@metamask/passkey-controller 3.1.0 → 4.0.0

package/dist/PasskeyController.mjs

@@ -1,680 +0,0 @@
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _PasskeyController_instances, _PasskeyController_ceremonyManager, _PasskeyController_expectedRPIDs, _PasskeyController_rpId, _PasskeyController_rpName, _PasskeyController_expectedOrigin, _PasskeyController_userName, _PasskeyController_userDisplayName, _PasskeyController_getIsOnboardingCompleted, _PasskeyController_operationMutex, _PasskeyController_protectVaultKeyWithPasskey, _PasskeyController_retrieveVaultKeyWithPasskey, _PasskeyController_verifyPasskeyAuthentication, _PasskeyController_renewVaultKeyProtection, _PasskeyController_changePasswordWithPasskeyVerification, _PasskeyController_removePasskeyWithPasskeyVerification, _PasskeyController_removePasskeyWithPasswordVerification, _PasskeyController_verifyAuthenticationResponse, _PasskeyController_withOperationLock, _PasskeyController_assertEnrollmentAllowed, _PasskeyController_requireEnrolled, _PasskeyController_getChallengeFromClientData, _PasskeyController_removePasskey;
-import { BaseController } from "@metamask/base-controller";
-import { areUint8ArraysEqual, stringToBytes } from "@metamask/utils";
-import { Mutex } from "async-mutex";
-import { WEBAUTHN_TIMEOUT_MS, CeremonyManager } from "./ceremony-manager.mjs";
-import { controllerName, PasskeyControllerErrorCode, PasskeyControllerErrorMessage } from "./constants.mjs";
-import { PasskeyControllerError } from "./errors.mjs";
-import { deriveKeyFromAuthenticationResponse } from "./key-derivation.mjs";
-import { createModuleLogger, projectLogger } from "./logger.mjs";
-import { decryptWithKey, encryptWithKey, randomBytesToBase64URL } from "./utils/crypto.mjs";
-import { base64URLToBytes, bytesToBase64URL } from "./utils/encoding.mjs";
-import { COSEALG } from "./webauthn/constants.mjs";
-import { decodeClientDataJSON } from "./webauthn/decode-client-data-json.mjs";
-import { verifyAuthenticationResponse } from "./webauthn/verify-authentication-response.mjs";
-import { verifyRegistrationResponse } from "./webauthn/verify-registration-response.mjs";
-/**
- * Returns the default (empty) state for {@link PasskeyController}.
- *
- * @returns A fresh state object with no enrolled passkey.
- */
-export function getDefaultPasskeyControllerState() {
-    return { passkeyRecord: null };
-}
-const passkeyControllerMetadata = {
-    passkeyRecord: {
-        persist: true,
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        usedInUi: true,
-    },
-};
-const log = createModuleLogger(projectLogger, controllerName);
-/**
- * Selectors for {@link PasskeyControllerState}.
- *
- * Use these instead of dedicated getter methods on the controller, so that
- * derived values can be consumed from Redux selectors and other places that
- * only have access to a state object.
- */
-export const passkeyControllerSelectors = {
-    selectIsPasskeyEnrolled: (state) => state.passkeyRecord !== null,
-};
-const MESSENGER_EXPOSED_METHODS = [
-    'isPasskeyEnrolled',
-    'generateRegistrationOptions',
-    'generatePostRegistrationAuthenticationOptions',
-    'generateAuthenticationOptions',
-    'protectVaultKeyWithPasskey',
-    'retrieveVaultKeyWithPasskey',
-    'unlockWithPasskey',
-    'verifyPasskeyAuthentication',
-    'renewVaultKeyProtection',
-    'changePasswordWithPasskeyVerification',
-    'exportSeedPhraseWithPasskey',
-    'exportAccountsWithPasskey',
-    'removePasskeyWithPasskeyVerification',
-    'removePasskeyWithPasswordVerification',
-    'clearState',
-    'destroy',
-];
-/**
- * Controller that enrolls a WebAuthn passkey and uses it to protect and unlock
- * the vault encryption key.
- */
-export class PasskeyController extends BaseController {
-    /**
-     * Creates a passkey controller with WebAuthn relying-party settings.
-     *
-     * @param options - Constructor options.
-     * @param options.messenger - The messenger to use for communication.
-     * @param options.state - The initial state of the controller.
-     * @param options.rpId - The relying party ID to use for the passkey.
-     * @param options.expectedRPID - The expected relying party ID to use for the passkey.
-     * @param options.rpName - The relying party name to use for the passkey.
-     * @param options.expectedOrigin - The expected origin to use for the passkey.
-     * @param options.userName - The user name to use for the passkey.
-     * @param options.userDisplayName - The user display name to use for the passkey.
-     * @param options.getIsOnboardingCompleted - The callback to use to check if onboarding is complete.
-     */
-    constructor({ messenger, state = {}, rpId, expectedRPID, rpName, expectedOrigin, userName, userDisplayName, getIsOnboardingCompleted, }) {
-        super({
-            messenger,
-            metadata: passkeyControllerMetadata,
-            name: controllerName,
-            state: { ...getDefaultPasskeyControllerState(), ...state },
-        });
-        _PasskeyController_instances.add(this);
-        _PasskeyController_ceremonyManager.set(this, new CeremonyManager());
-        _PasskeyController_expectedRPIDs.set(this, void 0);
-        _PasskeyController_rpId.set(this, void 0);
-        _PasskeyController_rpName.set(this, void 0);
-        _PasskeyController_expectedOrigin.set(this, void 0);
-        _PasskeyController_userName.set(this, void 0);
-        _PasskeyController_userDisplayName.set(this, void 0);
-        _PasskeyController_getIsOnboardingCompleted.set(this, void 0);
-        _PasskeyController_operationMutex.set(this, new Mutex());
-        const expectedRPIDs = Array.isArray(expectedRPID)
-            ? expectedRPID
-            : [expectedRPID];
-        __classPrivateFieldSet(this, _PasskeyController_expectedRPIDs, [...expectedRPIDs], "f");
-        __classPrivateFieldSet(this, _PasskeyController_rpId, rpId, "f");
-        __classPrivateFieldSet(this, _PasskeyController_rpName, rpName, "f");
-        __classPrivateFieldSet(this, _PasskeyController_expectedOrigin, expectedOrigin, "f");
-        __classPrivateFieldSet(this, _PasskeyController_userName, userName ?? rpName, "f");
-        __classPrivateFieldSet(this, _PasskeyController_userDisplayName, userDisplayName ?? rpName, "f");
-        __classPrivateFieldSet(this, _PasskeyController_getIsOnboardingCompleted, getIsOnboardingCompleted, "f");
-        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
-    }
-    /**
-     * Whether a passkey is enrolled and vault key material is stored.
-     *
-     * @returns `true` if enrolled, otherwise `false`.
-     */
-    isPasskeyEnrolled() {
-        return passkeyControllerSelectors.selectIsPasskeyEnrolled(this.state);
-    }
-    /**
-     * Builds WebAuthn credential creation options for passkey enrollment.
-     *
-     * @param creationOptionsConfig - Optional creation behavior.
-     * @param creationOptionsConfig.prfAvailable - Request the PRF extension unless `false`. Defaults to `true`.
-     * @returns Public key credential creation options for `navigator.credentials.create()`.
-     */
-    generateRegistrationOptions(creationOptionsConfig) {
-        if (this.isPasskeyEnrolled()) {
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.AlreadyEnrolled, { code: PasskeyControllerErrorCode.AlreadyEnrolled });
-        }
-        const includePrf = creationOptionsConfig?.prfAvailable !== false;
-        const prfSalt = includePrf ? randomBytesToBase64URL(32) : undefined;
-        const userHandle = randomBytesToBase64URL(64);
-        const challenge = randomBytesToBase64URL(32);
-        const extensions = {};
-        if (prfSalt) {
-            extensions.prf = { eval: { first: prfSalt } };
-        }
-        const options = {
-            rp: {
-                name: __classPrivateFieldGet(this, _PasskeyController_rpName, "f"),
-                id: __classPrivateFieldGet(this, _PasskeyController_rpId, "f"),
-            },
-            user: {
-                id: userHandle,
-                name: __classPrivateFieldGet(this, _PasskeyController_userName, "f"),
-                displayName: __classPrivateFieldGet(this, _PasskeyController_userDisplayName, "f"),
-            },
-            challenge,
-            pubKeyCredParams: [
-                { alg: COSEALG.EdDSA, type: 'public-key' },
-                { alg: COSEALG.ES256, type: 'public-key' },
-                { alg: COSEALG.RS256, type: 'public-key' },
-            ],
-            timeout: WEBAUTHN_TIMEOUT_MS,
-            authenticatorSelection: {
-                userVerification: 'required',
-                authenticatorAttachment: 'platform',
-                residentKey: 'preferred',
-            },
-            hints: ['client-device', 'hybrid'],
-            attestation: 'none',
-            ...(Object.keys(extensions).length > 0 ? { extensions } : {}),
-        };
-        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").saveRegistrationCeremony(challenge, {
-            userHandle,
-            prfSalt,
-            challenge,
-            createdAt: Date.now(),
-        });
-        return options;
-    }
-    /**
-     * Builds WebAuthn credential request options for the post-registration
-     * authentication step (between `create` and {@link protectVaultKeyWithPasskey}).
-     *
-     * @param params - Input for the pending registration ceremony.
-     * @param params.registrationResponse - Result of `navigator.credentials.create()`.
-     * @returns Public key credential request options for `navigator.credentials.get()`.
-     */
-    generatePostRegistrationAuthenticationOptions(params) {
-        // get registration ceremony
-        const { registrationResponse } = params;
-        const regChallenge = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_getChallengeFromClientData).call(this, registrationResponse.response.clientDataJSON);
-        const registrationCeremony = __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").getRegistrationCeremony(regChallenge);
-        if (!registrationCeremony) {
-            log('No active passkey registration ceremony for challenge');
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.NoRegistrationCeremony, { code: PasskeyControllerErrorCode.NoRegistrationCeremony });
-        }
-        // build auth options
-        const challenge = randomBytesToBase64URL(32);
-        const extensions = {};
-        if (registrationCeremony.prfSalt) {
-            extensions.prf = { eval: { first: registrationCeremony.prfSalt } };
-        }
-        const options = {
-            challenge,
-            rpId: __classPrivateFieldGet(this, _PasskeyController_rpId, "f"),
-            allowCredentials: [
-                {
-                    id: registrationResponse.id,
-                    type: 'public-key',
-                    transports: registrationResponse.response.transports,
-                },
-            ],
-            userVerification: 'required',
-            hints: ['client-device', 'hybrid'],
-            timeout: WEBAUTHN_TIMEOUT_MS,
-            extensions,
-        };
-        // save auth ceremony
-        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").saveAuthenticationCeremony(challenge, {
-            challenge,
-            createdAt: Date.now(),
-        });
-        return options;
-    }
-    /**
-     * Builds WebAuthn credential request options for the enrolled passkey.
-     *
-     * @returns Public key credential request options for `navigator.credentials.get()`.
-     */
-    generateAuthenticationOptions() {
-        const record = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-        const challenge = randomBytesToBase64URL(32);
-        const extensions = {};
-        if (record.keyDerivation.method === 'prf') {
-            extensions.prf = { eval: { first: record.keyDerivation.prfSalt } };
-        }
-        const options = {
-            challenge,
-            rpId: __classPrivateFieldGet(this, _PasskeyController_rpId, "f"),
-            allowCredentials: [
-                {
-                    id: record.credential.id,
-                    type: 'public-key',
-                    transports: record.credential.transports,
-                },
-            ],
-            userVerification: 'required',
-            hints: ['client-device', 'hybrid'],
-            timeout: WEBAUTHN_TIMEOUT_MS,
-            extensions,
-        };
-        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").saveAuthenticationCeremony(challenge, {
-            challenge,
-            createdAt: Date.now(),
-        });
-        return options;
-    }
-    /**
-     * Verifies registration and post-registration authentication, then stores the
-     * vault key encrypted under the new passkey.
-     *
-     * Fetches the current vault encryption key from KeyringController before wrapping.
-     * When onboarding is complete, requires `password` for step-up verification first.
-     *
-     * @param params - Enrollment completion inputs.
-     * @param params.registrationResponse - Result of `navigator.credentials.create()`.
-     * @param params.authenticationResponse - Result of `navigator.credentials.get()` after {@link generatePostRegistrationAuthenticationOptions}.
-     * @param params.password - Wallet password when onboarding is complete (step-up).
-     * @returns Resolves when enrollment completes.
-     */
-    async protectVaultKeyWithPasskey(params) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_protectVaultKeyWithPasskey).call(this, params));
-    }
-    /**
-     * Verifies an authentication assertion and returns the decrypted vault key.
-     *
-     * Prefer orchestrated methods ({@link unlockWithPasskey},
-     * {@link exportSeedPhraseWithPasskey}, {@link exportAccountsWithPasskey}) for product
-     * flows instead of calling KeyringController with the returned key manually.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @returns The plaintext vault encryption key.
-     */
-    async retrieveVaultKeyWithPasskey(authenticationResponse) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse));
-    }
-    /**
-     * Unlocks the keyring using a passkey authentication assertion.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @returns Resolves when the keyring is unlocked.
-     */
-    async unlockWithPasskey(authenticationResponse) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
-            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
-            await this.messenger.call('KeyringController:submitEncryptionKey', vaultKey);
-        });
-    }
-    /**
-     * Exports the seed phrase after passkey step-up authentication.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @param keyringId - Optional keyring id; defaults to the primary HD keyring.
-     * @returns Raw seed phrase bytes from KeyringController.
-     */
-    async exportSeedPhraseWithPasskey(authenticationResponse, keyringId) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
-            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
-            return await this.messenger.call('KeyringController:exportSeedPhrase', { encryptionKey: vaultKey }, keyringId);
-        });
-    }
-    /**
-     * Exports private keys for the given addresses after passkey step-up authentication.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @param addresses - Account addresses to export.
-     * @returns Private keys in the same order as `addresses`.
-     */
-    async exportAccountsWithPasskey(authenticationResponse, addresses) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, async () => {
-            const vaultKey = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
-            const privateKeys = [];
-            for (const address of addresses) {
-                privateKeys.push(await this.messenger.call('KeyringController:exportAccount', { encryptionKey: vaultKey }, address));
-            }
-            return privateKeys;
-        });
-    }
-    /**
-     * Checks whether the given authentication assertion is valid for the enrolled passkey.
-     *
-     * On failure, returns `false` for {@link PasskeyControllerError} with a `code`;
-     * other errors propagate.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @returns `true` if verification succeeds, otherwise `false`.
-     */
-    async verifyPasskeyAuthentication(authenticationResponse) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, authenticationResponse));
-    }
-    /**
-     * Re-wraps the vault key after rotation. Updates persisted `encryptedVaultKey` on success.
-     *
-     * Does not verify WebAuthn or ceremony state—call only after your layer has authenticated
-     * the user (passkey `get()` + verified assertion, or verified password). On passkey paths,
-     * pass the same `authenticationResponse` you just verified (e.g. from
-     * {@link retrieveVaultKeyWithPasskey} / {@link verifyPasskeyAuthentication}).
-     *
-     * For password change with passkey step-up, prefer
-     * {@link changePasswordWithPasskeyVerification}, which orchestrates keyring export,
-     * `changePassword`, and re-wrap in one call.
-     *
-     * @param params - Re-wrap inputs.
-     * @param params.authenticationResponse - Used to derive the wrapping key.
-     * @param params.oldVaultKey - Expected current vault key.
-     * @param params.newVaultKey - New vault key to encrypt under the passkey.
-     * @returns Resolves when the passkey record is updated.
-     */
-    async renewVaultKeyProtection(params) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_renewVaultKeyProtection).call(this, params));
-    }
-    /**
-     * Changes the wallet password after passkey step-up authentication.
-     *
-     * When `renewVaultKeyProtection` is `true` (default), re-wraps the vault key under the
-     * passkey after rotation. When `false`, removes the passkey instead.
-     *
-     * @param params - Change-password inputs.
-     * @param params.newPassword - New wallet password.
-     * @param params.authenticationResponse - Result of `navigator.credentials.get()`.
-     * @param params.options - Optional flow controls.
-     * @param params.options.renewVaultKeyProtection - Re-wrap vault key after password change.
-     * @returns Resolves when the password change completes.
-     */
-    async changePasswordWithPasskeyVerification(params) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_changePasswordWithPasskeyVerification).call(this, params));
-    }
-    /**
-     * Removes the enrolled passkey after verifying a passkey authentication assertion.
-     *
-     * @param authenticationResponse - Result of `navigator.credentials.get()`.
-     * @returns Resolves when the passkey is removed.
-     */
-    async removePasskeyWithPasskeyVerification(authenticationResponse) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskeyWithPasskeyVerification).call(this, authenticationResponse));
-    }
-    /**
-     * Removes the enrolled passkey after verifying the wallet password.
-     *
-     * @param password - Wallet password for step-up verification.
-     * @returns Resolves when the passkey is removed.
-     */
-    async removePasskeyWithPasswordVerification(password) {
-        return __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_withOperationLock).call(this, () => __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskeyWithPasswordVerification).call(this, password));
-    }
-    /**
-     * Resets state and clears in-flight registration/authentication ceremonies.
-     *
-     * For user-facing passkey removal with step-up, use
-     * {@link removePasskeyWithPasskeyVerification} or
-     * {@link removePasskeyWithPasswordVerification}.
-     */
-    clearState() {
-        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
-    }
-    /**
-     * Releases all in-flight ceremony state and tears down the messenger.
-     */
-    destroy() {
-        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").clear();
-        super.destroy();
-    }
-}
-_PasskeyController_ceremonyManager = new WeakMap(), _PasskeyController_expectedRPIDs = new WeakMap(), _PasskeyController_rpId = new WeakMap(), _PasskeyController_rpName = new WeakMap(), _PasskeyController_expectedOrigin = new WeakMap(), _PasskeyController_userName = new WeakMap(), _PasskeyController_userDisplayName = new WeakMap(), _PasskeyController_getIsOnboardingCompleted = new WeakMap(), _PasskeyController_operationMutex = new WeakMap(), _PasskeyController_instances = new WeakSet(), _PasskeyController_protectVaultKeyWithPasskey = async function _PasskeyController_protectVaultKeyWithPasskey(params) {
-    if (this.isPasskeyEnrolled()) {
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.AlreadyEnrolled, { code: PasskeyControllerErrorCode.AlreadyEnrolled });
-    }
-    await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_assertEnrollmentAllowed).call(this, params.password);
-    const vaultKey = await this.messenger.call('KeyringController:exportEncryptionKey');
-    const { registrationResponse, authenticationResponse } = params;
-    // get registration ceremony
-    const challenge = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_getChallengeFromClientData).call(this, registrationResponse.response.clientDataJSON);
-    const registrationCeremony = __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").getRegistrationCeremony(challenge);
-    if (!registrationCeremony) {
-        log('No active passkey registration ceremony for challenge');
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.NoRegistrationCeremony, { code: PasskeyControllerErrorCode.NoRegistrationCeremony });
-    }
-    try {
-        // verify registration response
-        const { verified, registrationInfo } = await verifyRegistrationResponse({
-            response: registrationResponse,
-            expectedChallenge: registrationCeremony.challenge,
-            expectedOrigin: __classPrivateFieldGet(this, _PasskeyController_expectedOrigin, "f"),
-            expectedRPIDs: __classPrivateFieldGet(this, _PasskeyController_expectedRPIDs, "f"),
-            requireUserVerification: true,
-        }).catch((error) => {
-            log('Error verifying passkey registration response', error);
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.RegistrationVerificationFailed, {
-                code: PasskeyControllerErrorCode.RegistrationVerificationFailed,
-                cause: error instanceof Error ? error : new Error(String(error)),
-            });
-        });
-        if (!verified || !registrationInfo) {
-            log('Passkey registration verification returned unverified or missing registration info');
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.RegistrationVerificationFailed, { code: PasskeyControllerErrorCode.RegistrationVerificationFailed });
-        }
-        // verify authentication response
-        const credential = {
-            id: registrationInfo.credentialId,
-            publicKey: bytesToBase64URL(registrationInfo.publicKey),
-            counter: registrationInfo.counter,
-            transports: registrationInfo.transports,
-            aaguid: registrationInfo.aaguid,
-        };
-        const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, credential);
-        // determine key derivation method
-        const prfFirst = authenticationResponse.clientExtensionResults?.prf?.results?.first;
-        const authHasPrfOutput = typeof prfFirst === 'string' && prfFirst.length > 0;
-        const keyDerivation = authHasPrfOutput && registrationCeremony.prfSalt
-            ? { method: 'prf', prfSalt: registrationCeremony.prfSalt }
-            : { method: 'userHandle' };
-        if (keyDerivation.method === 'userHandle' &&
-            authenticationResponse.response.userHandle !==
-                registrationCeremony.userHandle) {
-            log('Post-registration assertion userHandle does not match registration ceremony');
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: PasskeyControllerErrorCode.AuthenticationVerificationFailed });
-        }
-        // derive key and encrypt vault key
-        const encKey = deriveKeyFromAuthenticationResponse(authenticationResponse, { credential, keyDerivation });
-        const { ciphertext, iv } = encryptWithKey(vaultKey, encKey);
-        // persist passkey record
-        this.update((state) => {
-            state.passkeyRecord = {
-                credential: {
-                    ...credential,
-                    counter: Math.max(newCounter, credential.counter),
-                },
-                encryptedVaultKey: { ciphertext, iv },
-                keyDerivation,
-            };
-        });
-    }
-    finally {
-        // delete registration ceremony
-        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").deleteRegistrationCeremony(challenge);
-    }
-}, _PasskeyController_retrieveVaultKeyWithPasskey = async function _PasskeyController_retrieveVaultKeyWithPasskey(authenticationResponse) {
-    const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    // verify authentication response and update counter
-    const { newCounter } = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyAuthenticationResponse).call(this, authenticationResponse, passkeyRecord.credential);
-    this.update((state) => {
-        if (!state.passkeyRecord) {
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.NotEnrolled, { code: PasskeyControllerErrorCode.NotEnrolled });
-        }
-        state.passkeyRecord.credential.counter = Math.max(newCounter, state.passkeyRecord.credential.counter);
-    });
-    // derive key
-    const encKey = deriveKeyFromAuthenticationResponse(authenticationResponse, passkeyRecord);
-    // decrypt vault key
-    try {
-        const vaultKey = decryptWithKey(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
-        return vaultKey;
-    }
-    catch (cause) {
-        log('Error decrypting vault key with passkey', cause instanceof Error ? cause : new Error(String(cause)));
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
-            code: PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
-            cause: cause instanceof Error ? cause : new Error(String(cause)),
-        });
-    }
-}, _PasskeyController_verifyPasskeyAuthentication = async function _PasskeyController_verifyPasskeyAuthentication(authenticationResponse) {
-    try {
-        await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_retrieveVaultKeyWithPasskey).call(this, authenticationResponse);
-        return true;
-    }
-    catch (error) {
-        if (error instanceof PasskeyControllerError && error.code !== undefined) {
-            return false;
-        }
-        throw error;
-    }
-}, _PasskeyController_renewVaultKeyProtection = async function _PasskeyController_renewVaultKeyProtection(params) {
-    const { authenticationResponse } = params;
-    const passkeyRecord = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    // derive key
-    const encKey = deriveKeyFromAuthenticationResponse(authenticationResponse, passkeyRecord);
-    // decrypt vault key
-    let decryptedVaultKey;
-    try {
-        decryptedVaultKey = decryptWithKey(passkeyRecord.encryptedVaultKey.ciphertext, passkeyRecord.encryptedVaultKey.iv, encKey);
-    }
-    catch (error) {
-        log('Error decrypting vault key during passkey vault key renewal', error instanceof Error ? error : new Error(String(error)));
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.VaultKeyDecryptionFailed, {
-            code: PasskeyControllerErrorCode.VaultKeyDecryptionFailed,
-            cause: error instanceof Error ? error : new Error(String(error)),
-        });
-    }
-    // check if vault key matches
-    const { oldVaultKey, newVaultKey } = params;
-    if (!areUint8ArraysEqual(stringToBytes(decryptedVaultKey), stringToBytes(oldVaultKey))) {
-        log('Passkey renewal rejected: decrypted vault key does not match oldVaultKey');
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.VaultKeyMismatch, { code: PasskeyControllerErrorCode.VaultKeyMismatch });
-    }
-    // encrypt new vault key
-    const { ciphertext, iv } = encryptWithKey(newVaultKey, encKey);
-    // persist passkey record (mutate current state only for vault key material)
-    this.update((state) => {
-        if (!state.passkeyRecord) {
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.NotEnrolled, {
-                code: PasskeyControllerErrorCode.NotEnrolled,
-            });
-        }
-        state.passkeyRecord.encryptedVaultKey = { ciphertext, iv };
-    });
-}, _PasskeyController_changePasswordWithPasskeyVerification = async function _PasskeyController_changePasswordWithPasskeyVerification(params) {
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    const verified = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, params.authenticationResponse);
-    if (!verified) {
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: PasskeyControllerErrorCode.AuthenticationVerificationFailed });
-    }
-    const renewVaultKeyProtection = params.options?.renewVaultKeyProtection ?? true;
-    if (!renewVaultKeyProtection) {
-        await this.messenger.call('KeyringController:changePassword', params.newPassword);
-        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
-        return;
-    }
-    const vaultKeyBefore = await this.messenger.call('KeyringController:exportEncryptionKey');
-    await this.messenger.call('KeyringController:changePassword', params.newPassword);
-    try {
-        const vaultKeyAfter = await this.messenger.call('KeyringController:exportEncryptionKey');
-        await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_renewVaultKeyProtection).call(this, {
-            authenticationResponse: params.authenticationResponse,
-            oldVaultKey: vaultKeyBefore,
-            newVaultKey: vaultKeyAfter,
-        });
-    }
-    catch (error) {
-        __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.VaultKeyRenewalFailed, {
-            code: PasskeyControllerErrorCode.VaultKeyRenewalFailed,
-            cause: error instanceof Error ? error : new Error(String(error)),
-        });
-    }
-}, _PasskeyController_removePasskeyWithPasskeyVerification = async function _PasskeyController_removePasskeyWithPasskeyVerification(authenticationResponse) {
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    const verified = await __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_verifyPasskeyAuthentication).call(this, authenticationResponse);
-    if (!verified) {
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.AuthenticationVerificationFailed, { code: PasskeyControllerErrorCode.AuthenticationVerificationFailed });
-    }
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
-}, _PasskeyController_removePasskeyWithPasswordVerification = async function _PasskeyController_removePasskeyWithPasswordVerification(password) {
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_requireEnrolled).call(this);
-    await this.messenger.call('KeyringController:verifyPassword', password);
-    __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_removePasskey).call(this);
-}, _PasskeyController_verifyAuthenticationResponse = 
-/**
- * Validates a WebAuthn authentication response against stored credential data.
- *
- * @param authenticationResponse - Parsed authentication response from the client.
- * @param credential - Credential identifiers and public key material for verification.
- * @returns Updated authenticator signature counter.
- */
-async function _PasskeyController_verifyAuthenticationResponse(authenticationResponse, credential) {
-    // get challenge
-    const challenge = __classPrivateFieldGet(this, _PasskeyController_instances, "m", _PasskeyController_getChallengeFromClientData).call(this, authenticationResponse.response.clientDataJSON);
-    // get authentication ceremony
-    const authenticationCeremony = __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").getAuthenticationCeremony(challenge);
-    if (!authenticationCeremony) {
-        log('No active passkey authentication ceremony for challenge');
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.NoAuthenticationCeremony, { code: PasskeyControllerErrorCode.NoAuthenticationCeremony });
-    }
-    try {
-        // verify authentication response
-        const result = await verifyAuthenticationResponse({
-            response: authenticationResponse,
-            expectedChallenge: authenticationCeremony.challenge,
-            expectedOrigin: __classPrivateFieldGet(this, _PasskeyController_expectedOrigin, "f"),
-            expectedRPIDs: __classPrivateFieldGet(this, _PasskeyController_expectedRPIDs, "f"),
-            credential: {
-                id: credential.id,
-                publicKey: base64URLToBytes(credential.publicKey),
-                counter: credential.counter,
-                transports: credential.transports,
-            },
-            requireUserVerification: true,
-        }).catch((error) => {
-            log('Error verifying passkey authentication response', error instanceof Error ? error : new Error(String(error)));
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.AuthenticationVerificationFailed, {
-                code: PasskeyControllerErrorCode.AuthenticationVerificationFailed,
-                cause: error instanceof Error ? error : new Error(String(error)),
-            });
-        });
-        if (!result.verified) {
-            log('Passkey authentication verification returned unverified');
-            throw new PasskeyControllerError(PasskeyControllerErrorMessage.AuthenticationVerificationFailed, {
-                code: PasskeyControllerErrorCode.AuthenticationVerificationFailed,
-            });
-        }
-        return { newCounter: result.authenticationInfo.newCounter };
-    }
-    finally {
-        // delete authentication ceremony
-        __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").deleteAuthenticationCeremony(challenge);
-    }
-}, _PasskeyController_withOperationLock = 
-/**
- * Serializes orchestrated passkey operations that mutate state or call KeyringController.
- *
- * @param callback - Operation to run while the mutex is held.
- * @returns The result of the callback.
- */
-async function _PasskeyController_withOperationLock(callback) {
-    return __classPrivateFieldGet(this, _PasskeyController_operationMutex, "f").runExclusive(callback);
-}, _PasskeyController_assertEnrollmentAllowed = async function _PasskeyController_assertEnrollmentAllowed(password) {
-    if (!__classPrivateFieldGet(this, _PasskeyController_getIsOnboardingCompleted, "f").call(this)) {
-        return;
-    }
-    if (!password) {
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.EnrollmentPasswordRequired, {
-            code: PasskeyControllerErrorCode.EnrollmentPasswordRequired,
-        });
-    }
-    await this.messenger.call('KeyringController:verifyPassword', password);
-}, _PasskeyController_requireEnrolled = function _PasskeyController_requireEnrolled() {
-    const record = this.state.passkeyRecord;
-    if (!record) {
-        throw new PasskeyControllerError(PasskeyControllerErrorMessage.NotEnrolled, {
-            code: PasskeyControllerErrorCode.NotEnrolled,
-        });
-    }
-    return record;
-}, _PasskeyController_getChallengeFromClientData = function _PasskeyController_getChallengeFromClientData(clientDataJSON) {
-    return decodeClientDataJSON(clientDataJSON).challenge;
-}, _PasskeyController_removePasskey = function _PasskeyController_removePasskey() {
-    this.update(() => getDefaultPasskeyControllerState());
-    __classPrivateFieldGet(this, _PasskeyController_ceremonyManager, "f").clear();
-};
-//# sourceMappingURL=PasskeyController.mjs.map