@metamask-previews/passkey-controller 2.1.0-preview-eade524 → 2.1.0-preview-44376e0

package/dist/PasskeyController.cjs

@@ -10,12 +10,11 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _PasskeyController_instances, _PasskeyController_ceremonyManager, _PasskeyController_expectedRPIDs, _PasskeyController_rpId, _PasskeyController_rpName, _PasskeyController_expectedOrigin, _PasskeyController_userName, _PasskeyController_userDisplayName, _PasskeyController_getIsOnboardingCompleted, _PasskeyController_operationMutex, _PasskeyController_protectVaultKeyWithPasskey, _PasskeyController_retrieveVaultKeyWithPasskey, _PasskeyController_verifyPasskeyAuthentication, _PasskeyController_renewVaultKeyProtection, _PasskeyController_changePasswordWithPasskeyVerification, _PasskeyController_removePasskeyWithPasskeyVerification, _PasskeyController_removePasskeyWithPasswordVerification, _PasskeyController_verifyAuthenticationResponse, _PasskeyController_withOperationLock, _PasskeyController_assertEnrollmentAllowed, _PasskeyController_requireEnrolled, _PasskeyController_getChallengeFromClientData, _PasskeyController_removePasskey;
+var _PasskeyController_instances, _PasskeyController_ceremonyManager, _PasskeyController_expectedRPIDs, _PasskeyController_rpId, _PasskeyController_rpName, _PasskeyController_expectedOrigin, _PasskeyController_userName, _PasskeyController_userDisplayName, _PasskeyController_requireEnrolled, _PasskeyController_getChallengeFromClientData, _PasskeyController_verifyAuthenticationResponse;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PasskeyController = exports.passkeyControllerSelectors = exports.getDefaultPasskeyControllerState = void 0;
 const base_controller_1 = require("@metamask/base-controller");
 const utils_1 = require("@metamask/utils");
-const async_mutex_1 = require("async-mutex");
 const ceremony_manager_1 = require("./ceremony-manager.cjs");
 const constants_1 = require("./constants.cjs");
 const errors_1 = require("./errors.cjs");
@@ -62,14 +61,9 @@ const MESSENGER_EXPOSED_METHODS = [
     'generateAuthenticationOptions',
     'protectVaultKeyWithPasskey',
     'retrieveVaultKeyWithPasskey',
-    'unlockWithPasskey',
     'verifyPasskeyAuthentication',
     'renewVaultKeyProtection',
-    'changePasswordWithPasskeyVerification',
-    'exportSeedPhraseWithPasskey',
-    'exportAccountsWithPasskey',
-    'removePasskeyWithPasskeyVerification',
-    'removePasskeyWithPasswordVerification',
+    'removePasskey',
     'clearState',
     'destroy',
 ];
@@ -81,18 +75,20 @@ class PasskeyController extends base_controller_1.BaseController {
     /**
      * Creates a passkey controller with WebAuthn relying-party settings.
      *
-     * @param options - Constructor options.
-     * @param options.messenger - The messenger to use for communication.
-     * @param options.state - The initial state of the controller.
-     * @param options.rpId - The relying party ID to use for the passkey.
-     * @param options.expectedRPID - The expected relying party ID to use for the passkey.
-     * @param options.rpName - The relying party name to use for the passkey.
-     * @param options.expectedOrigin - The expected origin to use for the passkey.
-     * @param options.userName - The user name to use for the passkey.
-     * @param options.userDisplayName - The user display name to use for the passkey.
-     * @param options.getIsOnboardingCompleted - The callback to use to check if onboarding is complete.
+     * @param args - Constructor options.
+     * @param args.messenger - Controller messenger.
+     * @param args.state - Partial initial state; merged with {@link getDefaultPasskeyControllerState}.
+     * @param args.expectedRPID - Relying party ID(s) for verification (SHA-256 hash match in
+     *   authenticator data). Pass a string or array of strings; an empty array skips RP ID
+     *   allowlist checks in {@link verifyRegistrationResponse} / {@link verifyAuthenticationResponse}.
+     * @param args.rpId - When set, included as `rp.id` on registration options and `rpId` on
+     *   authentication options. When omitted, those fields are left unset (client default RP ID).
+     * @param args.rpName - Relying party name shown in the platform passkey UI.
+     * @param args.expectedOrigin - Allowed value(s) for the WebAuthn client origin.
+     * @param args.userName - Optional passkey user name; defaults to `rpName`.
+     * @param args.userDisplayName - Optional display name; defaults to `rpName`.
      */
-    constructor({ messenger, state = {}, rpId, expectedRPID, rpName, expectedOrigin, userName, userDisplayName, getIsOnboardingCompleted, }) {
+    constructor({ messenger, state = {}, rpId, expectedRPID, rpName, expectedOrigin, userName, userDisplayName, }) {
         super({
             messenger,
             metadata: passkeyControllerMetadata,
@@ -107,8 +103,6 @@ class PasskeyController extends base_controller_1.BaseController {
         _PasskeyController_expectedOrigin.set(this, void 0);
         _PasskeyController_userName.set(this, void 0);
         _PasskeyController_userDisplayName.set(this, void 0);
-        _PasskeyController_getIsOnboardingCompleted.set(this, void 0);
-        _PasskeyController_operationMutex.set(this, new async_mutex_1.Mutex());
         const expectedRPIDs = Array.isArray(expectedRPID)
             ? expectedRPID
             : [expectedRPID];
@@ -118,7 +112,6 @@ class PasskeyController extends base_controller_1.BaseController {
         __classPrivateFieldSet(this, _PasskeyController_expectedOrigin, expectedOrigin, "f");
         __classPrivateFieldSet(this, _PasskeyController_userName, userName ?? rpName, "f");
         __classPrivateFieldSet(this, _PasskeyController_userDisplayName, userDisplayName ?? rpName, "f");
-        __classPrivateFieldSet(this, _PasskeyController_getIsOnboardingCompleted, getIsOnboardingCompleted, "f");
         this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
     /**
@@ -264,72 +257,113 @@ class PasskeyController extends base_controller_1.BaseController {
      * Verifies registration and post-registration authentication, then stores the
      * vault key encrypted under the new passkey.
      *
-     * Fetches the current vault encryption key from KeyringController before wrapping.
-     * When onboarding is complete, requires `password` for step-up verification first.
-     *
      * @param params - Enrollment completion inputs.
      * @param params.registrationResponse - Result of `navigator.credentials.create()`.
      * @param params.authenticationResponse - Result of `navigator.credentials.get()` after {@link generatePostRegistrationAuthenticationOptions}.
-     * @param params.password - Wallet password when onboarding is complete (step-up).
-     * @returns Resolves when enrollment completes.
+     * @param params.vaultKey - Vault encryption key to encrypt and persist.
      */
     async protectVaultKeyWithPasskey(params) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_protectVaultKeyWithPasskey).call(this, params));
+        if (this.isPasskeyEnrolled()) {
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AlreadyEnrolled, { code: constants_1.PasskeyControllerErrorCode.AlreadyEnrolled });
+        }
+        const { registrationResponse, authenticationResponse, vaultKey } = params;
+        // get registration ceremony
+        const challenge = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_getChallengeFromClientData).call(this, registrationResponse.response.clientDataJSON);
+        const registrationCeremony = __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").getRegistrationCeremony(challenge);
+        if (!registrationCeremony) {
+            log('No active passkey registration ceremony for challenge');
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NoRegistrationCeremony, { code: constants_1.PasskeyControllerErrorCode.NoRegistrationCeremony });
+        }
+        try {
+            // verify registration response
+            const { verified, registrationInfo } = await (0, verify_registration_response_1.verifyRegistrationResponse)({
+                response: registrationResponse,
+                expectedChallenge: registrationCeremony.challenge,
+                expectedOrigin: __classPrivateFieldGet(this, _PasskeyController_expectedOrigin, "f"),
+                expectedRPIDs: __classPrivateFieldGet(this, _PasskeyController_expectedRPIDs, "f"),
+                requireUserVerification: true,
+            }).catch((error) => {
+                log('Error verifying passkey registration response', error);
+                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.RegistrationVerificationFailed, {
+                    code: constants_1.PasskeyControllerErrorCode.RegistrationVerificationFailed,
+                    cause: error instanceof Error ? error : new Error(String(error)),
+                });
+            });
+            if (!verified || !registrationInfo) {
+                log('Passkey registration verification returned unverified or missing registration info');
+                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.RegistrationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.RegistrationVerificationFailed });
+            }
+            // verify authentication response
+            const credential = {
+                id: registrationInfo.credentialId,
+                publicKey: (0, encoding_1.bytesToBase64URL)(registrationInfo.publicKey),
+                counter: registrationInfo.counter,
+                transports: registrationInfo.transports,
+                aaguid: registrationInfo.aaguid,
+            };
+            const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, credential);
+            // determine key derivation method
+            const prfFirst = authenticationResponse.clientExtensionResults?.prf?.results?.first;
+            const authHasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;
+            const keyDerivation = authHasPrfOutput && registrationCeremony.prfSalt
+                ? { method: 'prf', prfSalt: registrationCeremony.prfSalt }
+                : { method: 'userHandle' };
+            if (keyDerivation.method === 'userHandle' &&
+                authenticationResponse.response.userHandle !==
+                    registrationCeremony.userHandle) {
+                log('Post-registration assertion userHandle does not match registration ceremony');
+                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.AuthenticationVerificationFailed });
+            }
+            // derive key and encrypt vault key
+            const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, { credential, keyDerivation });
+            const { ciphertext, iv } = (0, crypto_1.encryptWithKey)(vaultKey, encKey);
+            // persist passkey record
+            this.update((state) => {
+                state.passkeyRecord = {
+                    credential: {
+                        ...credential,
+                        counter: Math.max(newCounter, credential.counter),
+                    },
+                    encryptedVaultKey: { ciphertext, iv },
+                    keyDerivation,
+                };
+            });
+        }
+        finally {
+            // delete registration ceremony
+            __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").deleteRegistrationCeremony(challenge);
+        }
     }
     /**
      * Verifies an authentication assertion and returns the decrypted vault key.
      *
-     * Prefer orchestrated methods ({@link unlockWithPasskey},
-     * {@link exportSeedPhraseWithPasskey}, {@link exportAccountsWithPasskey}) for product
-     * flows instead of calling KeyringController with the returned key manually.
-     *
      * @param authenticationResponse - Result of `navigator.credentials.get()`.
      * @returns The plaintext vault encryption key.
      */
     async retrieveVaultKeyWithPasskey(authenticationResponse) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse));
-    }
-    /**
-     * Unlocks the keyring using a passkey authentication assertion.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @returns Resolves when the keyring is unlocked.
-     */
-    async unlockWithPasskey(authenticationResponse) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
-            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
-            await this.messenger.call('KeyringController:submitEncryptionKey', vaultKey);
-        });
-    }
-    /**
-     * Exports the seed phrase after passkey step-up authentication.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @param keyringId - Optional keyring id; defaults to the primary HD keyring.
-     * @returns Raw seed phrase bytes from KeyringController.
-     */
-    async exportSeedPhraseWithPasskey(authenticationResponse, keyringId) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
-            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
-            return await this.messenger.call('KeyringController:exportSeedPhrase', { encryptionKey: vaultKey }, keyringId);
-        });
-    }
-    /**
-     * Exports private keys for the given addresses after passkey step-up authentication.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @param addresses - Account addresses to export.
-     * @returns Private keys in the same order as `addresses`.
-     */
-    async exportAccountsWithPasskey(authenticationResponse, addresses) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
-            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
-            const privateKeys = [];
-            for (const address of addresses) {
-                privateKeys.push(await this.messenger.call('KeyringController:exportAccount', { encryptionKey: vaultKey }, address));
+        const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
+        // verify authentication response and update counter
+        const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, passkeyRecord.credential);
+        this.update((state) => {
+            if (!state.passkeyRecord) {
+                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, { code: constants_1.PasskeyControllerErrorCode.NotEnrolled });
             }
-            return privateKeys;
+            state.passkeyRecord.credential.counter = Math.max(newCounter, state.passkeyRecord.credential.counter);
         });
+        // derive key
+        const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, passkeyRecord);
+        // decrypt vault key
+        try {
+            const vaultKey = (0, crypto_1.decryptWithKey)(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
+            return vaultKey;
+        }
+        catch (cause) {
+            log('Error decrypting vault key with passkey', cause instanceof Error ? cause : new Error(String(cause)));
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
+                code: constants_1.PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
+                cause: cause instanceof Error ? cause : new Error(String(cause)),
+            });
+        }
     }
     /**
      * Checks whether the given authentication assertion is valid for the enrolled passkey.
@@ -341,7 +375,16 @@ class PasskeyController extends base_controller_1.BaseController {
      * @returns `true` if verification succeeds, otherwise `false`.
      */
     async verifyPasskeyAuthentication(authenticationResponse) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, authenticationResponse));
+        try {
+            await this.retrieveVaultKeyWithPasskey(authenticationResponse);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof errors_1.PasskeyControllerError && error.code !== undefined) {
+                return false;
+            }
+            throw error;
+        }
     }
     /**
      * Re-wraps the vault key after rotation. Updates persisted `encryptedVaultKey` on success.
@@ -351,62 +394,59 @@ class PasskeyController extends base_controller_1.BaseController {
      * pass the same `authenticationResponse` you just verified (e.g. from
      * {@link retrieveVaultKeyWithPasskey} / {@link verifyPasskeyAuthentication}).
      *
-     * For password change with passkey step-up, prefer
-     * {@link changePasswordWithPasskeyVerification}, which orchestrates keyring export,
-     * `changePassword`, and re-wrap in one call.
-     *
      * @param params - Re-wrap inputs.
      * @param params.authenticationResponse - Used to derive the wrapping key.
      * @param params.oldVaultKey - Expected current vault key.
      * @param params.newVaultKey - New vault key to encrypt under the passkey.
-     * @returns Resolves when the passkey record is updated.
      */
     async renewVaultKeyProtection(params) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_renewVaultKeyProtection).call(this, params));
-    }
-    /**
-     * Changes the wallet password after passkey step-up authentication.
-     *
-     * When `renewVaultKeyProtection` is `true` (default), re-wraps the vault key under the
-     * passkey after rotation. When `false`, removes the passkey instead.
-     *
-     * @param params - Change-password inputs.
-     * @param params.newPassword - New wallet password.
-     * @param params.authenticationResponse - Result of `navigator.credentials.get()`.
-     * @param params.options - Optional flow controls.
-     * @param params.options.renewVaultKeyProtection - Re-wrap vault key after password change.
-     * @returns Resolves when the password change completes.
-     */
-    async changePasswordWithPasskeyVerification(params) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_changePasswordWithPasskeyVerification).call(this, params));
-    }
-    /**
-     * Removes the enrolled passkey after verifying a passkey authentication assertion.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @returns Resolves when the passkey is removed.
-     */
-    async removePasskeyWithPasskeyVerification(authenticationResponse) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskeyWithPasskeyVerification).call(this, authenticationResponse));
+        const { authenticationResponse } = params;
+        const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
+        // derive key
+        const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, passkeyRecord);
+        // decrypt vault key
+        let decryptedVaultKey;
+        try {
+            decryptedVaultKey = (0, crypto_1.decryptWithKey)(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
+        }
+        catch (error) {
+            log('Error decrypting vault key during passkey vault key renewal', error instanceof Error ? error : new Error(String(error)));
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
+                code: constants_1.PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
+                cause: error instanceof Error ? error : new Error(String(error)),
+            });
+        }
+        // check if vault key matches
+        const { oldVaultKey, newVaultKey } = params;
+        if (!(0, utils_1.areUint8ArraysEqual)((0, utils_1.stringToBytes)(decryptedVaultKey), (0, utils_1.stringToBytes)(oldVaultKey))) {
+            log('Passkey renewal rejected: decrypted vault key does not match oldVaultKey');
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyMismatch, { code: constants_1.PasskeyControllerErrorCode.VaultKeyMismatch });
+        }
+        // encrypt new vault key
+        const { ciphertext, iv } = (0, crypto_1.encryptWithKey)(newVaultKey, encKey);
+        // persist passkey record (mutate current state only for vault key material)
+        this.update((state) => {
+            if (!state.passkeyRecord) {
+                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, {
+                    code: constants_1.PasskeyControllerErrorCode.NotEnrolled,
+                });
+            }
+            state.passkeyRecord.encryptedVaultKey = { ciphertext, iv };
+        });
     }
     /**
-     * Removes the enrolled passkey after verifying the wallet password.
-     *
-     * @param password - Wallet password for step-up verification.
-     * @returns Resolves when the passkey is removed.
+     * Clears enrolled passkey state and in-flight ceremonies. Call only after the same
+     * auth gate as renewal (verified passkey assertion or password).
      */
-    async removePasskeyWithPasswordVerification(password) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskeyWithPasswordVerification).call(this, password));
+    removePasskey() {
+        this.update(() => getDefaultPasskeyControllerState());
+        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").clear();
     }
     /**
      * Resets state and clears in-flight registration/authentication ceremonies.
-     *
-     * For user-facing passkey removal with step-up, use
-     * {@link removePasskeyWithPasskeyVerification} or
-     * {@link removePasskeyWithPasswordVerification}.
      */
     clearState() {
-        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
+        this.removePasskey();
     }
     /**
      * Releases all in-flight ceremony state and tears down the messenger.
@@ -417,188 +457,16 @@ class PasskeyController extends base_controller_1.BaseController {
     }
 }
 exports.PasskeyController = PasskeyController;
-_PasskeyController_ceremonyManager = new WeakMap(), _PasskeyController_expectedRPIDs = new WeakMap(), _PasskeyController_rpId = new WeakMap(), _PasskeyController_rpName = new WeakMap(), _PasskeyController_expectedOrigin = new WeakMap(), _PasskeyController_userName = new WeakMap(), _PasskeyController_userDisplayName = new WeakMap(), _PasskeyController_getIsOnboardingCompleted = new WeakMap(), _PasskeyController_operationMutex = new WeakMap(), _PasskeyController_instances = new WeakSet(), _PasskeyController_protectVaultKeyWithPasskey = async function _PasskeyController_protectVaultKeyWithPasskey(params) {
-    if (this.isPasskeyEnrolled()) {
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AlreadyEnrolled, { code: constants_1.PasskeyControllerErrorCode.AlreadyEnrolled });
-    }
-    await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_assertEnrollmentAllowed).call(this, params.password);
-    const vaultKey = await this.messenger.call('KeyringController:exportEncryptionKey');
-    const { registrationResponse, authenticationResponse } = params;
-    // get registration ceremony
-    const challenge = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_getChallengeFromClientData).call(this, registrationResponse.response.clientDataJSON);
-    const registrationCeremony = __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").getRegistrationCeremony(challenge);
-    if (!registrationCeremony) {
-        log('No active passkey registration ceremony for challenge');
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NoRegistrationCeremony, { code: constants_1.PasskeyControllerErrorCode.NoRegistrationCeremony });
-    }
-    try {
-        // verify registration response
-        const { verified, registrationInfo } = await (0, verify_registration_response_1.verifyRegistrationResponse)({
-            response: registrationResponse,
-            expectedChallenge: registrationCeremony.challenge,
-            expectedOrigin: __classPrivateFieldGet(this, _PasskeyController_expectedOrigin, "f"),
-            expectedRPIDs: __classPrivateFieldGet(this, _PasskeyController_expectedRPIDs, "f"),
-            requireUserVerification: true,
-        }).catch((error) => {
-            log('Error verifying passkey registration response', error);
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.RegistrationVerificationFailed, {
-                code: constants_1.PasskeyControllerErrorCode.RegistrationVerificationFailed,
-                cause: error instanceof Error ? error : new Error(String(error)),
-            });
-        });
-        if (!verified || !registrationInfo) {
-            log('Passkey registration verification returned unverified or missing registration info');
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.RegistrationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.RegistrationVerificationFailed });
-        }
-        // verify authentication response
-        const credential = {
-            id: registrationInfo.credentialId,
-            publicKey: (0, encoding_1.bytesToBase64URL)(registrationInfo.publicKey),
-            counter: registrationInfo.counter,
-            transports: registrationInfo.transports,
-            aaguid: registrationInfo.aaguid,
-        };
-        const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, credential);
-        // determine key derivation method
-        const prfFirst = authenticationResponse.clientExtensionResults?.prf?.results?.first;
-        const authHasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;
-        const keyDerivation = authHasPrfOutput && registrationCeremony.prfSalt
-            ? { method: 'prf', prfSalt: registrationCeremony.prfSalt }
-            : { method: 'userHandle' };
-        if (keyDerivation.method === 'userHandle' &&
-            authenticationResponse.response.userHandle !==
-                registrationCeremony.userHandle) {
-            log('Post-registration assertion userHandle does not match registration ceremony');
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.AuthenticationVerificationFailed });
-        }
-        // derive key and encrypt vault key
-        const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, { credential, keyDerivation });
-        const { ciphertext, iv } = (0, crypto_1.encryptWithKey)(vaultKey, encKey);
-        // persist passkey record
-        this.update((state) => {
-            state.passkeyRecord = {
-                credential: {
-                    ...credential,
-                    counter: Math.max(newCounter, credential.counter),
-                },
-                encryptedVaultKey: { ciphertext, iv },
-                keyDerivation,
-            };
-        });
-    }
-    finally {
-        // delete registration ceremony
-        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").deleteRegistrationCeremony(challenge);
-    }
-}, _PasskeyController_retrieveVaultKeyWithPasskey = async function _PasskeyController_retrieveVaultKeyWithPasskey(authenticationResponse) {
-    const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    // verify authentication response and update counter
-    const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, passkeyRecord.credential);
-    this.update((state) => {
-        if (!state.passkeyRecord) {
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, { code: constants_1.PasskeyControllerErrorCode.NotEnrolled });
-        }
-        state.passkeyRecord.credential.counter = Math.max(newCounter, state.passkeyRecord.credential.counter);
-    });
-    // derive key
-    const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, passkeyRecord);
-    // decrypt vault key
-    try {
-        const vaultKey = (0, crypto_1.decryptWithKey)(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
-        return vaultKey;
-    }
-    catch (cause) {
-        log('Error decrypting vault key with passkey', cause instanceof Error ? cause : new Error(String(cause)));
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
-            code: constants_1.PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
-            cause: cause instanceof Error ? cause : new Error(String(cause)),
-        });
-    }
-}, _PasskeyController_verifyPasskeyAuthentication = async function _PasskeyController_verifyPasskeyAuthentication(authenticationResponse) {
-    try {
-        await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
-        return true;
-    }
-    catch (error) {
-        if (error instanceof errors_1.PasskeyControllerError && error.code !== undefined) {
-            return false;
-        }
-        throw error;
-    }
-}, _PasskeyController_renewVaultKeyProtection = async function _PasskeyController_renewVaultKeyProtection(params) {
-    const { authenticationResponse } = params;
-    const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    // derive key
-    const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, passkeyRecord);
-    // decrypt vault key
-    let decryptedVaultKey;
-    try {
-        decryptedVaultKey = (0, crypto_1.decryptWithKey)(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
-    }
-    catch (error) {
-        log('Error decrypting vault key during passkey vault key renewal', error instanceof Error ? error : new Error(String(error)));
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
-            code: constants_1.PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
-            cause: error instanceof Error ? error : new Error(String(error)),
-        });
-    }
-    // check if vault key matches
-    const { oldVaultKey, newVaultKey } = params;
-    if (!(0, utils_1.areUint8ArraysEqual)((0, utils_1.stringToBytes)(decryptedVaultKey), (0, utils_1.stringToBytes)(oldVaultKey))) {
-        log('Passkey renewal rejected: decrypted vault key does not match oldVaultKey');
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyMismatch, { code: constants_1.PasskeyControllerErrorCode.VaultKeyMismatch });
-    }
-    // encrypt new vault key
-    const { ciphertext, iv } = (0, crypto_1.encryptWithKey)(newVaultKey, encKey);
-    // persist passkey record (mutate current state only for vault key material)
-    this.update((state) => {
-        if (!state.passkeyRecord) {
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, {
-                code: constants_1.PasskeyControllerErrorCode.NotEnrolled,
-            });
-        }
-        state.passkeyRecord.encryptedVaultKey = { ciphertext, iv };
-    });
-}, _PasskeyController_changePasswordWithPasskeyVerification = async function _PasskeyController_changePasswordWithPasskeyVerification(params) {
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    const verified = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, params.authenticationResponse);
-    if (!verified) {
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.AuthenticationVerificationFailed });
-    }
-    const renewVaultKeyProtection = params.options?.renewVaultKeyProtection ?? true;
-    if (!renewVaultKeyProtection) {
-        await this.messenger.call('KeyringController:changePassword', params.newPassword);
-        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
-        return;
-    }
-    const vaultKeyBefore = await this.messenger.call('KeyringController:exportEncryptionKey');
-    await this.messenger.call('KeyringController:changePassword', params.newPassword);
-    try {
-        const vaultKeyAfter = await this.messenger.call('KeyringController:exportEncryptionKey');
-        await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_renewVaultKeyProtection).call(this, {
-            authenticationResponse: params.authenticationResponse,
-            oldVaultKey: vaultKeyBefore,
-            newVaultKey: vaultKeyAfter,
-        });
-    }
-    catch (error) {
-        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyRenewalFailed, {
-            code: constants_1.PasskeyControllerErrorCode.VaultKeyRenewalFailed,
-            cause: error instanceof Error ? error : new Error(String(error)),
+_PasskeyController_ceremonyManager = new WeakMap(), _PasskeyController_expectedRPIDs = new WeakMap(), _PasskeyController_rpId = new WeakMap(), _PasskeyController_rpName = new WeakMap(), _PasskeyController_expectedOrigin = new WeakMap(), _PasskeyController_userName = new WeakMap(), _PasskeyController_userDisplayName = new WeakMap(), _PasskeyController_instances = new WeakSet(), _PasskeyController_requireEnrolled = function _PasskeyController_requireEnrolled() {
+    const record = this.state.passkeyRecord;
+    if (!record) {
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, {
+            code: constants_1.PasskeyControllerErrorCode.NotEnrolled,
         });
     }
-}, _PasskeyController_removePasskeyWithPasskeyVerification = async function _PasskeyController_removePasskeyWithPasskeyVerification(authenticationResponse) {
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    const verified = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, authenticationResponse);
-    if (!verified) {
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.AuthenticationVerificationFailed });
-    }
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
-}, _PasskeyController_removePasskeyWithPasswordVerification = async function _PasskeyController_removePasskeyWithPasswordVerification(password) {
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    await this.messenger.call('KeyringController:verifyPassword', password);
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
+    return record;
+}, _PasskeyController_getChallengeFromClientData = function _PasskeyController_getChallengeFromClientData(clientDataJSON) {
+    return (0, decode_client_data_json_1.decodeClientDataJSON)(clientDataJSON).challenge;
 }, _PasskeyController_verifyAuthenticationResponse = 
 /**
  * Validates a WebAuthn authentication response against stored credential data.
@@ -649,35 +517,5 @@ async function _PasskeyController_verifyAuthenticationResponse(authenticationRes
         // delete authentication ceremony
         __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").deleteAuthenticationCeremony(challenge);
     }
-}, _PasskeyController_withOperationLock = 
-/**
- * Serializes orchestrated passkey operations that mutate state or call KeyringController.
- *
- * @param callback - Operation to run while the mutex is held.
- * @returns The result of the callback.
- */
-async function _PasskeyController_withOperationLock(callback) {
-    return __classPrivateFieldGet(this, _PasskeyController_operationMutex, "f").runExclusive(callback);
-}, _PasskeyController_assertEnrollmentAllowed = async function _PasskeyController_assertEnrollmentAllowed(password) {
-    if (!__classPrivateFieldGet(this, _PasskeyController_getIsOnboardingCompleted, "f").call(this)) {
-        return;
-    }
-    if (!password) {
-        throw new Error(constants_1.PasskeyControllerErrorMessage.EnrollmentPasswordRequired);
-    }
-    await this.messenger.call('KeyringController:verifyPassword', password);
-}, _PasskeyController_requireEnrolled = function _PasskeyController_requireEnrolled() {
-    const record = this.state.passkeyRecord;
-    if (!record) {
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, {
-            code: constants_1.PasskeyControllerErrorCode.NotEnrolled,
-        });
-    }
-    return record;
-}, _PasskeyController_getChallengeFromClientData = function _PasskeyController_getChallengeFromClientData(clientDataJSON) {
-    return (0, decode_client_data_json_1.decodeClientDataJSON)(clientDataJSON).challenge;
-}, _PasskeyController_removePasskey = function _PasskeyController_removePasskey() {
-    this.update(() => getDefaultPasskeyControllerState());
-    __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").clear();
 };
 //# sourceMappingURL=PasskeyController.cjs.map