@laceio/sdk 0.1.0 → 0.1.1-canary.0

package/dist/key-source-CcLTx8HK.js

@@ -0,0 +1,2761 @@
+import { Lt as utils } from "./Address-_c_-9hLC.js";
+import { E as toBytes$1, b as kdfInputToBytes, c as aexists, f as bytesToHex, l as ahash, m as clean, o as Hash, p as checkOpts, s as abytes, u as anumber, v as createView, y as hexToBytes } from "./_md-gbUqlhqd.js";
+import { n as sha512, t as sha256 } from "./sha2-c4sB6peD.js";
+//#region ../../node_modules/@noble/hashes/esm/hmac.js
+/**
+* HMAC: RFC2104 message authentication code.
+* @module
+*/
+var HMAC = class extends Hash {
+	constructor(hash, _key) {
+		super();
+		this.finished = false;
+		this.destroyed = false;
+		ahash(hash);
+		const key = toBytes$1(_key);
+		this.iHash = hash.create();
+		if (typeof this.iHash.update !== "function") throw new Error("Expected instance of class which extends utils.Hash");
+		this.blockLen = this.iHash.blockLen;
+		this.outputLen = this.iHash.outputLen;
+		const blockLen = this.blockLen;
+		const pad = new Uint8Array(blockLen);
+		pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
+		this.iHash.update(pad);
+		this.oHash = hash.create();
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 106;
+		this.oHash.update(pad);
+		clean(pad);
+	}
+	update(buf) {
+		aexists(this);
+		this.iHash.update(buf);
+		return this;
+	}
+	digestInto(out) {
+		aexists(this);
+		abytes(out, this.outputLen);
+		this.finished = true;
+		this.iHash.digestInto(out);
+		this.oHash.update(out);
+		this.oHash.digestInto(out);
+		this.destroy();
+	}
+	digest() {
+		const out = new Uint8Array(this.oHash.outputLen);
+		this.digestInto(out);
+		return out;
+	}
+	_cloneInto(to) {
+		to || (to = Object.create(Object.getPrototypeOf(this), {}));
+		const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+		to = to;
+		to.finished = finished;
+		to.destroyed = destroyed;
+		to.blockLen = blockLen;
+		to.outputLen = outputLen;
+		to.oHash = oHash._cloneInto(to.oHash);
+		to.iHash = iHash._cloneInto(to.iHash);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+	destroy() {
+		this.destroyed = true;
+		this.oHash.destroy();
+		this.iHash.destroy();
+	}
+};
+/**
+* HMAC: RFC2104 message authentication code.
+* @param hash - function that would be used e.g. sha256
+* @param key - message key
+* @param message - message data
+* @example
+* import { hmac } from '@noble/hashes/hmac';
+* import { sha256 } from '@noble/hashes/sha2';
+* const mac1 = hmac(sha256, 'key', 'message');
+*/
+const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
+hmac.create = (hash, key) => new HMAC(hash, key);
+//#endregion
+//#region ../../node_modules/@noble/hashes/esm/hkdf.js
+/**
+* HKDF (RFC 5869): extract + expand in one step.
+* See https://soatok.blog/2021/11/17/understanding-hkdf/.
+* @module
+*/
+/**
+* HKDF-extract from spec. Less important part. `HKDF-Extract(IKM, salt) -> PRK`
+* Arguments position differs from spec (IKM is first one, since it is not optional)
+* @param hash - hash function that would be used (e.g. sha256)
+* @param ikm - input keying material, the initial key
+* @param salt - optional salt value (a non-secret random value)
+*/
+function extract(hash, ikm, salt) {
+	ahash(hash);
+	if (salt === void 0) salt = new Uint8Array(hash.outputLen);
+	return hmac(hash, toBytes$1(salt), toBytes$1(ikm));
+}
+const HKDF_COUNTER = /* @__PURE__ */ Uint8Array.from([0]);
+const EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+/**
+* HKDF-expand from the spec. The most important part. `HKDF-Expand(PRK, info, L) -> OKM`
+* @param hash - hash function that would be used (e.g. sha256)
+* @param prk - a pseudorandom key of at least HashLen octets (usually, the output from the extract step)
+* @param info - optional context and application specific information (can be a zero-length string)
+* @param length - length of output keying material in bytes
+*/
+function expand(hash, prk, info, length = 32) {
+	ahash(hash);
+	anumber(length);
+	const olen = hash.outputLen;
+	if (length > 255 * olen) throw new Error("Length should be <= 255*HashLen");
+	const blocks = Math.ceil(length / olen);
+	if (info === void 0) info = EMPTY_BUFFER;
+	const okm = new Uint8Array(blocks * olen);
+	const HMAC = hmac.create(hash, prk);
+	const HMACTmp = HMAC._cloneInto();
+	const T = new Uint8Array(HMAC.outputLen);
+	for (let counter = 0; counter < blocks; counter++) {
+		HKDF_COUNTER[0] = counter + 1;
+		HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info).update(HKDF_COUNTER).digestInto(T);
+		okm.set(T, olen * counter);
+		HMAC._cloneInto(HMACTmp);
+	}
+	HMAC.destroy();
+	HMACTmp.destroy();
+	clean(T, HKDF_COUNTER);
+	return okm.slice(0, length);
+}
+/**
+* HKDF (RFC 5869): derive keys from an initial input.
+* Combines hkdf_extract + hkdf_expand in one step
+* @param hash - hash function that would be used (e.g. sha256)
+* @param ikm - input keying material, the initial key
+* @param salt - optional salt value (a non-secret random value)
+* @param info - optional context and application specific information (can be a zero-length string)
+* @param length - length of output keying material in bytes
+* @example
+* import { hkdf } from '@noble/hashes/hkdf';
+* import { sha256 } from '@noble/hashes/sha2';
+* import { randomBytes } from '@noble/hashes/utils';
+* const inputKey = randomBytes(32);
+* const salt = randomBytes(32);
+* const info = 'application-key';
+* const hk1 = hkdf(sha256, inputKey, salt, info, 32);
+*/
+const hkdf = (hash, ikm, salt, info, length) => expand(hash, extract(hash, ikm, salt), info, length);
+//#endregion
+//#region ../../packages/lib/crypto/src/value-objects/entropy-hex.vo.ts
+const ENTROPY_BYTE_LENGTH = 32;
+const ENTROPY_HEX_LENGTH = ENTROPY_BYTE_LENGTH * 2;
+const HEX_PATTERN = /^[0-9a-fA-F]+$/;
+/**
+* Types 32 bytes of entropy, as 64 hex characters, for `Mnemonic.deriveFrom`.
+* Throws when the value has another length or is not hex.
+*/
+const EntropyHex = (value) => {
+	if (value.length !== ENTROPY_HEX_LENGTH) throw new Error(`EntropyHex must be ${ENTROPY_BYTE_LENGTH} bytes (${ENTROPY_HEX_LENGTH} hex characters), got ${value.length}`);
+	if (!HEX_PATTERN.test(value)) throw new Error("EntropyHex must be a hex-encoded string");
+	return value;
+};
+//#endregion
+//#region ../../node_modules/@noble/hashes/esm/pbkdf2.js
+/**
+* PBKDF (RFC 2898). Can be used to create a key from password and salt.
+* @module
+*/
+function pbkdf2Init(hash, _password, _salt, _opts) {
+	ahash(hash);
+	const { c, dkLen, asyncTick } = checkOpts({
+		dkLen: 32,
+		asyncTick: 10
+	}, _opts);
+	anumber(c);
+	anumber(dkLen);
+	anumber(asyncTick);
+	if (c < 1) throw new Error("iterations (c) should be >= 1");
+	const password = kdfInputToBytes(_password);
+	const salt = kdfInputToBytes(_salt);
+	const DK = new Uint8Array(dkLen);
+	const PRF = hmac.create(hash, password);
+	return {
+		c,
+		dkLen,
+		asyncTick,
+		DK,
+		PRF,
+		PRFSalt: PRF._cloneInto().update(salt)
+	};
+}
+function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
+	PRF.destroy();
+	PRFSalt.destroy();
+	if (prfW) prfW.destroy();
+	clean(u);
+	return DK;
+}
+/**
+* PBKDF2-HMAC: RFC 2898 key derivation function
+* @param hash - hash function that would be used e.g. sha256
+* @param password - password from which a derived key is generated
+* @param salt - cryptographic salt
+* @param opts - {c, dkLen} where c is work factor and dkLen is output message size
+* @example
+* const key = pbkdf2(sha256, 'password', 'salt', { dkLen: 32, c: Math.pow(2, 18) });
+*/
+function pbkdf2(hash, password, salt, opts) {
+	const { c, dkLen, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
+	let prfW;
+	const arr = new Uint8Array(4);
+	const view = createView(arr);
+	const u = new Uint8Array(PRF.outputLen);
+	for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
+		const Ti = DK.subarray(pos, pos + PRF.outputLen);
+		view.setInt32(0, ti, false);
+		(prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
+		Ti.set(u.subarray(0, Ti.length));
+		for (let ui = 1; ui < c; ui++) {
+			PRF._cloneInto(prfW).update(u).digestInto(u);
+			for (let i = 0; i < Ti.length; i++) Ti[i] ^= u[i];
+		}
+	}
+	return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
+}
+//#endregion
+//#region ../../packages/lib/crypto/node_modules/@scure/bip39/esm/index.js
+/**
+* Audited & minimal JS implementation of
+* [BIP39 mnemonic phrases](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
+* @module
+* @example
+```js
+import * as bip39 from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english';
+const mn = bip39.generateMnemonic(wordlist);
+console.log(mn);
+const ent = bip39.mnemonicToEntropy(mn, wordlist)
+bip39.entropyToMnemonic(ent, wordlist);
+bip39.validateMnemonic(mn, wordlist);
+await bip39.mnemonicToSeed(mn, 'password');
+bip39.mnemonicToSeedSync(mn, 'password');
+
+// Wordlists
+import { wordlist as czech } from '@scure/bip39/wordlists/czech';
+import { wordlist as english } from '@scure/bip39/wordlists/english';
+import { wordlist as french } from '@scure/bip39/wordlists/french';
+import { wordlist as italian } from '@scure/bip39/wordlists/italian';
+import { wordlist as japanese } from '@scure/bip39/wordlists/japanese';
+import { wordlist as korean } from '@scure/bip39/wordlists/korean';
+import { wordlist as portuguese } from '@scure/bip39/wordlists/portuguese';
+import { wordlist as simplifiedChinese } from '@scure/bip39/wordlists/simplified-chinese';
+import { wordlist as spanish } from '@scure/bip39/wordlists/spanish';
+import { wordlist as traditionalChinese } from '@scure/bip39/wordlists/traditional-chinese';
+```
+*/
+/*! scure-bip39 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) */
+const isJapanese = (wordlist) => wordlist[0] === "あいこくしん";
+function nfkd(str) {
+	if (typeof str !== "string") throw new TypeError("invalid mnemonic type: " + typeof str);
+	return str.normalize("NFKD");
+}
+function normalize(str) {
+	const norm = nfkd(str);
+	const words = norm.split(" ");
+	if (![
+		12,
+		15,
+		18,
+		21,
+		24
+	].includes(words.length)) throw new Error("Invalid mnemonic");
+	return {
+		nfkd: norm,
+		words
+	};
+}
+function aentropy(ent) {
+	abytes(ent, 16, 20, 24, 28, 32);
+}
+const calcChecksum = (entropy) => {
+	const bitsLeft = 8 - entropy.length / 4;
+	return new Uint8Array([sha256(entropy)[0] >> bitsLeft << bitsLeft]);
+};
+function getCoder(wordlist) {
+	if (!Array.isArray(wordlist) || wordlist.length !== 2048 || typeof wordlist[0] !== "string") throw new Error("Wordlist: expected array of 2048 strings");
+	wordlist.forEach((i) => {
+		if (typeof i !== "string") throw new Error("wordlist: non-string element: " + i);
+	});
+	return utils.chain(utils.checksum(1, calcChecksum), utils.radix2(11, true), utils.alphabet(wordlist));
+}
+/**
+* Reversible: Converts raw entropy in form of byte array to mnemonic string.
+* @param entropy byte array
+* @param wordlist imported wordlist for specific language
+* @returns 12-24 words
+* @example
+* const ent = new Uint8Array([
+*   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f,
+*   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f
+* ]);
+* entropyToMnemonic(ent, wordlist);
+* // 'legal winner thank year wave sausage worth useful legal winner thank yellow'
+*/
+function entropyToMnemonic(entropy, wordlist) {
+	aentropy(entropy);
+	return getCoder(wordlist).encode(entropy).join(isJapanese(wordlist) ? "　" : " ");
+}
+const psalt = (passphrase) => nfkd("mnemonic" + passphrase);
+/**
+* Irreversible: Uses KDF to derive 64 bytes of key data from mnemonic + optional password.
+* @param mnemonic 12-24 words
+* @param passphrase string that will additionally protect the key
+* @returns 64 bytes of key data
+* @example
+* const mnem = 'legal winner thank year wave sausage worth useful legal winner thank yellow';
+* mnemonicToSeedSync(mnem, 'password');
+* // new Uint8Array([...64 bytes])
+*/
+function mnemonicToSeedSync(mnemonic, passphrase = "") {
+	return pbkdf2(sha512, normalize(mnemonic).nfkd, psalt(passphrase), {
+		c: 2048,
+		dkLen: 64
+	});
+}
+//#endregion
+//#region ../../node_modules/@scure/bip39/wordlists/english.js
+/** English BIP39 wordlist. */
+const wordlist = /* @__PURE__ */ Object.freeze(`abandon
+ability
+able
+about
+above
+absent
+absorb
+abstract
+absurd
+abuse
+access
+accident
+account
+accuse
+achieve
+acid
+acoustic
+acquire
+across
+act
+action
+actor
+actress
+actual
+adapt
+add
+addict
+address
+adjust
+admit
+adult
+advance
+advice
+aerobic
+affair
+afford
+afraid
+again
+age
+agent
+agree
+ahead
+aim
+air
+airport
+aisle
+alarm
+album
+alcohol
+alert
+alien
+all
+alley
+allow
+almost
+alone
+alpha
+already
+also
+alter
+always
+amateur
+amazing
+among
+amount
+amused
+analyst
+anchor
+ancient
+anger
+angle
+angry
+animal
+ankle
+announce
+annual
+another
+answer
+antenna
+antique
+anxiety
+any
+apart
+apology
+appear
+apple
+approve
+april
+arch
+arctic
+area
+arena
+argue
+arm
+armed
+armor
+army
+around
+arrange
+arrest
+arrive
+arrow
+art
+artefact
+artist
+artwork
+ask
+aspect
+assault
+asset
+assist
+assume
+asthma
+athlete
+atom
+attack
+attend
+attitude
+attract
+auction
+audit
+august
+aunt
+author
+auto
+autumn
+average
+avocado
+avoid
+awake
+aware
+away
+awesome
+awful
+awkward
+axis
+baby
+bachelor
+bacon
+badge
+bag
+balance
+balcony
+ball
+bamboo
+banana
+banner
+bar
+barely
+bargain
+barrel
+base
+basic
+basket
+battle
+beach
+bean
+beauty
+because
+become
+beef
+before
+begin
+behave
+behind
+believe
+below
+belt
+bench
+benefit
+best
+betray
+better
+between
+beyond
+bicycle
+bid
+bike
+bind
+biology
+bird
+birth
+bitter
+black
+blade
+blame
+blanket
+blast
+bleak
+bless
+blind
+blood
+blossom
+blouse
+blue
+blur
+blush
+board
+boat
+body
+boil
+bomb
+bone
+bonus
+book
+boost
+border
+boring
+borrow
+boss
+bottom
+bounce
+box
+boy
+bracket
+brain
+brand
+brass
+brave
+bread
+breeze
+brick
+bridge
+brief
+bright
+bring
+brisk
+broccoli
+broken
+bronze
+broom
+brother
+brown
+brush
+bubble
+buddy
+budget
+buffalo
+build
+bulb
+bulk
+bullet
+bundle
+bunker
+burden
+burger
+burst
+bus
+business
+busy
+butter
+buyer
+buzz
+cabbage
+cabin
+cable
+cactus
+cage
+cake
+call
+calm
+camera
+camp
+can
+canal
+cancel
+candy
+cannon
+canoe
+canvas
+canyon
+capable
+capital
+captain
+car
+carbon
+card
+cargo
+carpet
+carry
+cart
+case
+cash
+casino
+castle
+casual
+cat
+catalog
+catch
+category
+cattle
+caught
+cause
+caution
+cave
+ceiling
+celery
+cement
+census
+century
+cereal
+certain
+chair
+chalk
+champion
+change
+chaos
+chapter
+charge
+chase
+chat
+cheap
+check
+cheese
+chef
+cherry
+chest
+chicken
+chief
+child
+chimney
+choice
+choose
+chronic
+chuckle
+chunk
+churn
+cigar
+cinnamon
+circle
+citizen
+city
+civil
+claim
+clap
+clarify
+claw
+clay
+clean
+clerk
+clever
+click
+client
+cliff
+climb
+clinic
+clip
+clock
+clog
+close
+cloth
+cloud
+clown
+club
+clump
+cluster
+clutch
+coach
+coast
+coconut
+code
+coffee
+coil
+coin
+collect
+color
+column
+combine
+come
+comfort
+comic
+common
+company
+concert
+conduct
+confirm
+congress
+connect
+consider
+control
+convince
+cook
+cool
+copper
+copy
+coral
+core
+corn
+correct
+cost
+cotton
+couch
+country
+couple
+course
+cousin
+cover
+coyote
+crack
+cradle
+craft
+cram
+crane
+crash
+crater
+crawl
+crazy
+cream
+credit
+creek
+crew
+cricket
+crime
+crisp
+critic
+crop
+cross
+crouch
+crowd
+crucial
+cruel
+cruise
+crumble
+crunch
+crush
+cry
+crystal
+cube
+culture
+cup
+cupboard
+curious
+current
+curtain
+curve
+cushion
+custom
+cute
+cycle
+dad
+damage
+damp
+dance
+danger
+daring
+dash
+daughter
+dawn
+day
+deal
+debate
+debris
+decade
+december
+decide
+decline
+decorate
+decrease
+deer
+defense
+define
+defy
+degree
+delay
+deliver
+demand
+demise
+denial
+dentist
+deny
+depart
+depend
+deposit
+depth
+deputy
+derive
+describe
+desert
+design
+desk
+despair
+destroy
+detail
+detect
+develop
+device
+devote
+diagram
+dial
+diamond
+diary
+dice
+diesel
+diet
+differ
+digital
+dignity
+dilemma
+dinner
+dinosaur
+direct
+dirt
+disagree
+discover
+disease
+dish
+dismiss
+disorder
+display
+distance
+divert
+divide
+divorce
+dizzy
+doctor
+document
+dog
+doll
+dolphin
+domain
+donate
+donkey
+donor
+door
+dose
+double
+dove
+draft
+dragon
+drama
+drastic
+draw
+dream
+dress
+drift
+drill
+drink
+drip
+drive
+drop
+drum
+dry
+duck
+dumb
+dune
+during
+dust
+dutch
+duty
+dwarf
+dynamic
+eager
+eagle
+early
+earn
+earth
+easily
+east
+easy
+echo
+ecology
+economy
+edge
+edit
+educate
+effort
+egg
+eight
+either
+elbow
+elder
+electric
+elegant
+element
+elephant
+elevator
+elite
+else
+embark
+embody
+embrace
+emerge
+emotion
+employ
+empower
+empty
+enable
+enact
+end
+endless
+endorse
+enemy
+energy
+enforce
+engage
+engine
+enhance
+enjoy
+enlist
+enough
+enrich
+enroll
+ensure
+enter
+entire
+entry
+envelope
+episode
+equal
+equip
+era
+erase
+erode
+erosion
+error
+erupt
+escape
+essay
+essence
+estate
+eternal
+ethics
+evidence
+evil
+evoke
+evolve
+exact
+example
+excess
+exchange
+excite
+exclude
+excuse
+execute
+exercise
+exhaust
+exhibit
+exile
+exist
+exit
+exotic
+expand
+expect
+expire
+explain
+expose
+express
+extend
+extra
+eye
+eyebrow
+fabric
+face
+faculty
+fade
+faint
+faith
+fall
+false
+fame
+family
+famous
+fan
+fancy
+fantasy
+farm
+fashion
+fat
+fatal
+father
+fatigue
+fault
+favorite
+feature
+february
+federal
+fee
+feed
+feel
+female
+fence
+festival
+fetch
+fever
+few
+fiber
+fiction
+field
+figure
+file
+film
+filter
+final
+find
+fine
+finger
+finish
+fire
+firm
+first
+fiscal
+fish
+fit
+fitness
+fix
+flag
+flame
+flash
+flat
+flavor
+flee
+flight
+flip
+float
+flock
+floor
+flower
+fluid
+flush
+fly
+foam
+focus
+fog
+foil
+fold
+follow
+food
+foot
+force
+forest
+forget
+fork
+fortune
+forum
+forward
+fossil
+foster
+found
+fox
+fragile
+frame
+frequent
+fresh
+friend
+fringe
+frog
+front
+frost
+frown
+frozen
+fruit
+fuel
+fun
+funny
+furnace
+fury
+future
+gadget
+gain
+galaxy
+gallery
+game
+gap
+garage
+garbage
+garden
+garlic
+garment
+gas
+gasp
+gate
+gather
+gauge
+gaze
+general
+genius
+genre
+gentle
+genuine
+gesture
+ghost
+giant
+gift
+giggle
+ginger
+giraffe
+girl
+give
+glad
+glance
+glare
+glass
+glide
+glimpse
+globe
+gloom
+glory
+glove
+glow
+glue
+goat
+goddess
+gold
+good
+goose
+gorilla
+gospel
+gossip
+govern
+gown
+grab
+grace
+grain
+grant
+grape
+grass
+gravity
+great
+green
+grid
+grief
+grit
+grocery
+group
+grow
+grunt
+guard
+guess
+guide
+guilt
+guitar
+gun
+gym
+habit
+hair
+half
+hammer
+hamster
+hand
+happy
+harbor
+hard
+harsh
+harvest
+hat
+have
+hawk
+hazard
+head
+health
+heart
+heavy
+hedgehog
+height
+hello
+helmet
+help
+hen
+hero
+hidden
+high
+hill
+hint
+hip
+hire
+history
+hobby
+hockey
+hold
+hole
+holiday
+hollow
+home
+honey
+hood
+hope
+horn
+horror
+horse
+hospital
+host
+hotel
+hour
+hover
+hub
+huge
+human
+humble
+humor
+hundred
+hungry
+hunt
+hurdle
+hurry
+hurt
+husband
+hybrid
+ice
+icon
+idea
+identify
+idle
+ignore
+ill
+illegal
+illness
+image
+imitate
+immense
+immune
+impact
+impose
+improve
+impulse
+inch
+include
+income
+increase
+index
+indicate
+indoor
+industry
+infant
+inflict
+inform
+inhale
+inherit
+initial
+inject
+injury
+inmate
+inner
+innocent
+input
+inquiry
+insane
+insect
+inside
+inspire
+install
+intact
+interest
+into
+invest
+invite
+involve
+iron
+island
+isolate
+issue
+item
+ivory
+jacket
+jaguar
+jar
+jazz
+jealous
+jeans
+jelly
+jewel
+job
+join
+joke
+journey
+joy
+judge
+juice
+jump
+jungle
+junior
+junk
+just
+kangaroo
+keen
+keep
+ketchup
+key
+kick
+kid
+kidney
+kind
+kingdom
+kiss
+kit
+kitchen
+kite
+kitten
+kiwi
+knee
+knife
+knock
+know
+lab
+label
+labor
+ladder
+lady
+lake
+lamp
+language
+laptop
+large
+later
+latin
+laugh
+laundry
+lava
+law
+lawn
+lawsuit
+layer
+lazy
+leader
+leaf
+learn
+leave
+lecture
+left
+leg
+legal
+legend
+leisure
+lemon
+lend
+length
+lens
+leopard
+lesson
+letter
+level
+liar
+liberty
+library
+license
+life
+lift
+light
+like
+limb
+limit
+link
+lion
+liquid
+list
+little
+live
+lizard
+load
+loan
+lobster
+local
+lock
+logic
+lonely
+long
+loop
+lottery
+loud
+lounge
+love
+loyal
+lucky
+luggage
+lumber
+lunar
+lunch
+luxury
+lyrics
+machine
+mad
+magic
+magnet
+maid
+mail
+main
+major
+make
+mammal
+man
+manage
+mandate
+mango
+mansion
+manual
+maple
+marble
+march
+margin
+marine
+market
+marriage
+mask
+mass
+master
+match
+material
+math
+matrix
+matter
+maximum
+maze
+meadow
+mean
+measure
+meat
+mechanic
+medal
+media
+melody
+melt
+member
+memory
+mention
+menu
+mercy
+merge
+merit
+merry
+mesh
+message
+metal
+method
+middle
+midnight
+milk
+million
+mimic
+mind
+minimum
+minor
+minute
+miracle
+mirror
+misery
+miss
+mistake
+mix
+mixed
+mixture
+mobile
+model
+modify
+mom
+moment
+monitor
+monkey
+monster
+month
+moon
+moral
+more
+morning
+mosquito
+mother
+motion
+motor
+mountain
+mouse
+move
+movie
+much
+muffin
+mule
+multiply
+muscle
+museum
+mushroom
+music
+must
+mutual
+myself
+mystery
+myth
+naive
+name
+napkin
+narrow
+nasty
+nation
+nature
+near
+neck
+need
+negative
+neglect
+neither
+nephew
+nerve
+nest
+net
+network
+neutral
+never
+news
+next
+nice
+night
+noble
+noise
+nominee
+noodle
+normal
+north
+nose
+notable
+note
+nothing
+notice
+novel
+now
+nuclear
+number
+nurse
+nut
+oak
+obey
+object
+oblige
+obscure
+observe
+obtain
+obvious
+occur
+ocean
+october
+odor
+off
+offer
+office
+often
+oil
+okay
+old
+olive
+olympic
+omit
+once
+one
+onion
+online
+only
+open
+opera
+opinion
+oppose
+option
+orange
+orbit
+orchard
+order
+ordinary
+organ
+orient
+original
+orphan
+ostrich
+other
+outdoor
+outer
+output
+outside
+oval
+oven
+over
+own
+owner
+oxygen
+oyster
+ozone
+pact
+paddle
+page
+pair
+palace
+palm
+panda
+panel
+panic
+panther
+paper
+parade
+parent
+park
+parrot
+party
+pass
+patch
+path
+patient
+patrol
+pattern
+pause
+pave
+payment
+peace
+peanut
+pear
+peasant
+pelican
+pen
+penalty
+pencil
+people
+pepper
+perfect
+permit
+person
+pet
+phone
+photo
+phrase
+physical
+piano
+picnic
+picture
+piece
+pig
+pigeon
+pill
+pilot
+pink
+pioneer
+pipe
+pistol
+pitch
+pizza
+place
+planet
+plastic
+plate
+play
+please
+pledge
+pluck
+plug
+plunge
+poem
+poet
+point
+polar
+pole
+police
+pond
+pony
+pool
+popular
+portion
+position
+possible
+post
+potato
+pottery
+poverty
+powder
+power
+practice
+praise
+predict
+prefer
+prepare
+present
+pretty
+prevent
+price
+pride
+primary
+print
+priority
+prison
+private
+prize
+problem
+process
+produce
+profit
+program
+project
+promote
+proof
+property
+prosper
+protect
+proud
+provide
+public
+pudding
+pull
+pulp
+pulse
+pumpkin
+punch
+pupil
+puppy
+purchase
+purity
+purpose
+purse
+push
+put
+puzzle
+pyramid
+quality
+quantum
+quarter
+question
+quick
+quit
+quiz
+quote
+rabbit
+raccoon
+race
+rack
+radar
+radio
+rail
+rain
+raise
+rally
+ramp
+ranch
+random
+range
+rapid
+rare
+rate
+rather
+raven
+raw
+razor
+ready
+real
+reason
+rebel
+rebuild
+recall
+receive
+recipe
+record
+recycle
+reduce
+reflect
+reform
+refuse
+region
+regret
+regular
+reject
+relax
+release
+relief
+rely
+remain
+remember
+remind
+remove
+render
+renew
+rent
+reopen
+repair
+repeat
+replace
+report
+require
+rescue
+resemble
+resist
+resource
+response
+result
+retire
+retreat
+return
+reunion
+reveal
+review
+reward
+rhythm
+rib
+ribbon
+rice
+rich
+ride
+ridge
+rifle
+right
+rigid
+ring
+riot
+ripple
+risk
+ritual
+rival
+river
+road
+roast
+robot
+robust
+rocket
+romance
+roof
+rookie
+room
+rose
+rotate
+rough
+round
+route
+royal
+rubber
+rude
+rug
+rule
+run
+runway
+rural
+sad
+saddle
+sadness
+safe
+sail
+salad
+salmon
+salon
+salt
+salute
+same
+sample
+sand
+satisfy
+satoshi
+sauce
+sausage
+save
+say
+scale
+scan
+scare
+scatter
+scene
+scheme
+school
+science
+scissors
+scorpion
+scout
+scrap
+screen
+script
+scrub
+sea
+search
+season
+seat
+second
+secret
+section
+security
+seed
+seek
+segment
+select
+sell
+seminar
+senior
+sense
+sentence
+series
+service
+session
+settle
+setup
+seven
+shadow
+shaft
+shallow
+share
+shed
+shell
+sheriff
+shield
+shift
+shine
+ship
+shiver
+shock
+shoe
+shoot
+shop
+short
+shoulder
+shove
+shrimp
+shrug
+shuffle
+shy
+sibling
+sick
+side
+siege
+sight
+sign
+silent
+silk
+silly
+silver
+similar
+simple
+since
+sing
+siren
+sister
+situate
+six
+size
+skate
+sketch
+ski
+skill
+skin
+skirt
+skull
+slab
+slam
+sleep
+slender
+slice
+slide
+slight
+slim
+slogan
+slot
+slow
+slush
+small
+smart
+smile
+smoke
+smooth
+snack
+snake
+snap
+sniff
+snow
+soap
+soccer
+social
+sock
+soda
+soft
+solar
+soldier
+solid
+solution
+solve
+someone
+song
+soon
+sorry
+sort
+soul
+sound
+soup
+source
+south
+space
+spare
+spatial
+spawn
+speak
+special
+speed
+spell
+spend
+sphere
+spice
+spider
+spike
+spin
+spirit
+split
+spoil
+sponsor
+spoon
+sport
+spot
+spray
+spread
+spring
+spy
+square
+squeeze
+squirrel
+stable
+stadium
+staff
+stage
+stairs
+stamp
+stand
+start
+state
+stay
+steak
+steel
+stem
+step
+stereo
+stick
+still
+sting
+stock
+stomach
+stone
+stool
+story
+stove
+strategy
+street
+strike
+strong
+struggle
+student
+stuff
+stumble
+style
+subject
+submit
+subway
+success
+such
+sudden
+suffer
+sugar
+suggest
+suit
+summer
+sun
+sunny
+sunset
+super
+supply
+supreme
+sure
+surface
+surge
+surprise
+surround
+survey
+suspect
+sustain
+swallow
+swamp
+swap
+swarm
+swear
+sweet
+swift
+swim
+swing
+switch
+sword
+symbol
+symptom
+syrup
+system
+table
+tackle
+tag
+tail
+talent
+talk
+tank
+tape
+target
+task
+taste
+tattoo
+taxi
+teach
+team
+tell
+ten
+tenant
+tennis
+tent
+term
+test
+text
+thank
+that
+theme
+then
+theory
+there
+they
+thing
+this
+thought
+three
+thrive
+throw
+thumb
+thunder
+ticket
+tide
+tiger
+tilt
+timber
+time
+tiny
+tip
+tired
+tissue
+title
+toast
+tobacco
+today
+toddler
+toe
+together
+toilet
+token
+tomato
+tomorrow
+tone
+tongue
+tonight
+tool
+tooth
+top
+topic
+topple
+torch
+tornado
+tortoise
+toss
+total
+tourist
+toward
+tower
+town
+toy
+track
+trade
+traffic
+tragic
+train
+transfer
+trap
+trash
+travel
+tray
+treat
+tree
+trend
+trial
+tribe
+trick
+trigger
+trim
+trip
+trophy
+trouble
+truck
+true
+truly
+trumpet
+trust
+truth
+try
+tube
+tuition
+tumble
+tuna
+tunnel
+turkey
+turn
+turtle
+twelve
+twenty
+twice
+twin
+twist
+two
+type
+typical
+ugly
+umbrella
+unable
+unaware
+uncle
+uncover
+under
+undo
+unfair
+unfold
+unhappy
+uniform
+unique
+unit
+universe
+unknown
+unlock
+until
+unusual
+unveil
+update
+upgrade
+uphold
+upon
+upper
+upset
+urban
+urge
+usage
+use
+used
+useful
+useless
+usual
+utility
+vacant
+vacuum
+vague
+valid
+valley
+valve
+van
+vanish
+vapor
+various
+vast
+vault
+vehicle
+velvet
+vendor
+venture
+venue
+verb
+verify
+version
+very
+vessel
+veteran
+viable
+vibrant
+vicious
+victory
+video
+view
+village
+vintage
+violin
+virtual
+virus
+visa
+visit
+visual
+vital
+vivid
+vocal
+voice
+void
+volcano
+volume
+vote
+voyage
+wage
+wagon
+wait
+walk
+wall
+walnut
+want
+warfare
+warm
+warrior
+wash
+wasp
+waste
+water
+wave
+way
+wealth
+weapon
+wear
+weasel
+weather
+web
+wedding
+weekend
+weird
+welcome
+west
+wet
+whale
+what
+wheat
+wheel
+when
+where
+whip
+whisper
+wide
+width
+wife
+wild
+will
+win
+window
+wine
+wing
+wink
+winner
+winter
+wire
+wisdom
+wise
+wish
+witness
+wolf
+woman
+wonder
+wood
+wool
+word
+work
+world
+worry
+worth
+wrap
+wreck
+wrestle
+wrist
+write
+wrong
+yard
+year
+yellow
+you
+young
+youth
+zebra
+zero
+zone
+zoo`.split("\n"));
+//#endregion
+//#region ../../packages/lib/crypto/src/value-objects/mnemonic.vo.ts
+/**
+* Types a list of words as a BIP-39 mnemonic; it checks nothing.
+* `Mnemonic.deriveFrom(entropy)` derives 24 words from 32 bytes of entropy,
+* and `Mnemonic.toSeed(words)` gives their BIP-39 seed.
+*/
+const Mnemonic = (words) => words;
+/**
+* Derives a 24-word BIP39 mnemonic from 32 bytes of hex-encoded entropy.
+* Uses HKDF for domain separation, so the raw entropy is never used
+* directly as seed material. The entropy bytes and the expanded key are zeroed once the
+* words exist; the words themselves are strings and cannot be.
+*/
+Mnemonic.deriveFrom = (entropyHex) => {
+	const rawKey = hexToBytes(entropyHex);
+	const derived = hkdf(sha256, rawKey, "lace", "wallet-seed", 32);
+	try {
+		return Mnemonic(entropyToMnemonic(derived, wordlist).split(" "));
+	} finally {
+		rawKey.fill(0);
+		derived.fill(0);
+	}
+};
+/**
+* The 64-byte BIP39 seed of the mnemonic with an empty passphrase: the seed
+* that wallets deriving their keys from the BIP39 seed consume, so secrets
+* derived from it match what such a wallet built from the same words would
+* derive. The caller owns the bytes and zeroes them after use.
+*/
+Mnemonic.toSeed = (words) => mnemonicToSeedSync(words.join(" "));
+//#endregion
+//#region ../../packages/lib/passkey/src/constants.ts
+/** The label of the first PRF salt, whose output is the device secret. */
+const PRF_SALT_AUTHORISER_LABEL = "lace-passport/prf/authoriser/v1";
+/** The label of the second PRF salt, whose output is the root every named derivation starts from. */
+const PRF_SALT_ROOT_LABEL = "lace/prf/root/v1";
+/** The HKDF info label under which the record sealing key derives from the root. */
+const HKDF_RECORD_KEY_INFO = "lace-passport/hkdf/record-key/v1";
+/** The HKDF info label under which the wallet entropy, and from it the recovery words, derives from the root. */
+const HKDF_WALLET_ENTROPY_INFO = "lace/hkdf/wallet-entropy/v1";
+//#endregion
+//#region ../../packages/lib/passkey/src/errors.ts
+/** The user dismissed a WebAuthn ceremony. */
+var PasskeyCeremonyCancelledError = class extends Error {
+	code = "ceremony-cancelled";
+	constructor() {
+		super("The passkey ceremony was cancelled.");
+		this.name = "PasskeyCeremonyCancelledError";
+	}
+};
+/** The authenticator did not supply both PRF outputs. */
+var PasskeyPrfUnsupportedError = class extends Error {
+	code = "prf-unsupported";
+	constructor() {
+		super("The platform authenticator does not support the PRF extension.");
+		this.name = "PasskeyPrfUnsupportedError";
+	}
+};
+/** The selected credential differs from the imported wallet credential. */
+var PasskeyCredentialMismatchError = class extends Error {
+	code = "credential-mismatch";
+	constructor() {
+		super("The selected passkey does not match the wallet credential.");
+		this.name = "PasskeyCredentialMismatchError";
+	}
+};
+/**
+* The browser refused to open the signer popup (`popup-blocked`); it must be
+* opened inside a user gesture.
+*/
+var SignerPopupBlockedError = class extends Error {
+	code = "popup-blocked";
+	constructor() {
+		super("The browser blocked the signer popup.");
+		this.name = "SignerPopupBlockedError";
+	}
+};
+/**
+* The signer answered a request with a failure; `code` is the code it
+* reported, such as `ceremony-cancelled` when the user rejects the request
+* or `malformed-request` when the signer cannot describe it for consent,
+* and `details` the values it declared alongside, when any. Both come from
+* the signer page, so a reader validates `details` before acting on it.
+*/
+var RemoteSignerError = class extends Error {
+	code;
+	details;
+	constructor(code, message, details) {
+		super(message);
+		this.code = code;
+		this.details = details;
+		this.name = "RemoteSignerError";
+	}
+};
+/**
+* The signer popup closed, as when the user closes the window, while requests
+* were still pending (`ceremony-cancelled`).
+*/
+var SignerClosedError = class extends Error {
+	code = "ceremony-cancelled";
+	constructor() {
+		super("The signer popup was closed.");
+		this.name = "SignerClosedError";
+	}
+};
+//#endregion
+//#region ../../packages/lib/passkey/src/ceremony.ts
+const DEFAULT_RP_NAME = "Lace";
+const CHALLENGE_LENGTH = 32;
+const USER_ID_LENGTH = 16;
+const WALLET_ENTROPY_LENGTH = 32;
+const MAX_CREDENTIAL_ID_LENGTH = 1023;
+const ES256 = -7;
+const RS256 = -257;
+const RECIPE_VERSION = "v1";
+const encodeId = (id) => btoa(String.fromCharCode(...new Uint8Array(id))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+const decodeId = (id) => {
+	if (!/^[A-Za-z0-9_-]+$/.test(id) || id.length > Math.ceil(MAX_CREDENTIAL_ID_LENGTH * 4 / 3)) throw new Error("Invalid passkey credential ID.");
+	let bytes;
+	try {
+		bytes = Uint8Array.from(atob(id.replaceAll("-", "+").replaceAll("_", "/")), (character) => character.charCodeAt(0));
+	} catch {
+		throw new Error("Invalid passkey credential ID.");
+	}
+	if (bytes.length > MAX_CREDENTIAL_ID_LENGTH || encodeId(bytes.buffer) !== id) throw new Error("Invalid passkey credential ID.");
+	return bytes.buffer;
+};
+const utf8 = (value) => new TextEncoder().encode(value);
+/** PRF salts are public domain separators: SHA-256 of their label. */
+const prfSalt = async (label) => new Uint8Array(await crypto.subtle.digest("SHA-256", utf8(label)));
+const isCancellation = (error) => error instanceof Object && "name" in error && error.name === "NotAllowedError";
+const toBytes = (source) => source instanceof ArrayBuffer ? new Uint8Array(source) : new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+/** Zeroes every PRF output of one assertion. */
+const zeroOutputs = (outputs) => {
+	outputs.device?.fill(0);
+	outputs.root.fill(0);
+};
+/**
+* The wallet entropy is HKDF-SHA256 over the root with an empty salt and a
+* fixed info label. The expanded bytes are zeroed once encoded; the hex
+* string is what leaves this function, and only for the caller's use.
+*/
+const deriveWalletEntropy = (root) => {
+	const raw = hkdf(sha256, root, void 0, HKDF_WALLET_ENTROPY_INFO, WALLET_ENTROPY_LENGTH);
+	try {
+		return EntropyHex(bytesToHex(raw));
+	} finally {
+		raw.fill(0);
+	}
+};
+/**
+* Runs a fresh assertion and confines the words its root derives to `consume`.
+* The outputs are zeroed and the credential released on success and failure
+* alike; the credential is committed only when `consume` succeeds.
+*/
+const withCeremonyMnemonic = async (ceremony, consume) => {
+	const { outputs, credential } = await ceremony();
+	try {
+		const result = await consume(Mnemonic.deriveFrom(deriveWalletEntropy(outputs.root)));
+		credential.commit();
+		return result;
+	} finally {
+		credential.release();
+		zeroOutputs(outputs);
+	}
+};
+/**
+* The credential handling every key source shares: enrolment, the pinned
+* credential, and assertions evaluating the PRF at the root salt and, when
+* `deviceSaltLabel` is given, at that salt first. The root output is the
+* same either way, so every key source over one passkey derives the same
+* words.
+*
+* Ceremonies pin `allowCredentials` to the credential id captured from
+* passkey creation or a previous assertion; before one is known the key
+* is omitted, which is how WebAuthn asks for a discoverable credential,
+* so the browser offers any resident passkey for the origin. A dismissed
+* prompt maps to PasskeyCeremonyCancelledError and an authenticator without
+* PRF support to PasskeyPrfUnsupportedError.
+*
+* Enrolment asks for a platform authenticator, so the passkey is created
+* on the device the user is on and syncs through their platform
+* credential manager. Without that constraint a browser with no passkey
+* for the origin yet offers to scan a QR code and enrol another device
+* instead.
+*/
+const createPasskeyCeremonies = ({ credentials, rpName = DEFAULT_RP_NAME, rpId = globalThis.location?.hostname, credentialId: importedCredentialId }, deviceSaltLabel) => {
+	if (!rpId) throw new Error("A passkey RP ID is required.");
+	const container = credentials ?? navigator.credentials;
+	let credentialPin = importedCredentialId !== void 0 ? {
+		credentialId: decodeId(importedCredentialId),
+		committed: true,
+		holders: 0
+	} : void 0;
+	const prfEval = async () => {
+		const rootSalt = await prfSalt(PRF_SALT_ROOT_LABEL);
+		return deviceSaltLabel === void 0 ? { first: rootSalt } : {
+			first: await prfSalt(deviceSaltLabel),
+			second: rootSalt
+		};
+	};
+	const toOutputs = (results) => {
+		if (deviceSaltLabel === void 0) {
+			if (!results?.first) throw new PasskeyPrfUnsupportedError();
+			return { root: toBytes(results.first) };
+		}
+		if (!results?.first || !results.second) throw new PasskeyPrfUnsupportedError();
+		return {
+			device: toBytes(results.first),
+			root: toBytes(results.second)
+		};
+	};
+	const credentialRef = () => credentialPin ? {
+		credentialId: encodeId(credentialPin.credentialId),
+		rpId,
+		recipeVersion: RECIPE_VERSION
+	} : void 0;
+	const releaseCredentialPin = (pin) => {
+		pin.holders -= 1;
+		if (!pin.committed && pin.holders === 0 && credentialPin === pin) credentialPin = void 0;
+	};
+	const createCredential = async () => {
+		const evaluation = await prfEval();
+		let created;
+		try {
+			created = await container.create({ publicKey: {
+				rp: {
+					name: rpName,
+					id: rpId
+				},
+				user: {
+					id: crypto.getRandomValues(new Uint8Array(USER_ID_LENGTH)),
+					name: rpName,
+					displayName: rpName
+				},
+				challenge: crypto.getRandomValues(new Uint8Array(CHALLENGE_LENGTH)),
+				pubKeyCredParams: [{
+					type: "public-key",
+					alg: ES256
+				}, {
+					type: "public-key",
+					alg: RS256
+				}],
+				authenticatorSelection: {
+					authenticatorAttachment: "platform",
+					residentKey: "required",
+					userVerification: "required"
+				},
+				extensions: { prf: { eval: evaluation } }
+			} });
+		} catch (error) {
+			if (isCancellation(error)) throw new PasskeyCeremonyCancelledError();
+			throw error;
+		}
+		if (!created) throw new PasskeyCeremonyCancelledError();
+		const credential = created;
+		if (!credential.getClientExtensionResults().prf?.enabled) throw new PasskeyPrfUnsupportedError();
+		credentialPin = {
+			credentialId: credential.rawId,
+			committed: true,
+			holders: 0
+		};
+		return credentialRef();
+	};
+	let enrolment;
+	const ensureCredential = async () => {
+		const existing = credentialRef();
+		if (existing) return existing;
+		enrolment ??= createCredential().finally(() => {
+			enrolment = void 0;
+		});
+		return enrolment;
+	};
+	const ceremony = async () => {
+		const evaluation = await prfEval();
+		const expectedPin = credentialPin;
+		const expectedCredentialId = expectedPin?.credentialId;
+		if (expectedPin) expectedPin.holders += 1;
+		let asserted;
+		try {
+			asserted = await container.get({ publicKey: {
+				challenge: crypto.getRandomValues(new Uint8Array(CHALLENGE_LENGTH)),
+				rpId,
+				...expectedCredentialId && { allowCredentials: [{
+					type: "public-key",
+					id: expectedCredentialId
+				}] },
+				userVerification: "required",
+				extensions: { prf: { eval: evaluation } }
+			} });
+		} catch (error) {
+			if (expectedPin) releaseCredentialPin(expectedPin);
+			if (isCancellation(error)) throw new PasskeyCeremonyCancelledError();
+			throw error;
+		}
+		if (!asserted) {
+			if (expectedPin) releaseCredentialPin(expectedPin);
+			throw new PasskeyCeremonyCancelledError();
+		}
+		let heldPin = expectedPin;
+		try {
+			const credential = asserted;
+			if (expectedCredentialId && encodeId(credential.rawId) !== encodeId(expectedCredentialId)) throw new PasskeyCredentialMismatchError();
+			const outputs = toOutputs(credential.getClientExtensionResults().prf?.results);
+			if (!heldPin) {
+				const currentPin = credentialPin;
+				if (currentPin && encodeId(credential.rawId) !== encodeId(currentPin.credentialId)) throw new PasskeyCredentialMismatchError();
+				if (currentPin) {
+					currentPin.holders += 1;
+					heldPin = currentPin;
+				} else {
+					heldPin = {
+						credentialId: credential.rawId,
+						committed: false,
+						holders: 1
+					};
+					credentialPin = heldPin;
+				}
+			}
+			const selectedPin = heldPin;
+			let isReleased = false;
+			return {
+				outputs,
+				credential: {
+					commit: () => {
+						selectedPin.committed = true;
+					},
+					release: () => {
+						if (isReleased) return;
+						isReleased = true;
+						releaseCredentialPin(selectedPin);
+					}
+				}
+			};
+		} catch (error) {
+			if (heldPin) releaseCredentialPin(heldPin);
+			throw error;
+		}
+	};
+	return {
+		ensureCredential,
+		credentialRef,
+		ceremony
+	};
+};
+//#endregion
+//#region ../../packages/lib/passkey/src/key-source.ts
+/**
+* Creates the key source of one passkey: it runs the WebAuthn PRF ceremony
+* and derives the passkey's wallet words, handing them only to the callback
+* of `withPasskeyMnemonic`.
+*
+* @remarks
+* A {@link PasskeyKeySource} over the WebAuthn PRF extension. Each call to
+* `withPasskeyMnemonic` is its own assertion: the PRF output is the root,
+* the words derive from it through HKDF and BIP-39, and the root is zeroed
+* once the callback settles, on success and failure alike. Nothing is kept
+* between calls except the credential id.
+*
+* Ceremonies pin `allowCredentials` to the credential id captured from
+* passkey creation or a previous assertion; before one is known the key is
+* omitted, so the browser offers any resident passkey for the origin. A
+* dismissed prompt rejects with a `ceremony-cancelled` error and an
+* authenticator without PRF support with a `prf-unsupported` one.
+*
+* Enrolment asks for a platform authenticator, so the passkey is created on
+* the device the user is on and syncs through their platform credential
+* manager. Without that constraint a browser with no passkey for the origin
+* yet offers to scan a QR code and enrol another device instead.
+*
+* @param props - The relying party, a saved credential ID and the WebAuthn
+*   entry point, each optional.
+*/
+const createPasskeyKeySource = (props = {}) => {
+	const { ensureCredential, credentialRef, ceremony } = createPasskeyCeremonies(props);
+	return {
+		ensureCredential,
+		credentialRef,
+		withPasskeyMnemonic: async (use) => withCeremonyMnemonic(ceremony, use)
+	};
+};
+//#endregion
+export { zeroOutputs as a, RemoteSignerError as c, HKDF_RECORD_KEY_INFO as d, PRF_SALT_AUTHORISER_LABEL as f, hmac as g, hkdf as h, withCeremonyMnemonic as i, SignerClosedError as l, EntropyHex as m, createPasskeyCeremonies as n, PasskeyCeremonyCancelledError as o, Mnemonic as p, deriveWalletEntropy as r, PasskeyPrfUnsupportedError as s, createPasskeyKeySource as t, SignerPopupBlockedError as u };