudGlhbElkXTogcHJmU2FsdCB9LFxuICB9KTtcblxuICBpZiAoIWF1dGhSZXN1bHQucHJmUmVzdWx0KSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdQUkYgYXNzZXJ0aW9uIGRpZCBub3QgcmV0dXJuIGEgcmVzdWx0LicpO1xuICB9XG5cbiAgY29uc3QgcHJmUGFzc3dvcmQgPSBkZXJpdmVQYXNzd29yZChhdXRoUmVzdWx0LnByZlJlc3VsdCk7XG4gIGNvbnN0IGVuY3J5cHRlZFBydiA9IGJpdGdvLmVuY3J5cHQoeyBwYXNzd29yZDogcHJmUGFzc3dvcmQsIGlucHV0OiBwcml2YXRlS2V5IH0pO1xuXG4gIGNvbnN0IHVwZGF0ZWRLZXljaGFpbiA9IGF3YWl0IGJpdGdvXG4gICAgLnB1dChiaXRnby51cmwoYC8ke2NvaW59L2tleS8ke2tleWNoYWluSWR9YCwgMikpXG4gICAgLnNlbmQoe1xuICAgICAgd2ViYXV0aG5JbmZvOiB7XG4gICAgICAgIHByZlNhbHQsXG4gICAgICAgIG90cERldmljZUlkOiBkZXZpY2UuaWQsXG4gICAgICAgIGVuY3J5cHRlZFBydixcbiAgICAgIH0sXG4gICAgfSlcbiAgICAucmVzdWx0KCk7XG5cbiAgcmV0dXJuIHVwZGF0ZWRLZXljaGFpbiBhcyBLZXljaGFpbjtcbn1cbiJdfQ==

package/dist/src/base64url.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Base64url encoding helpers.
+ *
+ * Base64url uses the same alphabet as standard base64 except `+` becomes `-`,
+ * `/` becomes `_`, and padding (`=`) is stripped. Browser WebAuthn APIs and
+ * the BitGo server both use base64url for credential IDs and PRF salts, so we
+ * normalise to it everywhere on the client to avoid mismatches caused by
+ * mixing encodings.
+ */
+/** Converts a standard base64 string (or already-base64url string) to base64url. */
+export declare function toBase64Url(s: string): string;
+/** Encodes an ArrayBuffer or Buffer as a base64url string (no padding). */
+export declare function bufferToBase64Url(buffer: ArrayBuffer | Buffer): string;
+/** Decodes a base64url string into a Buffer. */
+export declare function base64UrlToBuffer(s: string): Buffer;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/src/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/base64url.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,CAEtE;AAED,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/dist/src/base64url.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * Base64url encoding helpers.
+ *
+ * Base64url uses the same alphabet as standard base64 except `+` becomes `-`,
+ * `/` becomes `_`, and padding (`=`) is stripped. Browser WebAuthn APIs and
+ * the BitGo server both use base64url for credential IDs and PRF salts, so we
+ * normalise to it everywhere on the client to avoid mismatches caused by
+ * mixing encodings.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toBase64Url = toBase64Url;
+exports.bufferToBase64Url = bufferToBase64Url;
+exports.base64UrlToBuffer = base64UrlToBuffer;
+/** Converts a standard base64 string (or already-base64url string) to base64url. */
+function toBase64Url(s) {
+    return s.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Encodes an ArrayBuffer or Buffer as a base64url string (no padding). */
+function bufferToBase64Url(buffer) {
+    return toBase64Url(Buffer.from(buffer).toString('base64'));
+}
+/** Decodes a base64url string into a Buffer. */
+function base64UrlToBuffer(s) {
+    return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmFzZTY0dXJsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2Jhc2U2NHVybC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUE7Ozs7Ozs7O0dBUUc7O0FBR0gsa0NBRUM7QUFHRCw4Q0FFQztBQUdELDhDQUVDO0FBYkQsb0ZBQW9GO0FBQ3BGLFNBQWdCLFdBQVcsQ0FBQyxDQUFTO0lBQ25DLE9BQU8sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBQ3RFLENBQUM7QUFFRCwyRUFBMkU7QUFDM0UsU0FBZ0IsaUJBQWlCLENBQUMsTUFBNEI7SUFDNUQsT0FBTyxXQUFXLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFxQixDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFDNUUsQ0FBQztBQUVELGdEQUFnRDtBQUNoRCxTQUFnQixpQkFBaUIsQ0FBQyxDQUFTO0lBQ3pDLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0FBQ3hFLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEJhc2U2NHVybCBlbmNvZGluZyBoZWxwZXJzLlxuICpcbiAqIEJhc2U2NHVybCB1c2VzIHRoZSBzYW1lIGFscGhhYmV0IGFzIHN0YW5kYXJkIGJhc2U2NCBleGNlcHQgYCtgIGJlY29tZXMgYC1gLFxuICogYC9gIGJlY29tZXMgYF9gLCBhbmQgcGFkZGluZyAoYD1gKSBpcyBzdHJpcHBlZC4gQnJvd3NlciBXZWJBdXRobiBBUElzIGFuZFxuICogdGhlIEJpdEdvIHNlcnZlciBib3RoIHVzZSBiYXNlNjR1cmwgZm9yIGNyZWRlbnRpYWwgSURzIGFuZCBQUkYgc2FsdHMsIHNvIHdlXG4gKiBub3JtYWxpc2UgdG8gaXQgZXZlcnl3aGVyZSBvbiB0aGUgY2xpZW50IHRvIGF2b2lkIG1pc21hdGNoZXMgY2F1c2VkIGJ5XG4gKiBtaXhpbmcgZW5jb2RpbmdzLlxuICovXG5cbi8qKiBDb252ZXJ0cyBhIHN0YW5kYXJkIGJhc2U2NCBzdHJpbmcgKG9yIGFscmVhZHktYmFzZTY0dXJsIHN0cmluZykgdG8gYmFzZTY0dXJsLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHRvQmFzZTY0VXJsKHM6IHN0cmluZyk6IHN0cmluZyB7XG4gIHJldHVybiBzLnJlcGxhY2UoL1xcKy9nLCAnLScpLnJlcGxhY2UoL1xcLy9nLCAnXycpLnJlcGxhY2UoLz0rJC8sICcnKTtcbn1cblxuLyoqIEVuY29kZXMgYW4gQXJyYXlCdWZmZXIgb3IgQnVmZmVyIGFzIGEgYmFzZTY0dXJsIHN0cmluZyAobm8gcGFkZGluZykuICovXG5leHBvcnQgZnVuY3Rpb24gYnVmZmVyVG9CYXNlNjRVcmwoYnVmZmVyOiBBcnJheUJ1ZmZlciB8IEJ1ZmZlcik6IHN0cmluZyB7XG4gIHJldHVybiB0b0Jhc2U2NFVybChCdWZmZXIuZnJvbShidWZmZXIgYXMgQXJyYXlCdWZmZXIpLnRvU3RyaW5nKCdiYXNlNjQnKSk7XG59XG5cbi8qKiBEZWNvZGVzIGEgYmFzZTY0dXJsIHN0cmluZyBpbnRvIGEgQnVmZmVyLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGJhc2U2NFVybFRvQnVmZmVyKHM6IHN0cmluZyk6IEJ1ZmZlciB7XG4gIHJldHVybiBCdWZmZXIuZnJvbShzLnJlcGxhY2UoLy0vZywgJysnKS5yZXBsYWNlKC9fL2csICcvJyksICdiYXNlNjQnKTtcbn1cbiJdfQ==

package/dist/src/deriveEnterpriseSalt.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Derives an enterprise-scoped PRF salt to prevent cross-enterprise key reuse.
+ *
+ * Computes HMAC-SHA256(key=prfSalt_base64url_decoded, data=enterpriseId_utf8).
+ * The baseSalt must always come from the server — never generate it client-side.
+ *
+ * Returns base64url so the same encoding is used everywhere the salt is handled
+ * (server storage, PRF eval input, prfHelpers lookup). Mixing encodings
+ * (e.g. hex on the client, base64url on the server) caused the PRF to receive
+ * different bytes during attach vs derive in browser environments where
+ * `Buffer.toString('hex')` is unreliable.
+ *
+ * @param baseSalt - Server-provided base64url-encoded PRF salt
+ * @param enterpriseId - Enterprise identifier
+ * @returns Base64url-encoded HMAC-SHA256 digest (no padding)
+ */
+export declare function deriveEnterpriseSalt(baseSalt: string, enterpriseId: string): string;
+//# sourceMappingURL=deriveEnterpriseSalt.d.ts.map

package/dist/src/deriveEnterpriseSalt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveEnterpriseSalt.d.ts","sourceRoot":"","sources":["../../src/deriveEnterpriseSalt.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnF"}

package/dist/src/deriveEnterpriseSalt.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveEnterpriseSalt = deriveEnterpriseSalt;
+const crypto_1 = require("crypto");
+const base64url_1 = require("./base64url");
+/**
+ * Derives an enterprise-scoped PRF salt to prevent cross-enterprise key reuse.
+ *
+ * Computes HMAC-SHA256(key=prfSalt_base64url_decoded, data=enterpriseId_utf8).
+ * The baseSalt must always come from the server — never generate it client-side.
+ *
+ * Returns base64url so the same encoding is used everywhere the salt is handled
+ * (server storage, PRF eval input, prfHelpers lookup). Mixing encodings
+ * (e.g. hex on the client, base64url on the server) caused the PRF to receive
+ * different bytes during attach vs derive in browser environments where
+ * `Buffer.toString('hex')` is unreliable.
+ *
+ * @param baseSalt - Server-provided base64url-encoded PRF salt
+ * @param enterpriseId - Enterprise identifier
+ * @returns Base64url-encoded HMAC-SHA256 digest (no padding)
+ */
+function deriveEnterpriseSalt(baseSalt, enterpriseId) {
+    const keyBytes = (0, base64url_1.base64UrlToBuffer)(baseSalt);
+    return (0, base64url_1.toBase64Url)((0, crypto_1.createHmac)('sha256', keyBytes).update(enterpriseId).digest('base64'));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZlRW50ZXJwcmlzZVNhbHQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGVyaXZlRW50ZXJwcmlzZVNhbHQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFtQkEsb0RBR0M7QUF0QkQsbUNBQW9DO0FBQ3BDLDJDQUE2RDtBQUU3RDs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFDSCxTQUFnQixvQkFBb0IsQ0FBQyxRQUFnQixFQUFFLFlBQW9CO0lBQ3pFLE1BQU0sUUFBUSxHQUFHLElBQUEsNkJBQWlCLEVBQUMsUUFBUSxDQUFDLENBQUM7SUFDN0MsT0FBTyxJQUFBLHVCQUFXLEVBQUMsSUFBQSxtQkFBVSxFQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFDM0YsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGNyZWF0ZUhtYWMgfSBmcm9tICdjcnlwdG8nO1xuaW1wb3J0IHsgYmFzZTY0VXJsVG9CdWZmZXIsIHRvQmFzZTY0VXJsIH0gZnJvbSAnLi9iYXNlNjR1cmwnO1xuXG4vKipcbiAqIERlcml2ZXMgYW4gZW50ZXJwcmlzZS1zY29wZWQgUFJGIHNhbHQgdG8gcHJldmVudCBjcm9zcy1lbnRlcnByaXNlIGtleSByZXVzZS5cbiAqXG4gKiBDb21wdXRlcyBITUFDLVNIQTI1NihrZXk9cHJmU2FsdF9iYXNlNjR1cmxfZGVjb2RlZCwgZGF0YT1lbnRlcnByaXNlSWRfdXRmOCkuXG4gKiBUaGUgYmFzZVNhbHQgbXVzdCBhbHdheXMgY29tZSBmcm9tIHRoZSBzZXJ2ZXIg4oCUIG5ldmVyIGdlbmVyYXRlIGl0IGNsaWVudC1zaWRlLlxuICpcbiAqIFJldHVybnMgYmFzZTY0dXJsIHNvIHRoZSBzYW1lIGVuY29kaW5nIGlzIHVzZWQgZXZlcnl3aGVyZSB0aGUgc2FsdCBpcyBoYW5kbGVkXG4gKiAoc2VydmVyIHN0b3JhZ2UsIFBSRiBldmFsIGlucHV0LCBwcmZIZWxwZXJzIGxvb2t1cCkuIE1peGluZyBlbmNvZGluZ3NcbiAqIChlLmcuIGhleCBvbiB0aGUgY2xpZW50LCBiYXNlNjR1cmwgb24gdGhlIHNlcnZlcikgY2F1c2VkIHRoZSBQUkYgdG8gcmVjZWl2ZVxuICogZGlmZmVyZW50IGJ5dGVzIGR1cmluZyBhdHRhY2ggdnMgZGVyaXZlIGluIGJyb3dzZXIgZW52aXJvbm1lbnRzIHdoZXJlXG4gKiBgQnVmZmVyLnRvU3RyaW5nKCdoZXgnKWAgaXMgdW5yZWxpYWJsZS5cbiAqXG4gKiBAcGFyYW0gYmFzZVNhbHQgLSBTZXJ2ZXItcHJvdmlkZWQgYmFzZTY0dXJsLWVuY29kZWQgUFJGIHNhbHRcbiAqIEBwYXJhbSBlbnRlcnByaXNlSWQgLSBFbnRlcnByaXNlIGlkZW50aWZpZXJcbiAqIEByZXR1cm5zIEJhc2U2NHVybC1lbmNvZGVkIEhNQUMtU0hBMjU2IGRpZ2VzdCAobm8gcGFkZGluZylcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGRlcml2ZUVudGVycHJpc2VTYWx0KGJhc2VTYWx0OiBzdHJpbmcsIGVudGVycHJpc2VJZDogc3RyaW5nKTogc3RyaW5nIHtcbiAgY29uc3Qga2V5Qnl0ZXMgPSBiYXNlNjRVcmxUb0J1ZmZlcihiYXNlU2FsdCk7XG4gIHJldHVybiB0b0Jhc2U2NFVybChjcmVhdGVIbWFjKCdzaGEyNTYnLCBrZXlCeXRlcykudXBkYXRlKGVudGVycHJpc2VJZCkuZGlnZXN0KCdiYXNlNjQnKSk7XG59XG4iXX0=

package/dist/src/derivePasskeyPrfKey.d.ts

@@ -0,0 +1,15 @@
+import type { BitGoBase, IWallet } from '@bitgo/sdk-core';
+import type { WebAuthnProvider } from './webAuthnTypes';
+/**
+ * Derives a wallet passphrase from a passkey PRF output.
+ *
+ * Fetches the wallet's user keychain, triggers a WebAuthn assertion with PRF
+ * evaluation, and returns a hex-encoded passphrase suitable for use as
+ * walletPassphrase in signing calls.
+ */
+export declare function derivePasskeyPrfKey(params: {
+    bitgo: BitGoBase;
+    wallet: IWallet;
+    provider: WebAuthnProvider;
+}): Promise<string>;
+//# sourceMappingURL=derivePasskeyPrfKey.d.ts.map

package/dist/src/derivePasskeyPrfKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivePasskeyPrfKey.d.ts","sourceRoot":"","sources":["../../src/derivePasskeyPrfKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAoD,MAAM,iBAAiB,CAAC;AAG5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA8BxD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;CAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CA4ClB"}

package/dist/src/derivePasskeyPrfKey.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.derivePasskeyPrfKey = derivePasskeyPrfKey;
+const prfHelpers_1 = require("./prfHelpers");
+const derivePassword_1 = require("./derivePassword");
+function webauthnDevicesFromKeychain(keychain) {
+    const lower = keychain.webauthnDevices;
+    if (lower !== undefined && lower.length > 0) {
+        return lower;
+    }
+    const upper = keychain.webAuthnDevices;
+    if (upper !== undefined && upper.length > 0) {
+        return upper;
+    }
+    return undefined;
+}
+function challengeFromAuthResponse(body) {
+    if (typeof body !== 'object' || body === null) {
+        throw new Error('Invalid assertion challenge response');
+    }
+    const rec = body;
+    if (typeof rec.challenge !== 'string') {
+        throw new Error('Invalid assertion challenge response');
+    }
+    return rec.challenge;
+}
+/**
+ * Derives a wallet passphrase from a passkey PRF output.
+ *
+ * Fetches the wallet's user keychain, triggers a WebAuthn assertion with PRF
+ * evaluation, and returns a hex-encoded passphrase suitable for use as
+ * walletPassphrase in signing calls.
+ */
+async function derivePasskeyPrfKey(params) {
+    const { bitgo, wallet, provider } = params;
+    const keychain = await wallet.getEncryptedUserKeychain();
+    const devices = webauthnDevicesFromKeychain(keychain);
+    if (!devices || devices.length === 0) {
+        throw new Error('No passkey devices available');
+    }
+    const { evalByCredential } = (0, prfHelpers_1.buildEvalByCredential)(devices);
+    if (Object.keys(evalByCredential).length === 0) {
+        throw new Error('No passkey devices available with a valid PRF salt');
+    }
+    const challenge = challengeFromAuthResponse(await bitgo.get(bitgo.url('/user/otp/webauthn/auth', 2)).result());
+    const allowCredentials = Object.keys(evalByCredential).map((credId) => {
+        const nodeBuf = Buffer.from(credId.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+        const id = nodeBuf.buffer.slice(nodeBuf.byteOffset, nodeBuf.byteOffset + nodeBuf.byteLength);
+        return {
+            type: 'public-key',
+            id,
+        };
+    });
+    const publicKey = {
+        challenge: new Uint8Array(Buffer.from(challenge, 'base64')),
+        allowCredentials,
+    };
+    const result = await provider.get({
+        publicKey,
+        evalByCredential,
+    });
+    (0, prfHelpers_1.matchDeviceByCredentialId)(devices, result.credentialId);
+    if (!result.prfResult) {
+        throw new Error('PRF output was not returned by the authenticator');
+    }
+    return (0, derivePassword_1.derivePassword)(result.prfResult);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZlUGFzc2tleVByZktleS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9kZXJpdmVQYXNza2V5UHJmS2V5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBd0NBLGtEQWdEQztBQXZGRCw2Q0FBZ0Y7QUFDaEYscURBQWtEO0FBUWxELFNBQVMsMkJBQTJCLENBQUMsUUFBOEI7SUFDakUsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLGVBQWUsQ0FBQztJQUN2QyxJQUFJLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1QyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsZUFBZSxDQUFDO0lBQ3ZDLElBQUksS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzVDLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE9BQU8sU0FBUyxDQUFDO0FBQ25CLENBQUM7QUFFRCxTQUFTLHlCQUF5QixDQUFDLElBQWE7SUFDOUMsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQzlDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsTUFBTSxHQUFHLEdBQUcsSUFBK0IsQ0FBQztJQUM1QyxJQUFJLE9BQU8sR0FBRyxDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDMUQsQ0FBQztJQUNELE9BQU8sR0FBRyxDQUFDLFNBQVMsQ0FBQztBQUN2QixDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0ksS0FBSyxVQUFVLG1CQUFtQixDQUFDLE1BSXpDO0lBQ0MsTUFBTSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBRTNDLE1BQU0sUUFBUSxHQUF5QixNQUFNLE1BQU0sQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO0lBQy9FLE1BQU0sT0FBTyxHQUFHLDJCQUEyQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRXRELElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyQyxNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVELE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxHQUFHLElBQUEsa0NBQXFCLEVBQUMsT0FBTyxDQUFDLENBQUM7SUFFNUQsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQy9DLE1BQU0sSUFBSSxLQUFLLENBQUMsb0RBQW9ELENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBRUQsTUFBTSxTQUFTLEdBQUcseUJBQXlCLENBQUMsTUFBTSxLQUFLLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMseUJBQXlCLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBRS9HLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFO1FBQ3BFLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUNwRixNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLEdBQUcsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzdGLE9BQU87WUFDTCxJQUFJLEVBQUUsWUFBcUI7WUFDM0IsRUFBRTtTQUNILENBQUM7SUFDSixDQUFDLENBQUMsQ0FBQztJQUVILE1BQU0sU0FBUyxHQUFzQztRQUNuRCxTQUFTLEVBQUUsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDM0QsZ0JBQWdCO0tBQ2pCLENBQUM7SUFFRixNQUFNLE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxHQUFHLENBQUM7UUFDaEMsU0FBUztRQUNULGdCQUFnQjtLQUNqQixDQUFDLENBQUM7SUFFSCxJQUFBLHNDQUF5QixFQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7SUFFeEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUVELE9BQU8sSUFBQSwrQkFBYyxFQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztBQUMxQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHR5cGUgeyBCaXRHb0Jhc2UsIElXYWxsZXQsIEtleWNoYWluV2ViYXV0aG5EZXZpY2UsIEtleWNoYWluV2l0aEVuY3J5cHRlZFBydiB9IGZyb20gJ0BiaXRnby9zZGstY29yZSc7XG5pbXBvcnQgeyBidWlsZEV2YWxCeUNyZWRlbnRpYWwsIG1hdGNoRGV2aWNlQnlDcmVkZW50aWFsSWQgfSBmcm9tICcuL3ByZkhlbHBlcnMnO1xuaW1wb3J0IHsgZGVyaXZlUGFzc3dvcmQgfSBmcm9tICcuL2Rlcml2ZVBhc3N3b3JkJztcbmltcG9ydCB0eXBlIHsgV2ViQXV0aG5Qcm92aWRlciB9IGZyb20gJy4vd2ViQXV0aG5UeXBlcyc7XG5cbi8qKiBBUEkgcGF5bG9hZHMgbWF5IHVzZSBlaXRoZXIgc3BlbGxpbmcgZm9yIHRoZSB3ZWJhdXRobiBkZXZpY2UgbGlzdC4gKi9cbnR5cGUgVXNlcktleWNoYWluUmVzcG9uc2UgPSBLZXljaGFpbldpdGhFbmNyeXB0ZWRQcnYgJiB7XG4gIHdlYkF1dGhuRGV2aWNlcz86IEtleWNoYWluV2ViYXV0aG5EZXZpY2VbXTtcbn07XG5cbmZ1bmN0aW9uIHdlYmF1dGhuRGV2aWNlc0Zyb21LZXljaGFpbihrZXljaGFpbjogVXNlcktleWNoYWluUmVzcG9uc2UpOiBLZXljaGFpbldlYmF1dGhuRGV2aWNlW10gfCB1bmRlZmluZWQge1xuICBjb25zdCBsb3dlciA9IGtleWNoYWluLndlYmF1dGhuRGV2aWNlcztcbiAgaWYgKGxvd2VyICE9PSB1bmRlZmluZWQgJiYgbG93ZXIubGVuZ3RoID4gMCkge1xuICAgIHJldHVybiBsb3dlcjtcbiAgfVxuICBjb25zdCB1cHBlciA9IGtleWNoYWluLndlYkF1dGhuRGV2aWNlcztcbiAgaWYgKHVwcGVyICE9PSB1bmRlZmluZWQgJiYgdXBwZXIubGVuZ3RoID4gMCkge1xuICAgIHJldHVybiB1cHBlcjtcbiAgfVxuICByZXR1cm4gdW5kZWZpbmVkO1xufVxuXG5mdW5jdGlvbiBjaGFsbGVuZ2VGcm9tQXV0aFJlc3BvbnNlKGJvZHk6IHVua25vd24pOiBzdHJpbmcge1xuICBpZiAodHlwZW9mIGJvZHkgIT09ICdvYmplY3QnIHx8IGJvZHkgPT09IG51bGwpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ0ludmFsaWQgYXNzZXJ0aW9uIGNoYWxsZW5nZSByZXNwb25zZScpO1xuICB9XG4gIGNvbnN0IHJlYyA9IGJvZHkgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG4gIGlmICh0eXBlb2YgcmVjLmNoYWxsZW5nZSAhPT0gJ3N0cmluZycpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ0ludmFsaWQgYXNzZXJ0aW9uIGNoYWxsZW5nZSByZXNwb25zZScpO1xuICB9XG4gIHJldHVybiByZWMuY2hhbGxlbmdlO1xufVxuXG4vKipcbiAqIERlcml2ZXMgYSB3YWxsZXQgcGFzc3BocmFzZSBmcm9tIGEgcGFzc2tleSBQUkYgb3V0cHV0LlxuICpcbiAqIEZldGNoZXMgdGhlIHdhbGxldCdzIHVzZXIga2V5Y2hhaW4sIHRyaWdnZXJzIGEgV2ViQXV0aG4gYXNzZXJ0aW9uIHdpdGggUFJGXG4gKiBldmFsdWF0aW9uLCBhbmQgcmV0dXJucyBhIGhleC1lbmNvZGVkIHBhc3NwaHJhc2Ugc3VpdGFibGUgZm9yIHVzZSBhc1xuICogd2FsbGV0UGFzc3BocmFzZSBpbiBzaWduaW5nIGNhbGxzLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZGVyaXZlUGFzc2tleVByZktleShwYXJhbXM6IHtcbiAgYml0Z286IEJpdEdvQmFzZTtcbiAgd2FsbGV0OiBJV2FsbGV0O1xuICBwcm92aWRlcjogV2ViQXV0aG5Qcm92aWRlcjtcbn0pOiBQcm9taXNlPHN0cmluZz4ge1xuICBjb25zdCB7IGJpdGdvLCB3YWxsZXQsIHByb3ZpZGVyIH0gPSBwYXJhbXM7XG5cbiAgY29uc3Qga2V5Y2hhaW46IFVzZXJLZXljaGFpblJlc3BvbnNlID0gYXdhaXQgd2FsbGV0LmdldEVuY3J5cHRlZFVzZXJLZXljaGFpbigpO1xuICBjb25zdCBkZXZpY2VzID0gd2ViYXV0aG5EZXZpY2VzRnJvbUtleWNoYWluKGtleWNoYWluKTtcblxuICBpZiAoIWRldmljZXMgfHwgZGV2aWNlcy5sZW5ndGggPT09IDApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ05vIHBhc3NrZXkgZGV2aWNlcyBhdmFpbGFibGUnKTtcbiAgfVxuXG4gIGNvbnN0IHsgZXZhbEJ5Q3JlZGVudGlhbCB9ID0gYnVpbGRFdmFsQnlDcmVkZW50aWFsKGRldmljZXMpO1xuXG4gIGlmIChPYmplY3Qua2V5cyhldmFsQnlDcmVkZW50aWFsKS5sZW5ndGggPT09IDApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ05vIHBhc3NrZXkgZGV2aWNlcyBhdmFpbGFibGUgd2l0aCBhIHZhbGlkIFBSRiBzYWx0Jyk7XG4gIH1cblxuICBjb25zdCBjaGFsbGVuZ2UgPSBjaGFsbGVuZ2VGcm9tQXV0aFJlc3BvbnNlKGF3YWl0IGJpdGdvLmdldChiaXRnby51cmwoJy91c2VyL290cC93ZWJhdXRobi9hdXRoJywgMikpLnJlc3VsdCgpKTtcblxuICBjb25zdCBhbGxvd0NyZWRlbnRpYWxzID0gT2JqZWN0LmtleXMoZXZhbEJ5Q3JlZGVudGlhbCkubWFwKChjcmVkSWQpID0+IHtcbiAgICBjb25zdCBub2RlQnVmID0gQnVmZmVyLmZyb20oY3JlZElkLnJlcGxhY2UoLy0vZywgJysnKS5yZXBsYWNlKC9fL2csICcvJyksICdiYXNlNjQnKTtcbiAgICBjb25zdCBpZCA9IG5vZGVCdWYuYnVmZmVyLnNsaWNlKG5vZGVCdWYuYnl0ZU9mZnNldCwgbm9kZUJ1Zi5ieXRlT2Zmc2V0ICsgbm9kZUJ1Zi5ieXRlTGVuZ3RoKTtcbiAgICByZXR1cm4ge1xuICAgICAgdHlwZTogJ3B1YmxpYy1rZXknIGFzIGNvbnN0LFxuICAgICAgaWQsXG4gICAgfTtcbiAgfSk7XG5cbiAgY29uc3QgcHVibGljS2V5OiBQdWJsaWNLZXlDcmVkZW50aWFsUmVxdWVzdE9wdGlvbnMgPSB7XG4gICAgY2hhbGxlbmdlOiBuZXcgVWludDhBcnJheShCdWZmZXIuZnJvbShjaGFsbGVuZ2UsICdiYXNlNjQnKSksXG4gICAgYWxsb3dDcmVkZW50aWFscyxcbiAgfTtcblxuICBjb25zdCByZXN1bHQgPSBhd2FpdCBwcm92aWRlci5nZXQoe1xuICAgIHB1YmxpY0tleSxcbiAgICBldmFsQnlDcmVkZW50aWFsLFxuICB9KTtcblxuICBtYXRjaERldmljZUJ5Q3JlZGVudGlhbElkKGRldmljZXMsIHJlc3VsdC5jcmVkZW50aWFsSWQpO1xuXG4gIGlmICghcmVzdWx0LnByZlJlc3VsdCkge1xuICAgIHRocm93IG5ldyBFcnJvcignUFJGIG91dHB1dCB3YXMgbm90IHJldHVybmVkIGJ5IHRoZSBhdXRoZW50aWNhdG9yJyk7XG4gIH1cblxuICByZXR1cm4gZGVyaXZlUGFzc3dvcmQocmVzdWx0LnByZlJlc3VsdCk7XG59XG4iXX0=

package/dist/src/derivePassword.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Derives a wallet passphrase from a WebAuthn PRF result.
+ *
+ * The PRF output (ArrayBuffer) is hex-encoded and used directly as the
+ * walletPassphrase for SJCL-based encryption (bitgo.encrypt).
+ *
+ * @param prfResult - Raw PRF output from WebAuthn credential assertion
+ * @returns Lowercase hex string to use as walletPassphrase
+ */
+export declare function derivePassword(prfResult: ArrayBuffer): string;
+//# sourceMappingURL=derivePassword.d.ts.map

package/dist/src/derivePassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivePassword.d.ts","sourceRoot":"","sources":["../../src/derivePassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,WAAW,GAAG,MAAM,CAE7D"}

package/dist/src/derivePassword.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.derivePassword = derivePassword;
+/**
+ * Derives a wallet passphrase from a WebAuthn PRF result.
+ *
+ * The PRF output (ArrayBuffer) is hex-encoded and used directly as the
+ * walletPassphrase for SJCL-based encryption (bitgo.encrypt).
+ *
+ * @param prfResult - Raw PRF output from WebAuthn credential assertion
+ * @returns Lowercase hex string to use as walletPassphrase
+ */
+function derivePassword(prfResult) {
+    return Buffer.from(prfResult).toString('hex');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZlUGFzc3dvcmQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZGVyaXZlUGFzc3dvcmQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFTQSx3Q0FFQztBQVhEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBZ0IsY0FBYyxDQUFDLFNBQXNCO0lBQ25ELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDaEQsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogRGVyaXZlcyBhIHdhbGxldCBwYXNzcGhyYXNlIGZyb20gYSBXZWJBdXRobiBQUkYgcmVzdWx0LlxuICpcbiAqIFRoZSBQUkYgb3V0cHV0IChBcnJheUJ1ZmZlcikgaXMgaGV4LWVuY29kZWQgYW5kIHVzZWQgZGlyZWN0bHkgYXMgdGhlXG4gKiB3YWxsZXRQYXNzcGhyYXNlIGZvciBTSkNMLWJhc2VkIGVuY3J5cHRpb24gKGJpdGdvLmVuY3J5cHQpLlxuICpcbiAqIEBwYXJhbSBwcmZSZXN1bHQgLSBSYXcgUFJGIG91dHB1dCBmcm9tIFdlYkF1dGhuIGNyZWRlbnRpYWwgYXNzZXJ0aW9uXG4gKiBAcmV0dXJucyBMb3dlcmNhc2UgaGV4IHN0cmluZyB0byB1c2UgYXMgd2FsbGV0UGFzc3BocmFzZVxuICovXG5leHBvcnQgZnVuY3Rpb24gZGVyaXZlUGFzc3dvcmQocHJmUmVzdWx0OiBBcnJheUJ1ZmZlcik6IHN0cmluZyB7XG4gIHJldHVybiBCdWZmZXIuZnJvbShwcmZSZXN1bHQpLnRvU3RyaW5nKCdoZXgnKTtcbn1cbiJdfQ==

package/dist/src/index.d.ts

@@ -0,0 +1,10 @@
+export { derivePassword } from './derivePassword';
+export { registerPasskey } from './registerPasskey';
+export { deriveEnterpriseSalt } from './deriveEnterpriseSalt';
+export { buildEvalByCredential, matchDeviceByCredentialId } from './prfHelpers';
+export { removePasskeyFromAccount } from './removePasskeyFromAccount';
+export type { WebAuthnOtpDevice, PasskeyAuthResult, PasskeyGetOptions, WebAuthnProvider } from './webAuthnTypes';
+export { removePasskeyFromWallet } from './removePasskeyFromWallet';
+export { attachPasskeyToWallet } from './attachPasskeyToWallet';
+export { derivePasskeyPrfKey } from './derivePasskeyPrfKey';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACjH,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.derivePasskeyPrfKey = exports.attachPasskeyToWallet = exports.removePasskeyFromWallet = exports.removePasskeyFromAccount = exports.matchDeviceByCredentialId = exports.buildEvalByCredential = exports.deriveEnterpriseSalt = exports.registerPasskey = exports.derivePassword = void 0;
+var derivePassword_1 = require("./derivePassword");
+Object.defineProperty(exports, "derivePassword", { enumerable: true, get: function () { return derivePassword_1.derivePassword; } });
+var registerPasskey_1 = require("./registerPasskey");
+Object.defineProperty(exports, "registerPasskey", { enumerable: true, get: function () { return registerPasskey_1.registerPasskey; } });
+var deriveEnterpriseSalt_1 = require("./deriveEnterpriseSalt");
+Object.defineProperty(exports, "deriveEnterpriseSalt", { enumerable: true, get: function () { return deriveEnterpriseSalt_1.deriveEnterpriseSalt; } });
+var prfHelpers_1 = require("./prfHelpers");
+Object.defineProperty(exports, "buildEvalByCredential", { enumerable: true, get: function () { return prfHelpers_1.buildEvalByCredential; } });
+Object.defineProperty(exports, "matchDeviceByCredentialId", { enumerable: true, get: function () { return prfHelpers_1.matchDeviceByCredentialId; } });
+var removePasskeyFromAccount_1 = require("./removePasskeyFromAccount");
+Object.defineProperty(exports, "removePasskeyFromAccount", { enumerable: true, get: function () { return removePasskeyFromAccount_1.removePasskeyFromAccount; } });
+var removePasskeyFromWallet_1 = require("./removePasskeyFromWallet");
+Object.defineProperty(exports, "removePasskeyFromWallet", { enumerable: true, get: function () { return removePasskeyFromWallet_1.removePasskeyFromWallet; } });
+var attachPasskeyToWallet_1 = require("./attachPasskeyToWallet");
+Object.defineProperty(exports, "attachPasskeyToWallet", { enumerable: true, get: function () { return attachPasskeyToWallet_1.attachPasskeyToWallet; } });
+var derivePasskeyPrfKey_1 = require("./derivePasskeyPrfKey");
+Object.defineProperty(exports, "derivePasskeyPrfKey", { enumerable: true, get: function () { return derivePasskeyPrfKey_1.derivePasskeyPrfKey; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbURBQWtEO0FBQXpDLGdIQUFBLGNBQWMsT0FBQTtBQUN2QixxREFBb0Q7QUFBM0Msa0hBQUEsZUFBZSxPQUFBO0FBQ3hCLCtEQUE4RDtBQUFyRCw0SEFBQSxvQkFBb0IsT0FBQTtBQUM3QiwyQ0FBZ0Y7QUFBdkUsbUhBQUEscUJBQXFCLE9BQUE7QUFBRSx1SEFBQSx5QkFBeUIsT0FBQTtBQUN6RCx1RUFBc0U7QUFBN0Qsb0lBQUEsd0JBQXdCLE9BQUE7QUFFakMscUVBQW9FO0FBQTNELGtJQUFBLHVCQUF1QixPQUFBO0FBQ2hDLGlFQUFnRTtBQUF2RCw4SEFBQSxxQkFBcUIsT0FBQTtBQUM5Qiw2REFBNEQ7QUFBbkQsMEhBQUEsbUJBQW1CLE9BQUEiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgeyBkZXJpdmVQYXNzd29yZCB9IGZyb20gJy4vZGVyaXZlUGFzc3dvcmQnO1xuZXhwb3J0IHsgcmVnaXN0ZXJQYXNza2V5IH0gZnJvbSAnLi9yZWdpc3RlclBhc3NrZXknO1xuZXhwb3J0IHsgZGVyaXZlRW50ZXJwcmlzZVNhbHQgfSBmcm9tICcuL2Rlcml2ZUVudGVycHJpc2VTYWx0JztcbmV4cG9ydCB7IGJ1aWxkRXZhbEJ5Q3JlZGVudGlhbCwgbWF0Y2hEZXZpY2VCeUNyZWRlbnRpYWxJZCB9IGZyb20gJy4vcHJmSGVscGVycyc7XG5leHBvcnQgeyByZW1vdmVQYXNza2V5RnJvbUFjY291bnQgfSBmcm9tICcuL3JlbW92ZVBhc3NrZXlGcm9tQWNjb3VudCc7XG5leHBvcnQgdHlwZSB7IFdlYkF1dGhuT3RwRGV2aWNlLCBQYXNza2V5QXV0aFJlc3VsdCwgUGFzc2tleUdldE9wdGlvbnMsIFdlYkF1dGhuUHJvdmlkZXIgfSBmcm9tICcuL3dlYkF1dGhuVHlwZXMnO1xuZXhwb3J0IHsgcmVtb3ZlUGFzc2tleUZyb21XYWxsZXQgfSBmcm9tICcuL3JlbW92ZVBhc3NrZXlGcm9tV2FsbGV0JztcbmV4cG9ydCB7IGF0dGFjaFBhc3NrZXlUb1dhbGxldCB9IGZyb20gJy4vYXR0YWNoUGFzc2tleVRvV2FsbGV0JztcbmV4cG9ydCB7IGRlcml2ZVBhc3NrZXlQcmZLZXkgfSBmcm9tICcuL2Rlcml2ZVBhc3NrZXlQcmZLZXknO1xuIl19

package/dist/src/prfHelpers.d.ts

@@ -0,0 +1,15 @@
+import type { WebauthnDevice } from '@bitgo/public-types';
+/**
+ * Builds the PRF eval map and credential-to-device lookup from a wallet
+ * keychain's webauthn devices. Devices without a prfSalt are skipped.
+ */
+export declare function buildEvalByCredential(devices: WebauthnDevice[]): {
+    evalByCredential: Record<string, string>;
+    credIdToDevice: Map<string, WebauthnDevice>;
+};
+/**
+ * Returns the WebauthnDevice matching the given credential ID.
+ * @throws if no matching device is found
+ */
+export declare function matchDeviceByCredentialId(devices: WebauthnDevice[], credentialId: string): WebauthnDevice;
+//# sourceMappingURL=prfHelpers.d.ts.map

package/dist/src/prfHelpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prfHelpers.d.ts","sourceRoot":"","sources":["../../src/prfHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG;IAChE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC7C,CA0BA;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,cAAc,CAQzG"}