@laceio/sdk 0.1.0 → 0.1.1-canary.0

package/dist/key-source-D2tTAag-.cjs

@@ -0,0 +1,806 @@
+const require_Address = require("./Address-AMKTo-dA.cjs");
+const require__md = require("./_md-6zV2Cme0.cjs");
+const require_english = require("./english-BZ_ebp2-.cjs");
+const require_sha2 = require("./sha2-DaRJZOjk.cjs");
+//#region ../../node_modules/@noble/hashes/esm/hmac.js
+/**
+* HMAC: RFC2104 message authentication code.
+* @module
+*/
+var HMAC = class extends require__md.Hash {
+	constructor(hash, _key) {
+		super();
+		this.finished = false;
+		this.destroyed = false;
+		require__md.ahash(hash);
+		const key = require__md.toBytes(_key);
+		this.iHash = hash.create();
+		if (typeof this.iHash.update !== "function") throw new Error("Expected instance of class which extends utils.Hash");
+		this.blockLen = this.iHash.blockLen;
+		this.outputLen = this.iHash.outputLen;
+		const blockLen = this.blockLen;
+		const pad = new Uint8Array(blockLen);
+		pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
+		this.iHash.update(pad);
+		this.oHash = hash.create();
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 106;
+		this.oHash.update(pad);
+		require__md.clean(pad);
+	}
+	update(buf) {
+		require__md.aexists(this);
+		this.iHash.update(buf);
+		return this;
+	}
+	digestInto(out) {
+		require__md.aexists(this);
+		require__md.abytes(out, this.outputLen);
+		this.finished = true;
+		this.iHash.digestInto(out);
+		this.oHash.update(out);
+		this.oHash.digestInto(out);
+		this.destroy();
+	}
+	digest() {
+		const out = new Uint8Array(this.oHash.outputLen);
+		this.digestInto(out);
+		return out;
+	}
+	_cloneInto(to) {
+		to || (to = Object.create(Object.getPrototypeOf(this), {}));
+		const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+		to = to;
+		to.finished = finished;
+		to.destroyed = destroyed;
+		to.blockLen = blockLen;
+		to.outputLen = outputLen;
+		to.oHash = oHash._cloneInto(to.oHash);
+		to.iHash = iHash._cloneInto(to.iHash);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+	destroy() {
+		this.destroyed = true;
+		this.oHash.destroy();
+		this.iHash.destroy();
+	}
+};
+/**
+* HMAC: RFC2104 message authentication code.
+* @param hash - function that would be used e.g. sha256
+* @param key - message key
+* @param message - message data
+* @example
+* import { hmac } from '@noble/hashes/hmac';
+* import { sha256 } from '@noble/hashes/sha2';
+* const mac1 = hmac(sha256, 'key', 'message');
+*/
+const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
+hmac.create = (hash, key) => new HMAC(hash, key);
+//#endregion
+//#region ../../node_modules/@noble/hashes/esm/hkdf.js
+/**
+* HKDF (RFC 5869): extract + expand in one step.
+* See https://soatok.blog/2021/11/17/understanding-hkdf/.
+* @module
+*/
+/**
+* HKDF-extract from spec. Less important part. `HKDF-Extract(IKM, salt) -> PRK`
+* Arguments position differs from spec (IKM is first one, since it is not optional)
+* @param hash - hash function that would be used (e.g. sha256)
+* @param ikm - input keying material, the initial key
+* @param salt - optional salt value (a non-secret random value)
+*/
+function extract(hash, ikm, salt) {
+	require__md.ahash(hash);
+	if (salt === void 0) salt = new Uint8Array(hash.outputLen);
+	return hmac(hash, require__md.toBytes(salt), require__md.toBytes(ikm));
+}
+const HKDF_COUNTER = /* @__PURE__ */ Uint8Array.from([0]);
+const EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+/**
+* HKDF-expand from the spec. The most important part. `HKDF-Expand(PRK, info, L) -> OKM`
+* @param hash - hash function that would be used (e.g. sha256)
+* @param prk - a pseudorandom key of at least HashLen octets (usually, the output from the extract step)
+* @param info - optional context and application specific information (can be a zero-length string)
+* @param length - length of output keying material in bytes
+*/
+function expand(hash, prk, info, length = 32) {
+	require__md.ahash(hash);
+	require__md.anumber(length);
+	const olen = hash.outputLen;
+	if (length > 255 * olen) throw new Error("Length should be <= 255*HashLen");
+	const blocks = Math.ceil(length / olen);
+	if (info === void 0) info = EMPTY_BUFFER;
+	const okm = new Uint8Array(blocks * olen);
+	const HMAC = hmac.create(hash, prk);
+	const HMACTmp = HMAC._cloneInto();
+	const T = new Uint8Array(HMAC.outputLen);
+	for (let counter = 0; counter < blocks; counter++) {
+		HKDF_COUNTER[0] = counter + 1;
+		HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info).update(HKDF_COUNTER).digestInto(T);
+		okm.set(T, olen * counter);
+		HMAC._cloneInto(HMACTmp);
+	}
+	HMAC.destroy();
+	HMACTmp.destroy();
+	require__md.clean(T, HKDF_COUNTER);
+	return okm.slice(0, length);
+}
+/**
+* HKDF (RFC 5869): derive keys from an initial input.
+* Combines hkdf_extract + hkdf_expand in one step
+* @param hash - hash function that would be used (e.g. sha256)
+* @param ikm - input keying material, the initial key
+* @param salt - optional salt value (a non-secret random value)
+* @param info - optional context and application specific information (can be a zero-length string)
+* @param length - length of output keying material in bytes
+* @example
+* import { hkdf } from '@noble/hashes/hkdf';
+* import { sha256 } from '@noble/hashes/sha2';
+* import { randomBytes } from '@noble/hashes/utils';
+* const inputKey = randomBytes(32);
+* const salt = randomBytes(32);
+* const info = 'application-key';
+* const hk1 = hkdf(sha256, inputKey, salt, info, 32);
+*/
+const hkdf = (hash, ikm, salt, info, length) => expand(hash, extract(hash, ikm, salt), info, length);
+//#endregion
+//#region ../../packages/lib/crypto/src/value-objects/entropy-hex.vo.ts
+const ENTROPY_BYTE_LENGTH = 32;
+const ENTROPY_HEX_LENGTH = ENTROPY_BYTE_LENGTH * 2;
+const HEX_PATTERN = /^[0-9a-fA-F]+$/;
+/**
+* Types 32 bytes of entropy, as 64 hex characters, for `Mnemonic.deriveFrom`.
+* Throws when the value has another length or is not hex.
+*/
+const EntropyHex = (value) => {
+	if (value.length !== ENTROPY_HEX_LENGTH) throw new Error(`EntropyHex must be ${ENTROPY_BYTE_LENGTH} bytes (${ENTROPY_HEX_LENGTH} hex characters), got ${value.length}`);
+	if (!HEX_PATTERN.test(value)) throw new Error("EntropyHex must be a hex-encoded string");
+	return value;
+};
+//#endregion
+//#region ../../node_modules/@noble/hashes/esm/pbkdf2.js
+/**
+* PBKDF (RFC 2898). Can be used to create a key from password and salt.
+* @module
+*/
+function pbkdf2Init(hash, _password, _salt, _opts) {
+	require__md.ahash(hash);
+	const { c, dkLen, asyncTick } = require__md.checkOpts({
+		dkLen: 32,
+		asyncTick: 10
+	}, _opts);
+	require__md.anumber(c);
+	require__md.anumber(dkLen);
+	require__md.anumber(asyncTick);
+	if (c < 1) throw new Error("iterations (c) should be >= 1");
+	const password = require__md.kdfInputToBytes(_password);
+	const salt = require__md.kdfInputToBytes(_salt);
+	const DK = new Uint8Array(dkLen);
+	const PRF = hmac.create(hash, password);
+	return {
+		c,
+		dkLen,
+		asyncTick,
+		DK,
+		PRF,
+		PRFSalt: PRF._cloneInto().update(salt)
+	};
+}
+function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
+	PRF.destroy();
+	PRFSalt.destroy();
+	if (prfW) prfW.destroy();
+	require__md.clean(u);
+	return DK;
+}
+/**
+* PBKDF2-HMAC: RFC 2898 key derivation function
+* @param hash - hash function that would be used e.g. sha256
+* @param password - password from which a derived key is generated
+* @param salt - cryptographic salt
+* @param opts - {c, dkLen} where c is work factor and dkLen is output message size
+* @example
+* const key = pbkdf2(sha256, 'password', 'salt', { dkLen: 32, c: Math.pow(2, 18) });
+*/
+function pbkdf2(hash, password, salt, opts) {
+	const { c, dkLen, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
+	let prfW;
+	const arr = new Uint8Array(4);
+	const view = require__md.createView(arr);
+	const u = new Uint8Array(PRF.outputLen);
+	for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
+		const Ti = DK.subarray(pos, pos + PRF.outputLen);
+		view.setInt32(0, ti, false);
+		(prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
+		Ti.set(u.subarray(0, Ti.length));
+		for (let ui = 1; ui < c; ui++) {
+			PRF._cloneInto(prfW).update(u).digestInto(u);
+			for (let i = 0; i < Ti.length; i++) Ti[i] ^= u[i];
+		}
+	}
+	return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
+}
+//#endregion
+//#region ../../packages/lib/crypto/node_modules/@scure/bip39/esm/index.js
+/**
+* Audited & minimal JS implementation of
+* [BIP39 mnemonic phrases](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
+* @module
+* @example
+```js
+import * as bip39 from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english';
+const mn = bip39.generateMnemonic(wordlist);
+console.log(mn);
+const ent = bip39.mnemonicToEntropy(mn, wordlist)
+bip39.entropyToMnemonic(ent, wordlist);
+bip39.validateMnemonic(mn, wordlist);
+await bip39.mnemonicToSeed(mn, 'password');
+bip39.mnemonicToSeedSync(mn, 'password');
+
+// Wordlists
+import { wordlist as czech } from '@scure/bip39/wordlists/czech';
+import { wordlist as english } from '@scure/bip39/wordlists/english';
+import { wordlist as french } from '@scure/bip39/wordlists/french';
+import { wordlist as italian } from '@scure/bip39/wordlists/italian';
+import { wordlist as japanese } from '@scure/bip39/wordlists/japanese';
+import { wordlist as korean } from '@scure/bip39/wordlists/korean';
+import { wordlist as portuguese } from '@scure/bip39/wordlists/portuguese';
+import { wordlist as simplifiedChinese } from '@scure/bip39/wordlists/simplified-chinese';
+import { wordlist as spanish } from '@scure/bip39/wordlists/spanish';
+import { wordlist as traditionalChinese } from '@scure/bip39/wordlists/traditional-chinese';
+```
+*/
+/*! scure-bip39 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) */
+const isJapanese = (wordlist) => wordlist[0] === "あいこくしん";
+function nfkd(str) {
+	if (typeof str !== "string") throw new TypeError("invalid mnemonic type: " + typeof str);
+	return str.normalize("NFKD");
+}
+function normalize(str) {
+	const norm = nfkd(str);
+	const words = norm.split(" ");
+	if (![
+		12,
+		15,
+		18,
+		21,
+		24
+	].includes(words.length)) throw new Error("Invalid mnemonic");
+	return {
+		nfkd: norm,
+		words
+	};
+}
+function aentropy(ent) {
+	require__md.abytes(ent, 16, 20, 24, 28, 32);
+}
+const calcChecksum = (entropy) => {
+	const bitsLeft = 8 - entropy.length / 4;
+	return new Uint8Array([require_sha2.sha256(entropy)[0] >> bitsLeft << bitsLeft]);
+};
+function getCoder(wordlist) {
+	if (!Array.isArray(wordlist) || wordlist.length !== 2048 || typeof wordlist[0] !== "string") throw new Error("Wordlist: expected array of 2048 strings");
+	wordlist.forEach((i) => {
+		if (typeof i !== "string") throw new Error("wordlist: non-string element: " + i);
+	});
+	return require_Address.utils.chain(require_Address.utils.checksum(1, calcChecksum), require_Address.utils.radix2(11, true), require_Address.utils.alphabet(wordlist));
+}
+/**
+* Reversible: Converts raw entropy in form of byte array to mnemonic string.
+* @param entropy byte array
+* @param wordlist imported wordlist for specific language
+* @returns 12-24 words
+* @example
+* const ent = new Uint8Array([
+*   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f,
+*   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f
+* ]);
+* entropyToMnemonic(ent, wordlist);
+* // 'legal winner thank year wave sausage worth useful legal winner thank yellow'
+*/
+function entropyToMnemonic(entropy, wordlist) {
+	aentropy(entropy);
+	return getCoder(wordlist).encode(entropy).join(isJapanese(wordlist) ? "　" : " ");
+}
+const psalt = (passphrase) => nfkd("mnemonic" + passphrase);
+/**
+* Irreversible: Uses KDF to derive 64 bytes of key data from mnemonic + optional password.
+* @param mnemonic 12-24 words
+* @param passphrase string that will additionally protect the key
+* @returns 64 bytes of key data
+* @example
+* const mnem = 'legal winner thank year wave sausage worth useful legal winner thank yellow';
+* mnemonicToSeedSync(mnem, 'password');
+* // new Uint8Array([...64 bytes])
+*/
+function mnemonicToSeedSync(mnemonic, passphrase = "") {
+	return pbkdf2(require_sha2.sha512, normalize(mnemonic).nfkd, psalt(passphrase), {
+		c: 2048,
+		dkLen: 64
+	});
+}
+//#endregion
+//#region ../../packages/lib/crypto/src/value-objects/mnemonic.vo.ts
+/**
+* Types a list of words as a BIP-39 mnemonic; it checks nothing.
+* `Mnemonic.deriveFrom(entropy)` derives 24 words from 32 bytes of entropy,
+* and `Mnemonic.toSeed(words)` gives their BIP-39 seed.
+*/
+const Mnemonic = (words) => words;
+/**
+* Derives a 24-word BIP39 mnemonic from 32 bytes of hex-encoded entropy.
+* Uses HKDF for domain separation, so the raw entropy is never used
+* directly as seed material. The entropy bytes and the expanded key are zeroed once the
+* words exist; the words themselves are strings and cannot be.
+*/
+Mnemonic.deriveFrom = (entropyHex) => {
+	const rawKey = require__md.hexToBytes(entropyHex);
+	const derived = hkdf(require_sha2.sha256, rawKey, "lace", "wallet-seed", 32);
+	try {
+		return Mnemonic(entropyToMnemonic(derived, require_english.wordlist).split(" "));
+	} finally {
+		rawKey.fill(0);
+		derived.fill(0);
+	}
+};
+/**
+* The 64-byte BIP39 seed of the mnemonic with an empty passphrase: the seed
+* that wallets deriving their keys from the BIP39 seed consume, so secrets
+* derived from it match what such a wallet built from the same words would
+* derive. The caller owns the bytes and zeroes them after use.
+*/
+Mnemonic.toSeed = (words) => mnemonicToSeedSync(words.join(" "));
+//#endregion
+//#region ../../packages/lib/passkey/src/constants.ts
+/** The label of the first PRF salt, whose output is the device secret. */
+const PRF_SALT_AUTHORISER_LABEL = "lace-passport/prf/authoriser/v1";
+/** The label of the second PRF salt, whose output is the root every named derivation starts from. */
+const PRF_SALT_ROOT_LABEL = "lace/prf/root/v1";
+/** The HKDF info label under which the record sealing key derives from the root. */
+const HKDF_RECORD_KEY_INFO = "lace-passport/hkdf/record-key/v1";
+/** The HKDF info label under which the wallet entropy, and from it the recovery words, derives from the root. */
+const HKDF_WALLET_ENTROPY_INFO = "lace/hkdf/wallet-entropy/v1";
+//#endregion
+//#region ../../packages/lib/passkey/src/errors.ts
+/** The user dismissed a WebAuthn ceremony. */
+var PasskeyCeremonyCancelledError = class extends Error {
+	code = "ceremony-cancelled";
+	constructor() {
+		super("The passkey ceremony was cancelled.");
+		this.name = "PasskeyCeremonyCancelledError";
+	}
+};
+/** The authenticator did not supply both PRF outputs. */
+var PasskeyPrfUnsupportedError = class extends Error {
+	code = "prf-unsupported";
+	constructor() {
+		super("The platform authenticator does not support the PRF extension.");
+		this.name = "PasskeyPrfUnsupportedError";
+	}
+};
+/** The selected credential differs from the imported wallet credential. */
+var PasskeyCredentialMismatchError = class extends Error {
+	code = "credential-mismatch";
+	constructor() {
+		super("The selected passkey does not match the wallet credential.");
+		this.name = "PasskeyCredentialMismatchError";
+	}
+};
+/**
+* The browser refused to open the signer popup (`popup-blocked`); it must be
+* opened inside a user gesture.
+*/
+var SignerPopupBlockedError = class extends Error {
+	code = "popup-blocked";
+	constructor() {
+		super("The browser blocked the signer popup.");
+		this.name = "SignerPopupBlockedError";
+	}
+};
+/**
+* The signer answered a request with a failure; `code` is the code it
+* reported, such as `ceremony-cancelled` when the user rejects the request
+* or `malformed-request` when the signer cannot describe it for consent,
+* and `details` the values it declared alongside, when any. Both come from
+* the signer page, so a reader validates `details` before acting on it.
+*/
+var RemoteSignerError = class extends Error {
+	code;
+	details;
+	constructor(code, message, details) {
+		super(message);
+		this.code = code;
+		this.details = details;
+		this.name = "RemoteSignerError";
+	}
+};
+/**
+* The signer popup closed, as when the user closes the window, while requests
+* were still pending (`ceremony-cancelled`).
+*/
+var SignerClosedError = class extends Error {
+	code = "ceremony-cancelled";
+	constructor() {
+		super("The signer popup was closed.");
+		this.name = "SignerClosedError";
+	}
+};
+//#endregion
+//#region ../../packages/lib/passkey/src/ceremony.ts
+const DEFAULT_RP_NAME = "Lace";
+const CHALLENGE_LENGTH = 32;
+const USER_ID_LENGTH = 16;
+const WALLET_ENTROPY_LENGTH = 32;
+const MAX_CREDENTIAL_ID_LENGTH = 1023;
+const ES256 = -7;
+const RS256 = -257;
+const RECIPE_VERSION = "v1";
+const encodeId = (id) => btoa(String.fromCharCode(...new Uint8Array(id))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+const decodeId = (id) => {
+	if (!/^[A-Za-z0-9_-]+$/.test(id) || id.length > Math.ceil(MAX_CREDENTIAL_ID_LENGTH * 4 / 3)) throw new Error("Invalid passkey credential ID.");
+	let bytes;
+	try {
+		bytes = Uint8Array.from(atob(id.replaceAll("-", "+").replaceAll("_", "/")), (character) => character.charCodeAt(0));
+	} catch {
+		throw new Error("Invalid passkey credential ID.");
+	}
+	if (bytes.length > MAX_CREDENTIAL_ID_LENGTH || encodeId(bytes.buffer) !== id) throw new Error("Invalid passkey credential ID.");
+	return bytes.buffer;
+};
+const utf8 = (value) => new TextEncoder().encode(value);
+/** PRF salts are public domain separators: SHA-256 of their label. */
+const prfSalt = async (label) => new Uint8Array(await crypto.subtle.digest("SHA-256", utf8(label)));
+const isCancellation = (error) => error instanceof Object && "name" in error && error.name === "NotAllowedError";
+const toBytes = (source) => source instanceof ArrayBuffer ? new Uint8Array(source) : new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+/** Zeroes every PRF output of one assertion. */
+const zeroOutputs = (outputs) => {
+	outputs.device?.fill(0);
+	outputs.root.fill(0);
+};
+/**
+* The wallet entropy is HKDF-SHA256 over the root with an empty salt and a
+* fixed info label. The expanded bytes are zeroed once encoded; the hex
+* string is what leaves this function, and only for the caller's use.
+*/
+const deriveWalletEntropy = (root) => {
+	const raw = hkdf(require_sha2.sha256, root, void 0, HKDF_WALLET_ENTROPY_INFO, WALLET_ENTROPY_LENGTH);
+	try {
+		return EntropyHex(require__md.bytesToHex(raw));
+	} finally {
+		raw.fill(0);
+	}
+};
+/**
+* Runs a fresh assertion and confines the words its root derives to `consume`.
+* The outputs are zeroed and the credential released on success and failure
+* alike; the credential is committed only when `consume` succeeds.
+*/
+const withCeremonyMnemonic = async (ceremony, consume) => {
+	const { outputs, credential } = await ceremony();
+	try {
+		const result = await consume(Mnemonic.deriveFrom(deriveWalletEntropy(outputs.root)));
+		credential.commit();
+		return result;
+	} finally {
+		credential.release();
+		zeroOutputs(outputs);
+	}
+};
+/**
+* The credential handling every key source shares: enrolment, the pinned
+* credential, and assertions evaluating the PRF at the root salt and, when
+* `deviceSaltLabel` is given, at that salt first. The root output is the
+* same either way, so every key source over one passkey derives the same
+* words.
+*
+* Ceremonies pin `allowCredentials` to the credential id captured from
+* passkey creation or a previous assertion; before one is known the key
+* is omitted, which is how WebAuthn asks for a discoverable credential,
+* so the browser offers any resident passkey for the origin. A dismissed
+* prompt maps to PasskeyCeremonyCancelledError and an authenticator without
+* PRF support to PasskeyPrfUnsupportedError.
+*
+* Enrolment asks for a platform authenticator, so the passkey is created
+* on the device the user is on and syncs through their platform
+* credential manager. Without that constraint a browser with no passkey
+* for the origin yet offers to scan a QR code and enrol another device
+* instead.
+*/
+const createPasskeyCeremonies = ({ credentials, rpName = DEFAULT_RP_NAME, rpId = globalThis.location?.hostname, credentialId: importedCredentialId }, deviceSaltLabel) => {
+	if (!rpId) throw new Error("A passkey RP ID is required.");
+	const container = credentials ?? navigator.credentials;
+	let credentialPin = importedCredentialId !== void 0 ? {
+		credentialId: decodeId(importedCredentialId),
+		committed: true,
+		holders: 0
+	} : void 0;
+	const prfEval = async () => {
+		const rootSalt = await prfSalt(PRF_SALT_ROOT_LABEL);
+		return deviceSaltLabel === void 0 ? { first: rootSalt } : {
+			first: await prfSalt(deviceSaltLabel),
+			second: rootSalt
+		};
+	};
+	const toOutputs = (results) => {
+		if (deviceSaltLabel === void 0) {
+			if (!results?.first) throw new PasskeyPrfUnsupportedError();
+			return { root: toBytes(results.first) };
+		}
+		if (!results?.first || !results.second) throw new PasskeyPrfUnsupportedError();
+		return {
+			device: toBytes(results.first),
+			root: toBytes(results.second)
+		};
+	};
+	const credentialRef = () => credentialPin ? {
+		credentialId: encodeId(credentialPin.credentialId),
+		rpId,
+		recipeVersion: RECIPE_VERSION
+	} : void 0;
+	const releaseCredentialPin = (pin) => {
+		pin.holders -= 1;
+		if (!pin.committed && pin.holders === 0 && credentialPin === pin) credentialPin = void 0;
+	};
+	const createCredential = async () => {
+		const evaluation = await prfEval();
+		let created;
+		try {
+			created = await container.create({ publicKey: {
+				rp: {
+					name: rpName,
+					id: rpId
+				},
+				user: {
+					id: crypto.getRandomValues(new Uint8Array(USER_ID_LENGTH)),
+					name: rpName,
+					displayName: rpName
+				},
+				challenge: crypto.getRandomValues(new Uint8Array(CHALLENGE_LENGTH)),
+				pubKeyCredParams: [{
+					type: "public-key",
+					alg: ES256
+				}, {
+					type: "public-key",
+					alg: RS256
+				}],
+				authenticatorSelection: {
+					authenticatorAttachment: "platform",
+					residentKey: "required",
+					userVerification: "required"
+				},
+				extensions: { prf: { eval: evaluation } }
+			} });
+		} catch (error) {
+			if (isCancellation(error)) throw new PasskeyCeremonyCancelledError();
+			throw error;
+		}
+		if (!created) throw new PasskeyCeremonyCancelledError();
+		const credential = created;
+		if (!credential.getClientExtensionResults().prf?.enabled) throw new PasskeyPrfUnsupportedError();
+		credentialPin = {
+			credentialId: credential.rawId,
+			committed: true,
+			holders: 0
+		};
+		return credentialRef();
+	};
+	let enrolment;
+	const ensureCredential = async () => {
+		const existing = credentialRef();
+		if (existing) return existing;
+		enrolment ??= createCredential().finally(() => {
+			enrolment = void 0;
+		});
+		return enrolment;
+	};
+	const ceremony = async () => {
+		const evaluation = await prfEval();
+		const expectedPin = credentialPin;
+		const expectedCredentialId = expectedPin?.credentialId;
+		if (expectedPin) expectedPin.holders += 1;
+		let asserted;
+		try {
+			asserted = await container.get({ publicKey: {
+				challenge: crypto.getRandomValues(new Uint8Array(CHALLENGE_LENGTH)),
+				rpId,
+				...expectedCredentialId && { allowCredentials: [{
+					type: "public-key",
+					id: expectedCredentialId
+				}] },
+				userVerification: "required",
+				extensions: { prf: { eval: evaluation } }
+			} });
+		} catch (error) {
+			if (expectedPin) releaseCredentialPin(expectedPin);
+			if (isCancellation(error)) throw new PasskeyCeremonyCancelledError();
+			throw error;
+		}
+		if (!asserted) {
+			if (expectedPin) releaseCredentialPin(expectedPin);
+			throw new PasskeyCeremonyCancelledError();
+		}
+		let heldPin = expectedPin;
+		try {
+			const credential = asserted;
+			if (expectedCredentialId && encodeId(credential.rawId) !== encodeId(expectedCredentialId)) throw new PasskeyCredentialMismatchError();
+			const outputs = toOutputs(credential.getClientExtensionResults().prf?.results);
+			if (!heldPin) {
+				const currentPin = credentialPin;
+				if (currentPin && encodeId(credential.rawId) !== encodeId(currentPin.credentialId)) throw new PasskeyCredentialMismatchError();
+				if (currentPin) {
+					currentPin.holders += 1;
+					heldPin = currentPin;
+				} else {
+					heldPin = {
+						credentialId: credential.rawId,
+						committed: false,
+						holders: 1
+					};
+					credentialPin = heldPin;
+				}
+			}
+			const selectedPin = heldPin;
+			let isReleased = false;
+			return {
+				outputs,
+				credential: {
+					commit: () => {
+						selectedPin.committed = true;
+					},
+					release: () => {
+						if (isReleased) return;
+						isReleased = true;
+						releaseCredentialPin(selectedPin);
+					}
+				}
+			};
+		} catch (error) {
+			if (heldPin) releaseCredentialPin(heldPin);
+			throw error;
+		}
+	};
+	return {
+		ensureCredential,
+		credentialRef,
+		ceremony
+	};
+};
+//#endregion
+//#region ../../packages/lib/passkey/src/key-source.ts
+/**
+* Creates the key source of one passkey: it runs the WebAuthn PRF ceremony
+* and derives the passkey's wallet words, handing them only to the callback
+* of `withPasskeyMnemonic`.
+*
+* @remarks
+* A {@link PasskeyKeySource} over the WebAuthn PRF extension. Each call to
+* `withPasskeyMnemonic` is its own assertion: the PRF output is the root,
+* the words derive from it through HKDF and BIP-39, and the root is zeroed
+* once the callback settles, on success and failure alike. Nothing is kept
+* between calls except the credential id.
+*
+* Ceremonies pin `allowCredentials` to the credential id captured from
+* passkey creation or a previous assertion; before one is known the key is
+* omitted, so the browser offers any resident passkey for the origin. A
+* dismissed prompt rejects with a `ceremony-cancelled` error and an
+* authenticator without PRF support with a `prf-unsupported` one.
+*
+* Enrolment asks for a platform authenticator, so the passkey is created on
+* the device the user is on and syncs through their platform credential
+* manager. Without that constraint a browser with no passkey for the origin
+* yet offers to scan a QR code and enrol another device instead.
+*
+* @param props - The relying party, a saved credential ID and the WebAuthn
+*   entry point, each optional.
+*/
+const createPasskeyKeySource = (props = {}) => {
+	const { ensureCredential, credentialRef, ceremony } = createPasskeyCeremonies(props);
+	return {
+		ensureCredential,
+		credentialRef,
+		withPasskeyMnemonic: async (use) => withCeremonyMnemonic(ceremony, use)
+	};
+};
+//#endregion
+Object.defineProperty(exports, "EntropyHex", {
+	enumerable: true,
+	get: function() {
+		return EntropyHex;
+	}
+});
+Object.defineProperty(exports, "HKDF_RECORD_KEY_INFO", {
+	enumerable: true,
+	get: function() {
+		return HKDF_RECORD_KEY_INFO;
+	}
+});
+Object.defineProperty(exports, "Mnemonic", {
+	enumerable: true,
+	get: function() {
+		return Mnemonic;
+	}
+});
+Object.defineProperty(exports, "PRF_SALT_AUTHORISER_LABEL", {
+	enumerable: true,
+	get: function() {
+		return PRF_SALT_AUTHORISER_LABEL;
+	}
+});
+Object.defineProperty(exports, "PasskeyCeremonyCancelledError", {
+	enumerable: true,
+	get: function() {
+		return PasskeyCeremonyCancelledError;
+	}
+});
+Object.defineProperty(exports, "PasskeyPrfUnsupportedError", {
+	enumerable: true,
+	get: function() {
+		return PasskeyPrfUnsupportedError;
+	}
+});
+Object.defineProperty(exports, "RemoteSignerError", {
+	enumerable: true,
+	get: function() {
+		return RemoteSignerError;
+	}
+});
+Object.defineProperty(exports, "SignerClosedError", {
+	enumerable: true,
+	get: function() {
+		return SignerClosedError;
+	}
+});
+Object.defineProperty(exports, "SignerPopupBlockedError", {
+	enumerable: true,
+	get: function() {
+		return SignerPopupBlockedError;
+	}
+});
+Object.defineProperty(exports, "createPasskeyCeremonies", {
+	enumerable: true,
+	get: function() {
+		return createPasskeyCeremonies;
+	}
+});
+Object.defineProperty(exports, "createPasskeyKeySource", {
+	enumerable: true,
+	get: function() {
+		return createPasskeyKeySource;
+	}
+});
+Object.defineProperty(exports, "deriveWalletEntropy", {
+	enumerable: true,
+	get: function() {
+		return deriveWalletEntropy;
+	}
+});
+Object.defineProperty(exports, "hkdf", {
+	enumerable: true,
+	get: function() {
+		return hkdf;
+	}
+});
+Object.defineProperty(exports, "hmac", {
+	enumerable: true,
+	get: function() {
+		return hmac;
+	}
+});
+Object.defineProperty(exports, "withCeremonyMnemonic", {
+	enumerable: true,
+	get: function() {
+		return withCeremonyMnemonic;
+	}
+});
+Object.defineProperty(exports, "zeroOutputs", {
+	enumerable: true,
+	get: function() {
+		return zeroOutputs;
+	}
+});