ox 1.1.2 → 1.3.0

package/dist/core/WebAuthn.d.ts

@@ -0,0 +1,224 @@
+import * as Bytes from './Bytes.js';
+import * as Errors from './Errors.js';
+import * as Hex from './Hex.js';
+import type { UnionOmit } from './internal/types.js';
+import * as Authentication from '../webauthn/Authentication.js';
+import type * as Credential from '../webauthn/Credential.js';
+import * as Registration from '../webauthn/Registration.js';
+import type * as Types from '../webauthn/Types.js';
+export * from './WebAuthnP256.js';
+/** Configuration for evaluating a WebAuthn credential-bound PRF. */
+export type Prf = true | {
+    /**
+     * Application-owned PRF input.
+     *
+     * Use the same input to reproduce an output. Store unpredictable inputs
+     * with the credential metadata.
+     */
+    input: Bytes.Bytes;
+};
+/**
+ * Creates a WebAuthn credential and optionally returns its credential-bound
+ * PRF output.
+ *
+ * @example
+ * ```ts twoslash
+ * import { Secp256k1, WebAuthn } from 'ox'
+ *
+ * const credential = await WebAuthn.createCredential({
+ *   name: 'Example',
+ *   prf: true
+ * })
+ * const privateKey = Secp256k1.fromPrf(credential.prf)
+ * ```
+ *
+ * `prf: true` uses the stable input `ox.webauthn.prf.v1`. Pass
+ * `{ input }` to use an application-owned input instead.
+ *
+ * When credential creation enables PRF but does not return an output, this
+ * function performs a follow-up assertion. The user may be prompted twice.
+ *
+ * If PRF evaluation fails after registration, the thrown error retains the
+ * created credential on its `credential` property.
+ *
+ * :::warning
+ *
+ * PRF output is secret application-held key material. Native
+ * `credential.raw.toJSON()` output includes extension results, so do not
+ * serialize or send the raw credential.
+ *
+ * PRF-derived keys are software keys. Code on any origin allowed to use the
+ * same RP ID can request the same output after user verification.
+ *
+ * :::
+ *
+ * @param options - Credential creation and PRF options.
+ * @returns The credential, with a copied PRF output when requested.
+ */
+export declare function createCredential<const options extends createCredential.Options | createCredential.PrfOptions>(options: options): Promise<createCredential.ReturnType<options>>;
+export declare namespace createCredential {
+    /** Options for ordinary WebAuthn P256 credential creation. */
+    type Options = Registration.create.Options & {
+        /** Reserved for credential creation with PRF output. */
+        prf?: never;
+    };
+    /** Options for WebAuthn credential creation with required PRF output. */
+    type PrfOptions = UnionOmit<Registration.getOptions.Options, 'authenticatorSelection' | 'challenge' | 'extensions'> & {
+        /**
+         * Criteria used to select an authenticator. User verification is always required.
+         */
+        authenticatorSelection?: Omit<NonNullable<Registration.getOptions.Options['authenticatorSelection']>, 'userVerification'> | undefined;
+        /**
+         * Cryptographic challenge. Defaults to a random 32-byte value.
+         *
+         * Supply and verify a server-generated challenge when registration is
+         * also used to authenticate a user to a server.
+         */
+        challenge?: Registration.getOptions.Options['challenge'] | undefined;
+        /** Function that creates the WebAuthn credential. */
+        createFn?: ((options?: Types.CredentialCreationOptions) => Promise<Types.Credential | null>) | undefined;
+        /** Additional WebAuthn extensions. The `prf` extension is managed by this function. */
+        extensions?: Omit<Types.AuthenticationExtensionsClientInputs, 'prf'> | undefined;
+        /** Function used for a follow-up PRF assertion when creation does not return an output. */
+        getFn?: ((options?: Types.CredentialRequestOptions) => Promise<Types.Credential | null>) | undefined;
+        /** Credential-bound PRF configuration. */
+        prf: Prf;
+        /** Raw credential options cannot be combined with managed PRF evaluation. */
+        publicKey?: never;
+    };
+    /** Created WebAuthn credential with its credential-bound PRF output. */
+    type PrfReturnType = Credential.Credential & {
+        /** Copied 32-byte credential-bound PRF output. */
+        prf: Bytes.Bytes;
+    };
+    /** Return type for a WebAuthn credential creation request. */
+    type ReturnType<options extends Options | PrfOptions> = options extends PrfOptions ? PrfReturnType : Credential.Credential;
+    type ErrorType = InvalidExtensionError | InvalidOptionsError | InvalidPrfOutputError | PrfEvaluationFailedError | PrfNotSupportedError | Registration.create.ErrorType | Errors.GlobalErrorType;
+}
+/**
+ * Requests a WebAuthn credential and returns its credential-bound PRF output.
+ *
+ * @example
+ * ```ts twoslash
+ * import { Secp256k1, WebAuthn } from 'ox'
+ *
+ * const { prf } = await WebAuthn.getCredential({
+ *   credentialId: 'oZ48...',
+ *   prf: true
+ * })
+ * const privateKey = Secp256k1.fromPrf(prf)
+ * ```
+ *
+ * `prf: true` uses the stable input `ox.webauthn.prf.v1`. Pass
+ * `{ input }` to use an application-owned input instead.
+ *
+ * When more than one credential can be selected, check `result.id`
+ * before using the PRF output.
+ *
+ * :::warning
+ *
+ * PRF output is secret application-held key material. Native
+ * `response.raw.toJSON()` output includes extension results, so do not
+ * serialize or send the raw response.
+ *
+ * :::
+ *
+ * @param options - Credential request and PRF options.
+ * @returns The requested credential and a copied 32-byte PRF output.
+ */
+export declare function getCredential(options: getCredential.Options): Promise<getCredential.ReturnType>;
+export declare namespace getCredential {
+    type Options = UnionOmit<Authentication.getOptions.Options, 'challenge' | 'extensions' | 'userVerification'> & {
+        /**
+         * Challenge to sign. Defaults to a random 32-byte value.
+         *
+         * Supply and verify a server-generated challenge when the assertion is
+         * also used to authenticate a user to a server.
+         */
+        challenge?: Hex.Hex | undefined;
+        /** Additional WebAuthn extensions. The `prf` extension is managed by this function. */
+        extensions?: Omit<Types.AuthenticationExtensionsClientInputs, 'prf'> | undefined;
+        /** Function that requests the WebAuthn credential. */
+        getFn?: ((options?: Types.CredentialRequestOptions) => Promise<Types.Credential | null>) | undefined;
+        /** Credential-bound PRF configuration. */
+        prf: Prf;
+        /** Raw credential options cannot be combined with managed PRF evaluation. */
+        publicKey?: never;
+    };
+    /** Result from a WebAuthn credential request. */
+    type Response = {
+        /** Credential identifier. */
+        id: string;
+        /** Native WebAuthn credential. */
+        raw: Types.PublicKeyCredential;
+    };
+    type ReturnType = Response & {
+        /** Copied 32-byte credential-bound PRF output. */
+        prf: Bytes.Bytes;
+    };
+    type ErrorType = Authentication.getOptions.ErrorType | GetCredentialFailedError | InvalidExtensionError | InvalidOptionsError | InvalidPrfOutputError | PrfEvaluationFailedError | PrfUnavailableError | Errors.GlobalErrorType;
+}
+type PrfResultContext = {
+    credential?: Credential.Credential | undefined;
+    response?: getCredential.Response | undefined;
+};
+/** Thrown when a caller supplies the managed `prf` extension. */
+export declare class InvalidExtensionError extends Errors.BaseError {
+    readonly name = "WebAuthn.InvalidExtensionError";
+    constructor();
+}
+/** Thrown when raw credential options are combined with managed PRF evaluation. */
+export declare class InvalidOptionsError extends Errors.BaseError {
+    readonly name = "WebAuthn.InvalidOptionsError";
+    constructor();
+}
+/** Thrown when a WebAuthn PRF result is not a valid 32-byte output. */
+export declare class InvalidPrfOutputError extends Errors.BaseError {
+    /** Credential that returned the invalid PRF output, when created in this operation. */
+    readonly credential?: Credential.Credential | undefined;
+    /** Authentication response that returned the invalid PRF output, when available. */
+    readonly response?: getCredential.Response | undefined;
+    readonly name = "WebAuthn.InvalidPrfOutputError";
+    constructor({ credential, response, size, }: PrfResultContext & {
+        size?: number | undefined;
+    });
+}
+/** Thrown when a created credential does not support PRF evaluation. */
+export declare class PrfNotSupportedError extends Errors.BaseError {
+    /** Credential that was created before PRF support was determined. */
+    readonly credential: Credential.Credential;
+    readonly name = "WebAuthn.PrfNotSupportedError";
+    constructor({ credential }: {
+        credential: Credential.Credential;
+    });
+}
+/** Thrown when a credential assertion does not return a PRF output. */
+export declare class PrfUnavailableError extends Errors.BaseError {
+    /** Authentication response that did not contain a PRF output. */
+    readonly response: getCredential.Response;
+    readonly name = "WebAuthn.PrfUnavailableError";
+    constructor({ response }: {
+        response: getCredential.Response;
+    });
+}
+/** Thrown when WebAuthn PRF evaluation fails after a credential ceremony. */
+export declare class PrfEvaluationFailedError extends Errors.BaseError<Error> {
+    /** Credential that was created before PRF evaluation failed, when available. */
+    readonly credential?: Credential.Credential | undefined;
+    /** Authentication response produced before PRF evaluation failed, when available. */
+    readonly response?: getCredential.Response | undefined;
+    readonly name = "WebAuthn.PrfEvaluationFailedError";
+    constructor({ cause, credential, response, }: {
+        cause: Error;
+        credential?: Credential.Credential | undefined;
+        response?: getCredential.Response | undefined;
+    });
+}
+/** Thrown when a WebAuthn credential request fails. */
+export declare class GetCredentialFailedError extends Errors.BaseError<Error> {
+    readonly name = "WebAuthn.GetCredentialFailedError";
+    constructor({ cause }?: {
+        cause?: Error | undefined;
+    });
+}
+//# sourceMappingURL=WebAuthn.d.ts.map

package/dist/core/WebAuthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebAuthn.d.ts","sourceRoot":"","sources":["../../src/core/WebAuthn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAEpD,OAAO,KAAK,cAAc,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,KAAK,UAAU,MAAM,2BAA2B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,6BAA6B,CAAA;AAC3D,OAAO,KAAK,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAElD,cAAc,mBAAmB,CAAA;AAIjC,oEAAoE;AACpE,MAAM,MAAM,GAAG,GACX,IAAI,GACJ;IACE;;;;;OAKG;IACH,KAAK,EAAE,KAAK,CAAC,KAAK,CAAA;CACnB,CAAA;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,CAAC,OAAO,SAAS,gBAAgB,CAAC,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAC5E,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAyFjE;AAED,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACxC,8DAA8D;IAC9D,KAAK,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,GAAG;QAC3C,wDAAwD;QACxD,GAAG,CAAC,EAAE,KAAK,CAAA;KACZ,CAAA;IAED,yEAAyE;IACzE,KAAK,UAAU,GAAG,SAAS,CACzB,YAAY,CAAC,UAAU,CAAC,OAAO,EAC/B,wBAAwB,GAAG,WAAW,GAAG,YAAY,CACtD,GAAG;QACF;;WAEG;QACH,sBAAsB,CAAC,EACnB,IAAI,CACF,WAAW,CACT,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAC1D,EACD,kBAAkB,CACnB,GACD,SAAS,CAAA;QACb;;;;;WAKG;QACH,SAAS,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;QACpE,qDAAqD;QACrD,QAAQ,CAAC,EACL,CAAC,CACC,OAAO,CAAC,EAAE,KAAK,CAAC,yBAAyB,KACtC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,GACtC,SAAS,CAAA;QACb,uFAAuF;QACvF,UAAU,CAAC,EACP,IAAI,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,GACvD,SAAS,CAAA;QACb,2FAA2F;QAC3F,KAAK,CAAC,EACF,CAAC,CACC,OAAO,CAAC,EAAE,KAAK,CAAC,wBAAwB,KACrC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,GACtC,SAAS,CAAA;QACb,0CAA0C;QAC1C,GAAG,EAAE,GAAG,CAAA;QACR,6EAA6E;QAC7E,SAAS,CAAC,EAAE,KAAK,CAAA;KAClB,CAAA;IAED,wEAAwE;IACxE,KAAK,aAAa,GAAG,UAAU,CAAC,UAAU,GAAG;QAC3C,kDAAkD;QAClD,GAAG,EAAE,KAAK,CAAC,KAAK,CAAA;KACjB,CAAA;IAED,8DAA8D;IAC9D,KAAK,UAAU,CAAC,OAAO,SAAS,OAAO,GAAG,UAAU,IAClD,OAAO,SAAS,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC,UAAU,CAAA;IAEpE,KAAK,SAAS,GACV,qBAAqB,GACrB,mBAAmB,GACnB,qBAAqB,GACrB,wBAAwB,GACxB,oBAAoB,GACpB,YAAY,CAAC,MAAM,CAAC,SAAS,GAC7B,MAAM,CAAC,eAAe,CAAA;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,CAAC,OAAO,GAC7B,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAgEnC;AAED,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,KAAK,OAAO,GAAG,SAAS,CACtB,cAAc,CAAC,UAAU,CAAC,OAAO,EACjC,WAAW,GAAG,YAAY,GAAG,kBAAkB,CAChD,GAAG;QACF;;;;;WAKG;QACH,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;QAC/B,uFAAuF;QACvF,UAAU,CAAC,EACP,IAAI,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,GACvD,SAAS,CAAA;QACb,sDAAsD;QACtD,KAAK,CAAC,EACF,CAAC,CACC,OAAO,CAAC,EAAE,KAAK,CAAC,wBAAwB,KACrC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,GACtC,SAAS,CAAA;QACb,0CAA0C;QAC1C,GAAG,EAAE,GAAG,CAAA;QACR,6EAA6E;QAC7E,SAAS,CAAC,EAAE,KAAK,CAAA;KAClB,CAAA;IAED,iDAAiD;IACjD,KAAK,QAAQ,GAAG;QACd,6BAA6B;QAC7B,EAAE,EAAE,MAAM,CAAA;QACV,kCAAkC;QAClC,GAAG,EAAE,KAAK,CAAC,mBAAmB,CAAA;KAC/B,CAAA;IAED,KAAK,UAAU,GAAG,QAAQ,GAAG;QAC3B,kDAAkD;QAClD,GAAG,EAAE,KAAK,CAAC,KAAK,CAAA;KACjB,CAAA;IAED,KAAK,SAAS,GACV,cAAc,CAAC,UAAU,CAAC,SAAS,GACnC,wBAAwB,GACxB,qBAAqB,GACrB,mBAAmB,GACnB,qBAAqB,GACrB,wBAAwB,GACxB,mBAAmB,GACnB,MAAM,CAAC,eAAe,CAAA;CAC3B;AAMD,KAAK,gBAAgB,GAAG;IACtB,UAAU,CAAC,EAAE,UAAU,CAAC,UAAU,GAAG,SAAS,CAAA;IAC9C,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ,GAAG,SAAS,CAAA;CAC9C,CAAA;AA4ED,iEAAiE;AACjE,qBAAa,qBAAsB,SAAQ,MAAM,CAAC,SAAS;IACzD,SAAkB,IAAI,oCAAmC;;CAK1D;AAED,mFAAmF;AACnF,qBAAa,mBAAoB,SAAQ,MAAM,CAAC,SAAS;IACvD,SAAkB,IAAI,kCAAiC;;CAOxD;AAED,uEAAuE;AACvE,qBAAa,qBAAsB,SAAQ,MAAM,CAAC,SAAS;IACzD,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,UAAU,GAAG,SAAS,CAAA;IAEvD,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ,GAAG,SAAS,CAAA;IAEtD,SAAkB,IAAI,oCAAmC;gBAE7C,EACV,UAAU,EACV,QAAQ,EACR,IAAI,GACL,EAAE,gBAAgB,GAAG;QACpB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC1B;CASF;AAED,wEAAwE;AACxE,qBAAa,oBAAqB,SAAQ,MAAM,CAAC,SAAS;IACxD,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAA;IAE1C,SAAkB,IAAI,mCAAkC;gBAE5C,EAAE,UAAU,EAAE,EAAE;QAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAA;KAAE;CAIlE;AAED,uEAAuE;AACvE,qBAAa,mBAAoB,SAAQ,MAAM,CAAC,SAAS;IACvD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAA;IAEzC,SAAkB,IAAI,kCAAiC;gBAE3C,EAAE,QAAQ,EAAE,EAAE;QAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAA;KAAE;CAI/D;AAED,6EAA6E;AAC7E,qBAAa,wBAAyB,SAAQ,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;IACnE,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,UAAU,GAAG,SAAS,CAAA;IAEvD,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ,GAAG,SAAS,CAAA;IAEtD,SAAkB,IAAI,uCAAsC;gBAEhD,EACV,KAAK,EACL,UAAU,EACV,QAAQ,GACT,EAAE;QACD,KAAK,EAAE,KAAK,CAAA;QACZ,UAAU,CAAC,EAAE,UAAU,CAAC,UAAU,GAAG,SAAS,CAAA;QAC9C,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ,GAAG,SAAS,CAAA;KAC9C;CAYF;AAED,uDAAuD;AACvD,qBAAa,wBAAyB,SAAQ,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;IACnE,SAAkB,IAAI,uCAAsC;gBAEhD,EAAE,KAAK,EAAE,GAAE;QAAE,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;KAAO;CAK1D"}

package/dist/core/WebAuthn.js

@@ -0,0 +1,343 @@
+import * as Bytes from './Bytes.js';
+import * as Errors from './Errors.js';
+import * as Hex from './Hex.js';
+import * as WebAuthnP256 from './WebAuthnP256.js';
+import * as Authentication from '../webauthn/Authentication.js';
+import * as Registration from '../webauthn/Registration.js';
+export * from './WebAuthnP256.js';
+const defaultPrfInput = Bytes.fromString('ox.webauthn.prf.v1');
+/**
+ * Creates a WebAuthn credential and optionally returns its credential-bound
+ * PRF output.
+ *
+ * @example
+ * ```ts twoslash
+ * import { Secp256k1, WebAuthn } from 'ox'
+ *
+ * const credential = await WebAuthn.createCredential({
+ *   name: 'Example',
+ *   prf: true
+ * })
+ * const privateKey = Secp256k1.fromPrf(credential.prf)
+ * ```
+ *
+ * `prf: true` uses the stable input `ox.webauthn.prf.v1`. Pass
+ * `{ input }` to use an application-owned input instead.
+ *
+ * When credential creation enables PRF but does not return an output, this
+ * function performs a follow-up assertion. The user may be prompted twice.
+ *
+ * If PRF evaluation fails after registration, the thrown error retains the
+ * created credential on its `credential` property.
+ *
+ * :::warning
+ *
+ * PRF output is secret application-held key material. Native
+ * `credential.raw.toJSON()` output includes extension results, so do not
+ * serialize or send the raw credential.
+ *
+ * PRF-derived keys are software keys. Code on any origin allowed to use the
+ * same RP ID can request the same output after user verification.
+ *
+ * :::
+ *
+ * @param options - Credential creation and PRF options.
+ * @returns The credential, with a copied PRF output when requested.
+ */
+export async function createCredential(options) {
+    if (!('prf' in options) || options.prf === undefined)
+        return WebAuthnP256.createCredential(options);
+    if ('publicKey' in options)
+        throw new InvalidOptionsError();
+    const rpId = options.rp?.id;
+    const { authenticatorSelection = {
+        requireResidentKey: true,
+        residentKey: 'required',
+    }, challenge = Hex.random(32), createFn, extensions, getFn, prf, timeout, ...rest } = options;
+    assertExtensions(extensions);
+    const input = getPrfInput(prf);
+    const credential = await Registration.create({
+        ...rest,
+        authenticatorSelection: {
+            ...authenticatorSelection,
+            userVerification: 'required',
+        },
+        challenge,
+        ...(createFn && { createFn }),
+        extensions: {
+            ...extensions,
+            prf: {
+                eval: {
+                    first: input,
+                },
+            },
+        },
+        ...(timeout !== undefined && { timeout }),
+    });
+    const result = (() => {
+        try {
+            return credential.raw.getClientExtensionResults().prf;
+        }
+        catch (cause) {
+            throw new PrfEvaluationFailedError({
+                cause: cause,
+                credential,
+            });
+        }
+    })();
+    const output = result?.results?.first;
+    if (output !== undefined)
+        return {
+            ...credential,
+            prf: parsePrfOutput(output, {
+                credential,
+            }),
+        };
+    if (result?.enabled !== true)
+        throw new PrfNotSupportedError({
+            credential,
+        });
+    try {
+        const result = await getCredential({
+            credentialId: credential.id,
+            ...(getFn && { getFn }),
+            prf: {
+                input,
+            },
+            ...(rpId && { rpId }),
+            ...(timeout !== undefined && { timeout }),
+        });
+        if (result.id !== credential.id)
+            throw new Error(`Expected credential "${credential.id}", but received "${result.id}".`);
+        return {
+            ...credential,
+            prf: result.prf,
+        };
+    }
+    catch (cause) {
+        throw new PrfEvaluationFailedError({
+            cause: cause,
+            credential,
+        });
+    }
+}
+/**
+ * Requests a WebAuthn credential and returns its credential-bound PRF output.
+ *
+ * @example
+ * ```ts twoslash
+ * import { Secp256k1, WebAuthn } from 'ox'
+ *
+ * const { prf } = await WebAuthn.getCredential({
+ *   credentialId: 'oZ48...',
+ *   prf: true
+ * })
+ * const privateKey = Secp256k1.fromPrf(prf)
+ * ```
+ *
+ * `prf: true` uses the stable input `ox.webauthn.prf.v1`. Pass
+ * `{ input }` to use an application-owned input instead.
+ *
+ * When more than one credential can be selected, check `result.id`
+ * before using the PRF output.
+ *
+ * :::warning
+ *
+ * PRF output is secret application-held key material. Native
+ * `response.raw.toJSON()` output includes extension results, so do not
+ * serialize or send the raw response.
+ *
+ * :::
+ *
+ * @param options - Credential request and PRF options.
+ * @returns The requested credential and a copied 32-byte PRF output.
+ */
+export async function getCredential(options) {
+    if ('publicKey' in options)
+        throw new InvalidOptionsError();
+    const { challenge = Hex.random(32), extensions, getFn = (options) => window.navigator.credentials.get(options), prf, ...rest } = options;
+    assertExtensions(extensions);
+    const input = getPrfInput(prf);
+    const request = Authentication.getOptions({
+        ...rest,
+        challenge,
+        extensions: {
+            ...extensions,
+            prf: {
+                eval: {
+                    first: input,
+                },
+            },
+        },
+        userVerification: 'required',
+    });
+    const raw = await (async () => {
+        try {
+            return (await getFn(request));
+        }
+        catch (cause) {
+            throw new GetCredentialFailedError({
+                cause: cause,
+            });
+        }
+    })();
+    if (!raw)
+        throw new GetCredentialFailedError();
+    const response = {
+        id: raw.id,
+        raw,
+    };
+    const output = (() => {
+        try {
+            return response.raw.getClientExtensionResults().prf?.results?.first;
+        }
+        catch (cause) {
+            throw new PrfEvaluationFailedError({
+                cause: cause,
+                response,
+            });
+        }
+    })();
+    if (output === undefined)
+        throw new PrfUnavailableError({
+            response,
+        });
+    return {
+        ...response,
+        prf: parsePrfOutput(output, {
+            response,
+        }),
+    };
+}
+function getPrfInput(prf) {
+    return (prf === true ? defaultPrfInput : prf.input).slice();
+}
+function parsePrfOutput(value, context) {
+    if (ArrayBuffer.isView(value)) {
+        if (value.byteLength !== 32)
+            throw new InvalidPrfOutputError({
+                ...context,
+                size: value.byteLength,
+            });
+        return new Uint8Array(value.buffer, value.byteOffset, value.byteLength).slice();
+    }
+    const arrayBufferSize = getArrayBufferSize(value);
+    if (arrayBufferSize !== undefined) {
+        if (arrayBufferSize !== 32)
+            throw new InvalidPrfOutputError({
+                ...context,
+                size: arrayBufferSize,
+            });
+        return new Uint8Array(value).slice();
+    }
+    if (typeof value === 'object' &&
+        value !== null &&
+        'length' in value &&
+        typeof value.length === 'number') {
+        if (value.length !== 32)
+            throw new InvalidPrfOutputError({
+                ...context,
+                size: value.length,
+            });
+        const output = new Uint8Array(32);
+        for (let index = 0; index < output.length; index++) {
+            const byte = value[index];
+            if (typeof byte !== 'number' ||
+                !Number.isInteger(byte) ||
+                byte < 0 ||
+                byte > 255)
+                throw new InvalidPrfOutputError(context);
+            output[index] = byte;
+        }
+        return output;
+    }
+    throw new InvalidPrfOutputError(context);
+}
+function getArrayBufferSize(value) {
+    try {
+        return Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'byteLength')?.get?.call(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function assertExtensions(extensions) {
+    if (extensions?.prf)
+        throw new InvalidExtensionError();
+}
+/** Thrown when a caller supplies the managed `prf` extension. */
+export class InvalidExtensionError extends Errors.BaseError {
+    name = 'WebAuthn.InvalidExtensionError';
+    constructor() {
+        super('The `prf` extension is managed by this function.');
+    }
+}
+/** Thrown when raw credential options are combined with managed PRF evaluation. */
+export class InvalidOptionsError extends Errors.BaseError {
+    name = 'WebAuthn.InvalidOptionsError';
+    constructor() {
+        super('The `publicKey` option cannot be combined with managed PRF evaluation.');
+    }
+}
+/** Thrown when a WebAuthn PRF result is not a valid 32-byte output. */
+export class InvalidPrfOutputError extends Errors.BaseError {
+    /** Credential that returned the invalid PRF output, when created in this operation. */
+    credential;
+    /** Authentication response that returned the invalid PRF output, when available. */
+    response;
+    name = 'WebAuthn.InvalidPrfOutputError';
+    constructor({ credential, response, size, }) {
+        super(size === undefined
+            ? 'Expected a 32-byte PRF output.'
+            : `Expected a 32-byte PRF output, but received ${size} bytes.`);
+        this.credential = credential;
+        this.response = response;
+    }
+}
+/** Thrown when a created credential does not support PRF evaluation. */
+export class PrfNotSupportedError extends Errors.BaseError {
+    /** Credential that was created before PRF support was determined. */
+    credential;
+    name = 'WebAuthn.PrfNotSupportedError';
+    constructor({ credential }) {
+        super('The created credential does not support PRF evaluation.');
+        this.credential = credential;
+    }
+}
+/** Thrown when a credential assertion does not return a PRF output. */
+export class PrfUnavailableError extends Errors.BaseError {
+    /** Authentication response that did not contain a PRF output. */
+    response;
+    name = 'WebAuthn.PrfUnavailableError';
+    constructor({ response }) {
+        super('The credential did not return a PRF output.');
+        this.response = response;
+    }
+}
+/** Thrown when WebAuthn PRF evaluation fails after a credential ceremony. */
+export class PrfEvaluationFailedError extends Errors.BaseError {
+    /** Credential that was created before PRF evaluation failed, when available. */
+    credential;
+    /** Authentication response produced before PRF evaluation failed, when available. */
+    response;
+    name = 'WebAuthn.PrfEvaluationFailedError';
+    constructor({ cause, credential, response, }) {
+        super(credential
+            ? 'Created a credential, but failed to evaluate its PRF.'
+            : 'Failed to evaluate the credential PRF.', {
+            cause,
+        });
+        this.credential = credential;
+        this.response = response;
+    }
+}
+/** Thrown when a WebAuthn credential request fails. */
+export class GetCredentialFailedError extends Errors.BaseError {
+    name = 'WebAuthn.GetCredentialFailedError';
+    constructor({ cause } = {}) {
+        super('Failed to request credential.', {
+            cause,
+        });
+    }
+}
+//# sourceMappingURL=WebAuthn.js.map

package/dist/core/WebAuthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebAuthn.js","sourceRoot":"","sources":["../../src/core/WebAuthn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAE/B,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,+BAA+B,CAAA;AAE/D,OAAO,KAAK,YAAY,MAAM,6BAA6B,CAAA;AAG3D,cAAc,mBAAmB,CAAA;AAEjC,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;AAe9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAEpC,OAAgB;IAChB,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAClD,OAAO,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAU,CAAA;IACxD,IAAI,WAAW,IAAI,OAAO;QAAE,MAAM,IAAI,mBAAmB,EAAE,CAAA;IAE3D,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,CAAA;IAC3B,MAAM,EACJ,sBAAsB,GAAG;QACvB,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,UAAU;KACxB,EACD,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAC1B,QAAQ,EACR,UAAU,EACV,KAAK,EACL,GAAG,EACH,OAAO,EACP,GAAG,IAAI,EACR,GAAG,OAAO,CAAA;IACX,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAE5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;QAC3C,GAAG,IAAI;QACP,sBAAsB,EAAE;YACtB,GAAG,sBAAsB;YACzB,gBAAgB,EAAE,UAAU;SAC7B;QACD,SAAS;QACT,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7B,UAAU,EAAE;YACV,GAAG,UAAU;YACb,GAAG,EAAE;gBACH,IAAI,EAAE;oBACJ,KAAK,EAAE,KAAK;iBACb;aACF;SACF;QACD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;KACX,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,GAAG,CAAA;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wBAAwB,CAAC;gBACjC,KAAK,EAAE,KAAc;gBACrB,UAAU;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAA;IACrC,IAAI,MAAM,KAAK,SAAS;QACtB,OAAO;YACL,GAAG,UAAU;YACb,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE;gBAC1B,UAAU;aACX,CAAC;SACM,CAAA;IAEZ,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAC1B,MAAM,IAAI,oBAAoB,CAAC;YAC7B,UAAU;SACX,CAAC,CAAA;IAEJ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;YACvB,GAAG,EAAE;gBACH,KAAK;aACN;YACD,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE;YAC7B,MAAM,IAAI,KAAK,CACb,wBAAwB,UAAU,CAAC,EAAE,oBAAoB,MAAM,CAAC,EAAE,IAAI,CACvE,CAAA;QACH,OAAO;YACL,GAAG,UAAU;YACb,GAAG,EAAE,MAAM,CAAC,GAAG;SACP,CAAA;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC;YACjC,KAAK,EAAE,KAAc;YACrB,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AA0ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA8B;IAE9B,IAAI,WAAW,IAAI,OAAO;QAAE,MAAM,IAAI,mBAAmB,EAAE,CAAA;IAE3D,MAAM,EACJ,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAC1B,UAAU,EACV,KAAK,GAAG,CAAC,OAAmD,EAAE,EAAE,CAC9D,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,OAAgB,CAAC,EACpD,GAAG,EACH,GAAG,IAAI,EACR,GAAG,OAAO,CAAA;IACX,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAE5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC;QACxC,GAAG,IAAI;QACP,SAAS;QACT,UAAU,EAAE;YACV,GAAG,UAAU;YACb,GAAG,EAAE;gBACH,IAAI,EAAE;oBACJ,KAAK,EAAE,KAAK;iBACb;aACF;SACF;QACD,gBAAgB,EAAE,UAAU;KAC7B,CAAC,CAAA;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAqC,CAAA;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wBAAwB,CAAC;gBACjC,KAAK,EAAE,KAAc;aACtB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;IAE9C,MAAM,QAAQ,GAAG;QACf,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG;KACJ,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAA;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wBAAwB,CAAC;gBACjC,KAAK,EAAE,KAAc;gBACrB,QAAQ;aACT,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,mBAAmB,CAAC;YAC5B,QAAQ;SACT,CAAC,CAAA;IAEJ,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE;YAC1B,QAAQ;SACT,CAAC;KACH,CAAA;AACH,CAAC;AAsDD,SAAS,WAAW,CAAC,GAAQ;IAC3B,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAA;AAC7D,CAAC;AAOD,SAAS,cAAc,CACrB,KAAc,EACd,OAAyB;IAEzB,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE;YACzB,MAAM,IAAI,qBAAqB,CAAC;gBAC9B,GAAG,OAAO;gBACV,IAAI,EAAE,KAAK,CAAC,UAAU;aACvB,CAAC,CAAA;QACJ,OAAO,IAAI,UAAU,CACnB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAC,KAAK,EAAE,CAAA;IACX,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACjD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,eAAe,KAAK,EAAE;YACxB,MAAM,IAAI,qBAAqB,CAAC;gBAC9B,GAAG,OAAO;gBACV,IAAI,EAAE,eAAe;aACtB,CAAC,CAAA;QACJ,OAAO,IAAI,UAAU,CAAC,KAAoB,CAAC,CAAC,KAAK,EAAE,CAAA;IACrD,CAAC;IAED,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,QAAQ,IAAI,KAAK;QACjB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAChC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YACrB,MAAM,IAAI,qBAAqB,CAAC;gBAC9B,GAAG,OAAO;gBACV,IAAI,EAAE,KAAK,CAAC,MAAM;aACnB,CAAC,CAAA;QAEJ,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;QACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,GAAI,KAA4B,CAAC,KAAK,CAAC,CAAA;YACjD,IACE,OAAO,IAAI,KAAK,QAAQ;gBACxB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBACvB,IAAI,GAAG,CAAC;gBACR,IAAI,GAAG,GAAG;gBAEV,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QACtB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,wBAAwB,CACpC,WAAW,CAAC,SAAS,EACrB,YAAY,CACb,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAkE;IAElE,IAAI,UAAU,EAAE,GAAG;QAAE,MAAM,IAAI,qBAAqB,EAAE,CAAA;AACxD,CAAC;AAED,iEAAiE;AACjE,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,SAAS;IACvC,IAAI,GAAG,gCAAgC,CAAA;IAEzD;QACE,KAAK,CAAC,kDAAkD,CAAC,CAAA;IAC3D,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,SAAS;IACrC,IAAI,GAAG,8BAA8B,CAAA;IAEvD;QACE,KAAK,CACH,wEAAwE,CACzE,CAAA;IACH,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,SAAS;IACzD,uFAAuF;IAC9E,UAAU,CAAoC;IAEvD,oFAAoF;IAC3E,QAAQ,CAAqC;IAEpC,IAAI,GAAG,gCAAgC,CAAA;IAEzD,YAAY,EACV,UAAU,EACV,QAAQ,EACR,IAAI,GAGL;QACC,KAAK,CACH,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,gCAAgC;YAClC,CAAC,CAAC,+CAA+C,IAAI,SAAS,CACjE,CAAA;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,SAAS;IACxD,qEAAqE;IAC5D,UAAU,CAAuB;IAExB,IAAI,GAAG,+BAA+B,CAAA;IAExD,YAAY,EAAE,UAAU,EAAyC;QAC/D,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAChE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,SAAS;IACvD,iEAAiE;IACxD,QAAQ,CAAwB;IAEvB,IAAI,GAAG,8BAA8B,CAAA;IAEvD,YAAY,EAAE,QAAQ,EAAwC;QAC5D,KAAK,CAAC,6CAA6C,CAAC,CAAA;QACpD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,SAAgB;IACnE,gFAAgF;IACvE,UAAU,CAAoC;IAEvD,qFAAqF;IAC5E,QAAQ,CAAqC;IAEpC,IAAI,GAAG,mCAAmC,CAAA;IAE5D,YAAY,EACV,KAAK,EACL,UAAU,EACV,QAAQ,GAKT;QACC,KAAK,CACH,UAAU;YACR,CAAC,CAAC,uDAAuD;YACzD,CAAC,CAAC,wCAAwC,EAC5C;YACE,KAAK;SACN,CACF,CAAA;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,wBAAyB,SAAQ,MAAM,CAAC,SAAgB;IACjD,IAAI,GAAG,mCAAmC,CAAA;IAE5D,YAAY,EAAE,KAAK,KAAoC,EAAE;QACvD,KAAK,CAAC,+BAA+B,EAAE;YACrC,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;CACF"}