@veridex/sdk 1.1.4 → 1.1.6

package/dist/{EVMClient-Bmy9czkE.d.mts → EVMClient-CTOtNY8I.d.mts}

@@ -1,6 +1,6 @@
 import { RegisterSessionParams, SessionValidationResult, RevokeSessionParams, SessionKey, IdentityState } from './types.mjs';
 import { ethers } from 'ethers';
-import { C as ChainClient, a as ChainConfig, T as TransferParams, E as ExecuteParams, B as BridgeParams, W as WebAuthnSignature, D as DispatchResult, V as VaultCreationResult } from './types-DP2CQT8p.mjs';
+import { C as ChainClient, a as ChainConfig, T as TransferParams, E as ExecuteParams, B as BridgeParams, W as WebAuthnSignature, D as DispatchResult, V as VaultCreationResult } from './types-DQ5dtU9x.mjs';
 
 interface EVMClientConfig {
     chainId: number;

package/dist/auth/prepareAuth.d.mts

@@ -1,4 +1,4 @@
-import { P as PasskeyCredential, T as TransferParams, E as ExecuteParams, B as BridgeParams } from '../types-DP2CQT8p.mjs';
+import { P as PasskeyCredential, T as TransferParams, E as ExecuteParams, B as BridgeParams } from '../types-DQ5dtU9x.mjs';
 
 type AuthenticateAndPrepareParams = {
     credential: PasskeyCredential;

package/dist/auth/prepareAuth.js

@@ -499,7 +499,8 @@ var PasskeyManager = class _PasskeyManager {
       credentialId: response.id,
       publicKeyX: publicKey.x,
       publicKeyY: publicKey.y,
-      keyHash
+      keyHash,
+      assurance: _PasskeyManager.assuranceFromRegistration(response) ?? void 0
     };
     return this.credential;
   }
@@ -878,7 +879,8 @@ var PasskeyManager = class _PasskeyManager {
       credentialId: response.id,
       publicKeyX: publicKey.x,
       publicKeyY: publicKey.y,
-      keyHash
+      keyHash,
+      assurance: _PasskeyManager.assuranceFromRegistration(response) ?? void 0
     };
     this.addCredentialToStorage(backupCredential);
     return backupCredential;
@@ -895,17 +897,94 @@ var PasskeyManager = class _PasskeyManager {
    */
   static parseBackupFlags(authenticatorData) {
     try {
-      const data = import_ethers2.ethers.getBytes(authenticatorData);
-      if (data.length < 37) return null;
-      const flags = data[32];
+      const assurance = _PasskeyManager.deriveAssurance(import_ethers2.ethers.getBytes(authenticatorData));
+      if (!assurance) return null;
       return {
-        backupEligible: (flags & 8) !== 0,
-        backupState: (flags & 16) !== 0
+        backupEligible: assurance.backupEligible,
+        backupState: assurance.backupState
       };
     } catch {
       return null;
     }
   }
+  /**
+   * Derive credential assurance from raw WebAuthn authenticator data.
+   *
+   * authData layout:
+   *   rpIdHash (32) | flags (1) | signCount (4) | [attestedCredentialData: aaguid (16) | ...]
+   *
+   * Flags byte: UP 0x01 | UV 0x04 | BE 0x08 | BS 0x10 | AT 0x40 | ED 0x80
+   *
+   * BE is the authoritative signal for whether a credential is device-bound or
+   * syncable. It is set by the authenticator itself — unlike a platform/user-agent
+   * guess, it correctly identifies a hardware key used on a syncing platform.
+   *
+   * @returns Assurance, or `null` if authData is too short to be valid.
+   */
+  static deriveAssurance(authData) {
+    if (authData.length < 37) return null;
+    const flags = authData[32];
+    const backupEligible = (flags & 8) !== 0;
+    const attestedCredentialData = (flags & 64) !== 0;
+    let aaguid;
+    if (attestedCredentialData && authData.length >= 53) {
+      aaguid = import_ethers2.ethers.hexlify(authData.slice(37, 53));
+    }
+    return {
+      backupEligible,
+      backupState: (flags & 16) !== 0,
+      userVerified: (flags & 4) !== 0,
+      level: backupEligible ? "synced" : "device-bound",
+      aaguid
+    };
+  }
+  /**
+   * Extract raw authenticator data from a registration response.
+   *
+   * Prefers the `authenticatorData` field when the authenticator provides it,
+   * and otherwise locates the `authData` byte string inside the CBOR
+   * attestation object.
+   */
+  static extractAuthData(response) {
+    const direct = response.response.authenticatorData;
+    if (direct) {
+      try {
+        return base64URLDecode(direct);
+      } catch {
+      }
+    }
+    try {
+      const attestationObject = base64URLDecode(response.response.attestationObject);
+      let offset = 0;
+      if (attestationObject[offset] >= 160 && attestationObject[offset] <= 191) {
+        offset++;
+      }
+      const key = [104, 97, 117, 116, 104, 68, 97, 116, 97];
+      let found = false;
+      while (offset < attestationObject.length - 37) {
+        if (key.every((byte, i) => attestationObject[offset + i] === byte)) {
+          offset += key.length;
+          found = true;
+          break;
+        }
+        offset++;
+      }
+      if (!found) return null;
+      if (attestationObject[offset] === 88) {
+        offset += 2;
+      } else if (attestationObject[offset] === 89) {
+        offset += 3;
+      }
+      return attestationObject.slice(offset);
+    } catch {
+      return null;
+    }
+  }
+  /** Derive assurance directly from a registration response. */
+  static assuranceFromRegistration(response) {
+    const authData = _PasskeyManager.extractAuthData(response);
+    return authData ? _PasskeyManager.deriveAssurance(authData) : null;
+  }
   /**
    * Get the number of credentials stored locally.
    */