@capgo/capacitor-passkey 8.2.0

package/dist/esm/definitions.d.ts

@@ -0,0 +1,531 @@
+/**
+ * Supported authenticator attachment values.
+ *
+ * @since 1.0.0
+ */
+export type PasskeyAuthenticatorAttachment = 'platform' | 'cross-platform';
+/**
+ * Supported WebAuthn credential type.
+ *
+ * @since 1.0.0
+ */
+export type PasskeyCredentialType = 'public-key';
+/**
+ * Supported user verification preferences.
+ *
+ * @since 1.0.0
+ */
+export type PasskeyUserVerification = 'discouraged' | 'preferred' | 'required';
+/**
+ * Supported attestation preferences.
+ *
+ * @since 1.0.0
+ */
+export type PasskeyAttestation = 'none' | 'indirect' | 'direct' | 'enterprise';
+/**
+ * Supported resident key preferences.
+ *
+ * @since 1.0.0
+ */
+export type PasskeyResidentKey = 'discouraged' | 'preferred' | 'required';
+/**
+ * Options used when installing the browser-style shim.
+ *
+ * @since 1.0.0
+ */
+export interface ShimWebAuthnOptions {
+    /**
+     * Optional HTTPS origin to encode into iOS 17.4+ clientDataJSON.
+     *
+     * Use this when your Capacitor app runs from `capacitor://localhost`
+     * but your relying party expects `https://signin.example.com`.
+     */
+    origin?: string;
+    /**
+     * Force the shim even if the runtime already exposes `navigator.credentials`.
+     *
+     * Defaults to `false`.
+     */
+    force?: boolean;
+}
+/**
+ * Runtime configuration loaded from the host app's Capacitor config.
+ *
+ * This is the shape returned by `getConfiguration()`.
+ *
+ * @since 1.1.0
+ */
+export interface PasskeyRuntimeConfiguration {
+    /**
+     * Whether the `/auto` entrypoint should install the shim automatically.
+     *
+     * Defaults to `true`.
+     */
+    autoShim: boolean;
+    /**
+     * Optional HTTPS origin used by the auto-shim.
+     *
+     * On iOS 17.4+ this origin is encoded into `clientDataJSON`.
+     */
+    origin?: string;
+    /**
+     * Domains associated with the app for passkey usage.
+     *
+     * These come from `domains` in Capacitor config plus the hostname derived
+     * from `origin` when available.
+     */
+    domains: string[];
+    /**
+     * Current runtime platform.
+     */
+    platform: 'ios' | 'android' | 'web';
+}
+/**
+ * JSON-safe representation of a public key credential descriptor.
+ *
+ * Binary identifiers must be base64url encoded.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyCredentialDescriptor {
+    /**
+     * Base64url-encoded credential identifier.
+     */
+    id: string;
+    /**
+     * Credential type. Only `public-key` is supported.
+     */
+    type?: PasskeyCredentialType;
+    /**
+     * Optional transport hints copied from WebAuthn.
+     */
+    transports?: string[];
+}
+/**
+ * JSON-safe relying party information.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyRelyingParty {
+    /**
+     * Relying party identifier.
+     *
+     * If omitted, the shim derives it from the configured origin when possible.
+     */
+    id?: string;
+    /**
+     * Human-readable relying party name.
+     */
+    name: string;
+}
+/**
+ * JSON-safe WebAuthn user entity.
+ *
+ * Binary identifiers must be base64url encoded.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyUserEntity {
+    /**
+     * Base64url-encoded user handle.
+     */
+    id: string;
+    /**
+     * User name shown by the authenticator.
+     */
+    name: string;
+    /**
+     * Optional display name shown by the authenticator.
+     */
+    displayName?: string;
+}
+/**
+ * JSON-safe credential parameter entry.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyCredentialParameter {
+    /**
+     * Credential type. Only `public-key` is supported.
+     */
+    type: PasskeyCredentialType;
+    /**
+     * COSE algorithm identifier.
+     */
+    alg: number;
+}
+/**
+ * JSON-safe authenticator selection options.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyAuthenticatorSelection {
+    /**
+     * Optional authenticator attachment hint.
+     */
+    authenticatorAttachment?: PasskeyAuthenticatorAttachment;
+    /**
+     * Optional resident key preference.
+     */
+    residentKey?: PasskeyResidentKey;
+    /**
+     * Legacy resident key requirement flag.
+     */
+    requireResidentKey?: boolean;
+    /**
+     * Optional user verification preference.
+     */
+    userVerification?: PasskeyUserVerification;
+}
+/**
+ * JSON-safe registration request options.
+ *
+ * All binary fields must be base64url encoded.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyPublicKeyCredentialCreationOptionsJSON {
+    /**
+     * Base64url-encoded challenge.
+     */
+    challenge: string;
+    /**
+     * Relying party information.
+     */
+    rp: PasskeyRelyingParty;
+    /**
+     * User information.
+     */
+    user: PasskeyUserEntity;
+    /**
+     * Supported credential algorithms.
+     */
+    pubKeyCredParams: PasskeyCredentialParameter[];
+    /**
+     * Optional timeout hint in milliseconds.
+     */
+    timeout?: number;
+    /**
+     * Optional credentials that must be excluded during registration.
+     */
+    excludeCredentials?: PasskeyCredentialDescriptor[];
+    /**
+     * Optional authenticator preferences.
+     */
+    authenticatorSelection?: PasskeyAuthenticatorSelection;
+    /**
+     * Optional attestation preference.
+     */
+    attestation?: PasskeyAttestation;
+    /**
+     * Optional hints copied from the JSON form used by modern WebAuthn toolkits.
+     */
+    hints?: string[];
+    /**
+     * Optional extensions copied as-is into the request JSON.
+     */
+    extensions?: Record<string, unknown>;
+}
+/**
+ * Direct registration request for the plugin transport.
+ *
+ * @since 1.0.0
+ */
+export interface CreateCredentialOptions {
+    /**
+     * JSON-safe registration request.
+     */
+    publicKey: PasskeyPublicKeyCredentialCreationOptionsJSON;
+    /**
+     * Optional HTTPS origin to use for iOS 17.4+ browser-style clientDataJSON.
+     */
+    origin?: string;
+}
+/**
+ * JSON-safe authentication request options.
+ *
+ * All binary fields must be base64url encoded.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyPublicKeyCredentialRequestOptionsJSON {
+    /**
+     * Base64url-encoded challenge.
+     */
+    challenge: string;
+    /**
+     * Optional timeout hint in milliseconds.
+     */
+    timeout?: number;
+    /**
+     * Optional relying party identifier.
+     *
+     * If omitted, the shim derives it from the configured origin when possible.
+     */
+    rpId?: string;
+    /**
+     * Optional allow list copied from WebAuthn.
+     */
+    allowCredentials?: PasskeyCredentialDescriptor[];
+    /**
+     * Optional user verification preference.
+     */
+    userVerification?: PasskeyUserVerification;
+    /**
+     * Optional hints copied from the JSON form used by modern WebAuthn toolkits.
+     */
+    hints?: string[];
+    /**
+     * Optional extensions copied as-is into the request JSON.
+     */
+    extensions?: Record<string, unknown>;
+}
+/**
+ * Direct authentication request for the plugin transport.
+ *
+ * @since 1.0.0
+ */
+export interface GetCredentialOptions {
+    /**
+     * JSON-safe authentication request.
+     */
+    publicKey: PasskeyPublicKeyCredentialRequestOptionsJSON;
+    /**
+     * Optional mediation hint. `conditional` currently falls back to an explicit prompt.
+     */
+    mediation?: string;
+    /**
+     * Optional HTTPS origin to use for iOS 17.4+ browser-style clientDataJSON.
+     */
+    origin?: string;
+}
+/**
+ * JSON-safe attestation response payload.
+ *
+ * All binary fields are base64url encoded.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyAuthenticatorAttestationResponseJSON {
+    /**
+     * Base64url-encoded clientDataJSON.
+     */
+    clientDataJSON: string;
+    /**
+     * Base64url-encoded attestation object.
+     */
+    attestationObject: string;
+    /**
+     * Optional base64url-encoded public key when provided by the platform.
+     */
+    publicKey?: string;
+    /**
+     * Optional public key algorithm when provided by the platform.
+     */
+    publicKeyAlgorithm?: number;
+    /**
+     * Optional transport list when provided by the platform.
+     */
+    transports?: string[];
+}
+/**
+ * JSON-safe assertion response payload.
+ *
+ * All binary fields are base64url encoded.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyAuthenticatorAssertionResponseJSON {
+    /**
+     * Base64url-encoded clientDataJSON.
+     */
+    clientDataJSON: string;
+    /**
+     * Base64url-encoded authenticator data.
+     */
+    authenticatorData: string;
+    /**
+     * Base64url-encoded signature.
+     */
+    signature: string;
+    /**
+     * Optional base64url-encoded user handle.
+     */
+    userHandle?: string | null;
+}
+/**
+ * JSON-safe registration credential returned by the plugin.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyRegistrationCredential {
+    /**
+     * Base64url-encoded credential identifier.
+     */
+    id: string;
+    /**
+     * Base64url-encoded raw credential identifier.
+     */
+    rawId: string;
+    /**
+     * Credential type. Always `public-key`.
+     */
+    type: PasskeyCredentialType;
+    /**
+     * Optional authenticator attachment reported by the platform.
+     */
+    authenticatorAttachment?: PasskeyAuthenticatorAttachment;
+    /**
+     * Client extension results returned by the platform.
+     */
+    clientExtensionResults: Record<string, unknown>;
+    /**
+     * Registration response payload.
+     */
+    response: PasskeyAuthenticatorAttestationResponseJSON;
+}
+/**
+ * JSON-safe authentication credential returned by the plugin.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeyAuthenticationCredential {
+    /**
+     * Base64url-encoded credential identifier.
+     */
+    id: string;
+    /**
+     * Base64url-encoded raw credential identifier.
+     */
+    rawId: string;
+    /**
+     * Credential type. Always `public-key`.
+     */
+    type: PasskeyCredentialType;
+    /**
+     * Optional authenticator attachment reported by the platform.
+     */
+    authenticatorAttachment?: PasskeyAuthenticatorAttachment;
+    /**
+     * Client extension results returned by the platform.
+     */
+    clientExtensionResults: Record<string, unknown>;
+    /**
+     * Assertion response payload.
+     */
+    response: PasskeyAuthenticatorAssertionResponseJSON;
+}
+/**
+ * Plugin version payload.
+ *
+ * @since 1.0.0
+ */
+export interface PluginVersionResult {
+    /**
+     * Version identifier reported by the current platform implementation.
+     */
+    version: string;
+}
+/**
+ * Passkey support status for the current runtime.
+ *
+ * @since 1.0.0
+ */
+export interface PasskeySupportResult {
+    /**
+     * Whether passkeys are available on the current runtime.
+     */
+    available: boolean;
+    /**
+     * Whether conditional mediation is available.
+     */
+    conditionalMediation: boolean;
+    /**
+     * Current platform identifier.
+     */
+    platform: 'ios' | 'android' | 'web';
+}
+/**
+ * Capacitor Passkey plugin.
+ *
+ * Use `autoShimWebAuthn()` or import `@capgo/capacitor-passkey/auto`
+ * to keep existing `navigator.credentials.create/get` code working
+ * inside a Capacitor app.
+ *
+ * @since 1.0.0
+ */
+export interface CapacitorPasskeyPlugin {
+    /**
+     * Install a browser-style WebAuthn shim on top of the native plugin.
+     *
+     * The shim patches `navigator.credentials.create/get` for `publicKey`
+     * requests and returns browser-like credential objects.
+     *
+     * Use this when you want to override the auto-loaded config manually.
+     *
+     * @since 1.0.0
+     * @example
+     * ```typescript
+     * import { CapacitorPasskey } from '@capgo/capacitor-passkey';
+     *
+     * CapacitorPasskey.shimWebAuthn({
+     *   origin: 'https://signin.example.com',
+     * });
+     * ```
+     */
+    shimWebAuthn(options?: ShimWebAuthnOptions): void;
+    /**
+     * Load plugin configuration from the host Capacitor app.
+     *
+     * This reads `plugins.CapacitorPasskey` from `capacitor.config.*`.
+     *
+     * @since 1.1.0
+     */
+    getConfiguration(): Promise<PasskeyRuntimeConfiguration>;
+    /**
+     * Install the browser-style shim using host app configuration.
+     *
+     * This is the easiest way to keep existing browser WebAuthn code working:
+     * configure the plugin in `capacitor.config.*`, then call this once during
+     * app bootstrap or use the `/auto` entrypoint.
+     *
+     * @since 1.1.0
+     * @example
+     * ```typescript
+     * import { CapacitorPasskey } from '@capgo/capacitor-passkey';
+     *
+     * await CapacitorPasskey.autoShimWebAuthn();
+     * ```
+     */
+    autoShimWebAuthn(options?: ShimWebAuthnOptions): Promise<PasskeyRuntimeConfiguration>;
+    /**
+     * Register a passkey from a JSON-safe WebAuthn request.
+     *
+     * This method is useful when your backend already returns the
+     * `PublicKeyCredentialCreationOptionsJSON` form.
+     *
+     * @since 1.0.0
+     */
+    createCredential(options: CreateCredentialOptions): Promise<PasskeyRegistrationCredential>;
+    /**
+     * Authenticate with an existing passkey from a JSON-safe WebAuthn request.
+     *
+     * This method is useful when your backend already returns the
+     * `PublicKeyCredentialRequestOptionsJSON` form.
+     *
+     * @since 1.0.0
+     */
+    getCredential(options: GetCredentialOptions): Promise<PasskeyAuthenticationCredential>;
+    /**
+     * Report whether passkeys are available in the current runtime.
+     *
+     * @since 1.0.0
+     */
+    isSupported(): Promise<PasskeySupportResult>;
+    /**
+     * Returns the current platform implementation version marker.
+     *
+     * @since 1.0.0
+     */
+    getPluginVersion(): Promise<PluginVersionResult>;
+}

package/dist/esm/definitions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=definitions.js.map

package/dist/esm/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Supported authenticator attachment values.\n *\n * @since 1.0.0\n */\nexport type PasskeyAuthenticatorAttachment = 'platform' | 'cross-platform';\n\n/**\n * Supported WebAuthn credential type.\n *\n * @since 1.0.0\n */\nexport type PasskeyCredentialType = 'public-key';\n\n/**\n * Supported user verification preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyUserVerification = 'discouraged' | 'preferred' | 'required';\n\n/**\n * Supported attestation preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyAttestation = 'none' | 'indirect' | 'direct' | 'enterprise';\n\n/**\n * Supported resident key preferences.\n *\n * @since 1.0.0\n */\nexport type PasskeyResidentKey = 'discouraged' | 'preferred' | 'required';\n\n/**\n * Options used when installing the browser-style shim.\n *\n * @since 1.0.0\n */\nexport interface ShimWebAuthnOptions {\n  /**\n   * Optional HTTPS origin to encode into iOS 17.4+ clientDataJSON.\n   *\n   * Use this when your Capacitor app runs from `capacitor://localhost`\n   * but your relying party expects `https://signin.example.com`.\n   */\n  origin?: string;\n\n  /**\n   * Force the shim even if the runtime already exposes `navigator.credentials`.\n   *\n   * Defaults to `false`.\n   */\n  force?: boolean;\n}\n\n/**\n * Runtime configuration loaded from the host app's Capacitor config.\n *\n * This is the shape returned by `getConfiguration()`.\n *\n * @since 1.1.0\n */\nexport interface PasskeyRuntimeConfiguration {\n  /**\n   * Whether the `/auto` entrypoint should install the shim automatically.\n   *\n   * Defaults to `true`.\n   */\n  autoShim: boolean;\n\n  /**\n   * Optional HTTPS origin used by the auto-shim.\n   *\n   * On iOS 17.4+ this origin is encoded into `clientDataJSON`.\n   */\n  origin?: string;\n\n  /**\n   * Domains associated with the app for passkey usage.\n   *\n   * These come from `domains` in Capacitor config plus the hostname derived\n   * from `origin` when available.\n   */\n  domains: string[];\n\n  /**\n   * Current runtime platform.\n   */\n  platform: 'ios' | 'android' | 'web';\n}\n\n/**\n * JSON-safe representation of a public key credential descriptor.\n *\n * Binary identifiers must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyCredentialDescriptor {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Credential type. Only `public-key` is supported.\n   */\n  type?: PasskeyCredentialType;\n\n  /**\n   * Optional transport hints copied from WebAuthn.\n   */\n  transports?: string[];\n}\n\n/**\n * JSON-safe relying party information.\n *\n * @since 1.0.0\n */\nexport interface PasskeyRelyingParty {\n  /**\n   * Relying party identifier.\n   *\n   * If omitted, the shim derives it from the configured origin when possible.\n   */\n  id?: string;\n\n  /**\n   * Human-readable relying party name.\n   */\n  name: string;\n}\n\n/**\n * JSON-safe WebAuthn user entity.\n *\n * Binary identifiers must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyUserEntity {\n  /**\n   * Base64url-encoded user handle.\n   */\n  id: string;\n\n  /**\n   * User name shown by the authenticator.\n   */\n  name: string;\n\n  /**\n   * Optional display name shown by the authenticator.\n   */\n  displayName?: string;\n}\n\n/**\n * JSON-safe credential parameter entry.\n *\n * @since 1.0.0\n */\nexport interface PasskeyCredentialParameter {\n  /**\n   * Credential type. Only `public-key` is supported.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * COSE algorithm identifier.\n   */\n  alg: number;\n}\n\n/**\n * JSON-safe authenticator selection options.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorSelection {\n  /**\n   * Optional authenticator attachment hint.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Optional resident key preference.\n   */\n  residentKey?: PasskeyResidentKey;\n\n  /**\n   * Legacy resident key requirement flag.\n   */\n  requireResidentKey?: boolean;\n\n  /**\n   * Optional user verification preference.\n   */\n  userVerification?: PasskeyUserVerification;\n}\n\n/**\n * JSON-safe registration request options.\n *\n * All binary fields must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyPublicKeyCredentialCreationOptionsJSON {\n  /**\n   * Base64url-encoded challenge.\n   */\n  challenge: string;\n\n  /**\n   * Relying party information.\n   */\n  rp: PasskeyRelyingParty;\n\n  /**\n   * User information.\n   */\n  user: PasskeyUserEntity;\n\n  /**\n   * Supported credential algorithms.\n   */\n  pubKeyCredParams: PasskeyCredentialParameter[];\n\n  /**\n   * Optional timeout hint in milliseconds.\n   */\n  timeout?: number;\n\n  /**\n   * Optional credentials that must be excluded during registration.\n   */\n  excludeCredentials?: PasskeyCredentialDescriptor[];\n\n  /**\n   * Optional authenticator preferences.\n   */\n  authenticatorSelection?: PasskeyAuthenticatorSelection;\n\n  /**\n   * Optional attestation preference.\n   */\n  attestation?: PasskeyAttestation;\n\n  /**\n   * Optional hints copied from the JSON form used by modern WebAuthn toolkits.\n   */\n  hints?: string[];\n\n  /**\n   * Optional extensions copied as-is into the request JSON.\n   */\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Direct registration request for the plugin transport.\n *\n * @since 1.0.0\n */\nexport interface CreateCredentialOptions {\n  /**\n   * JSON-safe registration request.\n   */\n  publicKey: PasskeyPublicKeyCredentialCreationOptionsJSON;\n\n  /**\n   * Optional HTTPS origin to use for iOS 17.4+ browser-style clientDataJSON.\n   */\n  origin?: string;\n}\n\n/**\n * JSON-safe authentication request options.\n *\n * All binary fields must be base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyPublicKeyCredentialRequestOptionsJSON {\n  /**\n   * Base64url-encoded challenge.\n   */\n  challenge: string;\n\n  /**\n   * Optional timeout hint in milliseconds.\n   */\n  timeout?: number;\n\n  /**\n   * Optional relying party identifier.\n   *\n   * If omitted, the shim derives it from the configured origin when possible.\n   */\n  rpId?: string;\n\n  /**\n   * Optional allow list copied from WebAuthn.\n   */\n  allowCredentials?: PasskeyCredentialDescriptor[];\n\n  /**\n   * Optional user verification preference.\n   */\n  userVerification?: PasskeyUserVerification;\n\n  /**\n   * Optional hints copied from the JSON form used by modern WebAuthn toolkits.\n   */\n  hints?: string[];\n\n  /**\n   * Optional extensions copied as-is into the request JSON.\n   */\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Direct authentication request for the plugin transport.\n *\n * @since 1.0.0\n */\nexport interface GetCredentialOptions {\n  /**\n   * JSON-safe authentication request.\n   */\n  publicKey: PasskeyPublicKeyCredentialRequestOptionsJSON;\n\n  /**\n   * Optional mediation hint. `conditional` currently falls back to an explicit prompt.\n   */\n  mediation?: string;\n\n  /**\n   * Optional HTTPS origin to use for iOS 17.4+ browser-style clientDataJSON.\n   */\n  origin?: string;\n}\n\n/**\n * JSON-safe attestation response payload.\n *\n * All binary fields are base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorAttestationResponseJSON {\n  /**\n   * Base64url-encoded clientDataJSON.\n   */\n  clientDataJSON: string;\n\n  /**\n   * Base64url-encoded attestation object.\n   */\n  attestationObject: string;\n\n  /**\n   * Optional base64url-encoded public key when provided by the platform.\n   */\n  publicKey?: string;\n\n  /**\n   * Optional public key algorithm when provided by the platform.\n   */\n  publicKeyAlgorithm?: number;\n\n  /**\n   * Optional transport list when provided by the platform.\n   */\n  transports?: string[];\n}\n\n/**\n * JSON-safe assertion response payload.\n *\n * All binary fields are base64url encoded.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticatorAssertionResponseJSON {\n  /**\n   * Base64url-encoded clientDataJSON.\n   */\n  clientDataJSON: string;\n\n  /**\n   * Base64url-encoded authenticator data.\n   */\n  authenticatorData: string;\n\n  /**\n   * Base64url-encoded signature.\n   */\n  signature: string;\n\n  /**\n   * Optional base64url-encoded user handle.\n   */\n  userHandle?: string | null;\n}\n\n/**\n * JSON-safe registration credential returned by the plugin.\n *\n * @since 1.0.0\n */\nexport interface PasskeyRegistrationCredential {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Base64url-encoded raw credential identifier.\n   */\n  rawId: string;\n\n  /**\n   * Credential type. Always `public-key`.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * Optional authenticator attachment reported by the platform.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Client extension results returned by the platform.\n   */\n  clientExtensionResults: Record<string, unknown>;\n\n  /**\n   * Registration response payload.\n   */\n  response: PasskeyAuthenticatorAttestationResponseJSON;\n}\n\n/**\n * JSON-safe authentication credential returned by the plugin.\n *\n * @since 1.0.0\n */\nexport interface PasskeyAuthenticationCredential {\n  /**\n   * Base64url-encoded credential identifier.\n   */\n  id: string;\n\n  /**\n   * Base64url-encoded raw credential identifier.\n   */\n  rawId: string;\n\n  /**\n   * Credential type. Always `public-key`.\n   */\n  type: PasskeyCredentialType;\n\n  /**\n   * Optional authenticator attachment reported by the platform.\n   */\n  authenticatorAttachment?: PasskeyAuthenticatorAttachment;\n\n  /**\n   * Client extension results returned by the platform.\n   */\n  clientExtensionResults: Record<string, unknown>;\n\n  /**\n   * Assertion response payload.\n   */\n  response: PasskeyAuthenticatorAssertionResponseJSON;\n}\n\n/**\n * Plugin version payload.\n *\n * @since 1.0.0\n */\nexport interface PluginVersionResult {\n  /**\n   * Version identifier reported by the current platform implementation.\n   */\n  version: string;\n}\n\n/**\n * Passkey support status for the current runtime.\n *\n * @since 1.0.0\n */\nexport interface PasskeySupportResult {\n  /**\n   * Whether passkeys are available on the current runtime.\n   */\n  available: boolean;\n\n  /**\n   * Whether conditional mediation is available.\n   */\n  conditionalMediation: boolean;\n\n  /**\n   * Current platform identifier.\n   */\n  platform: 'ios' | 'android' | 'web';\n}\n\n/**\n * Capacitor Passkey plugin.\n *\n * Use `autoShimWebAuthn()` or import `@capgo/capacitor-passkey/auto`\n * to keep existing `navigator.credentials.create/get` code working\n * inside a Capacitor app.\n *\n * @since 1.0.0\n */\nexport interface CapacitorPasskeyPlugin {\n  /**\n   * Install a browser-style WebAuthn shim on top of the native plugin.\n   *\n   * The shim patches `navigator.credentials.create/get` for `publicKey`\n   * requests and returns browser-like credential objects.\n   *\n   * Use this when you want to override the auto-loaded config manually.\n   *\n   * @since 1.0.0\n   * @example\n   * ```typescript\n   * import { CapacitorPasskey } from '@capgo/capacitor-passkey';\n   *\n   * CapacitorPasskey.shimWebAuthn({\n   *   origin: 'https://signin.example.com',\n   * });\n   * ```\n   */\n  shimWebAuthn(options?: ShimWebAuthnOptions): void;\n\n  /**\n   * Load plugin configuration from the host Capacitor app.\n   *\n   * This reads `plugins.CapacitorPasskey` from `capacitor.config.*`.\n   *\n   * @since 1.1.0\n   */\n  getConfiguration(): Promise<PasskeyRuntimeConfiguration>;\n\n  /**\n   * Install the browser-style shim using host app configuration.\n   *\n   * This is the easiest way to keep existing browser WebAuthn code working:\n   * configure the plugin in `capacitor.config.*`, then call this once during\n   * app bootstrap or use the `/auto` entrypoint.\n   *\n   * @since 1.1.0\n   * @example\n   * ```typescript\n   * import { CapacitorPasskey } from '@capgo/capacitor-passkey';\n   *\n   * await CapacitorPasskey.autoShimWebAuthn();\n   * ```\n   */\n  autoShimWebAuthn(options?: ShimWebAuthnOptions): Promise<PasskeyRuntimeConfiguration>;\n\n  /**\n   * Register a passkey from a JSON-safe WebAuthn request.\n   *\n   * This method is useful when your backend already returns the\n   * `PublicKeyCredentialCreationOptionsJSON` form.\n   *\n   * @since 1.0.0\n   */\n  createCredential(options: CreateCredentialOptions): Promise<PasskeyRegistrationCredential>;\n\n  /**\n   * Authenticate with an existing passkey from a JSON-safe WebAuthn request.\n   *\n   * This method is useful when your backend already returns the\n   * `PublicKeyCredentialRequestOptionsJSON` form.\n   *\n   * @since 1.0.0\n   */\n  getCredential(options: GetCredentialOptions): Promise<PasskeyAuthenticationCredential>;\n\n  /**\n   * Report whether passkeys are available in the current runtime.\n   *\n   * @since 1.0.0\n   */\n  isSupported(): Promise<PasskeySupportResult>;\n\n  /**\n   * Returns the current platform implementation version marker.\n   *\n   * @since 1.0.0\n   */\n  getPluginVersion(): Promise<PluginVersionResult>;\n}\n"]}

package/dist/esm/index.d.ts

@@ -0,0 +1,4 @@
+import type { CapacitorPasskeyPlugin } from './definitions';
+declare const CapacitorPasskey: CapacitorPasskeyPlugin;
+export * from './definitions';
+export { CapacitorPasskey };

package/dist/esm/index.js

@@ -0,0 +1,87 @@
+import { registerPlugin } from '@capacitor/core';
+import { installWebAuthnShim } from './shim';
+import { createNativeRequest } from './webauthn';
+const NativeCapacitorPasskey = registerPlugin('CapacitorPasskey', {
+    web: () => import('./web').then((module) => new module.CapacitorPasskeyWeb()),
+});
+let configurationPromise;
+let cachedConfiguration;
+function mergeShimOptions(configuration, options) {
+    var _a;
+    const origin = (_a = options === null || options === void 0 ? void 0 : options.origin) !== null && _a !== void 0 ? _a : configuration === null || configuration === void 0 ? void 0 : configuration.origin;
+    const force = options === null || options === void 0 ? void 0 : options.force;
+    if (!origin && force === undefined) {
+        return undefined;
+    }
+    return {
+        force,
+        origin,
+    };
+}
+function mergeRuntimeConfiguration(configuration, options) {
+    var _a;
+    const origin = (_a = options === null || options === void 0 ? void 0 : options.origin) !== null && _a !== void 0 ? _a : configuration.origin;
+    const domains = new Set(configuration.domains);
+    if (origin) {
+        try {
+            domains.add(new URL(origin).hostname);
+        }
+        catch (_b) {
+            // Ignore invalid override values here and let native APIs validate later.
+        }
+    }
+    return Object.assign(Object.assign({}, configuration), { domains: [...domains], origin });
+}
+async function loadConfiguration() {
+    try {
+        const configuration = await NativeCapacitorPasskey.getConfiguration();
+        cachedConfiguration = configuration;
+        return configuration;
+    }
+    catch (error) {
+        configurationPromise = undefined;
+        throw error;
+    }
+}
+const CapacitorPasskey = {
+    async autoShimWebAuthn(options) {
+        const configuration = await CapacitorPasskey.getConfiguration();
+        if (!configuration.autoShim && !(options === null || options === void 0 ? void 0 : options.force)) {
+            return configuration;
+        }
+        const effectiveConfiguration = mergeRuntimeConfiguration(configuration, options);
+        cachedConfiguration = effectiveConfiguration;
+        installWebAuthnShim({
+            options: mergeShimOptions(effectiveConfiguration, options),
+            plugin: CapacitorPasskey,
+        });
+        return effectiveConfiguration;
+    },
+    async createCredential(options) {
+        return NativeCapacitorPasskey.createCredential(createNativeRequest(options));
+    },
+    async getConfiguration() {
+        if (!configurationPromise) {
+            configurationPromise = loadConfiguration();
+        }
+        return configurationPromise;
+    },
+    async getCredential(options) {
+        return NativeCapacitorPasskey.getCredential(createNativeRequest(options));
+    },
+    async getPluginVersion() {
+        return NativeCapacitorPasskey.getPluginVersion();
+    },
+    async isSupported() {
+        return NativeCapacitorPasskey.isSupported();
+    },
+    shimWebAuthn(options) {
+        installWebAuthnShim({
+            options: mergeShimOptions(cachedConfiguration, options),
+            plugin: CapacitorPasskey,
+        });
+    },
+};
+export * from './definitions';
+export { CapacitorPasskey };
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAIjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,sBAAsB,GAAG,cAAc,CAA+B,kBAAkB,EAAE;IAC9F,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;CAC9E,CAAC,CAAC;AAEH,IAAI,oBAAsE,CAAC;AAC3E,IAAI,mBAA4D,CAAC;AAEjE,SAAS,gBAAgB,CACvB,aAAsD,EACtD,OAAwC;;IAExC,MAAM,MAAM,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC;IAE7B,IAAI,CAAC,MAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,aAA0C,EAC1C,OAAwC;;IAExC,MAAM,MAAM,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,aAAa,CAAC,MAAM,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAE/C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QAAC,WAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IAED,uCACK,aAAa,KAChB,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EACrB,MAAM,IACN;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;QACtE,mBAAmB,GAAG,aAAa,CAAC;QACpC,OAAO,aAAa,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oBAAoB,GAAG,SAAS,CAAC;QACjC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAA2B;IAC/C,KAAK,CAAC,gBAAgB,CAAC,OAAO;QAC5B,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;QAChE,IAAI,CAAC,aAAa,CAAC,QAAQ,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,EAAE,CAAC;YAC/C,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACjF,mBAAmB,GAAG,sBAAsB,CAAC;QAE7C,mBAAmB,CAAC;YAClB,OAAO,EAAE,gBAAgB,CAAC,sBAAsB,EAAE,OAAO,CAAC;YAC1D,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,OAAO;QAC5B,OAAO,sBAAsB,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,oBAAoB,GAAG,iBAAiB,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,OAAO;QACzB,OAAO,sBAAsB,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,CAAC,gBAAgB;QACpB,OAAO,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;IACnD,CAAC;IACD,KAAK,CAAC,WAAW;QACf,OAAO,sBAAsB,CAAC,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,YAAY,CAAC,OAAO;QAClB,mBAAmB,CAAC;YAClB,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,EAAE,OAAO,CAAC;YACvD,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,CAAC","sourcesContent":["import { registerPlugin } from '@capacitor/core';\n\nimport type { CapacitorPasskeyPlugin, PasskeyRuntimeConfiguration, ShimWebAuthnOptions } from './definitions';\nimport type { NativeCapacitorPasskeyPlugin } from './internal';\nimport { installWebAuthnShim } from './shim';\nimport { createNativeRequest } from './webauthn';\n\nconst NativeCapacitorPasskey = registerPlugin<NativeCapacitorPasskeyPlugin>('CapacitorPasskey', {\n  web: () => import('./web').then((module) => new module.CapacitorPasskeyWeb()),\n});\n\nlet configurationPromise: Promise<PasskeyRuntimeConfiguration> | undefined;\nlet cachedConfiguration: PasskeyRuntimeConfiguration | undefined;\n\nfunction mergeShimOptions(\n  configuration: PasskeyRuntimeConfiguration | undefined,\n  options: ShimWebAuthnOptions | undefined,\n): ShimWebAuthnOptions | undefined {\n  const origin = options?.origin ?? configuration?.origin;\n  const force = options?.force;\n\n  if (!origin && force === undefined) {\n    return undefined;\n  }\n\n  return {\n    force,\n    origin,\n  };\n}\n\nfunction mergeRuntimeConfiguration(\n  configuration: PasskeyRuntimeConfiguration,\n  options: ShimWebAuthnOptions | undefined,\n): PasskeyRuntimeConfiguration {\n  const origin = options?.origin ?? configuration.origin;\n  const domains = new Set(configuration.domains);\n\n  if (origin) {\n    try {\n      domains.add(new URL(origin).hostname);\n    } catch {\n      // Ignore invalid override values here and let native APIs validate later.\n    }\n  }\n\n  return {\n    ...configuration,\n    domains: [...domains],\n    origin,\n  };\n}\n\nasync function loadConfiguration(): Promise<PasskeyRuntimeConfiguration> {\n  try {\n    const configuration = await NativeCapacitorPasskey.getConfiguration();\n    cachedConfiguration = configuration;\n    return configuration;\n  } catch (error) {\n    configurationPromise = undefined;\n    throw error;\n  }\n}\n\nconst CapacitorPasskey: CapacitorPasskeyPlugin = {\n  async autoShimWebAuthn(options) {\n    const configuration = await CapacitorPasskey.getConfiguration();\n    if (!configuration.autoShim && !options?.force) {\n      return configuration;\n    }\n\n    const effectiveConfiguration = mergeRuntimeConfiguration(configuration, options);\n    cachedConfiguration = effectiveConfiguration;\n\n    installWebAuthnShim({\n      options: mergeShimOptions(effectiveConfiguration, options),\n      plugin: CapacitorPasskey,\n    });\n\n    return effectiveConfiguration;\n  },\n  async createCredential(options) {\n    return NativeCapacitorPasskey.createCredential(createNativeRequest(options));\n  },\n  async getConfiguration() {\n    if (!configurationPromise) {\n      configurationPromise = loadConfiguration();\n    }\n\n    return configurationPromise;\n  },\n  async getCredential(options) {\n    return NativeCapacitorPasskey.getCredential(createNativeRequest(options));\n  },\n  async getPluginVersion() {\n    return NativeCapacitorPasskey.getPluginVersion();\n  },\n  async isSupported() {\n    return NativeCapacitorPasskey.isSupported();\n  },\n  shimWebAuthn(options) {\n    installWebAuthnShim({\n      options: mergeShimOptions(cachedConfiguration, options),\n      plugin: CapacitorPasskey,\n    });\n  },\n};\n\nexport * from './definitions';\nexport { CapacitorPasskey };\n"]}

package/dist/esm/internal.d.ts

@@ -0,0 +1,14 @@
+import type { PasskeyAuthenticationCredential, PasskeyRuntimeConfiguration, PasskeyRegistrationCredential, PasskeySupportResult } from './definitions';
+export interface NativePasskeyRequest {
+    requestJson: string;
+    origin?: string;
+}
+export interface NativeCapacitorPasskeyPlugin {
+    createCredential(options: NativePasskeyRequest): Promise<PasskeyRegistrationCredential>;
+    getCredential(options: NativePasskeyRequest): Promise<PasskeyAuthenticationCredential>;
+    getConfiguration(): Promise<PasskeyRuntimeConfiguration>;
+    isSupported(): Promise<PasskeySupportResult>;
+    getPluginVersion(): Promise<{
+        version: string;
+    }>;
+}

package/dist/esm/internal.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=internal.js.map

package/dist/esm/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.js","sourceRoot":"","sources":["../../src/internal.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  PasskeyAuthenticationCredential,\n  PasskeyRuntimeConfiguration,\n  PasskeyRegistrationCredential,\n  PasskeySupportResult,\n} from './definitions';\n\nexport interface NativePasskeyRequest {\n  requestJson: string;\n  origin?: string;\n}\n\nexport interface NativeCapacitorPasskeyPlugin {\n  createCredential(options: NativePasskeyRequest): Promise<PasskeyRegistrationCredential>;\n  getCredential(options: NativePasskeyRequest): Promise<PasskeyAuthenticationCredential>;\n  getConfiguration(): Promise<PasskeyRuntimeConfiguration>;\n  isSupported(): Promise<PasskeySupportResult>;\n  getPluginVersion(): Promise<{ version: string }>;\n}\n"]}