@rakomi/react-native 0.1.0 → 0.2.0

package/dist/native/index.cjs

@@ -1,5 +1,7 @@
 'use strict';
 
+var sdkCore = require('@rakomi/sdk-core');
+
 // src/native/bare-rn-example.ts
 function createBareRnAdapter(options) {
   const servicePrefix = options.keychainServicePrefix ?? "rakomi";
@@ -376,6 +378,269 @@ function createNetInfoConnectivity() {
   };
 }
 
+// src/native/passkey-envelope.ts
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var RULES = {
+  registration: {
+    required: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    base64url: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    requiredStringArray: ["response.transports"],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: [
+      "clientDataJSON",
+      "attestationObject",
+      "authenticatorData",
+      "publicKey",
+      "publicKeyAlgorithm"
+    ],
+    keepStringArrayInResponse: ["transports"]
+  },
+  assertion: {
+    required: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature"
+    ],
+    base64url: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature",
+      "response.userHandle"
+    ],
+    requiredStringArray: [],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: ["clientDataJSON", "authenticatorData", "signature", "userHandle"],
+    keepStringArrayInResponse: []
+  }
+};
+var CredentialEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialEnvelopeError";
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function readPath(envelope, path) {
+  const dot = path.indexOf(".");
+  if (dot === -1) return envelope[path];
+  const parent = envelope[path.slice(0, dot)];
+  return isRecord(parent) ? parent[path.slice(dot + 1)] : void 0;
+}
+function assertW3cCredentialEnvelope(kind, parsed) {
+  if (!isRecord(parsed)) {
+    throw new CredentialEnvelopeError(
+      `the native module returned a ${parsed === null ? "null" : typeof parsed}; the contract is a JSON object`
+    );
+  }
+  if (parsed["type"] !== "public-key") {
+    throw new CredentialEnvelopeError(`'type' must be the string "public-key" (W3C WebAuthn L3)`);
+  }
+  if (!isRecord(parsed["response"])) {
+    throw new CredentialEnvelopeError(`'response' is missing or is not an object`);
+  }
+  const rule = RULES[kind];
+  for (const path of rule.required) {
+    const value = readPath(parsed, path);
+    if (typeof value !== "string" || value.length === 0) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be a non-empty string (W3C WebAuthn L3 JSON serialization)`
+      );
+    }
+  }
+  for (const path of rule.requiredStringArray) {
+    const value = readPath(parsed, path);
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an array of strings (W3C WebAuthn L3). The server stores it and replays it into allowCredentials \u2014 omitting it silently breaks cross-device sign-in later, on another device.`
+      );
+    }
+  }
+  for (const path of rule.requiredObject) {
+    const value = readPath(parsed, path);
+    if (!isRecord(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an object (an empty object is fine)`
+      );
+    }
+  }
+  for (const path of rule.base64url) {
+    const value = readPath(parsed, path);
+    if (value === void 0 || value === null) continue;
+    if (typeof value !== "string" || !BASE64URL.test(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is not unpadded base64url (RFC 4648 \xA75). On iOS, Data.base64EncodedString() emits standard base64 (RFC 4648 \xA74, with '+', '/' and '=' padding) \u2014 use the URL-safe, unpadded variant.`
+      );
+    }
+  }
+}
+function sanitizeCredentialEnvelope(kind, parsed) {
+  assertW3cCredentialEnvelope(kind, parsed);
+  const envelope = parsed;
+  const source = envelope["response"];
+  const rule = RULES[kind];
+  const response = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keepInResponse) {
+    const value = source[key];
+    if (typeof value === "string" || typeof value === "number") response[key] = value;
+  }
+  for (const key of rule.keepStringArrayInResponse) {
+    const value = source[key];
+    if (Array.isArray(value)) response[key] = value.filter((entry) => typeof entry === "string");
+  }
+  const projected = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keep) {
+    const value = envelope[key];
+    if (value !== void 0) projected[key] = value;
+  }
+  projected["response"] = response;
+  return projected;
+}
+
+// src/native/passkey-adapter.ts
+var NATIVE_CODE_TO_KIND = Object.assign(/* @__PURE__ */ Object.create(null), {
+  PASSKEY_CANCELLED: "cancelled",
+  PASSKEY_UNSUPPORTED: "unsupported",
+  PASSKEY_NO_CREDENTIAL: "cancelled"
+});
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeNativeRejection(err) {
+  const code = isRecord2(err) ? err["code"] : void 0;
+  if (typeof code === "string") {
+    const kind = NATIVE_CODE_TO_KIND[code];
+    if (kind !== void 0) {
+      throw new sdkCore.PasskeyCeremonyError(kind);
+    }
+  }
+  throw err;
+}
+function assertNever(value) {
+  throw new sdkCore.PasskeyCeremonyError("failed", `unhandled ceremony-error kind: ${String(value)}`);
+}
+function describeKind(kind) {
+  switch (kind) {
+    case "cancelled":
+      return "the user dismissed the passkey sheet";
+    case "unsupported":
+      return "this platform cannot run a passkey ceremony";
+    case "failed":
+      return "the passkey ceremony failed";
+    default:
+      return assertNever(kind);
+  }
+}
+function createNativePasskeyAdapter(options) {
+  const mod = options.module;
+  let inFlight = null;
+  const candidate = mod;
+  const missing = ["isPasskeySupported", "createPasskey", "getPasskey"].filter(
+    (method) => typeof candidate?.[method] !== "function"
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `native passkey module is missing: ${missing.join(", ")} \u2014 it does not satisfy NativePasskeyModuleSpec`
+    );
+  }
+  async function runCeremony(kind, requestJson, ceremonyOptions) {
+    const signal = ceremonyOptions?.signal;
+    if (signal?.aborted === true) {
+      throw new sdkCore.PasskeyCeremonyError("cancelled", describeKind("cancelled"));
+    }
+    const ticket = /* @__PURE__ */ Symbol("passkey-ceremony");
+    inFlight = ticket;
+    const onAbort = () => {
+      if (inFlight !== ticket) return;
+      try {
+        void Promise.resolve(mod.cancelPasskeyRequest?.()).catch(() => void 0);
+      } catch {
+      }
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    let raw;
+    try {
+      raw = await (kind === "registration" ? mod.createPasskey(requestJson) : mod.getPasskey(requestJson));
+    } catch (err) {
+      normalizeNativeRejection(err);
+    } finally {
+      signal?.removeEventListener("abort", onAbort);
+      if (inFlight === ticket) inFlight = null;
+    }
+    if (typeof raw !== "string") {
+      throw new CredentialEnvelopeError(
+        `the native module returned ${raw === null ? "null" : `a ${typeof raw}`}; the contract is a JSON string \u2014 wrap a module with an object API so it stringifies its argument and its result`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new CredentialEnvelopeError(
+        "the native module returned a string that is not valid JSON (a double-encoded response does this)"
+      );
+    }
+    return sanitizeCredentialEnvelope(kind, parsed);
+  }
+  async function ceremonyOrMalformed(kind, requestJson, ceremonyOptions) {
+    try {
+      return await runCeremony(kind, requestJson, ceremonyOptions);
+    } catch (err) {
+      if (err instanceof CredentialEnvelopeError) {
+        return { rakomiEnvelopeViolation: err.message };
+      }
+      throw err;
+    }
+  }
+  return {
+    async isSupported() {
+      try {
+        return await mod.isPasskeySupported() === true;
+      } catch {
+        return false;
+      }
+    },
+    hasPlatformAuthenticator() {
+      return probePlatformAuthenticator(mod);
+    },
+    createCredential(creationOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "registration",
+        JSON.stringify(creationOptions),
+        ceremonyOptions
+      );
+    },
+    getCredential(requestOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "assertion",
+        JSON.stringify(requestOptions),
+        ceremonyOptions
+      );
+    }
+  };
+}
+async function probePlatformAuthenticator(mod) {
+  if (typeof mod.isPlatformAuthenticatorAvailable !== "function") return null;
+  try {
+    const available = await mod.isPlatformAuthenticatorAvailable();
+    return typeof available === "boolean" ? available : null;
+  } catch {
+    return null;
+  }
+}
+
+exports.CredentialEnvelopeError = CredentialEnvelopeError;
+exports.assertW3cCredentialEnvelope = assertW3cCredentialEnvelope;
 exports.createBareRnAdapter = createBareRnAdapter;
 exports.createDefaultExpoAdapter = createDefaultExpoAdapter;
 exports.createNativeDpopProver = createNativeDpopProver;
+exports.createNativePasskeyAdapter = createNativePasskeyAdapter;
+exports.probePlatformAuthenticator = probePlatformAuthenticator;
+exports.sanitizeCredentialEnvelope = sanitizeCredentialEnvelope;

package/dist/native/index.d.cts

@@ -1,5 +1,5 @@
-import { N as NativeAuthAdapter } from '../expo-adapter-CtPCEgue.cjs';
-export { A as AppLifecycle, n as AppStateSubscription, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as DeepLinkProvider, o as DeepLinkSubscription, j as DpopProofInput, D as DpopProver, k as NativeDpopModuleSpec, p as NetInfoSubscription, P as ParClient, S as SystemBrowser, T as TokenCache, l as createDefaultExpoAdapter, m as createNativeDpopProver } from '../expo-adapter-CtPCEgue.cjs';
+import { N as NativeAuthAdapter } from '../passkey-adapter-D_Z3Z7lV.cjs';
+export { A as AppLifecycle, r as AppStateSubscription, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as CreateNativePasskeyAdapterOptions, j as DeepLinkProvider, s as DeepLinkSubscription, k as DpopProofInput, D as DpopProver, l as NativeDpopModuleSpec, m as NativePasskeyCeremonyAdapter, n as NativePasskeyModuleSpec, t as NetInfoSubscription, P as ParClient, S as SystemBrowser, T as TokenCache, o as createDefaultExpoAdapter, p as createNativeDpopProver, q as createNativePasskeyAdapter, u as probePlatformAuthenticator } from '../passkey-adapter-D_Z3Z7lV.cjs';
 import '@rakomi/sdk-core';
 
 /**
@@ -110,4 +110,34 @@ interface CreateBareRnAdapterOptions {
 }
 declare function createBareRnAdapter(options: CreateBareRnAdapterOptions): NativeAuthAdapter;
 
-export { type CreateBareRnAdapterOptions, NativeAuthAdapter, createBareRnAdapter };
+/** Which ceremony produced this envelope. The required-set differs per direction — deliberately. */
+type CredentialEnvelopeKind = 'registration' | 'assertion';
+/** The envelope broke the W3C contract. Terminal: the module is broken, retrying changes nothing. */
+declare class CredentialEnvelopeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate a parsed native response against the W3C envelope for `kind`.
+ *
+ * Throws {@link CredentialEnvelopeError} naming the field and the violated rule — never the field's
+ * VALUE. A `PasskeyError` message reaches logs and crash reporters; a credential id and a
+ * `clientDataJSON` are durable user identifiers, so the diagnosis must be free of them.
+ */
+declare function assertW3cCredentialEnvelope(kind: CredentialEnvelopeKind, parsed: unknown): void;
+/**
+ * Validate, then **re-project** the envelope onto the members the contract knows.
+ *
+ * Validating without projecting is a check, not a boundary. The bridge used to forward the whole parsed
+ * object, and the server accepts the credential as an opaque blob — so every extra member a buggy or
+ * hostile module invented rode straight through to persistence. A `transports` that is a *string*
+ * instead of an array, or a five-thousand-element array, lands in the database and then poisons every
+ * subsequent `allowCredentials` for that user. Dropping unknown members costs nothing (the server reads
+ * none of them) and closes the class outright, instead of blacklisting the shapes we happened to think
+ * of.
+ *
+ * `Object.create(null)` for the projection, so a `"__proto__"` key that survived `JSON.parse` as an own
+ * property cannot be carried into an object with a real prototype further down.
+ */
+declare function sanitizeCredentialEnvelope(kind: CredentialEnvelopeKind, parsed: unknown): Record<string, unknown>;
+
+export { type CreateBareRnAdapterOptions, CredentialEnvelopeError, type CredentialEnvelopeKind, NativeAuthAdapter, assertW3cCredentialEnvelope, createBareRnAdapter, sanitizeCredentialEnvelope };

package/dist/native/index.d.ts

@@ -1,5 +1,5 @@
-import { N as NativeAuthAdapter } from '../expo-adapter-CtPCEgue.js';
-export { A as AppLifecycle, n as AppStateSubscription, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as DeepLinkProvider, o as DeepLinkSubscription, j as DpopProofInput, D as DpopProver, k as NativeDpopModuleSpec, p as NetInfoSubscription, P as ParClient, S as SystemBrowser, T as TokenCache, l as createDefaultExpoAdapter, m as createNativeDpopProver } from '../expo-adapter-CtPCEgue.js';
+import { N as NativeAuthAdapter } from '../passkey-adapter-D_Z3Z7lV.js';
+export { A as AppLifecycle, r as AppStateSubscription, a as AppStateValue, b as AttestationVerifier, B as BackgroundTask, c as BiometricGate, d as BiometricResult, e as BrowserAuthSessionOptions, f as BrowserAuthSessionResult, C as ConnectivityProvider, g as CreateDefaultExpoAdapterOptions, h as CreateNativeDpopProverOptions, i as CreateNativePasskeyAdapterOptions, j as DeepLinkProvider, s as DeepLinkSubscription, k as DpopProofInput, D as DpopProver, l as NativeDpopModuleSpec, m as NativePasskeyCeremonyAdapter, n as NativePasskeyModuleSpec, t as NetInfoSubscription, P as ParClient, S as SystemBrowser, T as TokenCache, o as createDefaultExpoAdapter, p as createNativeDpopProver, q as createNativePasskeyAdapter, u as probePlatformAuthenticator } from '../passkey-adapter-D_Z3Z7lV.js';
 import '@rakomi/sdk-core';
 
 /**
@@ -110,4 +110,34 @@ interface CreateBareRnAdapterOptions {
 }
 declare function createBareRnAdapter(options: CreateBareRnAdapterOptions): NativeAuthAdapter;
 
-export { type CreateBareRnAdapterOptions, NativeAuthAdapter, createBareRnAdapter };
+/** Which ceremony produced this envelope. The required-set differs per direction — deliberately. */
+type CredentialEnvelopeKind = 'registration' | 'assertion';
+/** The envelope broke the W3C contract. Terminal: the module is broken, retrying changes nothing. */
+declare class CredentialEnvelopeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate a parsed native response against the W3C envelope for `kind`.
+ *
+ * Throws {@link CredentialEnvelopeError} naming the field and the violated rule — never the field's
+ * VALUE. A `PasskeyError` message reaches logs and crash reporters; a credential id and a
+ * `clientDataJSON` are durable user identifiers, so the diagnosis must be free of them.
+ */
+declare function assertW3cCredentialEnvelope(kind: CredentialEnvelopeKind, parsed: unknown): void;
+/**
+ * Validate, then **re-project** the envelope onto the members the contract knows.
+ *
+ * Validating without projecting is a check, not a boundary. The bridge used to forward the whole parsed
+ * object, and the server accepts the credential as an opaque blob — so every extra member a buggy or
+ * hostile module invented rode straight through to persistence. A `transports` that is a *string*
+ * instead of an array, or a five-thousand-element array, lands in the database and then poisons every
+ * subsequent `allowCredentials` for that user. Dropping unknown members costs nothing (the server reads
+ * none of them) and closes the class outright, instead of blacklisting the shapes we happened to think
+ * of.
+ *
+ * `Object.create(null)` for the projection, so a `"__proto__"` key that survived `JSON.parse` as an own
+ * property cannot be carried into an object with a real prototype further down.
+ */
+declare function sanitizeCredentialEnvelope(kind: CredentialEnvelopeKind, parsed: unknown): Record<string, unknown>;
+
+export { type CreateBareRnAdapterOptions, CredentialEnvelopeError, type CredentialEnvelopeKind, NativeAuthAdapter, assertW3cCredentialEnvelope, createBareRnAdapter, sanitizeCredentialEnvelope };

package/dist/native/index.js

@@ -1,3 +1,5 @@
+import { PasskeyCeremonyError } from '@rakomi/sdk-core';
+
 // src/native/bare-rn-example.ts
 function createBareRnAdapter(options) {
   const servicePrefix = options.keychainServicePrefix ?? "rakomi";
@@ -374,4 +376,262 @@ function createNetInfoConnectivity() {
   };
 }
 
-export { createBareRnAdapter, createDefaultExpoAdapter, createNativeDpopProver };
+// src/native/passkey-envelope.ts
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var RULES = {
+  registration: {
+    required: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    base64url: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    requiredStringArray: ["response.transports"],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: [
+      "clientDataJSON",
+      "attestationObject",
+      "authenticatorData",
+      "publicKey",
+      "publicKeyAlgorithm"
+    ],
+    keepStringArrayInResponse: ["transports"]
+  },
+  assertion: {
+    required: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature"
+    ],
+    base64url: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature",
+      "response.userHandle"
+    ],
+    requiredStringArray: [],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: ["clientDataJSON", "authenticatorData", "signature", "userHandle"],
+    keepStringArrayInResponse: []
+  }
+};
+var CredentialEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialEnvelopeError";
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function readPath(envelope, path) {
+  const dot = path.indexOf(".");
+  if (dot === -1) return envelope[path];
+  const parent = envelope[path.slice(0, dot)];
+  return isRecord(parent) ? parent[path.slice(dot + 1)] : void 0;
+}
+function assertW3cCredentialEnvelope(kind, parsed) {
+  if (!isRecord(parsed)) {
+    throw new CredentialEnvelopeError(
+      `the native module returned a ${parsed === null ? "null" : typeof parsed}; the contract is a JSON object`
+    );
+  }
+  if (parsed["type"] !== "public-key") {
+    throw new CredentialEnvelopeError(`'type' must be the string "public-key" (W3C WebAuthn L3)`);
+  }
+  if (!isRecord(parsed["response"])) {
+    throw new CredentialEnvelopeError(`'response' is missing or is not an object`);
+  }
+  const rule = RULES[kind];
+  for (const path of rule.required) {
+    const value = readPath(parsed, path);
+    if (typeof value !== "string" || value.length === 0) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be a non-empty string (W3C WebAuthn L3 JSON serialization)`
+      );
+    }
+  }
+  for (const path of rule.requiredStringArray) {
+    const value = readPath(parsed, path);
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an array of strings (W3C WebAuthn L3). The server stores it and replays it into allowCredentials \u2014 omitting it silently breaks cross-device sign-in later, on another device.`
+      );
+    }
+  }
+  for (const path of rule.requiredObject) {
+    const value = readPath(parsed, path);
+    if (!isRecord(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an object (an empty object is fine)`
+      );
+    }
+  }
+  for (const path of rule.base64url) {
+    const value = readPath(parsed, path);
+    if (value === void 0 || value === null) continue;
+    if (typeof value !== "string" || !BASE64URL.test(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is not unpadded base64url (RFC 4648 \xA75). On iOS, Data.base64EncodedString() emits standard base64 (RFC 4648 \xA74, with '+', '/' and '=' padding) \u2014 use the URL-safe, unpadded variant.`
+      );
+    }
+  }
+}
+function sanitizeCredentialEnvelope(kind, parsed) {
+  assertW3cCredentialEnvelope(kind, parsed);
+  const envelope = parsed;
+  const source = envelope["response"];
+  const rule = RULES[kind];
+  const response = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keepInResponse) {
+    const value = source[key];
+    if (typeof value === "string" || typeof value === "number") response[key] = value;
+  }
+  for (const key of rule.keepStringArrayInResponse) {
+    const value = source[key];
+    if (Array.isArray(value)) response[key] = value.filter((entry) => typeof entry === "string");
+  }
+  const projected = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keep) {
+    const value = envelope[key];
+    if (value !== void 0) projected[key] = value;
+  }
+  projected["response"] = response;
+  return projected;
+}
+
+// src/native/passkey-adapter.ts
+var NATIVE_CODE_TO_KIND = Object.assign(/* @__PURE__ */ Object.create(null), {
+  PASSKEY_CANCELLED: "cancelled",
+  PASSKEY_UNSUPPORTED: "unsupported",
+  PASSKEY_NO_CREDENTIAL: "cancelled"
+});
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeNativeRejection(err) {
+  const code = isRecord2(err) ? err["code"] : void 0;
+  if (typeof code === "string") {
+    const kind = NATIVE_CODE_TO_KIND[code];
+    if (kind !== void 0) {
+      throw new PasskeyCeremonyError(kind);
+    }
+  }
+  throw err;
+}
+function assertNever(value) {
+  throw new PasskeyCeremonyError("failed", `unhandled ceremony-error kind: ${String(value)}`);
+}
+function describeKind(kind) {
+  switch (kind) {
+    case "cancelled":
+      return "the user dismissed the passkey sheet";
+    case "unsupported":
+      return "this platform cannot run a passkey ceremony";
+    case "failed":
+      return "the passkey ceremony failed";
+    default:
+      return assertNever(kind);
+  }
+}
+function createNativePasskeyAdapter(options) {
+  const mod = options.module;
+  let inFlight = null;
+  const candidate = mod;
+  const missing = ["isPasskeySupported", "createPasskey", "getPasskey"].filter(
+    (method) => typeof candidate?.[method] !== "function"
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `native passkey module is missing: ${missing.join(", ")} \u2014 it does not satisfy NativePasskeyModuleSpec`
+    );
+  }
+  async function runCeremony(kind, requestJson, ceremonyOptions) {
+    const signal = ceremonyOptions?.signal;
+    if (signal?.aborted === true) {
+      throw new PasskeyCeremonyError("cancelled", describeKind("cancelled"));
+    }
+    const ticket = /* @__PURE__ */ Symbol("passkey-ceremony");
+    inFlight = ticket;
+    const onAbort = () => {
+      if (inFlight !== ticket) return;
+      try {
+        void Promise.resolve(mod.cancelPasskeyRequest?.()).catch(() => void 0);
+      } catch {
+      }
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    let raw;
+    try {
+      raw = await (kind === "registration" ? mod.createPasskey(requestJson) : mod.getPasskey(requestJson));
+    } catch (err) {
+      normalizeNativeRejection(err);
+    } finally {
+      signal?.removeEventListener("abort", onAbort);
+      if (inFlight === ticket) inFlight = null;
+    }
+    if (typeof raw !== "string") {
+      throw new CredentialEnvelopeError(
+        `the native module returned ${raw === null ? "null" : `a ${typeof raw}`}; the contract is a JSON string \u2014 wrap a module with an object API so it stringifies its argument and its result`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new CredentialEnvelopeError(
+        "the native module returned a string that is not valid JSON (a double-encoded response does this)"
+      );
+    }
+    return sanitizeCredentialEnvelope(kind, parsed);
+  }
+  async function ceremonyOrMalformed(kind, requestJson, ceremonyOptions) {
+    try {
+      return await runCeremony(kind, requestJson, ceremonyOptions);
+    } catch (err) {
+      if (err instanceof CredentialEnvelopeError) {
+        return { rakomiEnvelopeViolation: err.message };
+      }
+      throw err;
+    }
+  }
+  return {
+    async isSupported() {
+      try {
+        return await mod.isPasskeySupported() === true;
+      } catch {
+        return false;
+      }
+    },
+    hasPlatformAuthenticator() {
+      return probePlatformAuthenticator(mod);
+    },
+    createCredential(creationOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "registration",
+        JSON.stringify(creationOptions),
+        ceremonyOptions
+      );
+    },
+    getCredential(requestOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "assertion",
+        JSON.stringify(requestOptions),
+        ceremonyOptions
+      );
+    }
+  };
+}
+async function probePlatformAuthenticator(mod) {
+  if (typeof mod.isPlatformAuthenticatorAvailable !== "function") return null;
+  try {
+    const available = await mod.isPlatformAuthenticatorAvailable();
+    return typeof available === "boolean" ? available : null;
+  } catch {
+    return null;
+  }
+}
+
+export { CredentialEnvelopeError, assertW3cCredentialEnvelope, createBareRnAdapter, createDefaultExpoAdapter, createNativeDpopProver, createNativePasskeyAdapter, probePlatformAuthenticator, sanitizeCredentialEnvelope };