@metamask-previews/passkey-controller 3.1.0-preview-4f4c98e → 3.1.0-preview-eb263b0ee

package/dist/webauthn/verify-signature.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.cjs","sourceRoot":"","sources":["../../src/webauthn/verify-signature.ts"],"names":[],"mappings":";;;AAAA,2CAA8C;AAC9C,mDAAgD;AAChD,6CAAsD;AACtD,6CAA4D;AAE5D,uDAAwD;AACxD,kDAAqE;AAIrE;;;;;GAKG;AACH,SAAS,UAAU,CAAC,aAA4B;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAChB,aAA4B,EAC5B,SAAqB,EACrB,IAAgB;IAEhB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,GAAG,CAAW,CAAC;IACtD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,CAAC,CAAe,CAAC;IAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,CAAC,CAAe,CAAC;IAE3D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,mBAAW,EAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3E,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,sBAAO,CAAC,IAAI;YACf,OAAO,WAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAA,aAAM,EAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D,KAAK,sBAAO,CAAC,IAAI;YACf,OAAO,WAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAA,aAAM,EAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D,KAAK,sBAAO,CAAC,IAAI;YACf,OAAO,WAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAA,aAAM,EAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D;YACE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAChB,aAA4B,EAC5B,SAAqB,EACrB,IAAgB;IAEhB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,CAAC,CAAe,CAAC;IAE3D,IAAI,GAAG,KAAK,sBAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,KAAK,sBAAO,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,iBAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,SAAS,CACtB,aAA4B,EAC5B,SAAqB,EACrB,IAAgB;IAEhB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,CAAC,CAAe,CAAC;IAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAQ,CAAC,CAAC,CAAe,CAAC;IAE7D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,gBAAiD,CAAC;IACtD,IAAI,OAAe,CAAC;IACpB,IAAI,UAA8B,CAAC;IACnC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,sBAAO,CAAC,GAAG;YACd,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,OAAO,GAAG,OAAO,CAAC;YAClB,MAAM;QACR,KAAK,sBAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM;QACR,KAAK,sBAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM;QACR,KAAK,sBAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM;QACR,KAAK,sBAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,SAAS,CAAC;YAC7B,OAAO,GAAG,SAAS,CAAC;YACpB,UAAU,GAAG,EAAE,CAAC;YAChB,MAAM;QACR,KAAK,sBAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,SAAS,CAAC;YAC7B,OAAO,GAAG,SAAS,CAAC;YACpB,UAAU,GAAG,EAAE,CAAC;YAChB,MAAM;QACR,KAAK,sBAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,SAAS,CAAC;YAC7B,OAAO,GAAG,SAAS,CAAC;YACpB,UAAU,GAAG,EAAE,CAAC;YAChB,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL;QACE,GAAG,EAAE,KAAK;QACV,CAAC,EAAE,IAAA,8BAAgB,EAAC,OAAO,CAAC;QAC5B,CAAC,EAAE,IAAA,8BAAgB,EAAC,QAAQ,CAAC;KAC9B,EACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EACnD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,MAAM,eAAe,GACnB,gBAAgB,KAAK,SAAS;QAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAoB,EAAE;QACvD,CAAC,CAAC,mBAAmB,CAAC;IAE1B,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpC,eAAe,EACf,GAAG,EACH,cAAc,EACd,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,eAAe,CAAC,IAIrC;IACC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAEtC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,sBAAO,CAAC,GAAG;YACd,OAAO,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,sBAAO,CAAC,GAAG;YACd,OAAO,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,sBAAO,CAAC,GAAG;YACd,OAAO,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD;YACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAlBD,0CAkBC","sourcesContent":["import { concatBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\nimport { p256, p384, p521 } from '@noble/curves/nist';\nimport { sha256, sha384, sha512 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from '../utils/encoding.js';\nimport { COSEALG, COSECRV, COSEKEYS, COSEKTY } from './constants.js';\n\ntype COSEPublicKey = Map<number, number | Uint8Array>;\n\n/**\n * Get the key type from a COSE public key map.\n *\n * @param cosePublicKey - COSE public key map.\n * @returns The COSEKTY value.\n */\nfunction getKeyType(cosePublicKey: COSEPublicKey): number {\n  const kty = cosePublicKey.get(COSEKEYS.Kty);\n  if (typeof kty !== 'number') {\n    throw new Error('COSE public key missing kty');\n  }\n  return kty;\n}\n\n/**\n * Verify an EC2 (P-256, P-384, P-521) signature using @noble/curves.\n *\n * ECDSA requires the data to be hashed with the curve-appropriate\n * algorithm before verification: SHA-256 for P-256 and SHA-384 for P-384.\n *\n * @param cosePublicKey - COSE-encoded EC2 public key.\n * @param signature - DER-encoded ECDSA signature.\n * @param data - Data that was signed.\n * @returns Whether the signature is valid.\n */\nfunction verifyEC2(\n  cosePublicKey: COSEPublicKey,\n  signature: Uint8Array,\n  data: Uint8Array,\n): boolean {\n  const alg = cosePublicKey.get(COSEKEYS.Alg);\n  const crv = cosePublicKey.get(COSEKEYS.Crv) as number;\n  const xCoord = cosePublicKey.get(COSEKEYS.X) as Uint8Array;\n  const yCoord = cosePublicKey.get(COSEKEYS.Y) as Uint8Array;\n\n  if (typeof alg !== 'number') {\n    throw new Error('EC2 public key missing alg');\n  }\n\n  if (!xCoord || !yCoord) {\n    throw new Error('EC2 public key missing x or y coordinate');\n  }\n\n  const uncompressed = concatBytes([new Uint8Array([0x04]), xCoord, yCoord]);\n\n  switch (crv) {\n    case COSECRV.P256:\n      return p256.verify(signature, sha256(data), uncompressed);\n    case COSECRV.P384:\n      return p384.verify(signature, sha384(data), uncompressed);\n    case COSECRV.P521:\n      return p521.verify(signature, sha512(data), uncompressed);\n    default:\n      throw new Error(`Unsupported EC2 curve: ${crv}`);\n  }\n}\n\n/**\n * Verify an OKP (Ed25519) signature using @noble/curves.\n *\n * @param cosePublicKey - COSE-encoded OKP public key.\n * @param signature - Raw Ed25519 signature (64 bytes).\n * @param data - Data that was signed.\n * @returns Whether the signature is valid.\n */\nfunction verifyOKP(\n  cosePublicKey: COSEPublicKey,\n  signature: Uint8Array,\n  data: Uint8Array,\n): boolean {\n  const alg = cosePublicKey.get(COSEKEYS.Alg);\n  const crv = cosePublicKey.get(COSEKEYS.Crv);\n  const xCoord = cosePublicKey.get(COSEKEYS.X) as Uint8Array;\n\n  if (alg !== COSEALG.EdDSA) {\n    throw new Error(`Unexpected OKP algorithm: ${String(alg)}`);\n  }\n\n  if (crv !== COSECRV.ED25519) {\n    throw new Error(`Unsupported OKP curve: ${String(crv)}`);\n  }\n\n  if (!xCoord) {\n    throw new Error('OKP public key missing x coordinate');\n  }\n\n  return ed25519.verify(signature, data, xCoord);\n}\n\n/**\n * Verify an RSA signature using Web Crypto API.\n *\n * @param cosePublicKey - COSE-encoded RSA public key.\n * @param signature - RSA PKCS#1 v1.5 signature.\n * @param data - Data that was signed.\n * @returns Whether the signature is valid.\n */\nasync function verifyRSA(\n  cosePublicKey: COSEPublicKey,\n  signature: Uint8Array,\n  data: Uint8Array,\n): Promise<boolean> {\n  const alg = cosePublicKey.get(COSEKEYS.Alg);\n  const modulus = cosePublicKey.get(COSEKEYS.N) as Uint8Array;\n  const exponent = cosePublicKey.get(COSEKEYS.E) as Uint8Array;\n\n  if (typeof alg !== 'number') {\n    throw new Error('RSA public key missing alg');\n  }\n\n  if (!modulus || !exponent) {\n    throw new Error('RSA public key missing n or e');\n  }\n\n  let keyAlgorithmName: 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';\n  let hashAlg: string;\n  let saltLength: number | undefined;\n  switch (alg) {\n    case COSEALG.RS1:\n      keyAlgorithmName = 'RSASSA-PKCS1-v1_5';\n      hashAlg = 'SHA-1';\n      break;\n    case COSEALG.RS256:\n      keyAlgorithmName = 'RSASSA-PKCS1-v1_5';\n      hashAlg = 'SHA-256';\n      break;\n    case COSEALG.RS384:\n      keyAlgorithmName = 'RSASSA-PKCS1-v1_5';\n      hashAlg = 'SHA-384';\n      break;\n    case COSEALG.RS512:\n      keyAlgorithmName = 'RSASSA-PKCS1-v1_5';\n      hashAlg = 'SHA-512';\n      break;\n    case COSEALG.PS256:\n      keyAlgorithmName = 'RSA-PSS';\n      hashAlg = 'SHA-256';\n      saltLength = 32;\n      break;\n    case COSEALG.PS384:\n      keyAlgorithmName = 'RSA-PSS';\n      hashAlg = 'SHA-384';\n      saltLength = 48;\n      break;\n    case COSEALG.PS512:\n      keyAlgorithmName = 'RSA-PSS';\n      hashAlg = 'SHA-512';\n      saltLength = 64;\n      break;\n    default:\n      throw new Error(`Unsupported RSA algorithm: ${alg}`);\n  }\n\n  const key = await globalThis.crypto.subtle.importKey(\n    'jwk',\n    {\n      kty: 'RSA',\n      n: bytesToBase64URL(modulus),\n      e: bytesToBase64URL(exponent),\n    },\n    { name: keyAlgorithmName, hash: { name: hashAlg } },\n    false,\n    ['verify'],\n  );\n\n  const verifyAlgorithm =\n    keyAlgorithmName === 'RSA-PSS'\n      ? { name: 'RSA-PSS', saltLength: saltLength as number }\n      : 'RSASSA-PKCS1-v1_5';\n\n  const signatureBytes = Uint8Array.from(signature);\n  const dataBytes = Uint8Array.from(data);\n  return globalThis.crypto.subtle.verify(\n    verifyAlgorithm,\n    key,\n    signatureBytes,\n    dataBytes,\n  );\n}\n\n/**\n * Verify a WebAuthn signature using the appropriate algorithm based on\n * the COSE key type.\n *\n * Uses @noble/curves for EC2 and OKP (synchronous, audited, handles DER\n * natively). Falls back to Web Crypto API for RSA.\n *\n * @param opts - Options object.\n * @param opts.cosePublicKey - COSE-encoded public key as a Map.\n * @param opts.signature - The signature bytes.\n * @param opts.data - The data that was signed.\n * @returns Whether the signature is valid.\n */\nexport async function verifySignature(opts: {\n  cosePublicKey: COSEPublicKey;\n  signature: Uint8Array;\n  data: Uint8Array;\n}): Promise<boolean> {\n  const { cosePublicKey, signature, data } = opts;\n  const kty = getKeyType(cosePublicKey);\n\n  switch (kty) {\n    case COSEKTY.EC2:\n      return verifyEC2(cosePublicKey, signature, data);\n    case COSEKTY.OKP:\n      return verifyOKP(cosePublicKey, signature, data);\n    case COSEKTY.RSA:\n      return verifyRSA(cosePublicKey, signature, data);\n    default:\n      throw new Error(`Unsupported COSE key type: ${kty}`);\n  }\n}\n"]}

package/dist/webauthn/{verify-signature.d.ts → verify-signature.d.cts}

@@ -18,4 +18,4 @@ export declare function verifySignature(opts: {
     data: Uint8Array;
 }): Promise<boolean>;
 export {};
-//# sourceMappingURL=verify-signature.d.ts.map
+//# sourceMappingURL=verify-signature.d.cts.map

package/dist/webauthn/verify-signature.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.d.cts","sourceRoot":"","sources":["../../src/webauthn/verify-signature.ts"],"names":[],"mappings":"AAQA,KAAK,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;AAsLtD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;CAClB,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB"}

package/dist/webauthn/verify-signature.d.mts

@@ -0,0 +1,21 @@
+type COSEPublicKey = Map<number, number | Uint8Array>;
+/**
+ * Verify a WebAuthn signature using the appropriate algorithm based on
+ * the COSE key type.
+ *
+ * Uses @noble/curves for EC2 and OKP (synchronous, audited, handles DER
+ * natively). Falls back to Web Crypto API for RSA.
+ *
+ * @param opts - Options object.
+ * @param opts.cosePublicKey - COSE-encoded public key as a Map.
+ * @param opts.signature - The signature bytes.
+ * @param opts.data - The data that was signed.
+ * @returns Whether the signature is valid.
+ */
+export declare function verifySignature(opts: {
+    cosePublicKey: COSEPublicKey;
+    signature: Uint8Array;
+    data: Uint8Array;
+}): Promise<boolean>;
+export {};
+//# sourceMappingURL=verify-signature.d.mts.map

package/dist/webauthn/verify-signature.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.d.mts","sourceRoot":"","sources":["../../src/webauthn/verify-signature.ts"],"names":[],"mappings":"AAQA,KAAK,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;AAsLtD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;CAClB,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB"}

package/dist/webauthn/{verify-signature.js → verify-signature.mjs}

@@ -1,9 +1,9 @@
-import { concatBytes } from '@metamask/utils';
-import { ed25519 } from '@noble/curves/ed25519';
-import { p256, p384, p521 } from '@noble/curves/nist';
-import { sha256, sha384, sha512 } from '@noble/hashes/sha2';
-import { bytesToBase64URL } from '../utils/encoding.js';
-import { COSEALG, COSECRV, COSEKEYS, COSEKTY } from './constants.js';
+import { concatBytes } from "@metamask/utils";
+import { ed25519 } from "@noble/curves/ed25519";
+import { p256, p384, p521 } from "@noble/curves/nist";
+import { sha256, sha384, sha512 } from "@noble/hashes/sha2";
+import { bytesToBase64URL } from "../utils/encoding.mjs";
+import { COSEALG, COSECRV, COSEKEYS, COSEKTY } from "./constants.mjs";
 /**
  * Get the key type from a COSE public key map.
  *
@@ -169,4 +169,4 @@ export async function verifySignature(opts) {
             throw new Error(`Unsupported COSE key type: ${kty}`);
     }
 }
-//# sourceMappingURL=verify-signature.js.map
+//# sourceMappingURL=verify-signature.mjs.map

package/dist/webauthn/verify-signature.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.mjs","sourceRoot":"","sources":["../../src/webauthn/verify-signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,wBAAwB;AAC9C,OAAO,EAAE,OAAO,EAAE,8BAA8B;AAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B;AAE5D,OAAO,EAAE,gBAAgB,EAAE,8BAA6B;AACxD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAuB;AAIrE;;;;;GAKG;AACH,SAAS,UAAU,CAAC,aAA4B;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAChB,aAA4B,EAC5B,SAAqB,EACrB,IAAgB;IAEhB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAW,CAAC;IACtD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAe,CAAC;IAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAe,CAAC;IAE3D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3E,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO,CAAC,IAAI;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D,KAAK,OAAO,CAAC,IAAI;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D,KAAK,OAAO,CAAC,IAAI;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D;YACE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAChB,aAA4B,EAC5B,SAAqB,EACrB,IAAgB;IAEhB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAe,CAAC;IAE3D,IAAI,GAAG,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,SAAS,CACtB,aAA4B,EAC5B,SAAqB,EACrB,IAAgB;IAEhB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAe,CAAC;IAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAe,CAAC;IAE7D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,gBAAiD,CAAC;IACtD,IAAI,OAAe,CAAC;IACpB,IAAI,UAA8B,CAAC;IACnC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO,CAAC,GAAG;YACd,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,OAAO,GAAG,OAAO,CAAC;YAClB,MAAM;QACR,KAAK,OAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM;QACR,KAAK,OAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM;QACR,KAAK,OAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,mBAAmB,CAAC;YACvC,OAAO,GAAG,SAAS,CAAC;YACpB,MAAM;QACR,KAAK,OAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,SAAS,CAAC;YAC7B,OAAO,GAAG,SAAS,CAAC;YACpB,UAAU,GAAG,EAAE,CAAC;YAChB,MAAM;QACR,KAAK,OAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,SAAS,CAAC;YAC7B,OAAO,GAAG,SAAS,CAAC;YACpB,UAAU,GAAG,EAAE,CAAC;YAChB,MAAM;QACR,KAAK,OAAO,CAAC,KAAK;YAChB,gBAAgB,GAAG,SAAS,CAAC;YAC7B,OAAO,GAAG,SAAS,CAAC;YACpB,UAAU,GAAG,EAAE,CAAC;YAChB,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL;QACE,GAAG,EAAE,KAAK;QACV,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAC5B,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC;KAC9B,EACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EACnD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,MAAM,eAAe,GACnB,gBAAgB,KAAK,SAAS;QAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAoB,EAAE;QACvD,CAAC,CAAC,mBAAmB,CAAC;IAE1B,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpC,eAAe,EACf,GAAG,EACH,cAAc,EACd,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAIrC;IACC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAEtC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO,CAAC,GAAG;YACd,OAAO,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,OAAO,CAAC,GAAG;YACd,OAAO,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,OAAO,CAAC,GAAG;YACd,OAAO,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD;YACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC","sourcesContent":["import { concatBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\nimport { p256, p384, p521 } from '@noble/curves/nist';\nimport { sha256, sha384, sha512 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from '../utils/encoding.js';\nimport { COSEALG, COSECRV, COSEKEYS, COSEKTY } from './constants.js';\n\ntype COSEPublicKey = Map<number, number | Uint8Array>;\n\n/**\n * Get the key type from a COSE public key map.\n *\n * @param cosePublicKey - COSE public key map.\n * @returns The COSEKTY value.\n */\nfunction getKeyType(cosePublicKey: COSEPublicKey): number {\n  const kty = cosePublicKey.get(COSEKEYS.Kty);\n  if (typeof kty !== 'number') {\n    throw new Error('COSE public key missing kty');\n  }\n  return kty;\n}\n\n/**\n * Verify an EC2 (P-256, P-384, P-521) signature using @noble/curves.\n *\n * ECDSA requires the data to be hashed with the curve-appropriate\n * algorithm before verification: SHA-256 for P-256 and SHA-384 for P-384.\n *\n * @param cosePublicKey - COSE-encoded EC2 public key.\n * @param signature - DER-encoded ECDSA signature.\n * @param data - Data that was signed.\n * @returns Whether the signature is valid.\n */\nfunction verifyEC2(\n  cosePublicKey: COSEPublicKey,\n  signature: Uint8Array,\n  data: Uint8Array,\n): boolean {\n  const alg = cosePublicKey.get(COSEKEYS.Alg);\n  const crv = cosePublicKey.get(COSEKEYS.Crv) as number;\n  const xCoord = cosePublicKey.get(COSEKEYS.X) as Uint8Array;\n  const yCoord = cosePublicKey.get(COSEKEYS.Y) as Uint8Array;\n\n  if (typeof alg !== 'number') {\n    throw new Error('EC2 public key missing alg');\n  }\n\n  if (!xCoord || !yCoord) {\n    throw new Error('EC2 public key missing x or y coordinate');\n  }\n\n  const uncompressed = concatBytes([new Uint8Array([0x04]), xCoord, yCoord]);\n\n  switch (crv) {\n    case COSECRV.P256:\n      return p256.verify(signature, sha256(data), uncompressed);\n    case COSECRV.P384:\n      return p384.verify(signature, sha384(data), uncompressed);\n    case COSECRV.P521:\n      return p521.verify(signature, sha512(data), uncompressed);\n    default:\n      throw new Error(`Unsupported EC2 curve: ${crv}`);\n  }\n}\n\n/**\n * Verify an OKP (Ed25519) signature using @noble/curves.\n *\n * @param cosePublicKey - COSE-encoded OKP public key.\n * @param signature - Raw Ed25519 signature (64 bytes).\n * @param data - Data that was signed.\n * @returns Whether the signature is valid.\n */\nfunction verifyOKP(\n  cosePublicKey: COSEPublicKey,\n  signature: Uint8Array,\n  data: Uint8Array,\n): boolean {\n  const alg = cosePublicKey.get(COSEKEYS.Alg);\n  const crv = cosePublicKey.get(COSEKEYS.Crv);\n  const xCoord = cosePublicKey.get(COSEKEYS.X) as Uint8Array;\n\n  if (alg !== COSEALG.EdDSA) {\n    throw new Error(`Unexpected OKP algorithm: ${String(alg)}`);\n  }\n\n  if (crv !== COSECRV.ED25519) {\n    throw new Error(`Unsupported OKP curve: ${String(crv)}`);\n  }\n\n  if (!xCoord) {\n    throw new Error('OKP public key missing x coordinate');\n  }\n\n  return ed25519.verify(signature, data, xCoord);\n}\n\n/**\n * Verify an RSA signature using Web Crypto API.\n *\n * @param cosePublicKey - COSE-encoded RSA public key.\n * @param signature - RSA PKCS#1 v1.5 signature.\n * @param data - Data that was signed.\n * @returns Whether the signature is valid.\n */\nasync function verifyRSA(\n  cosePublicKey: COSEPublicKey,\n  signature: Uint8Array,\n  data: Uint8Array,\n): Promise<boolean> {\n  const alg = cosePublicKey.get(COSEKEYS.Alg);\n  const modulus = cosePublicKey.get(COSEKEYS.N) as Uint8Array;\n  const exponent = cosePublicKey.get(COSEKEYS.E) as Uint8Array;\n\n  if (typeof alg !== 'number') {\n    throw new Error('RSA public key missing alg');\n  }\n\n  if (!modulus || !exponent) {\n    throw new Error('RSA public key missing n or e');\n  }\n\n  let keyAlgorithmName: 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';\n  let hashAlg: string;\n  let saltLength: number | undefined;\n  switch (alg) {\n    case COSEALG.RS1:\n      keyAlgorithmName = 'RSASSA-PKCS1-v1_5';\n      hashAlg = 'SHA-1';\n      break;\n    case COSEALG.RS256:\n      keyAlgorithmName = 'RSASSA-PKCS1-v1_5';\n      hashAlg = 'SHA-256';\n      break;\n    case COSEALG.RS384:\n      keyAlgorithmName = 'RSASSA-PKCS1-v1_5';\n      hashAlg = 'SHA-384';\n      break;\n    case COSEALG.RS512:\n      keyAlgorithmName = 'RSASSA-PKCS1-v1_5';\n      hashAlg = 'SHA-512';\n      break;\n    case COSEALG.PS256:\n      keyAlgorithmName = 'RSA-PSS';\n      hashAlg = 'SHA-256';\n      saltLength = 32;\n      break;\n    case COSEALG.PS384:\n      keyAlgorithmName = 'RSA-PSS';\n      hashAlg = 'SHA-384';\n      saltLength = 48;\n      break;\n    case COSEALG.PS512:\n      keyAlgorithmName = 'RSA-PSS';\n      hashAlg = 'SHA-512';\n      saltLength = 64;\n      break;\n    default:\n      throw new Error(`Unsupported RSA algorithm: ${alg}`);\n  }\n\n  const key = await globalThis.crypto.subtle.importKey(\n    'jwk',\n    {\n      kty: 'RSA',\n      n: bytesToBase64URL(modulus),\n      e: bytesToBase64URL(exponent),\n    },\n    { name: keyAlgorithmName, hash: { name: hashAlg } },\n    false,\n    ['verify'],\n  );\n\n  const verifyAlgorithm =\n    keyAlgorithmName === 'RSA-PSS'\n      ? { name: 'RSA-PSS', saltLength: saltLength as number }\n      : 'RSASSA-PKCS1-v1_5';\n\n  const signatureBytes = Uint8Array.from(signature);\n  const dataBytes = Uint8Array.from(data);\n  return globalThis.crypto.subtle.verify(\n    verifyAlgorithm,\n    key,\n    signatureBytes,\n    dataBytes,\n  );\n}\n\n/**\n * Verify a WebAuthn signature using the appropriate algorithm based on\n * the COSE key type.\n *\n * Uses @noble/curves for EC2 and OKP (synchronous, audited, handles DER\n * natively). Falls back to Web Crypto API for RSA.\n *\n * @param opts - Options object.\n * @param opts.cosePublicKey - COSE-encoded public key as a Map.\n * @param opts.signature - The signature bytes.\n * @param opts.data - The data that was signed.\n * @returns Whether the signature is valid.\n */\nexport async function verifySignature(opts: {\n  cosePublicKey: COSEPublicKey;\n  signature: Uint8Array;\n  data: Uint8Array;\n}): Promise<boolean> {\n  const { cosePublicKey, signature, data } = opts;\n  const kty = getKeyType(cosePublicKey);\n\n  switch (kty) {\n    case COSEKTY.EC2:\n      return verifyEC2(cosePublicKey, signature, data);\n    case COSEKTY.OKP:\n      return verifyOKP(cosePublicKey, signature, data);\n    case COSEKTY.RSA:\n      return verifyRSA(cosePublicKey, signature, data);\n    default:\n      throw new Error(`Unsupported COSE key type: ${kty}`);\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask-previews/passkey-controller",
-  "version": "3.1.0-preview-4f4c98e",
+  "version": "3.1.0-preview-eb263b0ee",
   "description": "Controller and utilities for passkey-based wallet unlock",
   "keywords": [
     "Ethereum",
@@ -18,12 +18,19 @@
   "files": [
     "dist/"
   ],
-  "type": "module",
   "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.cts",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     },
     "./package.json": "./package.json"
   },
@@ -32,11 +39,9 @@
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
-    "build": "tsc --project tsconfig.build.json",
-    "build:all": "tsc --build tsconfig.build.json --verbose",
-    "build:clean": "yarn build:only-clean && yarn build",
+    "build": "ts-bridge --project tsconfig.build.json --verbose --clean --no-references",
+    "build:all": "ts-bridge --project tsconfig.build.json --verbose --clean",
     "build:docs": "typedoc",
-    "build:only-clean": "rimraf './dist' './tsconfig.build.tsbuildinfo'",
     "changelog:update": "../../scripts/update-changelog.sh @metamask/passkey-controller",
     "changelog:validate": "../../scripts/validate-changelog.sh @metamask/passkey-controller",
     "lint:tsconfigs": "tsx ../../scripts/lint-tsconfigs/lint-tsconfigs.mts",
@@ -63,18 +68,18 @@
   },
   "devDependencies": {
     "@metamask/auto-changelog": "^6.1.0",
+    "@ts-bridge/cli": "^0.6.4",
     "@types/jest": "^30.0.0",
-    "@typescript/native": "npm:typescript@^7.0.2",
     "deepmerge": "^4.2.2",
     "jest": "^30.4.2",
-    "rimraf": "^5.0.5",
+    "jest-environment-node": "^30.4.1",
     "ts-jest": "^29.4.11",
     "tsx": "^4.20.5",
     "typedoc": "^0.25.13",
     "typedoc-plugin-missing-exports": "^2.0.0",
-    "typescript": "npm:@typescript/typescript6@^6.0.2"
+    "typescript": "~5.3.3"
   },
   "engines": {
-    "node": "^22.14.0 || ^24"
+    "node": "^18.18 || >=20"
   }
 }

package/dist/PasskeyController-method-action-types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PasskeyController-method-action-types.d.ts","sourceRoot":"","sources":["../src/PasskeyController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE;;;;GAIG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oEAAoE,GAC9E;IACE,IAAI,EAAE,iEAAiE,CAAC;IACxE,OAAO,EAAE,iBAAiB,CAAC,+CAA+C,CAAC,CAAC;CAC7E,CAAC;AAEJ;;;;GAIG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iDAAiD,GAAG;IAC9D,IAAI,EAAE,8CAA8C,CAAC;IACrD,OAAO,EAAE,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,iBAAiB,CAAC,sCAAsC,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;CAC1C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;CACvC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,8BAA8B,GACtC,wCAAwC,GACxC,kDAAkD,GAClD,oEAAoE,GACpE,oDAAoD,GACpD,iDAAiD,GACjD,kDAAkD,GAClD,wCAAwC,GACxC,kDAAkD,GAClD,gDAAgD,GAChD,kDAAkD,GAClD,8CAA8C,GAC9C,4DAA4D,GAC5D,2DAA2D,GAC3D,4DAA4D,GAC5D,iCAAiC,GACjC,8BAA8B,CAAC"}

package/dist/PasskeyController-method-action-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PasskeyController-method-action-types.js","sourceRoot":"","sources":["../src/PasskeyController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { PasskeyController } from './PasskeyController.js';\n\n/**\n * Whether a passkey is enrolled and vault key material is stored.\n *\n * @returns `true` if enrolled, otherwise `false`.\n */\nexport type PasskeyControllerIsPasskeyEnrolledAction = {\n  type: `PasskeyController:isPasskeyEnrolled`;\n  handler: PasskeyController['isPasskeyEnrolled'];\n};\n\n/**\n * Builds WebAuthn credential creation options for passkey enrollment.\n *\n * @param creationOptionsConfig - Optional creation behavior.\n * @param creationOptionsConfig.prfAvailable - Request the PRF extension unless `false`. Defaults to `true`.\n * @returns Public key credential creation options for `navigator.credentials.create()`.\n */\nexport type PasskeyControllerGenerateRegistrationOptionsAction = {\n  type: `PasskeyController:generateRegistrationOptions`;\n  handler: PasskeyController['generateRegistrationOptions'];\n};\n\n/**\n * Builds WebAuthn credential request options for the post-registration\n * authentication step (between `create` and {@link protectVaultKeyWithPasskey}).\n *\n * @param params - Input for the pending registration ceremony.\n * @param params.registrationResponse - Result of `navigator.credentials.create()`.\n * @returns Public key credential request options for `navigator.credentials.get()`.\n */\nexport type PasskeyControllerGeneratePostRegistrationAuthenticationOptionsAction =\n  {\n    type: `PasskeyController:generatePostRegistrationAuthenticationOptions`;\n    handler: PasskeyController['generatePostRegistrationAuthenticationOptions'];\n  };\n\n/**\n * Builds WebAuthn credential request options for the enrolled passkey.\n *\n * @returns Public key credential request options for `navigator.credentials.get()`.\n */\nexport type PasskeyControllerGenerateAuthenticationOptionsAction = {\n  type: `PasskeyController:generateAuthenticationOptions`;\n  handler: PasskeyController['generateAuthenticationOptions'];\n};\n\n/**\n * Verifies registration and post-registration authentication, then stores the\n * vault key encrypted under the new passkey.\n *\n * Fetches the current vault encryption key from KeyringController before wrapping.\n * When onboarding is complete, requires `password` for step-up verification first.\n *\n * @param params - Enrollment completion inputs.\n * @param params.registrationResponse - Result of `navigator.credentials.create()`.\n * @param params.authenticationResponse - Result of `navigator.credentials.get()` after {@link generatePostRegistrationAuthenticationOptions}.\n * @param params.password - Wallet password when onboarding is complete (step-up).\n * @returns Resolves when enrollment completes.\n */\nexport type PasskeyControllerProtectVaultKeyWithPasskeyAction = {\n  type: `PasskeyController:protectVaultKeyWithPasskey`;\n  handler: PasskeyController['protectVaultKeyWithPasskey'];\n};\n\n/**\n * Verifies an authentication assertion and returns the decrypted vault key.\n *\n * Prefer orchestrated methods ({@link unlockWithPasskey},\n * {@link exportSeedPhraseWithPasskey}, {@link exportAccountsWithPasskey}) for product\n * flows instead of calling KeyringController with the returned key manually.\n *\n * @param authenticationResponse - Result of `navigator.credentials.get()`.\n * @returns The plaintext vault encryption key.\n */\nexport type PasskeyControllerRetrieveVaultKeyWithPasskeyAction = {\n  type: `PasskeyController:retrieveVaultKeyWithPasskey`;\n  handler: PasskeyController['retrieveVaultKeyWithPasskey'];\n};\n\n/**\n * Unlocks the keyring using a passkey authentication assertion.\n *\n * @param authenticationResponse - Result of `navigator.credentials.get()`.\n * @returns Resolves when the keyring is unlocked.\n */\nexport type PasskeyControllerUnlockWithPasskeyAction = {\n  type: `PasskeyController:unlockWithPasskey`;\n  handler: PasskeyController['unlockWithPasskey'];\n};\n\n/**\n * Exports the seed phrase after passkey step-up authentication.\n *\n * @param authenticationResponse - Result of `navigator.credentials.get()`.\n * @param keyringId - Optional keyring id; defaults to the primary HD keyring.\n * @returns Raw seed phrase bytes from KeyringController.\n */\nexport type PasskeyControllerExportSeedPhraseWithPasskeyAction = {\n  type: `PasskeyController:exportSeedPhraseWithPasskey`;\n  handler: PasskeyController['exportSeedPhraseWithPasskey'];\n};\n\n/**\n * Exports private keys for the given addresses after passkey step-up authentication.\n *\n * @param authenticationResponse - Result of `navigator.credentials.get()`.\n * @param addresses - Account addresses to export.\n * @returns Private keys in the same order as `addresses`.\n */\nexport type PasskeyControllerExportAccountsWithPasskeyAction = {\n  type: `PasskeyController:exportAccountsWithPasskey`;\n  handler: PasskeyController['exportAccountsWithPasskey'];\n};\n\n/**\n * Checks whether the given authentication assertion is valid for the enrolled passkey.\n *\n * On failure, returns `false` for {@link PasskeyControllerError} with a `code`;\n * other errors propagate.\n *\n * @param authenticationResponse - Result of `navigator.credentials.get()`.\n * @returns `true` if verification succeeds, otherwise `false`.\n */\nexport type PasskeyControllerVerifyPasskeyAuthenticationAction = {\n  type: `PasskeyController:verifyPasskeyAuthentication`;\n  handler: PasskeyController['verifyPasskeyAuthentication'];\n};\n\n/**\n * Re-wraps the vault key after rotation. Updates persisted `encryptedVaultKey` on success.\n *\n * Does not verify WebAuthn or ceremony state—call only after your layer has authenticated\n * the user (passkey `get()` + verified assertion, or verified password). On passkey paths,\n * pass the same `authenticationResponse` you just verified (e.g. from\n * {@link retrieveVaultKeyWithPasskey} / {@link verifyPasskeyAuthentication}).\n *\n * For password change with passkey step-up, prefer\n * {@link changePasswordWithPasskeyVerification}, which orchestrates keyring export,\n * `changePassword`, and re-wrap in one call.\n *\n * @param params - Re-wrap inputs.\n * @param params.authenticationResponse - Used to derive the wrapping key.\n * @param params.oldVaultKey - Expected current vault key.\n * @param params.newVaultKey - New vault key to encrypt under the passkey.\n * @returns Resolves when the passkey record is updated.\n */\nexport type PasskeyControllerRenewVaultKeyProtectionAction = {\n  type: `PasskeyController:renewVaultKeyProtection`;\n  handler: PasskeyController['renewVaultKeyProtection'];\n};\n\n/**\n * Changes the wallet password after passkey step-up authentication.\n *\n * When `renewVaultKeyProtection` is `true` (default), re-wraps the vault key under the\n * passkey after rotation. When `false`, removes the passkey instead.\n *\n * @param params - Change-password inputs.\n * @param params.newPassword - New wallet password.\n * @param params.authenticationResponse - Result of `navigator.credentials.get()`.\n * @param params.options - Optional flow controls.\n * @param params.options.renewVaultKeyProtection - Re-wrap vault key after password change.\n * @returns Resolves when the password change completes.\n */\nexport type PasskeyControllerChangePasswordWithPasskeyVerificationAction = {\n  type: `PasskeyController:changePasswordWithPasskeyVerification`;\n  handler: PasskeyController['changePasswordWithPasskeyVerification'];\n};\n\n/**\n * Removes the enrolled passkey after verifying a passkey authentication assertion.\n *\n * @param authenticationResponse - Result of `navigator.credentials.get()`.\n * @returns Resolves when the passkey is removed.\n */\nexport type PasskeyControllerRemovePasskeyWithPasskeyVerificationAction = {\n  type: `PasskeyController:removePasskeyWithPasskeyVerification`;\n  handler: PasskeyController['removePasskeyWithPasskeyVerification'];\n};\n\n/**\n * Removes the enrolled passkey after verifying the wallet password.\n *\n * @param password - Wallet password for step-up verification.\n * @returns Resolves when the passkey is removed.\n */\nexport type PasskeyControllerRemovePasskeyWithPasswordVerificationAction = {\n  type: `PasskeyController:removePasskeyWithPasswordVerification`;\n  handler: PasskeyController['removePasskeyWithPasswordVerification'];\n};\n\n/**\n * Resets state and clears in-flight registration/authentication ceremonies.\n *\n * For user-facing passkey removal with step-up, use\n * {@link removePasskeyWithPasskeyVerification} or\n * {@link removePasskeyWithPasswordVerification}.\n */\nexport type PasskeyControllerClearStateAction = {\n  type: `PasskeyController:clearState`;\n  handler: PasskeyController['clearState'];\n};\n\n/**\n * Releases all in-flight ceremony state and tears down the messenger.\n */\nexport type PasskeyControllerDestroyAction = {\n  type: `PasskeyController:destroy`;\n  handler: PasskeyController['destroy'];\n};\n\n/**\n * Union of all PasskeyController action types.\n */\nexport type PasskeyControllerMethodActions =\n  | PasskeyControllerIsPasskeyEnrolledAction\n  | PasskeyControllerGenerateRegistrationOptionsAction\n  | PasskeyControllerGeneratePostRegistrationAuthenticationOptionsAction\n  | PasskeyControllerGenerateAuthenticationOptionsAction\n  | PasskeyControllerProtectVaultKeyWithPasskeyAction\n  | PasskeyControllerRetrieveVaultKeyWithPasskeyAction\n  | PasskeyControllerUnlockWithPasskeyAction\n  | PasskeyControllerExportSeedPhraseWithPasskeyAction\n  | PasskeyControllerExportAccountsWithPasskeyAction\n  | PasskeyControllerVerifyPasskeyAuthenticationAction\n  | PasskeyControllerRenewVaultKeyProtectionAction\n  | PasskeyControllerChangePasswordWithPasskeyVerificationAction\n  | PasskeyControllerRemovePasskeyWithPasskeyVerificationAction\n  | PasskeyControllerRemovePasskeyWithPasswordVerificationAction\n  | PasskeyControllerClearStateAction\n  | PasskeyControllerDestroyAction;\n"]}

package/dist/PasskeyController.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PasskeyController.d.ts","sourceRoot":"","sources":["../src/PasskeyController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAK3D,OAAO,EACL,cAAc,EAGf,MAAM,gBAAgB,CAAC;AAIxB,OAAO,KAAK,EAEV,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EAKvB,MAAM,YAAY,CAAC;AASpB,OAAO,KAAK,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAI7B,YAAY,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,+BAA+B,EAC/B,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,kCAAkC,GACnC,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,wBAAgB,gCAAgC,IAAI,sBAAsB,CAEzE;AAaD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B;IACrC,uBAAuB,UAAU,sBAAsB,KAAG,OAAO;CAElE,CAAC;AAqBF;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CACnD,OAAO,cAAc,EACrB,sBAAsB,EACtB,0BAA0B,CAC3B;;IAmBC;;;;;;;;;;;;;OAaG;IACH,YAAY,EACV,SAAS,EACT,KAAU,EACV,IAAI,EACJ,YAAY,EACZ,MAAM,EACN,cAAc,EACd,QAAQ,EACR,eAAe,EACf,wBAAwB,GACzB,EAAE,wBAAwB,EAuB1B;IAED;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAE3B;IAED;;;;;;OAMG;IACH,2BAA2B,CAAC,qBAAqB,CAAC,EAAE;QAClD,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,GAAG,0BAA0B,CAqD7B;IAED;;;;;;;OAOG;IACH,6CAA6C,CAAC,MAAM,EAAE;QACpD,oBAAoB,EAAE,2BAA2B,CAAC;KACnD,GAAG,4BAA4B,CA+C/B;IAED;;;;OAIG;IACH,6BAA6B,IAAI,4BAA4B,CAgC5D;IAED;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,MAAM,EAAE;QACvC,oBAAoB,EAAE,2BAA2B,CAAC;QAClD,sBAAsB,EAAE,6BAA6B,CAAC;QACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;IA6HD;;;;;;;;;OASG;IACG,2BAA2B,CAC/B,sBAAsB,EAAE,6BAA6B,GACpD,OAAO,CAAC,MAAM,CAAC,CAIjB;IAsDD;;;;;OAKG;IACG,iBAAiB,CACrB,sBAAsB,EAAE,6BAA6B,GACpD,OAAO,CAAC,IAAI,CAAC,CAUf;IAED;;;;;;OAMG;IACG,2BAA2B,CAC/B,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAWrB;IAED;;;;;;OAMG;IACG,yBAAyB,CAC7B,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBnB;IAED;;;;;;;;OAQG;IACG,2BAA2B,CAC/B,sBAAsB,EAAE,6BAA6B,GACpD,OAAO,CAAC,OAAO,CAAC,CAIlB;IAgBD;;;;;;;;;;;;;;;;;OAiBG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,sBAAsB,EAAE,6BAA6B,CAAC;QACtD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;IAwED;;;;;;;;;;;;OAYG;IACG,qCAAqC,CAAC,MAAM,EAAE;QAClD,WAAW,EAAE,MAAM,CAAC;QACpB,sBAAsB,EAAE,6BAA6B,CAAC;QACtD,OAAO,CAAC,EAAE;YAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KACjD,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;IA4DD;;;;;OAKG;IACG,oCAAoC,CACxC,sBAAsB,EAAE,6BAA6B,GACpD,OAAO,CAAC,IAAI,CAAC,CAIf;IAoBD;;;;;OAKG;IACG,qCAAqC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;IAUD;;;;;;OAMG;IACH,UAAU,IAAI,IAAI,CAEjB;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;CA8HF"}

package/dist/PasskeyController.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PasskeyController.js","sourceRoot":"","sources":["../src/PasskeyController.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mCAAmC,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAWhE,OAAO,EACL,cAAc,EACd,cAAc,EACd,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAO7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAaxF;;;;GAIG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,yBAAyB,GAAG;IAChC,aAAa,EAAE;QACb,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;QACzB,QAAQ,EAAE,IAAI;KACf;CAC8C,CAAC;AAElD,MAAM,GAAG,GAAG,kBAAkB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,uBAAuB,EAAE,CAAC,KAA6B,EAAW,EAAE,CAClE,KAAK,CAAC,aAAa,KAAK,IAAI;CAC/B,CAAC;AAEF,MAAM,yBAAyB,GAAG;IAChC,mBAAmB;IACnB,6BAA6B;IAC7B,+CAA+C;IAC/C,+BAA+B;IAC/B,4BAA4B;IAC5B,6BAA6B;IAC7B,mBAAmB;IACnB,6BAA6B;IAC7B,yBAAyB;IACzB,uCAAuC;IACvC,6BAA6B;IAC7B,2BAA2B;IAC3B,sCAAsC;IACtC,uCAAuC;IACvC,YAAY;IACZ,SAAS;CACD,CAAC;AAEX;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,cAItC;IAmBC;;;;;;;;;;;;;OAaG;IACH,YAAY,EACV,SAAS,EACT,KAAK,GAAG,EAAE,EACV,IAAI,EACJ,YAAY,EACZ,MAAM,EACN,cAAc,EACd,QAAQ,EACR,eAAe,EACf,wBAAwB,GACC;QACzB,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ,EAAE,yBAAyB;YACnC,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,gCAAgC,EAAE,EAAE,GAAG,KAAK,EAAE;SAC3D,CAAC,CAAC;;QAhDI,6CAAmB,IAAI,eAAe,EAAE,EAAC;QAEzC,mDAAyB;QAEzB,0CAA0B;QAE1B,4CAAgB;QAEhB,oDAAmC;QAEnC,8CAAkB;QAElB,qDAAyB;QAEzB,8DAAyC;QAEzC,4CAAkB,IAAI,KAAK,EAAE,EAAC;QAkCrC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC/C,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACnB,uBAAA,IAAI,oCAAkB,CAAC,GAAG,aAAa,CAAC,MAAA,CAAC;QACzC,uBAAA,IAAI,2BAAS,IAAI,MAAA,CAAC;QAClB,uBAAA,IAAI,6BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,qCAAmB,cAAc,MAAA,CAAC;QACtC,uBAAA,IAAI,+BAAa,QAAQ,IAAI,MAAM,MAAA,CAAC;QACpC,uBAAA,IAAI,sCAAoB,eAAe,IAAI,MAAM,MAAA,CAAC;QAClD,uBAAA,IAAI,+CAA6B,wBAAwB,MAAA,CAAC;QAE1D,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,OAAO,0BAA0B,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,2BAA2B,CAAC,qBAE3B;QACC,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,eAAe,EAC7C,EAAE,IAAI,EAAE,0BAA0B,CAAC,eAAe,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,EAAE,YAAY,KAAK,KAAK,CAAC;QACjE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,UAAU,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAE7C,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAA+B;YAC1C,EAAE,EAAE;gBACF,IAAI,EAAE,uBAAA,IAAI,iCAAQ;gBAClB,EAAE,EAAE,uBAAA,IAAI,+BAAM;aACf;YACD,IAAI,EAAE;gBACJ,EAAE,EAAE,UAAU;gBACd,IAAI,EAAE,uBAAA,IAAI,mCAAU;gBACpB,WAAW,EAAE,uBAAA,IAAI,0CAAiB;aACnC;YACD,SAAS;YACT,gBAAgB,EAAE;gBAChB,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE;gBAC1C,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE;gBAC1C,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE;aAC3C;YACD,OAAO,EAAE,mBAAmB;YAC5B,sBAAsB,EAAE;gBACtB,gBAAgB,EAAE,UAAU;gBAC5B,uBAAuB,EAAE,UAAU;gBACnC,WAAW,EAAE,WAAW;aACzB;YACD,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;YAClC,WAAW,EAAE,MAAM;YACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,uBAAA,IAAI,0CAAiB,CAAC,wBAAwB,CAAC,SAAS,EAAE;YACxD,UAAU;YACV,OAAO;YACP,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,6CAA6C,CAAC,MAE7C;QACC,4BAA4B;QAC5B,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC;QACxC,MAAM,YAAY,GAAG,uBAAA,IAAI,mFAA4B,MAAhC,IAAI,EACvB,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAC7C,CAAC;QACF,MAAM,oBAAoB,GACxB,uBAAA,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,GAAG,CAAC,uDAAuD,CAAC,CAAC;YAC7D,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,sBAAsB,EACpD,EAAE,IAAI,EAAE,0BAA0B,CAAC,sBAAsB,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;YACjC,UAAU,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,OAAO,GAAiC;YAC5C,SAAS;YACT,IAAI,EAAE,uBAAA,IAAI,+BAAM;YAChB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,oBAAoB,CAAC,EAAE;oBAC3B,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,UAE7B;iBACd;aACF;YACD,gBAAgB,EAAE,UAAU;YAC5B,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;YAClC,OAAO,EAAE,mBAAmB;YAC5B,UAAU;SACX,CAAC;QAEF,qBAAqB;QACrB,uBAAA,IAAI,0CAAiB,CAAC,0BAA0B,CAAC,SAAS,EAAE;YAC1D,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,6BAA6B;QAC3B,MAAM,MAAM,GAAG,uBAAA,IAAI,wEAAiB,MAArB,IAAI,CAAmB,CAAC;QAEvC,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAE7C,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAiC;YAC5C,SAAS;YACT,IAAI,EAAE,uBAAA,IAAI,+BAAM;YAChB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;oBACxB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU;iBACzC;aACF;YACD,gBAAgB,EAAE,UAAU;YAC5B,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;YAClC,OAAO,EAAE,mBAAmB;YAC5B,UAAU;SACX,CAAC;QAEF,uBAAA,IAAI,0CAAiB,CAAC,0BAA0B,CAAC,SAAS,EAAE;YAC1D,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,0BAA0B,CAAC,MAIhC;QACC,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,GAAG,EAAE,CAClC,uBAAA,IAAI,mFAA4B,MAAhC,IAAI,EAA6B,MAAM,CAAC,CACzC,CAAC;IACJ,CAAC;IA6HD;;;;;;;;;OASG;IACH,KAAK,CAAC,2BAA2B,CAC/B,sBAAqD;QAErD,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,GAAG,EAAE,CAClC,uBAAA,IAAI,oFAA6B,MAAjC,IAAI,EAA8B,sBAAsB,CAAC,CAC1D,CAAC;IACJ,CAAC;IAsDD;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,sBAAqD;QAErD,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,KAAK,IAAI,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oFAA6B,MAAjC,IAAI,EACzB,sBAAsB,CACvB,CAAC;YACF,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvB,uCAAuC,EACvC,QAAQ,CACT,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,2BAA2B,CAC/B,sBAAqD,EACrD,SAAkB;QAElB,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,KAAK,IAAI,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oFAA6B,MAAjC,IAAI,EACzB,sBAAsB,CACvB,CAAC;YACF,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,oCAAoC,EACpC,EAAE,aAAa,EAAE,QAAQ,EAAE,EAC3B,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,yBAAyB,CAC7B,sBAAqD,EACrD,SAAmB;QAEnB,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,KAAK,IAAI,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oFAA6B,MAAjC,IAAI,EACzB,sBAAsB,CACvB,CAAC;YAEF,MAAM,WAAW,GAAa,EAAE,CAAC;YACjC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;gBAChC,WAAW,CAAC,IAAI,CACd,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvB,iCAAiC,EACjC,EAAE,aAAa,EAAE,QAAQ,EAAE,EAC3B,OAAO,CACR,CACF,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,2BAA2B,CAC/B,sBAAqD;QAErD,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,GAAG,EAAE,CAClC,uBAAA,IAAI,oFAA6B,MAAjC,IAAI,EAA8B,sBAAsB,CAAC,CAC1D,CAAC;IACJ,CAAC;IAgBD;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,uBAAuB,CAAC,MAI7B;QACC,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,GAAG,EAAE,CAAC,uBAAA,IAAI,gFAAyB,MAA7B,IAAI,EAA0B,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAwED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,qCAAqC,CAAC,MAI3C;QACC,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,GAAG,EAAE,CAClC,uBAAA,IAAI,8FAAuC,MAA3C,IAAI,EAAwC,MAAM,CAAC,CACpD,CAAC;IACJ,CAAC;IA4DD;;;;;OAKG;IACH,KAAK,CAAC,oCAAoC,CACxC,sBAAqD;QAErD,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,GAAG,EAAE,CAClC,uBAAA,IAAI,6FAAsC,MAA1C,IAAI,EAAuC,sBAAsB,CAAC,CACnE,CAAC;IACJ,CAAC;IAoBD;;;;;OAKG;IACH,KAAK,CAAC,qCAAqC,CAAC,QAAgB;QAC1D,OAAO,uBAAA,IAAI,0EAAmB,MAAvB,IAAI,EAAoB,GAAG,EAAE,CAClC,uBAAA,IAAI,8FAAuC,MAA3C,IAAI,EAAwC,QAAQ,CAAC,CACtD,CAAC;IACJ,CAAC;IAUD;;;;;;OAMG;IACH,UAAU;QACR,uBAAA,IAAI,sEAAe,MAAnB,IAAI,CAAiB,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,uBAAA,IAAI,0CAAiB,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC;CA8HF;4hBA7pBC,KAAK,wDAA6B,MAIjC;IACC,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,eAAe,EAC7C,EAAE,IAAI,EAAE,0BAA0B,CAAC,eAAe,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,MAAM,uBAAA,IAAI,gFAAyB,MAA7B,IAAI,EAA0B,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACxC,uCAAuC,CACxC,CAAC;IAEF,MAAM,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,GAAG,MAAM,CAAC;IAEhE,4BAA4B;IAC5B,MAAM,SAAS,GAAG,uBAAA,IAAI,mFAA4B,MAAhC,IAAI,EACpB,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAC7C,CAAC;IACF,MAAM,oBAAoB,GACxB,uBAAA,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,GAAG,CAAC,uDAAuD,CAAC,CAAC;QAC7D,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,sBAAsB,EACpD,EAAE,IAAI,EAAE,0BAA0B,CAAC,sBAAsB,EAAE,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,+BAA+B;QAC/B,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,0BAA0B,CAAC;YACtE,QAAQ,EAAE,oBAAoB;YAC9B,iBAAiB,EAAE,oBAAoB,CAAC,SAAS;YACjD,cAAc,EAAE,uBAAA,IAAI,yCAAgB;YACpC,aAAa,EAAE,uBAAA,IAAI,wCAAe;YAClC,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACjB,GAAG,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,8BAA8B,EAC5D;gBACE,IAAI,EAAE,0BAA0B,CAAC,8BAA8B;gBAC/D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACjE,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACnC,GAAG,CACD,oFAAoF,CACrF,CAAC;YACF,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,8BAA8B,EAC5D,EAAE,IAAI,EAAE,0BAA0B,CAAC,8BAA8B,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,UAAU,GAAG;YACjB,EAAE,EAAE,gBAAgB,CAAC,YAAY;YACjC,SAAS,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACvD,OAAO,EAAE,gBAAgB,CAAC,OAAO;YACjC,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,MAAM,EAAE,gBAAgB,CAAC,MAAM;SAChC,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAA,IAAI,qFAA8B,MAAlC,IAAI,EAC/B,sBAAsB,EACtB,UAAU,CACX,CAAC;QAEF,kCAAkC;QAClC,MAAM,QAAQ,GACZ,sBAAsB,CAAC,sBACxB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;QACvB,MAAM,gBAAgB,GACpB,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACtD,MAAM,aAAa,GACjB,gBAAgB,IAAI,oBAAoB,CAAC,OAAO;YAC9C,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE;YAC1D,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAE/B,IACE,aAAa,CAAC,MAAM,KAAK,YAAY;YACrC,sBAAsB,CAAC,QAAQ,CAAC,UAAU;gBACxC,oBAAoB,CAAC,UAAU,EACjC,CAAC;YACD,GAAG,CACD,6EAA6E,CAC9E,CAAC;YACF,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,gCAAgC,EAC9D,EAAE,IAAI,EAAE,0BAA0B,CAAC,gCAAgC,EAAE,CACtE,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,MAAM,MAAM,GAAG,mCAAmC,CAChD,sBAAsB,EACtB,EAAE,UAAU,EAAE,aAAa,EAAE,CAC9B,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE5D,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,aAAa,GAAG;gBACpB,UAAU,EAAE;oBACV,GAAG,UAAU;oBACb,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC;iBAClD;gBACD,iBAAiB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;gBACrC,aAAa;aACd,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,+BAA+B;QAC/B,uBAAA,IAAI,0CAAiB,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,mDAoBD,KAAK,yDACH,sBAAqD;IAErD,MAAM,aAAa,GAAG,uBAAA,IAAI,wEAAiB,MAArB,IAAI,CAAmB,CAAC;IAE9C,oDAAoD;IACpD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAA,IAAI,qFAA8B,MAAlC,IAAI,EAC/B,sBAAsB,EACtB,aAAa,CAAC,UAAU,CACzB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,WAAW,EACzC,EAAE,IAAI,EAAE,0BAA0B,CAAC,WAAW,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAC/C,UAAU,EACV,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,aAAa;IACb,MAAM,MAAM,GAAG,mCAAmC,CAChD,sBAAsB,EACtB,aAAa,CACd,CAAC;IAEF,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAC7B,aAAa,CAAC,iBAAiB,CAAC,UAAU,EAC1C,aAAa,CAAC,iBAAiB,CAAC,EAAE,EAClC,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CACD,yCAAyC,EACzC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,wBAAwB,EACtD;YACE,IAAI,EAAE,0BAA0B,CAAC,wBAAwB;YACzD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CACF,CAAC;IACJ,CAAC;AACH,CAAC,mDA4FD,KAAK,yDACH,sBAAqD;IAErD,IAAI,CAAC;QACH,MAAM,uBAAA,IAAI,oFAA6B,MAAjC,IAAI,EAA8B,sBAAsB,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,+CA4BD,KAAK,qDAA0B,MAI9B;IACC,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,aAAa,GAAG,uBAAA,IAAI,wEAAiB,MAArB,IAAI,CAAmB,CAAC;IAE9C,aAAa;IACb,MAAM,MAAM,GAAG,mCAAmC,CAChD,sBAAsB,EACtB,aAAa,CACd,CAAC;IAEF,oBAAoB;IACpB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,iBAAiB,GAAG,cAAc,CAChC,aAAa,CAAC,iBAAiB,CAAC,UAAU,EAC1C,aAAa,CAAC,iBAAiB,CAAC,EAAE,EAClC,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CACD,6DAA6D,EAC7D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,wBAAwB,EACtD;YACE,IAAI,EAAE,0BAA0B,CAAC,wBAAwB;YACzD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CACF,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC5C,IACE,CAAC,mBAAmB,CAClB,aAAa,CAAC,iBAAiB,CAAC,EAChC,aAAa,CAAC,WAAW,CAAC,CAC3B,EACD,CAAC;QACD,GAAG,CACD,0EAA0E,CAC3E,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,gBAAgB,EAC9C,EAAE,IAAI,EAAE,0BAA0B,CAAC,gBAAgB,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAE/D,4EAA4E;IAC5E,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,WAAW,EACzC;gBACE,IAAI,EAAE,0BAA0B,CAAC,WAAW;aAC7C,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,iBAAiB,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,6DAyBD,KAAK,mEAAwC,MAI5C;IACC,uBAAA,IAAI,wEAAiB,MAArB,IAAI,CAAmB,CAAC;IAExB,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oFAA6B,MAAjC,IAAI,EACzB,MAAM,CAAC,sBAAsB,CAC9B,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,gCAAgC,EAC9D,EAAE,IAAI,EAAE,0BAA0B,CAAC,gCAAgC,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,uBAAuB,GAC3B,MAAM,CAAC,OAAO,EAAE,uBAAuB,IAAI,IAAI,CAAC;IAElD,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvB,kCAAkC,EAClC,MAAM,CAAC,WAAW,CACnB,CAAC;QACF,uBAAA,IAAI,sEAAe,MAAnB,IAAI,CAAiB,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9C,uCAAuC,CACxC,CAAC;IACF,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvB,kCAAkC,EAClC,MAAM,CAAC,WAAW,CACnB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC7C,uCAAuC,CACxC,CAAC;QACF,MAAM,uBAAA,IAAI,gFAAyB,MAA7B,IAAI,EAA0B;YAClC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,WAAW,EAAE,cAAc;YAC3B,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uBAAA,IAAI,sEAAe,MAAnB,IAAI,CAAiB,CAAC;QACtB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,qBAAqB,EACnD;YACE,IAAI,EAAE,0BAA0B,CAAC,qBAAqB;YACtD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CACF,CAAC;IACJ,CAAC;AACH,CAAC,4DAgBD,KAAK,kEACH,sBAAqD;IAErD,uBAAA,IAAI,wEAAiB,MAArB,IAAI,CAAmB,CAAC;IAExB,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oFAA6B,MAAjC,IAAI,EACzB,sBAAsB,CACvB,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,gCAAgC,EAC9D,EAAE,IAAI,EAAE,0BAA0B,CAAC,gCAAgC,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,uBAAA,IAAI,sEAAe,MAAnB,IAAI,CAAiB,CAAC;AACxB,CAAC,6DAcD,KAAK,mEACH,QAAgB;IAEhB,uBAAA,IAAI,wEAAiB,MAArB,IAAI,CAAmB,CAAC;IACxB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC;IACxE,uBAAA,IAAI,sEAAe,MAAnB,IAAI,CAAiB,CAAC;AACxB,CAAC;AAqBD;;;;;;GAMG;AACH,KAAK,0DACH,sBAAqD,EACrD,UAAiC;IAEjC,gBAAgB;IAChB,MAAM,SAAS,GAAG,uBAAA,IAAI,mFAA4B,MAAhC,IAAI,EACpB,sBAAsB,CAAC,QAAQ,CAAC,cAAc,CAC/C,CAAC;IAEF,8BAA8B;IAC9B,MAAM,sBAAsB,GAC1B,uBAAA,IAAI,0CAAiB,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAC/D,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,wBAAwB,EACtD,EAAE,IAAI,EAAE,0BAA0B,CAAC,wBAAwB,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,iCAAiC;QACjC,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,QAAQ,EAAE,sBAAsB;YAChC,iBAAiB,EAAE,sBAAsB,CAAC,SAAS;YACnD,cAAc,EAAE,uBAAA,IAAI,yCAAgB;YACpC,aAAa,EAAE,uBAAA,IAAI,wCAAe;YAClC,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,SAAS,EAAE,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC;gBACjD,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC;YACD,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACjB,GAAG,CACD,iDAAiD,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;YACF,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,gCAAgC,EAC9D;gBACE,IAAI,EAAE,0BAA0B,CAAC,gCAAgC;gBACjE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACjE,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,GAAG,CAAC,yDAAyD,CAAC,CAAC;YAC/D,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,gCAAgC,EAC9D;gBACE,IAAI,EAAE,0BAA0B,CAAC,gCAAgC;aAClE,CACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,iCAAiC;QACjC,uBAAA,IAAI,0CAAiB,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,+CACH,QAA+B;IAE/B,OAAO,uBAAA,IAAI,yCAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC,+CAED,KAAK,qDAA0B,QAAiB;IAC9C,IAAI,CAAC,uBAAA,IAAI,mDAA0B,MAA9B,IAAI,CAA4B,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,0BAA0B,EACxD;YACE,IAAI,EAAE,0BAA0B,CAAC,0BAA0B;SAC5D,CACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;IAGC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,WAAW,EACzC;YACE,IAAI,EAAE,0BAA0B,CAAC,WAAW;SAC7C,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,yGAE2B,cAAsB;IAChD,OAAO,oBAAoB,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;IAMC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,EAAE,CAAC,CAAC;IACtD,uBAAA,IAAI,0CAAiB,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC","sourcesContent":["import type { StateMetadata } from '@metamask/base-controller';\nimport { BaseController } from '@metamask/base-controller';\nimport { areUint8ArraysEqual, stringToBytes } from '@metamask/utils';\nimport { Mutex } from 'async-mutex';\n\nimport { WEBAUTHN_TIMEOUT_MS, CeremonyManager } from './ceremony-manager.js';\nimport {\n  controllerName,\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants.js';\nimport { PasskeyControllerError } from './errors.js';\nimport { deriveKeyFromAuthenticationResponse } from './key-derivation.js';\nimport { createModuleLogger, projectLogger } from './logger.js';\nimport type {\n  AuthenticatorTransportFuture,\n  PasskeyControllerMessenger,\n  PasskeyControllerOptions,\n  PasskeyControllerState,\n  PasskeyCredentialInfo,\n  PasskeyKeyDerivation,\n  PasskeyRecord,\n  PrfClientExtensionResults,\n} from './types.js';\nimport {\n  decryptWithKey,\n  encryptWithKey,\n  randomBytesToBase64URL,\n} from './utils/crypto.js';\nimport { base64URLToBytes, bytesToBase64URL } from './utils/encoding.js';\nimport { COSEALG } from './webauthn/constants.js';\nimport { decodeClientDataJSON } from './webauthn/decode-client-data-json.js';\nimport type {\n  PasskeyAuthenticationOptions,\n  PasskeyAuthenticationResponse,\n  PasskeyRegistrationOptions,\n  PasskeyRegistrationResponse,\n} from './webauthn/types.js';\nimport { verifyAuthenticationResponse } from './webauthn/verify-authentication-response.js';\nimport { verifyRegistrationResponse } from './webauthn/verify-registration-response.js';\n\nexport type {\n  PasskeyControllerActions,\n  PasskeyControllerAllowedActions,\n  PasskeyControllerEvents,\n  PasskeyControllerGetStateAction,\n  PasskeyControllerMessenger,\n  PasskeyControllerOptions,\n  PasskeyControllerState,\n  PasskeyControllerStateChangedEvent,\n} from './types.js';\n\n/**\n * Returns the default (empty) state for {@link PasskeyController}.\n *\n * @returns A fresh state object with no enrolled passkey.\n */\nexport function getDefaultPasskeyControllerState(): PasskeyControllerState {\n  return { passkeyRecord: null };\n}\n\nconst passkeyControllerMetadata = {\n  passkeyRecord: {\n    persist: true,\n    includeInDebugSnapshot: false,\n    includeInStateLogs: false,\n    usedInUi: true,\n  },\n} satisfies StateMetadata<PasskeyControllerState>;\n\nconst log = createModuleLogger(projectLogger, controllerName);\n\n/**\n * Selectors for {@link PasskeyControllerState}.\n *\n * Use these instead of dedicated getter methods on the controller, so that\n * derived values can be consumed from Redux selectors and other places that\n * only have access to a state object.\n */\nexport const passkeyControllerSelectors = {\n  selectIsPasskeyEnrolled: (state: PasskeyControllerState): boolean =>\n    state.passkeyRecord !== null,\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'isPasskeyEnrolled',\n  'generateRegistrationOptions',\n  'generatePostRegistrationAuthenticationOptions',\n  'generateAuthenticationOptions',\n  'protectVaultKeyWithPasskey',\n  'retrieveVaultKeyWithPasskey',\n  'unlockWithPasskey',\n  'verifyPasskeyAuthentication',\n  'renewVaultKeyProtection',\n  'changePasswordWithPasskeyVerification',\n  'exportSeedPhraseWithPasskey',\n  'exportAccountsWithPasskey',\n  'removePasskeyWithPasskeyVerification',\n  'removePasskeyWithPasswordVerification',\n  'clearState',\n  'destroy',\n] as const;\n\n/**\n * Controller that enrolls a WebAuthn passkey and uses it to protect and unlock\n * the vault encryption key.\n */\nexport class PasskeyController extends BaseController<\n  typeof controllerName,\n  PasskeyControllerState,\n  PasskeyControllerMessenger\n> {\n  readonly #ceremonyManager = new CeremonyManager();\n\n  readonly #expectedRPIDs: string[];\n\n  readonly #rpId: string | undefined;\n\n  readonly #rpName: string;\n\n  readonly #expectedOrigin: string | string[];\n\n  readonly #userName: string;\n\n  readonly #userDisplayName: string;\n\n  readonly #getIsOnboardingCompleted: () => boolean;\n\n  readonly #operationMutex = new Mutex();\n\n  /**\n   * Creates a passkey controller with WebAuthn relying-party settings.\n   *\n   * @param options - Constructor options.\n   * @param options.messenger - The messenger to use for communication.\n   * @param options.state - The initial state of the controller.\n   * @param options.rpId - The relying party ID to use for the passkey.\n   * @param options.expectedRPID - The expected relying party ID to use for the passkey.\n   * @param options.rpName - The relying party name to use for the passkey.\n   * @param options.expectedOrigin - The expected origin to use for the passkey.\n   * @param options.userName - The user name to use for the passkey.\n   * @param options.userDisplayName - The user display name to use for the passkey.\n   * @param options.getIsOnboardingCompleted - The callback to use to check if onboarding is complete.\n   */\n  constructor({\n    messenger,\n    state = {},\n    rpId,\n    expectedRPID,\n    rpName,\n    expectedOrigin,\n    userName,\n    userDisplayName,\n    getIsOnboardingCompleted,\n  }: PasskeyControllerOptions) {\n    super({\n      messenger,\n      metadata: passkeyControllerMetadata,\n      name: controllerName,\n      state: { ...getDefaultPasskeyControllerState(), ...state },\n    });\n\n    const expectedRPIDs = Array.isArray(expectedRPID)\n      ? expectedRPID\n      : [expectedRPID];\n    this.#expectedRPIDs = [...expectedRPIDs];\n    this.#rpId = rpId;\n    this.#rpName = rpName;\n    this.#expectedOrigin = expectedOrigin;\n    this.#userName = userName ?? rpName;\n    this.#userDisplayName = userDisplayName ?? rpName;\n    this.#getIsOnboardingCompleted = getIsOnboardingCompleted;\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  /**\n   * Whether a passkey is enrolled and vault key material is stored.\n   *\n   * @returns `true` if enrolled, otherwise `false`.\n   */\n  isPasskeyEnrolled(): boolean {\n    return passkeyControllerSelectors.selectIsPasskeyEnrolled(this.state);\n  }\n\n  /**\n   * Builds WebAuthn credential creation options for passkey enrollment.\n   *\n   * @param creationOptionsConfig - Optional creation behavior.\n   * @param creationOptionsConfig.prfAvailable - Request the PRF extension unless `false`. Defaults to `true`.\n   * @returns Public key credential creation options for `navigator.credentials.create()`.\n   */\n  generateRegistrationOptions(creationOptionsConfig?: {\n    prfAvailable?: boolean;\n  }): PasskeyRegistrationOptions {\n    if (this.isPasskeyEnrolled()) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.AlreadyEnrolled,\n        { code: PasskeyControllerErrorCode.AlreadyEnrolled },\n      );\n    }\n\n    const includePrf = creationOptionsConfig?.prfAvailable !== false;\n    const prfSalt = includePrf ? randomBytesToBase64URL(32) : undefined;\n    const userHandle = randomBytesToBase64URL(64);\n    const challenge = randomBytesToBase64URL(32);\n\n    const extensions: Record<string, unknown> = {};\n    if (prfSalt) {\n      extensions.prf = { eval: { first: prfSalt } };\n    }\n\n    const options: PasskeyRegistrationOptions = {\n      rp: {\n        name: this.#rpName,\n        id: this.#rpId,\n      },\n      user: {\n        id: userHandle,\n        name: this.#userName,\n        displayName: this.#userDisplayName,\n      },\n      challenge,\n      pubKeyCredParams: [\n        { alg: COSEALG.EdDSA, type: 'public-key' },\n        { alg: COSEALG.ES256, type: 'public-key' },\n        { alg: COSEALG.RS256, type: 'public-key' },\n      ],\n      timeout: WEBAUTHN_TIMEOUT_MS,\n      authenticatorSelection: {\n        userVerification: 'required',\n        authenticatorAttachment: 'platform',\n        residentKey: 'preferred',\n      },\n      hints: ['client-device', 'hybrid'],\n      attestation: 'none',\n      ...(Object.keys(extensions).length > 0 ? { extensions } : {}),\n    };\n\n    this.#ceremonyManager.saveRegistrationCeremony(challenge, {\n      userHandle,\n      prfSalt,\n      challenge,\n      createdAt: Date.now(),\n    });\n\n    return options;\n  }\n\n  /**\n   * Builds WebAuthn credential request options for the post-registration\n   * authentication step (between `create` and {@link protectVaultKeyWithPasskey}).\n   *\n   * @param params - Input for the pending registration ceremony.\n   * @param params.registrationResponse - Result of `navigator.credentials.create()`.\n   * @returns Public key credential request options for `navigator.credentials.get()`.\n   */\n  generatePostRegistrationAuthenticationOptions(params: {\n    registrationResponse: PasskeyRegistrationResponse;\n  }): PasskeyAuthenticationOptions {\n    // get registration ceremony\n    const { registrationResponse } = params;\n    const regChallenge = this.#getChallengeFromClientData(\n      registrationResponse.response.clientDataJSON,\n    );\n    const registrationCeremony =\n      this.#ceremonyManager.getRegistrationCeremony(regChallenge);\n    if (!registrationCeremony) {\n      log('No active passkey registration ceremony for challenge');\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.NoRegistrationCeremony,\n        { code: PasskeyControllerErrorCode.NoRegistrationCeremony },\n      );\n    }\n\n    // build auth options\n    const challenge = randomBytesToBase64URL(32);\n    const extensions: Record<string, unknown> = {};\n    if (registrationCeremony.prfSalt) {\n      extensions.prf = { eval: { first: registrationCeremony.prfSalt } };\n    }\n    const options: PasskeyAuthenticationOptions = {\n      challenge,\n      rpId: this.#rpId,\n      allowCredentials: [\n        {\n          id: registrationResponse.id,\n          type: 'public-key',\n          transports: registrationResponse.response.transports as\n            | AuthenticatorTransportFuture[]\n            | undefined,\n        },\n      ],\n      userVerification: 'required',\n      hints: ['client-device', 'hybrid'],\n      timeout: WEBAUTHN_TIMEOUT_MS,\n      extensions,\n    };\n\n    // save auth ceremony\n    this.#ceremonyManager.saveAuthenticationCeremony(challenge, {\n      challenge,\n      createdAt: Date.now(),\n    });\n\n    return options;\n  }\n\n  /**\n   * Builds WebAuthn credential request options for the enrolled passkey.\n   *\n   * @returns Public key credential request options for `navigator.credentials.get()`.\n   */\n  generateAuthenticationOptions(): PasskeyAuthenticationOptions {\n    const record = this.#requireEnrolled();\n\n    const challenge = randomBytesToBase64URL(32);\n\n    const extensions: Record<string, unknown> = {};\n    if (record.keyDerivation.method === 'prf') {\n      extensions.prf = { eval: { first: record.keyDerivation.prfSalt } };\n    }\n\n    const options: PasskeyAuthenticationOptions = {\n      challenge,\n      rpId: this.#rpId,\n      allowCredentials: [\n        {\n          id: record.credential.id,\n          type: 'public-key',\n          transports: record.credential.transports,\n        },\n      ],\n      userVerification: 'required',\n      hints: ['client-device', 'hybrid'],\n      timeout: WEBAUTHN_TIMEOUT_MS,\n      extensions,\n    };\n\n    this.#ceremonyManager.saveAuthenticationCeremony(challenge, {\n      challenge,\n      createdAt: Date.now(),\n    });\n\n    return options;\n  }\n\n  /**\n   * Verifies registration and post-registration authentication, then stores the\n   * vault key encrypted under the new passkey.\n   *\n   * Fetches the current vault encryption key from KeyringController before wrapping.\n   * When onboarding is complete, requires `password` for step-up verification first.\n   *\n   * @param params - Enrollment completion inputs.\n   * @param params.registrationResponse - Result of `navigator.credentials.create()`.\n   * @param params.authenticationResponse - Result of `navigator.credentials.get()` after {@link generatePostRegistrationAuthenticationOptions}.\n   * @param params.password - Wallet password when onboarding is complete (step-up).\n   * @returns Resolves when enrollment completes.\n   */\n  async protectVaultKeyWithPasskey(params: {\n    registrationResponse: PasskeyRegistrationResponse;\n    authenticationResponse: PasskeyAuthenticationResponse;\n    password?: string;\n  }): Promise<void> {\n    return this.#withOperationLock(() =>\n      this.#protectVaultKeyWithPasskey(params),\n    );\n  }\n\n  async #protectVaultKeyWithPasskey(params: {\n    registrationResponse: PasskeyRegistrationResponse;\n    authenticationResponse: PasskeyAuthenticationResponse;\n    password?: string;\n  }): Promise<void> {\n    if (this.isPasskeyEnrolled()) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.AlreadyEnrolled,\n        { code: PasskeyControllerErrorCode.AlreadyEnrolled },\n      );\n    }\n\n    await this.#assertEnrollmentAllowed(params.password);\n    const vaultKey = await this.messenger.call(\n      'KeyringController:exportEncryptionKey',\n    );\n\n    const { registrationResponse, authenticationResponse } = params;\n\n    // get registration ceremony\n    const challenge = this.#getChallengeFromClientData(\n      registrationResponse.response.clientDataJSON,\n    );\n    const registrationCeremony =\n      this.#ceremonyManager.getRegistrationCeremony(challenge);\n    if (!registrationCeremony) {\n      log('No active passkey registration ceremony for challenge');\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.NoRegistrationCeremony,\n        { code: PasskeyControllerErrorCode.NoRegistrationCeremony },\n      );\n    }\n\n    try {\n      // verify registration response\n      const { verified, registrationInfo } = await verifyRegistrationResponse({\n        response: registrationResponse,\n        expectedChallenge: registrationCeremony.challenge,\n        expectedOrigin: this.#expectedOrigin,\n        expectedRPIDs: this.#expectedRPIDs,\n        requireUserVerification: true,\n      }).catch((error) => {\n        log('Error verifying passkey registration response', error);\n        throw new PasskeyControllerError(\n          PasskeyControllerErrorMessage.RegistrationVerificationFailed,\n          {\n            code: PasskeyControllerErrorCode.RegistrationVerificationFailed,\n            cause: error instanceof Error ? error : new Error(String(error)),\n          },\n        );\n      });\n      if (!verified || !registrationInfo) {\n        log(\n          'Passkey registration verification returned unverified or missing registration info',\n        );\n        throw new PasskeyControllerError(\n          PasskeyControllerErrorMessage.RegistrationVerificationFailed,\n          { code: PasskeyControllerErrorCode.RegistrationVerificationFailed },\n        );\n      }\n\n      // verify authentication response\n      const credential = {\n        id: registrationInfo.credentialId,\n        publicKey: bytesToBase64URL(registrationInfo.publicKey),\n        counter: registrationInfo.counter,\n        transports: registrationInfo.transports,\n        aaguid: registrationInfo.aaguid,\n      };\n      const { newCounter } = await this.#verifyAuthenticationResponse(\n        authenticationResponse,\n        credential,\n      );\n\n      // determine key derivation method\n      const prfFirst = (\n        authenticationResponse.clientExtensionResults as PrfClientExtensionResults\n      )?.prf?.results?.first;\n      const authHasPrfOutput =\n        typeof prfFirst === 'string' && prfFirst.length > 0;\n      const keyDerivation: PasskeyKeyDerivation =\n        authHasPrfOutput && registrationCeremony.prfSalt\n          ? { method: 'prf', prfSalt: registrationCeremony.prfSalt }\n          : { method: 'userHandle' };\n\n      if (\n        keyDerivation.method === 'userHandle' &&\n        authenticationResponse.response.userHandle !==\n          registrationCeremony.userHandle\n      ) {\n        log(\n          'Post-registration assertion userHandle does not match registration ceremony',\n        );\n        throw new PasskeyControllerError(\n          PasskeyControllerErrorMessage.AuthenticationVerificationFailed,\n          { code: PasskeyControllerErrorCode.AuthenticationVerificationFailed },\n        );\n      }\n\n      // derive key and encrypt vault key\n      const encKey = deriveKeyFromAuthenticationResponse(\n        authenticationResponse,\n        { credential, keyDerivation },\n      );\n      const { ciphertext, iv } = encryptWithKey(vaultKey, encKey);\n\n      // persist passkey record\n      this.update((state) => {\n        state.passkeyRecord = {\n          credential: {\n            ...credential,\n            counter: Math.max(newCounter, credential.counter),\n          },\n          encryptedVaultKey: { ciphertext, iv },\n          keyDerivation,\n        };\n      });\n    } finally {\n      // delete registration ceremony\n      this.#ceremonyManager.deleteRegistrationCeremony(challenge);\n    }\n  }\n\n  /**\n   * Verifies an authentication assertion and returns the decrypted vault key.\n   *\n   * Prefer orchestrated methods ({@link unlockWithPasskey},\n   * {@link exportSeedPhraseWithPasskey}, {@link exportAccountsWithPasskey}) for product\n   * flows instead of calling KeyringController with the returned key manually.\n   *\n   * @param authenticationResponse - Result of `navigator.credentials.get()`.\n   * @returns The plaintext vault encryption key.\n   */\n  async retrieveVaultKeyWithPasskey(\n    authenticationResponse: PasskeyAuthenticationResponse,\n  ): Promise<string> {\n    return this.#withOperationLock(() =>\n      this.#retrieveVaultKeyWithPasskey(authenticationResponse),\n    );\n  }\n\n  async #retrieveVaultKeyWithPasskey(\n    authenticationResponse: PasskeyAuthenticationResponse,\n  ): Promise<string> {\n    const passkeyRecord = this.#requireEnrolled();\n\n    // verify authentication response and update counter\n    const { newCounter } = await this.#verifyAuthenticationResponse(\n      authenticationResponse,\n      passkeyRecord.credential,\n    );\n    this.update((state) => {\n      if (!state.passkeyRecord) {\n        throw new PasskeyControllerError(\n          PasskeyControllerErrorMessage.NotEnrolled,\n          { code: PasskeyControllerErrorCode.NotEnrolled },\n        );\n      }\n      state.passkeyRecord.credential.counter = Math.max(\n        newCounter,\n        state.passkeyRecord.credential.counter,\n      );\n    });\n\n    // derive key\n    const encKey = deriveKeyFromAuthenticationResponse(\n      authenticationResponse,\n      passkeyRecord,\n    );\n\n    // decrypt vault key\n    try {\n      const vaultKey = decryptWithKey(\n        passkeyRecord.encryptedVaultKey.ciphertext,\n        passkeyRecord.encryptedVaultKey.iv,\n        encKey,\n      );\n      return vaultKey;\n    } catch (cause) {\n      log(\n        'Error decrypting vault key with passkey',\n        cause instanceof Error ? cause : new Error(String(cause)),\n      );\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.VaultKeyDecryptionFailed,\n        {\n          code: PasskeyControllerErrorCode.VaultKeyDecryptionFailed,\n          cause: cause instanceof Error ? cause : new Error(String(cause)),\n        },\n      );\n    }\n  }\n\n  /**\n   * Unlocks the keyring using a passkey authentication assertion.\n   *\n   * @param authenticationResponse - Result of `navigator.credentials.get()`.\n   * @returns Resolves when the keyring is unlocked.\n   */\n  async unlockWithPasskey(\n    authenticationResponse: PasskeyAuthenticationResponse,\n  ): Promise<void> {\n    return this.#withOperationLock(async () => {\n      const vaultKey = await this.#retrieveVaultKeyWithPasskey(\n        authenticationResponse,\n      );\n      await this.messenger.call(\n        'KeyringController:submitEncryptionKey',\n        vaultKey,\n      );\n    });\n  }\n\n  /**\n   * Exports the seed phrase after passkey step-up authentication.\n   *\n   * @param authenticationResponse - Result of `navigator.credentials.get()`.\n   * @param keyringId - Optional keyring id; defaults to the primary HD keyring.\n   * @returns Raw seed phrase bytes from KeyringController.\n   */\n  async exportSeedPhraseWithPasskey(\n    authenticationResponse: PasskeyAuthenticationResponse,\n    keyringId?: string,\n  ): Promise<Uint8Array> {\n    return this.#withOperationLock(async () => {\n      const vaultKey = await this.#retrieveVaultKeyWithPasskey(\n        authenticationResponse,\n      );\n      return await this.messenger.call(\n        'KeyringController:exportSeedPhrase',\n        { encryptionKey: vaultKey },\n        keyringId,\n      );\n    });\n  }\n\n  /**\n   * Exports private keys for the given addresses after passkey step-up authentication.\n   *\n   * @param authenticationResponse - Result of `navigator.credentials.get()`.\n   * @param addresses - Account addresses to export.\n   * @returns Private keys in the same order as `addresses`.\n   */\n  async exportAccountsWithPasskey(\n    authenticationResponse: PasskeyAuthenticationResponse,\n    addresses: string[],\n  ): Promise<string[]> {\n    return this.#withOperationLock(async () => {\n      const vaultKey = await this.#retrieveVaultKeyWithPasskey(\n        authenticationResponse,\n      );\n\n      const privateKeys: string[] = [];\n      for (const address of addresses) {\n        privateKeys.push(\n          await this.messenger.call(\n            'KeyringController:exportAccount',\n            { encryptionKey: vaultKey },\n            address,\n          ),\n        );\n      }\n      return privateKeys;\n    });\n  }\n\n  /**\n   * Checks whether the given authentication assertion is valid for the enrolled passkey.\n   *\n   * On failure, returns `false` for {@link PasskeyControllerError} with a `code`;\n   * other errors propagate.\n   *\n   * @param authenticationResponse - Result of `navigator.credentials.get()`.\n   * @returns `true` if verification succeeds, otherwise `false`.\n   */\n  async verifyPasskeyAuthentication(\n    authenticationResponse: PasskeyAuthenticationResponse,\n  ): Promise<boolean> {\n    return this.#withOperationLock(() =>\n      this.#verifyPasskeyAuthentication(authenticationResponse),\n    );\n  }\n\n  async #verifyPasskeyAuthentication(\n    authenticationResponse: PasskeyAuthenticationResponse,\n  ): Promise<boolean> {\n    try {\n      await this.#retrieveVaultKeyWithPasskey(authenticationResponse);\n      return true;\n    } catch (error: unknown) {\n      if (error instanceof PasskeyControllerError && error.code !== undefined) {\n        return false;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Re-wraps the vault key after rotation. Updates persisted `encryptedVaultKey` on success.\n   *\n   * Does not verify WebAuthn or ceremony state—call only after your layer has authenticated\n   * the user (passkey `get()` + verified assertion, or verified password). On passkey paths,\n   * pass the same `authenticationResponse` you just verified (e.g. from\n   * {@link retrieveVaultKeyWithPasskey} / {@link verifyPasskeyAuthentication}).\n   *\n   * For password change with passkey step-up, prefer\n   * {@link changePasswordWithPasskeyVerification}, which orchestrates keyring export,\n   * `changePassword`, and re-wrap in one call.\n   *\n   * @param params - Re-wrap inputs.\n   * @param params.authenticationResponse - Used to derive the wrapping key.\n   * @param params.oldVaultKey - Expected current vault key.\n   * @param params.newVaultKey - New vault key to encrypt under the passkey.\n   * @returns Resolves when the passkey record is updated.\n   */\n  async renewVaultKeyProtection(params: {\n    authenticationResponse: PasskeyAuthenticationResponse;\n    oldVaultKey: string;\n    newVaultKey: string;\n  }): Promise<void> {\n    return this.#withOperationLock(() => this.#renewVaultKeyProtection(params));\n  }\n\n  async #renewVaultKeyProtection(params: {\n    authenticationResponse: PasskeyAuthenticationResponse;\n    oldVaultKey: string;\n    newVaultKey: string;\n  }): Promise<void> {\n    const { authenticationResponse } = params;\n    const passkeyRecord = this.#requireEnrolled();\n\n    // derive key\n    const encKey = deriveKeyFromAuthenticationResponse(\n      authenticationResponse,\n      passkeyRecord,\n    );\n\n    // decrypt vault key\n    let decryptedVaultKey: string;\n    try {\n      decryptedVaultKey = decryptWithKey(\n        passkeyRecord.encryptedVaultKey.ciphertext,\n        passkeyRecord.encryptedVaultKey.iv,\n        encKey,\n      );\n    } catch (error) {\n      log(\n        'Error decrypting vault key during passkey vault key renewal',\n        error instanceof Error ? error : new Error(String(error)),\n      );\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.VaultKeyDecryptionFailed,\n        {\n          code: PasskeyControllerErrorCode.VaultKeyDecryptionFailed,\n          cause: error instanceof Error ? error : new Error(String(error)),\n        },\n      );\n    }\n\n    // check if vault key matches\n    const { oldVaultKey, newVaultKey } = params;\n    if (\n      !areUint8ArraysEqual(\n        stringToBytes(decryptedVaultKey),\n        stringToBytes(oldVaultKey),\n      )\n    ) {\n      log(\n        'Passkey renewal rejected: decrypted vault key does not match oldVaultKey',\n      );\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.VaultKeyMismatch,\n        { code: PasskeyControllerErrorCode.VaultKeyMismatch },\n      );\n    }\n\n    // encrypt new vault key\n    const { ciphertext, iv } = encryptWithKey(newVaultKey, encKey);\n\n    // persist passkey record (mutate current state only for vault key material)\n    this.update((state) => {\n      if (!state.passkeyRecord) {\n        throw new PasskeyControllerError(\n          PasskeyControllerErrorMessage.NotEnrolled,\n          {\n            code: PasskeyControllerErrorCode.NotEnrolled,\n          },\n        );\n      }\n      state.passkeyRecord.encryptedVaultKey = { ciphertext, iv };\n    });\n  }\n\n  /**\n   * Changes the wallet password after passkey step-up authentication.\n   *\n   * When `renewVaultKeyProtection` is `true` (default), re-wraps the vault key under the\n   * passkey after rotation. When `false`, removes the passkey instead.\n   *\n   * @param params - Change-password inputs.\n   * @param params.newPassword - New wallet password.\n   * @param params.authenticationResponse - Result of `navigator.credentials.get()`.\n   * @param params.options - Optional flow controls.\n   * @param params.options.renewVaultKeyProtection - Re-wrap vault key after password change.\n   * @returns Resolves when the password change completes.\n   */\n  async changePasswordWithPasskeyVerification(params: {\n    newPassword: string;\n    authenticationResponse: PasskeyAuthenticationResponse;\n    options?: { renewVaultKeyProtection?: boolean };\n  }): Promise<void> {\n    return this.#withOperationLock(() =>\n      this.#changePasswordWithPasskeyVerification(params),\n    );\n  }\n\n  async #changePasswordWithPasskeyVerification(params: {\n    newPassword: string;\n    authenticationResponse: PasskeyAuthenticationResponse;\n    options?: { renewVaultKeyProtection?: boolean };\n  }): Promise<void> {\n    this.#requireEnrolled();\n\n    const verified = await this.#verifyPasskeyAuthentication(\n      params.authenticationResponse,\n    );\n    if (!verified) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.AuthenticationVerificationFailed,\n        { code: PasskeyControllerErrorCode.AuthenticationVerificationFailed },\n      );\n    }\n\n    const renewVaultKeyProtection =\n      params.options?.renewVaultKeyProtection ?? true;\n\n    if (!renewVaultKeyProtection) {\n      await this.messenger.call(\n        'KeyringController:changePassword',\n        params.newPassword,\n      );\n      this.#removePasskey();\n      return;\n    }\n\n    const vaultKeyBefore = await this.messenger.call(\n      'KeyringController:exportEncryptionKey',\n    );\n    await this.messenger.call(\n      'KeyringController:changePassword',\n      params.newPassword,\n    );\n\n    try {\n      const vaultKeyAfter = await this.messenger.call(\n        'KeyringController:exportEncryptionKey',\n      );\n      await this.#renewVaultKeyProtection({\n        authenticationResponse: params.authenticationResponse,\n        oldVaultKey: vaultKeyBefore,\n        newVaultKey: vaultKeyAfter,\n      });\n    } catch (error) {\n      this.#removePasskey();\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.VaultKeyRenewalFailed,\n        {\n          code: PasskeyControllerErrorCode.VaultKeyRenewalFailed,\n          cause: error instanceof Error ? error : new Error(String(error)),\n        },\n      );\n    }\n  }\n\n  /**\n   * Removes the enrolled passkey after verifying a passkey authentication assertion.\n   *\n   * @param authenticationResponse - Result of `navigator.credentials.get()`.\n   * @returns Resolves when the passkey is removed.\n   */\n  async removePasskeyWithPasskeyVerification(\n    authenticationResponse: PasskeyAuthenticationResponse,\n  ): Promise<void> {\n    return this.#withOperationLock(() =>\n      this.#removePasskeyWithPasskeyVerification(authenticationResponse),\n    );\n  }\n\n  async #removePasskeyWithPasskeyVerification(\n    authenticationResponse: PasskeyAuthenticationResponse,\n  ): Promise<void> {\n    this.#requireEnrolled();\n\n    const verified = await this.#verifyPasskeyAuthentication(\n      authenticationResponse,\n    );\n    if (!verified) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.AuthenticationVerificationFailed,\n        { code: PasskeyControllerErrorCode.AuthenticationVerificationFailed },\n      );\n    }\n\n    this.#removePasskey();\n  }\n\n  /**\n   * Removes the enrolled passkey after verifying the wallet password.\n   *\n   * @param password - Wallet password for step-up verification.\n   * @returns Resolves when the passkey is removed.\n   */\n  async removePasskeyWithPasswordVerification(password: string): Promise<void> {\n    return this.#withOperationLock(() =>\n      this.#removePasskeyWithPasswordVerification(password),\n    );\n  }\n\n  async #removePasskeyWithPasswordVerification(\n    password: string,\n  ): Promise<void> {\n    this.#requireEnrolled();\n    await this.messenger.call('KeyringController:verifyPassword', password);\n    this.#removePasskey();\n  }\n\n  /**\n   * Resets state and clears in-flight registration/authentication ceremonies.\n   *\n   * For user-facing passkey removal with step-up, use\n   * {@link removePasskeyWithPasskeyVerification} or\n   * {@link removePasskeyWithPasswordVerification}.\n   */\n  clearState(): void {\n    this.#removePasskey();\n  }\n\n  /**\n   * Releases all in-flight ceremony state and tears down the messenger.\n   */\n  destroy(): void {\n    this.#ceremonyManager.clear();\n    super.destroy();\n  }\n\n  /**\n   * Validates a WebAuthn authentication response against stored credential data.\n   *\n   * @param authenticationResponse - Parsed authentication response from the client.\n   * @param credential - Credential identifiers and public key material for verification.\n   * @returns Updated authenticator signature counter.\n   */\n  async #verifyAuthenticationResponse(\n    authenticationResponse: PasskeyAuthenticationResponse,\n    credential: PasskeyCredentialInfo,\n  ): Promise<{ newCounter: number }> {\n    // get challenge\n    const challenge = this.#getChallengeFromClientData(\n      authenticationResponse.response.clientDataJSON,\n    );\n\n    // get authentication ceremony\n    const authenticationCeremony =\n      this.#ceremonyManager.getAuthenticationCeremony(challenge);\n    if (!authenticationCeremony) {\n      log('No active passkey authentication ceremony for challenge');\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.NoAuthenticationCeremony,\n        { code: PasskeyControllerErrorCode.NoAuthenticationCeremony },\n      );\n    }\n\n    try {\n      // verify authentication response\n      const result = await verifyAuthenticationResponse({\n        response: authenticationResponse,\n        expectedChallenge: authenticationCeremony.challenge,\n        expectedOrigin: this.#expectedOrigin,\n        expectedRPIDs: this.#expectedRPIDs,\n        credential: {\n          id: credential.id,\n          publicKey: base64URLToBytes(credential.publicKey),\n          counter: credential.counter,\n          transports: credential.transports,\n        },\n        requireUserVerification: true,\n      }).catch((error) => {\n        log(\n          'Error verifying passkey authentication response',\n          error instanceof Error ? error : new Error(String(error)),\n        );\n        throw new PasskeyControllerError(\n          PasskeyControllerErrorMessage.AuthenticationVerificationFailed,\n          {\n            code: PasskeyControllerErrorCode.AuthenticationVerificationFailed,\n            cause: error instanceof Error ? error : new Error(String(error)),\n          },\n        );\n      });\n      if (!result.verified) {\n        log('Passkey authentication verification returned unverified');\n        throw new PasskeyControllerError(\n          PasskeyControllerErrorMessage.AuthenticationVerificationFailed,\n          {\n            code: PasskeyControllerErrorCode.AuthenticationVerificationFailed,\n          },\n        );\n      }\n\n      return { newCounter: result.authenticationInfo.newCounter };\n    } finally {\n      // delete authentication ceremony\n      this.#ceremonyManager.deleteAuthenticationCeremony(challenge);\n    }\n  }\n\n  /**\n   * Serializes orchestrated passkey operations that mutate state or call KeyringController.\n   *\n   * @param callback - Operation to run while the mutex is held.\n   * @returns The result of the callback.\n   */\n  async #withOperationLock<Result>(\n    callback: () => Promise<Result>,\n  ): Promise<Result> {\n    return this.#operationMutex.runExclusive(callback);\n  }\n\n  async #assertEnrollmentAllowed(password?: string): Promise<void> {\n    if (!this.#getIsOnboardingCompleted()) {\n      return;\n    }\n\n    if (!password) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.EnrollmentPasswordRequired,\n        {\n          code: PasskeyControllerErrorCode.EnrollmentPasswordRequired,\n        },\n      );\n    }\n\n    await this.messenger.call('KeyringController:verifyPassword', password);\n  }\n\n  #requireEnrolled(): PasskeyRecord {\n    const record = this.state.passkeyRecord;\n    if (!record) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.NotEnrolled,\n        {\n          code: PasskeyControllerErrorCode.NotEnrolled,\n        },\n      );\n    }\n    return record;\n  }\n\n  #getChallengeFromClientData(clientDataJSON: string): string {\n    return decodeClientDataJSON(clientDataJSON).challenge;\n  }\n\n  /**\n   * Clears enrolled passkey state and in-flight ceremonies.\n   */\n  #removePasskey(): void {\n    this.update(() => getDefaultPasskeyControllerState());\n    this.#ceremonyManager.clear();\n  }\n}\n"]}

package/dist/ceremony-manager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ceremony-manager.d.ts","sourceRoot":"","sources":["../src/ceremony-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,YAAY,CAAC;AAEpB,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAA8C,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAIpD;;;GAGG;AACH,qBAAa,eAAe;;IAuD1B;;;;;OAKG;IACH,wBAAwB,CACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,2BAA2B,GACpC,IAAI,CAIN;IAED;;;;;OAKG;IACH,0BAA0B,CACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,6BAA6B,GACtC,IAAI,CAIN;IAED;;;;;OAKG;IACH,uBAAuB,CACrB,SAAS,EAAE,MAAM,GAChB,2BAA2B,GAAG,SAAS,CAGzC;IAED;;;;;OAKG;IACH,yBAAyB,CACvB,SAAS,EAAE,MAAM,GAChB,6BAA6B,GAAG,SAAS,CAG3C;IAED;;;;;OAKG;IACH,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAErD;IAED;;;;;OAKG;IACH,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEvD;IAED,sEAAsE;IACtE,KAAK,IAAI,IAAI,CAGZ;CACF"}

package/dist/ceremony-manager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ceremony-manager.js","sourceRoot":"","sources":["../src/ceremony-manager.ts"],"names":[],"mappings":";;;;;;AAKA,qEAAqE;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAO,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,GAAG,qBAAqB,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAIpD;;;GAGG;AACH,MAAM,OAAO,eAAe;IAA5B;;QACW,2CAAmB,IAAI,GAAG,EAAuC,EAAC;QAElE,6CAAqB,IAAI,GAAG,EAGlC,EAAC;IAkIN,CAAC;IAjFC;;;;;OAKG;IACH,wBAAwB,CACtB,SAAiB,EACjB,QAAqC;QAErC,uBAAA,IAAI,iEAAc,MAAlB,IAAI,EAAe,cAAc,CAAC,CAAC;QACnC,uBAAA,IAAI,oEAAiB,MAArB,IAAI,EAAkB,cAAc,CAAC,CAAC;QACtC,uBAAA,IAAI,wCAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,0BAA0B,CACxB,SAAiB,EACjB,QAAuC;QAEvC,uBAAA,IAAI,iEAAc,MAAlB,IAAI,EAAe,gBAAgB,CAAC,CAAC;QACrC,uBAAA,IAAI,oEAAiB,MAArB,IAAI,EAAkB,gBAAgB,CAAC,CAAC;QACxC,uBAAA,IAAI,0CAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,uBAAuB,CACrB,SAAiB;QAEjB,uBAAA,IAAI,iEAAc,MAAlB,IAAI,EAAe,cAAc,CAAC,CAAC;QACnC,OAAO,uBAAA,IAAI,wCAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,CACvB,SAAiB;QAEjB,uBAAA,IAAI,iEAAc,MAAlB,IAAI,EAAe,gBAAgB,CAAC,CAAC;QACrC,OAAO,uBAAA,IAAI,0CAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,0BAA0B,CAAC,SAAiB;QAC1C,OAAO,uBAAA,IAAI,wCAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,4BAA4B,CAAC,SAAiB;QAC5C,OAAO,uBAAA,IAAI,0CAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAED,sEAAsE;IACtE,KAAK;QACH,uBAAA,IAAI,wCAAiB,CAAC,KAAK,EAAE,CAAC;QAC9B,uBAAA,IAAI,0CAAmB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;CACF;6MAzHG,YAA0B;IAE1B,OAAO,YAAY,KAAK,cAAc;QACpC,CAAC,CAAC,uBAAA,IAAI,wCAAiB;QACvB,CAAC,CAAC,uBAAA,IAAI,0CAAmB,CAAC;AAC9B,CAAC,yEAEa,YAA0B;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,uBAAA,IAAI,2DAAQ,MAAZ,IAAI,EAAS,YAAY,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,QAAQ,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC,+EAOgB,YAA0B;IACzC,MAAM,GAAG,GAAG,uBAAA,IAAI,2DAAQ,MAAZ,IAAI,EAAS,YAAY,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC,IAAI,IAAI,iCAAiC,EAAE,CAAC;QACrD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,QAAQ,CAAC;QAC1B,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;YACrC,IAAI,QAAQ,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;gBACpC,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC;gBAChC,SAAS,GAAG,MAAM,CAAC;YACrB,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM;QACR,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;AACH,CAAC","sourcesContent":["import type {\n  PasskeyAuthenticationCeremony,\n  PasskeyRegistrationCeremony,\n} from './types.js';\n\n/** WebAuthn `timeout` for credential creation and assertion (ms). */\nexport const WEBAUTHN_TIMEOUT_MS = 60_000;\n\n/**\n * Extra allowance beyond {@link WEBAUTHN_TIMEOUT_MS} before in-memory\n * ceremony state is discarded (covers slow UX, multi-step enrollment, and\n * clock skew).\n */\nexport const CEREMONY_TTL_SLACK_MS = 120_000;\n\n/**\n * Maximum age for in-flight registration or authentication ceremony state\n * (between options and verified response). This bounds the lifetime of a\n * single WebAuthn ceremony only; it is not a user login session timeout.\n */\nexport const CEREMONY_MAX_AGE_MS = WEBAUTHN_TIMEOUT_MS + CEREMONY_TTL_SLACK_MS;\n\n/**\n * Upper bound on concurrent in-memory ceremonies per flow type (registration\n * vs authentication), for abuse / leak protection.\n */\nexport const MAX_CONCURRENT_PASSKEY_CEREMONIES = 16;\n\ntype CeremonyFlow = 'registration' | 'authentication';\n\n/**\n * In-memory store for in-flight WebAuthn ceremonies (registration vs authentication),\n * keyed by base64url challenge. Enforces TTL and a per-flow size cap; not user session state.\n */\nexport class CeremonyManager {\n  readonly #registrationMap = new Map<string, PasskeyRegistrationCeremony>();\n\n  readonly #authenticationMap = new Map<\n    string,\n    PasskeyAuthenticationCeremony\n  >();\n\n  /**\n   * Challenge-keyed map for prune/capacity helpers.\n   *\n   * @param ceremonyType - Which in-flight ceremony map to use.\n   * @returns The registration or authentication ceremony map for the given flow.\n   */\n  #getMap(\n    ceremonyType: CeremonyFlow,\n  ): Map<string, PasskeyRegistrationCeremony | PasskeyAuthenticationCeremony> {\n    return ceremonyType === 'registration'\n      ? this.#registrationMap\n      : this.#authenticationMap;\n  }\n\n  #pruneExpired(ceremonyType: CeremonyFlow): void {\n    const now = Date.now();\n    const map = this.#getMap(ceremonyType);\n    for (const [key, ceremony] of map) {\n      if (now - ceremony.createdAt > CEREMONY_MAX_AGE_MS) {\n        map.delete(key);\n      }\n    }\n  }\n\n  /**\n   * Removes the oldest entry (by `createdAt`) until size is below the cap.\n   *\n   * @param ceremonyType - Which in-flight ceremony map to evict from.\n   */\n  #enforceCapacity(ceremonyType: CeremonyFlow): void {\n    const map = this.#getMap(ceremonyType);\n    while (map.size >= MAX_CONCURRENT_PASSKEY_CEREMONIES) {\n      let oldestKey: string | undefined;\n      let oldestTime = Infinity;\n      for (const [mapKey, ceremony] of map) {\n        if (ceremony.createdAt < oldestTime) {\n          oldestTime = ceremony.createdAt;\n          oldestKey = mapKey;\n        }\n      }\n      if (oldestKey === undefined) {\n        break;\n      }\n      map.delete(oldestKey);\n    }\n  }\n\n  /**\n   * Records registration ceremony state after pruning expired rows and evicting oldest if at cap.\n   *\n   * @param challenge - Same base64url challenge as in the creation options `challenge` field.\n   * @param ceremony - Payload to retrieve when the registration response returns.\n   */\n  saveRegistrationCeremony(\n    challenge: string,\n    ceremony: PasskeyRegistrationCeremony,\n  ): void {\n    this.#pruneExpired('registration');\n    this.#enforceCapacity('registration');\n    this.#registrationMap.set(challenge, ceremony);\n  }\n\n  /**\n   * Records authentication ceremony state after pruning expired rows and evicting oldest if at cap.\n   *\n   * @param challenge - Same base64url challenge as in the request options `challenge` field.\n   * @param ceremony - Payload to retrieve when the assertion response returns.\n   */\n  saveAuthenticationCeremony(\n    challenge: string,\n    ceremony: PasskeyAuthenticationCeremony,\n  ): void {\n    this.#pruneExpired('authentication');\n    this.#enforceCapacity('authentication');\n    this.#authenticationMap.set(challenge, ceremony);\n  }\n\n  /**\n   * Returns registration ceremony for a challenge, pruning expired entries on this map first.\n   *\n   * @param challenge - Base64url challenge from decoded `clientDataJSON` (matches stored key).\n   * @returns Stored ceremony, or `undefined` if none or expired.\n   */\n  getRegistrationCeremony(\n    challenge: string,\n  ): PasskeyRegistrationCeremony | undefined {\n    this.#pruneExpired('registration');\n    return this.#registrationMap.get(challenge);\n  }\n\n  /**\n   * Returns authentication ceremony for a challenge, pruning expired entries on this map first.\n   *\n   * @param challenge - Base64url challenge from decoded `clientDataJSON` (matches stored key).\n   * @returns Stored ceremony, or `undefined` if none or expired.\n   */\n  getAuthenticationCeremony(\n    challenge: string,\n  ): PasskeyAuthenticationCeremony | undefined {\n    this.#pruneExpired('authentication');\n    return this.#authenticationMap.get(challenge);\n  }\n\n  /**\n   * Removes a registration ceremony by challenge.\n   *\n   * @param challenge - Map key for the ceremony to remove.\n   * @returns Whether an entry was deleted.\n   */\n  deleteRegistrationCeremony(challenge: string): boolean {\n    return this.#registrationMap.delete(challenge);\n  }\n\n  /**\n   * Removes an authentication ceremony by challenge.\n   *\n   * @param challenge - Map key for the ceremony to remove.\n   * @returns Whether an entry was deleted.\n   */\n  deleteAuthenticationCeremony(challenge: string): boolean {\n    return this.#authenticationMap.delete(challenge);\n  }\n\n  /** Drops all in-flight registration and authentication ceremonies. */\n  clear(): void {\n    this.#registrationMap.clear();\n    this.#authenticationMap.clear();\n  }\n}\n"]}

package/dist/constants.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,0BAA0B;aACrC,WAAW,EAAE,cAAc;aAC3B,eAAe,EAAE,kBAAkB;aACnC,sBAAsB,EAAE,0BAA0B;aAClD,8BAA8B,EAAE,kCAAkC;aAClE,wBAAwB,EAAE,4BAA4B;aACtD,gCAAgC,EAAE,oCAAoC;aACtE,kBAAkB,EAAE,sBAAsB;aAC1C,wBAAwB,EAAE,6BAA6B;aACvD,gBAAgB,EAAE,oBAAoB;aACtC,qBAAqB,EAAE,0BAA0B;aACjD,0BAA0B,EAAE,8BAA8B;CAClD,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,OAAO,0BAA0B,CAAC,CAAC;AAE/E;;GAEG;AACH,oBAAY,6BAA6B;IACvC,WAAW,gDAAgD;IAC3D,eAAe,oDAAoD;IACnE,sBAAsB,gEAAgE;IACtF,8BAA8B,iEAAiE;IAC/F,wBAAwB,kEAAkE;IAC1F,gCAAgC,mEAAmE;IACnG,kBAAkB,wEAAwE;IAC1F,wBAAwB,4DAA4D;IACpF,gBAAgB,oFAAoF;IACpG,0BAA0B,8DAA8D;IACxF,qBAAqB,yDAAyD;CAC/E"}

package/dist/constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,kBAAkB;IACnC,sBAAsB,EAAE,0BAA0B;IAClD,8BAA8B,EAAE,kCAAkC;IAClE,wBAAwB,EAAE,4BAA4B;IACtD,gCAAgC,EAAE,oCAAoC;IACtE,kBAAkB,EAAE,sBAAsB;IAC1C,wBAAwB,EAAE,6BAA6B;IACvD,gBAAgB,EAAE,oBAAoB;IACtC,qBAAqB,EAAE,0BAA0B;IACjD,0BAA0B,EAAE,8BAA8B;CAClD,CAAC;AAKX;;GAEG;AACH,MAAM,CAAN,IAAY,6BAYX;AAZD,WAAY,6BAA6B;IACvC,4FAA2D,CAAA;IAC3D,oGAAmE,CAAA;IACnE,uHAAsF,CAAA;IACtF,gIAA+F,CAAA;IAC/F,2HAA0F,CAAA;IAC1F,oIAAmG,CAAA;IACnG,2HAA0F,CAAA;IAC1F,qHAAoF,CAAA;IACpF,qIAAoG,CAAA;IACpG,yHAAwF,CAAA;IACxF,+GAA8E,CAAA;AAChF,CAAC,EAZW,6BAA6B,KAA7B,6BAA6B,QAYxC","sourcesContent":["export const controllerName = 'PasskeyController';\n\n/**\n * Stable programmatic codes for {@link PasskeyControllerError}.\n * Use these instead of matching `message` strings.\n */\nexport const PasskeyControllerErrorCode = {\n  NotEnrolled: 'not_enrolled',\n  AlreadyEnrolled: 'already_enrolled',\n  NoRegistrationCeremony: 'no_registration_ceremony',\n  RegistrationVerificationFailed: 'registration_verification_failed',\n  NoAuthenticationCeremony: 'no_authentication_ceremony',\n  AuthenticationVerificationFailed: 'authentication_verification_failed',\n  MissingKeyMaterial: 'missing_key_material',\n  VaultKeyDecryptionFailed: 'vault_key_decryption_failed',\n  VaultKeyMismatch: 'vault_key_mismatch',\n  VaultKeyRenewalFailed: 'vault_key_renewal_failed',\n  EnrollmentPasswordRequired: 'enrollment_password_required',\n} as const;\n\nexport type PasskeyControllerErrorCode =\n  (typeof PasskeyControllerErrorCode)[keyof typeof PasskeyControllerErrorCode];\n\n/**\n * Human-readable messages for {@link PasskeyControllerError}.\n */\nexport enum PasskeyControllerErrorMessage {\n  NotEnrolled = `${controllerName} - Passkey is not enrolled`,\n  AlreadyEnrolled = `${controllerName} - Passkey is already enrolled`,\n  NoRegistrationCeremony = `${controllerName} - No active passkey registration ceremony`,\n  RegistrationVerificationFailed = `${controllerName} - Passkey registration verification failed`,\n  NoAuthenticationCeremony = `${controllerName} - No active passkey authentication ceremony`,\n  AuthenticationVerificationFailed = `${controllerName} - Passkey authentication verification failed`,\n  MissingKeyMaterial = `${controllerName} - Passkey assertion missing required key material`,\n  VaultKeyDecryptionFailed = `${controllerName} - Passkey vault key decryption failed`,\n  VaultKeyMismatch = `${controllerName} - Passkey authentication does not match the current vault key`,\n  EnrollmentPasswordRequired = `${controllerName} - Password required to register passkey`,\n  VaultKeyRenewalFailed = `${controllerName} - Passkey vault key renewal failed`,\n}\n"]}

package/dist/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,IAAI,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAEnG;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;OAEG;IACH,IAAI,CAAC,EAAE,8BAA8B,CAAC;IACtC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAEF;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,IAAI,CAAC,EAAE,8BAA8B,CAAC;IAEtC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElC,KAAK,CAAC,EAAE,KAAK,CAAC;IAEd;;;OAGG;IACH,YACE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,6BAA6B,GAAG,KAAK,EAoBhD;IAED,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAehC;IAEQ,QAAQ,IAAI,MAAM,CAS1B;CACF"}

package/dist/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAoBA;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAO/C;;;OAGG;IACH,YACE,OAAe,EACf,OAA+C;QAE/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QAErC,MAAM,KAAK,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;QAExE,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACf,CAAC,CAAC;oBACE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;oBACrB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;oBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;iBACxB;gBACH,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAEQ,QAAQ;QACf,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF","sourcesContent":["import type { PasskeyControllerErrorCode as PasskeyControllerErrorCodeType } from './constants.js';\n\n/**\n * Options for creating a {@link PasskeyControllerError}.\n */\nexport type PasskeyControllerErrorOptions = {\n  /**\n   * The underlying error that caused this error (for error chaining).\n   */\n  cause?: Error;\n  /**\n   * Stable code for programmatic handling (see {@link PasskeyControllerErrorCode}).\n   */\n  code?: PasskeyControllerErrorCodeType;\n  /**\n   * Additional context for debugging or reporting.\n   */\n  context?: Record<string, unknown>;\n};\n\n/**\n * Error class for PasskeyController-related errors.\n */\nexport class PasskeyControllerError extends Error {\n  code?: PasskeyControllerErrorCodeType;\n\n  context?: Record<string, unknown>;\n\n  cause?: Error;\n\n  /**\n   * @param message - The error message.\n   * @param options - Error options or an `Error` instance used as `cause` (Keyring-style overload).\n   */\n  constructor(\n    message: string,\n    options?: PasskeyControllerErrorOptions | Error,\n  ) {\n    super(message);\n    this.name = 'PasskeyControllerError';\n\n    const cause = options instanceof Error ? options : options?.cause;\n    const code = options instanceof Error ? undefined : options?.code;\n    const context = options instanceof Error ? undefined : options?.context;\n\n    if (cause) {\n      this.cause = cause;\n    }\n    if (code) {\n      this.code = code;\n    }\n    if (context) {\n      this.context = context;\n    }\n\n    Object.setPrototypeOf(this, PasskeyControllerError.prototype);\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      message: this.message,\n      code: this.code,\n      context: this.context,\n      stack: this.stack,\n      cause: this.cause\n        ? {\n            name: this.cause.name,\n            message: this.cause.message,\n            stack: this.cause.stack,\n          }\n        : undefined,\n    };\n  }\n\n  override toString(): string {\n    let result = `${this.name}: ${this.message}`;\n    if (this.code) {\n      result += ` [${this.code}]`;\n    }\n    if (this.cause) {\n      result += `\\n  Caused by: ${this.cause}`;\n    }\n    return result;\n  }\n}\n"]}

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAC/F,YAAY,EACV,wCAAwC,EACxC,kDAAkD,EAClD,oEAAoE,EACpE,oDAAoD,EACpD,iDAAiD,EACjD,kDAAkD,EAClD,wCAAwC,EACxC,kDAAkD,EAClD,gDAAgD,EAChD,kDAAkD,EAClD,8CAA8C,EAC9C,4DAA4D,EAC5D,2DAA2D,EAC3D,4DAA4D,EAC5D,iCAAiC,EACjC,8BAA8B,GAC/B,MAAM,4CAA4C,CAAC"}

package/dist/index.js

@@ -1,5 +0,0 @@
-export { PasskeyControllerErrorCode, PasskeyControllerErrorMessage, } from './constants.js';
-export { PasskeyControllerError } from './errors.js';
-export { PasskeyController, getDefaultPasskeyControllerState, passkeyControllerSelectors, } from './PasskeyController.js';
-export { getAAGUIDFromRegistrationResponse } from './webauthn/verify-registration-response.js';
-//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAsBhC,OAAO,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC","sourcesContent":["export {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants.js';\nexport { PasskeyControllerError } from './errors.js';\nexport {\n  PasskeyController,\n  getDefaultPasskeyControllerState,\n  passkeyControllerSelectors,\n} from './PasskeyController.js';\nexport type {\n  PasskeyControllerState,\n  PasskeyControllerMessenger,\n  PasskeyControllerOptions,\n  PasskeyControllerGetStateAction,\n  PasskeyControllerActions,\n  PasskeyControllerStateChangedEvent,\n  PasskeyControllerEvents,\n  PasskeyCredentialInfo,\n  PasskeyDerivationMethod,\n  PasskeyKeyDerivation,\n  PasskeyRecord,\n  PrfEvalExtension,\n  PrfClientExtensionResults,\n} from './types.js';\nexport type {\n  PasskeyRegistrationOptions,\n  PasskeyRegistrationResponse,\n  PasskeyAuthenticationOptions,\n  PasskeyAuthenticationResponse,\n} from './webauthn/types.js';\nexport { getAAGUIDFromRegistrationResponse } from './webauthn/verify-registration-response.js';\nexport type {\n  PasskeyControllerIsPasskeyEnrolledAction,\n  PasskeyControllerGenerateRegistrationOptionsAction,\n  PasskeyControllerGeneratePostRegistrationAuthenticationOptionsAction,\n  PasskeyControllerGenerateAuthenticationOptionsAction,\n  PasskeyControllerProtectVaultKeyWithPasskeyAction,\n  PasskeyControllerRetrieveVaultKeyWithPasskeyAction,\n  PasskeyControllerUnlockWithPasskeyAction,\n  PasskeyControllerExportSeedPhraseWithPasskeyAction,\n  PasskeyControllerExportAccountsWithPasskeyAction,\n  PasskeyControllerVerifyPasskeyAuthenticationAction,\n  PasskeyControllerRenewVaultKeyProtectionAction,\n  PasskeyControllerChangePasswordWithPasskeyVerificationAction,\n  PasskeyControllerRemovePasskeyWithPasskeyVerificationAction,\n  PasskeyControllerRemovePasskeyWithPasswordVerificationAction,\n  PasskeyControllerClearStateAction,\n  PasskeyControllerDestroyAction,\n} from './PasskeyController-method-action-types.js';\n"]}

package/dist/key-derivation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"key-derivation.d.ts","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAA6B,MAAM,YAAY,CAAC;AAG3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,6BAA6B,EACrD,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,eAAe,CAAC,GAC1D,UAAU,CA0BZ"}

package/dist/key-derivation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"key-derivation.js","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,sBAAqD,EACrD,MAA2D;IAE3D,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC;IACvD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,sBACxB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,IAAI,GAAe,CAAC;IACpB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["import {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants.js';\nimport { PasskeyControllerError } from './errors.js';\nimport type { PasskeyRecord, PrfClientExtensionResults } from './types.js';\nimport { deriveEncryptionKey } from './utils/crypto.js';\nimport { base64URLToBytes } from './utils/encoding.js';\nimport type { PasskeyAuthenticationResponse } from './webauthn/types.js';\n\n/**\n * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony\n * response.\n *\n * The derivation method is determined by `record.keyDerivation`:\n * - `prf` -- uses the PRF evaluation result from `clientExtensionResults`.\n * - `userHandle` -- uses the `userHandle` returned in the assertion.\n *\n * @param authenticationResponse - The authentication credential result\n *   from `navigator.credentials.get()`.\n * @param record - Credential id and key derivation parameters (ciphertext is\n *   not read).\n * @returns The derived 32-byte AES wrapping key.\n * @throws {@link PasskeyControllerError} with code `missing_key_material` if the\n *   required key material (PRF result or userHandle) is missing from the response.\n */\nexport function deriveKeyFromAuthenticationResponse(\n  authenticationResponse: PasskeyAuthenticationResponse,\n  record: Pick<PasskeyRecord, 'credential' | 'keyDerivation'>,\n): Uint8Array {\n  const { userHandle } = authenticationResponse.response;\n  const prfFirst = (\n    authenticationResponse.clientExtensionResults as PrfClientExtensionResults\n  )?.prf?.results?.first;\n  const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;\n\n  let ikm: Uint8Array;\n  if (record.keyDerivation.method === 'prf') {\n    if (!hasPrfOutput) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.MissingKeyMaterial,\n        { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n      );\n    }\n    ikm = base64URLToBytes(prfFirst);\n  } else if (userHandle) {\n    ikm = base64URLToBytes(userHandle);\n  } else {\n    throw new PasskeyControllerError(\n      PasskeyControllerErrorMessage.MissingKeyMaterial,\n      { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n    );\n  }\n\n  return deriveEncryptionKey(ikm, base64URLToBytes(record.credential.id));\n}\n"]}

package/dist/logger.d.ts

@@ -1,4 +0,0 @@
-import { createModuleLogger } from '@metamask/utils';
-export declare const projectLogger: import("debug").Debugger;
-export { createModuleLogger };
-//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAI1E,eAAO,MAAM,aAAa,0BAAsC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/logger.js

@@ -1,6 +0,0 @@
-/* istanbul ignore file */
-import { createProjectLogger, createModuleLogger } from '@metamask/utils';
-import { controllerName } from './constants.js';
-export const projectLogger = createProjectLogger(controllerName);
-export { createModuleLogger };
-//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nimport { controllerName } from './constants.js';\n\nexport const projectLogger = createProjectLogger(controllerName);\n\nexport { createModuleLogger };\n"]}

package/dist/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACV,qCAAqC,EACrC,oCAAoC,EACpC,0CAA0C,EAC1C,uCAAuC,EACvC,0CAA0C,EAC1C,qCAAqC,EACtC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAEjG,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CACpE,OAAO,cAAc,EACrB,sBAAsB,CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,+BAA+B,GACvC,qCAAqC,GACrC,0CAA0C,GAC1C,0CAA0C,GAC1C,qCAAqC,GACrC,uCAAuC,GACvC,oCAAoC,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAChC,+BAA+B,GAC/B,8BAA8B,CAAC;AAEnC,MAAM,MAAM,kCAAkC,GAAG,2BAA2B,CAC1E,OAAO,cAAc,EACrB,sBAAsB,CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAEzE,MAAM,MAAM,0BAA0B,GAAG,SAAS,CAChD,OAAO,cAAc,EACrB,wBAAwB,GAAG,+BAA+B,EAC1D,uBAAuB,CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,0BAA0B,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,EAAE,MAAM,OAAO,CAAC;CACzC,CAAC"}

package/dist/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  ControllerGetStateAction,\n  ControllerStateChangedEvent,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerChangePasswordAction,\n  KeyringControllerExportAccountAction,\n  KeyringControllerExportEncryptionKeyAction,\n  KeyringControllerExportSeedPhraseAction,\n  KeyringControllerSubmitEncryptionKeyAction,\n  KeyringControllerVerifyPasswordAction,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\n\nimport { controllerName } from './constants.js';\nimport type { PasskeyControllerMethodActions } from './PasskeyController-method-action-types.js';\n\nexport type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt?: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n\nexport type PasskeyControllerState = {\n  passkeyRecord: PasskeyRecord | null;\n};\n\nexport type PasskeyControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  PasskeyControllerState\n>;\n\n/**\n * KeyringController actions that {@link PasskeyController} may call during\n * orchestrated passkey flows. The restricted messenger must allow these at init.\n */\nexport type PasskeyControllerAllowedActions =\n  | KeyringControllerVerifyPasswordAction\n  | KeyringControllerExportEncryptionKeyAction\n  | KeyringControllerSubmitEncryptionKeyAction\n  | KeyringControllerChangePasswordAction\n  | KeyringControllerExportSeedPhraseAction\n  | KeyringControllerExportAccountAction;\n\n/**\n * Actions exposed by {@link PasskeyController} on its messenger, including\n * `:getState`, enrollment/unlock ceremony methods, and lifecycle helpers.\n */\nexport type PasskeyControllerActions =\n  | PasskeyControllerGetStateAction\n  | PasskeyControllerMethodActions;\n\nexport type PasskeyControllerStateChangedEvent = ControllerStateChangedEvent<\n  typeof controllerName,\n  PasskeyControllerState\n>;\n\nexport type PasskeyControllerEvents = PasskeyControllerStateChangedEvent;\n\nexport type PasskeyControllerMessenger = Messenger<\n  typeof controllerName,\n  PasskeyControllerActions | PasskeyControllerAllowedActions,\n  PasskeyControllerEvents\n>;\n\nexport type PasskeyControllerOptions = {\n  messenger: PasskeyControllerMessenger;\n  state?: Partial<PasskeyControllerState>;\n  rpId?: string;\n  expectedRPID: string | string[];\n  rpName: string;\n  expectedOrigin: string | string[];\n  userName?: string;\n  userDisplayName?: string;\n  /**\n   * Returns whether wallet onboarding is complete. When `true`, enrollment\n   * requires password step-up. The integrator typically supplies\n   * `() => onboardingController.state.completedOnboarding`.\n   */\n  getIsOnboardingCompleted: () => boolean;\n};\n"]}

package/dist/utils/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,GACf,UAAU,CAEZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,UAAU,GACd;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CASpC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,UAAU,GACd,MAAM,CAMR"}

package/dist/utils/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAO,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from './encoding.js';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Generates random bytes and returns them as a base64url string (no padding).\n *\n * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).\n * @returns Base64url-encoded random bytes.\n */\nexport function randomBytesToBase64URL(byteLength: number): string {\n  return bytesToBase64URL(randomBytes(byteLength));\n}\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}

package/dist/utils/encoding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/utils/encoding.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK1D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAI1D;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD"}

package/dist/utils/encoding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/utils/encoding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,aAAa,CAAC,KAAK,CAAC;SACxB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\n\n/**\n * Encode a byte array as a base64url string (RFC 4648 §5).\n *\n * @param bytes - The bytes to encode.\n * @returns Base64url-encoded string without padding.\n */\nexport function bytesToBase64URL(bytes: Uint8Array): string {\n  return bytesToBase64(bytes)\n    .replace(/\\+/gu, '-')\n    .replace(/\\//gu, '_')\n    .replace(/[=]+$/u, '');\n}\n\n/**\n * Decode a base64url string (RFC 4648 §5) into bytes.\n *\n * @param value - Base64url-encoded string.\n * @returns Decoded bytes.\n */\nexport function base64URLToBytes(value: string): Uint8Array {\n  const standard = value.replace(/-/gu, '+').replace(/_/gu, '/');\n  const padLength = (4 - (standard.length % 4)) % 4;\n  return Uint8Array.from(base64ToBytes(standard + '='.repeat(padLength)));\n}\n\n/**\n * Encode a byte array as a hexadecimal string.\n *\n * @param bytes - The bytes to encode.\n * @returns Hex-encoded string.\n */\nexport function bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n"]}

package/dist/webauthn/constants.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/webauthn/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ;IACnB,wBAAwB;aACxB,GAAG,EAAE,CAAC;IACN,yBAAyB;aACzB,GAAG,EAAE,CAAC;IAEN,kCAAkC;aAClC,GAAG,EAAE,CAAC,CAAC;IACP,0CAA0C;aAC1C,CAAC,EAAE,CAAC,CAAC;IACL,wBAAwB;aACxB,CAAC,EAAE,CAAC,CAAC;IAEL,qDAAqD;aACrD,CAAC,EAAE,CAAC,CAAC;IACL,oDAAoD;aACpD,CAAC,EAAE,CAAC,CAAC;CACG,CAAC"}

package/dist/webauthn/constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/webauthn/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAN,IAAY,OAaX;AAbD,WAAY,OAAO;IACjB,wCAAU,CAAA;IACV,wCAAU,CAAA;IACV,yCAAW,CAAA;IACX,yCAAW,CAAA;IACX,yCAAW,CAAA;IACX,yCAAW,CAAA;IACX,yCAAW,CAAA;IACX,2CAAY,CAAA;IACZ,0CAAY,CAAA;IACZ,0CAAY,CAAA;IACZ,0CAAY,CAAA;IACZ,wCAAY,CAAA;AACd,CAAC,EAbW,OAAO,KAAP,OAAO,QAalB;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,OAIX;AAJD,WAAY,OAAO;IACjB,mCAAO,CAAA;IACP,mCAAO,CAAA;IACP,mCAAO,CAAA;AACT,CAAC,EAJW,OAAO,KAAP,OAAO,QAIlB;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,OAMX;AAND,WAAY,OAAO;IACjB,qCAAQ,CAAA;IACR,qCAAQ,CAAA;IACR,qCAAQ,CAAA;IACR,2CAAW,CAAA;IACX,+CAAa,CAAA;AACf,CAAC,EANW,OAAO,KAAP,OAAO,QAMlB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,wBAAwB;IACxB,GAAG,EAAE,CAAC;IACN,yBAAyB;IACzB,GAAG,EAAE,CAAC;IAEN,kCAAkC;IAClC,GAAG,EAAE,CAAC,CAAC;IACP,0CAA0C;IAC1C,CAAC,EAAE,CAAC,CAAC;IACL,wBAAwB;IACxB,CAAC,EAAE,CAAC,CAAC;IAEL,qDAAqD;IACrD,CAAC,EAAE,CAAC,CAAC;IACL,oDAAoD;IACpD,CAAC,EAAE,CAAC,CAAC;CACG,CAAC","sourcesContent":["/**\n * COSE Algorithms\n *\n * @see https://www.iana.org/assignments/cose/cose.xhtml#algorithms\n */\nexport enum COSEALG {\n  ES256 = -7,\n  EdDSA = -8,\n  ES384 = -35,\n  ES512 = -36,\n  PS256 = -37,\n  PS384 = -38,\n  PS512 = -39,\n  ES256K = -47,\n  RS256 = -257,\n  RS384 = -258,\n  RS512 = -259,\n  RS1 = -65535,\n}\n\n/**\n * COSE Key Types\n *\n * @see https://www.iana.org/assignments/cose/cose.xhtml#key-type\n */\nexport enum COSEKTY {\n  OKP = 1,\n  EC2 = 2,\n  RSA = 3,\n}\n\n/**\n * COSE Curves\n *\n * @see https://www.iana.org/assignments/cose/cose.xhtml#elliptic-curves\n */\nexport enum COSECRV {\n  P256 = 1,\n  P384 = 2,\n  P521 = 3,\n  ED25519 = 6,\n  SECP256K1 = 8,\n}\n\n/**\n * COSE Key common and type-specific parameter labels.\n *\n * EC2 and RSA re-use the same numeric labels (-1, -2, -3) with different\n * semantics, so this is a plain object instead of an enum to avoid\n * duplicate-value violations.\n *\n * @see https://www.iana.org/assignments/cose/cose.xhtml#key-common-parameters\n * @see https://www.iana.org/assignments/cose/cose.xhtml#key-type-parameters\n */\nexport const COSEKEYS = {\n  /** Key Type (common) */\n  Kty: 1,\n  /** Algorithm (common) */\n  Alg: 3,\n\n  /** EC2 / OKP: curve identifier */\n  Crv: -1,\n  /** EC2: x-coordinate / OKP: public key */\n  X: -2,\n  /** EC2: y-coordinate */\n  Y: -3,\n\n  /** RSA: modulus n (shares numeric label with Crv) */\n  N: -1,\n  /** RSA: exponent e (shares numeric label with X) */\n  E: -2,\n} as const;\n"]}

package/dist/webauthn/decode-attestation-object.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"decode-attestation-object.d.ts","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,UAAU,GAC5B,iBAAiB,CAInB"}

package/dist/webauthn/decode-attestation-object.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"decode-attestation-object.js","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI1D;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,iBAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAgC,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\n\nimport type { AttestationObject } from './types.js';\n\n/**\n * CBOR-decode an attestationObject buffer into a Map with `fmt`, `attStmt`,\n * and `authData` entries.\n *\n * @param attestationObject - Raw attestation object bytes.\n * @returns Decoded AttestationObject map.\n */\nexport function decodeAttestationObject(\n  attestationObject: Uint8Array,\n): AttestationObject {\n  const copy = new Uint8Array(attestationObject);\n  const [decoded] = decodePartialCBOR(copy, 0) as [AttestationObject, number];\n  return decoded;\n}\n"]}

package/dist/webauthn/decode-client-data-json.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"decode-client-data-json.d.ts","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAIjE"}

package/dist/webauthn/decode-client-data-json.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"decode-client-data-json.js","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;AAC5C,CAAC","sourcesContent":["import { base64URLToBytes } from '../utils/encoding.js';\nimport type { ClientDataJSON } from './types.js';\n\n/**\n * Decode an authenticator's base64url-encoded clientDataJSON to JSON.\n *\n * @param data - Base64url-encoded clientDataJSON string.\n * @returns Parsed ClientDataJSON object.\n */\nexport function decodeClientDataJSON(data: string): ClientDataJSON {\n  const bytes = base64URLToBytes(data);\n  const text = new TextDecoder().decode(bytes);\n  return JSON.parse(text) as ClientDataJSON;\n}\n"]}

package/dist/webauthn/match-expected-rp-id.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"match-expected-rp-id.d.ts","sourceRoot":"","sources":["../../src/webauthn/match-expected-rp-id.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,UAAU,EACpB,aAAa,EAAE,MAAM,EAAE,GACtB,MAAM,CAQR"}

package/dist/webauthn/match-expected-rp-id.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"match-expected-rp-id.js","sourceRoot":"","sources":["../../src/webauthn/match-expected-rp-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAoB,EACpB,aAAuB;IAEvB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import { areUint8ArraysEqual } from '@metamask/utils';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToHex } from '../utils/encoding.js';\n\n/**\n * Verify that an authenticator data rpIdHash matches one of the expected\n * RP IDs by SHA-256 hashing each candidate and comparing.\n *\n * @param rpIdHash - The rpIdHash from authenticatorData (32 bytes).\n * @param expectedRPIDs - One or more RP ID strings to check against.\n * @returns The matching RP ID string.\n * @throws If no expected RP ID matches.\n */\nexport function matchExpectedRPID(\n  rpIdHash: Uint8Array,\n  expectedRPIDs: string[],\n): string {\n  for (const rpID of expectedRPIDs) {\n    const expectedHash = sha256(new TextEncoder().encode(rpID));\n    if (areUint8ArraysEqual(rpIdHash, expectedHash)) {\n      return rpID;\n    }\n  }\n  throw new Error(`Unexpected RP ID hash: received ${bytesToHex(rpIdHash)}`);\n}\n"]}