@rakomi/react-native 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import { createContext, useMemo, useReducer, useEffect, useRef, useState, useContext } from 'react';
-import { EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, decodeUser, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken } from '@rakomi/sdk-core';
-export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createTranslator, decodeJwtPayload, decodeSession, decodeUser, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
+import { createContext, useMemo, useReducer, useRef, useEffect, useState, useCallback, useContext } from 'react';
+import { createAuthorizationEndpointCache, EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, extractOrgClaims, parseAuthConfigResponse, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, passkeyError, decodeUser, assertPasskey, stepUpWithPasskey, registerPasskey, listPasskeys, renamePasskey, deletePasskey, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken, decodeJwtPayload, PasskeyCeremonyError } from '@rakomi/sdk-core';
+export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createAuthorizationEndpointCache, createTranslator, decodeJwtPayload, decodeSession, decodeUser, deriveAuthorizationEndpointFallback, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
 import { jwtVerify } from 'jose';
 import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
 
@@ -11,6 +11,24 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 
+// src/internal/ceremony-lock.ts
+function createCeremonyLock() {
+  let held = false;
+  return {
+    tryAcquire() {
+      if (held) return false;
+      held = true;
+      return true;
+    },
+    release() {
+      held = false;
+    },
+    get held() {
+      return held;
+    }
+  };
+}
+
 // src/internal/canonical-url.ts
 var CanonicalizeUrlError = class extends Error {
   constructor(code, message) {
@@ -116,6 +134,37 @@ function createDpopSession(options) {
   return new DpopSession(options);
 }
 
+// src/internal/compose-signals.ts
+function composeSignals(caller, internal) {
+  if (caller === void 0) {
+    return { signal: internal, dispose: () => void 0 };
+  }
+  const controller = new AbortController();
+  const abort = (reason) => {
+    if (!controller.signal.aborted) controller.abort(reason);
+  };
+  const onCaller = () => abort(caller.reason);
+  const onInternal = () => abort(internal.reason);
+  if (caller.aborted) {
+    abort(caller.reason);
+  } else if (internal.aborted) {
+    abort(internal.reason);
+  } else {
+    caller.addEventListener("abort", onCaller, { once: true });
+    internal.addEventListener("abort", onInternal, { once: true });
+  }
+  let disposed = false;
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      if (disposed) return;
+      disposed = true;
+      caller.removeEventListener("abort", onCaller);
+      internal.removeEventListener("abort", onInternal);
+    }
+  };
+}
+
 // src/internal/http-client.ts
 function createRnHttpClient(options = {}) {
   const baseUrl = options.baseUrl?.replace(/\/$/, "") ?? "";
@@ -124,18 +173,41 @@ function createRnHttpClient(options = {}) {
     fetch: async (url, init = {}) => {
       const fullUrl = url.startsWith("http://") || url.startsWith("https://") ? url : `${baseUrl}${url.startsWith("/") ? "" : "/"}${url}`;
       const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), timeout);
+      const timedOut = Object.assign(new Error("request timed out"), { name: "TimeoutError" });
+      const timer = setTimeout(() => controller.abort(timedOut), timeout);
+      const composed = composeSignals(init.signal, controller.signal);
+      let response;
       try {
-        return await fetch(fullUrl, {
+        response = await fetch(fullUrl, {
           method: init.method ?? "GET",
           headers: init.headers,
           body: init.body,
           redirect: "error",
-          signal: init.signal ?? controller.signal
+          signal: composed.signal
         });
-      } finally {
+      } catch (err2) {
         clearTimeout(timer);
+        composed.dispose();
+        throw err2;
+      }
+      clearTimeout(timer);
+      const body = response.body;
+      const streaming = body !== null && body !== void 0 && typeof body.pipeThrough === "function" && typeof TransformStream !== "undefined";
+      if (!streaming) {
+        composed.dispose();
+        return response;
       }
+      const release = new TransformStream({
+        flush: () => composed.dispose()
+      });
+      const piped = body.pipeThrough(release);
+      const wrapped = new Response(piped, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+      composed.signal.addEventListener("abort", () => composed.dispose(), { once: true });
+      return wrapped;
     }
   };
 }
@@ -224,8 +296,8 @@ function deriveDefaultJwksUri(tokenEndpoint) {
     return tokenEndpoint.replace(/\/[^/]*$/, "") + "/.well-known/jwks.json";
   }
 }
-var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://rakomi.com";
-var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://rakomi.com";
+var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://api.rakomi.com";
+var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://api.rakomi.com";
 function deriveDefaultIssuer(_tokenEndpoint) {
   return RAKOMI_PLATFORM_ISSUER_DEFAULT;
 }
@@ -940,8 +1012,24 @@ function RakomiProvider(props) {
     return Object.freeze(built);
   }, [props.nativeAdapter, props.tokenCache]);
   const http = useMemo(() => createRnHttpClient({ baseUrl: props.baseUrl }), [props.baseUrl]);
+  const authorizationEndpointCache = useMemo(
+    () => createAuthorizationEndpointCache({
+      fetchDiscoveryDocument: async () => {
+        const response = await http.fetch("/.well-known/openid-configuration", {
+          method: "GET",
+          headers: { Accept: "application/json" }
+        });
+        if (!response.ok) {
+          throw new Error(`discovery fetch failed: HTTP ${response.status}`);
+        }
+        return response.json();
+      }
+    }),
+    [http]
+  );
   const events = useMemo(() => new EventLog(props.onEvent), [props.onEvent]);
   const [snapshot, dispatch] = useReducer(reduce, INITIAL_SNAPSHOT);
+  const passkeyCeremonyLock = useRef(createCeremonyLock()).current;
   const translate = useMemo(
     () => createTranslator(props.locale ?? "en", props.translations),
     [props.locale, props.translations]
@@ -1074,6 +1162,7 @@ function RakomiProvider(props) {
       redirectUri: props.redirectUri,
       adapter,
       http,
+      authorizationEndpointCache,
       snapshot,
       state: snapshot.state,
       isSignedIn: isSignedIn(snapshot),
@@ -1085,10 +1174,11 @@ function RakomiProvider(props) {
       signOut,
       getToken,
       submitOAuthTokens,
+      passkeyCeremonyLock,
       beginAuthFlow,
       dpopSession
     }),
-    [adapter, http, snapshot, events, props.publishableKey, props.baseUrl, props.redirectUri, props.locale, translate, signOut, getToken, submitOAuthTokens, beginAuthFlow, dpopSession]
+    [adapter, http, authorizationEndpointCache, snapshot, events, props.publishableKey, props.baseUrl, props.redirectUri, props.locale, translate, signOut, getToken, submitOAuthTokens, beginAuthFlow, dpopSession, passkeyCeremonyLock]
   );
   return /* @__PURE__ */ jsx(RakomiContext.Provider, { value, children: props.children });
 }
@@ -1202,19 +1292,20 @@ function useFlag(flag, options) {
 }
 function useOrganization() {
   const { user } = useRakomiContext();
-  const orgId = user?.rawClaims["org_id"];
-  const orgRole = user?.rawClaims["org_role"];
-  const orgMemberships = user?.rawClaims["org_memberships"] ?? [];
+  const { org_id: orgId, org_role: orgRole, org_memberships: orgMemberships } = extractOrgClaims(
+    user?.rawClaims ?? {}
+  );
   return {
     isLoaded: !!user,
-    organization: orgId && orgRole ? { orgId, orgRole, orgMemberships } : null
+    organization: orgId && orgRole ? { orgId, orgRole, orgMemberships: orgMemberships ?? [] } : null
   };
 }
 function useOrganizationList() {
   const { user } = useRakomiContext();
+  const { org_memberships: organizations } = extractOrgClaims(user?.rawClaims ?? {});
   return {
     isLoaded: !!user,
-    organizations: user?.rawClaims["org_memberships"] ?? []
+    organizations: organizations ?? []
   };
 }
 function useLinkedAccounts() {
@@ -1248,7 +1339,8 @@ function useAuthConfig() {
             headers: { Accept: "application/json", "X-API-Key": publishableKey }
           });
           if (!response.ok) return null;
-          return await response.json();
+          const raw = await response.json();
+          return parseAuthConfigResponse(raw, baseUrl);
         } catch {
           return null;
         }
@@ -1544,13 +1636,23 @@ function SignIn(props) {
   const [code, setCode] = useState("");
   const [busy, setBusy] = useState(false);
   const tokenEndpoint = props.tokenEndpoint ?? "/v1/auth/oauth/callback";
-  const authorizationEndpoint = props.authorizationEndpoint ?? "/oauth/authorize";
   const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/totp/verify";
   const providers = props.providers ?? ["google"];
   async function onProviderPress(provider) {
     if (busy) return;
     setBusy(true);
     ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { provider } });
+    let authorizationEndpoint = props.authorizationEndpoint;
+    if (!authorizationEndpoint) {
+      const resolved = await ctx.authorizationEndpointCache.resolve(ctx.baseUrl);
+      if (!resolved.ok) {
+        ctx.events.push({ type: "sign_in_failed", severity: "warning", error: resolved.error });
+        setStep({ kind: "error", error: resolved.error });
+        setBusy(false);
+        return;
+      }
+      authorizationEndpoint = resolved.authorizationEndpoint;
+    }
     const outcome = await startSocialSignIn({
       adapter: ctx.adapter,
       http: ctx.http,
@@ -1756,7 +1858,7 @@ function UserButton(props) {
 function UserProfile(props) {
   useEffect(() => {
     if (typeof __DEV__ !== "undefined" && __DEV__) {
-      console.warn("[@rakomi/react-native] <UserProfile /> is in preview until 0.2.0 \u2014 feedback welcome.");
+      console.warn("[@rakomi/react-native] <UserProfile /> is in preview \u2014 feedback welcome.");
     }
   }, []);
   const ctx = useRakomiContext();
@@ -1804,6 +1906,264 @@ function createNativeDpopProver(options) {
   };
 }
 
+// src/native/passkey-envelope.ts
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var RULES = {
+  registration: {
+    required: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    base64url: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    requiredStringArray: ["response.transports"],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: [
+      "clientDataJSON",
+      "attestationObject",
+      "authenticatorData",
+      "publicKey",
+      "publicKeyAlgorithm"
+    ],
+    keepStringArrayInResponse: ["transports"]
+  },
+  assertion: {
+    required: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature"
+    ],
+    base64url: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature",
+      "response.userHandle"
+    ],
+    requiredStringArray: [],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: ["clientDataJSON", "authenticatorData", "signature", "userHandle"],
+    keepStringArrayInResponse: []
+  }
+};
+var CredentialEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialEnvelopeError";
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function readPath(envelope, path) {
+  const dot = path.indexOf(".");
+  if (dot === -1) return envelope[path];
+  const parent = envelope[path.slice(0, dot)];
+  return isRecord(parent) ? parent[path.slice(dot + 1)] : void 0;
+}
+function assertW3cCredentialEnvelope(kind, parsed) {
+  if (!isRecord(parsed)) {
+    throw new CredentialEnvelopeError(
+      `the native module returned a ${parsed === null ? "null" : typeof parsed}; the contract is a JSON object`
+    );
+  }
+  if (parsed["type"] !== "public-key") {
+    throw new CredentialEnvelopeError(`'type' must be the string "public-key" (W3C WebAuthn L3)`);
+  }
+  if (!isRecord(parsed["response"])) {
+    throw new CredentialEnvelopeError(`'response' is missing or is not an object`);
+  }
+  const rule = RULES[kind];
+  for (const path of rule.required) {
+    const value = readPath(parsed, path);
+    if (typeof value !== "string" || value.length === 0) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be a non-empty string (W3C WebAuthn L3 JSON serialization)`
+      );
+    }
+  }
+  for (const path of rule.requiredStringArray) {
+    const value = readPath(parsed, path);
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an array of strings (W3C WebAuthn L3). The server stores it and replays it into allowCredentials \u2014 omitting it silently breaks cross-device sign-in later, on another device.`
+      );
+    }
+  }
+  for (const path of rule.requiredObject) {
+    const value = readPath(parsed, path);
+    if (!isRecord(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an object (an empty object is fine)`
+      );
+    }
+  }
+  for (const path of rule.base64url) {
+    const value = readPath(parsed, path);
+    if (value === void 0 || value === null) continue;
+    if (typeof value !== "string" || !BASE64URL.test(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is not unpadded base64url (RFC 4648 \xA75). On iOS, Data.base64EncodedString() emits standard base64 (RFC 4648 \xA74, with '+', '/' and '=' padding) \u2014 use the URL-safe, unpadded variant.`
+      );
+    }
+  }
+}
+function sanitizeCredentialEnvelope(kind, parsed) {
+  assertW3cCredentialEnvelope(kind, parsed);
+  const envelope = parsed;
+  const source = envelope["response"];
+  const rule = RULES[kind];
+  const response = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keepInResponse) {
+    const value = source[key];
+    if (typeof value === "string" || typeof value === "number") response[key] = value;
+  }
+  for (const key of rule.keepStringArrayInResponse) {
+    const value = source[key];
+    if (Array.isArray(value)) response[key] = value.filter((entry) => typeof entry === "string");
+  }
+  const projected = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keep) {
+    const value = envelope[key];
+    if (value !== void 0) projected[key] = value;
+  }
+  projected["response"] = response;
+  return projected;
+}
+
+// src/native/passkey-adapter.ts
+var NATIVE_CODE_TO_KIND = Object.assign(/* @__PURE__ */ Object.create(null), {
+  PASSKEY_CANCELLED: "cancelled",
+  PASSKEY_UNSUPPORTED: "unsupported",
+  PASSKEY_NO_CREDENTIAL: "cancelled"
+});
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeNativeRejection(err2) {
+  const code = isRecord2(err2) ? err2["code"] : void 0;
+  if (typeof code === "string") {
+    const kind = NATIVE_CODE_TO_KIND[code];
+    if (kind !== void 0) {
+      throw new PasskeyCeremonyError(kind);
+    }
+  }
+  throw err2;
+}
+function assertNever(value) {
+  throw new PasskeyCeremonyError("failed", `unhandled ceremony-error kind: ${String(value)}`);
+}
+function describeKind(kind) {
+  switch (kind) {
+    case "cancelled":
+      return "the user dismissed the passkey sheet";
+    case "unsupported":
+      return "this platform cannot run a passkey ceremony";
+    case "failed":
+      return "the passkey ceremony failed";
+    default:
+      return assertNever(kind);
+  }
+}
+function createNativePasskeyAdapter(options) {
+  const mod = options.module;
+  let inFlight = null;
+  const candidate = mod;
+  const missing = ["isPasskeySupported", "createPasskey", "getPasskey"].filter(
+    (method) => typeof candidate?.[method] !== "function"
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `native passkey module is missing: ${missing.join(", ")} \u2014 it does not satisfy NativePasskeyModuleSpec`
+    );
+  }
+  async function runCeremony(kind, requestJson, ceremonyOptions) {
+    const signal = ceremonyOptions?.signal;
+    if (signal?.aborted === true) {
+      throw new PasskeyCeremonyError("cancelled", describeKind("cancelled"));
+    }
+    const ticket = /* @__PURE__ */ Symbol("passkey-ceremony");
+    inFlight = ticket;
+    const onAbort = () => {
+      if (inFlight !== ticket) return;
+      try {
+        void Promise.resolve(mod.cancelPasskeyRequest?.()).catch(() => void 0);
+      } catch {
+      }
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    let raw;
+    try {
+      raw = await (kind === "registration" ? mod.createPasskey(requestJson) : mod.getPasskey(requestJson));
+    } catch (err2) {
+      normalizeNativeRejection(err2);
+    } finally {
+      signal?.removeEventListener("abort", onAbort);
+      if (inFlight === ticket) inFlight = null;
+    }
+    if (typeof raw !== "string") {
+      throw new CredentialEnvelopeError(
+        `the native module returned ${raw === null ? "null" : `a ${typeof raw}`}; the contract is a JSON string \u2014 wrap a module with an object API so it stringifies its argument and its result`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new CredentialEnvelopeError(
+        "the native module returned a string that is not valid JSON (a double-encoded response does this)"
+      );
+    }
+    return sanitizeCredentialEnvelope(kind, parsed);
+  }
+  async function ceremonyOrMalformed(kind, requestJson, ceremonyOptions) {
+    try {
+      return await runCeremony(kind, requestJson, ceremonyOptions);
+    } catch (err2) {
+      if (err2 instanceof CredentialEnvelopeError) {
+        return { rakomiEnvelopeViolation: err2.message };
+      }
+      throw err2;
+    }
+  }
+  return {
+    async isSupported() {
+      try {
+        return await mod.isPasskeySupported() === true;
+      } catch {
+        return false;
+      }
+    },
+    hasPlatformAuthenticator() {
+      return probePlatformAuthenticator(mod);
+    },
+    createCredential(creationOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "registration",
+        JSON.stringify(creationOptions),
+        ceremonyOptions
+      );
+    },
+    getCredential(requestOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "assertion",
+        JSON.stringify(requestOptions),
+        ceremonyOptions
+      );
+    }
+  };
+}
+async function probePlatformAuthenticator(mod) {
+  if (typeof mod.isPlatformAuthenticatorAvailable !== "function") return null;
+  try {
+    const available = await mod.isPlatformAuthenticatorAvailable();
+    return typeof available === "boolean" ? available : null;
+  } catch {
+    return null;
+  }
+}
+
 // src/internal/webhook-verify.ts
 var RKSEC_PREFIX = "rksec_";
 var EXPECTED_KEY_LENGTH = 32;
@@ -1919,6 +2279,349 @@ async function verifyPublisherWebhook(body, headers, secret, tolerance = DEFAULT
   const clamped = Math.min(Math.max(0, tolerance), MAX_WEBHOOK_TOLERANCE);
   return verifyWebhook(body, headers, secret, clamped);
 }
+var CEREMONY_ACTIONS = /* @__PURE__ */ new Set(["signIn", "register", "stepUp"]);
+function platformProbe(adapter) {
+  const candidate = adapter.hasPlatformAuthenticator;
+  return typeof candidate === "function" ? candidate.bind(adapter) : void 0;
+}
+function sessionIdentity(token) {
+  const payload = decodeJwtPayload(token);
+  if (payload === null) return null;
+  const subject = payload["sub"];
+  const session = payload["sid"];
+  if (typeof subject !== "string" || !subject) return null;
+  if (typeof session !== "string" || !session) return null;
+  return { subject, session };
+}
+var notSupported = () => passkeyError(
+  "PASSKEY_NOT_SUPPORTED",
+  "no passkey ceremony adapter is wired: pass one on `nativeAdapter.passkeys` (see createNativePasskeyAdapter)"
+);
+function usePasskeys(options = {}) {
+  const ctx = useRakomiContext();
+  const {
+    adapter: nativeAdapter,
+    http,
+    baseUrl,
+    publishableKey,
+    getToken,
+    beginAuthFlow,
+    submitOAuthTokens,
+    passkeyCeremonyLock
+  } = ctx;
+  const [isSupported, setIsSupported] = useState(null);
+  const [hasPlatformAuthenticator, setHasPlatformAuthenticator] = useState(null);
+  const [passkeys, setPasskeys] = useState(void 0);
+  const [error, setError] = useState(null);
+  const [isSigningIn, setIsSigningIn] = useState(false);
+  const [isRegistering, setIsRegistering] = useState(false);
+  const [isSteppingUp, setIsSteppingUp] = useState(false);
+  const [isLoading, setIsLoading] = useState(false);
+  const [isMutating, setIsMutating] = useState(false);
+  const adapter = options.adapter ?? nativeAdapter.passkeys;
+  const mountedRef = useRef(true);
+  const busyRef = useRef({
+    signIn: false,
+    register: false,
+    stepUp: false,
+    list: false,
+    mutate: false
+  });
+  const inFlightRef = useRef(/* @__PURE__ */ new Set());
+  useEffect(() => {
+    mountedRef.current = true;
+    const inFlight = inFlightRef.current;
+    return () => {
+      mountedRef.current = false;
+      for (const controller of inFlight) controller.abort();
+      inFlight.clear();
+    };
+  }, []);
+  useEffect(() => {
+    if (adapter === void 0) {
+      setIsSupported(false);
+      setHasPlatformAuthenticator(null);
+      return;
+    }
+    let cancelled = false;
+    void (async () => {
+      const [supported, platform] = await Promise.all([
+        Promise.resolve(adapter.isSupported()).catch(() => false),
+        Promise.resolve(platformProbe(adapter)?.() ?? null).catch(() => null)
+      ]);
+      if (cancelled || !mountedRef.current) return;
+      setIsSupported(supported === true);
+      setHasPlatformAuthenticator(typeof platform === "boolean" ? platform : null);
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [adapter]);
+  const setBusy = useCallback((key, value) => {
+    busyRef.current[key] = value;
+    if (key === "signIn") setIsSigningIn(value);
+    else if (key === "register") setIsRegistering(value);
+    else if (key === "stepUp") setIsSteppingUp(value);
+    else if (key === "list") setIsLoading(value);
+    else setIsMutating(value);
+  }, []);
+  const requireSession = useCallback(async () => {
+    const expired = () => passkeyError("PASSKEY_SESSION_EXPIRED", "you must be signed in to manage passkeys");
+    const token = await getToken();
+    if (!token.ok) {
+      const err2 = token.error;
+      if (err2.code === "NETWORK_ERROR" || err2.code === "REFRESH_FAILED" && err2.reason === "network") {
+        return passkeyError("PASSKEY_NETWORK_ERROR", err2.message);
+      }
+      return expired();
+    }
+    const user = decodeUser(token.token);
+    if (user === null) return expired();
+    return { accessToken: token.token, userId: user.id };
+  }, [getToken]);
+  const runAction = useCallback(
+    async (key, guarded, run, onSuccess) => {
+      const refuse = (result) => {
+        if (!result.ok && mountedRef.current) setError(result.error);
+        return result;
+      };
+      if (busyRef.current[key]) return refuse(guarded);
+      const isCeremony = CEREMONY_ACTIONS.has(key);
+      if (isCeremony && !passkeyCeremonyLock.tryAcquire()) return refuse(guarded);
+      setBusy(key, true);
+      setError(null);
+      const controller = new AbortController();
+      inFlightRef.current.add(controller);
+      try {
+        const result = await run(controller.signal);
+        if (!result.ok && mountedRef.current) setError(result.error);
+        if (result.ok && mountedRef.current) onSuccess?.(result);
+        return result;
+      } finally {
+        inFlightRef.current.delete(controller);
+        busyRef.current[key] = false;
+        if (isCeremony) passkeyCeremonyLock.release();
+        if (mountedRef.current) setBusy(key, false);
+      }
+    },
+    [passkeyCeremonyLock, setBusy]
+  );
+  const busyResult = useCallback(
+    (action) => ({
+      ok: false,
+      error: passkeyError("PASSKEY_INVALID_INPUT", `a passkey ${action} is already in progress`)
+    }),
+    []
+  );
+  const unsupported = useCallback(() => {
+    const result = { ok: false, error: notSupported() };
+    if (mountedRef.current) setError(result.error);
+    return Promise.resolve(result);
+  }, []);
+  const sessionFailure = (session) => !("accessToken" in session);
+  const signInWithPasskey = useCallback(
+    (input = {}) => {
+      if (adapter === void 0) return unsupported();
+      return runAction("signIn", busyResult("sign-in"), async (signal) => {
+        const result = await assertPasskey({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          adapter,
+          ...input.userHandle === void 0 ? {} : { userHandle: input.userHandle },
+          signal
+        });
+        if (!result.ok) return result;
+        const failed = (message) => ({
+          ok: false,
+          error: passkeyError("PASSKEY_REQUEST_FAILED", message)
+        });
+        let nonce;
+        try {
+          nonce = await beginAuthFlow();
+        } catch (err2) {
+          return failed(
+            `the passkey was accepted but the session could not be started: ${err2 instanceof Error ? err2.message : "unknown error"}`
+          );
+        }
+        const tokens = result.tokens;
+        if (nativeAdapter.dpopProver !== void 0 && tokens.token_type !== "DPoP") {
+          return failed(
+            "the passkey was accepted but the session was refused: this app is configured for sender-constrained (DPoP) sessions, and the passkey sign-in returned an unbound bearer session. Storing it would silently downgrade the app\u2019s security posture."
+          );
+        }
+        try {
+          await submitOAuthTokens(tokens, nonce);
+        } catch (err2) {
+          return failed(
+            `the passkey was accepted but the session could not be stored: ${err2 instanceof Error ? err2.message : "unknown error"}`
+          );
+        }
+        const confirmed = await getToken();
+        if (!confirmed.ok) {
+          return failed(
+            "the passkey was accepted but the session was not established (the token submission was rejected)"
+          );
+        }
+        const submitted = sessionIdentity(tokens.access_token);
+        const live = sessionIdentity(confirmed.token);
+        if (submitted === null || live === null) {
+          if (confirmed.token !== tokens.access_token) {
+            return failed("the passkey was accepted but the resulting session token could not be read");
+          }
+          return result;
+        }
+        if (live.subject !== submitted.subject || live.session !== submitted.session) {
+          return failed(
+            "the passkey was accepted but the session was not established (the token submission was rejected)"
+          );
+        }
+        return result;
+      });
+    },
+    [
+      adapter,
+      baseUrl,
+      beginAuthFlow,
+      busyResult,
+      getToken,
+      http,
+      publishableKey,
+      runAction,
+      submitOAuthTokens,
+      unsupported
+    ]
+  );
+  const stepUpWithPasskey$1 = useCallback(() => {
+    if (adapter === void 0) return unsupported();
+    return runAction("stepUp", busyResult("step-up"), async (signal) => {
+      const session = await requireSession();
+      if (sessionFailure(session)) return { ok: false, error: session };
+      return stepUpWithPasskey({
+        http,
+        baseUrl,
+        clientId: publishableKey,
+        accessToken: session.accessToken,
+        adapter,
+        signal
+      });
+    });
+  }, [adapter, baseUrl, busyResult, http, publishableKey, requireSession, runAction, unsupported]);
+  const registerPasskey$1 = useCallback(
+    (input) => {
+      if (adapter === void 0) return unsupported();
+      return runAction("register", busyResult("registration"), async (signal) => {
+        const session = await requireSession();
+        if (sessionFailure(session)) return { ok: false, error: session };
+        return registerPasskey({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          accessToken: session.accessToken,
+          stepUpToken: input.stepUpToken,
+          adapter,
+          ...input.nickname === void 0 ? {} : { nickname: input.nickname },
+          signal
+        });
+      });
+    },
+    [adapter, baseUrl, busyResult, http, publishableKey, requireSession, runAction, unsupported]
+  );
+  const listPasskeys$1 = useCallback(
+    (input) => runAction(
+      "list",
+      busyResult("list"),
+      async (signal) => {
+        const session = await requireSession();
+        if (sessionFailure(session)) return { ok: false, error: session };
+        return listPasskeys({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          accessToken: session.accessToken,
+          stepUpToken: input.stepUpToken,
+          userId: session.userId,
+          signal
+        });
+      },
+      (result) => {
+        if (result.ok) setPasskeys(result.data);
+      }
+    ),
+    [baseUrl, busyResult, http, publishableKey, requireSession, runAction]
+  );
+  const renamePasskey$1 = useCallback(
+    (input) => runAction(
+      "mutate",
+      busyResult("mutation"),
+      async (signal) => {
+        const session = await requireSession();
+        if (sessionFailure(session)) return { ok: false, error: session };
+        return renamePasskey({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          accessToken: session.accessToken,
+          stepUpToken: input.stepUpToken,
+          userId: session.userId,
+          passkeyId: input.passkeyId,
+          nickname: input.nickname,
+          signal
+        });
+      },
+      (result) => {
+        if (!result.ok) return;
+        setPasskeys(
+          (current) => current?.map((passkey) => passkey.id === result.passkey.id ? result.passkey : passkey)
+        );
+      }
+    ),
+    [baseUrl, busyResult, http, publishableKey, requireSession, runAction]
+  );
+  const deletePasskey$1 = useCallback(
+    (input) => runAction(
+      "mutate",
+      busyResult("mutation"),
+      async (signal) => {
+        const session = await requireSession();
+        if (sessionFailure(session)) return { ok: false, error: session };
+        return deletePasskey({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          accessToken: session.accessToken,
+          stepUpToken: input.stepUpToken,
+          userId: session.userId,
+          passkeyId: input.passkeyId,
+          signal
+        });
+      },
+      (result) => {
+        if (result.ok) {
+          setPasskeys((current) => current?.filter((passkey) => passkey.id !== input.passkeyId));
+        }
+      }
+    ),
+    [baseUrl, busyResult, http, publishableKey, requireSession, runAction]
+  );
+  return {
+    isSupported,
+    hasPlatformAuthenticator,
+    passkeys,
+    error,
+    isSigningIn,
+    isRegistering,
+    isSteppingUp,
+    isLoading,
+    isMutating,
+    signInWithPasskey,
+    stepUpWithPasskey: stepUpWithPasskey$1,
+    registerPasskey: registerPasskey$1,
+    listPasskeys: listPasskeys$1,
+    renamePasskey: renamePasskey$1,
+    deletePasskey: deletePasskey$1
+  };
+}
 
 // src/hooks/use-submit-oauth-tokens.ts
 function useSubmitOAuthTokens() {
@@ -2001,4 +2704,4 @@ function useMfa() {
   };
 }
 
-export { DEFAULT_WEBHOOK_TOLERANCE, DpopSession, Feature, MAX_WEBHOOK_TOLERANCE, Protect, RakomiProvider, SignIn, SignUp, SignedIn, SignedOut, UserButton, UserProfile, createDefaultExpoAdapter, createDpopSession, createNativeDpopProver, createRnHttpClient, startSocialSignIn, useAnonymousSignin, useAuth, useAuthConfig, useBaasPlans, useBaasSubscription, useBranding, useEmailOtp, useFlag, useLinkedAccounts, useMagicLink, useMfa, useOrganization, useOrganizationList, useRegister, useSession, useSubmitOAuthTokens, useTranslation, useUser, verifyPublisherWebhook, verifyWebhook };
+export { DEFAULT_WEBHOOK_TOLERANCE, DpopSession, Feature, MAX_WEBHOOK_TOLERANCE, Protect, RakomiProvider, SignIn, SignUp, SignedIn, SignedOut, UserButton, UserProfile, createDefaultExpoAdapter, createDpopSession, createNativeDpopProver, createNativePasskeyAdapter, createRnHttpClient, startSocialSignIn, useAnonymousSignin, useAuth, useAuthConfig, useBaasPlans, useBaasSubscription, useBranding, useEmailOtp, useFlag, useLinkedAccounts, useMagicLink, useMfa, useOrganization, useOrganizationList, usePasskeys, useRegister, useSession, useSubmitOAuthTokens, useTranslation, useUser, verifyPublisherWebhook, verifyWebhook };