@metamask/passkey-controller 2.1.0 → 3.1.0

package/dist/index.d.mts

@@ -1,8 +1,8 @@
 export { PasskeyControllerErrorCode, PasskeyControllerErrorMessage, } from "./constants.mjs";
 export { PasskeyControllerError } from "./errors.mjs";
 export { PasskeyController, getDefaultPasskeyControllerState, passkeyControllerSelectors, } from "./PasskeyController.mjs";
-export type { PasskeyControllerState, PasskeyControllerMessenger, PasskeyControllerGetStateAction, PasskeyControllerActions, PasskeyControllerStateChangedEvent, PasskeyControllerEvents, } from "./PasskeyController.mjs";
-export type { PasskeyCredentialInfo, PasskeyDerivationMethod, PasskeyKeyDerivation, PasskeyRecord, PrfEvalExtension, PrfClientExtensionResults, } from "./types.mjs";
+export type { PasskeyControllerState, PasskeyControllerMessenger, PasskeyControllerOptions, PasskeyControllerGetStateAction, PasskeyControllerActions, PasskeyControllerStateChangedEvent, PasskeyControllerEvents, PasskeyCredentialInfo, PasskeyDerivationMethod, PasskeyKeyDerivation, PasskeyRecord, PrfEvalExtension, PrfClientExtensionResults, } from "./types.mjs";
 export type { PasskeyRegistrationOptions, PasskeyRegistrationResponse, PasskeyAuthenticationOptions, PasskeyAuthenticationResponse, } from "./webauthn/types.mjs";
-export type { PasskeyControllerIsPasskeyEnrolledAction, PasskeyControllerGenerateRegistrationOptionsAction, PasskeyControllerGeneratePostRegistrationAuthenticationOptionsAction, PasskeyControllerGenerateAuthenticationOptionsAction, PasskeyControllerProtectVaultKeyWithPasskeyAction, PasskeyControllerRetrieveVaultKeyWithPasskeyAction, PasskeyControllerVerifyPasskeyAuthenticationAction, PasskeyControllerRenewVaultKeyProtectionAction, PasskeyControllerRemovePasskeyAction, PasskeyControllerClearStateAction, PasskeyControllerDestroyAction, } from "./PasskeyController-method-action-types.mjs";
+export { getAAGUIDFromRegistrationResponse } from "./webauthn/verify-registration-response.mjs";
+export type { PasskeyControllerIsPasskeyEnrolledAction, PasskeyControllerGenerateRegistrationOptionsAction, PasskeyControllerGeneratePostRegistrationAuthenticationOptionsAction, PasskeyControllerGenerateAuthenticationOptionsAction, PasskeyControllerProtectVaultKeyWithPasskeyAction, PasskeyControllerRetrieveVaultKeyWithPasskeyAction, PasskeyControllerUnlockWithPasskeyAction, PasskeyControllerExportSeedPhraseWithPasskeyAction, PasskeyControllerExportAccountsWithPasskeyAction, PasskeyControllerVerifyPasskeyAuthenticationAction, PasskeyControllerRenewVaultKeyProtectionAction, PasskeyControllerChangePasswordWithPasskeyVerificationAction, PasskeyControllerRemovePasskeyWithPasskeyVerificationAction, PasskeyControllerRemovePasskeyWithPasswordVerificationAction, PasskeyControllerClearStateAction, PasskeyControllerDestroyAction, } from "./PasskeyController-method-action-types.mjs";
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,wBAAoB;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAiB;AAClD,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,0BAA0B,GAC3B,gCAA4B;AAC7B,YAAY,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,+BAA+B,EAC/B,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,GACxB,gCAA4B;AAC7B,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,yBAAyB,GAC1B,oBAAgB;AACjB,YAAY,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,6BAAyB;AAC1B,YAAY,EACV,wCAAwC,EACxC,kDAAkD,EAClD,oEAAoE,EACpE,oDAAoD,EACpD,iDAAiD,EACjD,kDAAkD,EAClD,kDAAkD,EAClD,8CAA8C,EAC9C,oCAAoC,EACpC,iCAAiC,EACjC,8BAA8B,GAC/B,oDAAgD"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,wBAAuB;AACxB,OAAO,EAAE,sBAAsB,EAAE,qBAAoB;AACrD,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,0BAA0B,GAC3B,gCAA+B;AAChC,YAAY,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,yBAAyB,GAC1B,oBAAmB;AACpB,YAAY,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,6BAA4B;AAC7B,OAAO,EAAE,iCAAiC,EAAE,oDAAmD;AAC/F,YAAY,EACV,wCAAwC,EACxC,kDAAkD,EAClD,oEAAoE,EACpE,oDAAoD,EACpD,iDAAiD,EACjD,kDAAkD,EAClD,wCAAwC,EACxC,kDAAkD,EAClD,gDAAgD,EAChD,kDAAkD,EAClD,8CAA8C,EAC9C,4DAA4D,EAC5D,2DAA2D,EAC3D,4DAA4D,EAC5D,iCAAiC,EACjC,8BAA8B,GAC/B,oDAAmD"}

package/dist/index.mjs

@@ -1,4 +1,5 @@
 export { PasskeyControllerErrorCode, PasskeyControllerErrorMessage } from "./constants.mjs";
 export { PasskeyControllerError } from "./errors.mjs";
 export { PasskeyController, getDefaultPasskeyControllerState, passkeyControllerSelectors } from "./PasskeyController.mjs";
+export { getAAGUIDFromRegistrationResponse } from "./webauthn/verify-registration-response.mjs";
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC9B,wBAAoB;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAiB;AAClD,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,0BAA0B,EAC3B,gCAA4B","sourcesContent":["export {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants';\nexport { PasskeyControllerError } from './errors';\nexport {\n  PasskeyController,\n  getDefaultPasskeyControllerState,\n  passkeyControllerSelectors,\n} from './PasskeyController';\nexport type {\n  PasskeyControllerState,\n  PasskeyControllerMessenger,\n  PasskeyControllerGetStateAction,\n  PasskeyControllerActions,\n  PasskeyControllerStateChangedEvent,\n  PasskeyControllerEvents,\n} from './PasskeyController';\nexport type {\n  PasskeyCredentialInfo,\n  PasskeyDerivationMethod,\n  PasskeyKeyDerivation,\n  PasskeyRecord,\n  PrfEvalExtension,\n  PrfClientExtensionResults,\n} from './types';\nexport type {\n  PasskeyRegistrationOptions,\n  PasskeyRegistrationResponse,\n  PasskeyAuthenticationOptions,\n  PasskeyAuthenticationResponse,\n} from './webauthn/types';\nexport type {\n  PasskeyControllerIsPasskeyEnrolledAction,\n  PasskeyControllerGenerateRegistrationOptionsAction,\n  PasskeyControllerGeneratePostRegistrationAuthenticationOptionsAction,\n  PasskeyControllerGenerateAuthenticationOptionsAction,\n  PasskeyControllerProtectVaultKeyWithPasskeyAction,\n  PasskeyControllerRetrieveVaultKeyWithPasskeyAction,\n  PasskeyControllerVerifyPasskeyAuthenticationAction,\n  PasskeyControllerRenewVaultKeyProtectionAction,\n  PasskeyControllerRemovePasskeyAction,\n  PasskeyControllerClearStateAction,\n  PasskeyControllerDestroyAction,\n} from './PasskeyController-method-action-types';\n"]}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC9B,wBAAuB;AACxB,OAAO,EAAE,sBAAsB,EAAE,qBAAoB;AACrD,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,0BAA0B,EAC3B,gCAA+B;AAsBhC,OAAO,EAAE,iCAAiC,EAAE,oDAAmD","sourcesContent":["export {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants.js';\nexport { PasskeyControllerError } from './errors.js';\nexport {\n  PasskeyController,\n  getDefaultPasskeyControllerState,\n  passkeyControllerSelectors,\n} from './PasskeyController.js';\nexport type {\n  PasskeyControllerState,\n  PasskeyControllerMessenger,\n  PasskeyControllerOptions,\n  PasskeyControllerGetStateAction,\n  PasskeyControllerActions,\n  PasskeyControllerStateChangedEvent,\n  PasskeyControllerEvents,\n  PasskeyCredentialInfo,\n  PasskeyDerivationMethod,\n  PasskeyKeyDerivation,\n  PasskeyRecord,\n  PrfEvalExtension,\n  PrfClientExtensionResults,\n} from './types.js';\nexport type {\n  PasskeyRegistrationOptions,\n  PasskeyRegistrationResponse,\n  PasskeyAuthenticationOptions,\n  PasskeyAuthenticationResponse,\n} from './webauthn/types.js';\nexport { getAAGUIDFromRegistrationResponse } from './webauthn/verify-registration-response.js';\nexport type {\n  PasskeyControllerIsPasskeyEnrolledAction,\n  PasskeyControllerGenerateRegistrationOptionsAction,\n  PasskeyControllerGeneratePostRegistrationAuthenticationOptionsAction,\n  PasskeyControllerGenerateAuthenticationOptionsAction,\n  PasskeyControllerProtectVaultKeyWithPasskeyAction,\n  PasskeyControllerRetrieveVaultKeyWithPasskeyAction,\n  PasskeyControllerUnlockWithPasskeyAction,\n  PasskeyControllerExportSeedPhraseWithPasskeyAction,\n  PasskeyControllerExportAccountsWithPasskeyAction,\n  PasskeyControllerVerifyPasskeyAuthenticationAction,\n  PasskeyControllerRenewVaultKeyProtectionAction,\n  PasskeyControllerChangePasswordWithPasskeyVerificationAction,\n  PasskeyControllerRemovePasskeyWithPasskeyVerificationAction,\n  PasskeyControllerRemovePasskeyWithPasswordVerificationAction,\n  PasskeyControllerClearStateAction,\n  PasskeyControllerDestroyAction,\n} from './PasskeyController-method-action-types.js';\n"]}

package/dist/key-derivation.cjs

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deriveKeyFromAuthenticationResponse = void 0;
-const constants_1 = require("./constants.cjs");
-const errors_1 = require("./errors.cjs");
-const crypto_1 = require("./utils/crypto.cjs");
-const encoding_1 = require("./utils/encoding.cjs");
+const constants_js_1 = require("./constants.cjs");
+const errors_js_1 = require("./errors.cjs");
+const crypto_js_1 = require("./utils/crypto.cjs");
+const encoding_js_1 = require("./utils/encoding.cjs");
 /**
  * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony
  * response.
@@ -28,17 +28,17 @@ function deriveKeyFromAuthenticationResponse(authenticationResponse, record) {
     let ikm;
     if (record.keyDerivation.method === 'prf') {
         if (!hasPrfOutput) {
-            throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.MissingKeyMaterial, { code: constants_1.PasskeyControllerErrorCode.MissingKeyMaterial });
+            throw new errors_js_1.PasskeyControllerError(constants_js_1.PasskeyControllerErrorMessage.MissingKeyMaterial, { code: constants_js_1.PasskeyControllerErrorCode.MissingKeyMaterial });
         }
-        ikm = (0, encoding_1.base64URLToBytes)(prfFirst);
+        ikm = (0, encoding_js_1.base64URLToBytes)(prfFirst);
     }
     else if (userHandle) {
-        ikm = (0, encoding_1.base64URLToBytes)(userHandle);
+        ikm = (0, encoding_js_1.base64URLToBytes)(userHandle);
     }
     else {
-        throw new errors_1.PasskeyControllerError(constants_1.PasskeyControllerErrorMessage.MissingKeyMaterial, { code: constants_1.PasskeyControllerErrorCode.MissingKeyMaterial });
+        throw new errors_js_1.PasskeyControllerError(constants_js_1.PasskeyControllerErrorMessage.MissingKeyMaterial, { code: constants_js_1.PasskeyControllerErrorCode.MissingKeyMaterial });
     }
-    return (0, crypto_1.deriveEncryptionKey)(ikm, (0, encoding_1.base64URLToBytes)(record.credential.id));
+    return (0, crypto_js_1.deriveEncryptionKey)(ikm, (0, encoding_js_1.base64URLToBytes)(record.credential.id));
 }
 exports.deriveKeyFromAuthenticationResponse = deriveKeyFromAuthenticationResponse;
 //# sourceMappingURL=key-derivation.cjs.map

package/dist/key-derivation.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"key-derivation.cjs","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":";;;AAAA,+CAGqB;AACrB,yCAAkD;AAElD,+CAAqD;AACrD,mDAAoD;AAGpD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,mCAAmC,CACjD,sBAAqD,EACrD,MAA2D;IAE3D,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC;IACvD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,sBACxB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,IAAI,GAAe,CAAC;IACpB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,+BAAsB,CAC9B,yCAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,sCAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,IAAA,2BAAgB,EAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,GAAG,GAAG,IAAA,2BAAgB,EAAC,UAAU,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,+BAAsB,CAC9B,yCAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,sCAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,IAAA,4BAAmB,EAAC,GAAG,EAAE,IAAA,2BAAgB,EAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AA7BD,kFA6BC","sourcesContent":["import {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants';\nimport { PasskeyControllerError } from './errors';\nimport type { PasskeyRecord, PrfClientExtensionResults } from './types';\nimport { deriveEncryptionKey } from './utils/crypto';\nimport { base64URLToBytes } from './utils/encoding';\nimport type { PasskeyAuthenticationResponse } from './webauthn/types';\n\n/**\n * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony\n * response.\n *\n * The derivation method is determined by `record.keyDerivation`:\n * - `prf` -- uses the PRF evaluation result from `clientExtensionResults`.\n * - `userHandle` -- uses the `userHandle` returned in the assertion.\n *\n * @param authenticationResponse - The authentication credential result\n *   from `navigator.credentials.get()`.\n * @param record - Credential id and key derivation parameters (ciphertext is\n *   not read).\n * @returns The derived 32-byte AES wrapping key.\n * @throws {@link PasskeyControllerError} with code `missing_key_material` if the\n *   required key material (PRF result or userHandle) is missing from the response.\n */\nexport function deriveKeyFromAuthenticationResponse(\n  authenticationResponse: PasskeyAuthenticationResponse,\n  record: Pick<PasskeyRecord, 'credential' | 'keyDerivation'>,\n): Uint8Array {\n  const { userHandle } = authenticationResponse.response;\n  const prfFirst = (\n    authenticationResponse.clientExtensionResults as PrfClientExtensionResults\n  )?.prf?.results?.first;\n  const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;\n\n  let ikm: Uint8Array;\n  if (record.keyDerivation.method === 'prf') {\n    if (!hasPrfOutput) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.MissingKeyMaterial,\n        { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n      );\n    }\n    ikm = base64URLToBytes(prfFirst);\n  } else if (userHandle) {\n    ikm = base64URLToBytes(userHandle);\n  } else {\n    throw new PasskeyControllerError(\n      PasskeyControllerErrorMessage.MissingKeyMaterial,\n      { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n    );\n  }\n\n  return deriveEncryptionKey(ikm, base64URLToBytes(record.credential.id));\n}\n"]}
+{"version":3,"file":"key-derivation.cjs","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":";;;AAAA,kDAGwB;AACxB,4CAAqD;AAErD,kDAAwD;AACxD,sDAAuD;AAGvD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,mCAAmC,CACjD,sBAAqD,EACrD,MAA2D;IAE3D,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC;IACvD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,sBACxB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,IAAI,GAAe,CAAC;IACpB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,kCAAsB,CAC9B,4CAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,yCAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,IAAA,8BAAgB,EAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,GAAG,GAAG,IAAA,8BAAgB,EAAC,UAAU,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,kCAAsB,CAC9B,4CAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,yCAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,IAAA,+BAAmB,EAAC,GAAG,EAAE,IAAA,8BAAgB,EAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AA7BD,kFA6BC","sourcesContent":["import {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants.js';\nimport { PasskeyControllerError } from './errors.js';\nimport type { PasskeyRecord, PrfClientExtensionResults } from './types.js';\nimport { deriveEncryptionKey } from './utils/crypto.js';\nimport { base64URLToBytes } from './utils/encoding.js';\nimport type { PasskeyAuthenticationResponse } from './webauthn/types.js';\n\n/**\n * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony\n * response.\n *\n * The derivation method is determined by `record.keyDerivation`:\n * - `prf` -- uses the PRF evaluation result from `clientExtensionResults`.\n * - `userHandle` -- uses the `userHandle` returned in the assertion.\n *\n * @param authenticationResponse - The authentication credential result\n *   from `navigator.credentials.get()`.\n * @param record - Credential id and key derivation parameters (ciphertext is\n *   not read).\n * @returns The derived 32-byte AES wrapping key.\n * @throws {@link PasskeyControllerError} with code `missing_key_material` if the\n *   required key material (PRF result or userHandle) is missing from the response.\n */\nexport function deriveKeyFromAuthenticationResponse(\n  authenticationResponse: PasskeyAuthenticationResponse,\n  record: Pick<PasskeyRecord, 'credential' | 'keyDerivation'>,\n): Uint8Array {\n  const { userHandle } = authenticationResponse.response;\n  const prfFirst = (\n    authenticationResponse.clientExtensionResults as PrfClientExtensionResults\n  )?.prf?.results?.first;\n  const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;\n\n  let ikm: Uint8Array;\n  if (record.keyDerivation.method === 'prf') {\n    if (!hasPrfOutput) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.MissingKeyMaterial,\n        { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n      );\n    }\n    ikm = base64URLToBytes(prfFirst);\n  } else if (userHandle) {\n    ikm = base64URLToBytes(userHandle);\n  } else {\n    throw new PasskeyControllerError(\n      PasskeyControllerErrorMessage.MissingKeyMaterial,\n      { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n    );\n  }\n\n  return deriveEncryptionKey(ikm, base64URLToBytes(record.credential.id));\n}\n"]}

package/dist/key-derivation.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"key-derivation.d.cts","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAA6B,oBAAgB;AAGxE,OAAO,KAAK,EAAE,6BAA6B,EAAE,6BAAyB;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,6BAA6B,EACrD,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,eAAe,CAAC,GAC1D,UAAU,CA0BZ"}
+{"version":3,"file":"key-derivation.d.cts","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAA6B,oBAAmB;AAG3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,6BAA4B;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,6BAA6B,EACrD,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,eAAe,CAAC,GAC1D,UAAU,CA0BZ"}

package/dist/key-derivation.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"key-derivation.d.mts","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAA6B,oBAAgB;AAGxE,OAAO,KAAK,EAAE,6BAA6B,EAAE,6BAAyB;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,6BAA6B,EACrD,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,eAAe,CAAC,GAC1D,UAAU,CA0BZ"}
+{"version":3,"file":"key-derivation.d.mts","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAA6B,oBAAmB;AAG3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,6BAA4B;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,sBAAsB,EAAE,6BAA6B,EACrD,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,eAAe,CAAC,GAC1D,UAAU,CA0BZ"}

package/dist/key-derivation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"key-derivation.mjs","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC9B,wBAAoB;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAiB;AAElD,OAAO,EAAE,mBAAmB,EAAE,2BAAuB;AACrD,OAAO,EAAE,gBAAgB,EAAE,6BAAyB;AAGpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,sBAAqD,EACrD,MAA2D;IAE3D,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC;IACvD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,sBACxB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,IAAI,GAAe,CAAC;IACpB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["import {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants';\nimport { PasskeyControllerError } from './errors';\nimport type { PasskeyRecord, PrfClientExtensionResults } from './types';\nimport { deriveEncryptionKey } from './utils/crypto';\nimport { base64URLToBytes } from './utils/encoding';\nimport type { PasskeyAuthenticationResponse } from './webauthn/types';\n\n/**\n * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony\n * response.\n *\n * The derivation method is determined by `record.keyDerivation`:\n * - `prf` -- uses the PRF evaluation result from `clientExtensionResults`.\n * - `userHandle` -- uses the `userHandle` returned in the assertion.\n *\n * @param authenticationResponse - The authentication credential result\n *   from `navigator.credentials.get()`.\n * @param record - Credential id and key derivation parameters (ciphertext is\n *   not read).\n * @returns The derived 32-byte AES wrapping key.\n * @throws {@link PasskeyControllerError} with code `missing_key_material` if the\n *   required key material (PRF result or userHandle) is missing from the response.\n */\nexport function deriveKeyFromAuthenticationResponse(\n  authenticationResponse: PasskeyAuthenticationResponse,\n  record: Pick<PasskeyRecord, 'credential' | 'keyDerivation'>,\n): Uint8Array {\n  const { userHandle } = authenticationResponse.response;\n  const prfFirst = (\n    authenticationResponse.clientExtensionResults as PrfClientExtensionResults\n  )?.prf?.results?.first;\n  const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;\n\n  let ikm: Uint8Array;\n  if (record.keyDerivation.method === 'prf') {\n    if (!hasPrfOutput) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.MissingKeyMaterial,\n        { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n      );\n    }\n    ikm = base64URLToBytes(prfFirst);\n  } else if (userHandle) {\n    ikm = base64URLToBytes(userHandle);\n  } else {\n    throw new PasskeyControllerError(\n      PasskeyControllerErrorMessage.MissingKeyMaterial,\n      { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n    );\n  }\n\n  return deriveEncryptionKey(ikm, base64URLToBytes(record.credential.id));\n}\n"]}
+{"version":3,"file":"key-derivation.mjs","sourceRoot":"","sources":["../src/key-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC9B,wBAAuB;AACxB,OAAO,EAAE,sBAAsB,EAAE,qBAAoB;AAErD,OAAO,EAAE,mBAAmB,EAAE,2BAA0B;AACxD,OAAO,EAAE,gBAAgB,EAAE,6BAA4B;AAGvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,sBAAqD,EACrD,MAA2D;IAE3D,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC;IACvD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,sBACxB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzE,IAAI,GAAe,CAAC;IACpB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,CAAC,kBAAkB,EAChD,EAAE,IAAI,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["import {\n  PasskeyControllerErrorCode,\n  PasskeyControllerErrorMessage,\n} from './constants.js';\nimport { PasskeyControllerError } from './errors.js';\nimport type { PasskeyRecord, PrfClientExtensionResults } from './types.js';\nimport { deriveEncryptionKey } from './utils/crypto.js';\nimport { base64URLToBytes } from './utils/encoding.js';\nimport type { PasskeyAuthenticationResponse } from './webauthn/types.js';\n\n/**\n * Derives an AES-256 wrapping key from a WebAuthn authentication ceremony\n * response.\n *\n * The derivation method is determined by `record.keyDerivation`:\n * - `prf` -- uses the PRF evaluation result from `clientExtensionResults`.\n * - `userHandle` -- uses the `userHandle` returned in the assertion.\n *\n * @param authenticationResponse - The authentication credential result\n *   from `navigator.credentials.get()`.\n * @param record - Credential id and key derivation parameters (ciphertext is\n *   not read).\n * @returns The derived 32-byte AES wrapping key.\n * @throws {@link PasskeyControllerError} with code `missing_key_material` if the\n *   required key material (PRF result or userHandle) is missing from the response.\n */\nexport function deriveKeyFromAuthenticationResponse(\n  authenticationResponse: PasskeyAuthenticationResponse,\n  record: Pick<PasskeyRecord, 'credential' | 'keyDerivation'>,\n): Uint8Array {\n  const { userHandle } = authenticationResponse.response;\n  const prfFirst = (\n    authenticationResponse.clientExtensionResults as PrfClientExtensionResults\n  )?.prf?.results?.first;\n  const hasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;\n\n  let ikm: Uint8Array;\n  if (record.keyDerivation.method === 'prf') {\n    if (!hasPrfOutput) {\n      throw new PasskeyControllerError(\n        PasskeyControllerErrorMessage.MissingKeyMaterial,\n        { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n      );\n    }\n    ikm = base64URLToBytes(prfFirst);\n  } else if (userHandle) {\n    ikm = base64URLToBytes(userHandle);\n  } else {\n    throw new PasskeyControllerError(\n      PasskeyControllerErrorMessage.MissingKeyMaterial,\n      { code: PasskeyControllerErrorCode.MissingKeyMaterial },\n    );\n  }\n\n  return deriveEncryptionKey(ikm, base64URLToBytes(record.credential.id));\n}\n"]}

package/dist/logger.cjs

@@ -4,6 +4,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createModuleLogger = exports.projectLogger = void 0;
 const utils_1 = require("@metamask/utils");
 Object.defineProperty(exports, "createModuleLogger", { enumerable: true, get: function () { return utils_1.createModuleLogger; } });
-const constants_1 = require("./constants.cjs");
-exports.projectLogger = (0, utils_1.createProjectLogger)(constants_1.controllerName);
+const constants_js_1 = require("./constants.cjs");
+exports.projectLogger = (0, utils_1.createProjectLogger)(constants_js_1.controllerName);
 //# sourceMappingURL=logger.cjs.map

package/dist/logger.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"logger.cjs","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAAA,0BAA0B;;;AAE1B,2CAA0E;AAMjE,mGANqB,0BAAkB,OAMrB;AAJ3B,+CAA6C;AAEhC,QAAA,aAAa,GAAG,IAAA,2BAAmB,EAAC,0BAAc,CAAC,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nimport { controllerName } from './constants';\n\nexport const projectLogger = createProjectLogger(controllerName);\n\nexport { createModuleLogger };\n"]}
+{"version":3,"file":"logger.cjs","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAAA,0BAA0B;;;AAE1B,2CAA0E;AAMjE,mGANqB,0BAAkB,OAMrB;AAJ3B,kDAAgD;AAEnC,QAAA,aAAa,GAAG,IAAA,2BAAmB,EAAC,6BAAc,CAAC,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nimport { controllerName } from './constants.js';\n\nexport const projectLogger = createProjectLogger(controllerName);\n\nexport { createModuleLogger };\n"]}

package/dist/logger.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"logger.mjs","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB;AAE1E,OAAO,EAAE,cAAc,EAAE,wBAAoB;AAE7C,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nimport { controllerName } from './constants';\n\nexport const projectLogger = createProjectLogger(controllerName);\n\nexport { createModuleLogger };\n"]}
+{"version":3,"file":"logger.mjs","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB;AAE1E,OAAO,EAAE,cAAc,EAAE,wBAAuB;AAEhD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nimport { controllerName } from './constants.js';\n\nexport const projectLogger = createProjectLogger(controllerName);\n\nexport { createModuleLogger };\n"]}

package/dist/types.cjs

@@ -1,3 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const constants_js_1 = require("./constants.cjs");
 //# sourceMappingURL=types.cjs.map

package/dist/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["export type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt?: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n"]}
+{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;AAcA,kDAAgD","sourcesContent":["import type {\n  ControllerGetStateAction,\n  ControllerStateChangedEvent,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerChangePasswordAction,\n  KeyringControllerExportAccountAction,\n  KeyringControllerExportEncryptionKeyAction,\n  KeyringControllerExportSeedPhraseAction,\n  KeyringControllerSubmitEncryptionKeyAction,\n  KeyringControllerVerifyPasswordAction,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\n\nimport { controllerName } from './constants.js';\nimport type { PasskeyControllerMethodActions } from './PasskeyController-method-action-types.js';\n\nexport type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt?: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n\nexport type PasskeyControllerState = {\n  passkeyRecord: PasskeyRecord | null;\n};\n\nexport type PasskeyControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  PasskeyControllerState\n>;\n\n/**\n * KeyringController actions that {@link PasskeyController} may call during\n * orchestrated passkey flows. The restricted messenger must allow these at init.\n */\nexport type PasskeyControllerAllowedActions =\n  | KeyringControllerVerifyPasswordAction\n  | KeyringControllerExportEncryptionKeyAction\n  | KeyringControllerSubmitEncryptionKeyAction\n  | KeyringControllerChangePasswordAction\n  | KeyringControllerExportSeedPhraseAction\n  | KeyringControllerExportAccountAction;\n\n/**\n * Actions exposed by {@link PasskeyController} on its messenger, including\n * `:getState`, enrollment/unlock ceremony methods, and lifecycle helpers.\n */\nexport type PasskeyControllerActions =\n  | PasskeyControllerGetStateAction\n  | PasskeyControllerMethodActions;\n\nexport type PasskeyControllerStateChangedEvent = ControllerStateChangedEvent<\n  typeof controllerName,\n  PasskeyControllerState\n>;\n\nexport type PasskeyControllerEvents = PasskeyControllerStateChangedEvent;\n\nexport type PasskeyControllerMessenger = Messenger<\n  typeof controllerName,\n  PasskeyControllerActions | PasskeyControllerAllowedActions,\n  PasskeyControllerEvents\n>;\n\nexport type PasskeyControllerOptions = {\n  messenger: PasskeyControllerMessenger;\n  state?: Partial<PasskeyControllerState>;\n  rpId?: string;\n  expectedRPID: string | string[];\n  rpName: string;\n  expectedOrigin: string | string[];\n  userName?: string;\n  userDisplayName?: string;\n  /**\n   * Returns whether wallet onboarding is complete. When `true`, enrollment\n   * requires password step-up. The integrator typically supplies\n   * `() => onboardingController.state.completedOnboarding`.\n   */\n  getIsOnboardingCompleted: () => boolean;\n};\n"]}

package/dist/types.d.cts

@@ -1,3 +1,8 @@
+import type { ControllerGetStateAction, ControllerStateChangedEvent } from "@metamask/base-controller";
+import type { KeyringControllerChangePasswordAction, KeyringControllerExportAccountAction, KeyringControllerExportEncryptionKeyAction, KeyringControllerExportSeedPhraseAction, KeyringControllerSubmitEncryptionKeyAction, KeyringControllerVerifyPasswordAction } from "@metamask/keyring-controller";
+import type { Messenger } from "@metamask/messenger";
+import { controllerName } from "./constants.cjs";
+import type { PasskeyControllerMethodActions } from "./PasskeyController-method-action-types.cjs";
 export type Base64String = string;
 export type Base64URLString = string;
 export type AuthenticatorTransportFuture = 'ble' | 'cable' | 'hybrid' | 'internal' | 'nfc' | 'smart-card' | 'usb';
@@ -91,4 +96,37 @@ export type PrfClientExtensionResults = {
         };
     };
 };
+export type PasskeyControllerState = {
+    passkeyRecord: PasskeyRecord | null;
+};
+export type PasskeyControllerGetStateAction = ControllerGetStateAction<typeof controllerName, PasskeyControllerState>;
+/**
+ * KeyringController actions that {@link PasskeyController} may call during
+ * orchestrated passkey flows. The restricted messenger must allow these at init.
+ */
+export type PasskeyControllerAllowedActions = KeyringControllerVerifyPasswordAction | KeyringControllerExportEncryptionKeyAction | KeyringControllerSubmitEncryptionKeyAction | KeyringControllerChangePasswordAction | KeyringControllerExportSeedPhraseAction | KeyringControllerExportAccountAction;
+/**
+ * Actions exposed by {@link PasskeyController} on its messenger, including
+ * `:getState`, enrollment/unlock ceremony methods, and lifecycle helpers.
+ */
+export type PasskeyControllerActions = PasskeyControllerGetStateAction | PasskeyControllerMethodActions;
+export type PasskeyControllerStateChangedEvent = ControllerStateChangedEvent<typeof controllerName, PasskeyControllerState>;
+export type PasskeyControllerEvents = PasskeyControllerStateChangedEvent;
+export type PasskeyControllerMessenger = Messenger<typeof controllerName, PasskeyControllerActions | PasskeyControllerAllowedActions, PasskeyControllerEvents>;
+export type PasskeyControllerOptions = {
+    messenger: PasskeyControllerMessenger;
+    state?: Partial<PasskeyControllerState>;
+    rpId?: string;
+    expectedRPID: string | string[];
+    rpName: string;
+    expectedOrigin: string | string[];
+    userName?: string;
+    userDisplayName?: string;
+    /**
+     * Returns whether wallet onboarding is complete. When `true`, enrollment
+     * requires password step-up. The integrator typically supplies
+     * `() => onboardingController.state.completedOnboarding`.
+     */
+    getIsOnboardingCompleted: () => boolean;
+};
 //# sourceMappingURL=types.d.cts.map

package/dist/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC"}
+{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC5B,kCAAkC;AACnC,OAAO,KAAK,EACV,qCAAqC,EACrC,oCAAoC,EACpC,0CAA0C,EAC1C,uCAAuC,EACvC,0CAA0C,EAC1C,qCAAqC,EACtC,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AAErD,OAAO,EAAE,cAAc,EAAE,wBAAuB;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,oDAAmD;AAEjG,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CACpE,OAAO,cAAc,EACrB,sBAAsB,CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,+BAA+B,GACvC,qCAAqC,GACrC,0CAA0C,GAC1C,0CAA0C,GAC1C,qCAAqC,GACrC,uCAAuC,GACvC,oCAAoC,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAChC,+BAA+B,GAC/B,8BAA8B,CAAC;AAEnC,MAAM,MAAM,kCAAkC,GAAG,2BAA2B,CAC1E,OAAO,cAAc,EACrB,sBAAsB,CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAEzE,MAAM,MAAM,0BAA0B,GAAG,SAAS,CAChD,OAAO,cAAc,EACrB,wBAAwB,GAAG,+BAA+B,EAC1D,uBAAuB,CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,0BAA0B,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,EAAE,MAAM,OAAO,CAAC;CACzC,CAAC"}

package/dist/types.d.mts

@@ -1,3 +1,8 @@
+import type { ControllerGetStateAction, ControllerStateChangedEvent } from "@metamask/base-controller";
+import type { KeyringControllerChangePasswordAction, KeyringControllerExportAccountAction, KeyringControllerExportEncryptionKeyAction, KeyringControllerExportSeedPhraseAction, KeyringControllerSubmitEncryptionKeyAction, KeyringControllerVerifyPasswordAction } from "@metamask/keyring-controller";
+import type { Messenger } from "@metamask/messenger";
+import { controllerName } from "./constants.mjs";
+import type { PasskeyControllerMethodActions } from "./PasskeyController-method-action-types.mjs";
 export type Base64String = string;
 export type Base64URLString = string;
 export type AuthenticatorTransportFuture = 'ble' | 'cable' | 'hybrid' | 'internal' | 'nfc' | 'smart-card' | 'usb';
@@ -91,4 +96,37 @@ export type PrfClientExtensionResults = {
         };
     };
 };
+export type PasskeyControllerState = {
+    passkeyRecord: PasskeyRecord | null;
+};
+export type PasskeyControllerGetStateAction = ControllerGetStateAction<typeof controllerName, PasskeyControllerState>;
+/**
+ * KeyringController actions that {@link PasskeyController} may call during
+ * orchestrated passkey flows. The restricted messenger must allow these at init.
+ */
+export type PasskeyControllerAllowedActions = KeyringControllerVerifyPasswordAction | KeyringControllerExportEncryptionKeyAction | KeyringControllerSubmitEncryptionKeyAction | KeyringControllerChangePasswordAction | KeyringControllerExportSeedPhraseAction | KeyringControllerExportAccountAction;
+/**
+ * Actions exposed by {@link PasskeyController} on its messenger, including
+ * `:getState`, enrollment/unlock ceremony methods, and lifecycle helpers.
+ */
+export type PasskeyControllerActions = PasskeyControllerGetStateAction | PasskeyControllerMethodActions;
+export type PasskeyControllerStateChangedEvent = ControllerStateChangedEvent<typeof controllerName, PasskeyControllerState>;
+export type PasskeyControllerEvents = PasskeyControllerStateChangedEvent;
+export type PasskeyControllerMessenger = Messenger<typeof controllerName, PasskeyControllerActions | PasskeyControllerAllowedActions, PasskeyControllerEvents>;
+export type PasskeyControllerOptions = {
+    messenger: PasskeyControllerMessenger;
+    state?: Partial<PasskeyControllerState>;
+    rpId?: string;
+    expectedRPID: string | string[];
+    rpName: string;
+    expectedOrigin: string | string[];
+    userName?: string;
+    userDisplayName?: string;
+    /**
+     * Returns whether wallet onboarding is complete. When `true`, enrollment
+     * requires password step-up. The integrator typically supplies
+     * `() => onboardingController.state.completedOnboarding`.
+     */
+    getIsOnboardingCompleted: () => boolean;
+};
 //# sourceMappingURL=types.d.mts.map

package/dist/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC5B,kCAAkC;AACnC,OAAO,KAAK,EACV,qCAAqC,EACrC,oCAAoC,EACpC,0CAA0C,EAC1C,uCAAuC,EACvC,0CAA0C,EAC1C,qCAAqC,EACtC,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AAErD,OAAO,EAAE,cAAc,EAAE,wBAAuB;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,oDAAmD;AAEjG,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,OAAO,GACP,QAAQ,GACR,UAAU,GACV,KAAK,GACL,YAAY,GACZ,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0CAA0C;IAC1C,EAAE,EAAE,eAAe,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,eAAe,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,YAAY,CAAC;IACzB,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,MAAM,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B,GACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,4DAA4D;AAC5D,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,qBAAqB,CAAC;IAClC,uDAAuD;IACvD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4DAA4D;IAC5D,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE;QACJ,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,eAAe,CAAA;SAAE,CAAC;KACvC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CACpE,OAAO,cAAc,EACrB,sBAAsB,CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,+BAA+B,GACvC,qCAAqC,GACrC,0CAA0C,GAC1C,0CAA0C,GAC1C,qCAAqC,GACrC,uCAAuC,GACvC,oCAAoC,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAChC,+BAA+B,GAC/B,8BAA8B,CAAC;AAEnC,MAAM,MAAM,kCAAkC,GAAG,2BAA2B,CAC1E,OAAO,cAAc,EACrB,sBAAsB,CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAEzE,MAAM,MAAM,0BAA0B,GAAG,SAAS,CAChD,OAAO,cAAc,EACrB,wBAAwB,GAAG,+BAA+B,EAC1D,uBAAuB,CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,0BAA0B,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,EAAE,MAAM,OAAO,CAAC;CACzC,CAAC"}

package/dist/types.mjs

@@ -1,2 +1,2 @@
-export {};
+import { controllerName } from "./constants.mjs";
 //# sourceMappingURL=types.mjs.map

package/dist/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["export type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt?: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n"]}
+{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,wBAAuB","sourcesContent":["import type {\n  ControllerGetStateAction,\n  ControllerStateChangedEvent,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerChangePasswordAction,\n  KeyringControllerExportAccountAction,\n  KeyringControllerExportEncryptionKeyAction,\n  KeyringControllerExportSeedPhraseAction,\n  KeyringControllerSubmitEncryptionKeyAction,\n  KeyringControllerVerifyPasswordAction,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\n\nimport { controllerName } from './constants.js';\nimport type { PasskeyControllerMethodActions } from './PasskeyController-method-action-types.js';\n\nexport type Base64String = string;\n\nexport type Base64URLString = string;\n\nexport type AuthenticatorTransportFuture =\n  | 'ble'\n  | 'cable'\n  | 'hybrid'\n  | 'internal'\n  | 'nfc'\n  | 'smart-card'\n  | 'usb';\n\n/**\n * WebAuthn credential metadata used to identify the passkey and verify\n * subsequent assertions.\n */\nexport type PasskeyCredentialInfo = {\n  /** WebAuthn credential ID (base64url). */\n  id: Base64URLString;\n  /** COSE-encoded credential public key (base64url) used to verify assertions. */\n  publicKey: Base64URLString;\n  /** Authenticator signature counter for replay/clone detection. */\n  counter: number;\n  /** Authenticator transports hint for `allowCredentials`. */\n  transports?: AuthenticatorTransportFuture[];\n  /** Authenticator AAGUID captured from attested credential data at registration. */\n  aaguid: string;\n};\n\n/**\n * Vault key wrapped under the passkey-derived AES-256-GCM key.\n */\nexport type EncryptedVaultKey = {\n  /** Base64-encoded AES-256-GCM ciphertext of the vault key. */\n  ciphertext: Base64String;\n  /** Base64-encoded AES-GCM IV used during encryption. */\n  iv: Base64String;\n};\n\n/**\n * Parameters needed to reproduce the AES-256 wrapping key at unlock time.\n *\n * Encoded as a discriminated union so PRF-only fields (e.g. `prfSalt`) can\n * only exist on the PRF branch, removing the \"optional but actually\n * required\" footgun.\n */\nexport type PasskeyKeyDerivation =\n  | {\n      method: 'prf';\n      /**\n       * PRF salt sent in `get()` extension options to reproduce the same PRF\n       * output that was generated at registration.\n       */\n      prfSalt: Base64URLString;\n    }\n  | { method: 'userHandle' };\n\n/** Discriminator value for {@link PasskeyKeyDerivation}. */\nexport type PasskeyDerivationMethod = PasskeyKeyDerivation['method'];\n\nexport type PasskeyRecord = {\n  /** WebAuthn credential metadata used for assertion verification & re-discovery. */\n  credential: PasskeyCredentialInfo;\n  /** Vault key wrapped under the passkey-derived key. */\n  encryptedVaultKey: EncryptedVaultKey;\n  /** How the wrapping key is reconstructed at unlock time. */\n  keyDerivation: PasskeyKeyDerivation;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **registration** ceremony\n * (from `create()` options until `protectVaultKeyWithPasskey` completes). This is\n * not a user login session; it is keyed by challenge and distinct from the full\n * spec ceremony (which includes the authenticator round-trip).\n */\nexport type PasskeyRegistrationCeremony = {\n  userHandle: Base64URLString;\n  prfSalt?: Base64URLString;\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * In-memory state for one **in-flight** WebAuthn **authentication** ceremony\n * (`get()` options until the assertion is verified). Not a user login session.\n */\nexport type PasskeyAuthenticationCeremony = {\n  challenge: Base64URLString;\n  /** When this ceremony was started (ms since epoch); used for TTL pruning. */\n  createdAt: number;\n};\n\n/**\n * PRF extension types not covered by DOM typings.\n */\nexport type PrfEvalExtension = {\n  eval: {\n    first: Base64URLString;\n  };\n};\n\nexport type PrfClientExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: { first?: Base64URLString };\n  };\n};\n\nexport type PasskeyControllerState = {\n  passkeyRecord: PasskeyRecord | null;\n};\n\nexport type PasskeyControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  PasskeyControllerState\n>;\n\n/**\n * KeyringController actions that {@link PasskeyController} may call during\n * orchestrated passkey flows. The restricted messenger must allow these at init.\n */\nexport type PasskeyControllerAllowedActions =\n  | KeyringControllerVerifyPasswordAction\n  | KeyringControllerExportEncryptionKeyAction\n  | KeyringControllerSubmitEncryptionKeyAction\n  | KeyringControllerChangePasswordAction\n  | KeyringControllerExportSeedPhraseAction\n  | KeyringControllerExportAccountAction;\n\n/**\n * Actions exposed by {@link PasskeyController} on its messenger, including\n * `:getState`, enrollment/unlock ceremony methods, and lifecycle helpers.\n */\nexport type PasskeyControllerActions =\n  | PasskeyControllerGetStateAction\n  | PasskeyControllerMethodActions;\n\nexport type PasskeyControllerStateChangedEvent = ControllerStateChangedEvent<\n  typeof controllerName,\n  PasskeyControllerState\n>;\n\nexport type PasskeyControllerEvents = PasskeyControllerStateChangedEvent;\n\nexport type PasskeyControllerMessenger = Messenger<\n  typeof controllerName,\n  PasskeyControllerActions | PasskeyControllerAllowedActions,\n  PasskeyControllerEvents\n>;\n\nexport type PasskeyControllerOptions = {\n  messenger: PasskeyControllerMessenger;\n  state?: Partial<PasskeyControllerState>;\n  rpId?: string;\n  expectedRPID: string | string[];\n  rpName: string;\n  expectedOrigin: string | string[];\n  userName?: string;\n  userDisplayName?: string;\n  /**\n   * Returns whether wallet onboarding is complete. When `true`, enrollment\n   * requires password step-up. The integrator typically supplies\n   * `() => onboardingController.state.completedOnboarding`.\n   */\n  getIsOnboardingCompleted: () => boolean;\n};\n"]}

package/dist/utils/crypto.cjs

@@ -6,7 +6,7 @@ const aes_1 = require("@noble/ciphers/aes");
 const webcrypto_1 = require("@noble/ciphers/webcrypto");
 const hkdf_1 = require("@noble/hashes/hkdf");
 const sha2_1 = require("@noble/hashes/sha2");
-const encoding_1 = require("./encoding.cjs");
+const encoding_js_1 = require("./encoding.cjs");
 const PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';
 const AES_GCM_IV_LENGTH = 12;
 /**
@@ -16,7 +16,7 @@ const AES_GCM_IV_LENGTH = 12;
  * @returns Base64url-encoded random bytes.
  */
 function randomBytesToBase64URL(byteLength) {
-    return (0, encoding_1.bytesToBase64URL)((0, webcrypto_1.randomBytes)(byteLength));
+    return (0, encoding_js_1.bytesToBase64URL)((0, webcrypto_1.randomBytes)(byteLength));
 }
 exports.randomBytesToBase64URL = randomBytesToBase64URL;
 /**

package/dist/utils/crypto.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.cjs","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":";;;AAAA,2CAA+D;AAC/D,4CAAyC;AACzC,wDAAuD;AACvD,6CAA0C;AAC1C,6CAA4C;AAE5C,6CAA8C;AAE9C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,UAAkB;IACvD,OAAO,IAAA,2BAAgB,EAAC,IAAA,uBAAW,EAAC,UAAU,CAAC,CAAC,CAAC;AACnD,CAAC;AAFD,wDAEC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AALD,kDAKC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,IAAA,uBAAW,EAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,IAAA,qBAAa,EAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,IAAA,qBAAa,EAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAZD,wCAYC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,IAAA,qBAAa,EAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAA,qBAAa,EAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAVD,wCAUC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from './encoding';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Generates random bytes and returns them as a base64url string (no padding).\n *\n * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).\n * @returns Base64url-encoded random bytes.\n */\nexport function randomBytesToBase64URL(byteLength: number): string {\n  return bytesToBase64URL(randomBytes(byteLength));\n}\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}
+{"version":3,"file":"crypto.cjs","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":";;;AAAA,2CAA+D;AAC/D,4CAAyC;AACzC,wDAAuD;AACvD,6CAA0C;AAC1C,6CAA4C;AAE5C,gDAAiD;AAEjD,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,UAAkB;IACvD,OAAO,IAAA,8BAAgB,EAAC,IAAA,uBAAW,EAAC,UAAU,CAAC,CAAC,CAAC;AACnD,CAAC;AAFD,wDAEC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AALD,kDAKC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,IAAA,uBAAW,EAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,IAAA,qBAAa,EAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,IAAA,qBAAa,EAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAZD,wCAYC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,IAAA,qBAAa,EAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAA,qBAAa,EAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAVD,wCAUC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from './encoding.js';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Generates random bytes and returns them as a base64url string (no padding).\n *\n * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).\n * @returns Base64url-encoded random bytes.\n */\nexport function randomBytesToBase64URL(byteLength: number): string {\n  return bytesToBase64URL(randomBytes(byteLength));\n}\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}

package/dist/utils/crypto.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.mjs","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB;AAC/D,OAAO,EAAE,GAAG,EAAE,2BAA2B;AACzC,OAAO,EAAE,WAAW,EAAE,iCAAiC;AACvD,OAAO,EAAE,IAAI,EAAE,2BAA2B;AAC1C,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,OAAO,EAAE,gBAAgB,EAAE,uBAAmB;AAE9C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAO,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from './encoding';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Generates random bytes and returns them as a base64url string (no padding).\n *\n * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).\n * @returns Base64url-encoded random bytes.\n */\nexport function randomBytesToBase64URL(byteLength: number): string {\n  return bytesToBase64URL(randomBytes(byteLength));\n}\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}
+{"version":3,"file":"crypto.mjs","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB;AAC/D,OAAO,EAAE,GAAG,EAAE,2BAA2B;AACzC,OAAO,EAAE,WAAW,EAAE,iCAAiC;AACvD,OAAO,EAAE,IAAI,EAAE,2BAA2B;AAC1C,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,OAAO,EAAE,gBAAgB,EAAE,uBAAsB;AAEjD,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAO,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAe,EACf,IAAgB;IAEhB,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,GAAe;IAEf,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC;QAC1C,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,EAAU,EACV,GAAe;IAEf,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { bytesToBase64, base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToBase64URL } from './encoding.js';\n\nconst PASSKEY_HKDF_INFO = 'metamask:passkey:encryption-key:v1';\n\nconst AES_GCM_IV_LENGTH = 12;\n\n/**\n * Generates random bytes and returns them as a base64url string (no padding).\n *\n * @param byteLength - Number of bytes to generate (e.g. WebAuthn challenge length).\n * @returns Base64url-encoded random bytes.\n */\nexport function randomBytesToBase64URL(byteLength: number): string {\n  return bytesToBase64URL(randomBytes(byteLength));\n}\n\n/**\n * Derives an AES-256 encryption key from input key material and a credential ID\n * using HKDF-SHA256.\n *\n * @param ikm - Input key material (e.g. PRF output or userHandle).\n * @param salt - HKDF salt.\n * @returns 32-byte derived encryption key.\n */\nexport function deriveEncryptionKey(\n  ikm: Uint8Array,\n  salt: Uint8Array,\n): Uint8Array {\n  return hkdf(sha256, ikm, salt, PASSKEY_HKDF_INFO, 32);\n}\n\n/**\n * Encrypts plaintext with an AES-256-GCM key.\n *\n * @param plaintext - UTF-8 string to encrypt.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Base64-encoded ciphertext and IV.\n */\nexport function encryptWithKey(\n  plaintext: string,\n  key: Uint8Array,\n): { ciphertext: string; iv: string } {\n  const iv = randomBytes(AES_GCM_IV_LENGTH);\n  const encoded = new TextEncoder().encode(plaintext);\n  const ciphertextBytes = gcm(key, iv).encrypt(encoded);\n\n  return {\n    ciphertext: bytesToBase64(ciphertextBytes),\n    iv: bytesToBase64(iv),\n  };\n}\n\n/**\n * Decrypts AES-256-GCM ciphertext with the given key.\n *\n * @param ciphertext - Base64-encoded ciphertext.\n * @param iv - Base64-encoded initialization vector.\n * @param key - 32-byte AES-256 key from {@link deriveEncryptionKey}.\n * @returns Decrypted UTF-8 string.\n */\nexport function decryptWithKey(\n  ciphertext: string,\n  iv: string,\n  key: Uint8Array,\n): string {\n  const ciphertextBytes = base64ToBytes(ciphertext);\n  const ivBytes = base64ToBytes(iv);\n  const plaintext = gcm(key, ivBytes).decrypt(ciphertextBytes);\n\n  return new TextDecoder().decode(plaintext);\n}\n"]}

package/dist/webauthn/decode-attestation-object.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"decode-attestation-object.cjs","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAI1D;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,iBAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,IAAA,6BAAiB,EAAC,IAAI,EAAE,CAAC,CAAgC,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC;AAND,0DAMC","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\n\nimport type { AttestationObject } from './types';\n\n/**\n * CBOR-decode an attestationObject buffer into a Map with `fmt`, `attStmt`,\n * and `authData` entries.\n *\n * @param attestationObject - Raw attestation object bytes.\n * @returns Decoded AttestationObject map.\n */\nexport function decodeAttestationObject(\n  attestationObject: Uint8Array,\n): AttestationObject {\n  const copy = new Uint8Array(attestationObject);\n  const [decoded] = decodePartialCBOR(copy, 0) as [AttestationObject, number];\n  return decoded;\n}\n"]}
+{"version":3,"file":"decode-attestation-object.cjs","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAI1D;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,iBAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,IAAA,6BAAiB,EAAC,IAAI,EAAE,CAAC,CAAgC,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC;AAND,0DAMC","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\n\nimport type { AttestationObject } from './types.js';\n\n/**\n * CBOR-decode an attestationObject buffer into a Map with `fmt`, `attStmt`,\n * and `authData` entries.\n *\n * @param attestationObject - Raw attestation object bytes.\n * @returns Decoded AttestationObject map.\n */\nexport function decodeAttestationObject(\n  attestationObject: Uint8Array,\n): AttestationObject {\n  const copy = new Uint8Array(attestationObject);\n  const [decoded] = decodePartialCBOR(copy, 0) as [AttestationObject, number];\n  return decoded;\n}\n"]}

package/dist/webauthn/decode-attestation-object.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"decode-attestation-object.d.cts","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAgB;AAEjD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,UAAU,GAC5B,iBAAiB,CAInB"}
+{"version":3,"file":"decode-attestation-object.d.cts","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAmB;AAEpD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,UAAU,GAC5B,iBAAiB,CAInB"}

package/dist/webauthn/decode-attestation-object.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"decode-attestation-object.d.mts","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAgB;AAEjD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,UAAU,GAC5B,iBAAiB,CAInB"}
+{"version":3,"file":"decode-attestation-object.d.mts","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAmB;AAEpD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,UAAU,GAC5B,iBAAiB,CAInB"}

package/dist/webauthn/decode-attestation-object.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"decode-attestation-object.mjs","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,8BAA8B;AAI1D;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,iBAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAgC,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\n\nimport type { AttestationObject } from './types';\n\n/**\n * CBOR-decode an attestationObject buffer into a Map with `fmt`, `attStmt`,\n * and `authData` entries.\n *\n * @param attestationObject - Raw attestation object bytes.\n * @returns Decoded AttestationObject map.\n */\nexport function decodeAttestationObject(\n  attestationObject: Uint8Array,\n): AttestationObject {\n  const copy = new Uint8Array(attestationObject);\n  const [decoded] = decodePartialCBOR(copy, 0) as [AttestationObject, number];\n  return decoded;\n}\n"]}
+{"version":3,"file":"decode-attestation-object.mjs","sourceRoot":"","sources":["../../src/webauthn/decode-attestation-object.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,8BAA8B;AAI1D;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,iBAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAgC,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\n\nimport type { AttestationObject } from './types.js';\n\n/**\n * CBOR-decode an attestationObject buffer into a Map with `fmt`, `attStmt`,\n * and `authData` entries.\n *\n * @param attestationObject - Raw attestation object bytes.\n * @returns Decoded AttestationObject map.\n */\nexport function decodeAttestationObject(\n  attestationObject: Uint8Array,\n): AttestationObject {\n  const copy = new Uint8Array(attestationObject);\n  const [decoded] = decodePartialCBOR(copy, 0) as [AttestationObject, number];\n  return decoded;\n}\n"]}

package/dist/webauthn/decode-client-data-json.cjs

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decodeClientDataJSON = void 0;
-const encoding_1 = require("../utils/encoding.cjs");
+const encoding_js_1 = require("../utils/encoding.cjs");
 /**
  * Decode an authenticator's base64url-encoded clientDataJSON to JSON.
  *
@@ -9,7 +9,7 @@ const encoding_1 = require("../utils/encoding.cjs");
  * @returns Parsed ClientDataJSON object.
  */
 function decodeClientDataJSON(data) {
-    const bytes = (0, encoding_1.base64URLToBytes)(data);
+    const bytes = (0, encoding_js_1.base64URLToBytes)(data);
     const text = new TextDecoder().decode(bytes);
     return JSON.parse(text);
 }

package/dist/webauthn/decode-client-data-json.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"decode-client-data-json.cjs","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":";;;AAAA,oDAAqD;AAGrD;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAA,2BAAgB,EAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;AAC5C,CAAC;AAJD,oDAIC","sourcesContent":["import { base64URLToBytes } from '../utils/encoding';\nimport type { ClientDataJSON } from './types';\n\n/**\n * Decode an authenticator's base64url-encoded clientDataJSON to JSON.\n *\n * @param data - Base64url-encoded clientDataJSON string.\n * @returns Parsed ClientDataJSON object.\n */\nexport function decodeClientDataJSON(data: string): ClientDataJSON {\n  const bytes = base64URLToBytes(data);\n  const text = new TextDecoder().decode(bytes);\n  return JSON.parse(text) as ClientDataJSON;\n}\n"]}
+{"version":3,"file":"decode-client-data-json.cjs","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":";;;AAAA,uDAAwD;AAGxD;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAA,8BAAgB,EAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;AAC5C,CAAC;AAJD,oDAIC","sourcesContent":["import { base64URLToBytes } from '../utils/encoding.js';\nimport type { ClientDataJSON } from './types.js';\n\n/**\n * Decode an authenticator's base64url-encoded clientDataJSON to JSON.\n *\n * @param data - Base64url-encoded clientDataJSON string.\n * @returns Parsed ClientDataJSON object.\n */\nexport function decodeClientDataJSON(data: string): ClientDataJSON {\n  const bytes = base64URLToBytes(data);\n  const text = new TextDecoder().decode(bytes);\n  return JSON.parse(text) as ClientDataJSON;\n}\n"]}

package/dist/webauthn/decode-client-data-json.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"decode-client-data-json.d.cts","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAgB;AAE9C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAIjE"}
+{"version":3,"file":"decode-client-data-json.d.cts","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAmB;AAEjD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAIjE"}

package/dist/webauthn/decode-client-data-json.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"decode-client-data-json.d.mts","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAgB;AAE9C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAIjE"}
+{"version":3,"file":"decode-client-data-json.d.mts","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAmB;AAEjD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAIjE"}

package/dist/webauthn/decode-client-data-json.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"decode-client-data-json.mjs","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,8BAA0B;AAGrD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;AAC5C,CAAC","sourcesContent":["import { base64URLToBytes } from '../utils/encoding';\nimport type { ClientDataJSON } from './types';\n\n/**\n * Decode an authenticator's base64url-encoded clientDataJSON to JSON.\n *\n * @param data - Base64url-encoded clientDataJSON string.\n * @returns Parsed ClientDataJSON object.\n */\nexport function decodeClientDataJSON(data: string): ClientDataJSON {\n  const bytes = base64URLToBytes(data);\n  const text = new TextDecoder().decode(bytes);\n  return JSON.parse(text) as ClientDataJSON;\n}\n"]}
+{"version":3,"file":"decode-client-data-json.mjs","sourceRoot":"","sources":["../../src/webauthn/decode-client-data-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,8BAA6B;AAGxD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;AAC5C,CAAC","sourcesContent":["import { base64URLToBytes } from '../utils/encoding.js';\nimport type { ClientDataJSON } from './types.js';\n\n/**\n * Decode an authenticator's base64url-encoded clientDataJSON to JSON.\n *\n * @param data - Base64url-encoded clientDataJSON string.\n * @returns Parsed ClientDataJSON object.\n */\nexport function decodeClientDataJSON(data: string): ClientDataJSON {\n  const bytes = base64URLToBytes(data);\n  const text = new TextDecoder().decode(bytes);\n  return JSON.parse(text) as ClientDataJSON;\n}\n"]}

package/dist/webauthn/match-expected-rp-id.cjs

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.matchExpectedRPID = void 0;
 const utils_1 = require("@metamask/utils");
 const sha2_1 = require("@noble/hashes/sha2");
-const encoding_1 = require("../utils/encoding.cjs");
+const encoding_js_1 = require("../utils/encoding.cjs");
 /**
  * Verify that an authenticator data rpIdHash matches one of the expected
  * RP IDs by SHA-256 hashing each candidate and comparing.
@@ -20,7 +20,7 @@ function matchExpectedRPID(rpIdHash, expectedRPIDs) {
             return rpID;
         }
     }
-    throw new Error(`Unexpected RP ID hash: received ${(0, encoding_1.bytesToHex)(rpIdHash)}`);
+    throw new Error(`Unexpected RP ID hash: received ${(0, encoding_js_1.bytesToHex)(rpIdHash)}`);
 }
 exports.matchExpectedRPID = matchExpectedRPID;
 //# sourceMappingURL=match-expected-rp-id.cjs.map

package/dist/webauthn/match-expected-rp-id.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"match-expected-rp-id.cjs","sourceRoot":"","sources":["../../src/webauthn/match-expected-rp-id.ts"],"names":[],"mappings":";;;AAAA,2CAAsD;AACtD,6CAA4C;AAE5C,oDAA+C;AAE/C;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAC/B,QAAoB,EACpB,aAAuB;IAEvB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,IAAA,aAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAA,2BAAmB,EAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAA,qBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAXD,8CAWC","sourcesContent":["import { areUint8ArraysEqual } from '@metamask/utils';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToHex } from '../utils/encoding';\n\n/**\n * Verify that an authenticator data rpIdHash matches one of the expected\n * RP IDs by SHA-256 hashing each candidate and comparing.\n *\n * @param rpIdHash - The rpIdHash from authenticatorData (32 bytes).\n * @param expectedRPIDs - One or more RP ID strings to check against.\n * @returns The matching RP ID string.\n * @throws If no expected RP ID matches.\n */\nexport function matchExpectedRPID(\n  rpIdHash: Uint8Array,\n  expectedRPIDs: string[],\n): string {\n  for (const rpID of expectedRPIDs) {\n    const expectedHash = sha256(new TextEncoder().encode(rpID));\n    if (areUint8ArraysEqual(rpIdHash, expectedHash)) {\n      return rpID;\n    }\n  }\n  throw new Error(`Unexpected RP ID hash: received ${bytesToHex(rpIdHash)}`);\n}\n"]}
+{"version":3,"file":"match-expected-rp-id.cjs","sourceRoot":"","sources":["../../src/webauthn/match-expected-rp-id.ts"],"names":[],"mappings":";;;AAAA,2CAAsD;AACtD,6CAA4C;AAE5C,uDAAkD;AAElD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAC/B,QAAoB,EACpB,aAAuB;IAEvB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,IAAA,aAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAA,2BAAmB,EAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAA,wBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAXD,8CAWC","sourcesContent":["import { areUint8ArraysEqual } from '@metamask/utils';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToHex } from '../utils/encoding.js';\n\n/**\n * Verify that an authenticator data rpIdHash matches one of the expected\n * RP IDs by SHA-256 hashing each candidate and comparing.\n *\n * @param rpIdHash - The rpIdHash from authenticatorData (32 bytes).\n * @param expectedRPIDs - One or more RP ID strings to check against.\n * @returns The matching RP ID string.\n * @throws If no expected RP ID matches.\n */\nexport function matchExpectedRPID(\n  rpIdHash: Uint8Array,\n  expectedRPIDs: string[],\n): string {\n  for (const rpID of expectedRPIDs) {\n    const expectedHash = sha256(new TextEncoder().encode(rpID));\n    if (areUint8ArraysEqual(rpIdHash, expectedHash)) {\n      return rpID;\n    }\n  }\n  throw new Error(`Unexpected RP ID hash: received ${bytesToHex(rpIdHash)}`);\n}\n"]}

package/dist/webauthn/match-expected-rp-id.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"match-expected-rp-id.mjs","sourceRoot":"","sources":["../../src/webauthn/match-expected-rp-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB;AACtD,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,OAAO,EAAE,UAAU,EAAE,8BAA0B;AAE/C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAoB,EACpB,aAAuB;IAEvB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import { areUint8ArraysEqual } from '@metamask/utils';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToHex } from '../utils/encoding';\n\n/**\n * Verify that an authenticator data rpIdHash matches one of the expected\n * RP IDs by SHA-256 hashing each candidate and comparing.\n *\n * @param rpIdHash - The rpIdHash from authenticatorData (32 bytes).\n * @param expectedRPIDs - One or more RP ID strings to check against.\n * @returns The matching RP ID string.\n * @throws If no expected RP ID matches.\n */\nexport function matchExpectedRPID(\n  rpIdHash: Uint8Array,\n  expectedRPIDs: string[],\n): string {\n  for (const rpID of expectedRPIDs) {\n    const expectedHash = sha256(new TextEncoder().encode(rpID));\n    if (areUint8ArraysEqual(rpIdHash, expectedHash)) {\n      return rpID;\n    }\n  }\n  throw new Error(`Unexpected RP ID hash: received ${bytesToHex(rpIdHash)}`);\n}\n"]}
+{"version":3,"file":"match-expected-rp-id.mjs","sourceRoot":"","sources":["../../src/webauthn/match-expected-rp-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB;AACtD,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,OAAO,EAAE,UAAU,EAAE,8BAA6B;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAoB,EACpB,aAAuB;IAEvB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import { areUint8ArraysEqual } from '@metamask/utils';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { bytesToHex } from '../utils/encoding.js';\n\n/**\n * Verify that an authenticator data rpIdHash matches one of the expected\n * RP IDs by SHA-256 hashing each candidate and comparing.\n *\n * @param rpIdHash - The rpIdHash from authenticatorData (32 bytes).\n * @param expectedRPIDs - One or more RP ID strings to check against.\n * @returns The matching RP ID string.\n * @throws If no expected RP ID matches.\n */\nexport function matchExpectedRPID(\n  rpIdHash: Uint8Array,\n  expectedRPIDs: string[],\n): string {\n  for (const rpID of expectedRPIDs) {\n    const expectedHash = sha256(new TextEncoder().encode(rpID));\n    if (areUint8ArraysEqual(rpIdHash, expectedHash)) {\n      return rpID;\n    }\n  }\n  throw new Error(`Unexpected RP ID hash: received ${bytesToHex(rpIdHash)}`);\n}\n"]}

package/dist/webauthn/parse-authenticator-data.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"parse-authenticator-data.cjs","sourceRoot":"","sources":["../../src/webauthn/parse-authenticator-data.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAI1D,+BAA+B;AAE/B;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,QAAoB;IAEpB,IAAI,QAAQ,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,CAAC,UAAU,8BAA8B,CAC1E,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,EAAE,CAAC;IAEd,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAA2B;QACpC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,SAAS;KACV,CAAC;IACF,OAAO,IAAI,CAAC,CAAC;IAEb,MAAM,WAAW,GAAG,IAAI,QAAQ,CAC9B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,UAAU,GAAG,OAAO,EAC7B,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC;IAEb,MAAM,MAAM,GAA4B;QACtC,QAAQ;QACR,KAAK;QACL,OAAO;KACR,CAAC;IAEF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,EAAE,CAAC;QAEd,MAAM,aAAa,GAAG,IAAI,QAAQ,CAChC,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,UAAU,GAAG,OAAO,EAC7B,CAAC,CACF,CAAC;QACF,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,CAAC;QAEb,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;QAClE,OAAO,IAAI,SAAS,CAAC;QAErB,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,IAAA,6BAAiB,EACtC,IAAI,UAAU,CAAC,WAAW,CAAC,EAC3B,CAAC,CACmB,CAAC;QACvB,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC;QAC1E,OAAO,IAAI,UAAU,CAAC;QAEtB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;QACnC,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,IAAA,6BAAiB,EAC3C,IAAI,UAAU,CAAC,SAAS,CAAC,EACzB,CAAC,CACgC,CAAC;QACpC,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC;QAChC,MAAM,CAAC,oBAAoB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,QAAQ,CAAC;IACtB,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AApFD,wDAoFC;AAED,8BAA8B","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\n\nimport type { ParsedAuthenticatorData, AuthenticatorDataFlags } from './types';\n\n/* eslint-disable no-bitwise */\n\n/**\n * Parse an authenticator data buffer per §6.1 of the WebAuthn spec.\n *\n * @param authData - Raw authenticator data bytes.\n * @returns Parsed authenticator data with flags, rpIdHash, counter, and\n *   optional attested credential data.\n */\nexport function parseAuthenticatorData(\n  authData: Uint8Array,\n): ParsedAuthenticatorData {\n  if (authData.byteLength < 37) {\n    throw new Error(\n      `authenticatorData is ${authData.byteLength} bytes, expected at least 37`,\n    );\n  }\n\n  let pointer = 0;\n\n  const rpIdHash = authData.slice(pointer, pointer + 32);\n  pointer += 32;\n\n  const flagsByte = authData[pointer];\n  const flags: AuthenticatorDataFlags = {\n    up: Boolean(flagsByte & (1 << 0)),\n    uv: Boolean(flagsByte & (1 << 2)),\n    be: Boolean(flagsByte & (1 << 3)),\n    bs: Boolean(flagsByte & (1 << 4)),\n    at: Boolean(flagsByte & (1 << 6)),\n    ed: Boolean(flagsByte & (1 << 7)),\n    flagsByte,\n  };\n  pointer += 1;\n\n  const counterView = new DataView(\n    authData.buffer,\n    authData.byteOffset + pointer,\n    4,\n  );\n  const counter = counterView.getUint32(0, false);\n  pointer += 4;\n\n  const result: ParsedAuthenticatorData = {\n    rpIdHash,\n    flags,\n    counter,\n  };\n\n  if (flags.at) {\n    const aaguid = authData.slice(pointer, pointer + 16);\n    pointer += 16;\n\n    const credIDLenView = new DataView(\n      authData.buffer,\n      authData.byteOffset + pointer,\n      2,\n    );\n    const credIDLen = credIDLenView.getUint16(0, false);\n    pointer += 2;\n\n    const credentialID = authData.slice(pointer, pointer + credIDLen);\n    pointer += credIDLen;\n\n    const pubKeyBytes = authData.slice(pointer);\n    const [, nextOffset] = decodePartialCBOR(\n      new Uint8Array(pubKeyBytes),\n      0,\n    ) as [unknown, number];\n    const credentialPublicKey = authData.slice(pointer, pointer + nextOffset);\n    pointer += nextOffset;\n\n    result.aaguid = aaguid;\n    result.credentialID = credentialID;\n    result.credentialPublicKey = credentialPublicKey;\n  }\n\n  if (flags.ed) {\n    const remaining = authData.slice(pointer);\n    const [decoded, consumed] = decodePartialCBOR(\n      new Uint8Array(remaining),\n      0,\n    ) as [Map<string, unknown>, number];\n    result.extensionsData = decoded;\n    result.extensionsDataBuffer = remaining.slice(0, consumed);\n    pointer += consumed;\n  }\n\n  if (authData.byteLength > pointer) {\n    throw new Error('Leftover bytes detected while parsing authenticator data');\n  }\n\n  return result;\n}\n\n/* eslint-enable no-bitwise */\n"]}
+{"version":3,"file":"parse-authenticator-data.cjs","sourceRoot":"","sources":["../../src/webauthn/parse-authenticator-data.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAO1D,+BAA+B;AAE/B;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,QAAoB;IAEpB,IAAI,QAAQ,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,CAAC,UAAU,8BAA8B,CAC1E,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,EAAE,CAAC;IAEd,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAA2B;QACpC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,SAAS;KACV,CAAC;IACF,OAAO,IAAI,CAAC,CAAC;IAEb,MAAM,WAAW,GAAG,IAAI,QAAQ,CAC9B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,UAAU,GAAG,OAAO,EAC7B,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC;IAEb,MAAM,MAAM,GAA4B;QACtC,QAAQ;QACR,KAAK;QACL,OAAO;KACR,CAAC;IAEF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,EAAE,CAAC;QAEd,MAAM,aAAa,GAAG,IAAI,QAAQ,CAChC,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,UAAU,GAAG,OAAO,EAC7B,CAAC,CACF,CAAC;QACF,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,CAAC;QAEb,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;QAClE,OAAO,IAAI,SAAS,CAAC;QAErB,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,IAAA,6BAAiB,EACtC,IAAI,UAAU,CAAC,WAAW,CAAC,EAC3B,CAAC,CACmB,CAAC;QACvB,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC;QAC1E,OAAO,IAAI,UAAU,CAAC;QAEtB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;QACnC,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,IAAA,6BAAiB,EAC3C,IAAI,UAAU,CAAC,SAAS,CAAC,EACzB,CAAC,CACgC,CAAC;QACpC,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC;QAChC,MAAM,CAAC,oBAAoB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,QAAQ,CAAC;IACtB,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AApFD,wDAoFC;AAED,8BAA8B","sourcesContent":["import { decodePartialCBOR } from '@levischuck/tiny-cbor';\n\nimport type {\n  ParsedAuthenticatorData,\n  AuthenticatorDataFlags,\n} from './types.js';\n\n/* eslint-disable no-bitwise */\n\n/**\n * Parse an authenticator data buffer per §6.1 of the WebAuthn spec.\n *\n * @param authData - Raw authenticator data bytes.\n * @returns Parsed authenticator data with flags, rpIdHash, counter, and\n *   optional attested credential data.\n */\nexport function parseAuthenticatorData(\n  authData: Uint8Array,\n): ParsedAuthenticatorData {\n  if (authData.byteLength < 37) {\n    throw new Error(\n      `authenticatorData is ${authData.byteLength} bytes, expected at least 37`,\n    );\n  }\n\n  let pointer = 0;\n\n  const rpIdHash = authData.slice(pointer, pointer + 32);\n  pointer += 32;\n\n  const flagsByte = authData[pointer];\n  const flags: AuthenticatorDataFlags = {\n    up: Boolean(flagsByte & (1 << 0)),\n    uv: Boolean(flagsByte & (1 << 2)),\n    be: Boolean(flagsByte & (1 << 3)),\n    bs: Boolean(flagsByte & (1 << 4)),\n    at: Boolean(flagsByte & (1 << 6)),\n    ed: Boolean(flagsByte & (1 << 7)),\n    flagsByte,\n  };\n  pointer += 1;\n\n  const counterView = new DataView(\n    authData.buffer,\n    authData.byteOffset + pointer,\n    4,\n  );\n  const counter = counterView.getUint32(0, false);\n  pointer += 4;\n\n  const result: ParsedAuthenticatorData = {\n    rpIdHash,\n    flags,\n    counter,\n  };\n\n  if (flags.at) {\n    const aaguid = authData.slice(pointer, pointer + 16);\n    pointer += 16;\n\n    const credIDLenView = new DataView(\n      authData.buffer,\n      authData.byteOffset + pointer,\n      2,\n    );\n    const credIDLen = credIDLenView.getUint16(0, false);\n    pointer += 2;\n\n    const credentialID = authData.slice(pointer, pointer + credIDLen);\n    pointer += credIDLen;\n\n    const pubKeyBytes = authData.slice(pointer);\n    const [, nextOffset] = decodePartialCBOR(\n      new Uint8Array(pubKeyBytes),\n      0,\n    ) as [unknown, number];\n    const credentialPublicKey = authData.slice(pointer, pointer + nextOffset);\n    pointer += nextOffset;\n\n    result.aaguid = aaguid;\n    result.credentialID = credentialID;\n    result.credentialPublicKey = credentialPublicKey;\n  }\n\n  if (flags.ed) {\n    const remaining = authData.slice(pointer);\n    const [decoded, consumed] = decodePartialCBOR(\n      new Uint8Array(remaining),\n      0,\n    ) as [Map<string, unknown>, number];\n    result.extensionsData = decoded;\n    result.extensionsDataBuffer = remaining.slice(0, consumed);\n    pointer += consumed;\n  }\n\n  if (authData.byteLength > pointer) {\n    throw new Error('Leftover bytes detected while parsing authenticator data');\n  }\n\n  return result;\n}\n\n/* eslint-enable no-bitwise */\n"]}

package/dist/webauthn/parse-authenticator-data.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-authenticator-data.d.cts","sourceRoot":"","sources":["../../src/webauthn/parse-authenticator-data.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAA0B,oBAAgB;AAI/E;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAkFzB"}
+{"version":3,"file":"parse-authenticator-data.d.cts","sourceRoot":"","sources":["../../src/webauthn/parse-authenticator-data.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,uBAAuB,EAExB,oBAAmB;AAIpB;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAkFzB"}

package/dist/webauthn/parse-authenticator-data.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-authenticator-data.d.mts","sourceRoot":"","sources":["../../src/webauthn/parse-authenticator-data.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAA0B,oBAAgB;AAI/E;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAkFzB"}
+{"version":3,"file":"parse-authenticator-data.d.mts","sourceRoot":"","sources":["../../src/webauthn/parse-authenticator-data.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,uBAAuB,EAExB,oBAAmB;AAIpB;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAkFzB"}