@veridex/sdk 1.1.4 → 1.1.6

package/dist/index.js

@@ -770,7 +770,8 @@ var init_PasskeyManager = __esm({
           credentialId: response.id,
           publicKeyX: publicKey.x,
           publicKeyY: publicKey.y,
-          keyHash
+          keyHash,
+          assurance: _PasskeyManager.assuranceFromRegistration(response) ?? void 0
         };
         return this.credential;
       }
@@ -1149,7 +1150,8 @@ var init_PasskeyManager = __esm({
           credentialId: response.id,
           publicKeyX: publicKey.x,
           publicKeyY: publicKey.y,
-          keyHash
+          keyHash,
+          assurance: _PasskeyManager.assuranceFromRegistration(response) ?? void 0
         };
         this.addCredentialToStorage(backupCredential);
         return backupCredential;
@@ -1166,17 +1168,94 @@ var init_PasskeyManager = __esm({
        */
       static parseBackupFlags(authenticatorData) {
         try {
-          const data = import_ethers2.ethers.getBytes(authenticatorData);
-          if (data.length < 37) return null;
-          const flags = data[32];
+          const assurance = _PasskeyManager.deriveAssurance(import_ethers2.ethers.getBytes(authenticatorData));
+          if (!assurance) return null;
           return {
-            backupEligible: (flags & 8) !== 0,
-            backupState: (flags & 16) !== 0
+            backupEligible: assurance.backupEligible,
+            backupState: assurance.backupState
           };
         } catch {
           return null;
         }
       }
+      /**
+       * Derive credential assurance from raw WebAuthn authenticator data.
+       *
+       * authData layout:
+       *   rpIdHash (32) | flags (1) | signCount (4) | [attestedCredentialData: aaguid (16) | ...]
+       *
+       * Flags byte: UP 0x01 | UV 0x04 | BE 0x08 | BS 0x10 | AT 0x40 | ED 0x80
+       *
+       * BE is the authoritative signal for whether a credential is device-bound or
+       * syncable. It is set by the authenticator itself — unlike a platform/user-agent
+       * guess, it correctly identifies a hardware key used on a syncing platform.
+       *
+       * @returns Assurance, or `null` if authData is too short to be valid.
+       */
+      static deriveAssurance(authData) {
+        if (authData.length < 37) return null;
+        const flags = authData[32];
+        const backupEligible = (flags & 8) !== 0;
+        const attestedCredentialData = (flags & 64) !== 0;
+        let aaguid;
+        if (attestedCredentialData && authData.length >= 53) {
+          aaguid = import_ethers2.ethers.hexlify(authData.slice(37, 53));
+        }
+        return {
+          backupEligible,
+          backupState: (flags & 16) !== 0,
+          userVerified: (flags & 4) !== 0,
+          level: backupEligible ? "synced" : "device-bound",
+          aaguid
+        };
+      }
+      /**
+       * Extract raw authenticator data from a registration response.
+       *
+       * Prefers the `authenticatorData` field when the authenticator provides it,
+       * and otherwise locates the `authData` byte string inside the CBOR
+       * attestation object.
+       */
+      static extractAuthData(response) {
+        const direct = response.response.authenticatorData;
+        if (direct) {
+          try {
+            return base64URLDecode(direct);
+          } catch {
+          }
+        }
+        try {
+          const attestationObject = base64URLDecode(response.response.attestationObject);
+          let offset = 0;
+          if (attestationObject[offset] >= 160 && attestationObject[offset] <= 191) {
+            offset++;
+          }
+          const key = [104, 97, 117, 116, 104, 68, 97, 116, 97];
+          let found = false;
+          while (offset < attestationObject.length - 37) {
+            if (key.every((byte, i) => attestationObject[offset + i] === byte)) {
+              offset += key.length;
+              found = true;
+              break;
+            }
+            offset++;
+          }
+          if (!found) return null;
+          if (attestationObject[offset] === 88) {
+            offset += 2;
+          } else if (attestationObject[offset] === 89) {
+            offset += 3;
+          }
+          return attestationObject.slice(offset);
+        } catch {
+          return null;
+        }
+      }
+      /** Derive assurance directly from a registration response. */
+      static assuranceFromRegistration(response) {
+        const authData = _PasskeyManager.extractAuthData(response);
+        return authData ? _PasskeyManager.deriveAssurance(authData) : null;
+      }
       /**
        * Get the number of credentials stored locally.
        */
@@ -12602,9 +12681,11 @@ var VeridexSDK = class {
       throw new VeridexError("VAULT_NOT_FOUND" /* VAULT_NOT_FOUND */, "Identity not registered. Call registerIdentity() first.");
     }
     const nonce = await this.chain.getNonce(state.identity);
+    const addKeyChainConfig = this.chain.getConfig();
+    const addKeyHubChainId = addKeyChainConfig.hubChainId ?? addKeyChainConfig.wormholeChainId;
     const packedChallenge = import_ethers15.ethers.solidityPacked(
-      ["string", "bytes32", "bytes32", "uint256"],
-      ["VERIDEX_ADD_KEY", state.identity, newCredential.keyHash, nonce]
+      ["string", "bytes32", "bytes32", "uint256", "uint16"],
+      ["VERIDEX_ADD_KEY", state.identity, newCredential.keyHash, nonce, addKeyHubChainId]
     );
     const signature = await this.passkey.sign(import_ethers15.ethers.getBytes(packedChallenge));
     if (!signer) {
@@ -12660,9 +12741,11 @@ var VeridexSDK = class {
       throw new VeridexError("VAULT_NOT_FOUND" /* VAULT_NOT_FOUND */, "Identity not registered. Call registerIdentity() first.");
     }
     const nonce = await this.chain.getNonce(state.identity);
+    const removeKeyChainConfig = this.chain.getConfig();
+    const removeKeyHubChainId = removeKeyChainConfig.hubChainId ?? removeKeyChainConfig.wormholeChainId;
     const packedChallenge = import_ethers15.ethers.solidityPacked(
-      ["string", "bytes32", "bytes32", "uint256"],
-      ["VERIDEX_REMOVE_KEY", state.identity, keyToRemove, nonce]
+      ["string", "bytes32", "bytes32", "uint256", "uint16"],
+      ["VERIDEX_REMOVE_KEY", state.identity, keyToRemove, nonce, removeKeyHubChainId]
     );
     const signature = await this.passkey.sign(import_ethers15.ethers.getBytes(packedChallenge));
     const { receipt, sequence } = await evmClient.removeKey(
@@ -15224,6 +15307,10 @@ init_presets();
 init_featureFlags();
 init_presets();
 init_featureFlags();
+var DEFAULT_PUBLIC_RELAYER_URLS = {
+  testnet: "https://relayer.veridex.network"
+  // mainnet: '<set when public mainnet relayer ships>',
+};
 function createChainClient(chain, network, customRpcUrl) {
   const preset = getChainPreset(chain);
   const config = preset[network];
@@ -15336,7 +15423,7 @@ function createSDK(chain, config = {}) {
   return new VeridexSDK({
     chain: chainClient,
     testnet: network === "testnet",
-    relayerUrl: config.relayerUrl,
+    relayerUrl: config.relayerUrl ?? DEFAULT_PUBLIC_RELAYER_URLS[network],
     relayerApiKey: config.relayerApiKey,
     sponsorPrivateKey: config.sponsorPrivateKey,
     integratorSponsorKey: config.integratorSponsorKey,