@metamask/passkey-controller 2.0.1 → 3.0.0

package/dist/PasskeyController.cjs

@@ -10,11 +10,12 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _PasskeyController_instances, _PasskeyController_ceremonyManager, _PasskeyController_expectedRPIDs, _PasskeyController_rpId, _PasskeyController_rpName, _PasskeyController_expectedOrigin, _PasskeyController_userName, _PasskeyController_userDisplayName, _PasskeyController_requireEnrolled, _PasskeyController_getChallengeFromClientData, _PasskeyController_verifyAuthenticationResponse;
+var _PasskeyController_instances, _PasskeyController_ceremonyManager, _PasskeyController_expectedRPIDs, _PasskeyController_rpId, _PasskeyController_rpName, _PasskeyController_expectedOrigin, _PasskeyController_userName, _PasskeyController_userDisplayName, _PasskeyController_getIsOnboardingCompleted, _PasskeyController_operationMutex, _PasskeyController_protectVaultKeyWithPasskey, _PasskeyController_retrieveVaultKeyWithPasskey, _PasskeyController_verifyPasskeyAuthentication, _PasskeyController_renewVaultKeyProtection, _PasskeyController_changePasswordWithPasskeyVerification, _PasskeyController_removePasskeyWithPasskeyVerification, _PasskeyController_removePasskeyWithPasswordVerification, _PasskeyController_verifyAuthenticationResponse, _PasskeyController_withOperationLock, _PasskeyController_assertEnrollmentAllowed, _PasskeyController_requireEnrolled, _PasskeyController_getChallengeFromClientData, _PasskeyController_removePasskey;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PasskeyController = exports.passkeyControllerSelectors = exports.getDefaultPasskeyControllerState = void 0;
 const base_controller_1 = require("@metamask/base-controller");
 const utils_1 = require("@metamask/utils");
+const async_mutex_1 = require("async-mutex");
 const ceremony_manager_1 = require("./ceremony-manager.cjs");
 const constants_1 = require("./constants.cjs");
 const errors_1 = require("./errors.cjs");
@@ -54,6 +55,24 @@ const log = (0, logger_1.createModuleLogger)(logger_1.projectLogger, constants_1
 exports.passkeyControllerSelectors = {
     selectIsPasskeyEnrolled: (state) => state.passkeyRecord !== null,
 };
+const MESSENGER_EXPOSED_METHODS = [
+    'isPasskeyEnrolled',
+    'generateRegistrationOptions',
+    'generatePostRegistrationAuthenticationOptions',
+    'generateAuthenticationOptions',
+    'protectVaultKeyWithPasskey',
+    'retrieveVaultKeyWithPasskey',
+    'unlockWithPasskey',
+    'verifyPasskeyAuthentication',
+    'renewVaultKeyProtection',
+    'changePasswordWithPasskeyVerification',
+    'exportSeedPhraseWithPasskey',
+    'exportAccountsWithPasskey',
+    'removePasskeyWithPasskeyVerification',
+    'removePasskeyWithPasswordVerification',
+    'clearState',
+    'destroy',
+];
 /**
  * Controller that enrolls a WebAuthn passkey and uses it to protect and unlock
  * the vault encryption key.
@@ -62,20 +81,18 @@ class PasskeyController extends base_controller_1.BaseController {
     /**
      * Creates a passkey controller with WebAuthn relying-party settings.
      *
-     * @param args - Constructor options.
-     * @param args.messenger - Controller messenger.
-     * @param args.state - Partial initial state; merged with {@link getDefaultPasskeyControllerState}.
-     * @param args.expectedRPID - Relying party ID(s) for verification (SHA-256 hash match in
-     *   authenticator data). Pass a string or array of strings; an empty array skips RP ID
-     *   allowlist checks in {@link verifyRegistrationResponse} / {@link verifyAuthenticationResponse}.
-     * @param args.rpId - When set, included as `rp.id` on registration options and `rpId` on
-     *   authentication options. When omitted, those fields are left unset (client default RP ID).
-     * @param args.rpName - Relying party name shown in the platform passkey UI.
-     * @param args.expectedOrigin - Allowed value(s) for the WebAuthn client origin.
-     * @param args.userName - Optional passkey user name; defaults to `rpName`.
-     * @param args.userDisplayName - Optional display name; defaults to `rpName`.
+     * @param options - Constructor options.
+     * @param options.messenger - The messenger to use for communication.
+     * @param options.state - The initial state of the controller.
+     * @param options.rpId - The relying party ID to use for the passkey.
+     * @param options.expectedRPID - The expected relying party ID to use for the passkey.
+     * @param options.rpName - The relying party name to use for the passkey.
+     * @param options.expectedOrigin - The expected origin to use for the passkey.
+     * @param options.userName - The user name to use for the passkey.
+     * @param options.userDisplayName - The user display name to use for the passkey.
+     * @param options.getIsOnboardingCompleted - The callback to use to check if onboarding is complete.
      */
-    constructor({ messenger, state = {}, rpId, expectedRPID, rpName, expectedOrigin, userName, userDisplayName, }) {
+    constructor({ messenger, state = {}, rpId, expectedRPID, rpName, expectedOrigin, userName, userDisplayName, getIsOnboardingCompleted, }) {
         super({
             messenger,
             metadata: passkeyControllerMetadata,
@@ -90,6 +107,8 @@ class PasskeyController extends base_controller_1.BaseController {
         _PasskeyController_expectedOrigin.set(this, void 0);
         _PasskeyController_userName.set(this, void 0);
         _PasskeyController_userDisplayName.set(this, void 0);
+        _PasskeyController_getIsOnboardingCompleted.set(this, void 0);
+        _PasskeyController_operationMutex.set(this, new async_mutex_1.Mutex());
         const expectedRPIDs = Array.isArray(expectedRPID)
             ? expectedRPID
             : [expectedRPID];
@@ -99,6 +118,8 @@ class PasskeyController extends base_controller_1.BaseController {
         __classPrivateFieldSet(this, _PasskeyController_expectedOrigin, expectedOrigin, "f");
         __classPrivateFieldSet(this, _PasskeyController_userName, userName ?? rpName, "f");
         __classPrivateFieldSet(this, _PasskeyController_userDisplayName, userDisplayName ?? rpName, "f");
+        __classPrivateFieldSet(this, _PasskeyController_getIsOnboardingCompleted, getIsOnboardingCompleted, "f");
+        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
     /**
      * Whether a passkey is enrolled and vault key material is stored.
@@ -243,113 +264,72 @@ class PasskeyController extends base_controller_1.BaseController {
      * Verifies registration and post-registration authentication, then stores the
      * vault key encrypted under the new passkey.
      *
+     * Fetches the current vault encryption key from KeyringController before wrapping.
+     * When onboarding is complete, requires `password` for step-up verification first.
+     *
      * @param params - Enrollment completion inputs.
      * @param params.registrationResponse - Result of `navigator.credentials.create()`.
      * @param params.authenticationResponse - Result of `navigator.credentials.get()` after {@link generatePostRegistrationAuthenticationOptions}.
-     * @param params.vaultKey - Vault encryption key to encrypt and persist.
+     * @param params.password - Wallet password when onboarding is complete (step-up).
+     * @returns Resolves when enrollment completes.
      */
     async protectVaultKeyWithPasskey(params) {
-        if (this.isPasskeyEnrolled()) {
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AlreadyEnrolled, { code: constants_1.PasskeyControllerErrorCode.AlreadyEnrolled });
-        }
-        const { registrationResponse, authenticationResponse, vaultKey } = params;
-        // get registration ceremony
-        const challenge = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_getChallengeFromClientData).call(this, registrationResponse.response.clientDataJSON);
-        const registrationCeremony = __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").getRegistrationCeremony(challenge);
-        if (!registrationCeremony) {
-            log('No active passkey registration ceremony for challenge');
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NoRegistrationCeremony, { code: constants_1.PasskeyControllerErrorCode.NoRegistrationCeremony });
-        }
-        try {
-            // verify registration response
-            const { verified, registrationInfo } = await (0, verify_registration_response_1.verifyRegistrationResponse)({
-                response: registrationResponse,
-                expectedChallenge: registrationCeremony.challenge,
-                expectedOrigin: __classPrivateFieldGet(this, _PasskeyController_expectedOrigin, "f"),
-                expectedRPIDs: __classPrivateFieldGet(this, _PasskeyController_expectedRPIDs, "f"),
-                requireUserVerification: true,
-            }).catch((error) => {
-                log('Error verifying passkey registration response', error);
-                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.RegistrationVerificationFailed, {
-                    code: constants_1.PasskeyControllerErrorCode.RegistrationVerificationFailed,
-                    cause: error instanceof Error ? error : new Error(String(error)),
-                });
-            });
-            if (!verified || !registrationInfo) {
-                log('Passkey registration verification returned unverified or missing registration info');
-                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.RegistrationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.RegistrationVerificationFailed });
-            }
-            // verify authentication response
-            const credential = {
-                id: registrationInfo.credentialId,
-                publicKey: (0, encoding_1.bytesToBase64URL)(registrationInfo.publicKey),
-                counter: registrationInfo.counter,
-                transports: registrationInfo.transports,
-                aaguid: registrationInfo.aaguid,
-            };
-            const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, credential);
-            // determine key derivation method
-            const prfFirst = authenticationResponse.clientExtensionResults?.prf?.results?.first;
-            const authHasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;
-            const keyDerivation = authHasPrfOutput && registrationCeremony.prfSalt
-                ? { method: 'prf', prfSalt: registrationCeremony.prfSalt }
-                : { method: 'userHandle' };
-            if (keyDerivation.method === 'userHandle' &&
-                authenticationResponse.response.userHandle !==
-                    registrationCeremony.userHandle) {
-                log('Post-registration assertion userHandle does not match registration ceremony');
-                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.AuthenticationVerificationFailed });
-            }
-            // derive key and encrypt vault key
-            const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, { credential, keyDerivation });
-            const { ciphertext, iv } = (0, crypto_1.encryptWithKey)(vaultKey, encKey);
-            // persist passkey record
-            this.update((state) => {
-                state.passkeyRecord = {
-                    credential: {
-                        ...credential,
-                        counter: Math.max(newCounter, credential.counter),
-                    },
-                    encryptedVaultKey: { ciphertext, iv },
-                    keyDerivation,
-                };
-            });
-        }
-        finally {
-            // delete registration ceremony
-            __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").deleteRegistrationCeremony(challenge);
-        }
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_protectVaultKeyWithPasskey).call(this, params));
     }
     /**
      * Verifies an authentication assertion and returns the decrypted vault key.
      *
+     * Prefer orchestrated methods ({@link unlockWithPasskey},
+     * {@link exportSeedPhraseWithPasskey}, {@link exportAccountsWithPasskey}) for product
+     * flows instead of calling KeyringController with the returned key manually.
+     *
      * @param authenticationResponse - Result of `navigator.credentials.get()`.
      * @returns The plaintext vault encryption key.
      */
     async retrieveVaultKeyWithPasskey(authenticationResponse) {
-        const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-        // verify authentication response and update counter
-        const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, passkeyRecord.credential);
-        this.update((state) => {
-            if (!state.passkeyRecord) {
-                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, { code: constants_1.PasskeyControllerErrorCode.NotEnrolled });
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse));
+    }
+    /**
+     * Unlocks the keyring using a passkey authentication assertion.
+     *
+     * @param authenticationResponse - Result of `navigator.credentials.get()`.
+     * @returns Resolves when the keyring is unlocked.
+     */
+    async unlockWithPasskey(authenticationResponse) {
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
+            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
+            await this.messenger.call('KeyringController:submitEncryptionKey', vaultKey);
+        });
+    }
+    /**
+     * Exports the seed phrase after passkey step-up authentication.
+     *
+     * @param authenticationResponse - Result of `navigator.credentials.get()`.
+     * @param keyringId - Optional keyring id; defaults to the primary HD keyring.
+     * @returns Raw seed phrase bytes from KeyringController.
+     */
+    async exportSeedPhraseWithPasskey(authenticationResponse, keyringId) {
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
+            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
+            return await this.messenger.call('KeyringController:exportSeedPhrase', { encryptionKey: vaultKey }, keyringId);
+        });
+    }
+    /**
+     * Exports private keys for the given addresses after passkey step-up authentication.
+     *
+     * @param authenticationResponse - Result of `navigator.credentials.get()`.
+     * @param addresses - Account addresses to export.
+     * @returns Private keys in the same order as `addresses`.
+     */
+    async exportAccountsWithPasskey(authenticationResponse, addresses) {
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
+            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
+            const privateKeys = [];
+            for (const address of addresses) {
+                privateKeys.push(await this.messenger.call('KeyringController:exportAccount', { encryptionKey: vaultKey }, address));
             }
-            state.passkeyRecord.credential.counter = Math.max(newCounter, state.passkeyRecord.credential.counter);
+            return privateKeys;
         });
-        // derive key
-        const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, passkeyRecord);
-        // decrypt vault key
-        try {
-            const vaultKey = (0, crypto_1.decryptWithKey)(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
-            return vaultKey;
-        }
-        catch (cause) {
-            log('Error decrypting vault key with passkey', cause instanceof Error ? cause : new Error(String(cause)));
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
-                code: constants_1.PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
-                cause: cause instanceof Error ? cause : new Error(String(cause)),
-            });
-        }
     }
     /**
      * Checks whether the given authentication assertion is valid for the enrolled passkey.
@@ -361,16 +341,7 @@ class PasskeyController extends base_controller_1.BaseController {
      * @returns `true` if verification succeeds, otherwise `false`.
      */
     async verifyPasskeyAuthentication(authenticationResponse) {
-        try {
-            await this.retrieveVaultKeyWithPasskey(authenticationResponse);
-            return true;
-        }
-        catch (error) {
-            if (error instanceof errors_1.PasskeyControllerError && error.code !== undefined) {
-                return false;
-            }
-            throw error;
-        }
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, authenticationResponse));
     }
     /**
      * Re-wraps the vault key after rotation. Updates persisted `encryptedVaultKey` on success.
@@ -380,59 +351,62 @@ class PasskeyController extends base_controller_1.BaseController {
      * pass the same `authenticationResponse` you just verified (e.g. from
      * {@link retrieveVaultKeyWithPasskey} / {@link verifyPasskeyAuthentication}).
      *
+     * For password change with passkey step-up, prefer
+     * {@link changePasswordWithPasskeyVerification}, which orchestrates keyring export,
+     * `changePassword`, and re-wrap in one call.
+     *
      * @param params - Re-wrap inputs.
      * @param params.authenticationResponse - Used to derive the wrapping key.
      * @param params.oldVaultKey - Expected current vault key.
      * @param params.newVaultKey - New vault key to encrypt under the passkey.
+     * @returns Resolves when the passkey record is updated.
      */
     async renewVaultKeyProtection(params) {
-        const { authenticationResponse } = params;
-        const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-        // derive key
-        const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, passkeyRecord);
-        // decrypt vault key
-        let decryptedVaultKey;
-        try {
-            decryptedVaultKey = (0, crypto_1.decryptWithKey)(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
-        }
-        catch (error) {
-            log('Error decrypting vault key during passkey vault key renewal', error instanceof Error ? error : new Error(String(error)));
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
-                code: constants_1.PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
-                cause: error instanceof Error ? error : new Error(String(error)),
-            });
-        }
-        // check if vault key matches
-        const { oldVaultKey, newVaultKey } = params;
-        if (!(0, utils_1.areUint8ArraysEqual)((0, utils_1.stringToBytes)(decryptedVaultKey), (0, utils_1.stringToBytes)(oldVaultKey))) {
-            log('Passkey renewal rejected: decrypted vault key does not match oldVaultKey');
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyMismatch, { code: constants_1.PasskeyControllerErrorCode.VaultKeyMismatch });
-        }
-        // encrypt new vault key
-        const { ciphertext, iv } = (0, crypto_1.encryptWithKey)(newVaultKey, encKey);
-        // persist passkey record (mutate current state only for vault key material)
-        this.update((state) => {
-            if (!state.passkeyRecord) {
-                throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, {
-                    code: constants_1.PasskeyControllerErrorCode.NotEnrolled,
-                });
-            }
-            state.passkeyRecord.encryptedVaultKey = { ciphertext, iv };
-        });
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_renewVaultKeyProtection).call(this, params));
     }
     /**
-     * Clears enrolled passkey state and in-flight ceremonies. Call only after the same
-     * auth gate as renewal (verified passkey assertion or password).
+     * Changes the wallet password after passkey step-up authentication.
+     *
+     * When `renewVaultKeyProtection` is `true` (default), re-wraps the vault key under the
+     * passkey after rotation. When `false`, removes the passkey instead.
+     *
+     * @param params - Change-password inputs.
+     * @param params.newPassword - New wallet password.
+     * @param params.authenticationResponse - Result of `navigator.credentials.get()`.
+     * @param params.options - Optional flow controls.
+     * @param params.options.renewVaultKeyProtection - Re-wrap vault key after password change.
+     * @returns Resolves when the password change completes.
      */
-    removePasskey() {
-        this.update(() => getDefaultPasskeyControllerState());
-        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").clear();
+    async changePasswordWithPasskeyVerification(params) {
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_changePasswordWithPasskeyVerification).call(this, params));
+    }
+    /**
+     * Removes the enrolled passkey after verifying a passkey authentication assertion.
+     *
+     * @param authenticationResponse - Result of `navigator.credentials.get()`.
+     * @returns Resolves when the passkey is removed.
+     */
+    async removePasskeyWithPasskeyVerification(authenticationResponse) {
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskeyWithPasskeyVerification).call(this, authenticationResponse));
+    }
+    /**
+     * Removes the enrolled passkey after verifying the wallet password.
+     *
+     * @param password - Wallet password for step-up verification.
+     * @returns Resolves when the passkey is removed.
+     */
+    async removePasskeyWithPasswordVerification(password) {
+        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskeyWithPasswordVerification).call(this, password));
     }
     /**
      * Resets state and clears in-flight registration/authentication ceremonies.
+     *
+     * For user-facing passkey removal with step-up, use
+     * {@link removePasskeyWithPasskeyVerification} or
+     * {@link removePasskeyWithPasswordVerification}.
      */
     clearState() {
-        this.removePasskey();
+        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
     }
     /**
      * Releases all in-flight ceremony state and tears down the messenger.
@@ -443,16 +417,188 @@ class PasskeyController extends base_controller_1.BaseController {
     }
 }
 exports.PasskeyController = PasskeyController;
-_PasskeyController_ceremonyManager = new WeakMap(), _PasskeyController_expectedRPIDs = new WeakMap(), _PasskeyController_rpId = new WeakMap(), _PasskeyController_rpName = new WeakMap(), _PasskeyController_expectedOrigin = new WeakMap(), _PasskeyController_userName = new WeakMap(), _PasskeyController_userDisplayName = new WeakMap(), _PasskeyController_instances = new WeakSet(), _PasskeyController_requireEnrolled = function _PasskeyController_requireEnrolled() {
-    const record = this.state.passkeyRecord;
-    if (!record) {
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, {
-            code: constants_1.PasskeyControllerErrorCode.NotEnrolled,
+_PasskeyController_ceremonyManager = new WeakMap(), _PasskeyController_expectedRPIDs = new WeakMap(), _PasskeyController_rpId = new WeakMap(), _PasskeyController_rpName = new WeakMap(), _PasskeyController_expectedOrigin = new WeakMap(), _PasskeyController_userName = new WeakMap(), _PasskeyController_userDisplayName = new WeakMap(), _PasskeyController_getIsOnboardingCompleted = new WeakMap(), _PasskeyController_operationMutex = new WeakMap(), _PasskeyController_instances = new WeakSet(), _PasskeyController_protectVaultKeyWithPasskey = async function _PasskeyController_protectVaultKeyWithPasskey(params) {
+    if (this.isPasskeyEnrolled()) {
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AlreadyEnrolled, { code: constants_1.PasskeyControllerErrorCode.AlreadyEnrolled });
+    }
+    await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_assertEnrollmentAllowed).call(this, params.password);
+    const vaultKey = await this.messenger.call('KeyringController:exportEncryptionKey');
+    const { registrationResponse, authenticationResponse } = params;
+    // get registration ceremony
+    const challenge = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_getChallengeFromClientData).call(this, registrationResponse.response.clientDataJSON);
+    const registrationCeremony = __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").getRegistrationCeremony(challenge);
+    if (!registrationCeremony) {
+        log('No active passkey registration ceremony for challenge');
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NoRegistrationCeremony, { code: constants_1.PasskeyControllerErrorCode.NoRegistrationCeremony });
+    }
+    try {
+        // verify registration response
+        const { verified, registrationInfo } = await (0, verify_registration_response_1.verifyRegistrationResponse)({
+            response: registrationResponse,
+            expectedChallenge: registrationCeremony.challenge,
+            expectedOrigin: __classPrivateFieldGet(this, _PasskeyController_expectedOrigin, "f"),
+            expectedRPIDs: __classPrivateFieldGet(this, _PasskeyController_expectedRPIDs, "f"),
+            requireUserVerification: true,
+        }).catch((error) => {
+            log('Error verifying passkey registration response', error);
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.RegistrationVerificationFailed, {
+                code: constants_1.PasskeyControllerErrorCode.RegistrationVerificationFailed,
+                cause: error instanceof Error ? error : new Error(String(error)),
+            });
+        });
+        if (!verified || !registrationInfo) {
+            log('Passkey registration verification returned unverified or missing registration info');
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.RegistrationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.RegistrationVerificationFailed });
+        }
+        // verify authentication response
+        const credential = {
+            id: registrationInfo.credentialId,
+            publicKey: (0, encoding_1.bytesToBase64URL)(registrationInfo.publicKey),
+            counter: registrationInfo.counter,
+            transports: registrationInfo.transports,
+            aaguid: registrationInfo.aaguid,
+        };
+        const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, credential);
+        // determine key derivation method
+        const prfFirst = authenticationResponse.clientExtensionResults?.prf?.results?.first;
+        const authHasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;
+        const keyDerivation = authHasPrfOutput && registrationCeremony.prfSalt
+            ? { method: 'prf', prfSalt: registrationCeremony.prfSalt }
+            : { method: 'userHandle' };
+        if (keyDerivation.method === 'userHandle' &&
+            authenticationResponse.response.userHandle !==
+                registrationCeremony.userHandle) {
+            log('Post-registration assertion userHandle does not match registration ceremony');
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.AuthenticationVerificationFailed });
+        }
+        // derive key and encrypt vault key
+        const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, { credential, keyDerivation });
+        const { ciphertext, iv } = (0, crypto_1.encryptWithKey)(vaultKey, encKey);
+        // persist passkey record
+        this.update((state) => {
+            state.passkeyRecord = {
+                credential: {
+                    ...credential,
+                    counter: Math.max(newCounter, credential.counter),
+                },
+                encryptedVaultKey: { ciphertext, iv },
+                keyDerivation,
+            };
         });
     }
-    return record;
-}, _PasskeyController_getChallengeFromClientData = function _PasskeyController_getChallengeFromClientData(clientDataJSON) {
-    return (0, decode_client_data_json_1.decodeClientDataJSON)(clientDataJSON).challenge;
+    finally {
+        // delete registration ceremony
+        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").deleteRegistrationCeremony(challenge);
+    }
+}, _PasskeyController_retrieveVaultKeyWithPasskey = async function _PasskeyController_retrieveVaultKeyWithPasskey(authenticationResponse) {
+    const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
+    // verify authentication response and update counter
+    const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, passkeyRecord.credential);
+    this.update((state) => {
+        if (!state.passkeyRecord) {
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, { code: constants_1.PasskeyControllerErrorCode.NotEnrolled });
+        }
+        state.passkeyRecord.credential.counter = Math.max(newCounter, state.passkeyRecord.credential.counter);
+    });
+    // derive key
+    const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, passkeyRecord);
+    // decrypt vault key
+    try {
+        const vaultKey = (0, crypto_1.decryptWithKey)(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
+        return vaultKey;
+    }
+    catch (cause) {
+        log('Error decrypting vault key with passkey', cause instanceof Error ? cause : new Error(String(cause)));
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
+            code: constants_1.PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
+            cause: cause instanceof Error ? cause : new Error(String(cause)),
+        });
+    }
+}, _PasskeyController_verifyPasskeyAuthentication = async function _PasskeyController_verifyPasskeyAuthentication(authenticationResponse) {
+    try {
+        await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof errors_1.PasskeyControllerError && error.code !== undefined) {
+            return false;
+        }
+        throw error;
+    }
+}, _PasskeyController_renewVaultKeyProtection = async function _PasskeyController_renewVaultKeyProtection(params) {
+    const { authenticationResponse } = params;
+    const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
+    // derive key
+    const encKey = (0, key_derivation_1.deriveKeyFromAuthenticationResponse)(authenticationResponse, passkeyRecord);
+    // decrypt vault key
+    let decryptedVaultKey;
+    try {
+        decryptedVaultKey = (0, crypto_1.decryptWithKey)(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
+    }
+    catch (error) {
+        log('Error decrypting vault key during passkey vault key renewal', error instanceof Error ? error : new Error(String(error)));
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
+            code: constants_1.PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
+            cause: error instanceof Error ? error : new Error(String(error)),
+        });
+    }
+    // check if vault key matches
+    const { oldVaultKey, newVaultKey } = params;
+    if (!(0, utils_1.areUint8ArraysEqual)((0, utils_1.stringToBytes)(decryptedVaultKey), (0, utils_1.stringToBytes)(oldVaultKey))) {
+        log('Passkey renewal rejected: decrypted vault key does not match oldVaultKey');
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyMismatch, { code: constants_1.PasskeyControllerErrorCode.VaultKeyMismatch });
+    }
+    // encrypt new vault key
+    const { ciphertext, iv } = (0, crypto_1.encryptWithKey)(newVaultKey, encKey);
+    // persist passkey record (mutate current state only for vault key material)
+    this.update((state) => {
+        if (!state.passkeyRecord) {
+            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, {
+                code: constants_1.PasskeyControllerErrorCode.NotEnrolled,
+            });
+        }
+        state.passkeyRecord.encryptedVaultKey = { ciphertext, iv };
+    });
+}, _PasskeyController_changePasswordWithPasskeyVerification = async function _PasskeyController_changePasswordWithPasskeyVerification(params) {
+    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
+    const verified = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, params.authenticationResponse);
+    if (!verified) {
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.AuthenticationVerificationFailed });
+    }
+    const renewVaultKeyProtection = params.options?.renewVaultKeyProtection ?? true;
+    if (!renewVaultKeyProtection) {
+        await this.messenger.call('KeyringController:changePassword', params.newPassword);
+        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
+        return;
+    }
+    const vaultKeyBefore = await this.messenger.call('KeyringController:exportEncryptionKey');
+    await this.messenger.call('KeyringController:changePassword', params.newPassword);
+    try {
+        const vaultKeyAfter = await this.messenger.call('KeyringController:exportEncryptionKey');
+        await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_renewVaultKeyProtection).call(this, {
+            authenticationResponse: params.authenticationResponse,
+            oldVaultKey: vaultKeyBefore,
+            newVaultKey: vaultKeyAfter,
+        });
+    }
+    catch (error) {
+        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.VaultKeyRenewalFailed, {
+            code: constants_1.PasskeyControllerErrorCode.VaultKeyRenewalFailed,
+            cause: error instanceof Error ? error : new Error(String(error)),
+        });
+    }
+}, _PasskeyController_removePasskeyWithPasskeyVerification = async function _PasskeyController_removePasskeyWithPasskeyVerification(authenticationResponse) {
+    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
+    const verified = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, authenticationResponse);
+    if (!verified) {
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: constants_1.PasskeyControllerErrorCode.AuthenticationVerificationFailed });
+    }
+    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
+}, _PasskeyController_removePasskeyWithPasswordVerification = async function _PasskeyController_removePasskeyWithPasswordVerification(password) {
+    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
+    await this.messenger.call('KeyringController:verifyPassword', password);
+    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
 }, _PasskeyController_verifyAuthenticationResponse = 
 /**
  * Validates a WebAuthn authentication response against stored credential data.
@@ -503,5 +649,37 @@ async function _PasskeyController_verifyAuthenticationResponse(authenticationRes
         // delete authentication ceremony
         __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").deleteAuthenticationCeremony(challenge);
     }
+}, _PasskeyController_withOperationLock = 
+/**
+ * Serializes orchestrated passkey operations that mutate state or call KeyringController.
+ *
+ * @param callback - Operation to run while the mutex is held.
+ * @returns The result of the callback.
+ */
+async function _PasskeyController_withOperationLock(callback) {
+    return __classPrivateFieldGet(this, _PasskeyController_operationMutex, "f").runExclusive(callback);
+}, _PasskeyController_assertEnrollmentAllowed = async function _PasskeyController_assertEnrollmentAllowed(password) {
+    if (!__classPrivateFieldGet(this, _PasskeyController_getIsOnboardingCompleted, "f").call(this)) {
+        return;
+    }
+    if (!password) {
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.EnrollmentPasswordRequired, {
+            code: constants_1.PasskeyControllerErrorCode.EnrollmentPasswordRequired,
+        });
+    }
+    await this.messenger.call('KeyringController:verifyPassword', password);
+}, _PasskeyController_requireEnrolled = function _PasskeyController_requireEnrolled() {
+    const record = this.state.passkeyRecord;
+    if (!record) {
+        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.NotEnrolled, {
+            code: constants_1.PasskeyControllerErrorCode.NotEnrolled,
+        });
+    }
+    return record;
+}, _PasskeyController_getChallengeFromClientData = function _PasskeyController_getChallengeFromClientData(clientDataJSON) {
+    return (0, decode_client_data_json_1.decodeClientDataJSON)(clientDataJSON).challenge;
+}, _PasskeyController_removePasskey = function _PasskeyController_removePasskey() {
+    this.update(() => getDefaultPasskeyControllerState());
+    __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").clear();
 };
 //# sourceMappingURL=PasskeyController.cjs.map