@veridex/sdk 1.1.5 → 1.1.7

package/dist/passkey-fh8bo2w-.d.mts

@@ -0,0 +1,241 @@
+import { RegistrationResponseJSON } from '@simplewebauthn/types';
+
+/**
+ * Veridex Protocol SDK - Passkey Manager
+ *
+ * Chain-agnostic WebAuthn/Passkey credential management
+ */
+
+/**
+ * Assurance tier of a credential, derived from the authoritative WebAuthn
+ * Backup Eligibility (BE) flag — not from a platform guess.
+ *
+ * - `device-bound`: BE=0. The private key cannot leave the authenticator
+ *   (secure element, or a hardware key such as a YubiKey). Not recoverable.
+ * - `synced`: BE=1. The credential is eligible for sync/backup by a provider
+ *   (iCloud Keychain, Google Password Manager, Windows Hello). Recoverable via
+ *   the user's platform account — which its security therefore depends on.
+ * - `unknown`: flags were not determinable from the registration response.
+ */
+type CredentialAssuranceLevel = 'device-bound' | 'synced' | 'unknown';
+/** WebAuthn-derived assurance metadata for a credential. */
+interface CredentialAssurance {
+    /** BE flag (0x08) — credential may be backed up / synced by a provider. */
+    backupEligible: boolean;
+    /** BS flag (0x10) — credential is currently backed up / synced. */
+    backupState: boolean;
+    /** UV flag (0x04) — user was verified (biometric/PIN) at registration. */
+    userVerified: boolean;
+    /** Tier derived from BE. Consumed by the policy engine to gate authority. */
+    level: CredentialAssuranceLevel;
+    /** Authenticator model identifier (16-byte AAGUID, hex). Zeroed by many platform authenticators. */
+    aaguid?: string;
+}
+interface PasskeyCredential {
+    credentialId: string;
+    publicKeyX: bigint;
+    publicKeyY: bigint;
+    keyHash: string;
+    /**
+     * Authoritative assurance derived from the WebAuthn authenticator data.
+     * Optional for backward compatibility with credentials constructed from
+     * stored fields (e.g. env vars) that predate assurance capture.
+     */
+    assurance?: CredentialAssurance;
+}
+interface WebAuthnSignature {
+    authenticatorData: string;
+    clientDataJSON: string;
+    challengeIndex: number;
+    typeIndex: number;
+    r: bigint;
+    s: bigint;
+}
+interface PasskeyManagerConfig {
+    rpName?: string;
+    rpId?: string;
+    timeout?: number;
+    userVerification?: 'required' | 'preferred' | 'discouraged';
+    authenticatorAttachment?: 'platform' | 'cross-platform';
+    /** Relayer API URL for cross-device credential recovery */
+    relayerUrl?: string;
+}
+/**
+ * The canonical Veridex RP ID for cross-domain passkey sharing.
+ * All Veridex SDK instances should use this RP ID to enable passkey
+ * portability across different applications and domains.
+ *
+ * This works via W3C Related Origin Requests (ROR) - veridex.network
+ * hosts a .well-known/webauthn file that lists allowed origins.
+ */
+declare const VERIDEX_RP_ID = "veridex.network";
+/**
+ * Detects the appropriate RP ID for passkey sharing.
+ *
+ * For production: Returns VERIDEX_RP_ID ('veridex.network') to enable
+ * cross-domain passkey sharing via Related Origin Requests (ROR).
+ *
+ * For local development:
+ * - localhost/127.0.0.1 → returns as-is
+ * - IP addresses → returns as-is
+ *
+ * @param forceLocal - If true, uses local domain detection instead of canonical RP ID
+ */
+declare function detectRpId(forceLocal?: boolean): string;
+/**
+ * Check if the browser supports Related Origin Requests (ROR).
+ * This is a WebAuthn Level 3 feature that allows using passkeys
+ * across different domains listed in the RP's .well-known/webauthn file.
+ *
+ * @returns true if ROR is supported, false otherwise
+ */
+declare function supportsRelatedOrigins(): Promise<boolean>;
+
+/**
+ * Manages WebAuthn passkey credentials for Veridex Protocol
+ */
+declare class PasskeyManager {
+    private config;
+    private credential;
+    constructor(config?: PasskeyManagerConfig);
+    static isSupported(): boolean;
+    static isPlatformAuthenticatorAvailable(): Promise<boolean>;
+    register(username: string, displayName: string): Promise<PasskeyCredential>;
+    sign(challenge: Uint8Array): Promise<WebAuthnSignature>;
+    /**
+     * Authenticate using a discoverable credential (passkey)
+     * This allows sign-in without knowing the credential ID ahead of time.
+     * The authenticator will show all available passkeys for this RP.
+     *
+     * @param challenge - Optional challenge bytes. If not provided, a random challenge is used.
+     * @returns The credential that was used to authenticate, along with the signature
+     */
+    authenticate(challenge?: Uint8Array): Promise<{
+        credential: PasskeyCredential;
+        signature: WebAuthnSignature;
+    }>;
+    /**
+     * Find a credential by ID in the list of stored credentials
+     */
+    private findCredentialById;
+    /**
+     * Get all credentials stored in localStorage
+     */
+    getAllStoredCredentials(key?: string): PasskeyCredential[];
+    private parseStoredCredential;
+    /**
+     * Save a list of credentials to localStorage
+     */
+    saveCredentials(credentials: PasskeyCredential[], key?: string): void;
+    /**
+     * Add a single credential to storage (append or update)
+     */
+    addCredentialToStorage(credential: PasskeyCredential, key?: string): void;
+    /**
+     * Check if there's ANY stored credential for this RP
+     */
+    hasStoredCredential(): boolean;
+    getCredential(): PasskeyCredential | null;
+    setCredential(credential: PasskeyCredential): void;
+    createCredentialFromPublicKey(credentialId: string, publicKeyX: bigint, publicKeyY: bigint): PasskeyCredential;
+    clearCredential(): void;
+    /**
+     * Save the current credential to localStorage (appends to list)
+     */
+    saveToLocalStorage(key?: string): void;
+    loadFromLocalStorage(key?: string): PasskeyCredential | null;
+    removeFromLocalStorage(key?: string): void;
+    /**
+     * Save the current credential to the relayer for cross-device recovery.
+     * This should be called after registration.
+     */
+    saveCredentialToRelayer(): Promise<boolean>;
+    /**
+     * Load a credential from the relayer by credential ID.
+     * Used during discoverable credential authentication when localStorage is empty.
+     */
+    loadCredentialFromRelayer(credentialId: string): Promise<PasskeyCredential | null>;
+    /**
+     * Load a credential from the relayer by keyHash.
+     * Useful when you know the user's keyHash but not their credential ID.
+     */
+    loadCredentialFromRelayerByKeyHash(keyHash: string): Promise<PasskeyCredential | null>;
+    /**
+     * Register a backup passkey for the current identity.
+     *
+     * This creates a new WebAuthn credential on this device/platform that becomes
+     * an additional authorized key for the same Veridex identity. The caller
+     * must submit the returned credential to VeridexHub.addKey() for on-chain registration.
+     *
+     * Use cases:
+     * - "Add this device" flow when signing in on a new machine
+     * - Proactive backup creation on a separate authenticator
+     * - Cross-ecosystem redundancy (iCloud + Google Password Manager)
+     *
+     * @param username - Username for the new credential (typically same as primary)
+     * @param displayName - Display name for the backup (e.g., "MacBook Pro Backup")
+     * @param excludeCredentialIds - Credential IDs to exclude (prevents re-registering same authenticator)
+     * @returns The newly registered backup credential
+     */
+    registerBackupPasskey(username: string, displayName: string, excludeCredentialIds?: string[]): Promise<PasskeyCredential>;
+    /**
+     * Get registration info for backup state from a registration response.
+     *
+     * This extracts the backup eligibility (BE) and backup state (BS) flags
+     * from the authenticator data, which indicate whether the credential
+     * is eligible for cloud sync and whether it is currently synced.
+     *
+     * @param authenticatorData - Hex-encoded authenticator data from registration
+     * @returns Backup flags, or null if not determinable
+     */
+    static parseBackupFlags(authenticatorData: string): {
+        backupEligible: boolean;
+        backupState: boolean;
+    } | null;
+    /**
+     * Derive credential assurance from raw WebAuthn authenticator data.
+     *
+     * authData layout:
+     *   rpIdHash (32) | flags (1) | signCount (4) | [attestedCredentialData: aaguid (16) | ...]
+     *
+     * Flags byte: UP 0x01 | UV 0x04 | BE 0x08 | BS 0x10 | AT 0x40 | ED 0x80
+     *
+     * BE is the authoritative signal for whether a credential is device-bound or
+     * syncable. It is set by the authenticator itself — unlike a platform/user-agent
+     * guess, it correctly identifies a hardware key used on a syncing platform.
+     *
+     * @returns Assurance, or `null` if authData is too short to be valid.
+     */
+    static deriveAssurance(authData: Uint8Array): CredentialAssurance | null;
+    /**
+     * Extract raw authenticator data from a registration response.
+     *
+     * Prefers the `authenticatorData` field when the authenticator provides it,
+     * and otherwise locates the `authData` byte string inside the CBOR
+     * attestation object.
+     */
+    private static extractAuthData;
+    /** Derive assurance directly from a registration response. */
+    static assuranceFromRegistration(response: RegistrationResponseJSON): CredentialAssurance | null;
+    /**
+     * Get the number of credentials stored locally.
+     */
+    getStoredCredentialCount(): number;
+    /**
+     * Get all credential IDs stored locally (for exclude lists).
+     */
+    getStoredCredentialIds(): string[];
+    private extractPublicKeyFromAttestation;
+    private parseCOSEKey;
+    private tryParseCOSEKeyStrategies;
+    private parseCOSEKeyWithCBORStructure;
+    private tryParseASN1Structure;
+    private find32ByteSequences;
+    private isValidCoordinate;
+    private bytesToBigInt;
+    private bytesToHex;
+    private analyzeCOSEStructure;
+    private parseAuthenticationResponse;
+}
+
+export { type CredentialAssurance as C, PasskeyManager as P, VERIDEX_RP_ID as V, type WebAuthnSignature as W, type PasskeyCredential as a, type PasskeyManagerConfig as b, type CredentialAssuranceLevel as c, detectRpId as d, supportsRelatedOrigins as s };

package/dist/passkey.d.mts

@@ -1,182 +1,2 @@
-/**
- * Veridex Protocol SDK - Passkey Manager
- *
- * Chain-agnostic WebAuthn/Passkey credential management
- */
-interface PasskeyCredential {
-    credentialId: string;
-    publicKeyX: bigint;
-    publicKeyY: bigint;
-    keyHash: string;
-}
-interface WebAuthnSignature {
-    authenticatorData: string;
-    clientDataJSON: string;
-    challengeIndex: number;
-    typeIndex: number;
-    r: bigint;
-    s: bigint;
-}
-interface PasskeyManagerConfig {
-    rpName?: string;
-    rpId?: string;
-    timeout?: number;
-    userVerification?: 'required' | 'preferred' | 'discouraged';
-    authenticatorAttachment?: 'platform' | 'cross-platform';
-    /** Relayer API URL for cross-device credential recovery */
-    relayerUrl?: string;
-}
-/**
- * The canonical Veridex RP ID for cross-domain passkey sharing.
- * All Veridex SDK instances should use this RP ID to enable passkey
- * portability across different applications and domains.
- *
- * This works via W3C Related Origin Requests (ROR) - veridex.network
- * hosts a .well-known/webauthn file that lists allowed origins.
- */
-declare const VERIDEX_RP_ID = "veridex.network";
-/**
- * Detects the appropriate RP ID for passkey sharing.
- *
- * For production: Returns VERIDEX_RP_ID ('veridex.network') to enable
- * cross-domain passkey sharing via Related Origin Requests (ROR).
- *
- * For local development:
- * - localhost/127.0.0.1 → returns as-is
- * - IP addresses → returns as-is
- *
- * @param forceLocal - If true, uses local domain detection instead of canonical RP ID
- */
-declare function detectRpId(forceLocal?: boolean): string;
-/**
- * Check if the browser supports Related Origin Requests (ROR).
- * This is a WebAuthn Level 3 feature that allows using passkeys
- * across different domains listed in the RP's .well-known/webauthn file.
- *
- * @returns true if ROR is supported, false otherwise
- */
-declare function supportsRelatedOrigins(): Promise<boolean>;
-
-/**
- * Manages WebAuthn passkey credentials for Veridex Protocol
- */
-declare class PasskeyManager {
-    private config;
-    private credential;
-    constructor(config?: PasskeyManagerConfig);
-    static isSupported(): boolean;
-    static isPlatformAuthenticatorAvailable(): Promise<boolean>;
-    register(username: string, displayName: string): Promise<PasskeyCredential>;
-    sign(challenge: Uint8Array): Promise<WebAuthnSignature>;
-    /**
-     * Authenticate using a discoverable credential (passkey)
-     * This allows sign-in without knowing the credential ID ahead of time.
-     * The authenticator will show all available passkeys for this RP.
-     *
-     * @param challenge - Optional challenge bytes. If not provided, a random challenge is used.
-     * @returns The credential that was used to authenticate, along with the signature
-     */
-    authenticate(challenge?: Uint8Array): Promise<{
-        credential: PasskeyCredential;
-        signature: WebAuthnSignature;
-    }>;
-    /**
-     * Find a credential by ID in the list of stored credentials
-     */
-    private findCredentialById;
-    /**
-     * Get all credentials stored in localStorage
-     */
-    getAllStoredCredentials(key?: string): PasskeyCredential[];
-    private parseStoredCredential;
-    /**
-     * Save a list of credentials to localStorage
-     */
-    saveCredentials(credentials: PasskeyCredential[], key?: string): void;
-    /**
-     * Add a single credential to storage (append or update)
-     */
-    addCredentialToStorage(credential: PasskeyCredential, key?: string): void;
-    /**
-     * Check if there's ANY stored credential for this RP
-     */
-    hasStoredCredential(): boolean;
-    getCredential(): PasskeyCredential | null;
-    setCredential(credential: PasskeyCredential): void;
-    createCredentialFromPublicKey(credentialId: string, publicKeyX: bigint, publicKeyY: bigint): PasskeyCredential;
-    clearCredential(): void;
-    /**
-     * Save the current credential to localStorage (appends to list)
-     */
-    saveToLocalStorage(key?: string): void;
-    loadFromLocalStorage(key?: string): PasskeyCredential | null;
-    removeFromLocalStorage(key?: string): void;
-    /**
-     * Save the current credential to the relayer for cross-device recovery.
-     * This should be called after registration.
-     */
-    saveCredentialToRelayer(): Promise<boolean>;
-    /**
-     * Load a credential from the relayer by credential ID.
-     * Used during discoverable credential authentication when localStorage is empty.
-     */
-    loadCredentialFromRelayer(credentialId: string): Promise<PasskeyCredential | null>;
-    /**
-     * Load a credential from the relayer by keyHash.
-     * Useful when you know the user's keyHash but not their credential ID.
-     */
-    loadCredentialFromRelayerByKeyHash(keyHash: string): Promise<PasskeyCredential | null>;
-    /**
-     * Register a backup passkey for the current identity.
-     *
-     * This creates a new WebAuthn credential on this device/platform that becomes
-     * an additional authorized key for the same Veridex identity. The caller
-     * must submit the returned credential to VeridexHub.addKey() for on-chain registration.
-     *
-     * Use cases:
-     * - "Add this device" flow when signing in on a new machine
-     * - Proactive backup creation on a separate authenticator
-     * - Cross-ecosystem redundancy (iCloud + Google Password Manager)
-     *
-     * @param username - Username for the new credential (typically same as primary)
-     * @param displayName - Display name for the backup (e.g., "MacBook Pro Backup")
-     * @param excludeCredentialIds - Credential IDs to exclude (prevents re-registering same authenticator)
-     * @returns The newly registered backup credential
-     */
-    registerBackupPasskey(username: string, displayName: string, excludeCredentialIds?: string[]): Promise<PasskeyCredential>;
-    /**
-     * Get registration info for backup state from a registration response.
-     *
-     * This extracts the backup eligibility (BE) and backup state (BS) flags
-     * from the authenticator data, which indicate whether the credential
-     * is eligible for cloud sync and whether it is currently synced.
-     *
-     * @param authenticatorData - Hex-encoded authenticator data from registration
-     * @returns Backup flags, or null if not determinable
-     */
-    static parseBackupFlags(authenticatorData: string): {
-        backupEligible: boolean;
-        backupState: boolean;
-    } | null;
-    /**
-     * Get the number of credentials stored locally.
-     */
-    getStoredCredentialCount(): number;
-    /**
-     * Get all credential IDs stored locally (for exclude lists).
-     */
-    getStoredCredentialIds(): string[];
-    private extractPublicKeyFromAttestation;
-    private parseCOSEKey;
-    private tryParseCOSEKeyStrategies;
-    private parseCOSEKeyWithCBORStructure;
-    private tryParseASN1Structure;
-    private find32ByteSequences;
-    private isValidCoordinate;
-    private bytesToBigInt;
-    private bytesToHex;
-    private analyzeCOSEStructure;
-    private parseAuthenticationResponse;
-}
-
-export { type PasskeyCredential, PasskeyManager, type PasskeyManagerConfig, VERIDEX_RP_ID, type WebAuthnSignature, detectRpId, supportsRelatedOrigins };
+export { a as PasskeyCredential, P as PasskeyManager, b as PasskeyManagerConfig, V as VERIDEX_RP_ID, W as WebAuthnSignature, d as detectRpId, s as supportsRelatedOrigins } from './passkey-fh8bo2w-.mjs';
+import '@simplewebauthn/types';

package/dist/passkey.js

@@ -250,7 +250,8 @@ var PasskeyManager = class _PasskeyManager {
       credentialId: response.id,
       publicKeyX: publicKey.x,
       publicKeyY: publicKey.y,
-      keyHash
+      keyHash,
+      assurance: _PasskeyManager.assuranceFromRegistration(response) ?? void 0
     };
     return this.credential;
   }
@@ -629,7 +630,8 @@ var PasskeyManager = class _PasskeyManager {
       credentialId: response.id,
       publicKeyX: publicKey.x,
       publicKeyY: publicKey.y,
-      keyHash
+      keyHash,
+      assurance: _PasskeyManager.assuranceFromRegistration(response) ?? void 0
     };
     this.addCredentialToStorage(backupCredential);
     return backupCredential;
@@ -646,17 +648,94 @@ var PasskeyManager = class _PasskeyManager {
    */
   static parseBackupFlags(authenticatorData) {
     try {
-      const data = import_ethers2.ethers.getBytes(authenticatorData);
-      if (data.length < 37) return null;
-      const flags = data[32];
+      const assurance = _PasskeyManager.deriveAssurance(import_ethers2.ethers.getBytes(authenticatorData));
+      if (!assurance) return null;
       return {
-        backupEligible: (flags & 8) !== 0,
-        backupState: (flags & 16) !== 0
+        backupEligible: assurance.backupEligible,
+        backupState: assurance.backupState
       };
     } catch {
       return null;
     }
   }
+  /**
+   * Derive credential assurance from raw WebAuthn authenticator data.
+   *
+   * authData layout:
+   *   rpIdHash (32) | flags (1) | signCount (4) | [attestedCredentialData: aaguid (16) | ...]
+   *
+   * Flags byte: UP 0x01 | UV 0x04 | BE 0x08 | BS 0x10 | AT 0x40 | ED 0x80
+   *
+   * BE is the authoritative signal for whether a credential is device-bound or
+   * syncable. It is set by the authenticator itself — unlike a platform/user-agent
+   * guess, it correctly identifies a hardware key used on a syncing platform.
+   *
+   * @returns Assurance, or `null` if authData is too short to be valid.
+   */
+  static deriveAssurance(authData) {
+    if (authData.length < 37) return null;
+    const flags = authData[32];
+    const backupEligible = (flags & 8) !== 0;
+    const attestedCredentialData = (flags & 64) !== 0;
+    let aaguid;
+    if (attestedCredentialData && authData.length >= 53) {
+      aaguid = import_ethers2.ethers.hexlify(authData.slice(37, 53));
+    }
+    return {
+      backupEligible,
+      backupState: (flags & 16) !== 0,
+      userVerified: (flags & 4) !== 0,
+      level: backupEligible ? "synced" : "device-bound",
+      aaguid
+    };
+  }
+  /**
+   * Extract raw authenticator data from a registration response.
+   *
+   * Prefers the `authenticatorData` field when the authenticator provides it,
+   * and otherwise locates the `authData` byte string inside the CBOR
+   * attestation object.
+   */
+  static extractAuthData(response) {
+    const direct = response.response.authenticatorData;
+    if (direct) {
+      try {
+        return base64URLDecode(direct);
+      } catch {
+      }
+    }
+    try {
+      const attestationObject = base64URLDecode(response.response.attestationObject);
+      let offset = 0;
+      if (attestationObject[offset] >= 160 && attestationObject[offset] <= 191) {
+        offset++;
+      }
+      const key = [104, 97, 117, 116, 104, 68, 97, 116, 97];
+      let found = false;
+      while (offset < attestationObject.length - 37) {
+        if (key.every((byte, i) => attestationObject[offset + i] === byte)) {
+          offset += key.length;
+          found = true;
+          break;
+        }
+        offset++;
+      }
+      if (!found) return null;
+      if (attestationObject[offset] === 88) {
+        offset += 2;
+      } else if (attestationObject[offset] === 89) {
+        offset += 3;
+      }
+      return attestationObject.slice(offset);
+    } catch {
+      return null;
+    }
+  }
+  /** Derive assurance directly from a registration response. */
+  static assuranceFromRegistration(response) {
+    const authData = _PasskeyManager.extractAuthData(response);
+    return authData ? _PasskeyManager.deriveAssurance(authData) : null;
+  }
   /**
    * Get the number of credentials stored locally.
    */