@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/esm/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.js

@@ -1,6 +1,10 @@
-import { __esm } from "../../../_virtual/rolldown_runtime.js";
-
 //#region src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts
+const WebAuthnBridgeMessage = {
+	Create: "WALLET_WEBAUTHN_CREATE",
+	Get: "WALLET_WEBAUTHN_GET",
+	CreateResult: "WALLET_WEBAUTHN_CREATE_RESULT",
+	GetResult: "WALLET_WEBAUTHN_GET_RESULT"
+};
 function getResultTypeFor(kind) {
 	return kind === WebAuthnBridgeMessage.Get ? WebAuthnBridgeMessage.GetResult : WebAuthnBridgeMessage.CreateResult;
 }
@@ -103,6 +107,54 @@ async function requestParentDomainWebAuthn(kind, publicKey, client, timeoutMs) {
 	if (kind === "create") return client.request(WebAuthnBridgeMessage.Create, publicKey, timeoutMs);
 	return client.request(WebAuthnBridgeMessage.Get, publicKey, timeoutMs);
 }
+var WindowParentDomainWebAuthnClient = class {
+	async request(kind, publicKey, timeoutMs = 6e4) {
+		const requestId = `${kind}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
+		const resultType = getResultTypeFor(kind);
+		return new Promise((resolve) => {
+			let settled = false;
+			const finish = (val) => {
+				if (!settled) {
+					settled = true;
+					resolve(val);
+				}
+			};
+			const onMessage = (ev) => {
+				const payload = ev?.data;
+				if (!payload || typeof payload.type !== "string") return;
+				const t = payload.type;
+				if (t !== resultType) return;
+				const rid = payload.requestId;
+				if (rid !== requestId) return;
+				window.removeEventListener("message", onMessage);
+				const ok = !!payload.ok;
+				const cred = payload.credential;
+				const err = payload.error;
+				if (ok && cred) return finish({
+					ok: true,
+					credential: cred
+				});
+				return finish({
+					ok: false,
+					error: typeof err === "string" ? err : void 0
+				});
+			};
+			window.addEventListener("message", onMessage);
+			window.parent?.postMessage({
+				type: kind,
+				requestId,
+				publicKey
+			}, "*");
+			setTimeout(() => {
+				window.removeEventListener("message", onMessage);
+				finish({
+					ok: false,
+					timeout: true
+				});
+			}, timeoutMs);
+		});
+	}
+};
 function notAllowedError(message) {
 	const e = new Error(message);
 	e.name = "NotAllowedError";
@@ -139,65 +191,7 @@ async function attemptRefocus(maxRetries = 2, delays = [50, 120]) {
 	}
 	return document.hasFocus();
 }
-var WebAuthnBridgeMessage, WindowParentDomainWebAuthnClient;
-var init_safari_fallbacks = __esm({ "src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts": (() => {
-	WebAuthnBridgeMessage = {
-		Create: "WALLET_WEBAUTHN_CREATE",
-		Get: "WALLET_WEBAUTHN_GET",
-		CreateResult: "WALLET_WEBAUTHN_CREATE_RESULT",
-		GetResult: "WALLET_WEBAUTHN_GET_RESULT"
-	};
-	WindowParentDomainWebAuthnClient = class {
-		async request(kind, publicKey, timeoutMs = 6e4) {
-			const requestId = `${kind}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
-			const resultType = getResultTypeFor(kind);
-			return new Promise((resolve) => {
-				let settled = false;
-				const finish = (val) => {
-					if (!settled) {
-						settled = true;
-						resolve(val);
-					}
-				};
-				const onMessage = (ev) => {
-					const payload = ev?.data;
-					if (!payload || typeof payload.type !== "string") return;
-					const t = payload.type;
-					if (t !== resultType) return;
-					const rid = payload.requestId;
-					if (rid !== requestId) return;
-					window.removeEventListener("message", onMessage);
-					const ok = !!payload.ok;
-					const cred = payload.credential;
-					const err = payload.error;
-					if (ok && cred) return finish({
-						ok: true,
-						credential: cred
-					});
-					return finish({
-						ok: false,
-						error: typeof err === "string" ? err : void 0
-					});
-				};
-				window.addEventListener("message", onMessage);
-				window.parent?.postMessage({
-					type: kind,
-					requestId,
-					publicKey
-				}, "*");
-				setTimeout(() => {
-					window.removeEventListener("message", onMessage);
-					finish({
-						ok: false,
-						timeout: true
-					});
-				}, timeoutMs);
-			});
-		}
-	};
-}) });
 
 //#endregion
-init_safari_fallbacks();
-export { WebAuthnBridgeMessage, executeWebAuthnWithParentFallbacksSafari, init_safari_fallbacks };
+export { WebAuthnBridgeMessage, executeWebAuthnWithParentFallbacksSafari };
 //# sourceMappingURL=safari-fallbacks.js.map

package/dist/esm/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.js.map

@@ -1 +1 @@
-{"version":3,"file":"safari-fallbacks.js","names":["be: unknown","e: unknown"],"sources":["../../../../../src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts"],"sourcesContent":["// Safari/WebAuthn fallbacks: centralized retry + top-level bridge\n// - Encapsulates Safari-specific error handling (ancestor-origin, not-focused)\n// - Bridges create/get to top-level via postMessage when needed\n// - Keeps helpers private to reduce file count and surface area\n\ntype Kind = 'create' | 'get';\n\n// Typed message names for parent-domain bridge\nexport const WebAuthnBridgeMessage = {\n  Create: 'WALLET_WEBAUTHN_CREATE',\n  Get: 'WALLET_WEBAUTHN_GET',\n  CreateResult: 'WALLET_WEBAUTHN_CREATE_RESULT',\n  GetResult: 'WALLET_WEBAUTHN_GET_RESULT',\n} as const;\n\nexport type BridgeKind = typeof WebAuthnBridgeMessage.Create | typeof WebAuthnBridgeMessage.Get;\nexport type BridgeResultKind = typeof WebAuthnBridgeMessage.CreateResult | typeof WebAuthnBridgeMessage.GetResult;\n\ntype ResultTypeFor<K extends BridgeKind> =\n  K extends typeof WebAuthnBridgeMessage.Get\n    ? typeof WebAuthnBridgeMessage.GetResult\n    : typeof WebAuthnBridgeMessage.CreateResult;\n\nfunction getResultTypeFor<K extends BridgeKind>(kind: K): ResultTypeFor<K> {\n  return (kind === WebAuthnBridgeMessage.Get\n    ? WebAuthnBridgeMessage.GetResult\n    : WebAuthnBridgeMessage.CreateResult) as ResultTypeFor<K>;\n}\n\ntype BridgeOk = { ok: true; credential: unknown };\ntype BridgeErr = { ok: false; error?: string; timeout?: boolean };\ntype BridgeResponse = BridgeOk | BridgeErr;\n\n// Client interface used to request WebAuthn from the parent/top-level context\nexport type ParentDomainWebAuthnClient = {\n  request<K extends BridgeKind>(\n    kind: K,\n    publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,\n    timeoutMs?: number,\n  ): Promise<BridgeResponse>;\n};\n\nexport interface OrchestratorDeps {\n  rpId: string;\n  inIframe: boolean;\n  timeoutMs?: number;\n  bridgeClient?: ParentDomainWebAuthnClient;\n  // Gate for ancestor-error on GET; bridges for focus errors are always allowed when in iframe.\n  permitGetBridgeOnAncestorError?: boolean;\n  // Optional AbortSignal to cancel native navigator.credentials operations.\n  // Note: parent-bridge path may not be abortable.\n  abortSignal?: AbortSignal;\n}\n\n/**\n * Execute a WebAuthn operation with Safari-aware fallbacks.\n *\n * Steps:\n * 1) Try native WebAuthn via navigator.credentials.{create|get}\n * 2) If the failure matches Safari's ancestor-origin restriction and we are in an iframe,\n *    ask the parent/top-level window to perform the WebAuthn operation (bridge). If the\n *    parent reports a user cancellation, throw NotAllowedError; if it times out, continue.\n * 3) If the failure matches Safari's \"document not focused\" path, first attempt to refocus\n *    and retry native once; if still blocked and in an iframe, ask the parent window to handle it.\n * 4) Generic last resort: when in an iframe (constrained context), always attempt the parent\n *    WebAuthn once even if the error wasn't recognized as a Safari-specific case. If the parent\n *    path times out, surface a deterministic timeout error without re-trying native again.\n * 5) Otherwise, rethrow the original error.\n */\nexport async function executeWebAuthnWithParentFallbacksSafari(\n  kind: Kind,\n  publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,\n  deps: OrchestratorDeps,\n): Promise<PublicKeyCredential | unknown> {\n\n  const {\n    rpId,\n    inIframe,\n    timeoutMs = 60000,\n    permitGetBridgeOnAncestorError = true\n  } = deps;\n  const bridgeClient = deps.bridgeClient || new WindowParentDomainWebAuthnClient();\n\n  const isTestForceNativeFail = (): boolean => {\n    const g = (globalThis as any);\n    const w = (typeof window !== 'undefined' ? (window as any) : undefined);\n    return !!(g && g.__W3A_TEST_FORCE_NATIVE_FAIL) || !!(w && w.__W3A_TEST_FORCE_NATIVE_FAIL);\n  };\n  const bumpCounter = (key: string) => {\n    const g = (globalThis as any);\n    g[key] = (g[key] || 0) + 1;\n  };\n\n  // Test harness fast-path: when explicitly forcing native fail, skip native and go straight to bridge.\n  // Still bump native attempt counters for determinism in tests.\n  if (isTestForceNativeFail()) {\n    if (kind === 'create') bumpCounter('__W3A_TEST_NATIVE_CREATE_ATTEMPTS');\n    else bumpCounter('__W3A_TEST_NATIVE_GET_ATTEMPTS');\n    try {\n      const bridged = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);\n      if (bridged?.ok) return bridged.credential;\n      if (bridged && !bridged.timeout) {\n        throw notAllowedError(bridged.error || 'WebAuthn cancelled or failed (bridge)');\n      }\n      throw new Error('WebAuthn bridge timeout');\n    } catch (be: unknown) {\n      // Ensure consistent error type for unit tests\n      throw notAllowedError((be as any)?.message || 'WebAuthn bridge failed');\n    }\n  }\n\n  const tryNative = async () => {\n    if (kind === 'create') {\n      bumpCounter('__W3A_TEST_NATIVE_CREATE_ATTEMPTS');\n      if (isTestForceNativeFail()) throw notAllowedError('Forced native fail (create)');\n      // Build options with optional AbortSignal\n      return await navigator.credentials.create({\n        publicKey: publicKey as PublicKeyCredentialCreationOptions,\n        ...(deps.abortSignal ? { signal: deps.abortSignal } : {}),\n      });\n    } else {\n      bumpCounter('__W3A_TEST_NATIVE_GET_ATTEMPTS');\n      if (isTestForceNativeFail()) throw notAllowedError('Forced native fail (get)');\n      return await navigator.credentials.get({\n        publicKey: publicKey as PublicKeyCredentialRequestOptions,\n        ...(deps.abortSignal ? { signal: deps.abortSignal } : {}),\n      });\n    }\n  };\n\n  // Step 1: native attempt\n  try {\n    return await tryNative();\n  } catch (e: unknown) {\n    // If the user explicitly cancelled (generic NotAllowedError without Safari-specific hints),\n    // do not attempt any bridge fallbacks that would re-prompt Touch ID. Propagate immediately.\n    // This avoids double prompts when a user cancels the native sheet.\n    const name = safeName(e);\n    if (name === 'NotAllowedError' && !isAncestorOriginError(e) && !isDocumentNotFocusedError(e)) {\n      throw e;\n    }\n\n    // Step 2: ancestor-origin restriction → parent bridge (when in iframe)\n    if (isAncestorOriginError(e) && inIframe) {\n      if (kind === 'get' && !permitGetBridgeOnAncestorError) {\n        throw e;\n      }\n      try {\n        const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);\n        if (bridgedCredentials?.ok) return bridgedCredentials.credential;\n        if (bridgedCredentials && !bridgedCredentials.timeout) {\n          throw notAllowedError(bridgedCredentials.error || 'WebAuthn get cancelled or failed (bridge)');\n        }\n      } catch (be: unknown) {\n        throw notAllowedError((be as any)?.message || 'WebAuthn bridge failed');\n      }\n    }\n\n    // Step 3: document-not-focused → refocus + retry native; then parent bridge if still blocked\n    if (isDocumentNotFocusedError(e)) {\n      const focused = await attemptRefocus();\n      if (focused) {\n        try { return await tryNative(); } catch {}\n      }\n      if (inIframe) {\n        try {\n          const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);\n          if (bridgedCredentials?.ok) return bridgedCredentials.credential;\n          if (bridgedCredentials && !bridgedCredentials.timeout) {\n            throw notAllowedError(bridgedCredentials.error || 'WebAuthn get cancelled or failed (bridge)');\n          }\n        } catch (be: unknown) {\n          throw notAllowedError((be as any)?.message || 'WebAuthn bridge failed');\n        }\n      }\n    }\n\n    // Step 4: generic last-resort bridge path for constrained iframe contexts\n    if (inIframe) {\n      try {\n        const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);\n        if (bridgedCredentials?.ok) return bridgedCredentials.credential;\n        if (bridgedCredentials && !bridgedCredentials.timeout) {\n          throw notAllowedError(bridgedCredentials.error || 'WebAuthn cancelled or failed (bridge)');\n        }\n        // Timeout: surface an explicit error without re‑trying native again\n        throw new Error('WebAuthn bridge timeout');\n      } catch (be: unknown) {\n        throw notAllowedError((be as any)?.message || 'WebAuthn bridge failed');\n      }\n    }\n\n    // Step 5: not an iframe or no recognized fallback – rethrow original error\n    throw e;\n  }\n}\n\n// Request the parent/top-level window to perform the WebAuthn operation\nexport async function requestParentDomainWebAuthn(\n  kind: Kind,\n  publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,\n  client: ParentDomainWebAuthnClient,\n  timeoutMs: number,\n): Promise<BridgeResponse> {\n  if (kind === 'create') {\n    return client.request(WebAuthnBridgeMessage.Create, publicKey as PublicKeyCredentialCreationOptions, timeoutMs);\n  }\n  return client.request(WebAuthnBridgeMessage.Get, publicKey as PublicKeyCredentialRequestOptions, timeoutMs);\n}\n\n// Default bridge client using window.parent postMessage protocol\nexport class WindowParentDomainWebAuthnClient implements ParentDomainWebAuthnClient {\n  async request<K extends BridgeKind>(\n    kind: K,\n    publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,\n    timeoutMs = 60000,\n  ): Promise<BridgeResponse> {\n    const requestId = `${kind}:${Date.now()}:${Math.random().toString(36).slice(2)}`;\n    const resultType = getResultTypeFor(kind);\n\n    return new Promise((resolve) => {\n      let settled = false;\n      const finish = (val: BridgeResponse) => { if (!settled) { settled = true; resolve(val); } };\n\n      const onMessage = (ev: MessageEvent) => {\n        const payload = ev?.data as unknown;\n        if (!payload || typeof (payload as { type?: unknown }).type !== 'string') return;\n        const t = (payload as { type: string }).type;\n        if (t !== resultType) return;\n        const rid = (payload as { requestId?: unknown }).requestId;\n        if (rid !== requestId) return;\n        window.removeEventListener('message', onMessage);\n        const ok = !!(payload as { ok?: unknown }).ok;\n        const cred = (payload as { credential?: unknown }).credential;\n        const err = (payload as { error?: unknown }).error;\n        if (ok && cred) return finish({ ok: true, credential: cred });\n        return finish({ ok: false, error: typeof err === 'string' ? err : undefined });\n      };\n      window.addEventListener('message', onMessage);\n      window.parent?.postMessage({ type: kind, requestId, publicKey } as { type: K; requestId: string; publicKey: any }, '*');\n      setTimeout(() => { window.removeEventListener('message', onMessage); finish({ ok: false, timeout: true }); }, timeoutMs);\n    });\n  }\n}\n\nfunction notAllowedError(message: string): Error {\n  const e = new Error(message);\n  (e as any).name = 'NotAllowedError';\n  return e;\n}\n\n// Private: error classification helpers\nfunction isAncestorOriginError(err: unknown): boolean {\n  const msg = safeMessage(err);\n  return /origin of the document is not the same as its ancestors/i.test(msg);\n}\n\nfunction isDocumentNotFocusedError(err: unknown): boolean {\n  const name = safeName(err);\n  const msg = safeMessage(err);\n  const isNotAllowed = name === 'NotAllowedError';\n  const mentionsFocus = /document is not focused|not focused|focus/i.test(msg);\n  return Boolean(isNotAllowed && mentionsFocus);\n}\n\nfunction safeMessage(err: unknown): string {\n  return String((err as { message?: unknown })?.message || '');\n}\n\nfunction safeName(err: unknown): string {\n  const n = (err as { name?: unknown })?.name;\n  return typeof n === 'string' ? n : '';\n}\n\n// Private: focus utility to mitigate Safari focus issues\nasync function attemptRefocus(maxRetries = 2, delays: number[] = [50, 120]): Promise<boolean> {\n  (window as any).focus?.();\n  (document?.body as any)?.focus?.();\n\n  const wait = (ms: number) => new Promise(r => setTimeout(r, ms));\n  const total = Math.max(0, maxRetries);\n  for (let i = 0; i <= total; i++) {\n    const d = delays[i] ?? delays[delays.length - 1] ?? 80;\n    await wait(d);\n    if (document.hasFocus()) return true;\n    (window as any).focus?.();\n  }\n  return document.hasFocus();\n}\n"],"mappings":";;;AAuBA,SAAS,iBAAuC,MAA2B;AACzE,QAAQ,SAAS,sBAAsB,MACnC,sBAAsB,YACtB,sBAAsB;;;;;;;;;;;;;;;;;AA2C5B,eAAsB,yCACpB,MACA,WACA,MACwC;CAExC,MAAM,EACJ,MACA,UACA,YAAY,KACZ,iCAAiC,SAC/B;CACJ,MAAM,eAAe,KAAK,gBAAgB,IAAI;CAE9C,MAAM,8BAAuC;EAC3C,MAAM,IAAK;EACX,MAAM,IAAK,OAAO,WAAW,cAAe,SAAiB;AAC7D,SAAO,CAAC,EAAE,KAAK,EAAE,iCAAiC,CAAC,EAAE,KAAK,EAAE;;CAE9D,MAAM,eAAe,QAAgB;EACnC,MAAM,IAAK;AACX,IAAE,QAAQ,EAAE,QAAQ,KAAK;;AAK3B,KAAI,yBAAyB;AAC3B,MAAI,SAAS,SAAU,aAAY;MAC9B,aAAY;AACjB,MAAI;GACF,MAAM,UAAU,MAAM,4BAA4B,MAAM,WAAW,cAAc;AACjF,OAAI,SAAS,GAAI,QAAO,QAAQ;AAChC,OAAI,WAAW,CAAC,QAAQ,QACtB,OAAM,gBAAgB,QAAQ,SAAS;AAEzC,SAAM,IAAI,MAAM;WACTA,IAAa;AAEpB,SAAM,gBAAiB,IAAY,WAAW;;;CAIlD,MAAM,YAAY,YAAY;AAC5B,MAAI,SAAS,UAAU;AACrB,eAAY;AACZ,OAAI,wBAAyB,OAAM,gBAAgB;AAEnD,UAAO,MAAM,UAAU,YAAY,OAAO;IAC7B;IACX,GAAI,KAAK,cAAc,EAAE,QAAQ,KAAK,gBAAgB;;SAEnD;AACL,eAAY;AACZ,OAAI,wBAAyB,OAAM,gBAAgB;AACnD,UAAO,MAAM,UAAU,YAAY,IAAI;IAC1B;IACX,GAAI,KAAK,cAAc,EAAE,QAAQ,KAAK,gBAAgB;;;;AAM5D,KAAI;AACF,SAAO,MAAM;UACNC,GAAY;EAInB,MAAM,OAAO,SAAS;AACtB,MAAI,SAAS,qBAAqB,CAAC,sBAAsB,MAAM,CAAC,0BAA0B,GACxF,OAAM;AAIR,MAAI,sBAAsB,MAAM,UAAU;AACxC,OAAI,SAAS,SAAS,CAAC,+BACrB,OAAM;AAER,OAAI;IACF,MAAM,qBAAqB,MAAM,4BAA4B,MAAM,WAAW,cAAc;AAC5F,QAAI,oBAAoB,GAAI,QAAO,mBAAmB;AACtD,QAAI,sBAAsB,CAAC,mBAAmB,QAC5C,OAAM,gBAAgB,mBAAmB,SAAS;YAE7CD,IAAa;AACpB,UAAM,gBAAiB,IAAY,WAAW;;;AAKlD,MAAI,0BAA0B,IAAI;GAChC,MAAM,UAAU,MAAM;AACtB,OAAI,QACF,KAAI;AAAE,WAAO,MAAM;WAAqB;AAE1C,OAAI,SACF,KAAI;IACF,MAAM,qBAAqB,MAAM,4BAA4B,MAAM,WAAW,cAAc;AAC5F,QAAI,oBAAoB,GAAI,QAAO,mBAAmB;AACtD,QAAI,sBAAsB,CAAC,mBAAmB,QAC5C,OAAM,gBAAgB,mBAAmB,SAAS;YAE7CA,IAAa;AACpB,UAAM,gBAAiB,IAAY,WAAW;;;AAMpD,MAAI,SACF,KAAI;GACF,MAAM,qBAAqB,MAAM,4BAA4B,MAAM,WAAW,cAAc;AAC5F,OAAI,oBAAoB,GAAI,QAAO,mBAAmB;AACtD,OAAI,sBAAsB,CAAC,mBAAmB,QAC5C,OAAM,gBAAgB,mBAAmB,SAAS;AAGpD,SAAM,IAAI,MAAM;WACTA,IAAa;AACpB,SAAM,gBAAiB,IAAY,WAAW;;AAKlD,QAAM;;;AAKV,eAAsB,4BACpB,MACA,WACA,QACA,WACyB;AACzB,KAAI,SAAS,SACX,QAAO,OAAO,QAAQ,sBAAsB,QAAQ,WAAiD;AAEvG,QAAO,OAAO,QAAQ,sBAAsB,KAAK,WAAgD;;AAsCnG,SAAS,gBAAgB,SAAwB;CAC/C,MAAM,IAAI,IAAI,MAAM;AACpB,CAAC,EAAU,OAAO;AAClB,QAAO;;AAIT,SAAS,sBAAsB,KAAuB;CACpD,MAAM,MAAM,YAAY;AACxB,QAAO,2DAA2D,KAAK;;AAGzE,SAAS,0BAA0B,KAAuB;CACxD,MAAM,OAAO,SAAS;CACtB,MAAM,MAAM,YAAY;CACxB,MAAM,eAAe,SAAS;CAC9B,MAAM,gBAAgB,6CAA6C,KAAK;AACxE,QAAO,QAAQ,gBAAgB;;AAGjC,SAAS,YAAY,KAAsB;AACzC,QAAO,OAAQ,KAA+B,WAAW;;AAG3D,SAAS,SAAS,KAAsB;CACtC,MAAM,IAAK,KAA4B;AACvC,QAAO,OAAO,MAAM,WAAW,IAAI;;AAIrC,eAAe,eAAe,aAAa,GAAG,SAAmB,CAAC,IAAI,MAAwB;AAC5F,CAAC,OAAe;AAChB,EAAC,UAAU,OAAc;CAEzB,MAAM,QAAQ,OAAe,IAAI,SAAQ,MAAK,WAAW,GAAG;CAC5D,MAAM,QAAQ,KAAK,IAAI,GAAG;AAC1B,MAAK,IAAI,IAAI,GAAG,KAAK,OAAO,KAAK;EAC/B,MAAM,IAAI,OAAO,MAAM,OAAO,OAAO,SAAS,MAAM;AACpD,QAAM,KAAK;AACX,MAAI,SAAS,WAAY,QAAO;AAChC,EAAC,OAAe;;AAElB,QAAO,SAAS;;;;CAvRL,wBAAwB;EACnC,QAAQ;EACR,KAAK;EACL,cAAc;EACd,WAAW;;CAuMA,mCAAb,MAAoF;EAClF,MAAM,QACJ,MACA,WACA,YAAY,KACa;GACzB,MAAM,YAAY,GAAG,KAAK,GAAG,KAAK,MAAM,GAAG,KAAK,SAAS,SAAS,IAAI,MAAM;GAC5E,MAAM,aAAa,iBAAiB;AAEpC,UAAO,IAAI,SAAS,YAAY;IAC9B,IAAI,UAAU;IACd,MAAM,UAAU,QAAwB;AAAE,SAAI,CAAC,SAAS;AAAE,gBAAU;AAAM,cAAQ;;;IAElF,MAAM,aAAa,OAAqB;KACtC,MAAM,UAAU,IAAI;AACpB,SAAI,CAAC,WAAW,OAAQ,QAA+B,SAAS,SAAU;KAC1E,MAAM,IAAK,QAA6B;AACxC,SAAI,MAAM,WAAY;KACtB,MAAM,MAAO,QAAoC;AACjD,SAAI,QAAQ,UAAW;AACvB,YAAO,oBAAoB,WAAW;KACtC,MAAM,KAAK,CAAC,CAAE,QAA6B;KAC3C,MAAM,OAAQ,QAAqC;KACnD,MAAM,MAAO,QAAgC;AAC7C,SAAI,MAAM,KAAM,QAAO,OAAO;MAAE,IAAI;MAAM,YAAY;;AACtD,YAAO,OAAO;MAAE,IAAI;MAAO,OAAO,OAAO,QAAQ,WAAW,MAAM;;;AAEpE,WAAO,iBAAiB,WAAW;AACnC,WAAO,QAAQ,YAAY;KAAE,MAAM;KAAM;KAAW;OAA+D;AACnH,qBAAiB;AAAE,YAAO,oBAAoB,WAAW;AAAY,YAAO;MAAE,IAAI;MAAO,SAAS;;OAAY"}
+{"version":3,"file":"safari-fallbacks.js","names":["be: unknown","e: unknown"],"sources":["../../../../../src/core/WebAuthnManager/WebAuthnFallbacks/safari-fallbacks.ts"],"sourcesContent":["// Safari/WebAuthn fallbacks: centralized retry + top-level bridge\n// - Encapsulates Safari-specific error handling (ancestor-origin, not-focused)\n// - Bridges create/get to top-level via postMessage when needed\n// - Keeps helpers private to reduce file count and surface area\n\ntype Kind = 'create' | 'get';\n\n// Typed message names for parent-domain bridge\nexport const WebAuthnBridgeMessage = {\n  Create: 'WALLET_WEBAUTHN_CREATE',\n  Get: 'WALLET_WEBAUTHN_GET',\n  CreateResult: 'WALLET_WEBAUTHN_CREATE_RESULT',\n  GetResult: 'WALLET_WEBAUTHN_GET_RESULT',\n} as const;\n\nexport type BridgeKind = typeof WebAuthnBridgeMessage.Create | typeof WebAuthnBridgeMessage.Get;\nexport type BridgeResultKind = typeof WebAuthnBridgeMessage.CreateResult | typeof WebAuthnBridgeMessage.GetResult;\n\ntype ResultTypeFor<K extends BridgeKind> =\n  K extends typeof WebAuthnBridgeMessage.Get\n    ? typeof WebAuthnBridgeMessage.GetResult\n    : typeof WebAuthnBridgeMessage.CreateResult;\n\nfunction getResultTypeFor<K extends BridgeKind>(kind: K): ResultTypeFor<K> {\n  return (kind === WebAuthnBridgeMessage.Get\n    ? WebAuthnBridgeMessage.GetResult\n    : WebAuthnBridgeMessage.CreateResult) as ResultTypeFor<K>;\n}\n\ntype BridgeOk = { ok: true; credential: unknown };\ntype BridgeErr = { ok: false; error?: string; timeout?: boolean };\ntype BridgeResponse = BridgeOk | BridgeErr;\n\n// Client interface used to request WebAuthn from the parent/top-level context\nexport type ParentDomainWebAuthnClient = {\n  request<K extends BridgeKind>(\n    kind: K,\n    publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,\n    timeoutMs?: number,\n  ): Promise<BridgeResponse>;\n};\n\nexport interface OrchestratorDeps {\n  rpId: string;\n  inIframe: boolean;\n  timeoutMs?: number;\n  bridgeClient?: ParentDomainWebAuthnClient;\n  // Gate for ancestor-error on GET; bridges for focus errors are always allowed when in iframe.\n  permitGetBridgeOnAncestorError?: boolean;\n  // Optional AbortSignal to cancel native navigator.credentials operations.\n  // Note: parent-bridge path may not be abortable.\n  abortSignal?: AbortSignal;\n}\n\n/**\n * Execute a WebAuthn operation with Safari-aware fallbacks.\n *\n * Steps:\n * 1) Try native WebAuthn via navigator.credentials.{create|get}\n * 2) If the failure matches Safari's ancestor-origin restriction and we are in an iframe,\n *    ask the parent/top-level window to perform the WebAuthn operation (bridge). If the\n *    parent reports a user cancellation, throw NotAllowedError; if it times out, continue.\n * 3) If the failure matches Safari's \"document not focused\" path, first attempt to refocus\n *    and retry native once; if still blocked and in an iframe, ask the parent window to handle it.\n * 4) Generic last resort: when in an iframe (constrained context), always attempt the parent\n *    WebAuthn once even if the error wasn't recognized as a Safari-specific case. If the parent\n *    path times out, surface a deterministic timeout error without re-trying native again.\n * 5) Otherwise, rethrow the original error.\n */\nexport async function executeWebAuthnWithParentFallbacksSafari(\n  kind: Kind,\n  publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,\n  deps: OrchestratorDeps,\n): Promise<PublicKeyCredential | unknown> {\n\n  const {\n    rpId,\n    inIframe,\n    timeoutMs = 60000,\n    permitGetBridgeOnAncestorError = true\n  } = deps;\n  const bridgeClient = deps.bridgeClient || new WindowParentDomainWebAuthnClient();\n\n  const isTestForceNativeFail = (): boolean => {\n    const g = (globalThis as any);\n    const w = (typeof window !== 'undefined' ? (window as any) : undefined);\n    return !!(g && g.__W3A_TEST_FORCE_NATIVE_FAIL) || !!(w && w.__W3A_TEST_FORCE_NATIVE_FAIL);\n  };\n  const bumpCounter = (key: string) => {\n    const g = (globalThis as any);\n    g[key] = (g[key] || 0) + 1;\n  };\n\n  // Test harness fast-path: when explicitly forcing native fail, skip native and go straight to bridge.\n  // Still bump native attempt counters for determinism in tests.\n  if (isTestForceNativeFail()) {\n    if (kind === 'create') bumpCounter('__W3A_TEST_NATIVE_CREATE_ATTEMPTS');\n    else bumpCounter('__W3A_TEST_NATIVE_GET_ATTEMPTS');\n    try {\n      const bridged = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);\n      if (bridged?.ok) return bridged.credential;\n      if (bridged && !bridged.timeout) {\n        throw notAllowedError(bridged.error || 'WebAuthn cancelled or failed (bridge)');\n      }\n      throw new Error('WebAuthn bridge timeout');\n    } catch (be: unknown) {\n      // Ensure consistent error type for unit tests\n      throw notAllowedError((be as any)?.message || 'WebAuthn bridge failed');\n    }\n  }\n\n  const tryNative = async () => {\n    if (kind === 'create') {\n      bumpCounter('__W3A_TEST_NATIVE_CREATE_ATTEMPTS');\n      if (isTestForceNativeFail()) throw notAllowedError('Forced native fail (create)');\n      // Build options with optional AbortSignal\n      return await navigator.credentials.create({\n        publicKey: publicKey as PublicKeyCredentialCreationOptions,\n        ...(deps.abortSignal ? { signal: deps.abortSignal } : {}),\n      });\n    } else {\n      bumpCounter('__W3A_TEST_NATIVE_GET_ATTEMPTS');\n      if (isTestForceNativeFail()) throw notAllowedError('Forced native fail (get)');\n      return await navigator.credentials.get({\n        publicKey: publicKey as PublicKeyCredentialRequestOptions,\n        ...(deps.abortSignal ? { signal: deps.abortSignal } : {}),\n      });\n    }\n  };\n\n  // Step 1: native attempt\n  try {\n    return await tryNative();\n  } catch (e: unknown) {\n    // If the user explicitly cancelled (generic NotAllowedError without Safari-specific hints),\n    // do not attempt any bridge fallbacks that would re-prompt Touch ID. Propagate immediately.\n    // This avoids double prompts when a user cancels the native sheet.\n    const name = safeName(e);\n    if (name === 'NotAllowedError' && !isAncestorOriginError(e) && !isDocumentNotFocusedError(e)) {\n      throw e;\n    }\n\n    // Step 2: ancestor-origin restriction → parent bridge (when in iframe)\n    if (isAncestorOriginError(e) && inIframe) {\n      if (kind === 'get' && !permitGetBridgeOnAncestorError) {\n        throw e;\n      }\n      try {\n        const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);\n        if (bridgedCredentials?.ok) return bridgedCredentials.credential;\n        if (bridgedCredentials && !bridgedCredentials.timeout) {\n          throw notAllowedError(bridgedCredentials.error || 'WebAuthn get cancelled or failed (bridge)');\n        }\n      } catch (be: unknown) {\n        throw notAllowedError((be as any)?.message || 'WebAuthn bridge failed');\n      }\n    }\n\n    // Step 3: document-not-focused → refocus + retry native; then parent bridge if still blocked\n    if (isDocumentNotFocusedError(e)) {\n      const focused = await attemptRefocus();\n      if (focused) {\n        try { return await tryNative(); } catch {}\n      }\n      if (inIframe) {\n        try {\n          const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);\n          if (bridgedCredentials?.ok) return bridgedCredentials.credential;\n          if (bridgedCredentials && !bridgedCredentials.timeout) {\n            throw notAllowedError(bridgedCredentials.error || 'WebAuthn get cancelled or failed (bridge)');\n          }\n        } catch (be: unknown) {\n          throw notAllowedError((be as any)?.message || 'WebAuthn bridge failed');\n        }\n      }\n    }\n\n    // Step 4: generic last-resort bridge path for constrained iframe contexts\n    if (inIframe) {\n      try {\n        const bridgedCredentials = await requestParentDomainWebAuthn(kind, publicKey, bridgeClient, timeoutMs);\n        if (bridgedCredentials?.ok) return bridgedCredentials.credential;\n        if (bridgedCredentials && !bridgedCredentials.timeout) {\n          throw notAllowedError(bridgedCredentials.error || 'WebAuthn cancelled or failed (bridge)');\n        }\n        // Timeout: surface an explicit error without re‑trying native again\n        throw new Error('WebAuthn bridge timeout');\n      } catch (be: unknown) {\n        throw notAllowedError((be as any)?.message || 'WebAuthn bridge failed');\n      }\n    }\n\n    // Step 5: not an iframe or no recognized fallback – rethrow original error\n    throw e;\n  }\n}\n\n// Request the parent/top-level window to perform the WebAuthn operation\nexport async function requestParentDomainWebAuthn(\n  kind: Kind,\n  publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,\n  client: ParentDomainWebAuthnClient,\n  timeoutMs: number,\n): Promise<BridgeResponse> {\n  if (kind === 'create') {\n    return client.request(WebAuthnBridgeMessage.Create, publicKey as PublicKeyCredentialCreationOptions, timeoutMs);\n  }\n  return client.request(WebAuthnBridgeMessage.Get, publicKey as PublicKeyCredentialRequestOptions, timeoutMs);\n}\n\n// Default bridge client using window.parent postMessage protocol\nexport class WindowParentDomainWebAuthnClient implements ParentDomainWebAuthnClient {\n  async request<K extends BridgeKind>(\n    kind: K,\n    publicKey: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,\n    timeoutMs = 60000,\n  ): Promise<BridgeResponse> {\n    const requestId = `${kind}:${Date.now()}:${Math.random().toString(36).slice(2)}`;\n    const resultType = getResultTypeFor(kind);\n\n    return new Promise((resolve) => {\n      let settled = false;\n      const finish = (val: BridgeResponse) => { if (!settled) { settled = true; resolve(val); } };\n\n      const onMessage = (ev: MessageEvent) => {\n        const payload = ev?.data as unknown;\n        if (!payload || typeof (payload as { type?: unknown }).type !== 'string') return;\n        const t = (payload as { type: string }).type;\n        if (t !== resultType) return;\n        const rid = (payload as { requestId?: unknown }).requestId;\n        if (rid !== requestId) return;\n        window.removeEventListener('message', onMessage);\n        const ok = !!(payload as { ok?: unknown }).ok;\n        const cred = (payload as { credential?: unknown }).credential;\n        const err = (payload as { error?: unknown }).error;\n        if (ok && cred) return finish({ ok: true, credential: cred });\n        return finish({ ok: false, error: typeof err === 'string' ? err : undefined });\n      };\n      window.addEventListener('message', onMessage);\n      window.parent?.postMessage({ type: kind, requestId, publicKey } as { type: K; requestId: string; publicKey: any }, '*');\n      setTimeout(() => { window.removeEventListener('message', onMessage); finish({ ok: false, timeout: true }); }, timeoutMs);\n    });\n  }\n}\n\nfunction notAllowedError(message: string): Error {\n  const e = new Error(message);\n  (e as any).name = 'NotAllowedError';\n  return e;\n}\n\n// Private: error classification helpers\nfunction isAncestorOriginError(err: unknown): boolean {\n  const msg = safeMessage(err);\n  return /origin of the document is not the same as its ancestors/i.test(msg);\n}\n\nfunction isDocumentNotFocusedError(err: unknown): boolean {\n  const name = safeName(err);\n  const msg = safeMessage(err);\n  const isNotAllowed = name === 'NotAllowedError';\n  const mentionsFocus = /document is not focused|not focused|focus/i.test(msg);\n  return Boolean(isNotAllowed && mentionsFocus);\n}\n\nfunction safeMessage(err: unknown): string {\n  return String((err as { message?: unknown })?.message || '');\n}\n\nfunction safeName(err: unknown): string {\n  const n = (err as { name?: unknown })?.name;\n  return typeof n === 'string' ? n : '';\n}\n\n// Private: focus utility to mitigate Safari focus issues\nasync function attemptRefocus(maxRetries = 2, delays: number[] = [50, 120]): Promise<boolean> {\n  (window as any).focus?.();\n  (document?.body as any)?.focus?.();\n\n  const wait = (ms: number) => new Promise(r => setTimeout(r, ms));\n  const total = Math.max(0, maxRetries);\n  for (let i = 0; i <= total; i++) {\n    const d = delays[i] ?? delays[delays.length - 1] ?? 80;\n    await wait(d);\n    if (document.hasFocus()) return true;\n    (window as any).focus?.();\n  }\n  return document.hasFocus();\n}\n"],"mappings":";AAQA,MAAa,wBAAwB;CACnC,QAAQ;CACR,KAAK;CACL,cAAc;CACd,WAAW;;AAWb,SAAS,iBAAuC,MAA2B;AACzE,QAAQ,SAAS,sBAAsB,MACnC,sBAAsB,YACtB,sBAAsB;;;;;;;;;;;;;;;;;AA2C5B,eAAsB,yCACpB,MACA,WACA,MACwC;CAExC,MAAM,EACJ,MACA,UACA,YAAY,KACZ,iCAAiC,SAC/B;CACJ,MAAM,eAAe,KAAK,gBAAgB,IAAI;CAE9C,MAAM,8BAAuC;EAC3C,MAAM,IAAK;EACX,MAAM,IAAK,OAAO,WAAW,cAAe,SAAiB;AAC7D,SAAO,CAAC,EAAE,KAAK,EAAE,iCAAiC,CAAC,EAAE,KAAK,EAAE;;CAE9D,MAAM,eAAe,QAAgB;EACnC,MAAM,IAAK;AACX,IAAE,QAAQ,EAAE,QAAQ,KAAK;;AAK3B,KAAI,yBAAyB;AAC3B,MAAI,SAAS,SAAU,aAAY;MAC9B,aAAY;AACjB,MAAI;GACF,MAAM,UAAU,MAAM,4BAA4B,MAAM,WAAW,cAAc;AACjF,OAAI,SAAS,GAAI,QAAO,QAAQ;AAChC,OAAI,WAAW,CAAC,QAAQ,QACtB,OAAM,gBAAgB,QAAQ,SAAS;AAEzC,SAAM,IAAI,MAAM;WACTA,IAAa;AAEpB,SAAM,gBAAiB,IAAY,WAAW;;;CAIlD,MAAM,YAAY,YAAY;AAC5B,MAAI,SAAS,UAAU;AACrB,eAAY;AACZ,OAAI,wBAAyB,OAAM,gBAAgB;AAEnD,UAAO,MAAM,UAAU,YAAY,OAAO;IAC7B;IACX,GAAI,KAAK,cAAc,EAAE,QAAQ,KAAK,gBAAgB;;SAEnD;AACL,eAAY;AACZ,OAAI,wBAAyB,OAAM,gBAAgB;AACnD,UAAO,MAAM,UAAU,YAAY,IAAI;IAC1B;IACX,GAAI,KAAK,cAAc,EAAE,QAAQ,KAAK,gBAAgB;;;;AAM5D,KAAI;AACF,SAAO,MAAM;UACNC,GAAY;EAInB,MAAM,OAAO,SAAS;AACtB,MAAI,SAAS,qBAAqB,CAAC,sBAAsB,MAAM,CAAC,0BAA0B,GACxF,OAAM;AAIR,MAAI,sBAAsB,MAAM,UAAU;AACxC,OAAI,SAAS,SAAS,CAAC,+BACrB,OAAM;AAER,OAAI;IACF,MAAM,qBAAqB,MAAM,4BAA4B,MAAM,WAAW,cAAc;AAC5F,QAAI,oBAAoB,GAAI,QAAO,mBAAmB;AACtD,QAAI,sBAAsB,CAAC,mBAAmB,QAC5C,OAAM,gBAAgB,mBAAmB,SAAS;YAE7CD,IAAa;AACpB,UAAM,gBAAiB,IAAY,WAAW;;;AAKlD,MAAI,0BAA0B,IAAI;GAChC,MAAM,UAAU,MAAM;AACtB,OAAI,QACF,KAAI;AAAE,WAAO,MAAM;WAAqB;AAE1C,OAAI,SACF,KAAI;IACF,MAAM,qBAAqB,MAAM,4BAA4B,MAAM,WAAW,cAAc;AAC5F,QAAI,oBAAoB,GAAI,QAAO,mBAAmB;AACtD,QAAI,sBAAsB,CAAC,mBAAmB,QAC5C,OAAM,gBAAgB,mBAAmB,SAAS;YAE7CA,IAAa;AACpB,UAAM,gBAAiB,IAAY,WAAW;;;AAMpD,MAAI,SACF,KAAI;GACF,MAAM,qBAAqB,MAAM,4BAA4B,MAAM,WAAW,cAAc;AAC5F,OAAI,oBAAoB,GAAI,QAAO,mBAAmB;AACtD,OAAI,sBAAsB,CAAC,mBAAmB,QAC5C,OAAM,gBAAgB,mBAAmB,SAAS;AAGpD,SAAM,IAAI,MAAM;WACTA,IAAa;AACpB,SAAM,gBAAiB,IAAY,WAAW;;AAKlD,QAAM;;;AAKV,eAAsB,4BACpB,MACA,WACA,QACA,WACyB;AACzB,KAAI,SAAS,SACX,QAAO,OAAO,QAAQ,sBAAsB,QAAQ,WAAiD;AAEvG,QAAO,OAAO,QAAQ,sBAAsB,KAAK,WAAgD;;AAInG,IAAa,mCAAb,MAAoF;CAClF,MAAM,QACJ,MACA,WACA,YAAY,KACa;EACzB,MAAM,YAAY,GAAG,KAAK,GAAG,KAAK,MAAM,GAAG,KAAK,SAAS,SAAS,IAAI,MAAM;EAC5E,MAAM,aAAa,iBAAiB;AAEpC,SAAO,IAAI,SAAS,YAAY;GAC9B,IAAI,UAAU;GACd,MAAM,UAAU,QAAwB;AAAE,QAAI,CAAC,SAAS;AAAE,eAAU;AAAM,aAAQ;;;GAElF,MAAM,aAAa,OAAqB;IACtC,MAAM,UAAU,IAAI;AACpB,QAAI,CAAC,WAAW,OAAQ,QAA+B,SAAS,SAAU;IAC1E,MAAM,IAAK,QAA6B;AACxC,QAAI,MAAM,WAAY;IACtB,MAAM,MAAO,QAAoC;AACjD,QAAI,QAAQ,UAAW;AACvB,WAAO,oBAAoB,WAAW;IACtC,MAAM,KAAK,CAAC,CAAE,QAA6B;IAC3C,MAAM,OAAQ,QAAqC;IACnD,MAAM,MAAO,QAAgC;AAC7C,QAAI,MAAM,KAAM,QAAO,OAAO;KAAE,IAAI;KAAM,YAAY;;AACtD,WAAO,OAAO;KAAE,IAAI;KAAO,OAAO,OAAO,QAAQ,WAAW,MAAM;;;AAEpE,UAAO,iBAAiB,WAAW;AACnC,UAAO,QAAQ,YAAY;IAAE,MAAM;IAAM;IAAW;MAA+D;AACnH,oBAAiB;AAAE,WAAO,oBAAoB,WAAW;AAAY,WAAO;KAAE,IAAI;KAAO,SAAS;;MAAY;;;;AAKpH,SAAS,gBAAgB,SAAwB;CAC/C,MAAM,IAAI,IAAI,MAAM;AACpB,CAAC,EAAU,OAAO;AAClB,QAAO;;AAIT,SAAS,sBAAsB,KAAuB;CACpD,MAAM,MAAM,YAAY;AACxB,QAAO,2DAA2D,KAAK;;AAGzE,SAAS,0BAA0B,KAAuB;CACxD,MAAM,OAAO,SAAS;CACtB,MAAM,MAAM,YAAY;CACxB,MAAM,eAAe,SAAS;CAC9B,MAAM,gBAAgB,6CAA6C,KAAK;AACxE,QAAO,QAAQ,gBAAgB;;AAGjC,SAAS,YAAY,KAAsB;AACzC,QAAO,OAAQ,KAA+B,WAAW;;AAG3D,SAAS,SAAS,KAAsB;CACtC,MAAM,IAAK,KAA4B;AACvC,QAAO,OAAO,MAAM,WAAW,IAAI;;AAIrC,eAAe,eAAe,aAAa,GAAG,SAAmB,CAAC,IAAI,MAAwB;AAC5F,CAAC,OAAe;AAChB,EAAC,UAAU,OAAc;CAEzB,MAAM,QAAQ,OAAe,IAAI,SAAQ,MAAK,WAAW,GAAG;CAC5D,MAAM,QAAQ,KAAK,IAAI,GAAG;AAC1B,MAAK,IAAI,IAAI,GAAG,KAAK,OAAO,KAAK;EAC/B,MAAM,IAAI,OAAO,MAAM,OAAO,OAAO,SAAS,MAAM;AACpD,QAAM,KAAK;AACX,MAAI,SAAS,WAAY,QAAO;AAChC,EAAC,OAAe;;AAElB,QAAO,SAAS"}

package/dist/esm/core/WebAuthnManager/collectAuthenticationCredentialForVrfChallenge.js

@@ -0,0 +1,34 @@
+import { toAccountId } from "../types/accountIds.js";
+import { authenticatorsToAllowCredentials } from "./touchIdPrompt.js";
+
+//#region src/core/WebAuthnManager/collectAuthenticationCredentialForVrfChallenge.ts
+async function collectAuthenticationCredentialForVrfChallenge(args) {
+	const nearAccountId = toAccountId(args.nearAccountId);
+	const authenticators = await args.indexedDB.clientDB.getAuthenticatorsByUser(nearAccountId);
+	let authenticatorsForPrompt = authenticators;
+	if (authenticators.length > 0) ({authenticatorsForPrompt} = await args.indexedDB.clientDB.ensureCurrentPasskey(toAccountId(nearAccountId), authenticators));
+	args.onBeforePrompt?.({
+		authenticators,
+		authenticatorsForPrompt,
+		vrfChallenge: args.vrfChallenge
+	});
+	const allowCredentials = authenticatorsToAllowCredentials(authenticatorsForPrompt);
+	const serialized = args.includeSecondPrfOutput ? await args.touchIdPrompt.getAuthenticationCredentialsSerializedDualPrf({
+		nearAccountId,
+		challenge: args.vrfChallenge,
+		allowCredentials
+	}) : await args.touchIdPrompt.getAuthenticationCredentialsSerialized({
+		nearAccountId,
+		challenge: args.vrfChallenge,
+		allowCredentials
+	});
+	if (authenticators.length > 0) {
+		const { wrongPasskeyError } = await args.indexedDB.clientDB.ensureCurrentPasskey(toAccountId(nearAccountId), authenticators, serialized.rawId);
+		if (wrongPasskeyError) throw new Error(wrongPasskeyError);
+	}
+	return serialized;
+}
+
+//#endregion
+export { collectAuthenticationCredentialForVrfChallenge };
+//# sourceMappingURL=collectAuthenticationCredentialForVrfChallenge.js.map

package/dist/esm/core/WebAuthnManager/collectAuthenticationCredentialForVrfChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectAuthenticationCredentialForVrfChallenge.js","names":["authenticatorsForPrompt: ClientAuthenticatorData[]"],"sources":["../../../../src/core/WebAuthnManager/collectAuthenticationCredentialForVrfChallenge.ts"],"sourcesContent":["import type { ClientAuthenticatorData, UnifiedIndexedDBManager } from '../IndexedDBManager';\nimport type { AccountId } from '../types/accountIds';\nimport { toAccountId } from '../types/accountIds';\nimport type { VRFChallenge } from '../types/vrf-worker';\nimport { authenticatorsToAllowCredentials } from './touchIdPrompt';\nimport type { TouchIdPrompt } from './touchIdPrompt';\nimport type { WebAuthnAuthenticationCredential } from '../types/webauthn';\n\nexport async function collectAuthenticationCredentialForVrfChallenge(args: {\n  indexedDB: UnifiedIndexedDBManager;\n  touchIdPrompt: Pick<TouchIdPrompt, 'getAuthenticationCredentialsSerialized' | 'getAuthenticationCredentialsSerializedDualPrf'>;\n  nearAccountId: AccountId | string;\n  vrfChallenge: VRFChallenge;\n  onBeforePrompt?: (info: {\n    authenticators: ClientAuthenticatorData[];\n    authenticatorsForPrompt: ClientAuthenticatorData[];\n    vrfChallenge: VRFChallenge;\n  }) => void;\n  /**\n   * When true, include PRF.second in the serialized credential.\n   * Use only for explicit recovery/export flows (higher-friction paths).\n   */\n  includeSecondPrfOutput?: boolean;\n}): Promise<WebAuthnAuthenticationCredential> {\n  const nearAccountId = toAccountId(args.nearAccountId);\n\n  const authenticators = await args.indexedDB.clientDB.getAuthenticatorsByUser(nearAccountId);\n  let authenticatorsForPrompt: ClientAuthenticatorData[] = authenticators;\n  if (authenticators.length > 0) {\n    ({ authenticatorsForPrompt } = await args.indexedDB.clientDB.ensureCurrentPasskey(\n      toAccountId(nearAccountId),\n      authenticators,\n    ));\n  }\n\n  args.onBeforePrompt?.({ authenticators, authenticatorsForPrompt, vrfChallenge: args.vrfChallenge });\n\n  const allowCredentials = authenticatorsToAllowCredentials(authenticatorsForPrompt);\n  const serialized = args.includeSecondPrfOutput\n    ? await args.touchIdPrompt.getAuthenticationCredentialsSerializedDualPrf({\n      nearAccountId,\n      challenge: args.vrfChallenge,\n      allowCredentials,\n    })\n    : await args.touchIdPrompt.getAuthenticationCredentialsSerialized({\n      nearAccountId,\n      challenge: args.vrfChallenge,\n      allowCredentials,\n    });\n\n  // Verify that the chosen credential matches the \"current\" passkey device, when applicable.\n  if (authenticators.length > 0) {\n    const { wrongPasskeyError } = await args.indexedDB.clientDB.ensureCurrentPasskey(\n      toAccountId(nearAccountId),\n      authenticators,\n      serialized.rawId,\n    );\n    if (wrongPasskeyError) {\n      throw new Error(wrongPasskeyError);\n    }\n  }\n\n  return serialized;\n}\n"],"mappings":";;;;AAQA,eAAsB,+CAA+C,MAevB;CAC5C,MAAM,gBAAgB,YAAY,KAAK;CAEvC,MAAM,iBAAiB,MAAM,KAAK,UAAU,SAAS,wBAAwB;CAC7E,IAAIA,0BAAqD;AACzD,KAAI,eAAe,SAAS,EAC1B,EAAC,CAAE,2BAA4B,MAAM,KAAK,UAAU,SAAS,qBAC3D,YAAY,gBACZ;AAIJ,MAAK,iBAAiB;EAAE;EAAgB;EAAyB,cAAc,KAAK;;CAEpF,MAAM,mBAAmB,iCAAiC;CAC1D,MAAM,aAAa,KAAK,yBACpB,MAAM,KAAK,cAAc,8CAA8C;EACvE;EACA,WAAW,KAAK;EAChB;MAEA,MAAM,KAAK,cAAc,uCAAuC;EAChE;EACA,WAAW,KAAK;EAChB;;AAIJ,KAAI,eAAe,SAAS,GAAG;EAC7B,MAAM,EAAE,sBAAsB,MAAM,KAAK,UAAU,SAAS,qBAC1D,YAAY,gBACZ,gBACA,WAAW;AAEb,MAAI,kBACF,OAAM,IAAI,MAAM;;AAIpB,QAAO"}

package/dist/esm/core/WebAuthnManager/credentialsHelpers.js

@@ -1,7 +1,5 @@
-import { __esm } from "../../_virtual/rolldown_runtime.js";
-import { init_validation, isArray, isObject, isString } from "../WalletIframe/validation.js";
+import { isArray, isObject, isString } from "../../utils/validation.js";
 import { base64UrlEncode } from "../../utils/base64.js";
-import { init_utils } from "../../utils/index.js";
 
 //#region src/core/WebAuthnManager/credentialsHelpers.ts
 /**
@@ -112,22 +110,27 @@ function normalizeRegistrationCredential(input) {
 	return normalized;
 }
 /**
-* Removes PRF outputs from the credential
-* @param credential - The WebAuthn credential containing PRF outputs
-* @returns Credential with PRF results cleared
+* Redacts client extension outputs from the credential before sending it over the network.
+*
+* Motivation:
+* - WebAuthn `clientExtensionResults` may contain sensitive material (e.g. PRF outputs).
+* - Even when not sensitive, extension outputs can add fingerprinting surface and bloat payloads.
+*
+* @param credential - The WebAuthn credential potentially containing extension outputs
+* @returns Credential with `clientExtensionResults` removed/redacted
 */
 function removePrfOutputGuard(credential) {
-	const credentialWithoutPrf = {
+	const response = credential.response;
+	const responseWithoutExtensions = isObject(response) ? (() => {
+		const cloned = { ...response };
+		if ("clientExtensionResults" in cloned) cloned.clientExtensionResults = null;
+		return cloned;
+	})() : response;
+	return {
 		...credential,
-		clientExtensionResults: {
-			...credential.clientExtensionResults,
-			prf: { results: {
-				first: void 0,
-				second: void 0
-			} }
-		}
+		response: responseWithoutExtensions,
+		clientExtensionResults: null
 	};
-	return credentialWithoutPrf;
 }
 /**
 * Returns true when the input looks like a serialized registration credential
@@ -277,12 +280,7 @@ function normalizeClientExtensionOutputs(input) {
 	}
 	return out;
 }
-var init_credentialsHelpers = __esm({ "src/core/WebAuthnManager/credentialsHelpers.ts": (() => {
-	init_utils();
-	init_validation();
-}) });
 
 //#endregion
-init_credentialsHelpers();
-export { generateChaCha20Salt, generateEd25519Salt, init_credentialsHelpers, isSerializedRegistrationCredential, normalizeRegistrationCredential, removePrfOutputGuard, serializeAuthenticationCredentialWithPRF, serializeRegistrationCredential, serializeRegistrationCredentialWithPRF };
+export { generateChaCha20Salt, generateEd25519Salt, isSerializedRegistrationCredential, normalizeRegistrationCredential, removePrfOutputGuard, serializeAuthenticationCredentialWithPRF, serializeRegistrationCredential, serializeRegistrationCredentialWithPRF };
 //# sourceMappingURL=credentialsHelpers.js.map

package/dist/esm/core/WebAuthnManager/credentialsHelpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentialsHelpers.js","names":["transports: string[]","normalized: Record<string, unknown>","response: Record<string, unknown>","credentialWithoutPrf: C","out: AuthenticationExtensionsClientOutputs","outCp: CredentialPropertiesOutput"],"sources":["../../../../src/core/WebAuthnManager/credentialsHelpers.ts"],"sourcesContent":["import { base64UrlEncode } from \"../../utils\";\nimport { isObject, isString, isArray } from '../WalletIframe/validation';\nimport {\n  type WebAuthnAuthenticationCredential,\n  type WebAuthnRegistrationCredential,\n  type AuthenticationExtensionsClientOutputs,\n  type CredentialPropertiesOutput,\n} from '../types/webauthn';\n\ntype SerializableCredential = WebAuthnAuthenticationCredential | WebAuthnRegistrationCredential;\n\n/**\n * Serialize PublicKeyCredential for both authentication and registration for WASM worker\n * - Uses base64url encoding for WASM compatibility\n *\n * @returns SerializableCredential - The serialized credential\n * - Does not return PRF outputs\n */\nexport function serializeRegistrationCredential(\n  credential: PublicKeyCredential,\n): WebAuthnRegistrationCredential {\n  const response = credential.response as AuthenticatorAttestationResponse;\n  // Safari and some platforms may not implement getTransports(); guard it.\n  let transports: string[] = [];\n  try {\n    const fn = (response as { getTransports?: () => string[] })?.getTransports;\n    if (typeof fn === 'function') {\n      transports = fn.call(response) || [];\n    }\n  } catch {\n    transports = [];\n  }\n\n  return {\n    id: credential.id,\n    rawId: base64UrlEncode(credential.rawId),\n    type: credential.type,\n    authenticatorAttachment: credential.authenticatorAttachment ?? undefined,\n    response: {\n      clientDataJSON: base64UrlEncode(response.clientDataJSON),\n      attestationObject: base64UrlEncode(response.attestationObject),\n      transports,\n    },\n    clientExtensionResults: {\n      prf: {\n        results: {\n          first: undefined,\n          second: undefined\n        }\n      }\n    },\n  };\n}\n\nexport function serializeAuthenticationCredential(\n  credential: PublicKeyCredential,\n): WebAuthnAuthenticationCredential {\n  const response = credential.response as AuthenticatorAssertionResponse;\n\n  return {\n    id: credential.id,\n    rawId: base64UrlEncode(credential.rawId),\n    type: credential.type,\n    authenticatorAttachment: credential.authenticatorAttachment ?? undefined,\n    response: {\n      clientDataJSON: base64UrlEncode(response.clientDataJSON),\n      authenticatorData: base64UrlEncode(response.authenticatorData),\n      signature: base64UrlEncode(response.signature),\n      userHandle: response.userHandle ? base64UrlEncode(response.userHandle as ArrayBuffer) : undefined,\n    },\n    clientExtensionResults: {\n      prf: {\n        results: {\n          first: undefined,\n          second: undefined\n        }\n      }\n    },\n  };\n}\n\n/**\n * Serialize PublicKeyCredential for both authentication and registration for WASM worker\n * @returns SerializableCredential - The serialized credential\n * - INCLUDES PRF outputs\n */\nexport function serializeRegistrationCredentialWithPRF({\n  credential,\n  firstPrfOutput = true,\n  secondPrfOutput = true,\n}: {\n  credential: PublicKeyCredential,\n  firstPrfOutput?: boolean,\n  secondPrfOutput?: boolean,\n}): WebAuthnRegistrationCredential {\n  const base = serializeRegistrationCredential(credential);\n  const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({\n    credential,\n    firstPrfOutput,\n    secondPrfOutput,\n  });\n  return {\n    ...base,\n    clientExtensionResults: {\n      prf: {\n        results: {\n          first: chacha20PrfOutput,\n          second: ed25519PrfOutput,\n        },\n      },\n    },\n  };\n}\n\nexport function serializeAuthenticationCredentialWithPRF({\n  credential,\n  firstPrfOutput = true,\n  secondPrfOutput = false,\n}: {\n  credential: PublicKeyCredential,\n  firstPrfOutput?: boolean,\n  secondPrfOutput?: boolean,\n}): WebAuthnAuthenticationCredential {\n  const base = serializeAuthenticationCredential(credential);\n  const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({\n    credential,\n    firstPrfOutput,\n    secondPrfOutput,\n  });\n  return {\n    ...base,\n    clientExtensionResults: {\n      prf: {\n        results: {\n          first: chacha20PrfOutput,\n          second: ed25519PrfOutput,\n        },\n      },\n    },\n  };\n}\n\n/////////////////////////////////////////\n// RUNTIME VALIDATION / NORMALIZATION\n/////////////////////////////////////////\n\n// Use shared type guards (isString/isArray) from WalletIframe/validation\n\n/**\n * Validates and normalizes a serialized WebAuthn registration credential.\n * Ensures required fields exist and have the expected primitive types.\n * Populates missing optional arrays like transports with [].\n */\nexport function normalizeRegistrationCredential(input: unknown): WebAuthnRegistrationCredential {\n  if (!isObject(input)) throw new Error('Invalid credential: not an object');\n\n  const candidate = input as Record<string, unknown>;\n  const normalized: Record<string, unknown> = { ...candidate };\n\n  if (!isString(normalized.id)) throw new Error('Invalid credential.id');\n  if (!isString(normalized.type)) throw new Error('Invalid credential.type');\n\n  if (!isString(normalized.rawId)) normalized.rawId = '';\n  if (normalized.authenticatorAttachment !== undefined && !isString(normalized.authenticatorAttachment)) {\n    normalized.authenticatorAttachment = String(normalized.authenticatorAttachment);\n  }\n\n  const response: Record<string, unknown> = isObject(normalized.response)\n    ? { ...(normalized.response as Record<string, unknown>) }\n    : {};\n\n  if (!isString(response.clientDataJSON)) response.clientDataJSON = '';\n  if (!isString(response.attestationObject)) response.attestationObject = '';\n  if (!isArray<string>(response.transports)) response.transports = [];\n\n  normalized.response = response;\n  normalized.clientExtensionResults = normalizeClientExtensionOutputs(normalized.clientExtensionResults);\n\n  return normalized as unknown as WebAuthnRegistrationCredential;\n}\n\n/**\n * Validates and normalizes a serialized WebAuthn authentication credential.\n * Ensures required fields exist and have the expected primitive types.\n */\nexport function normalizeAuthenticationCredential(input: unknown): WebAuthnAuthenticationCredential {\n  if (!isObject(input)) throw new Error('Invalid credential: not an object');\n\n  const candidate = input as Record<string, unknown>;\n  const normalized: Record<string, unknown> = { ...candidate };\n\n  if (!isString(normalized.id)) throw new Error('Invalid credential.id');\n  if (!isString(normalized.type)) throw new Error('Invalid credential.type');\n\n  if (!isString(normalized.rawId)) normalized.rawId = '';\n  if (normalized.authenticatorAttachment !== undefined && !isString(normalized.authenticatorAttachment)) {\n    normalized.authenticatorAttachment = String(normalized.authenticatorAttachment);\n  }\n\n  const response: Record<string, unknown> = isObject(normalized.response)\n    ? { ...(normalized.response as Record<string, unknown>) }\n    : {};\n\n  if (!isString(response.clientDataJSON)) response.clientDataJSON = '';\n  if (!isString(response.authenticatorData)) response.authenticatorData = '';\n  if (!isString(response.signature)) response.signature = '';\n  if (response.userHandle !== undefined && !isString(response.userHandle)) response.userHandle = undefined;\n\n  normalized.response = response;\n  normalized.clientExtensionResults = normalizeClientExtensionOutputs(normalized.clientExtensionResults);\n\n  return normalized as unknown as WebAuthnAuthenticationCredential;\n}\n\n/**\n * Removes PRF outputs from the credential\n * @param credential - The WebAuthn credential containing PRF outputs\n * @returns Credential with PRF results cleared\n */\nexport function removePrfOutputGuard<C extends SerializableCredential>(credential: C): C {\n  const credentialWithoutPrf: C = {\n    ...credential,\n    clientExtensionResults: {\n      ...credential.clientExtensionResults,\n      prf: {\n        results: {\n          first: undefined,\n          second: undefined\n        }\n      }\n    }\n  } as C;\n  return credentialWithoutPrf;\n}\n\n/////////////////////////////////////////\n// TYPE GUARDS\n/////////////////////////////////////////\n\n/**\n * Returns true when the input looks like a serialized registration credential\n * (i.e., plain object with base64url string fields), not a live PublicKeyCredential.\n */\nexport function isSerializedRegistrationCredential(x: unknown): x is WebAuthnRegistrationCredential {\n  if (!isObject(x)) return false;\n  const candidate = x as {\n    id?: unknown;\n    rawId?: unknown;\n    type?: unknown;\n    response?: unknown;\n  };\n\n  if (!isString(candidate.id) || !isString(candidate.rawId) || !isString(candidate.type)) {\n    return false;\n  }\n\n  if (!isObject(candidate.response)) return false;\n  const response = candidate.response as {\n    clientDataJSON?: unknown;\n    attestationObject?: unknown;\n    transports?: unknown;\n  };\n\n  if (!isString(response.clientDataJSON) || !isString(response.attestationObject)) {\n    return false;\n  }\n\n  return response.transports == null || isArray(response.transports);\n}\n\n/**\n * Generate ChaCha20Poly1305 salt using account-specific HKDF for encryption key derivation\n * @param nearAccountId - NEAR account ID to scope the salt to\n * @returns 32-byte Uint8Array salt for ChaCha20Poly1305 key derivation\n */\nexport function generateChaCha20Salt(nearAccountId: string): Uint8Array {\n  const saltString = `chacha20-salt:${nearAccountId}`;\n  const salt = new Uint8Array(32);\n  const saltBytes = new TextEncoder().encode(saltString);\n  salt.set(saltBytes.slice(0, 32));\n  return salt;\n}\n\n/**\n * Generate Ed25519 salt using account-specific HKDF for signing key derivation\n * @param nearAccountId - NEAR account ID to scope the salt to\n * @returns 32-byte Uint8Array salt for Ed25519 key derivation\n */\nexport function generateEd25519Salt(nearAccountId: string): Uint8Array {\n  const saltString = `ed25519-salt:${nearAccountId}`;\n  const salt = new Uint8Array(32);\n  const saltBytes = new TextEncoder().encode(saltString);\n  salt.set(saltBytes.slice(0, 32));\n  return salt;\n}\n\n/** Credential that may have extension results (live or serialized) */\ntype CredentialWithExtensions =\n  | PublicKeyCredential\n  | {\n      clientExtensionResults?: unknown;\n      getClientExtensionResults?: () => unknown;\n    };\n\n/** Extension results structure - flexible to handle both live and serialized forms */\ntype ExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: {\n      first?: unknown;\n      second?: unknown;\n    };\n  };\n  [key: string]: unknown;\n};\n\n/** PRF output values after extraction */\ntype PrfOutputs = {\n  first?: unknown;\n  second?: unknown;\n};\n\n/**\n * Dual PRF outputs for separate encryption and signing key derivation\n */\ninterface DualPrfOutputs {\n  /** Base64-encoded PRF output from prf.results.first for ChaCha20Poly1305 encryption */\n  chacha20PrfOutput: string;\n  /** Base64-encoded PRF output from prf.results.second for Ed25519 signing */\n  ed25519PrfOutput: string;\n}\n\n/**\n * Extract PRF outputs from WebAuthn credential extension results\n * ENCODING: Uses base64url for WASM compatibility\n * @param credential - WebAuthn credential with dual PRF extension results\n * @param firstPrfOutput - Whether to include the first PRF output (default: true)\n * @param secondPrfOutput - Whether to include the second PRF output (default: false)\n * @returns PRF outputs\n */\nfunction extractPrfFromCredential({\n  credential,\n  firstPrfOutput = true,\n  secondPrfOutput = false,\n}: {\n  credential: CredentialWithExtensions;\n  firstPrfOutput?: boolean | undefined;\n  secondPrfOutput?: boolean;\n}): DualPrfOutputs {\n  // Step 1: Get extension results (support both live and serialized credentials)\n  const extensionResults = getExtensionResults(credential);\n\n  // Step 2: Extract PRF results object\n  const prfResults = extractPrfResultsObject(extensionResults);\n\n  // Step 3: Validate PRF results exist and are not empty\n  validatePrfResults(prfResults, firstPrfOutput, secondPrfOutput);\n\n  // Step 4: Normalize and encode PRF outputs\n  const firstEncoded = firstPrfOutput ? normalizePrfValueToBase64Url(prfResults.first) : undefined;\n  const secondEncoded = secondPrfOutput ? normalizePrfValueToBase64Url(prfResults.second) : undefined;\n\n  // Step 5: Validate required outputs are present\n  if (firstPrfOutput && !firstEncoded) {\n    throw new Error('Missing PRF result: first');\n  }\n  if (secondPrfOutput && !secondEncoded) {\n    throw new Error('Missing PRF result: second');\n  }\n\n  return {\n    chacha20PrfOutput: firstEncoded || '',\n    ed25519PrfOutput: secondEncoded || '',\n  };\n}\n\n/** Get extension results from credential (live or serialized) */\nfunction getExtensionResults(credential: CredentialWithExtensions): ExtensionResults | undefined {\n  try {\n    const fn = (credential as { getClientExtensionResults?: () => unknown }).getClientExtensionResults;\n    if (typeof fn === 'function') {\n      return fn.call(credential) as ExtensionResults;\n    }\n  } catch {\n    // Fall through to direct property access\n  }\n  return (credential as { clientExtensionResults?: unknown }).clientExtensionResults as ExtensionResults | undefined;\n}\n\n/** Extract PRF results object from extension results */\nfunction extractPrfResultsObject(extensionResults: ExtensionResults | undefined): PrfOutputs | undefined {\n  try {\n    return extensionResults?.prf?.results;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Validate PRF results are present and not empty */\nfunction validatePrfResults(\n  prfResults: PrfOutputs | undefined,\n  firstRequired: boolean,\n  secondRequired: boolean\n): asserts prfResults is PrfOutputs {\n  if (!prfResults) {\n    throw new Error('Missing PRF results from credential, use a PRF-enabled Authenticator');\n  }\n\n  // Check if PRF results object exists but is completely empty\n  // This indicates a hard failure (not a platform limitation that should trigger GET fallback)\n  const hasAnyPrfData = prfResults.first !== undefined || prfResults.second !== undefined;\n  if (!hasAnyPrfData && (firstRequired || secondRequired)) {\n    throw new Error('Missing PRF result - PRF evaluation failed: results object is empty');\n  }\n}\n\n/** Normalize a PRF value to base64url string */\nfunction normalizePrfValueToBase64Url(value: unknown): string | undefined {\n  if (!value) return undefined;\n\n  // Already base64url encoded\n  if (typeof value === 'string') return value;\n\n  // ArrayBuffer\n  if (value instanceof ArrayBuffer) return base64UrlEncode(value);\n\n  // ArrayBufferView (TypedArray, DataView)\n  if (ArrayBuffer.isView(value)) {\n    return base64UrlEncode(value.buffer);\n  }\n\n  // Try to treat as ArrayBuffer-like\n  try {\n    return base64UrlEncode(value as ArrayBufferLike);\n  } catch {\n    // Last resort: wrap in Uint8Array\n    try {\n      return base64UrlEncode(new Uint8Array(value as ArrayBufferLike).buffer);\n    } catch {\n      return undefined;\n    }\n  }\n}\n\n/////////////////////////////////////////\n// EXTENSION OUTPUTS NORMALIZATION\n/////////////////////////////////////////\n\n/**\n * Normalize WebAuthn client extension outputs into an SDK‑local, clone‑safe shape.\n *\n * Purpose:\n * - Browsers return extension results on PublicKeyCredential in a variety of\n *   shapes and with optional presence. This helper takes an unknown value\n *   (either a live `credential.getClientExtensionResults()` object or a\n *   serialized snapshot) and produces a strictly typed\n *   `AuthenticationExtensionsClientOutputs` compatible with our WASM workers\n *   and cross‑window message passing (structured‑clone safe).\n */\nfunction normalizeClientExtensionOutputs(input: unknown): AuthenticationExtensionsClientOutputs {\n  const out: AuthenticationExtensionsClientOutputs = {\n    prf: { results: { first: undefined, second: undefined } },\n  } as AuthenticationExtensionsClientOutputs;\n\n  const src = isObject(input) ? (input as Record<string, unknown>) : {};\n  // appid\n  if (typeof src.appid === 'boolean') out.appid = src.appid as boolean;\n  // appidExclude\n  if (typeof src.appidExclude === 'boolean') out.appidExclude = src.appidExclude as boolean;\n  // hmacCreateSecret\n  if (typeof src.hmacCreateSecret === 'boolean') out.hmacCreateSecret = src.hmacCreateSecret as boolean;\n  // credProps\n  if (isObject(src.credProps)) {\n    const cp = src.credProps as Record<string, unknown>;\n    const outCp: CredentialPropertiesOutput = {};\n    if (typeof cp.rk === 'boolean') outCp.rk = cp.rk as boolean;\n    out.credProps = outCp;\n  }\n  // uvm: expect array of 3-number tuples; tolerate nested arrays loosely\n  if (isArray(src.uvm)) {\n    const uvmArr = (src.uvm as unknown[]).filter(isArray).map((t) => {\n      const a = t as unknown[];\n      const n0 = typeof a[0] === 'number' ? (a[0] as number) : undefined;\n      const n1 = typeof a[1] === 'number' ? (a[1] as number) : undefined;\n      const n2 = typeof a[2] === 'number' ? (a[2] as number) : undefined;\n      return (typeof n0 === 'number' && typeof n1 === 'number' && typeof n2 === 'number')\n        ? [n0, n1, n2] as [number, number, number]\n        : undefined;\n    }).filter((x): x is [number, number, number] => Array.isArray(x));\n    if (uvmArr.length > 0) out.uvm = uvmArr;\n  }\n  // prf\n  if (isObject(src.prf)) {\n    const prf = src.prf as Record<string, unknown>;\n    const results = isObject(prf.results) ? (prf.results as Record<string, unknown>) : {};\n    const first = results.first;\n    const second = results.second;\n    out.prf = {\n      results: {\n        first: isString(first) ? first : undefined,\n        second: isString(second) ? second : undefined,\n      },\n    };\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,SAAgB,gCACd,YACgC;CAChC,MAAM,WAAW,WAAW;CAE5B,IAAIA,aAAuB;AAC3B,KAAI;EACF,MAAM,KAAM,UAAiD;AAC7D,MAAI,OAAO,OAAO,WAChB,cAAa,GAAG,KAAK,aAAa;SAE9B;AACN,eAAa;;AAGf,QAAO;EACL,IAAI,WAAW;EACf,OAAO,gBAAgB,WAAW;EAClC,MAAM,WAAW;EACjB,yBAAyB,WAAW,2BAA2B;EAC/D,UAAU;GACR,gBAAgB,gBAAgB,SAAS;GACzC,mBAAmB,gBAAgB,SAAS;GAC5C;;EAEF,wBAAwB,EACtB,KAAK,EACH,SAAS;GACP,OAAO;GACP,QAAQ;;;;AAOlB,SAAgB,kCACd,YACkC;CAClC,MAAM,WAAW,WAAW;AAE5B,QAAO;EACL,IAAI,WAAW;EACf,OAAO,gBAAgB,WAAW;EAClC,MAAM,WAAW;EACjB,yBAAyB,WAAW,2BAA2B;EAC/D,UAAU;GACR,gBAAgB,gBAAgB,SAAS;GACzC,mBAAmB,gBAAgB,SAAS;GAC5C,WAAW,gBAAgB,SAAS;GACpC,YAAY,SAAS,aAAa,gBAAgB,SAAS,cAA6B;;EAE1F,wBAAwB,EACtB,KAAK,EACH,SAAS;GACP,OAAO;GACP,QAAQ;;;;;;;;;AAYlB,SAAgB,uCAAuC,EACrD,YACA,iBAAiB,MACjB,kBAAkB,QAKe;CACjC,MAAM,OAAO,gCAAgC;CAC7C,MAAM,EAAE,mBAAmB,qBAAqB,yBAAyB;EACvE;EACA;EACA;;AAEF,QAAO;EACL,GAAG;EACH,wBAAwB,EACtB,KAAK,EACH,SAAS;GACP,OAAO;GACP,QAAQ;;;;AAOlB,SAAgB,yCAAyC,EACvD,YACA,iBAAiB,MACjB,kBAAkB,SAKiB;CACnC,MAAM,OAAO,kCAAkC;CAC/C,MAAM,EAAE,mBAAmB,qBAAqB,yBAAyB;EACvE;EACA;EACA;;AAEF,QAAO;EACL,GAAG;EACH,wBAAwB,EACtB,KAAK,EACH,SAAS;GACP,OAAO;GACP,QAAQ;;;;;;;;;AAkBlB,SAAgB,gCAAgC,OAAgD;AAC9F,KAAI,CAAC,SAAS,OAAQ,OAAM,IAAI,MAAM;CAEtC,MAAM,YAAY;CAClB,MAAMC,aAAsC,EAAE,GAAG;AAEjD,KAAI,CAAC,SAAS,WAAW,IAAK,OAAM,IAAI,MAAM;AAC9C,KAAI,CAAC,SAAS,WAAW,MAAO,OAAM,IAAI,MAAM;AAEhD,KAAI,CAAC,SAAS,WAAW,OAAQ,YAAW,QAAQ;AACpD,KAAI,WAAW,4BAA4B,UAAa,CAAC,SAAS,WAAW,yBAC3E,YAAW,0BAA0B,OAAO,WAAW;CAGzD,MAAMC,WAAoC,SAAS,WAAW,YAC1D,EAAE,GAAI,WAAW,aACjB;AAEJ,KAAI,CAAC,SAAS,SAAS,gBAAiB,UAAS,iBAAiB;AAClE,KAAI,CAAC,SAAS,SAAS,mBAAoB,UAAS,oBAAoB;AACxE,KAAI,CAAC,QAAgB,SAAS,YAAa,UAAS,aAAa;AAEjE,YAAW,WAAW;AACtB,YAAW,yBAAyB,gCAAgC,WAAW;AAE/E,QAAO;;;;;;;AAyCT,SAAgB,qBAAuD,YAAkB;CACvF,MAAMC,uBAA0B;EAC9B,GAAG;EACH,wBAAwB;GACtB,GAAG,WAAW;GACd,KAAK,EACH,SAAS;IACP,OAAO;IACP,QAAQ;;;;AAKhB,QAAO;;;;;;AAWT,SAAgB,mCAAmC,GAAiD;AAClG,KAAI,CAAC,SAAS,GAAI,QAAO;CACzB,MAAM,YAAY;AAOlB,KAAI,CAAC,SAAS,UAAU,OAAO,CAAC,SAAS,UAAU,UAAU,CAAC,SAAS,UAAU,MAC/E,QAAO;AAGT,KAAI,CAAC,SAAS,UAAU,UAAW,QAAO;CAC1C,MAAM,WAAW,UAAU;AAM3B,KAAI,CAAC,SAAS,SAAS,mBAAmB,CAAC,SAAS,SAAS,mBAC3D,QAAO;AAGT,QAAO,SAAS,cAAc,QAAQ,QAAQ,SAAS;;;;;;;AAQzD,SAAgB,qBAAqB,eAAmC;CACtE,MAAM,aAAa,iBAAiB;CACpC,MAAM,OAAO,IAAI,WAAW;CAC5B,MAAM,YAAY,IAAI,cAAc,OAAO;AAC3C,MAAK,IAAI,UAAU,MAAM,GAAG;AAC5B,QAAO;;;;;;;AAQT,SAAgB,oBAAoB,eAAmC;CACrE,MAAM,aAAa,gBAAgB;CACnC,MAAM,OAAO,IAAI,WAAW;CAC5B,MAAM,YAAY,IAAI,cAAc,OAAO;AAC3C,MAAK,IAAI,UAAU,MAAM,GAAG;AAC5B,QAAO;;;;;;;;;;AA+CT,SAAS,yBAAyB,EAChC,YACA,iBAAiB,MACjB,kBAAkB,SAKD;CAEjB,MAAM,mBAAmB,oBAAoB;CAG7C,MAAM,aAAa,wBAAwB;AAG3C,oBAAmB,YAAY,gBAAgB;CAG/C,MAAM,eAAe,iBAAiB,6BAA6B,WAAW,SAAS;CACvF,MAAM,gBAAgB,kBAAkB,6BAA6B,WAAW,UAAU;AAG1F,KAAI,kBAAkB,CAAC,aACrB,OAAM,IAAI,MAAM;AAElB,KAAI,mBAAmB,CAAC,cACtB,OAAM,IAAI,MAAM;AAGlB,QAAO;EACL,mBAAmB,gBAAgB;EACnC,kBAAkB,iBAAiB;;;;AAKvC,SAAS,oBAAoB,YAAoE;AAC/F,KAAI;EACF,MAAM,KAAM,WAA6D;AACzE,MAAI,OAAO,OAAO,WAChB,QAAO,GAAG,KAAK;SAEX;AAGR,QAAQ,WAAoD;;;AAI9D,SAAS,wBAAwB,kBAAwE;AACvG,KAAI;AACF,SAAO,kBAAkB,KAAK;SACxB;AACN,SAAO;;;;AAKX,SAAS,mBACP,YACA,eACA,gBACkC;AAClC,KAAI,CAAC,WACH,OAAM,IAAI,MAAM;CAKlB,MAAM,gBAAgB,WAAW,UAAU,UAAa,WAAW,WAAW;AAC9E,KAAI,CAAC,kBAAkB,iBAAiB,gBACtC,OAAM,IAAI,MAAM;;;AAKpB,SAAS,6BAA6B,OAAoC;AACxE,KAAI,CAAC,MAAO,QAAO;AAGnB,KAAI,OAAO,UAAU,SAAU,QAAO;AAGtC,KAAI,iBAAiB,YAAa,QAAO,gBAAgB;AAGzD,KAAI,YAAY,OAAO,OACrB,QAAO,gBAAgB,MAAM;AAI/B,KAAI;AACF,SAAO,gBAAgB;SACjB;AAEN,MAAI;AACF,UAAO,gBAAgB,IAAI,WAAW,OAA0B;UAC1D;AACN,UAAO;;;;;;;;;;;;;;;AAoBb,SAAS,gCAAgC,OAAuD;CAC9F,MAAMC,MAA6C,EACjD,KAAK,EAAE,SAAS;EAAE,OAAO;EAAW,QAAQ;;CAG9C,MAAM,MAAM,SAAS,SAAU,QAAoC;AAEnE,KAAI,OAAO,IAAI,UAAU,UAAW,KAAI,QAAQ,IAAI;AAEpD,KAAI,OAAO,IAAI,iBAAiB,UAAW,KAAI,eAAe,IAAI;AAElE,KAAI,OAAO,IAAI,qBAAqB,UAAW,KAAI,mBAAmB,IAAI;AAE1E,KAAI,SAAS,IAAI,YAAY;EAC3B,MAAM,KAAK,IAAI;EACf,MAAMC,QAAoC;AAC1C,MAAI,OAAO,GAAG,OAAO,UAAW,OAAM,KAAK,GAAG;AAC9C,MAAI,YAAY;;AAGlB,KAAI,QAAQ,IAAI,MAAM;EACpB,MAAM,SAAU,IAAI,IAAkB,OAAO,SAAS,KAAK,MAAM;GAC/D,MAAM,IAAI;GACV,MAAM,KAAK,OAAO,EAAE,OAAO,WAAY,EAAE,KAAgB;GACzD,MAAM,KAAK,OAAO,EAAE,OAAO,WAAY,EAAE,KAAgB;GACzD,MAAM,KAAK,OAAO,EAAE,OAAO,WAAY,EAAE,KAAgB;AACzD,UAAQ,OAAO,OAAO,YAAY,OAAO,OAAO,YAAY,OAAO,OAAO,WACtE;IAAC;IAAI;IAAI;OACT;KACH,QAAQ,MAAqC,MAAM,QAAQ;AAC9D,MAAI,OAAO,SAAS,EAAG,KAAI,MAAM;;AAGnC,KAAI,SAAS,IAAI,MAAM;EACrB,MAAM,MAAM,IAAI;EAChB,MAAM,UAAU,SAAS,IAAI,WAAY,IAAI,UAAsC;EACnF,MAAM,QAAQ,QAAQ;EACtB,MAAM,SAAS,QAAQ;AACvB,MAAI,MAAM,EACR,SAAS;GACP,OAAO,SAAS,SAAS,QAAQ;GACjC,QAAQ,SAAS,UAAU,SAAS;;;AAI1C,QAAO"}
+{"version":3,"file":"credentialsHelpers.js","names":["transports: string[]","normalized: Record<string, unknown>","response: Record<string, unknown>","response: unknown","out: AuthenticationExtensionsClientOutputs","outCp: CredentialPropertiesOutput"],"sources":["../../../../src/core/WebAuthnManager/credentialsHelpers.ts"],"sourcesContent":["import { base64UrlEncode } from \"../../utils\";\nimport { isObject, isString, isArray } from '@/utils/validation';\nimport {\n  type WebAuthnAuthenticationCredential,\n  type WebAuthnRegistrationCredential,\n  type AuthenticationExtensionsClientOutputs,\n  type CredentialPropertiesOutput,\n} from '../types/webauthn';\n\ntype SerializableCredential = WebAuthnAuthenticationCredential | WebAuthnRegistrationCredential;\n\n/**\n * Serialize PublicKeyCredential for both authentication and registration for WASM worker\n * - Uses base64url encoding for WASM compatibility\n *\n * @returns SerializableCredential - The serialized credential\n * - Does not return PRF outputs\n */\nexport function serializeRegistrationCredential(\n  credential: PublicKeyCredential,\n): WebAuthnRegistrationCredential {\n  const response = credential.response as AuthenticatorAttestationResponse;\n  // Safari and some platforms may not implement getTransports(); guard it.\n  let transports: string[] = [];\n  try {\n    const fn = (response as { getTransports?: () => string[] })?.getTransports;\n    if (typeof fn === 'function') {\n      transports = fn.call(response) || [];\n    }\n  } catch {\n    transports = [];\n  }\n\n  return {\n    id: credential.id,\n    rawId: base64UrlEncode(credential.rawId),\n    type: credential.type,\n    authenticatorAttachment: credential.authenticatorAttachment ?? undefined,\n    response: {\n      clientDataJSON: base64UrlEncode(response.clientDataJSON),\n      attestationObject: base64UrlEncode(response.attestationObject),\n      transports,\n    },\n    clientExtensionResults: {\n      prf: {\n        results: {\n          first: undefined,\n          second: undefined\n        }\n      }\n    },\n  };\n}\n\nexport function serializeAuthenticationCredential(\n  credential: PublicKeyCredential,\n): WebAuthnAuthenticationCredential {\n  const response = credential.response as AuthenticatorAssertionResponse;\n\n  return {\n    id: credential.id,\n    rawId: base64UrlEncode(credential.rawId),\n    type: credential.type,\n    authenticatorAttachment: credential.authenticatorAttachment ?? undefined,\n    response: {\n      clientDataJSON: base64UrlEncode(response.clientDataJSON),\n      authenticatorData: base64UrlEncode(response.authenticatorData),\n      signature: base64UrlEncode(response.signature),\n      userHandle: response.userHandle ? base64UrlEncode(response.userHandle as ArrayBuffer) : undefined,\n    },\n    clientExtensionResults: {\n      prf: {\n        results: {\n          first: undefined,\n          second: undefined\n        }\n      }\n    },\n  };\n}\n\n/**\n * Serialize PublicKeyCredential for both authentication and registration for WASM worker\n * @returns SerializableCredential - The serialized credential\n * - INCLUDES PRF outputs\n */\nexport function serializeRegistrationCredentialWithPRF({\n  credential,\n  firstPrfOutput = true,\n  secondPrfOutput = true,\n}: {\n  credential: PublicKeyCredential,\n  firstPrfOutput?: boolean,\n  secondPrfOutput?: boolean,\n}): WebAuthnRegistrationCredential {\n  const base = serializeRegistrationCredential(credential);\n  const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({\n    credential,\n    firstPrfOutput,\n    secondPrfOutput,\n  });\n  return {\n    ...base,\n    clientExtensionResults: {\n      prf: {\n        results: {\n          first: chacha20PrfOutput,\n          second: ed25519PrfOutput,\n        },\n      },\n    },\n  };\n}\n\nexport function serializeAuthenticationCredentialWithPRF({\n  credential,\n  firstPrfOutput = true,\n  secondPrfOutput = false,\n}: {\n  credential: PublicKeyCredential,\n  firstPrfOutput?: boolean,\n  secondPrfOutput?: boolean,\n}): WebAuthnAuthenticationCredential {\n  const base = serializeAuthenticationCredential(credential);\n  const { chacha20PrfOutput, ed25519PrfOutput } = extractPrfFromCredential({\n    credential,\n    firstPrfOutput,\n    secondPrfOutput,\n  });\n  return {\n    ...base,\n    clientExtensionResults: {\n      prf: {\n        results: {\n          first: chacha20PrfOutput,\n          second: ed25519PrfOutput,\n        },\n      },\n    },\n  };\n}\n\n/////////////////////////////////////////\n// RUNTIME VALIDATION / NORMALIZATION\n/////////////////////////////////////////\n\n// Use shared type guards (isString/isArray) from @/utils/validation\n\n/**\n * Validates and normalizes a serialized WebAuthn registration credential.\n * Ensures required fields exist and have the expected primitive types.\n * Populates missing optional arrays like transports with [].\n */\nexport function normalizeRegistrationCredential(input: unknown): WebAuthnRegistrationCredential {\n  if (!isObject(input)) throw new Error('Invalid credential: not an object');\n\n  const candidate = input as Record<string, unknown>;\n  const normalized: Record<string, unknown> = { ...candidate };\n\n  if (!isString(normalized.id)) throw new Error('Invalid credential.id');\n  if (!isString(normalized.type)) throw new Error('Invalid credential.type');\n\n  if (!isString(normalized.rawId)) normalized.rawId = '';\n  if (normalized.authenticatorAttachment !== undefined && !isString(normalized.authenticatorAttachment)) {\n    normalized.authenticatorAttachment = String(normalized.authenticatorAttachment);\n  }\n\n  const response: Record<string, unknown> = isObject(normalized.response)\n    ? { ...(normalized.response as Record<string, unknown>) }\n    : {};\n\n  if (!isString(response.clientDataJSON)) response.clientDataJSON = '';\n  if (!isString(response.attestationObject)) response.attestationObject = '';\n  if (!isArray<string>(response.transports)) response.transports = [];\n\n  normalized.response = response;\n  normalized.clientExtensionResults = normalizeClientExtensionOutputs(normalized.clientExtensionResults);\n\n  return normalized as unknown as WebAuthnRegistrationCredential;\n}\n\n/**\n * Validates and normalizes a serialized WebAuthn authentication credential.\n * Ensures required fields exist and have the expected primitive types.\n */\nexport function normalizeAuthenticationCredential(input: unknown): WebAuthnAuthenticationCredential {\n  if (!isObject(input)) throw new Error('Invalid credential: not an object');\n\n  const candidate = input as Record<string, unknown>;\n  const normalized: Record<string, unknown> = { ...candidate };\n\n  if (!isString(normalized.id)) throw new Error('Invalid credential.id');\n  if (!isString(normalized.type)) throw new Error('Invalid credential.type');\n\n  if (!isString(normalized.rawId)) normalized.rawId = '';\n  if (normalized.authenticatorAttachment !== undefined && !isString(normalized.authenticatorAttachment)) {\n    normalized.authenticatorAttachment = String(normalized.authenticatorAttachment);\n  }\n\n  const response: Record<string, unknown> = isObject(normalized.response)\n    ? { ...(normalized.response as Record<string, unknown>) }\n    : {};\n\n  if (!isString(response.clientDataJSON)) response.clientDataJSON = '';\n  if (!isString(response.authenticatorData)) response.authenticatorData = '';\n  if (!isString(response.signature)) response.signature = '';\n  if (response.userHandle !== undefined && !isString(response.userHandle)) response.userHandle = undefined;\n\n  normalized.response = response;\n  normalized.clientExtensionResults = normalizeClientExtensionOutputs(normalized.clientExtensionResults);\n\n  return normalized as unknown as WebAuthnAuthenticationCredential;\n}\n\n/**\n * Redacts client extension outputs from the credential before sending it over the network.\n *\n * Motivation:\n * - WebAuthn `clientExtensionResults` may contain sensitive material (e.g. PRF outputs).\n * - Even when not sensitive, extension outputs can add fingerprinting surface and bloat payloads.\n *\n * @param credential - The WebAuthn credential potentially containing extension outputs\n * @returns Credential with `clientExtensionResults` removed/redacted\n */\nexport function removePrfOutputGuard<C extends SerializableCredential>(credential: C): C {\n  // Never leak PRF (or any other extension outputs) outside the wallet runtime.\n  // Use `null` so the field is explicitly redacted in JSON payloads.\n  const response: unknown = (credential as { response?: unknown }).response;\n  const responseWithoutExtensions = isObject(response)\n    ? (() => {\n      const cloned = { ...(response as Record<string, unknown>) };\n      if ('clientExtensionResults' in cloned) cloned.clientExtensionResults = null;\n      return cloned;\n    })()\n    : response;\n\n  return {\n    ...credential,\n    response: responseWithoutExtensions,\n    clientExtensionResults: null ,\n  } as C;\n}\n\n/////////////////////////////////////////\n// TYPE GUARDS\n/////////////////////////////////////////\n\n/**\n * Returns true when the input looks like a serialized registration credential\n * (i.e., plain object with base64url string fields), not a live PublicKeyCredential.\n */\nexport function isSerializedRegistrationCredential(x: unknown): x is WebAuthnRegistrationCredential {\n  if (!isObject(x)) return false;\n  const candidate = x as {\n    id?: unknown;\n    rawId?: unknown;\n    type?: unknown;\n    response?: unknown;\n  };\n\n  if (!isString(candidate.id) || !isString(candidate.rawId) || !isString(candidate.type)) {\n    return false;\n  }\n\n  if (!isObject(candidate.response)) return false;\n  const response = candidate.response as {\n    clientDataJSON?: unknown;\n    attestationObject?: unknown;\n    transports?: unknown;\n  };\n\n  if (!isString(response.clientDataJSON) || !isString(response.attestationObject)) {\n    return false;\n  }\n\n  return response.transports == null || isArray(response.transports);\n}\n\n/**\n * Generate ChaCha20Poly1305 salt using account-specific HKDF for encryption key derivation\n * @param nearAccountId - NEAR account ID to scope the salt to\n * @returns 32-byte Uint8Array salt for ChaCha20Poly1305 key derivation\n */\nexport function generateChaCha20Salt(nearAccountId: string): Uint8Array {\n  const saltString = `chacha20-salt:${nearAccountId}`;\n  const salt = new Uint8Array(32);\n  const saltBytes = new TextEncoder().encode(saltString);\n  salt.set(saltBytes.slice(0, 32));\n  return salt;\n}\n\n/**\n * Generate Ed25519 salt using account-specific HKDF for signing key derivation\n * @param nearAccountId - NEAR account ID to scope the salt to\n * @returns 32-byte Uint8Array salt for Ed25519 key derivation\n */\nexport function generateEd25519Salt(nearAccountId: string): Uint8Array {\n  const saltString = `ed25519-salt:${nearAccountId}`;\n  const salt = new Uint8Array(32);\n  const saltBytes = new TextEncoder().encode(saltString);\n  salt.set(saltBytes.slice(0, 32));\n  return salt;\n}\n\n/** Credential that may have extension results (live or serialized) */\ntype CredentialWithExtensions =\n  | PublicKeyCredential\n  | {\n      clientExtensionResults?: unknown;\n      getClientExtensionResults?: () => unknown;\n    };\n\n/** Extension results structure - flexible to handle both live and serialized forms */\ntype ExtensionResults = {\n  prf?: {\n    enabled?: boolean;\n    results?: {\n      first?: unknown;\n      second?: unknown;\n    };\n  };\n  [key: string]: unknown;\n};\n\n/** PRF output values after extraction */\ntype PrfOutputs = {\n  first?: unknown;\n  second?: unknown;\n};\n\n/**\n * Dual PRF outputs for separate encryption and signing key derivation\n */\ninterface DualPrfOutputs {\n  /** Base64-encoded PRF output from prf.results.first for ChaCha20Poly1305 encryption */\n  chacha20PrfOutput: string;\n  /** Base64-encoded PRF output from prf.results.second for Ed25519 signing */\n  ed25519PrfOutput: string;\n}\n\n/**\n * Extract PRF outputs from WebAuthn credential extension results\n * ENCODING: Uses base64url for WASM compatibility\n * @param credential - WebAuthn credential with dual PRF extension results\n * @param firstPrfOutput - Whether to include the first PRF output (default: true)\n * @param secondPrfOutput - Whether to include the second PRF output (default: false)\n * @returns PRF outputs\n */\nfunction extractPrfFromCredential({\n  credential,\n  firstPrfOutput = true,\n  secondPrfOutput = false,\n}: {\n  credential: CredentialWithExtensions;\n  firstPrfOutput?: boolean | undefined;\n  secondPrfOutput?: boolean;\n}): DualPrfOutputs {\n  // Step 1: Get extension results (support both live and serialized credentials)\n  const extensionResults = getExtensionResults(credential);\n\n  // Step 2: Extract PRF results object\n  const prfResults = extractPrfResultsObject(extensionResults);\n\n  // Step 3: Validate PRF results exist and are not empty\n  validatePrfResults(prfResults, firstPrfOutput, secondPrfOutput);\n\n  // Step 4: Normalize and encode PRF outputs\n  const firstEncoded = firstPrfOutput ? normalizePrfValueToBase64Url(prfResults.first) : undefined;\n  const secondEncoded = secondPrfOutput ? normalizePrfValueToBase64Url(prfResults.second) : undefined;\n\n  // Step 5: Validate required outputs are present\n  if (firstPrfOutput && !firstEncoded) {\n    throw new Error('Missing PRF result: first');\n  }\n  if (secondPrfOutput && !secondEncoded) {\n    throw new Error('Missing PRF result: second');\n  }\n\n  return {\n    chacha20PrfOutput: firstEncoded || '',\n    ed25519PrfOutput: secondEncoded || '',\n  };\n}\n\n/** Get extension results from credential (live or serialized) */\nfunction getExtensionResults(credential: CredentialWithExtensions): ExtensionResults | undefined {\n  try {\n    const fn = (credential as { getClientExtensionResults?: () => unknown }).getClientExtensionResults;\n    if (typeof fn === 'function') {\n      return fn.call(credential) as ExtensionResults;\n    }\n  } catch {\n    // Fall through to direct property access\n  }\n  return (credential as { clientExtensionResults?: unknown }).clientExtensionResults as ExtensionResults | undefined;\n}\n\n/** Extract PRF results object from extension results */\nfunction extractPrfResultsObject(extensionResults: ExtensionResults | undefined): PrfOutputs | undefined {\n  try {\n    return extensionResults?.prf?.results;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Validate PRF results are present and not empty */\nfunction validatePrfResults(\n  prfResults: PrfOutputs | undefined,\n  firstRequired: boolean,\n  secondRequired: boolean\n): asserts prfResults is PrfOutputs {\n  if (!prfResults) {\n    throw new Error('Missing PRF results from credential, use a PRF-enabled Authenticator');\n  }\n\n  // Check if PRF results object exists but is completely empty\n  // This indicates a hard failure (not a platform limitation that should trigger GET fallback)\n  const hasAnyPrfData = prfResults.first !== undefined || prfResults.second !== undefined;\n  if (!hasAnyPrfData && (firstRequired || secondRequired)) {\n    throw new Error('Missing PRF result - PRF evaluation failed: results object is empty');\n  }\n}\n\n/** Normalize a PRF value to base64url string */\nfunction normalizePrfValueToBase64Url(value: unknown): string | undefined {\n  if (!value) return undefined;\n\n  // Already base64url encoded\n  if (typeof value === 'string') return value;\n\n  // ArrayBuffer\n  if (value instanceof ArrayBuffer) return base64UrlEncode(value);\n\n  // ArrayBufferView (TypedArray, DataView)\n  if (ArrayBuffer.isView(value)) {\n    return base64UrlEncode(value.buffer);\n  }\n\n  // Try to treat as ArrayBuffer-like\n  try {\n    return base64UrlEncode(value as ArrayBufferLike);\n  } catch {\n    // Last resort: wrap in Uint8Array\n    try {\n      return base64UrlEncode(new Uint8Array(value as ArrayBufferLike).buffer);\n    } catch {\n      return undefined;\n    }\n  }\n}\n\n/////////////////////////////////////////\n// EXTENSION OUTPUTS NORMALIZATION\n/////////////////////////////////////////\n\n/**\n * Normalize WebAuthn client extension outputs into an SDK‑local, clone‑safe shape.\n *\n * Purpose:\n * - Browsers return extension results on PublicKeyCredential in a variety of\n *   shapes and with optional presence. This helper takes an unknown value\n *   (either a live `credential.getClientExtensionResults()` object or a\n *   serialized snapshot) and produces a strictly typed\n *   `AuthenticationExtensionsClientOutputs` compatible with our WASM workers\n *   and cross‑window message passing (structured‑clone safe).\n */\nfunction normalizeClientExtensionOutputs(input: unknown): AuthenticationExtensionsClientOutputs {\n  const out: AuthenticationExtensionsClientOutputs = {\n    prf: { results: { first: undefined, second: undefined } },\n  } as AuthenticationExtensionsClientOutputs;\n\n  const src = isObject(input) ? (input as Record<string, unknown>) : {};\n  // appid\n  if (typeof src.appid === 'boolean') out.appid = src.appid as boolean;\n  // appidExclude\n  if (typeof src.appidExclude === 'boolean') out.appidExclude = src.appidExclude as boolean;\n  // hmacCreateSecret\n  if (typeof src.hmacCreateSecret === 'boolean') out.hmacCreateSecret = src.hmacCreateSecret as boolean;\n  // credProps\n  if (isObject(src.credProps)) {\n    const cp = src.credProps as Record<string, unknown>;\n    const outCp: CredentialPropertiesOutput = {};\n    if (typeof cp.rk === 'boolean') outCp.rk = cp.rk as boolean;\n    out.credProps = outCp;\n  }\n  // uvm: expect array of 3-number tuples; tolerate nested arrays loosely\n  if (isArray(src.uvm)) {\n    const uvmArr = (src.uvm as unknown[]).filter(isArray).map((t) => {\n      const a = t as unknown[];\n      const n0 = typeof a[0] === 'number' ? (a[0] as number) : undefined;\n      const n1 = typeof a[1] === 'number' ? (a[1] as number) : undefined;\n      const n2 = typeof a[2] === 'number' ? (a[2] as number) : undefined;\n      return (typeof n0 === 'number' && typeof n1 === 'number' && typeof n2 === 'number')\n        ? [n0, n1, n2] as [number, number, number]\n        : undefined;\n    }).filter((x): x is [number, number, number] => Array.isArray(x));\n    if (uvmArr.length > 0) out.uvm = uvmArr;\n  }\n  // prf\n  if (isObject(src.prf)) {\n    const prf = src.prf as Record<string, unknown>;\n    const results = isObject(prf.results) ? (prf.results as Record<string, unknown>) : {};\n    const first = results.first;\n    const second = results.second;\n    out.prf = {\n      results: {\n        first: isString(first) ? first : undefined,\n        second: isString(second) ? second : undefined,\n      },\n    };\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;AAkBA,SAAgB,gCACd,YACgC;CAChC,MAAM,WAAW,WAAW;CAE5B,IAAIA,aAAuB;AAC3B,KAAI;EACF,MAAM,KAAM,UAAiD;AAC7D,MAAI,OAAO,OAAO,WAChB,cAAa,GAAG,KAAK,aAAa;SAE9B;AACN,eAAa;;AAGf,QAAO;EACL,IAAI,WAAW;EACf,OAAO,gBAAgB,WAAW;EAClC,MAAM,WAAW;EACjB,yBAAyB,WAAW,2BAA2B;EAC/D,UAAU;GACR,gBAAgB,gBAAgB,SAAS;GACzC,mBAAmB,gBAAgB,SAAS;GAC5C;;EAEF,wBAAwB,EACtB,KAAK,EACH,SAAS;GACP,OAAO;GACP,QAAQ;;;;AAOlB,SAAgB,kCACd,YACkC;CAClC,MAAM,WAAW,WAAW;AAE5B,QAAO;EACL,IAAI,WAAW;EACf,OAAO,gBAAgB,WAAW;EAClC,MAAM,WAAW;EACjB,yBAAyB,WAAW,2BAA2B;EAC/D,UAAU;GACR,gBAAgB,gBAAgB,SAAS;GACzC,mBAAmB,gBAAgB,SAAS;GAC5C,WAAW,gBAAgB,SAAS;GACpC,YAAY,SAAS,aAAa,gBAAgB,SAAS,cAA6B;;EAE1F,wBAAwB,EACtB,KAAK,EACH,SAAS;GACP,OAAO;GACP,QAAQ;;;;;;;;;AAYlB,SAAgB,uCAAuC,EACrD,YACA,iBAAiB,MACjB,kBAAkB,QAKe;CACjC,MAAM,OAAO,gCAAgC;CAC7C,MAAM,EAAE,mBAAmB,qBAAqB,yBAAyB;EACvE;EACA;EACA;;AAEF,QAAO;EACL,GAAG;EACH,wBAAwB,EACtB,KAAK,EACH,SAAS;GACP,OAAO;GACP,QAAQ;;;;AAOlB,SAAgB,yCAAyC,EACvD,YACA,iBAAiB,MACjB,kBAAkB,SAKiB;CACnC,MAAM,OAAO,kCAAkC;CAC/C,MAAM,EAAE,mBAAmB,qBAAqB,yBAAyB;EACvE;EACA;EACA;;AAEF,QAAO;EACL,GAAG;EACH,wBAAwB,EACtB,KAAK,EACH,SAAS;GACP,OAAO;GACP,QAAQ;;;;;;;;;AAkBlB,SAAgB,gCAAgC,OAAgD;AAC9F,KAAI,CAAC,SAAS,OAAQ,OAAM,IAAI,MAAM;CAEtC,MAAM,YAAY;CAClB,MAAMC,aAAsC,EAAE,GAAG;AAEjD,KAAI,CAAC,SAAS,WAAW,IAAK,OAAM,IAAI,MAAM;AAC9C,KAAI,CAAC,SAAS,WAAW,MAAO,OAAM,IAAI,MAAM;AAEhD,KAAI,CAAC,SAAS,WAAW,OAAQ,YAAW,QAAQ;AACpD,KAAI,WAAW,4BAA4B,UAAa,CAAC,SAAS,WAAW,yBAC3E,YAAW,0BAA0B,OAAO,WAAW;CAGzD,MAAMC,WAAoC,SAAS,WAAW,YAC1D,EAAE,GAAI,WAAW,aACjB;AAEJ,KAAI,CAAC,SAAS,SAAS,gBAAiB,UAAS,iBAAiB;AAClE,KAAI,CAAC,SAAS,SAAS,mBAAoB,UAAS,oBAAoB;AACxE,KAAI,CAAC,QAAgB,SAAS,YAAa,UAAS,aAAa;AAEjE,YAAW,WAAW;AACtB,YAAW,yBAAyB,gCAAgC,WAAW;AAE/E,QAAO;;;;;;;;;;;;AA8CT,SAAgB,qBAAuD,YAAkB;CAGvF,MAAMC,WAAqB,WAAsC;CACjE,MAAM,4BAA4B,SAAS,mBAChC;EACP,MAAM,SAAS,EAAE,GAAI;AACrB,MAAI,4BAA4B,OAAQ,QAAO,yBAAyB;AACxE,SAAO;QAEP;AAEJ,QAAO;EACL,GAAG;EACH,UAAU;EACV,wBAAwB;;;;;;;AAY5B,SAAgB,mCAAmC,GAAiD;AAClG,KAAI,CAAC,SAAS,GAAI,QAAO;CACzB,MAAM,YAAY;AAOlB,KAAI,CAAC,SAAS,UAAU,OAAO,CAAC,SAAS,UAAU,UAAU,CAAC,SAAS,UAAU,MAC/E,QAAO;AAGT,KAAI,CAAC,SAAS,UAAU,UAAW,QAAO;CAC1C,MAAM,WAAW,UAAU;AAM3B,KAAI,CAAC,SAAS,SAAS,mBAAmB,CAAC,SAAS,SAAS,mBAC3D,QAAO;AAGT,QAAO,SAAS,cAAc,QAAQ,QAAQ,SAAS;;;;;;;AAQzD,SAAgB,qBAAqB,eAAmC;CACtE,MAAM,aAAa,iBAAiB;CACpC,MAAM,OAAO,IAAI,WAAW;CAC5B,MAAM,YAAY,IAAI,cAAc,OAAO;AAC3C,MAAK,IAAI,UAAU,MAAM,GAAG;AAC5B,QAAO;;;;;;;AAQT,SAAgB,oBAAoB,eAAmC;CACrE,MAAM,aAAa,gBAAgB;CACnC,MAAM,OAAO,IAAI,WAAW;CAC5B,MAAM,YAAY,IAAI,cAAc,OAAO;AAC3C,MAAK,IAAI,UAAU,MAAM,GAAG;AAC5B,QAAO;;;;;;;;;;AA+CT,SAAS,yBAAyB,EAChC,YACA,iBAAiB,MACjB,kBAAkB,SAKD;CAEjB,MAAM,mBAAmB,oBAAoB;CAG7C,MAAM,aAAa,wBAAwB;AAG3C,oBAAmB,YAAY,gBAAgB;CAG/C,MAAM,eAAe,iBAAiB,6BAA6B,WAAW,SAAS;CACvF,MAAM,gBAAgB,kBAAkB,6BAA6B,WAAW,UAAU;AAG1F,KAAI,kBAAkB,CAAC,aACrB,OAAM,IAAI,MAAM;AAElB,KAAI,mBAAmB,CAAC,cACtB,OAAM,IAAI,MAAM;AAGlB,QAAO;EACL,mBAAmB,gBAAgB;EACnC,kBAAkB,iBAAiB;;;;AAKvC,SAAS,oBAAoB,YAAoE;AAC/F,KAAI;EACF,MAAM,KAAM,WAA6D;AACzE,MAAI,OAAO,OAAO,WAChB,QAAO,GAAG,KAAK;SAEX;AAGR,QAAQ,WAAoD;;;AAI9D,SAAS,wBAAwB,kBAAwE;AACvG,KAAI;AACF,SAAO,kBAAkB,KAAK;SACxB;AACN,SAAO;;;;AAKX,SAAS,mBACP,YACA,eACA,gBACkC;AAClC,KAAI,CAAC,WACH,OAAM,IAAI,MAAM;CAKlB,MAAM,gBAAgB,WAAW,UAAU,UAAa,WAAW,WAAW;AAC9E,KAAI,CAAC,kBAAkB,iBAAiB,gBACtC,OAAM,IAAI,MAAM;;;AAKpB,SAAS,6BAA6B,OAAoC;AACxE,KAAI,CAAC,MAAO,QAAO;AAGnB,KAAI,OAAO,UAAU,SAAU,QAAO;AAGtC,KAAI,iBAAiB,YAAa,QAAO,gBAAgB;AAGzD,KAAI,YAAY,OAAO,OACrB,QAAO,gBAAgB,MAAM;AAI/B,KAAI;AACF,SAAO,gBAAgB;SACjB;AAEN,MAAI;AACF,UAAO,gBAAgB,IAAI,WAAW,OAA0B;UAC1D;AACN,UAAO;;;;;;;;;;;;;;;AAoBb,SAAS,gCAAgC,OAAuD;CAC9F,MAAMC,MAA6C,EACjD,KAAK,EAAE,SAAS;EAAE,OAAO;EAAW,QAAQ;;CAG9C,MAAM,MAAM,SAAS,SAAU,QAAoC;AAEnE,KAAI,OAAO,IAAI,UAAU,UAAW,KAAI,QAAQ,IAAI;AAEpD,KAAI,OAAO,IAAI,iBAAiB,UAAW,KAAI,eAAe,IAAI;AAElE,KAAI,OAAO,IAAI,qBAAqB,UAAW,KAAI,mBAAmB,IAAI;AAE1E,KAAI,SAAS,IAAI,YAAY;EAC3B,MAAM,KAAK,IAAI;EACf,MAAMC,QAAoC;AAC1C,MAAI,OAAO,GAAG,OAAO,UAAW,OAAM,KAAK,GAAG;AAC9C,MAAI,YAAY;;AAGlB,KAAI,QAAQ,IAAI,MAAM;EACpB,MAAM,SAAU,IAAI,IAAkB,OAAO,SAAS,KAAK,MAAM;GAC/D,MAAM,IAAI;GACV,MAAM,KAAK,OAAO,EAAE,OAAO,WAAY,EAAE,KAAgB;GACzD,MAAM,KAAK,OAAO,EAAE,OAAO,WAAY,EAAE,KAAgB;GACzD,MAAM,KAAK,OAAO,EAAE,OAAO,WAAY,EAAE,KAAgB;AACzD,UAAQ,OAAO,OAAO,YAAY,OAAO,OAAO,YAAY,OAAO,OAAO,WACtE;IAAC;IAAI;IAAI;OACT;KACH,QAAQ,MAAqC,MAAM,QAAQ;AAC9D,MAAI,OAAO,SAAS,EAAG,KAAI,MAAM;;AAGnC,KAAI,SAAS,IAAI,MAAM;EACrB,MAAM,MAAM,IAAI;EAChB,MAAM,UAAU,SAAS,IAAI,WAAY,IAAI,UAAsC;EACnF,MAAM,QAAQ,QAAQ;EACtB,MAAM,SAAS,QAAQ;AACvB,MAAI,MAAM,EACR,SAAS;GACP,OAAO,SAAS,SAAS,QAAQ;GACjC,QAAQ,SAAS,UAAU,SAAS;;;AAI1C,QAAO"}