@metamask/passkey-controller 1.0.0 → 2.0.0

package/dist/key-derivation.d.mts

@@ -1,28 +1,5 @@
-import type { PasskeyKeyDerivation, PasskeyRecord, PasskeyRegistrationCeremony } from "./types.mjs";
-import type { PasskeyAuthenticationResponse, PasskeyRegistrationResponse } from "./webauthn/types.mjs";
-/**
- * Derives an AES-256 wrapping key from a WebAuthn registration ceremony
- * response.
- *
- * Uses the PRF output as HKDF input key material when
- * `clientExtensionResults.prf.results.first` is a non-empty string;
- * otherwise falls back to the random `userHandle` created during option
- * generation (including when PRF is enabled but no output is present).
- *
- * @param registrationResponse - The registration credential result from
- *   `navigator.credentials.create()`.
- * @param registrationCeremony - In-flight registration ceremony state from
- *   when `generateRegistrationOptions()` was called.
- * @param verifiedCredentialId - Base64url credential id from verified
- *   authenticator data (same value as persisted `credential.id` after
- *   `verifyRegistrationResponse`), not the client wrapper field alone.
- * @returns The derived 32-byte AES wrapping key and the
- *   {@link PasskeyKeyDerivation} parameters needed to reproduce it.
- */
-export declare function deriveKeyFromRegistrationResponse(registrationResponse: PasskeyRegistrationResponse, registrationCeremony: PasskeyRegistrationCeremony, verifiedCredentialId: string): {
-    encKey: Uint8Array;
-    keyDerivation: PasskeyKeyDerivation;
-};
+import type { PasskeyRecord } from "./types.mjs";
+import type { PasskeyAuthenticationResponse } from "./webauthn/types.mjs";
 /**
  * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony
  * response.
@@ -33,11 +10,11 @@ export declare function deriveKeyFromRegistrationResponse(registrationResponse:
  *
  * @param authenticationResponse - The authentication credential result
  *   from `navigator.credentials.get()`.
- * @param record - The persisted passkey record that was created during
- *   enrollment.
+ * @param record - Credential id and key derivation parameters (ciphertext is
+ *   not read).
  * @returns The derived 32-byte AES wrapping key.
  * @throws {@link PasskeyControllerError} with code `missing_key_material` if the
  *   required key material (PRF result or userHandle) is missing from the response.
  */
-export declare function deriveKeyFromAuthenticationResponse(authenticationResponse: PasskeyAuthenticationResponse, record: PasskeyRecord): Uint8Array;
+export declare function deriveKeyFromAuthenticationResponse(authenticationResponse: PasskeyAuthenticationResponse, record: Pick<PasskeyRecord, 'credential' | 'keyDerivation'>): Uint8Array;
 //# sourceMappingURL=key-derivation.d.mts.map

package/dist/key-derivation.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"key-derivation.d.mts","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAE5B,oBAAgB;AAGjB,OAAO,KAAK,EACV,6BAA6B,EAC7B,2BAA2B,EAC5B,6BAAyB;AAE1B;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAC/C,oBAAoB,EAAE,2BAA2B,EACjD,oBAAoB,EAAE,2BAA2B,EACjD,oBAAoB,EAAE,MAAM,GAC3B;IACD,MAAM,EAAE,UAAU,CAAC;IACnB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAmBA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,6BAA6B,EACrD,MAAM,EAAE,aAAa,GACpB,UAAU,CA0BZ"}
+{"version":3,"file":"key-derivation.d.mts","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAA6B,oBAAgB;AAGxE,OAAO,KAAK,EAAE,6BAA6B,EAAE,6BAAyB;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,6BAA6B,EACrD,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,eAAe,CAAC,GAC1D,UAAU,CA0BZ"}

package/dist/key-derivation.mjs

@@ -2,37 +2,6 @@ import { PasskeyControllerErrorCode, PasskeyControllerErrorMessage } from "./con
 import { PasskeyControllerError } from "./errors.mjs";
 import { deriveEncryptionKey } from "./utils/crypto.mjs";
 import { base64URLToBytes } from "./utils/encoding.mjs";
-/**
- * Derives an AES-256 wrapping key from a WebAuthn registration ceremony
- * response.
- *
- * Uses the PRF output as HKDF input key material when
- * `clientExtensionResults.prf.results.first` is a non-empty string;
- * otherwise falls back to the random `userHandle` created during option
- * generation (including when PRF is enabled but no output is present).
- *
- * @param registrationResponse - The registration credential result from
- *   `navigator.credentials.create()`.
- * @param registrationCeremony - In-flight registration ceremony state from
- *   when `generateRegistrationOptions()` was called.
- * @param verifiedCredentialId - Base64url credential id from verified
- *   authenticator data (same value as persisted `credential.id` after
- *   `verifyRegistrationResponse`), not the client wrapper field alone.
- * @returns The derived 32-byte AES wrapping key and the
- *   {@link PasskeyKeyDerivation} parameters needed to reproduce it.
- */
-export function deriveKeyFromRegistrationResponse(registrationResponse, registrationCeremony, verifiedCredentialId) {
-    const prfFirst = registrationResponse.clientExtensionResults?.prf?.results?.first;
-    const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;
-    const keyDerivation = hasPrfOutput
-        ? { method: 'prf', prfSalt: registrationCeremony.prfSalt }
-        : { method: 'userHandle' };
-    const ikm = keyDerivation.method === 'prf'
-        ? base64URLToBytes(prfFirst)
-        : base64URLToBytes(registrationCeremony.userHandle);
-    const encKey = deriveEncryptionKey(ikm, base64URLToBytes(verifiedCredentialId));
-    return { encKey, keyDerivation };
-}
 /**
  * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony
  * response.
@@ -43,8 +12,8 @@ export function deriveKeyFromRegistrationResponse(registrationResponse, registra
  *
  * @param authenticationResponse - The authentication credential result
  *   from `navigator.credentials.get()`.
- * @param record - The persisted passkey record that was created during
- *   enrollment.
+ * @param record - Credential id and key derivation parameters (ciphertext is
+ *   not read).
  * @returns The derived 32-byte AES wrapping key.
  * @throws {@link PasskeyControllerError} with code `missing_key_material` if the
  *   required key material (PRF result or userHandle) is missing from the response.

package/dist/key-derivation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"key-derivation.mjs","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC9B,wBAAoB;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAiB;AAOlD,OAAO,EAAE,mBAAmB,EAAE,2BAAuB;AACrD,OAAO,EAAE,gBAAgB,EAAE,6BAAyB;AAMpD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,oBAAiD,EACjD,oBAAiD,EACjD,oBAA4B;IAK5B,MAAM,QAAQ,GACZ,oBAAoB,CAAC,sBACtB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,MAAM,aAAa,GAAyB,YAAY;QACtD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE;QAC1D,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7B,MAAM,GAAG,GACP,aAAa,CAAC,MAAM,KAAK,KAAK;QAC5B,CAAC,CAAC,gBAAgB,CAAC,QAAkB,CAAC;QACtC,CAAC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,mBAAmB,CAChC,GAAG,EACH,gBAAgB,CAAC,oBAAoB,CAAC,CACvC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,sBAAqD,EACrD,MAAqB;IAErB,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC;IACvD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,sBACxB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,IAAI,GAAe,CAAC;IACpB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["import {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants';\nimport { PasskeyControllerError } from './errors';\nimport type {\n  PasskeyKeyDerivation,\n  PasskeyRecord,\n  PasskeyRegistrationCeremony,\n  PrfClientExtensionResults,\n} from './types';\nimport { deriveEncryptionKey } from './utils/crypto';\nimport { base64URLToBytes } from './utils/encoding';\nimport type {\n  PasskeyAuthenticationResponse,\n  PasskeyRegistrationResponse,\n} from './webauthn/types';\n\n/**\n * Derives an AES-256 wrapping key from a WebAuthn registration ceremony\n * response.\n *\n * Uses the PRF output as HKDF input key material when\n * `clientExtensionResults.prf.results.first` is a non-empty string;\n * otherwise falls back to the random `userHandle` created during option\n * generation (including when PRF is enabled but no output is present).\n *\n * @param registrationResponse - The registration credential result from\n *   `navigator.credentials.create()`.\n * @param registrationCeremony - In-flight registration ceremony state from\n *   when `generateRegistrationOptions()` was called.\n * @param verifiedCredentialId - Base64url credential id from verified\n *   authenticator data (same value as persisted `credential.id` after\n *   `verifyRegistrationResponse`), not the client wrapper field alone.\n * @returns The derived 32-byte AES wrapping key and the\n *   {@link PasskeyKeyDerivation} parameters needed to reproduce it.\n */\nexport function deriveKeyFromRegistrationResponse(\n  registrationResponse: PasskeyRegistrationResponse,\n  registrationCeremony: PasskeyRegistrationCeremony,\n  verifiedCredentialId: string,\n): {\n  encKey: Uint8Array;\n  keyDerivation: PasskeyKeyDerivation;\n} {\n  const prfFirst = (\n    registrationResponse.clientExtensionResults as PrfClientExtensionResults\n  )?.prf?.results?.first;\n  const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;\n\n  const keyDerivation: PasskeyKeyDerivation = hasPrfOutput\n    ? { method: 'prf', prfSalt: registrationCeremony.prfSalt }\n    : { method: 'userHandle' };\n  const ikm =\n    keyDerivation.method === 'prf'\n      ? base64URLToBytes(prfFirst as string)\n      : base64URLToBytes(registrationCeremony.userHandle);\n  const encKey = deriveEncryptionKey(\n    ikm,\n    base64URLToBytes(verifiedCredentialId),\n  );\n\n  return { encKey, keyDerivation };\n}\n\n/**\n * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony\n * response.\n *\n * The derivation method is determined by `record.keyDerivation`:\n * - `prf` -- uses the PRF evaluation result from `clientExtensionResults`.\n * - `userHandle` -- uses the `userHandle` returned in the assertion.\n *\n * @param authenticationResponse - The authentication credential result\n *   from `navigator.credentials.get()`.\n * @param record - The persisted passkey record that was created during\n *   enrollment.\n * @returns The derived 32-byte AES wrapping key.\n * @throws {@link PasskeyControllerError} with code `missing_key_material` if the\n *   required key material (PRF result or userHandle) is missing from the response.\n */\nexport function deriveKeyFromAuthenticationResponse(\n  authenticationResponse: PasskeyAuthenticationResponse,\n  record: PasskeyRecord,\n): Uint8Array {\n  const { userHandle } = authenticationResponse.response;\n  const prfFirst = (\n    authenticationResponse.clientExtensionResults as PrfClientExtensionResults\n  )?.prf?.results?.first;\n  const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;\n\n  let ikm: Uint8Array;\n  if (record.keyDerivation.method === 'prf') {\n    if (!hasPrfOutput) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.MissingKeyMaterial,\n        { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n      );\n    }\n    ikm = base64URLToBytes(prfFirst);\n  } else if (userHandle) {\n    ikm = base64URLToBytes(userHandle);\n  } else {\n    throw new PasskeyControllerError(\n      PasskeyControllerErrorMessage.MissingKeyMaterial,\n      { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n    );\n  }\n\n  return deriveEncryptionKey(ikm, base64URLToBytes(record.credential.id));\n}\n"]}
+{"version":3,"file":"key-derivation.mjs","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC9B,wBAAoB;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAiB;AAElD,OAAO,EAAE,mBAAmB,EAAE,2BAAuB;AACrD,OAAO,EAAE,gBAAgB,EAAE,6BAAyB;AAGpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,sBAAqD,EACrD,MAA2D;IAE3D,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC;IACvD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,sBACxB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,IAAI,GAAe,CAAC;IACpB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["import {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants';\nimport { PasskeyControllerError } from './errors';\nimport type { PasskeyRecord, PrfClientExtensionResults } from './types';\nimport { deriveEncryptionKey } from './utils/crypto';\nimport { base64URLToBytes } from './utils/encoding';\nimport type { PasskeyAuthenticationResponse } from './webauthn/types';\n\n/**\n * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony\n * response.\n *\n * The derivation method is determined by `record.keyDerivation`:\n * - `prf` -- uses the PRF evaluation result from `clientExtensionResults`.\n * - `userHandle` -- uses the `userHandle` returned in the assertion.\n *\n * @param authenticationResponse - The authentication credential result\n *   from `navigator.credentials.get()`.\n * @param record - Credential id and key derivation parameters (ciphertext is\n *   not read).\n * @returns The derived 32-byte AES wrapping key.\n * @throws {@link PasskeyControllerError} with code `missing_key_material` if the\n *   required key material (PRF result or userHandle) is missing from the response.\n */\nexport function deriveKeyFromAuthenticationResponse(\n  authenticationResponse: PasskeyAuthenticationResponse,\n  record: Pick<PasskeyRecord, 'credential' | 'keyDerivation'>,\n): Uint8Array {\n  const { userHandle } = authenticationResponse.response;\n  const prfFirst = (\n    authenticationResponse.clientExtensionResults as PrfClientExtensionResults\n  )?.prf?.results?.first;\n  const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;\n\n  let ikm: Uint8Array;\n  if (record.keyDerivation.method === 'prf') {\n    if (!hasPrfOutput) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.MissingKeyMaterial,\n        { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n      );\n    }\n    ikm = base64URLToBytes(prfFirst);\n  } else if (userHandle) {\n    ikm = base64URLToBytes(userHandle);\n  } else {\n    throw new PasskeyControllerError(\n      PasskeyControllerErrorMessage.MissingKeyMaterial,\n      { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n    );\n  }\n\n  return deriveEncryptionKey(ikm, base64URLToBytes(record.credential.id));\n}\n"]}

package/dist/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["export type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n"]}
+{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["export type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt?: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n"]}

package/dist/types.d.cts

@@ -61,7 +61,7 @@ export type PasskeyRecord = {
  */
 export type PasskeyRegistrationCeremony = {
     userHandle: Base64URLString;
-    prfSalt: Base64URLString;
+    prfSalt?: Base64URLString;
     challenge: Base64URLString;
     /** When this ceremony was started (ms since epoch); used for TTL pruning. */
     createdAt: number;

package/dist/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC"}
+{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC"}

package/dist/types.d.mts

@@ -61,7 +61,7 @@ export type PasskeyRecord = {
  */
 export type PasskeyRegistrationCeremony = {
     userHandle: Base64URLString;
-    prfSalt: Base64URLString;
+    prfSalt?: Base64URLString;
     challenge: Base64URLString;
     /** When this ceremony was started (ms since epoch); used for TTL pruning. */
     createdAt: number;

package/dist/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC"}

package/dist/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["export type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n"]}
+{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["export type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt?: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n"]}

package/dist/utils/crypto.cjs

@@ -1,13 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decryptWithKey = exports.encryptWithKey = exports.deriveEncryptionKey = void 0;
+exports.decryptWithKey = exports.encryptWithKey = exports.deriveEncryptionKey = exports.randomBytesToBase64URL = void 0;
 const utils_1 = require("@metamask/utils");
 const aes_1 = require("@noble/ciphers/aes");
 const webcrypto_1 = require("@noble/ciphers/webcrypto");
 const hkdf_1 = require("@noble/hashes/hkdf");
 const sha2_1 = require("@noble/hashes/sha2");
+const encoding_1 = require("./encoding.cjs");
 const PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';
 const AES_GCM_IV_LENGTH = 12;
+/**
+ * Generates random bytes and returns them as a base64url string (no padding).
+ *
+ * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).
+ * @returns Base64url-encoded random bytes.
+ */
+function randomBytesToBase64URL(byteLength) {
+    return (0, encoding_1.bytesToBase64URL)((0, webcrypto_1.randomBytes)(byteLength));
+}
+exports.randomBytesToBase64URL = randomBytesToBase64URL;
 /**
  * Derives an AES-256 encryption key from input key material and a credential ID
  * using HKDF-SHA256.

package/dist/utils/crypto.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.cjs","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":";;;AAAA,2CAA+D;AAC/D,4CAAyC;AACzC,wDAAuD;AACvD,6CAA0C;AAC1C,6CAA4C;AAE5C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AALD,kDAKC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,IAAA,uBAAW,EAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,IAAA,qBAAa,EAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,IAAA,qBAAa,EAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAZD,wCAYC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,IAAA,qBAAa,EAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAA,qBAAa,EAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAVD,wCAUC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}
+{"version":3,"file":"crypto.cjs","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":";;;AAAA,2CAA+D;AAC/D,4CAAyC;AACzC,wDAAuD;AACvD,6CAA0C;AAC1C,6CAA4C;AAE5C,6CAA8C;AAE9C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,UAAkB;IACvD,OAAO,IAAA,2BAAgB,EAAC,IAAA,uBAAW,EAAC,UAAU,CAAC,CAAC,CAAC;AACnD,CAAC;AAFD,wDAEC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AALD,kDAKC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,IAAA,uBAAW,EAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,IAAA,qBAAa,EAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,IAAA,qBAAa,EAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAZD,wCAYC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,IAAA,qBAAa,EAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAA,qBAAa,EAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAVD,wCAUC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from './encoding';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Generates random bytes and returns them as a base64url string (no padding).\n *\n * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).\n * @returns Base64url-encoded random bytes.\n */\nexport function randomBytesToBase64URL(byteLength: number): string {\n  return bytesToBase64URL(randomBytes(byteLength));\n}\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}

package/dist/utils/crypto.d.cts

@@ -1,3 +1,10 @@
+/**
+ * Generates random bytes and returns them as a base64url string (no padding).
+ *
+ * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).
+ * @returns Base64url-encoded random bytes.
+ */
+export declare function randomBytesToBase64URL(byteLength: number): string;
 /**
  * Derives an AES-256 encryption key from input key material and a credential ID
  * using HKDF-SHA256.

package/dist/utils/crypto.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.cts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,GACf,UAAU,CAEZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,UAAU,GACd;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CASpC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,UAAU,GACd,MAAM,CAMR"}
+{"version":3,"file":"crypto.d.cts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,GACf,UAAU,CAEZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,UAAU,GACd;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CASpC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,UAAU,GACd,MAAM,CAMR"}

package/dist/utils/crypto.d.mts

@@ -1,3 +1,10 @@
+/**
+ * Generates random bytes and returns them as a base64url string (no padding).
+ *
+ * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).
+ * @returns Base64url-encoded random bytes.
+ */
+export declare function randomBytesToBase64URL(byteLength: number): string;
 /**
  * Derives an AES-256 encryption key from input key material and a credential ID
  * using HKDF-SHA256.

package/dist/utils/crypto.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.mts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,GACf,UAAU,CAEZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,UAAU,GACd;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CASpC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,UAAU,GACd,MAAM,CAMR"}
+{"version":3,"file":"crypto.d.mts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,GACf,UAAU,CAEZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,UAAU,GACd;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CASpC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,UAAU,GACd,MAAM,CAMR"}

package/dist/utils/crypto.mjs

@@ -3,8 +3,18 @@ import { gcm } from "@noble/ciphers/aes";
 import { randomBytes } from "@noble/ciphers/webcrypto";
 import { hkdf } from "@noble/hashes/hkdf";
 import { sha256 } from "@noble/hashes/sha2";
+import { bytesToBase64URL } from "./encoding.mjs";
 const PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';
 const AES_GCM_IV_LENGTH = 12;
+/**
+ * Generates random bytes and returns them as a base64url string (no padding).
+ *
+ * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).
+ * @returns Base64url-encoded random bytes.
+ */
+export function randomBytesToBase64URL(byteLength) {
+    return bytesToBase64URL(randomBytes(byteLength));
+}
 /**
  * Derives an AES-256 encryption key from input key material and a credential ID
  * using HKDF-SHA256.

package/dist/utils/crypto.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.mjs","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB;AAC/D,OAAO,EAAE,GAAG,EAAE,2BAA2B;AACzC,OAAO,EAAE,WAAW,EAAE,iCAAiC;AACvD,OAAO,EAAE,IAAI,EAAE,2BAA2B;AAC1C,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}
+{"version":3,"file":"crypto.mjs","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB;AAC/D,OAAO,EAAE,GAAG,EAAE,2BAA2B;AACzC,OAAO,EAAE,WAAW,EAAE,iCAAiC;AACvD,OAAO,EAAE,IAAI,EAAE,2BAA2B;AAC1C,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,OAAO,EAAE,gBAAgB,EAAE,uBAAmB;AAE9C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAO,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from './encoding';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Generates random bytes and returns them as a base64url string (no padding).\n *\n * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).\n * @returns Base64url-encoded random bytes.\n */\nexport function randomBytesToBase64URL(byteLength: number): string {\n  return bytesToBase64URL(randomBytes(byteLength));\n}\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}

package/dist/webauthn/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../../src/webauthn/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AuthenticatorTransportFuture,\n  Base64URLString as Base64URL,\n} from '../types';\n\nexport type PublicKeyCredentialDescriptorJSON = {\n  id: Base64URL;\n  type: 'public-key';\n  transports?: AuthenticatorTransportFuture[];\n};\n\nexport type PublicKeyCredentialHint =\n  | 'hybrid'\n  | 'security-key'\n  | 'client-device';\n\nexport type PasskeyRegistrationOptions = {\n  rp: { name: string; id: string };\n  user: {\n    id: Base64URL;\n    name: string;\n    displayName: string;\n  };\n  challenge: Base64URL;\n  pubKeyCredParams: { alg: number; type: 'public-key' }[];\n  timeout?: number;\n  excludeCredentials?: PublicKeyCredentialDescriptorJSON[];\n  authenticatorSelection?: {\n    authenticatorAttachment?: 'cross-platform' | 'platform';\n    residentKey?: 'discouraged' | 'preferred' | 'required';\n    requireResidentKey?: boolean;\n    userVerification?: 'discouraged' | 'preferred' | 'required';\n  };\n  hints?: PublicKeyCredentialHint[];\n  attestation?: 'direct' | 'enterprise' | 'indirect' | 'none';\n  extensions?: Record<string, unknown>;\n};\n\nexport type PasskeyRegistrationResponse = {\n  id: Base64URL;\n  rawId: Base64URL;\n  type: 'public-key';\n  response: {\n    clientDataJSON: Base64URL;\n    attestationObject: Base64URL;\n    transports?: string[];\n    publicKeyAlgorithm?: number;\n    publicKey?: Base64URL;\n    authenticatorData?: Base64URL;\n  };\n  authenticatorAttachment?: 'cross-platform' | 'platform';\n  clientExtensionResults: Record<string, unknown>;\n};\n\nexport type PasskeyAuthenticationOptions = {\n  challenge: Base64URL;\n  timeout?: number;\n  rpId?: string;\n  allowCredentials?: PublicKeyCredentialDescriptorJSON[];\n  userVerification?: 'discouraged' | 'preferred' | 'required';\n  hints?: PublicKeyCredentialHint[];\n  extensions?: Record<string, unknown>;\n};\n\nexport type PasskeyAuthenticationResponse = {\n  id: Base64URL;\n  rawId: Base64URL;\n  type: 'public-key';\n  response: {\n    clientDataJSON: Base64URL;\n    authenticatorData: Base64URL;\n    signature: Base64URL;\n    userHandle?: Base64URL;\n  };\n  authenticatorAttachment?: 'cross-platform' | 'platform';\n  clientExtensionResults: Record<string, unknown>;\n};\n\nexport type ClientDataJSON = {\n  type: string;\n  challenge: string;\n  origin: string;\n  crossOrigin?: boolean;\n  tokenBinding?: {\n    id?: string;\n    status: 'present' | 'supported' | 'not-supported';\n  };\n};\n\nexport type AttestationFormat =\n  | 'fido-u2f'\n  | 'packed'\n  | 'android-safetynet'\n  | 'android-key'\n  | 'tpm'\n  | 'apple'\n  | 'none';\n\nexport type AttestationObject = {\n  get(key: 'fmt'): AttestationFormat;\n  get(key: 'attStmt'): AttestationStatement;\n  get(key: 'authData'): Uint8Array;\n};\n\nexport type AttestationStatement = {\n  get(key: 'sig'): Uint8Array | undefined;\n  get(key: 'x5c'): Uint8Array[] | undefined;\n  get(key: 'alg'): number | undefined;\n  readonly size: number;\n};\n\nexport type AuthenticatorDataFlags = {\n  up: boolean;\n  uv: boolean;\n  be: boolean;\n  bs: boolean;\n  at: boolean;\n  ed: boolean;\n  flagsByte: number;\n};\n\nexport type ParsedAuthenticatorData = {\n  rpIdHash: Uint8Array;\n  flags: AuthenticatorDataFlags;\n  counter: number;\n  aaguid?: Uint8Array;\n  credentialID?: Uint8Array;\n  credentialPublicKey?: Uint8Array;\n  extensionsData?: Map<string, unknown>;\n  extensionsDataBuffer?: Uint8Array;\n};\n"]}
+{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../../src/webauthn/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AuthenticatorTransportFuture,\n  Base64URLString as Base64URL,\n} from '../types';\n\nexport type PublicKeyCredentialDescriptorJSON = {\n  id: Base64URL;\n  type: 'public-key';\n  transports?: AuthenticatorTransportFuture[];\n};\n\nexport type PublicKeyCredentialHint =\n  | 'hybrid'\n  | 'security-key'\n  | 'client-device';\n\nexport type PasskeyRegistrationOptions = {\n  rp: { name: string; id?: string };\n  user: {\n    id: Base64URL;\n    name: string;\n    displayName: string;\n  };\n  challenge: Base64URL;\n  pubKeyCredParams: { alg: number; type: 'public-key' }[];\n  timeout?: number;\n  excludeCredentials?: PublicKeyCredentialDescriptorJSON[];\n  authenticatorSelection?: {\n    authenticatorAttachment?: 'cross-platform' | 'platform';\n    residentKey?: 'discouraged' | 'preferred' | 'required';\n    requireResidentKey?: boolean;\n    userVerification?: 'discouraged' | 'preferred' | 'required';\n  };\n  hints?: PublicKeyCredentialHint[];\n  attestation?: 'direct' | 'enterprise' | 'indirect' | 'none';\n  extensions?: Record<string, unknown>;\n};\n\nexport type PasskeyRegistrationResponse = {\n  id: Base64URL;\n  rawId: Base64URL;\n  type: 'public-key';\n  response: {\n    clientDataJSON: Base64URL;\n    attestationObject: Base64URL;\n    transports?: string[];\n    publicKeyAlgorithm?: number;\n    publicKey?: Base64URL;\n    authenticatorData?: Base64URL;\n  };\n  authenticatorAttachment?: 'cross-platform' | 'platform';\n  clientExtensionResults: Record<string, unknown>;\n};\n\nexport type PasskeyAuthenticationOptions = {\n  challenge: Base64URL;\n  timeout?: number;\n  rpId?: string;\n  allowCredentials?: PublicKeyCredentialDescriptorJSON[];\n  userVerification?: 'discouraged' | 'preferred' | 'required';\n  hints?: PublicKeyCredentialHint[];\n  extensions?: Record<string, unknown>;\n};\n\nexport type PasskeyAuthenticationResponse = {\n  id: Base64URL;\n  rawId: Base64URL;\n  type: 'public-key';\n  response: {\n    clientDataJSON: Base64URL;\n    authenticatorData: Base64URL;\n    signature: Base64URL;\n    userHandle?: Base64URL;\n  };\n  authenticatorAttachment?: 'cross-platform' | 'platform';\n  clientExtensionResults: Record<string, unknown>;\n};\n\nexport type ClientDataJSON = {\n  type: string;\n  challenge: string;\n  origin: string;\n  crossOrigin?: boolean;\n  tokenBinding?: {\n    id?: string;\n    status: 'present' | 'supported' | 'not-supported';\n  };\n};\n\nexport type AttestationFormat =\n  | 'fido-u2f'\n  | 'packed'\n  | 'android-safetynet'\n  | 'android-key'\n  | 'tpm'\n  | 'apple'\n  | 'none';\n\nexport type AttestationObject = {\n  get(key: 'fmt'): AttestationFormat;\n  get(key: 'attStmt'): AttestationStatement;\n  get(key: 'authData'): Uint8Array;\n};\n\nexport type AttestationStatement = {\n  get(key: 'sig'): Uint8Array | undefined;\n  get(key: 'x5c'): Uint8Array[] | undefined;\n  get(key: 'alg'): number | undefined;\n  readonly size: number;\n};\n\nexport type AuthenticatorDataFlags = {\n  up: boolean;\n  uv: boolean;\n  be: boolean;\n  bs: boolean;\n  at: boolean;\n  ed: boolean;\n  flagsByte: number;\n};\n\nexport type ParsedAuthenticatorData = {\n  rpIdHash: Uint8Array;\n  flags: AuthenticatorDataFlags;\n  counter: number;\n  aaguid?: Uint8Array;\n  credentialID?: Uint8Array;\n  credentialPublicKey?: Uint8Array;\n  extensionsData?: Map<string, unknown>;\n  extensionsDataBuffer?: Uint8Array;\n};\n"]}

package/dist/webauthn/types.d.cts

@@ -8,7 +8,7 @@ export type PublicKeyCredentialHint = 'hybrid' | 'security-key' | 'client-device
 export type PasskeyRegistrationOptions = {
     rp: {
         name: string;
-        id: string;
+        id?: string;
     };
     user: {
         id: Base64URL;

package/dist/webauthn/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../../src/webauthn/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,eAAe,IAAI,SAAS,EAC7B,qBAAiB;AAElB,MAAM,MAAM,iCAAiC,GAAG;IAC9C,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,GACR,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,MAAM,0BAA0B,GAAG;IACvC,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,IAAI,EAAE;QACJ,EAAE,EAAE,SAAS,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,SAAS,CAAC;IACrB,gBAAgB,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACzD,sBAAsB,CAAC,EAAE;QACvB,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;QACxD,WAAW,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QACvD,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;KAC7D,CAAC;IACF,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,SAAS,CAAC;QAC1B,iBAAiB,EAAE,SAAS,CAAC;QAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,iBAAiB,CAAC,EAAE,SAAS,CAAC;KAC/B,CAAC;IACF,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACvD,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;IAC5D,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,SAAS,CAAC;QAC1B,iBAAiB,EAAE,SAAS,CAAC;QAC7B,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;KACxB,CAAC;IACF,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,QAAQ,GACR,mBAAmB,GACnB,aAAa,GACb,KAAK,GACL,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,oBAAoB,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,GAAG,SAAS,CAAC;IACxC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC"}
+{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../../src/webauthn/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,eAAe,IAAI,SAAS,EAC7B,qBAAiB;AAElB,MAAM,MAAM,iCAAiC,GAAG;IAC9C,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,GACR,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,MAAM,0BAA0B,GAAG;IACvC,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,IAAI,EAAE;QACJ,EAAE,EAAE,SAAS,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,SAAS,CAAC;IACrB,gBAAgB,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACzD,sBAAsB,CAAC,EAAE;QACvB,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;QACxD,WAAW,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QACvD,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;KAC7D,CAAC;IACF,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,SAAS,CAAC;QAC1B,iBAAiB,EAAE,SAAS,CAAC;QAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,iBAAiB,CAAC,EAAE,SAAS,CAAC;KAC/B,CAAC;IACF,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACvD,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;IAC5D,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,SAAS,CAAC;QAC1B,iBAAiB,EAAE,SAAS,CAAC;QAC7B,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;KACxB,CAAC;IACF,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,QAAQ,GACR,mBAAmB,GACnB,aAAa,GACb,KAAK,GACL,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,oBAAoB,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,GAAG,SAAS,CAAC;IACxC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC"}

package/dist/webauthn/types.d.mts

@@ -8,7 +8,7 @@ export type PublicKeyCredentialHint = 'hybrid' | 'security-key' | 'client-device
 export type PasskeyRegistrationOptions = {
     rp: {
         name: string;
-        id: string;
+        id?: string;
     };
     user: {
         id: Base64URL;

package/dist/webauthn/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../../src/webauthn/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,eAAe,IAAI,SAAS,EAC7B,qBAAiB;AAElB,MAAM,MAAM,iCAAiC,GAAG;IAC9C,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,GACR,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,MAAM,0BAA0B,GAAG;IACvC,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,IAAI,EAAE;QACJ,EAAE,EAAE,SAAS,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,SAAS,CAAC;IACrB,gBAAgB,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACzD,sBAAsB,CAAC,EAAE;QACvB,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;QACxD,WAAW,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QACvD,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;KAC7D,CAAC;IACF,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,SAAS,CAAC;QAC1B,iBAAiB,EAAE,SAAS,CAAC;QAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,iBAAiB,CAAC,EAAE,SAAS,CAAC;KAC/B,CAAC;IACF,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACvD,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;IAC5D,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,SAAS,CAAC;QAC1B,iBAAiB,EAAE,SAAS,CAAC;QAC7B,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;KACxB,CAAC;IACF,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,QAAQ,GACR,mBAAmB,GACnB,aAAa,GACb,KAAK,GACL,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,oBAAoB,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,GAAG,SAAS,CAAC;IACxC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../../src/webauthn/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,eAAe,IAAI,SAAS,EAC7B,qBAAiB;AAElB,MAAM,MAAM,iCAAiC,GAAG;IAC9C,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,GACR,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,MAAM,0BAA0B,GAAG;IACvC,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,IAAI,EAAE;QACJ,EAAE,EAAE,SAAS,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,SAAS,CAAC;IACrB,gBAAgB,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACzD,sBAAsB,CAAC,EAAE;QACvB,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;QACxD,WAAW,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;QACvD,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;KAC7D,CAAC;IACF,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,SAAS,CAAC;QAC1B,iBAAiB,EAAE,SAAS,CAAC;QAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,iBAAiB,CAAC,EAAE,SAAS,CAAC;KAC/B,CAAC;IACF,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,iCAAiC,EAAE,CAAC;IACvD,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;IAC5D,KAAK,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE;QACR,cAAc,EAAE,SAAS,CAAC;QAC1B,iBAAiB,EAAE,SAAS,CAAC;QAC7B,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;KACxB,CAAC;IACF,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;KACnD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,QAAQ,GACR,mBAAmB,GACnB,aAAa,GACb,KAAK,GACL,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,oBAAoB,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,GAAG,SAAS,CAAC;IACxC,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC"}

package/dist/webauthn/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../../src/webauthn/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AuthenticatorTransportFuture,\n  Base64URLString as Base64URL,\n} from '../types';\n\nexport type PublicKeyCredentialDescriptorJSON = {\n  id: Base64URL;\n  type: 'public-key';\n  transports?: AuthenticatorTransportFuture[];\n};\n\nexport type PublicKeyCredentialHint =\n  | 'hybrid'\n  | 'security-key'\n  | 'client-device';\n\nexport type PasskeyRegistrationOptions = {\n  rp: { name: string; id: string };\n  user: {\n    id: Base64URL;\n    name: string;\n    displayName: string;\n  };\n  challenge: Base64URL;\n  pubKeyCredParams: { alg: number; type: 'public-key' }[];\n  timeout?: number;\n  excludeCredentials?: PublicKeyCredentialDescriptorJSON[];\n  authenticatorSelection?: {\n    authenticatorAttachment?: 'cross-platform' | 'platform';\n    residentKey?: 'discouraged' | 'preferred' | 'required';\n    requireResidentKey?: boolean;\n    userVerification?: 'discouraged' | 'preferred' | 'required';\n  };\n  hints?: PublicKeyCredentialHint[];\n  attestation?: 'direct' | 'enterprise' | 'indirect' | 'none';\n  extensions?: Record<string, unknown>;\n};\n\nexport type PasskeyRegistrationResponse = {\n  id: Base64URL;\n  rawId: Base64URL;\n  type: 'public-key';\n  response: {\n    clientDataJSON: Base64URL;\n    attestationObject: Base64URL;\n    transports?: string[];\n    publicKeyAlgorithm?: number;\n    publicKey?: Base64URL;\n    authenticatorData?: Base64URL;\n  };\n  authenticatorAttachment?: 'cross-platform' | 'platform';\n  clientExtensionResults: Record<string, unknown>;\n};\n\nexport type PasskeyAuthenticationOptions = {\n  challenge: Base64URL;\n  timeout?: number;\n  rpId?: string;\n  allowCredentials?: PublicKeyCredentialDescriptorJSON[];\n  userVerification?: 'discouraged' | 'preferred' | 'required';\n  hints?: PublicKeyCredentialHint[];\n  extensions?: Record<string, unknown>;\n};\n\nexport type PasskeyAuthenticationResponse = {\n  id: Base64URL;\n  rawId: Base64URL;\n  type: 'public-key';\n  response: {\n    clientDataJSON: Base64URL;\n    authenticatorData: Base64URL;\n    signature: Base64URL;\n    userHandle?: Base64URL;\n  };\n  authenticatorAttachment?: 'cross-platform' | 'platform';\n  clientExtensionResults: Record<string, unknown>;\n};\n\nexport type ClientDataJSON = {\n  type: string;\n  challenge: string;\n  origin: string;\n  crossOrigin?: boolean;\n  tokenBinding?: {\n    id?: string;\n    status: 'present' | 'supported' | 'not-supported';\n  };\n};\n\nexport type AttestationFormat =\n  | 'fido-u2f'\n  | 'packed'\n  | 'android-safetynet'\n  | 'android-key'\n  | 'tpm'\n  | 'apple'\n  | 'none';\n\nexport type AttestationObject = {\n  get(key: 'fmt'): AttestationFormat;\n  get(key: 'attStmt'): AttestationStatement;\n  get(key: 'authData'): Uint8Array;\n};\n\nexport type AttestationStatement = {\n  get(key: 'sig'): Uint8Array | undefined;\n  get(key: 'x5c'): Uint8Array[] | undefined;\n  get(key: 'alg'): number | undefined;\n  readonly size: number;\n};\n\nexport type AuthenticatorDataFlags = {\n  up: boolean;\n  uv: boolean;\n  be: boolean;\n  bs: boolean;\n  at: boolean;\n  ed: boolean;\n  flagsByte: number;\n};\n\nexport type ParsedAuthenticatorData = {\n  rpIdHash: Uint8Array;\n  flags: AuthenticatorDataFlags;\n  counter: number;\n  aaguid?: Uint8Array;\n  credentialID?: Uint8Array;\n  credentialPublicKey?: Uint8Array;\n  extensionsData?: Map<string, unknown>;\n  extensionsDataBuffer?: Uint8Array;\n};\n"]}
+{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../../src/webauthn/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  AuthenticatorTransportFuture,\n  Base64URLString as Base64URL,\n} from '../types';\n\nexport type PublicKeyCredentialDescriptorJSON = {\n  id: Base64URL;\n  type: 'public-key';\n  transports?: AuthenticatorTransportFuture[];\n};\n\nexport type PublicKeyCredentialHint =\n  | 'hybrid'\n  | 'security-key'\n  | 'client-device';\n\nexport type PasskeyRegistrationOptions = {\n  rp: { name: string; id?: string };\n  user: {\n    id: Base64URL;\n    name: string;\n    displayName: string;\n  };\n  challenge: Base64URL;\n  pubKeyCredParams: { alg: number; type: 'public-key' }[];\n  timeout?: number;\n  excludeCredentials?: PublicKeyCredentialDescriptorJSON[];\n  authenticatorSelection?: {\n    authenticatorAttachment?: 'cross-platform' | 'platform';\n    residentKey?: 'discouraged' | 'preferred' | 'required';\n    requireResidentKey?: boolean;\n    userVerification?: 'discouraged' | 'preferred' | 'required';\n  };\n  hints?: PublicKeyCredentialHint[];\n  attestation?: 'direct' | 'enterprise' | 'indirect' | 'none';\n  extensions?: Record<string, unknown>;\n};\n\nexport type PasskeyRegistrationResponse = {\n  id: Base64URL;\n  rawId: Base64URL;\n  type: 'public-key';\n  response: {\n    clientDataJSON: Base64URL;\n    attestationObject: Base64URL;\n    transports?: string[];\n    publicKeyAlgorithm?: number;\n    publicKey?: Base64URL;\n    authenticatorData?: Base64URL;\n  };\n  authenticatorAttachment?: 'cross-platform' | 'platform';\n  clientExtensionResults: Record<string, unknown>;\n};\n\nexport type PasskeyAuthenticationOptions = {\n  challenge: Base64URL;\n  timeout?: number;\n  rpId?: string;\n  allowCredentials?: PublicKeyCredentialDescriptorJSON[];\n  userVerification?: 'discouraged' | 'preferred' | 'required';\n  hints?: PublicKeyCredentialHint[];\n  extensions?: Record<string, unknown>;\n};\n\nexport type PasskeyAuthenticationResponse = {\n  id: Base64URL;\n  rawId: Base64URL;\n  type: 'public-key';\n  response: {\n    clientDataJSON: Base64URL;\n    authenticatorData: Base64URL;\n    signature: Base64URL;\n    userHandle?: Base64URL;\n  };\n  authenticatorAttachment?: 'cross-platform' | 'platform';\n  clientExtensionResults: Record<string, unknown>;\n};\n\nexport type ClientDataJSON = {\n  type: string;\n  challenge: string;\n  origin: string;\n  crossOrigin?: boolean;\n  tokenBinding?: {\n    id?: string;\n    status: 'present' | 'supported' | 'not-supported';\n  };\n};\n\nexport type AttestationFormat =\n  | 'fido-u2f'\n  | 'packed'\n  | 'android-safetynet'\n  | 'android-key'\n  | 'tpm'\n  | 'apple'\n  | 'none';\n\nexport type AttestationObject = {\n  get(key: 'fmt'): AttestationFormat;\n  get(key: 'attStmt'): AttestationStatement;\n  get(key: 'authData'): Uint8Array;\n};\n\nexport type AttestationStatement = {\n  get(key: 'sig'): Uint8Array | undefined;\n  get(key: 'x5c'): Uint8Array[] | undefined;\n  get(key: 'alg'): number | undefined;\n  readonly size: number;\n};\n\nexport type AuthenticatorDataFlags = {\n  up: boolean;\n  uv: boolean;\n  be: boolean;\n  bs: boolean;\n  at: boolean;\n  ed: boolean;\n  flagsByte: number;\n};\n\nexport type ParsedAuthenticatorData = {\n  rpIdHash: Uint8Array;\n  flags: AuthenticatorDataFlags;\n  counter: number;\n  aaguid?: Uint8Array;\n  credentialID?: Uint8Array;\n  credentialPublicKey?: Uint8Array;\n  extensionsData?: Map<string, unknown>;\n  extensionsDataBuffer?: Uint8Array;\n};\n"]}

package/dist/webauthn/verify-authentication-response.cjs

@@ -31,7 +31,7 @@ const verify_signature_1 = require("./verify-signature.cjs");
  * @param opts.expectedChallenge - The base64url challenge that was issued
  *   for this ceremony.
  * @param opts.expectedOrigin - One or more acceptable origins.
- * @param opts.expectedRPID - The Relying Party ID domain.
+ * @param opts.expectedRPIDs - Relying Party ID strings to match against `rpIdHash`.
  * @param opts.credential - The stored credential record to verify against.
  * @param opts.credential.id - The credential ID (base64url).
  * @param opts.credential.publicKey - The COSE-encoded public key bytes
@@ -44,7 +44,7 @@ const verify_signature_1 = require("./verify-signature.cjs");
  *   authentication info (new counter, origin, RP ID).
  */
 async function verifyAuthenticationResponse(opts) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, credential, requireUserVerification = false, } = opts;
+    const { response, expectedChallenge, expectedOrigin, expectedRPIDs, credential, requireUserVerification = false, } = opts;
     const { id, rawId, type: credentialType, response: assertionResponse, } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -93,8 +93,7 @@ async function verifyAuthenticationResponse(opts) {
     const authDataBuffer = (0, encoding_1.base64URLToBytes)(assertionResponse.authenticatorData);
     const parsedAuthData = (0, parse_authenticator_data_1.parseAuthenticatorData)(authDataBuffer);
     const { rpIdHash, flags, counter } = parsedAuthData;
-    // Make sure the response's RP ID is ours
-    const matchedRPID = (0, match_expected_rp_id_1.matchExpectedRPID)(rpIdHash, [expectedRPID]);
+    const matchedRPID = expectedRPIDs.length > 0 ? (0, match_expected_rp_id_1.matchExpectedRPID)(rpIdHash, expectedRPIDs) : '';
     // WebAuthn only requires the user presence flag be true
     if (!flags.up) {
         throw new Error('User not present during authentication');

package/dist/webauthn/verify-authentication-response.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify-authentication-response.cjs","sourceRoot":"","sources":["../../src/webauthn/verify-authentication-response.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAC1D,2CAA8C;AAC9C,6CAA4C;AAG5C,oDAAqD;AACrD,2EAAiE;AACjE,qEAA2D;AAC3D,6EAAoE;AAGpE,6DAAqD;AAerD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACI,KAAK,UAAU,4BAA4B,CAAC,IAYlD;IACC,MAAM,EACJ,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,UAAU,EACV,uBAAuB,GAAG,KAAK,GAChC,GAAG,IAAI,CAAC;IAET,MAAM,EACJ,EAAE,EACF,KAAK,EACL,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,iBAAiB,GAC5B,GAAG,QAAQ,CAAC;IAEb,oCAAoC;IACpC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,iCAAiC;IACjC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,0CAA0C;IAC1C,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,CAAC,cAAc,CAAC,yBAAyB,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,iBAAiB,EAAE,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,8CAAoB,EAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC;IAEjE,6CAA6C;IAC7C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,sDAAsD;IACtD,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,iDAAiD,SAAS,gBAAgB,iBAAiB,GAAG,CAC/F,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QACnD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACrB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,uBAAuB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,IACE,iBAAiB,CAAC,UAAU;QAC5B,OAAO,iBAAiB,CAAC,UAAU,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IACE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,2BAAgB,EAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,cAAc,GAClB,IAAA,iDAAsB,EAAC,cAAc,CAAC,CAAC;IACzC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;IAEpD,yCAAyC;IACzC,MAAM,WAAW,GAAG,IAAA,wCAAiB,EAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEhE,wDAAwD;IACxD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,wCAAwC;IACxC,IAAI,uBAAuB,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,aAAM,EAC3B,IAAA,2BAAgB,EAAC,iBAAiB,CAAC,cAAc,CAAC,CACnD,CAAC;IACF,MAAM,aAAa,GAAG,IAAA,mBAAW,EAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAEpE,MAAM,SAAS,GAAG,IAAA,2BAAgB,EAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,aAAa,GAAG,IAAA,6BAAiB,EACrC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EACpC,CAAC,CACF,CAAC,CAAC,CAAqC,CAAC;IAEzC,MAAM,QAAQ,GAAG,MAAM,IAAA,kCAAe,EAAC;QACrC,aAAa;QACb,SAAS;QACT,IAAI,EAAE,aAAa;KACpB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,IACE,CAAC,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,UAAU,CAAC,OAAO,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,wCAAwC,UAAU,CAAC,OAAO,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,kBAAkB,EAAE;YAClB,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,UAAU,EAAE,OAAO;YACnB,YAAY,EAAE,KAAK,CAAC,EAAE;YACtB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,IAAI,EAAE,WAAW;SAClB;KACF,CAAC;AACJ,CAAC;AA3JD,oEA2JC","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\nimport { concatBytes } from '@metamask/utils';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport type { AuthenticatorTransportFuture } from '../types';\nimport { base64URLToBytes } from '../utils/encoding';\nimport { decodeClientDataJSON } from './decode-client-data-json';\nimport { matchExpectedRPID } from './match-expected-rp-id';\nimport { parseAuthenticatorData } from './parse-authenticator-data';\nimport type { ParsedAuthenticatorData } from './types';\nimport type { PasskeyAuthenticationResponse } from './types';\nimport { verifySignature } from './verify-signature';\n\nexport type VerifiedAuthenticationResponse =\n  | { verified: false; authenticationInfo?: never }\n  | {\n      verified: true;\n      authenticationInfo: {\n        credentialId: string;\n        newCounter: number;\n        userVerified: boolean;\n        origin: string;\n        rpID: string;\n      };\n    };\n\n/**\n * Verifies a WebAuthn authentication (assertion) response per\n * W3C WebAuthn Level 3 §7.2.\n *\n * Performs the following checks in order:\n * 1. Credential ID presence, base64url consistency, and type.\n * 2. `clientDataJSON` -- type is `\"webauthn.get\"`, challenge and origin\n *    match.\n * 3. `authenticatorData` -- RP ID hash matches, user-presence flag is\n *    set, and optional user-verification flag is checked.\n * 4. Signature verification -- `signature` is verified over\n *    `authData || SHA-256(clientDataJSON)` using the stored credential\n *    public key (COSE-encoded).\n * 5. Counter monotonicity -- if either the stored or returned counter\n *    is non-zero, the new counter must exceed the stored value.\n *\n * @param opts - Verification options.\n * @param opts.response - The `PublicKeyCredential` result from\n *   `navigator.credentials.get()`, serialized as JSON.\n * @param opts.expectedChallenge - The base64url challenge that was issued\n *   for this ceremony.\n * @param opts.expectedOrigin - One or more acceptable origins.\n * @param opts.expectedRPID - The Relying Party ID domain.\n * @param opts.credential - The stored credential record to verify against.\n * @param opts.credential.id - The credential ID (base64url).\n * @param opts.credential.publicKey - The COSE-encoded public key bytes\n *   persisted during registration.\n * @param opts.credential.counter - The last known signature counter value.\n * @param opts.credential.transports - Optional authenticator transports.\n * @param opts.requireUserVerification - When `true`, verification fails\n *   if the UV flag is not set. Defaults to `false`.\n * @returns Verification result containing `verified` status and parsed\n *   authentication info (new counter, origin, RP ID).\n */\nexport async function verifyAuthenticationResponse(opts: {\n  response: PasskeyAuthenticationResponse;\n  expectedChallenge: string;\n  expectedOrigin: string | string[];\n  expectedRPID: string;\n  credential: {\n    id: string;\n    publicKey: Uint8Array;\n    counter: number;\n    transports?: AuthenticatorTransportFuture[];\n  };\n  requireUserVerification?: boolean;\n}): Promise<VerifiedAuthenticationResponse> {\n  const {\n    response,\n    expectedChallenge,\n    expectedOrigin,\n    expectedRPID,\n    credential,\n    requireUserVerification = false,\n  } = opts;\n\n  const {\n    id,\n    rawId,\n    type: credentialType,\n    response: assertionResponse,\n  } = response;\n\n  // Ensure credential specified an ID\n  if (!id) {\n    throw new Error('Missing credential ID');\n  }\n\n  // Ensure ID is base64url-encoded\n  if (id !== rawId) {\n    throw new Error('Credential ID was not base64url-encoded');\n  }\n\n  // Make sure credential type is public-key\n  if (credentialType !== 'public-key') {\n    throw new Error(\n      `Unexpected credential type ${String(credentialType)}, expected \"public-key\"`,\n    );\n  }\n\n  if (typeof assertionResponse?.clientDataJSON !== 'string') {\n    throw new Error('Credential response clientDataJSON was not a string');\n  }\n\n  const clientDataJSON = decodeClientDataJSON(assertionResponse.clientDataJSON);\n  const { type, challenge, origin, tokenBinding } = clientDataJSON;\n\n  // Make sure we're handling an authentication\n  if (type !== 'webauthn.get') {\n    throw new Error(`Unexpected authentication response type: ${type}`);\n  }\n\n  // Ensure the device provided the challenge we gave it\n  if (challenge !== expectedChallenge) {\n    throw new Error(\n      `Unexpected authentication response challenge \"${challenge}\", expected \"${expectedChallenge}\"`,\n    );\n  }\n\n  // Check that the origin is our site\n  const expectedOrigins = Array.isArray(expectedOrigin)\n    ? expectedOrigin\n    : [expectedOrigin];\n  if (!expectedOrigins.includes(origin)) {\n    throw new Error(\n      `Unexpected authentication response origin \"${origin}\", expected one of: ${expectedOrigins.join(', ')}`,\n    );\n  }\n\n  if (\n    assertionResponse.userHandle &&\n    typeof assertionResponse.userHandle !== 'string'\n  ) {\n    throw new Error('Credential response userHandle was not a string');\n  }\n\n  if (tokenBinding) {\n    if (typeof tokenBinding !== 'object') {\n      throw new Error('ClientDataJSON tokenBinding was not an object');\n    }\n\n    if (\n      !['present', 'supported', 'not-supported'].includes(tokenBinding.status)\n    ) {\n      throw new Error(`Unexpected tokenBinding status ${tokenBinding.status}`);\n    }\n  }\n\n  const authDataBuffer = base64URLToBytes(assertionResponse.authenticatorData);\n  const parsedAuthData: ParsedAuthenticatorData =\n    parseAuthenticatorData(authDataBuffer);\n  const { rpIdHash, flags, counter } = parsedAuthData;\n\n  // Make sure the response's RP ID is ours\n  const matchedRPID = matchExpectedRPID(rpIdHash, [expectedRPID]);\n\n  // WebAuthn only requires the user presence flag be true\n  if (!flags.up) {\n    throw new Error('User not present during authentication');\n  }\n\n  // Enforce user verification if required\n  if (requireUserVerification && !flags.uv) {\n    throw new Error(\n      'User verification required, but user could not be verified',\n    );\n  }\n\n  const clientDataHash = sha256(\n    base64URLToBytes(assertionResponse.clientDataJSON),\n  );\n  const signatureBase = concatBytes([authDataBuffer, clientDataHash]);\n\n  const signature = base64URLToBytes(assertionResponse.signature);\n\n  const cosePublicKey = decodePartialCBOR(\n    new Uint8Array(credential.publicKey),\n    0,\n  )[0] as Map<number, number | Uint8Array>;\n\n  const verified = await verifySignature({\n    cosePublicKey,\n    signature,\n    data: signatureBase,\n  });\n\n  if (!verified) {\n    return { verified: false };\n  }\n\n  if (\n    (counter > 0 || credential.counter > 0) &&\n    counter <= credential.counter\n  ) {\n    throw new Error(\n      `Response counter value ${counter} must be greater than stored counter ${credential.counter}`,\n    );\n  }\n\n  return {\n    verified: true,\n    authenticationInfo: {\n      credentialId: credential.id,\n      newCounter: counter,\n      userVerified: flags.uv,\n      origin: clientDataJSON.origin,\n      rpID: matchedRPID,\n    },\n  };\n}\n"]}
+{"version":3,"file":"verify-authentication-response.cjs","sourceRoot":"","sources":["../../src/webauthn/verify-authentication-response.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAC1D,2CAA8C;AAC9C,6CAA4C;AAG5C,oDAAqD;AACrD,2EAAiE;AACjE,qEAA2D;AAC3D,6EAAoE;AAGpE,6DAAqD;AAgBrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACI,KAAK,UAAU,4BAA4B,CAAC,IAYlD;IACC,MAAM,EACJ,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,UAAU,EACV,uBAAuB,GAAG,KAAK,GAChC,GAAG,IAAI,CAAC;IAET,MAAM,EACJ,EAAE,EACF,KAAK,EACL,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,iBAAiB,GAC5B,GAAG,QAAQ,CAAC;IAEb,oCAAoC;IACpC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,iCAAiC;IACjC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,0CAA0C;IAC1C,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,CAAC,cAAc,CAAC,yBAAyB,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,iBAAiB,EAAE,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,8CAAoB,EAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC;IAEjE,6CAA6C;IAC7C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,sDAAsD;IACtD,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,iDAAiD,SAAS,gBAAgB,iBAAiB,GAAG,CAC/F,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QACnD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACrB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,uBAAuB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,IACE,iBAAiB,CAAC,UAAU;QAC5B,OAAO,iBAAiB,CAAC,UAAU,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IACE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,2BAAgB,EAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,cAAc,GAClB,IAAA,iDAAsB,EAAC,cAAc,CAAC,CAAC;IACzC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;IAEpD,MAAM,WAAW,GACf,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,wCAAiB,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7E,wDAAwD;IACxD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,wCAAwC;IACxC,IAAI,uBAAuB,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,aAAM,EAC3B,IAAA,2BAAgB,EAAC,iBAAiB,CAAC,cAAc,CAAC,CACnD,CAAC;IACF,MAAM,aAAa,GAAG,IAAA,mBAAW,EAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAEpE,MAAM,SAAS,GAAG,IAAA,2BAAgB,EAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,aAAa,GAAG,IAAA,6BAAiB,EACrC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EACpC,CAAC,CACF,CAAC,CAAC,CAAqC,CAAC;IAEzC,MAAM,QAAQ,GAAG,MAAM,IAAA,kCAAe,EAAC;QACrC,aAAa;QACb,SAAS;QACT,IAAI,EAAE,aAAa;KACpB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,IACE,CAAC,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,UAAU,CAAC,OAAO,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,wCAAwC,UAAU,CAAC,OAAO,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,kBAAkB,EAAE;YAClB,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,UAAU,EAAE,OAAO;YACnB,YAAY,EAAE,KAAK,CAAC,EAAE;YACtB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,IAAI,EAAE,WAAW;SAClB;KACF,CAAC;AACJ,CAAC;AA3JD,oEA2JC","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\nimport { concatBytes } from '@metamask/utils';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport type { AuthenticatorTransportFuture } from '../types';\nimport { base64URLToBytes } from '../utils/encoding';\nimport { decodeClientDataJSON } from './decode-client-data-json';\nimport { matchExpectedRPID } from './match-expected-rp-id';\nimport { parseAuthenticatorData } from './parse-authenticator-data';\nimport type { ParsedAuthenticatorData } from './types';\nimport type { PasskeyAuthenticationResponse } from './types';\nimport { verifySignature } from './verify-signature';\n\nexport type VerifiedAuthenticationResponse =\n  | { verified: false; authenticationInfo?: never }\n  | {\n      verified: true;\n      authenticationInfo: {\n        credentialId: string;\n        newCounter: number;\n        userVerified: boolean;\n        origin: string;\n        /** Matched RP ID, or `\"\"` when `expectedRPIDs` is empty (RP ID hash check skipped). */\n        rpID: string;\n      };\n    };\n\n/**\n * Verifies a WebAuthn authentication (assertion) response per\n * W3C WebAuthn Level 3 §7.2.\n *\n * Performs the following checks in order:\n * 1. Credential ID presence, base64url consistency, and type.\n * 2. `clientDataJSON` -- type is `\"webauthn.get\"`, challenge and origin\n *    match.\n * 3. `authenticatorData` -- RP ID hash matches, user-presence flag is\n *    set, and optional user-verification flag is checked.\n * 4. Signature verification -- `signature` is verified over\n *    `authData || SHA-256(clientDataJSON)` using the stored credential\n *    public key (COSE-encoded).\n * 5. Counter monotonicity -- if either the stored or returned counter\n *    is non-zero, the new counter must exceed the stored value.\n *\n * @param opts - Verification options.\n * @param opts.response - The `PublicKeyCredential` result from\n *   `navigator.credentials.get()`, serialized as JSON.\n * @param opts.expectedChallenge - The base64url challenge that was issued\n *   for this ceremony.\n * @param opts.expectedOrigin - One or more acceptable origins.\n * @param opts.expectedRPIDs - Relying Party ID strings to match against `rpIdHash`.\n * @param opts.credential - The stored credential record to verify against.\n * @param opts.credential.id - The credential ID (base64url).\n * @param opts.credential.publicKey - The COSE-encoded public key bytes\n *   persisted during registration.\n * @param opts.credential.counter - The last known signature counter value.\n * @param opts.credential.transports - Optional authenticator transports.\n * @param opts.requireUserVerification - When `true`, verification fails\n *   if the UV flag is not set. Defaults to `false`.\n * @returns Verification result containing `verified` status and parsed\n *   authentication info (new counter, origin, RP ID).\n */\nexport async function verifyAuthenticationResponse(opts: {\n  response: PasskeyAuthenticationResponse;\n  expectedChallenge: string;\n  expectedOrigin: string | string[];\n  expectedRPIDs: string[];\n  credential: {\n    id: string;\n    publicKey: Uint8Array;\n    counter: number;\n    transports?: AuthenticatorTransportFuture[];\n  };\n  requireUserVerification?: boolean;\n}): Promise<VerifiedAuthenticationResponse> {\n  const {\n    response,\n    expectedChallenge,\n    expectedOrigin,\n    expectedRPIDs,\n    credential,\n    requireUserVerification = false,\n  } = opts;\n\n  const {\n    id,\n    rawId,\n    type: credentialType,\n    response: assertionResponse,\n  } = response;\n\n  // Ensure credential specified an ID\n  if (!id) {\n    throw new Error('Missing credential ID');\n  }\n\n  // Ensure ID is base64url-encoded\n  if (id !== rawId) {\n    throw new Error('Credential ID was not base64url-encoded');\n  }\n\n  // Make sure credential type is public-key\n  if (credentialType !== 'public-key') {\n    throw new Error(\n      `Unexpected credential type ${String(credentialType)}, expected \"public-key\"`,\n    );\n  }\n\n  if (typeof assertionResponse?.clientDataJSON !== 'string') {\n    throw new Error('Credential response clientDataJSON was not a string');\n  }\n\n  const clientDataJSON = decodeClientDataJSON(assertionResponse.clientDataJSON);\n  const { type, challenge, origin, tokenBinding } = clientDataJSON;\n\n  // Make sure we're handling an authentication\n  if (type !== 'webauthn.get') {\n    throw new Error(`Unexpected authentication response type: ${type}`);\n  }\n\n  // Ensure the device provided the challenge we gave it\n  if (challenge !== expectedChallenge) {\n    throw new Error(\n      `Unexpected authentication response challenge \"${challenge}\", expected \"${expectedChallenge}\"`,\n    );\n  }\n\n  // Check that the origin is our site\n  const expectedOrigins = Array.isArray(expectedOrigin)\n    ? expectedOrigin\n    : [expectedOrigin];\n  if (!expectedOrigins.includes(origin)) {\n    throw new Error(\n      `Unexpected authentication response origin \"${origin}\", expected one of: ${expectedOrigins.join(', ')}`,\n    );\n  }\n\n  if (\n    assertionResponse.userHandle &&\n    typeof assertionResponse.userHandle !== 'string'\n  ) {\n    throw new Error('Credential response userHandle was not a string');\n  }\n\n  if (tokenBinding) {\n    if (typeof tokenBinding !== 'object') {\n      throw new Error('ClientDataJSON tokenBinding was not an object');\n    }\n\n    if (\n      !['present', 'supported', 'not-supported'].includes(tokenBinding.status)\n    ) {\n      throw new Error(`Unexpected tokenBinding status ${tokenBinding.status}`);\n    }\n  }\n\n  const authDataBuffer = base64URLToBytes(assertionResponse.authenticatorData);\n  const parsedAuthData: ParsedAuthenticatorData =\n    parseAuthenticatorData(authDataBuffer);\n  const { rpIdHash, flags, counter } = parsedAuthData;\n\n  const matchedRPID =\n    expectedRPIDs.length > 0 ? matchExpectedRPID(rpIdHash, expectedRPIDs) : '';\n\n  // WebAuthn only requires the user presence flag be true\n  if (!flags.up) {\n    throw new Error('User not present during authentication');\n  }\n\n  // Enforce user verification if required\n  if (requireUserVerification && !flags.uv) {\n    throw new Error(\n      'User verification required, but user could not be verified',\n    );\n  }\n\n  const clientDataHash = sha256(\n    base64URLToBytes(assertionResponse.clientDataJSON),\n  );\n  const signatureBase = concatBytes([authDataBuffer, clientDataHash]);\n\n  const signature = base64URLToBytes(assertionResponse.signature);\n\n  const cosePublicKey = decodePartialCBOR(\n    new Uint8Array(credential.publicKey),\n    0,\n  )[0] as Map<number, number | Uint8Array>;\n\n  const verified = await verifySignature({\n    cosePublicKey,\n    signature,\n    data: signatureBase,\n  });\n\n  if (!verified) {\n    return { verified: false };\n  }\n\n  if (\n    (counter > 0 || credential.counter > 0) &&\n    counter <= credential.counter\n  ) {\n    throw new Error(\n      `Response counter value ${counter} must be greater than stored counter ${credential.counter}`,\n    );\n  }\n\n  return {\n    verified: true,\n    authenticationInfo: {\n      credentialId: credential.id,\n      newCounter: counter,\n      userVerified: flags.uv,\n      origin: clientDataJSON.origin,\n      rpID: matchedRPID,\n    },\n  };\n}\n"]}

package/dist/webauthn/verify-authentication-response.d.cts

@@ -10,6 +10,7 @@ export type VerifiedAuthenticationResponse = {
         newCounter: number;
         userVerified: boolean;
         origin: string;
+        /** Matched RP ID, or `""` when `expectedRPIDs` is empty (RP ID hash check skipped). */
         rpID: string;
     };
 };
@@ -35,7 +36,7 @@ export type VerifiedAuthenticationResponse = {
  * @param opts.expectedChallenge - The base64url challenge that was issued
  *   for this ceremony.
  * @param opts.expectedOrigin - One or more acceptable origins.
- * @param opts.expectedRPID - The Relying Party ID domain.
+ * @param opts.expectedRPIDs - Relying Party ID strings to match against `rpIdHash`.
  * @param opts.credential - The stored credential record to verify against.
  * @param opts.credential.id - The credential ID (base64url).
  * @param opts.credential.publicKey - The COSE-encoded public key bytes
@@ -51,7 +52,7 @@ export declare function verifyAuthenticationResponse(opts: {
     response: PasskeyAuthenticationResponse;
     expectedChallenge: string;
     expectedOrigin: string | string[];
-    expectedRPID: string;
+    expectedRPIDs: string[];
     credential: {
         id: string;
         publicKey: Uint8Array;

package/dist/webauthn/verify-authentication-response.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-authentication-response.d.cts","sourceRoot":"","sources":["../../src/webauthn/verify-authentication-response.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,4BAA4B,EAAE,qBAAiB;AAM7D,OAAO,KAAK,EAAE,6BAA6B,EAAE,oBAAgB;AAG7D,MAAM,MAAM,8BAA8B,GACtC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/C;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,kBAAkB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,QAAQ,EAAE,6BAA6B,CAAC;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,UAAU,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,CAAC;IACF,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA+I1C"}
+{"version":3,"file":"verify-authentication-response.d.cts","sourceRoot":"","sources":["../../src/webauthn/verify-authentication-response.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,4BAA4B,EAAE,qBAAiB;AAM7D,OAAO,KAAK,EAAE,6BAA6B,EAAE,oBAAgB;AAG7D,MAAM,MAAM,8BAA8B,GACtC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/C;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,kBAAkB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,uFAAuF;QACvF,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,QAAQ,EAAE,6BAA6B,CAAC;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,UAAU,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,CAAC;IACF,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA+I1C"}

package/dist/webauthn/verify-authentication-response.d.mts

@@ -10,6 +10,7 @@ export type VerifiedAuthenticationResponse = {
         newCounter: number;
         userVerified: boolean;
         origin: string;
+        /** Matched RP ID, or `""` when `expectedRPIDs` is empty (RP ID hash check skipped). */
         rpID: string;
     };
 };
@@ -35,7 +36,7 @@ export type VerifiedAuthenticationResponse = {
  * @param opts.expectedChallenge - The base64url challenge that was issued
  *   for this ceremony.
  * @param opts.expectedOrigin - One or more acceptable origins.
- * @param opts.expectedRPID - The Relying Party ID domain.
+ * @param opts.expectedRPIDs - Relying Party ID strings to match against `rpIdHash`.
  * @param opts.credential - The stored credential record to verify against.
  * @param opts.credential.id - The credential ID (base64url).
  * @param opts.credential.publicKey - The COSE-encoded public key bytes
@@ -51,7 +52,7 @@ export declare function verifyAuthenticationResponse(opts: {
     response: PasskeyAuthenticationResponse;
     expectedChallenge: string;
     expectedOrigin: string | string[];
-    expectedRPID: string;
+    expectedRPIDs: string[];
     credential: {
         id: string;
         publicKey: Uint8Array;

package/dist/webauthn/verify-authentication-response.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-authentication-response.d.mts","sourceRoot":"","sources":["../../src/webauthn/verify-authentication-response.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,4BAA4B,EAAE,qBAAiB;AAM7D,OAAO,KAAK,EAAE,6BAA6B,EAAE,oBAAgB;AAG7D,MAAM,MAAM,8BAA8B,GACtC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/C;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,kBAAkB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,QAAQ,EAAE,6BAA6B,CAAC;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,UAAU,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,CAAC;IACF,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA+I1C"}
+{"version":3,"file":"verify-authentication-response.d.mts","sourceRoot":"","sources":["../../src/webauthn/verify-authentication-response.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,4BAA4B,EAAE,qBAAiB;AAM7D,OAAO,KAAK,EAAE,6BAA6B,EAAE,oBAAgB;AAG7D,MAAM,MAAM,8BAA8B,GACtC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,kBAAkB,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/C;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,kBAAkB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,uFAAuF;QACvF,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,QAAQ,EAAE,6BAA6B,CAAC;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,UAAU,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,CAAC;IACF,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA+I1C"}