@coinbase/cdp-core 0.0.121 → 0.0.123

package/dist/native/index.native243.js

@@ -1,6 +1,4 @@
-function e(t) {
-  return t && t.__esModule && Object.prototype.hasOwnProperty.call(t, "default") ? t.default : t;
-}
+var r = {};
 export {
-  e as getDefaultExportFromCjs
+  r as __exports
 };

package/dist/native/index.native244.js

@@ -1,4 +1,4 @@
-var r = { exports: {} };
+var e = { exports: {} };
 export {
-  r as __module
+  e as __module
 };

package/dist/native/index.native245.js

@@ -1,4 +1,4 @@
-var r = {};
+var r = { exports: {} };
 export {
-  r as __exports
+  r as __module
 };

package/dist/native/index.native246.js

@@ -1,4 +1,6 @@
-var e = { exports: {} };
+function e(t) {
+  return t && t.__esModule && Object.prototype.hasOwnProperty.call(t, "default") ? t.default : t;
+}
 export {
-  e as __module
+  e as getDefaultExportFromCjs
 };

package/dist/native/index.native253.js

@@ -1,4 +1,4 @@
-import n from "./index.native155.js";
+import n from "./index.native176.js";
 function r(t) {
   return n(t) && typeof t.kty == "string";
 }

package/dist/native/index.native256.js

@@ -1,4 +1,4 @@
-import { SizeExceedsPaddingSizeError as a } from "./index.native242.js";
+import { SizeExceedsPaddingSizeError as a } from "./index.native237.js";
 function o(r, i = {}) {
   const { dir: n, size: e = 32 } = i;
   if (e === 0)

package/dist/native/index.native3.js

@@ -1,2 +1,2 @@
-import { __require as r } from "./index.native224.js";
+import { __require as r } from "./index.native222.js";
 r();

package/dist/native/index.native79.js

@@ -1,26 +1,26 @@
-import { submitMfaEnrollment as s } from "@coinbase/cdp-api-client";
-import { Analytics as u } from "./index.native2.js";
+import { submitMfaEnrollment as u } from "@coinbase/cdp-api-client";
+import { Analytics as i } from "./index.native2.js";
 import "./index.native3.js";
-import { toAuthStateUser as i } from "./index.native104.js";
-import { withAuth as f } from "./index.native99.js";
-import { mockUser as c } from "./index.native109.js";
-import { validateUserAuthState as l } from "./index.native105.js";
+import { toAuthStateUser as f } from "./index.native104.js";
+import { withAuth as c } from "./index.native99.js";
+import { mockUser as l } from "./index.native109.js";
+import { validateUserAuthState as h } from "./index.native105.js";
 import { getConfig as o, getCoreAuthManager as p } from "./index.native76.js";
 const E = async (e) => {
-  if (u.sendActionCallEvent({ name: "submit_mfa_enrollment" }), o().useMock)
+  if (i.sendActionCallEvent({ name: "submit_mfa_enrollment" }), o().useMock)
     return {
-      user: c
+      user: l
     };
-  const t = p(), { authState: m } = l(t.getUser(), t.getAuthState()), a = await f({}, t, async ({ user: n }) => s(
-    n.userId,
+  const t = p(), { authState: a } = h(t.getUser(), t.getAuthState()), m = await c({}, t, async ({ user: s }) => u(
+    s.userId,
     e.mfaMethod,
     {
       mfaCode: e.mfaCode
     },
     { projectID: o().projectId },
     e.idempotencyKey
-  )), r = i(a.endUser);
-  return await t.setAuthState({ ...m, user: r }), { user: r };
+  )), r = f(m.endUser), n = t.getAuthState() ?? a;
+  return await t.setAuthState({ ...n, user: r }), { user: r };
 };
 export {
   E as submitMfaEnrollment

package/dist/native/index.native84.js

@@ -1,22 +1,25 @@
 import { getMfaConfigState as f } from "./index.native76.js";
 import "@coinbase/cdp-api-client";
 import "viem";
-const r = ["totp", "sms"], o = (t, e) => {
-  const n = t.mfaMethods[e]?.enrolledAt;
-  return !!n && Date.now() > new Date(n).getTime();
+const r = ["totp", "sms", "passkey"], s = (t) => !!t && Date.now() > new Date(t).getTime(), o = (t, e) => {
+  if (e === "passkey") {
+    const n = t.mfaMethods.passkey;
+    return Array.isArray(n) && n.some((a) => s(a.enrolledAt));
+  }
+  return s(t.mfaMethods[e]?.enrolledAt);
 };
-function d(t) {
+function M(t) {
   return t.mfaMethods ? r.filter((e) => o(t, e)) : [];
 }
-function s(t, e) {
+function c(t, e) {
   return e ? o(t, e) : t.mfaMethods ? r.some((n) => o(t, n)) : !1;
 }
-function M() {
+function m() {
   const t = f(), e = r.filter((n) => t?.[`${n}Config`]?.enabled);
   return e.length ? e : ["totp"];
 }
 export {
-  M as getEnabledMfaMethods,
-  d as getEnrolledMfaMethods,
-  s as isEnrolledInMfa
+  m as getEnabledMfaMethods,
+  M as getEnrolledMfaMethods,
+  c as isEnrolledInMfa
 };

package/dist/native/index.native87.js

@@ -13,24 +13,24 @@ const l = 60 * 1e3, R = {
   baseDelayMs: 1e3,
   maxDelayMs: 1e4
 };
-function g(s, e, r) {
-  const n = e * Math.pow(2, s), o = Math.random() * 0.3 * n;
-  return Math.min(n + o, r);
+function g(r, e, t) {
+  const n = e * Math.pow(2, r), o = Math.random() * 0.3 * n;
+  return Math.min(n + o, t);
 }
-function A(s) {
-  return new Promise((e) => setTimeout(e, s));
+function A(r) {
+  return new Promise((e) => setTimeout(e, r));
 }
-function E(s) {
-  if (s instanceof TypeError && s.message.includes("fetch"))
+function E(r) {
+  if (r instanceof TypeError && r.message.includes("fetch"))
     return !0;
-  if (s instanceof y) {
-    if (s.statusCode >= 500 && s.statusCode < 600 || s.statusCode === 408 || s.statusCode === 429)
+  if (r instanceof y) {
+    if (r.statusCode >= 500 && r.statusCode < 600 || r.statusCode === 408 || r.statusCode === 429)
       return !0;
-    if (s.statusCode === 401)
+    if (r.statusCode === 401)
       return !1;
   }
-  if (s instanceof Error) {
-    const e = s.message.toLowerCase();
+  if (r instanceof Error) {
+    const e = r.message.toLowerCase();
     if (e.includes("network") || e.includes("timeout") || e.includes("econnrefused") || e.includes("enotfound") || e.includes("socket"))
       return !0;
   }
@@ -48,9 +48,11 @@ class j {
    * Initializes the token manager.
    *
    * @param projectId - The project ID.
+   * @param options - Options that control initial session refresh behavior.
+   * @param options.deferInitialization - Whether to defer the initial session refresh until ensureInitialized is called.
    */
-  constructor(e) {
-    this.projectId = e, this.initPromise = this._doInitialize();
+  constructor(e, t = {}) {
+    this.projectId = e, t.deferInitialization || (this.initPromise = this._doInitialize());
   }
   /**
    * Gets the current user, or null if there is no user signed in.
@@ -139,12 +141,12 @@ class j {
     if (!await this.isSignedIn())
       throw new Error("Cannot get X-Wallet-Auth header if the user is not signed in");
     this.shouldRefreshWalletSecret() && await this.refreshWalletSecret();
-    const r = `${e.requestMethod} ${e.requestHost}${e.requestPath}`, n = Math.floor(Date.now() / 1e3), o = c(), a = {
-      uris: [r]
+    const t = `${e.requestMethod} ${e.requestHost}${e.requestPath}`, n = Math.floor(Date.now() / 1e3), o = c(), a = {
+      uris: [t]
     };
     if (e.requestData && Object.keys(e.requestData).length > 0) {
-      const t = p(e.requestData);
-      a.reqHash = await o.hash(new TextEncoder().encode(JSON.stringify(t)));
+      const s = p(e.requestData);
+      a.reqHash = await o.hash(new TextEncoder().encode(JSON.stringify(s)));
     }
     return await new _(a).setProtectedHeader({ alg: "ES256", typ: "JWT" }).setIssuedAt(n).setNotBefore(n).setJti(o.generateRandomId()).sign(this.walletSecret.keyPair.privateKey);
   }
@@ -162,7 +164,7 @@ class j {
    * @param authState - The authentication state.
    */
   async setAuthState(e) {
-    this.authState = e, i.endUserIdentifier = e.user.userId, this.authStateChangeCallbacks.forEach((r) => r(this.authState?.user ?? null)), this.scheduleTokenRefresh();
+    this.authState = e, i.endUserIdentifier = e.user.userId, this.authStateChangeCallbacks.forEach((t) => t(this.authState?.user ?? null)), this.scheduleTokenRefresh();
   }
   /**
    * Clears the authentication state.
@@ -172,14 +174,10 @@ class j {
   }
   /**
    * Ensures the AuthManager is initialized before proceeding.
-   * If initialization is already in progress, waits for it to complete.
+   * Starts deferred initialization when necessary, otherwise waits for initialization already in progress.
    */
   async ensureInitialized() {
-    if (this.initPromise) {
-      await this.initPromise;
-      return;
-    }
-    throw new Error("AuthManager not initialized");
+    this.initPromise ??= this._doInitialize(), await this.initPromise;
   }
   /**
    * Internal async initialization logic.
@@ -210,19 +208,19 @@ class j {
    * @returns The new access token.
    */
   async refreshAccessToken(e = "on_demand") {
-    const { maxRetries: r, baseDelayMs: n, maxDelayMs: o } = R;
+    const { maxRetries: t, baseDelayMs: n, maxDelayMs: o } = R;
     i.sendSessionRefreshEvent({
       name: "refresh_token_start",
       trigger: e
     });
-    for (let a = 0; a <= r; a++)
+    for (let a = 0; a <= t; a++)
       try {
-        const t = await d(this.projectId, {
+        const s = await d(this.projectId, {
           grantType: "refresh_token"
         }), h = k(
-          t.accessToken,
-          t.validUntil,
-          t.endUser
+          s.accessToken,
+          s.validUntil,
+          s.endUser
         );
         await this.setAuthState(h), i.sendSessionRefreshEvent({
           name: "refresh_token_success",
@@ -230,15 +228,15 @@ class j {
           attempt: a
         });
         return;
-      } catch (t) {
-        const h = t instanceof Error ? t.message : String(t);
-        if (m(t)) {
-          if (S(t)) {
+      } catch (s) {
+        const h = s instanceof Error ? s.message : String(s);
+        if (m(s)) {
+          if (S(s)) {
             i.sendSessionRefreshEvent({
               name: "refresh_token_skipped_transient",
               trigger: e,
               attempt: a,
-              read_outcome: t.outcome,
+              read_outcome: s.outcome,
               error_message: h
             });
             return;
@@ -248,12 +246,12 @@ class j {
             trigger: e,
             attempt: a,
             error_type: "non_transient",
-            read_outcome: t.outcome,
+            read_outcome: s.outcome,
             error_message: h
           }), await this.signOut();
           return;
         }
-        if (!E(t)) {
+        if (!E(s)) {
           i.sendSessionRefreshEvent({
             name: "refresh_token_failure",
             trigger: e,
@@ -263,7 +261,7 @@ class j {
           }), await this.signOut();
           return;
         }
-        if (a === r) {
+        if (a === t) {
           i.sendSessionRefreshEvent({
             name: "refresh_token_exhausted",
             trigger: e,
@@ -291,13 +289,13 @@ class j {
   scheduleTokenRefresh() {
     if (this.cancelTokenRefresh(), !this.authState)
       return;
-    const r = this.authState.expiresAt - l - Date.now();
-    r <= 0 || (i.sendSessionRefreshEvent({
+    const t = this.authState.expiresAt - l - Date.now();
+    t <= 0 || (i.sendSessionRefreshEvent({
       name: "refresh_token_scheduled",
-      time_until_refresh_ms: r
+      time_until_refresh_ms: t
     }), this.refreshTimeout = setTimeout(async () => {
       await this.refreshAccessToken("scheduled"), this.scheduleTokenRefresh();
-    }, r));
+    }, t));
   }
   /**
    * Cancels any scheduled token refresh.
@@ -334,20 +332,20 @@ class j {
    * Internal wallet secret refresh logic.
    */
   async _doRefreshWalletSecret() {
-    const e = c(), r = this.walletSecret?.walletSecretId ?? e.generateRandomId(), n = this.walletSecret?.keyPair ?? await e.createKeyPair(), o = this.authState.expiresAt, a = new Date(o).toISOString();
-    this.walletSecret = { walletSecretId: r, keyPair: n, expiresAt: o };
+    const e = c(), t = this.walletSecret?.walletSecretId ?? e.generateRandomId(), n = this.walletSecret?.keyPair ?? await e.createKeyPair(), o = this.authState.expiresAt, a = new Date(o).toISOString();
+    this.walletSecret = { walletSecretId: t, keyPair: n, expiresAt: o };
     try {
       await w(
         this.authState.user.userId,
         {
-          walletSecretId: r,
+          walletSecretId: t,
           publicKey: n.publicKeyBase64,
           validUntil: a
         },
         { projectID: this.projectId }
       );
-    } catch (t) {
-      throw this.walletSecret = null, t;
+    } catch (s) {
+      throw this.walletSecret = null, s;
     }
   }
 }

package/dist/native/index.native90.js

@@ -59,9 +59,11 @@ class l extends Error {
    *
    * @param code - The error code identifying the type of MFA error.
    * @param message - The error message.
+   * @param options - Additional error options.
+   * @param options.cause - The underlying error this one was mapped from, when there is one.
    */
-  constructor(r, e) {
-    super(e), this.name = "MfaError", this.code = r;
+  constructor(r, e, o) {
+    super(e, o), this.name = "MfaError", this.code = r;
   }
 }
 class u extends Error {

package/dist/native-types/actions/deletePasskey.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Deletes a single enrolled passkey (WebAuthn) credential by its credential ID.
+ *
+ * Last Method Protection: if deleting this passkey would leave the end user with
+ * no enrolled MFA methods of any type (no other passkeys, TOTP, or SMS) and the
+ * project requires MFA verification on login, the request is rejected with a 403.
+ *
+ * The signed-in user is refreshed afterwards, so `user.mfaMethods.passkey` and
+ * `isEnrolledInMfa(user, "passkey")` reflect the deletion. A `listPasskeys` result you are
+ * already holding is not refreshed; re-run it to get the new list.
+ *
+ * @param credentialId - The base64url-encoded WebAuthn credential ID of the passkey to delete.
+ * @example
+ * ```typescript
+ * const [passkey] = await listPasskeys();
+ * await deletePasskey(passkey.credentialId);
+ * const remaining = await listPasskeys();
+ * ```
+ * @returns A promise that resolves once the passkey has been deleted.
+ */
+export declare const deletePasskey: (credentialId: string) => Promise<void>;

package/dist/native-types/actions/enrollPasskey.d.ts

@@ -0,0 +1,44 @@
+import { User } from '../types.js';
+/**
+ * Options for enrolling a passkey (WebAuthn) as an MFA method.
+ */
+export type EnrollPasskeyOptions = {
+    /** An optional human-friendly name for the passkey (e.g. the device or browser), shown when listing enrolled passkeys. */
+    name?: string;
+    /** Optional idempotency key for safe retries. */
+    idempotencyKey?: string;
+};
+/**
+ * Result of enrollPasskey.
+ */
+export type EnrollPasskeyResult = {
+    /** The updated user with the passkey enrolled. */
+    user: User;
+};
+/**
+ * Enrolls a passkey (WebAuthn) as an MFA method for the current end user.
+ *
+ * This runs the full WebAuthn registration ceremony in one call: it initiates
+ * enrollment with the server to obtain credential creation options, prompts the
+ * browser to create a new credential via `navigator.credentials.create()`, and
+ * submits the resulting attestation to the server to complete enrollment.
+ *
+ * Passkey MFA is supported in web environments only. Call `isPasskeySupported`
+ * first to check availability before offering passkey enrollment in your UI.
+ *
+ * @param options - The options for enrolling the passkey.
+ * @param options.name - An optional human-friendly name for the passkey.
+ * @param options.idempotencyKey - Optional idempotency key for safe retries.
+ * @example
+ * ```typescript
+ * if (await isPasskeySupported()) {
+ *   const { user } = await enrollPasskey({ name: "MacBook Pro" });
+ *   console.log("Passkey enrolled for user:", user.userId);
+ * }
+ * ```
+ * @returns The result containing the updated user.
+ * @throws {MfaError} With code `PASSKEY_NOT_SUPPORTED` when passkeys are not available in the current environment.
+ * @throws {MfaError} With code `CANCELLED` when the user dismisses the passkey prompt or it times out.
+ * @throws {MfaError} With code `PASSKEY_ALREADY_ENROLLED` when this device already holds a passkey for the account.
+ */
+export declare const enrollPasskey: (options?: EnrollPasskeyOptions) => Promise<EnrollPasskeyResult>;

package/dist/native-types/actions/listPasskeys.d.ts

@@ -0,0 +1,16 @@
+import { PasskeySummary } from '@coinbase/cdp-api-client';
+/**
+ * Lists the passkey (WebAuthn) credentials enrolled by the current end user.
+ *
+ * Never returns the COSE public key or any other sensitive credential material.
+ *
+ * @example
+ * ```typescript
+ * const passkeys = await listPasskeys();
+ * for (const passkey of passkeys) {
+ *   console.log(passkey.name, passkey.credentialId, passkey.enrolledAt);
+ * }
+ * ```
+ * @returns A promise resolving to the list of enrolled passkey summaries.
+ */
+export declare const listPasskeys: () => Promise<PasskeySummary[]>;

package/dist/native-types/actions/verifyPasskey.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Options for verifying a passkey (WebAuthn).
+ */
+export type VerifyPasskeyOptions = {
+    /** Optional idempotency key for safe retries. */
+    idempotencyKey?: string;
+};
+/**
+ * Completes an MFA verification using an enrolled passkey (WebAuthn).
+ *
+ * This runs the full WebAuthn authentication ceremony in one call: it initiates
+ * verification with the server to obtain credential request options, prompts the
+ * browser for an assertion via `navigator.credentials.get()`, and submits the
+ * resulting assertion to the server. After successful verification, any pending
+ * operation that was waiting for MFA will automatically continue.
+ *
+ * Passkey MFA is supported in web environments only. Call `isPasskeySupported`
+ * first to check availability before offering passkey verification in your UI.
+ *
+ * @param options - The options for the verification.
+ * @param options.idempotencyKey - Optional idempotency key for safe retries.
+ * @example
+ * ```typescript
+ * await verifyPasskey();
+ * ```
+ * @returns A promise that resolves if passkey verification is successful.
+ * @throws {MfaError} With code `PASSKEY_NOT_SUPPORTED` when passkeys are not available in the current environment.
+ * @throws {MfaError} With code `CANCELLED` when the user dismisses the passkey prompt or it times out.
+ */
+export declare const verifyPasskey: (options?: VerifyPasskeyOptions) => Promise<void>;

package/dist/native-types/auth/authManager.d.ts

@@ -16,8 +16,12 @@ export declare class AuthManager implements IAuthManager {
      * Initializes the token manager.
      *
      * @param projectId - The project ID.
+     * @param options - Options that control initial session refresh behavior.
+     * @param options.deferInitialization - Whether to defer the initial session refresh until ensureInitialized is called.
      */
-    constructor(projectId: string);
+    constructor(projectId: string, options?: {
+        deferInitialization?: boolean;
+    });
     /**
      * Gets the current user, or null if there is no user signed in.
      *
@@ -98,7 +102,7 @@ export declare class AuthManager implements IAuthManager {
     clearAuthState(): Promise<void>;
     /**
      * Ensures the AuthManager is initialized before proceeding.
-     * If initialization is already in progress, waits for it to complete.
+     * Starts deferred initialization when necessary, otherwise waits for initialization already in progress.
      */
     ensureInitialized(): Promise<void>;
     /**

package/dist/native-types/auth/createAuthManager.d.ts

@@ -6,6 +6,10 @@ import { IAuthManager } from './types.js';
  * - Otherwise, returns an AuthManager for standard CDP authentication
  *
  * @param projectId - The project ID.
+ * @param options - Options that control initial session refresh behavior.
+ * @param options.deferInitialization - Whether to defer the initial session refresh until ensureInitialized is called.
  * @returns The appropriate AuthManager instance.
  */
-export declare function createAuthManager(projectId: string): IAuthManager;
+export declare function createAuthManager(projectId: string, options?: {
+    deferInitialization?: boolean;
+}): IAuthManager;

package/dist/native-types/errors.d.ts

@@ -63,7 +63,11 @@ export type MfaErrorCode =
 /** No MFA listener is registered to handle verification. */
  | "LISTENER_REQUIRED"
 /** MFA listeners are registered but none matched the trigger value. */
- | "NO_LISTENER_MATCHED";
+ | "NO_LISTENER_MATCHED"
+/** Passkeys (WebAuthn) are not supported in the current environment. */
+ | "PASSKEY_NOT_SUPPORTED"
+/** This device already holds a passkey for this account, so it cannot enroll another. */
+ | "PASSKEY_ALREADY_ENROLLED";
 /**
  * Error thrown when an MFA operation fails.
  */
@@ -77,8 +81,12 @@ export declare class MfaError extends Error {
      *
      * @param code - The error code identifying the type of MFA error.
      * @param message - The error message.
+     * @param options - Additional error options.
+     * @param options.cause - The underlying error this one was mapped from, when there is one.
      */
-    constructor(code: MfaErrorCode, message: string);
+    constructor(code: MfaErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
 }
 /**
  * Error codes for swap-related errors returned by the backend.

package/dist/native-types/index.web.d.ts

@@ -49,6 +49,10 @@ export { submitMfaEnrollment, type SubmitMfaEnrollmentOptions, type SubmitMfaEnr
 export { initiateMfaVerification } from './actions/initiateMfaVerification.js';
 export { submitMfaVerification, type SubmitMfaVerificationOptions, } from './actions/submitMfaVerification.js';
 export { cancelMfaVerification } from './actions/cancelMfaVerification.js';
+export { enrollPasskey, type EnrollPasskeyOptions, type EnrollPasskeyResult, } from './actions/enrollPasskey.js';
+export { verifyPasskey, type VerifyPasskeyOptions } from './actions/verifyPasskey.js';
+export { listPasskeys } from './actions/listPasskeys.js';
+export { deletePasskey } from './actions/deletePasskey.js';
 export { getEnabledMfaMethods, getEnrolledMfaMethods, isEnrolledInMfa, isMfaProtectedAction, isMfaRequired, MFA_PROTECTED_ACTIONS, MFA_PROTECTED_FUNCTIONS, type MfaProtectedAction, type MfaListener, type MfaVerificationContext, } from './mfa/index.js';
 export { registerMfaListener, type MfaListenerOptions } from './mfa/state.web.js';
 export * from './auth/authManager.js';
@@ -66,3 +70,4 @@ export * from './secureIframe/index.js';
 export { createEvmKeyExportIframe, createSolanaKeyExportIframe, type CreateKeyExportIframeOptions, type CreateKeyExportIframeResult, type SecureIframeStatusDetails, } from './actions/createKeyExportIframe.js';
 export { getConfig } from './state.js';
 export { toTransactionSigner } from './solana-kit/toTransactionSigner.js';
+export { isPasskeySupported } from './shared/webauthn.js';

package/dist/native-types/mfa/utils.d.ts

@@ -3,13 +3,13 @@ import { User, MfaMethod } from '../types.js';
  * Gets the list of MFA methods that the user has enrolled in.
  *
  * @param user - The user object.
- * @returns An array of enrolled MFA methods ('totp', 'sms', or both).
+ * @returns An array of enrolled MFA methods, any of 'totp', 'sms', and 'passkey'.
  *
  * @example
  * ```typescript
  * const user = await getCurrentUser();
  * const methods = getEnrolledMfaMethods(user);
- * // methods = ['totp', 'sms']
+ * // methods = ['totp', 'passkey']
  *
  * if (methods.length > 1) {
  *   // Prompt user to choose which method to use
@@ -56,7 +56,7 @@ export declare function isEnrolledInMfa(user: User, method?: MfaMethod): boolean
  * const config = getMfaConfigState();
  * if (config) {
  *   const methods = getEnabledMfaMethods(config);
- *   // methods = ['totp', 'sms']
+ *   // methods = ['totp', 'passkey']
  * }
  * ```
  */

package/dist/native-types/shared/base64url.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Encodes binary data to a URL-safe base64 string (base64url), with no padding.
+ *
+ * URL-safe base64 replaces the standard `+` and `/` characters with `-` and `_`
+ * respectively, and omits the `=` padding. This is the encoding WebAuthn uses for
+ * binary fields (challenge, credential IDs, etc.) when serialized to JSON.
+ *
+ * @param data - The binary data to encode, as an ArrayBuffer or Uint8Array.
+ * @returns The base64url-encoded string (no padding).
+ */
+export declare function encodeBase64url(data: ArrayBuffer | Uint8Array): string;
+/**
+ * Decodes a URL-safe base64 string (base64url) to binary data.
+ *
+ * Accepts input with or without padding, and tolerates the standard base64
+ * alphabet as well. Reverses {@link encodeBase64url}.
+ *
+ * @param base64url - The base64url-encoded string to decode.
+ * @returns The decoded bytes as a Uint8Array.
+ */
+export declare function decodeBase64url(base64url: string): Uint8Array;