@waaskey/sdk 0.4.1 → 0.4.2

package/dist/index.cjs

@@ -486,6 +486,54 @@ var Onramp = class {
   }
 };
 
+// src/passkey/assertion.ts
+function isPasskeyAssertionSupported() {
+  return typeof globalThis.navigator !== "undefined" && typeof globalThis.navigator.credentials !== "undefined";
+}
+async function defaultAssertionCeremony() {
+  let mod;
+  try {
+    mod = await import('@simplewebauthn/browser');
+  } catch {
+    throw new WaaskeyError('Passkey step-up requires "@simplewebauthn/browser" installed, or pass a custom ceremony.', "unsupported");
+  }
+  return {
+    get: (options) => mod.startAuthentication({ optionsJSON: options })
+  };
+}
+async function getSigningAssertion(challenge, options = {}) {
+  if (options.ceremony === void 0 && !isPasskeyAssertionSupported()) {
+    throw new WaaskeyError("Passkey step-up is not available in this runtime (no WebAuthn API).", "unsupported");
+  }
+  const ceremony = options.ceremony ?? await defaultAssertionCeremony();
+  const rpId = options.rpId ?? (typeof location === "undefined" ? void 0 : location.hostname);
+  const requestOptions = {
+    challenge,
+    userVerification: "required",
+    ...rpId ? { rpId } : {},
+    ...options.credentialId ? { allowCredentials: [{ id: options.credentialId, type: "public-key" }] } : {}
+  };
+  try {
+    return await ceremony.get(requestOptions);
+  } catch (cause) {
+    if (cause instanceof WaaskeyError) throw cause;
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    if (/cancel|abort|not allowed|user gesture/i.test(msg)) {
+      throw new WaaskeyError("Passkey authentication was cancelled by the user.", "aborted", { cause });
+    }
+    throw new WaaskeyError("Passkey step-up assertion failed.", "unsupported", { cause });
+  }
+}
+
+// src/passkey/recovery-factor.ts
+function passkeyFactorEnrollment(credentialId) {
+  return { type: "passkey", credential: credentialId };
+}
+async function passkeyFactorVerification(challenge, options = {}) {
+  const assertion = await getSigningAssertion(challenge, options);
+  return { type: "passkey", token: JSON.stringify(assertion) };
+}
+
 // src/storage/crypto.ts
 var PBKDF2_ITERATIONS = 21e4;
 var PBKDF2_HASH = "SHA-256";
@@ -687,8 +735,12 @@ var Recovery = class {
 async function buildRecoveryRegistration(params) {
   const recoveryCode = params.recoveryCode ?? generateRecoveryCode();
   const backup = params.passkey ? await sealRecoveryBackup(params.share, recoveryCode, params.passkey) : { ciphertext: await sealWithPassword(recoveryCode, params.share), keyWraps: void 0 };
+  if (params.passkeyFactor && !params.passkey) {
+    throw new WaaskeyError("passkeyFactor requires `passkey` \u2014 a factor for a credential this backup cannot open would be a lock-out.", "validation");
+  }
+  const strongFactor = params.passkeyFactor ? passkeyFactorEnrollment(params.passkey.credentialId) : { type: "recovery_code", credential: await sha256Hex(recoveryCode) };
   const factors = [
-    { type: "recovery_code", credential: await sha256Hex(recoveryCode) },
+    strongFactor,
     { type: "totp", credential: params.totpSecret },
     { type: "email_otp", credential: params.email },
     ...params.extraFactors ?? []
@@ -1171,45 +1223,6 @@ function deserializeShare(blob) {
   };
 }
 
-// src/passkey/assertion.ts
-function isPasskeyAssertionSupported() {
-  return typeof globalThis.navigator !== "undefined" && typeof globalThis.navigator.credentials !== "undefined";
-}
-async function defaultAssertionCeremony() {
-  let mod;
-  try {
-    mod = await import('@simplewebauthn/browser');
-  } catch {
-    throw new WaaskeyError('Passkey step-up requires "@simplewebauthn/browser" installed, or pass a custom ceremony.', "unsupported");
-  }
-  return {
-    get: (options) => mod.startAuthentication({ optionsJSON: options })
-  };
-}
-async function getSigningAssertion(challenge, options = {}) {
-  if (options.ceremony === void 0 && !isPasskeyAssertionSupported()) {
-    throw new WaaskeyError("Passkey step-up is not available in this runtime (no WebAuthn API).", "unsupported");
-  }
-  const ceremony = options.ceremony ?? await defaultAssertionCeremony();
-  const rpId = options.rpId ?? (typeof location === "undefined" ? void 0 : location.hostname);
-  const requestOptions = {
-    challenge,
-    userVerification: "required",
-    ...rpId ? { rpId } : {},
-    ...options.credentialId ? { allowCredentials: [{ id: options.credentialId, type: "public-key" }] } : {}
-  };
-  try {
-    return await ceremony.get(requestOptions);
-  } catch (cause) {
-    if (cause instanceof WaaskeyError) throw cause;
-    const msg = cause instanceof Error ? cause.message : String(cause);
-    if (/cancel|abort|not allowed|user gesture/i.test(msg)) {
-      throw new WaaskeyError("Passkey authentication was cancelled by the user.", "aborted", { cause });
-    }
-    throw new WaaskeyError("Passkey step-up assertion failed.", "unsupported", { cause });
-  }
-}
-
 // src/wallet.ts
 var DEVICE_ROLE = "device";
 var Wallet = class {
@@ -2361,15 +2374,6 @@ function resolveSink(analytics, http) {
   return analytics ?? new HttpAnalyticsSink(http);
 }
 
-// src/passkey/recovery-factor.ts
-function passkeyFactorEnrollment(credentialId) {
-  return { type: "passkey", credential: credentialId };
-}
-async function passkeyFactorVerification(challenge, options = {}) {
-  const assertion = await getSigningAssertion(challenge, options);
-  return { type: "passkey", token: JSON.stringify(assertion) };
-}
-
 // src/mpc/wasm-core.ts
 var WasmMpcCore = class {
   constructor(load) {