@keyneom/sync-kit 0.1.0 → 0.2.0-rc.0

package/dist/crypto/profiles.js

@@ -1,48 +1,35 @@
 export const V1_ALGORITHM = "AES-256-GCM+HKDF-SHA-256";
-export const easyBcV1Profile = {
-    appId: "easy-bc",
-    filename: "easybc-sync-v1.json",
-    aad: "easy-bc-sync-envelope-v1",
-    hkdfInfo: "easy-bc-cloud-content-key-v1",
-    algorithm: V1_ALGORITHM,
-    readVersions: [1],
-    writeVersion: 1,
-    compression: "gzip-if-smaller",
-    nonceBytes: 12,
-    kdfSaltBytes: 32,
-    prfInputBytes: 32,
-    tagBits: 128,
-    passkey: {
-        rpName: "EasyBC",
-        userName: "encrypted-sync",
-        userDisplayName: "EasyBC encrypted sync",
-        algorithm: -7,
-        residentKey: "required",
-        userVerification: "required",
-        timeoutMs: 60_000,
-    },
-};
-export const familyChoresV1Profile = {
-    appId: "family-chores",
-    filename: "family-chores-sync-v1.json",
-    aad: "family-chores-sync-envelope-v1",
-    hkdfInfo: "family-chores-cloud-content-key-v1",
-    algorithm: V1_ALGORITHM,
-    readVersions: [1],
-    writeVersion: 1,
-    compression: "none",
-    nonceBytes: 12,
-    kdfSaltBytes: 32,
-    prfInputBytes: 32,
-    tagBits: 128,
-    passkey: {
-        rpName: "Family Chores",
-        userName: "encrypted-sync",
-        userDisplayName: "Family Chores encrypted sync",
-        algorithm: -7,
-        residentKey: "required",
-        userVerification: "required",
-        timeoutMs: 60_000,
-    },
-};
+/**
+ * Creates a consumer-owned v1 profile while fixing protocol-level constants.
+ * Application profiles are configuration, not package presets.
+ */
+export function defineV1CompatibilityProfile(input) {
+    for (const [name, value] of Object.entries({
+        appId: input.appId,
+        filename: input.filename,
+        aad: input.aad,
+        hkdfInfo: input.hkdfInfo,
+        rpName: input.passkey.rpName,
+        userName: input.passkey.userName,
+        userDisplayName: input.passkey.userDisplayName,
+    })) {
+        if (!value.trim())
+            throw new TypeError(`${name} must not be empty.`);
+    }
+    if (!Number.isFinite(input.passkey.timeoutMs) ||
+        input.passkey.timeoutMs <= 0) {
+        throw new TypeError("passkey.timeoutMs must be positive.");
+    }
+    return Object.freeze({
+        ...input,
+        passkey: Object.freeze({ ...input.passkey }),
+        algorithm: V1_ALGORITHM,
+        readVersions: [1],
+        writeVersion: 1,
+        nonceBytes: 12,
+        kdfSaltBytes: 32,
+        prfInputBytes: 32,
+        tagBits: 128,
+    });
+}
 //# sourceMappingURL=profiles.js.map

package/dist/crypto/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/crypto/profiles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,0BAAmC,CAAC;AA8BhE,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,qBAAqB;IAC/B,GAAG,EAAE,0BAA0B;IAC/B,QAAQ,EAAE,8BAA8B;IACxC,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,CAAC,CAAC,CAAC;IACjB,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,EAAE;IACjB,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE;QACP,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,uBAAuB;QACxC,SAAS,EAAE,CAAC,CAAC;QACb,WAAW,EAAE,UAAU;QACvB,gBAAgB,EAAE,UAAU;QAC5B,SAAS,EAAE,MAAM;KAClB;CACwC,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,eAAe;IACtB,QAAQ,EAAE,4BAA4B;IACtC,GAAG,EAAE,gCAAgC;IACrC,QAAQ,EAAE,oCAAoC;IAC9C,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,CAAC,CAAC,CAAC;IACjB,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,EAAE;IACjB,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE;QACP,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,eAAe,EAAE,8BAA8B;QAC/C,SAAS,EAAE,CAAC,CAAC;QACb,WAAW,EAAE,UAAU;QACvB,gBAAgB,EAAE,UAAU;QAC5B,SAAS,EAAE,MAAM;KAClB;CACwC,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/crypto/profiles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,0BAAmC,CAAC;AAmChE;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAkC;IAElC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QACzC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;KAC/C,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IACvE,CAAC;IACD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACzC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5C,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,CAAC,CAAC,CAAU;QAC1B,YAAY,EAAE,CAAC;QACf,UAAU,EAAE,EAAE;QACd,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;QACjB,OAAO,EAAE,GAAG;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./core/index.js";
 export * from "./crypto/index.js";
+export * from "./sharing/index.js";
 export * from "./snapshot/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
 export * from "./core/index.js";
 export * from "./crypto/index.js";
+export * from "./sharing/index.js";
 export * from "./snapshot/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC"}

package/dist/keys/web-passkey/index.d.ts

@@ -1,9 +1,14 @@
 import type { KeyProvider } from "../../core/types.js";
 import { type CryptoBackend, type SyncEnvelopeV1, type V1CompatibilityProfile, type V1KeyMetadata } from "../../crypto/index.js";
+export type WebPasskeyKeyMetadata = V1KeyMetadata & {
+    credentialPublicKey?: JsonWebKey;
+};
 export type WebPasskeyProviderOptions<K> = {
     rpId: string;
     deriveKey: (secret: Uint8Array, salt: Uint8Array) => Promise<K>;
-    crypto?: Pick<Crypto, "getRandomValues">;
+    crypto?: Pick<Crypto, "getRandomValues"> & {
+        subtle?: SubtleCrypto;
+    };
     navigator?: Navigator;
     secureContext?: () => boolean;
 };
@@ -14,10 +19,11 @@ export declare class WebPasskeyProvider<K> implements KeyProvider<SyncEnvelopeV1
     private pending;
     constructor(profile: V1CompatibilityProfile, options: WebPasskeyProviderOptions<K>);
     create(): Promise<{
-        metadata: V1KeyMetadata;
+        metadata: WebPasskeyKeyMetadata;
         key: K;
     }>;
     unlock(envelope: SyncEnvelopeV1): Promise<K>;
+    unlockMetadata(metadata: V1KeyMetadata): Promise<K>;
     clear(): void;
     supported(): boolean;
     private unlockNow;

package/dist/keys/web-passkey/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/keys/web-passkey/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAe/B,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC;CAC/B,CAAC;AAEF,qBAAa,kBAAkB,CAAC,CAAC,CAC/B,YAAW,WAAW,CAAC,cAAc,EAAE,CAAC,EAAE,aAAa,CAAC;IAMtD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,OAAO,CAA0D;gBAGtD,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAGlD,MAAM,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,GAAG,EAAE,CAAC,CAAA;KAAE,CAAC;IAsDtD,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAqBlD,KAAK,IAAI,IAAI;IAKb,SAAS,IAAI,OAAO;YASN,SAAS;YAkBT,WAAW;YA6BX,aAAa;IAW3B,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,YAAY;CAMrB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,GAAG;IACjE,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;CACpC,GACA,kBAAkB,CAAC,SAAS,CAAC,CAO/B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/keys/web-passkey/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAgB/B,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAClD,mBAAmB,CAAC,EAAE,UAAU,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG;QACzC,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;IACF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC;CAC/B,CAAC;AAEF,qBAAa,kBAAkB,CAAC,CAAC,CAC/B,YAAW,WAAW,CAAC,cAAc,EAAE,CAAC,EAAE,aAAa,CAAC;IAMtD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,OAAO,CAA0D;gBAGtD,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAGlD,MAAM,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,qBAAqB,CAAC;QAAC,GAAG,EAAE,CAAC,CAAA;KAAE,CAAC;IA2D9D,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IAS5C,cAAc,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC;IAqBzD,KAAK,IAAI,IAAI;IAKb,SAAS,IAAI,OAAO;YASN,SAAS;YAkBT,WAAW;YA6BX,aAAa;IAW3B,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,MAAM;IAUd,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,YAAY;CAMrB;AA8BD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,GAAG;IACjE,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;CACpC,GACA,kBAAkB,CAAC,SAAS,CAAC,CAO/B"}

package/dist/keys/web-passkey/index.js

@@ -45,27 +45,37 @@ export class WebPasskeyProvider {
         const secret = returnedSecret ??
             (await this.evaluatePrf(credentialId, prfInput, this.options.rpId));
         const key = await this.deriveAndZero(secret, kdfSalt);
+        const credentialPublicKey = await exportCredentialPublicKey(credential, cryptoImplementation.subtle);
         const metadata = {
             credentialId: bytesToBase64Url(credentialId),
             rpId: this.options.rpId,
             prfInput,
             kdfSalt,
+            ...(credentialPublicKey ? { credentialPublicKey } : {}),
         };
         this.cached = { identity: metadataIdentity(metadata), key };
         return { metadata, key };
     }
     async unlock(envelope) {
-        if (envelope.rpId !== this.options.rpId) {
-            throw new SyncKitError("compatibility", `The snapshot belongs to ${envelope.rpId}, not ${this.options.rpId}.`);
+        return this.unlockMetadata({
+            credentialId: envelope.credentialId,
+            rpId: envelope.rpId,
+            prfInput: base64UrlToBytes(envelope.prfInput),
+            kdfSalt: base64UrlToBytes(envelope.kdfSalt),
+        });
+    }
+    async unlockMetadata(metadata) {
+        if (metadata.rpId !== this.options.rpId) {
+            throw new SyncKitError("compatibility", `The protected key belongs to ${metadata.rpId}, not ${this.options.rpId}.`);
         }
-        const identity = envelopeIdentity(envelope);
+        const identity = metadataIdentity(metadata);
         if (this.cached?.identity === identity)
             return this.cached.key;
         if (this.cached)
             this.clear();
         if (this.pending?.identity === identity)
             return this.pending.promise;
-        const promise = this.unlockNow(envelope, identity);
+        const promise = this.unlockNow(metadata, identity);
         this.pending = { identity, promise };
         try {
             return await promise;
@@ -85,10 +95,10 @@ export class WebPasskeyProvider {
             (typeof window !== "undefined" && window.isSecureContext)) &&
             Boolean(navigatorImplementation?.credentials));
     }
-    async unlockNow(envelope, identity) {
+    async unlockNow(metadata, identity) {
         this.assertSupported();
-        const secret = await this.evaluatePrf(base64UrlToBytes(envelope.credentialId), base64UrlToBytes(envelope.prfInput), envelope.rpId);
-        const key = await this.deriveAndZero(secret, base64UrlToBytes(envelope.kdfSalt));
+        const secret = await this.evaluatePrf(base64UrlToBytes(metadata.credentialId), metadata.prfInput, metadata.rpId);
+        const key = await this.deriveAndZero(secret, metadata.kdfSalt);
         this.cached = { identity, key };
         return key;
     }
@@ -143,6 +153,20 @@ export class WebPasskeyProvider {
             (typeof navigator === "undefined" ? undefined : navigator));
     }
 }
+async function exportCredentialPublicKey(credential, subtle) {
+    if (!subtle || !credential.response)
+        return undefined;
+    const response = credential.response;
+    if (response.getPublicKeyAlgorithm?.() !== -7 ||
+        typeof response.getPublicKey !== "function") {
+        return undefined;
+    }
+    const spki = response.getPublicKey();
+    if (!spki)
+        return undefined;
+    const key = await subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
+    return subtle.exportKey("jwk", key);
+}
 export function createWebPasskeyProvider(profile, options) {
     const backend = options.backend ?? createWebCryptoBackend();
     return new WebPasskeyProvider(profile, {
@@ -173,13 +197,11 @@ function prfExtensions(prfInput) {
 function randomBytes(length, cryptoImplementation) {
     return cryptoImplementation.getRandomValues(new Uint8Array(length));
 }
-function envelopeIdentity(envelope) {
-    return [envelope.rpId, envelope.credentialId, envelope.kdfSalt].join("\n");
-}
 function metadataIdentity(metadata) {
     return [
         metadata.rpId,
         metadata.credentialId,
+        bytesToBase64Url(metadata.prfInput),
         bytesToBase64Url(metadata.kdfSalt),
     ].join("\n");
 }

package/dist/keys/web-passkey/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/keys/web-passkey/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAsBrD,MAAM,OAAO,kBAAkB;IAOV;IACA;IALX,MAAM,GAAwC,IAAI,CAAC;IACnD,OAAO,GAAqD,IAAI,CAAC;IAEzE,YACmB,OAA+B,EAC/B,OAAqC;QADrC,YAAO,GAAP,OAAO,CAAwB;QAC/B,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,WAAW,CAC1B,IAAI,CAAC,OAAO,CAAC,aAAa,EAC1B,oBAAoB,CACrB,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CACzB,IAAI,CAAC,OAAO,CAAC,YAAY,EACzB,oBAAoB,CACrB,CAAC;QACF,MAAM,UAAU,GAAG,qBAAqB,CACtC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YACxC,SAAS,EAAE;gBACT,EAAE,EAAE;oBACF,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACrB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM;iBAClC;gBACD,IAAI,EAAE;oBACJ,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;oBACrD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ;oBACnC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe;iBAClD;gBACD,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBAC5D,gBAAgB,EAAE;oBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;iBAC5D;gBACD,sBAAsB,EAAE;oBACtB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW;oBAC7C,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;iBACxD;gBACD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;gBACvC,WAAW,EAAE,MAAM;gBACnB,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC;aACpC;SACF,CAAC,CACH,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GACV,cAAc;YACd,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG;YACf,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC;YAC5C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,QAAQ;YACR,OAAO;SACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAwB;QACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,2BAA2B,QAAQ,CAAC,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAErE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,SAAS;QACP,MAAM,uBAAuB,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO,CACL,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE;YAC7B,CAAC,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC;YAC5D,OAAO,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAC9C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,QAAwB,EACxB,QAAgB;QAEhB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EACvC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACnC,QAAQ,CAAC,IAAI,CACd,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,MAAM,EACN,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,YAAwB,EACxB,QAAoB,EACpB,IAAY;QAEZ,MAAM,UAAU,GAAG,qBAAqB,CACtC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;YACrC,SAAS,EAAE;gBACT,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,IAAI;gBACJ,gBAAgB,EAAE;oBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE;iBACrD;gBACD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;gBACvD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;gBACvC,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC;aACpC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAkB,EAClB,IAAgB;QAEhB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM;QACZ,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,SAAS;QACf,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,YAAY;QAClB,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,CAAC,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3D,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,OAA+B,EAC/B,OAEC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sBAAsB,EAAE,CAAC;IAC5D,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE;QACrC,GAAG,OAAO;QACV,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAC1B,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAwB;IAExB,IACE,CAAC,KAAK;QACN,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QACnB,OAAQ,KAA4C;aACjD,yBAAyB;YAC1B,UAAU,EACZ,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,KAA2C,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,UAAmC;IACpD,MAAM,KAAK,GAAI,UAAU,CAAC,yBAAyB,EAAgB,CAAC,GAAG;QACrE,EAAE,OAAO,EAAE,KAAK,CAAC;IACnB,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CACpB,QAAoB;IAEpB,OAAO;QACL,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,oBAAqD;IAErD,OAAO,oBAAoB,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAuB;IAC/C,OAAO;QACL,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,YAAY;QACrB,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC;KACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/keys/web-passkey/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AA6BrD,MAAM,OAAO,kBAAkB;IAOV;IACA;IALX,MAAM,GAAwC,IAAI,CAAC;IACnD,OAAO,GAAqD,IAAI,CAAC;IAEzE,YACmB,OAA+B,EAC/B,OAAqC;QADrC,YAAO,GAAP,OAAO,CAAwB;QAC/B,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,WAAW,CAC1B,IAAI,CAAC,OAAO,CAAC,aAAa,EAC1B,oBAAoB,CACrB,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CACzB,IAAI,CAAC,OAAO,CAAC,YAAY,EACzB,oBAAoB,CACrB,CAAC;QACF,MAAM,UAAU,GAAG,qBAAqB,CACtC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YACxC,SAAS,EAAE;gBACT,EAAE,EAAE;oBACF,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACrB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM;iBAClC;gBACD,IAAI,EAAE;oBACJ,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;oBACrD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ;oBACnC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe;iBAClD;gBACD,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBAC5D,gBAAgB,EAAE;oBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;iBAC5D;gBACD,sBAAsB,EAAE;oBACtB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW;oBAC7C,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;iBACxD;gBACD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;gBACvC,WAAW,EAAE,MAAM;gBACnB,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC;aACpC;SACF,CAAC,CACH,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GACV,cAAc;YACd,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,mBAAmB,GAAG,MAAM,yBAAyB,CACzD,UAAU,EACV,oBAAoB,CAAC,MAAM,CAC5B,CAAC;QACF,MAAM,QAAQ,GAA0B;YACtC,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC;YAC5C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,QAAQ;YACR,OAAO;YACP,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAwB;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7C,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAuB;QAC1C,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,gCAAgC,QAAQ,CAAC,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAErE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,SAAS;QACP,MAAM,uBAAuB,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO,CACL,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE;YAC7B,CAAC,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC;YAC5D,OAAO,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAC9C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,QAAuB,EACvB,QAAgB;QAEhB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EACvC,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,IAAI,CACd,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,MAAM,EACN,QAAQ,CAAC,OAAO,CACjB,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,YAAwB,EACxB,QAAoB,EACpB,IAAY;QAEZ,MAAM,UAAU,GAAG,qBAAqB,CACtC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;YACrC,SAAS,EAAE;gBACT,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,IAAI;gBACJ,gBAAgB,EAAE;oBAChB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE;iBACrD;gBACD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;gBACvD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;gBACvC,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC;aACpC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAkB,EAClB,IAAgB;QAEhB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM;QAGZ,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,SAAS;QACf,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,YAAY;QAClB,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,CAAC,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3D,CAAC;IACJ,CAAC;CACF;AAED,KAAK,UAAU,yBAAyB,CACtC,UAAmC,EACnC,MAAgC;IAEhC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,QAAQ,GACZ,UAAU,CAAC,QAGV,CAAC;IACJ,IACE,QAAQ,CAAC,qBAAqB,EAAE,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,YAAY,KAAK,UAAU,EAC3C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,MAAM,EACN,IAAI,EACJ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAA+B,EAC/B,OAEC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sBAAsB,EAAE,CAAC;IAC5D,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE;QACrC,GAAG,OAAO;QACV,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAC1B,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAwB;IAExB,IACE,CAAC,KAAK;QACN,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QACnB,OAAQ,KAA4C;aACjD,yBAAyB;YAC1B,UAAU,EACZ,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,KAAK,EACL,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,KAA2C,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,UAAmC;IACpD,MAAM,KAAK,GAAI,UAAU,CAAC,yBAAyB,EAAgB,CAAC,GAAG;QACrE,EAAE,OAAO,EAAE,KAAK,CAAC;IACnB,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CACpB,QAAoB;IAEpB,OAAO;QACL,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,oBAAqD;IAErD,OAAO,oBAAoB,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAuB;IAC/C,OAAO;QACL,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,YAAY;QACrB,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC;KACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/sharing/account-binding.d.ts

@@ -0,0 +1,57 @@
+import type { SharingAccountBindingV1, SharingPasskeyAssertionV1 } from "./index.js";
+export type SharingAccountBindingContext = {
+    appId: string;
+    exchangeId: string;
+    sharingKeyId: string;
+    credentialId: string;
+};
+export type VerifiedGoogleAccount = {
+    subject: string;
+    audience: string;
+    email?: string;
+};
+export declare function createBackendlessSharingAccountBinding(context: Omit<SharingAccountBindingContext, "credentialId">, options: {
+    credential(): Promise<{
+        credentialId: string;
+        credentialPublicKey: JsonWebKey;
+    }>;
+    requestGoogleIdToken(nonce: string): Promise<string>;
+    rpId: string;
+    timeoutMs?: number;
+    navigator?: Navigator;
+    crypto?: Crypto;
+}): Promise<SharingAccountBindingV1>;
+export declare function createSharingAccountBindingChallenge(context: SharingAccountBindingContext, cryptoImplementation?: Crypto): Promise<string>;
+export declare function createSharingAccountBindingV1(challenge: string, googleIdToken: string, passkey: SharingPasskeyAssertionV1): SharingAccountBindingV1;
+export declare function verifySharingAccountBindingV1(binding: SharingAccountBindingV1, context: SharingAccountBindingContext, options: {
+    googleAudience: string;
+    rpId: string;
+    allowedOrigins: string[];
+    requireUserVerification?: boolean;
+    fetch?: typeof fetch;
+    crypto?: Crypto;
+    now?: () => number;
+}): Promise<VerifiedGoogleAccount>;
+export declare function getSharingPasskeyAssertion(input: {
+    challenge: string;
+    rpId: string;
+    credentialId: string;
+    credentialPublicKey: JsonWebKey;
+    timeoutMs?: number;
+    navigator?: Navigator;
+}): Promise<SharingPasskeyAssertionV1>;
+export declare function verifyPasskeyAssertion(assertion: SharingPasskeyAssertionV1, options: {
+    challenge: string;
+    rpId: string;
+    allowedOrigins: string[];
+    requireUserVerification?: boolean;
+    crypto?: Crypto;
+}): Promise<void>;
+export declare function verifyGoogleIdToken(token: string, options: {
+    audience: string;
+    nonce: string;
+    fetch?: typeof fetch;
+    crypto?: Crypto;
+    now?: () => number;
+}): Promise<VerifiedGoogleAccount>;
+//# sourceMappingURL=account-binding.d.ts.map

package/dist/sharing/account-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-binding.d.ts","sourceRoot":"","sources":["../../src/sharing/account-binding.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,uBAAuB,EACvB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,4BAA4B,GAAG;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,sCAAsC,CAC1D,OAAO,EAAE,IAAI,CAAC,4BAA4B,EAAE,cAAc,CAAC,EAC3D,OAAO,EAAE;IACP,UAAU,IAAI,OAAO,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,UAAU,CAAC;KACjC,CAAC,CAAC;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,uBAAuB,CAAC,CAuBlC;AAED,wBAAsB,oCAAoC,CACxD,OAAO,EAAE,4BAA4B,EACrC,oBAAoB,GAAE,MAA0B,GAC/C,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,yBAAyB,GACjC,uBAAuB,CAczB;AAED,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,4BAA4B,EACrC,OAAO,EAAE;IACP,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,qBAAqB,CAAC,CA6BhC;AAED,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,UAAU,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,GACA,OAAO,CAAC,yBAAyB,CAAC,CAkDpC;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,yBAAyB,EACpC,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAoHf;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,qBAAqB,CAAC,CA4GhC"}

package/dist/sharing/account-binding.js

@@ -0,0 +1,305 @@
+import { SyncKitError } from "../core/errors.js";
+import { base64UrlToBytes, bytesToBase64Url } from "../crypto/base64url.js";
+import { canonicalAad } from "../crypto/canonical.js";
+import { copyBuffer } from "../crypto/runtime.js";
+const GOOGLE_CERTS = "https://www.googleapis.com/oauth2/v3/certs";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+export async function createBackendlessSharingAccountBinding(context, options) {
+    const credential = await options.credential();
+    const challenge = await createSharingAccountBindingChallenge({
+        ...context,
+        credentialId: credential.credentialId,
+    }, options.crypto ?? globalThis.crypto);
+    const passkey = await getSharingPasskeyAssertion({
+        challenge,
+        rpId: options.rpId,
+        credentialId: credential.credentialId,
+        credentialPublicKey: credential.credentialPublicKey,
+        ...(options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}),
+        ...(options.navigator ? { navigator: options.navigator } : {}),
+    });
+    const googleIdToken = await options.requestGoogleIdToken(challenge);
+    return createSharingAccountBindingV1(challenge, googleIdToken, passkey);
+}
+export async function createSharingAccountBindingChallenge(context, cryptoImplementation = globalThis.crypto) {
+    for (const [name, value] of Object.entries(context)) {
+        if (!value.trim())
+            throw new TypeError(`${name} must not be empty.`);
+    }
+    return bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.digest("SHA-256", copyBuffer(canonicalAad(context)))));
+}
+export function createSharingAccountBindingV1(challenge, googleIdToken, passkey) {
+    if (base64UrlToBytes(challenge).length !== 32) {
+        throw new TypeError("challenge must be a SHA-256 value.");
+    }
+    if (!googleIdToken.trim()) {
+        throw new TypeError("googleIdToken must not be empty.");
+    }
+    return {
+        schemaVersion: 1,
+        kind: "sync-kit-sharing-account-binding",
+        challenge,
+        googleIdToken,
+        passkey,
+    };
+}
+export async function verifySharingAccountBindingV1(binding, context, options) {
+    const cryptoImplementation = options.crypto ?? globalThis.crypto;
+    const expectedChallenge = await createSharingAccountBindingChallenge(context, cryptoImplementation);
+    if (binding.challenge !== expectedChallenge ||
+        binding.passkey.credentialId !== context.credentialId) {
+        throw new SyncKitError("authorization", "The account binding does not match this exchange and sharing key.");
+    }
+    await verifyPasskeyAssertion(binding.passkey, {
+        challenge: expectedChallenge,
+        rpId: options.rpId,
+        allowedOrigins: options.allowedOrigins,
+        requireUserVerification: options.requireUserVerification ?? true,
+        crypto: cryptoImplementation,
+    });
+    return verifyGoogleIdToken(binding.googleIdToken, {
+        audience: options.googleAudience,
+        nonce: expectedChallenge,
+        ...(options.fetch ? { fetch: options.fetch } : {}),
+        crypto: cryptoImplementation,
+        ...(options.now ? { now: options.now } : {}),
+    });
+}
+export async function getSharingPasskeyAssertion(input) {
+    const navigatorImplementation = input.navigator ??
+        (typeof navigator === "undefined" ? undefined : navigator);
+    if (!navigatorImplementation?.credentials) {
+        throw new SyncKitError("configuration", "WebAuthn credentials are unavailable.");
+    }
+    const credential = await navigatorImplementation.credentials.get({
+        publicKey: {
+            challenge: copyBuffer(base64UrlToBytes(input.challenge)),
+            rpId: input.rpId,
+            allowCredentials: [
+                {
+                    type: "public-key",
+                    id: copyBuffer(base64UrlToBytes(input.credentialId)),
+                },
+            ],
+            userVerification: "required",
+            timeout: input.timeoutMs ?? 60_000,
+        },
+    });
+    if (!credential ||
+        !("rawId" in credential) ||
+        !("response" in credential)) {
+        throw new SyncKitError("key", "The passkey assertion was cancelled.");
+    }
+    const publicKeyCredential = credential;
+    const response = publicKeyCredential.response;
+    return {
+        credentialId: bytesToBase64Url(new Uint8Array(publicKeyCredential.rawId)),
+        credentialPublicKey: input.credentialPublicKey,
+        authenticatorData: bytesToBase64Url(new Uint8Array(response.authenticatorData)),
+        clientDataJSON: bytesToBase64Url(new Uint8Array(response.clientDataJSON)),
+        signature: bytesToBase64Url(new Uint8Array(response.signature)),
+    };
+}
+export async function verifyPasskeyAssertion(assertion, options) {
+    const cryptoImplementation = options.crypto ?? globalThis.crypto;
+    const clientDataBytes = base64UrlToBytes(assertion.clientDataJSON);
+    let clientData;
+    try {
+        clientData = JSON.parse(decoder.decode(clientDataBytes));
+    }
+    catch (error) {
+        throw new SyncKitError("compatibility", "The WebAuthn client data is invalid.", { cause: error });
+    }
+    if (!clientData ||
+        typeof clientData !== "object" ||
+        Array.isArray(clientData)) {
+        throw new SyncKitError("compatibility", "The WebAuthn client data is malformed.");
+    }
+    const client = clientData;
+    if (client.type !== "webauthn.get" ||
+        client.challenge !== options.challenge ||
+        typeof client.origin !== "string" ||
+        !options.allowedOrigins.includes(client.origin)) {
+        throw new SyncKitError("authorization", "The WebAuthn assertion context is invalid.");
+    }
+    const authenticatorData = base64UrlToBytes(assertion.authenticatorData);
+    if (authenticatorData.length < 37) {
+        throw new SyncKitError("compatibility", "The WebAuthn authenticator data is truncated.");
+    }
+    const expectedRpHash = new Uint8Array(await cryptoImplementation.subtle.digest("SHA-256", copyBuffer(encoder.encode(options.rpId))));
+    if (!equalBytes(authenticatorData.slice(0, 32), expectedRpHash)) {
+        throw new SyncKitError("authorization", "The WebAuthn assertion belongs to another relying party.");
+    }
+    const flags = authenticatorData[32] ?? 0;
+    if ((flags & 0x01) === 0) {
+        throw new SyncKitError("authorization", "The WebAuthn assertion lacks user presence.");
+    }
+    if ((options.requireUserVerification ?? true) && (flags & 0x04) === 0) {
+        throw new SyncKitError("authorization", "The WebAuthn assertion lacks user verification.");
+    }
+    const clientDataHash = new Uint8Array(await cryptoImplementation.subtle.digest("SHA-256", copyBuffer(clientDataBytes)));
+    const signed = new Uint8Array(authenticatorData.length + clientDataHash.length);
+    signed.set(authenticatorData);
+    signed.set(clientDataHash, authenticatorData.length);
+    const publicKey = assertion.credentialPublicKey;
+    if (publicKey.kty !== "EC" ||
+        publicKey.crv !== "P-256" ||
+        !publicKey.x ||
+        !publicKey.y) {
+        throw new SyncKitError("compatibility", "The passkey public key must be an ES256 P-256 JWK.");
+    }
+    const imported = await cryptoImplementation.subtle.importKey("jwk", {
+        kty: "EC",
+        crv: "P-256",
+        x: publicKey.x,
+        y: publicKey.y,
+        ext: true,
+        key_ops: ["verify"],
+    }, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+    const valid = await cryptoImplementation.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, imported, copyBuffer(derEcdsaToP1363(base64UrlToBytes(assertion.signature), 32)), copyBuffer(signed));
+    if (!valid) {
+        throw new SyncKitError("authorization", "The WebAuthn assertion signature is invalid.");
+    }
+}
+export async function verifyGoogleIdToken(token, options) {
+    const cryptoImplementation = options.crypto ?? globalThis.crypto;
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+        throw new SyncKitError("compatibility", "The Google ID token is not a JWT.");
+    }
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    if (!encodedHeader || !encodedPayload || !encodedSignature) {
+        throw new SyncKitError("compatibility", "The Google ID token is incomplete.");
+    }
+    const header = parseJwtObject(encodedHeader, "header");
+    const claims = parseJwtObject(encodedPayload, "claims");
+    if (header.alg !== "RS256" ||
+        typeof header.kid !== "string" ||
+        !header.kid) {
+        throw new SyncKitError("compatibility", "The Google ID token algorithm is unsupported.");
+    }
+    const fetchImplementation = options.fetch ?? globalThis.fetch;
+    if (!fetchImplementation) {
+        throw new SyncKitError("configuration", "Fetch is required to verify Google identity tokens.");
+    }
+    const response = await fetchImplementation(GOOGLE_CERTS);
+    if (!response.ok) {
+        throw new SyncKitError("provider", `Google signing keys could not be loaded (${response.status}).`, { status: response.status });
+    }
+    const keySet = (await response.json());
+    const jwk = keySet.keys?.find((key) => key.kid === header.kid);
+    if (!jwk) {
+        throw new SyncKitError("authorization", "The Google ID token signing key is unknown.");
+    }
+    const key = await cryptoImplementation.subtle.importKey("jwk", { ...jwk, key_ops: ["verify"], ext: true }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    const valid = await cryptoImplementation.subtle.verify("RSASSA-PKCS1-v1_5", key, copyBuffer(base64UrlToBytes(encodedSignature)), copyBuffer(encoder.encode(`${encodedHeader}.${encodedPayload}`)));
+    if (!valid) {
+        throw new SyncKitError("authorization", "The Google ID token signature is invalid.");
+    }
+    const nowSeconds = Math.floor((options.now?.() ?? Date.now()) / 1_000);
+    const audiences = Array.isArray(claims.aud)
+        ? claims.aud
+        : [claims.aud];
+    if ((claims.iss !== "https://accounts.google.com" &&
+        claims.iss !== "accounts.google.com") ||
+        !audiences.includes(options.audience) ||
+        typeof claims.exp !== "number" ||
+        claims.exp <= nowSeconds ||
+        claims.nonce !== options.nonce ||
+        typeof claims.sub !== "string" ||
+        !claims.sub) {
+        throw new SyncKitError("authorization", "The Google ID token claims do not match this account binding.");
+    }
+    if (claims.email !== undefined &&
+        (typeof claims.email !== "string" ||
+            claims.email_verified !== true)) {
+        throw new SyncKitError("authorization", "The Google ID token email is not verified.");
+    }
+    return {
+        subject: claims.sub,
+        audience: options.audience,
+        ...(typeof claims.email === "string"
+            ? { email: claims.email }
+            : {}),
+    };
+}
+function parseJwtObject(encoded, label) {
+    try {
+        const value = JSON.parse(decoder.decode(base64UrlToBytes(encoded)));
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            throw new TypeError("not an object");
+        }
+        return value;
+    }
+    catch (error) {
+        throw new SyncKitError("compatibility", `The Google ID token ${label} is invalid.`, { cause: error });
+    }
+}
+function derEcdsaToP1363(der, width) {
+    let offset = 0;
+    if (der[offset++] !== 0x30)
+        throw invalidDer();
+    const sequenceLength = readDerLength(der, offset);
+    offset = sequenceLength.offset;
+    if (sequenceLength.length !== der.length - offset)
+        throw invalidDer();
+    if (der[offset++] !== 0x02)
+        throw invalidDer();
+    const rLength = readDerLength(der, offset);
+    offset = rLength.offset;
+    const r = der.slice(offset, offset + rLength.length);
+    offset += rLength.length;
+    if (der[offset++] !== 0x02)
+        throw invalidDer();
+    const sLength = readDerLength(der, offset);
+    offset = sLength.offset;
+    const s = der.slice(offset, offset + sLength.length);
+    offset += sLength.length;
+    if (offset !== der.length)
+        throw invalidDer();
+    const result = new Uint8Array(width * 2);
+    result.set(normalizeInteger(r, width), 0);
+    result.set(normalizeInteger(s, width), width);
+    return result;
+}
+function readDerLength(value, offset) {
+    const first = value[offset];
+    if (first === undefined)
+        throw invalidDer();
+    if ((first & 0x80) === 0)
+        return { length: first, offset: offset + 1 };
+    const bytes = first & 0x7f;
+    if (bytes === 0 || bytes > 2 || offset + bytes >= value.length) {
+        throw invalidDer();
+    }
+    let length = 0;
+    for (let index = 0; index < bytes; index += 1) {
+        length = (length << 8) | (value[offset + 1 + index] ?? 0);
+    }
+    return { length, offset: offset + 1 + bytes };
+}
+function normalizeInteger(value, width) {
+    let normalized = value;
+    while (normalized.length > 1 && normalized[0] === 0) {
+        normalized = normalized.slice(1);
+    }
+    if (normalized.length > width)
+        throw invalidDer();
+    const result = new Uint8Array(width);
+    result.set(normalized, width - normalized.length);
+    return result;
+}
+function invalidDer() {
+    return new SyncKitError("compatibility", "The WebAuthn ECDSA signature is malformed.");
+}
+function equalBytes(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1) {
+        difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+    }
+    return difference === 0;
+}
+//# sourceMappingURL=account-binding.js.map