1function u(e){const t=new Uint8Array(e);let n="";for(const r of t)n+=String.fromCharCode(r);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function g(e){const t=e.replace(/-/g,"+").replace(/_/g,"/"),n=(4-t.length%4)%4,a=t.padEnd(t.length+n,"="),r=atob(a),l=new ArrayBuffer(r.length),d=new Uint8Array(l);for(let o=0;o<r.length;o++)d[o]=r.charCodeAt(o);return l}function R(){return S.stubThis(globalThis?.PublicKeyCredential!==void 0&&typeof globalThis.PublicKeyCredential=="function")}const S={stubThis:e=>e};function m(e){const{id:t}=e;return{...e,id:g(t),transports:e.transports}}function y(e){return e==="localhost"||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)}class i extends Error{constructor({message:t,code:n,cause:a,name:r}){super(t,{cause:a}),Object.defineProperty(this,"code",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),this.name=r??a.name,this.code=n}}function I({error:e,options:t}){const{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new i({message:"Registration ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else if(e.name==="ConstraintError"){if(n.authenticatorSelection?.requireResidentKey===!0)return new i({message:"Discoverable credentials were required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",cause:e});if(t.mediation==="conditional"&&n.authenticatorSelection?.userVerification==="required")return new i({message:"User verification was required during automatic registration but it could not be performed",code:"ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",cause:e});if(n.authenticatorSelection?.userVerification==="required")return new i({message:"User verification was required but no available authenticator supported it",code:"ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",cause:e})}else{if(e.name==="InvalidStateError")return new i({message:"The authenticator was previously registered",code:"ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",cause:e});if(e.name==="NotAllowedError")return new i({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="NotSupportedError")return n.pubKeyCredParams.filter(r=>r.type==="public-key").length===0?new i({message:'No entry in pubKeyCredParams was of type "public-key"',code:"ERROR_MALFORMED_PUBKEYCREDPARAMS",cause:e}):new i({message:"No available authenticator supported any of the specified pubKeyCredParams algorithms",code:"ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",cause:e});if(e.name==="SecurityError"){const a=globalThis.location.hostname;if(y(a)){if(n.rp.id!==a)return new i({message:`The RP ID "${n.rp.id}" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new i({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="TypeError"){if(n.user.id.byteLength<1||n.user.id.byteLength>64)return new i({message:"User ID was not between 1 and 64 characters",code:"ERROR_INVALID_USER_ID_LENGTH",cause:e})}else if(e.name==="UnknownError")return new i({message:"The authenticator was unable to process the specified options, or could not create a new credential",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}class T{constructor(){Object.defineProperty(this,"controller",{enumerable:!0,configurable:!0,writable:!0,value:void 0})}createNewAbortSignal(){if(this.controller){const n=new Error("Cancelling existing WebAuthn API call for new one");n.name="AbortError",this.controller.abort(n)}const t=new AbortController;return this.controller=t,t.signal}cancelCeremony(){if(this.controller){const t=new Error("Manually cancelling existing WebAuthn API call");t.name="AbortError",this.controller.abort(t),this.controller=void 0}}}const O=new T,P=["cross-platform","platform"];function _(e){if(e&&!(P.indexOf(e)<0))return e}async function D(e){!e.optionsJSON&&e.challenge&&(console.warn("startRegistration() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});const{optionsJSON:t,useAutoRegister:n=!1}=e;if(!R())throw new Error("WebAuthn is not supported in this browser");const a={...t,challenge:g(t.challenge),user:{...t.user,id:g(t.user.id)},excludeCredentials:t.excludeCredentials?.map(m)},r={};n&&(r.mediation="conditional"),r.publicKey=a,r.signal=O.createNewAbortSignal();let l;try{l=await navigator.credentials.create(r)}catch(c){throw I({error:c,options:r})}if(!l)throw new Error("Registration was not completed");const{id:d,rawId:o,response:s,type:w}=l;let h;typeof s.getTransports=="function"&&(h=s.getTransports());let p;if(typeof s.getPublicKeyAlgorithm=="function")try{p=s.getPublicKeyAlgorithm()}catch(c){A("getPublicKeyAlgorithm()",c)}let f;if(typeof s.getPublicKey=="function")try{const c=s.getPublicKey();c!==null&&(f=u(c))}catch(c){A("getPublicKey()",c)}let b;if(typeof s.getAuthenticatorData=="function")try{b=u(s.getAuthenticatorData())}catch(c){A("getAuthenticatorData()",c)}return{id:d,rawId:u(o),response:{attestationObject:u(s.attestationObject),clientDataJSON:u(s.clientDataJSON),transports:h,publicKeyAlgorithm:p,publicKey:f,authenticatorData:b},type:w,clientExtensionResults:l.getClientExtensionResults(),authenticatorAttachment:_(l.authenticatorAttachment)}}function A(e,t){console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them. 2`,t)}function C(){if(!R())return E.stubThis(new Promise(t=>t(!1)));const e=globalThis.PublicKeyCredential;return e?.isConditionalMediationAvailable===void 0?E.stubThis(new Promise(t=>t(!1))):E.stubThis(e.isConditionalMediationAvailable())}const E={stubThis:e=>e};function N({error:e,options:t}){const{publicKey:n}=t;if(!n)throw Error("options was missing required publicKey property");if(e.name==="AbortError"){if(t.signal instanceof AbortSignal)return new i({message:"Authentication ceremony was sent an abort signal",code:"ERROR_CEREMONY_ABORTED",cause:e})}else{if(e.name==="NotAllowedError")return new i({message:e.message,code:"ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",cause:e});if(e.name==="SecurityError"){const a=globalThis.location.hostname;if(y(a)){if(n.rpId!==a)return new i({message:`The RP ID "${n.rpId}
2" is invalid for this domain`,code:"ERROR_INVALID_RP_ID",cause:e})}else return new i({message:`${globalThis.location.hostname} is an invalid domain`,code:"ERROR_INVALID_DOMAIN",cause:e})}else if(e.name==="UnknownError")return new i({message:"The authenticator was unable to process the specified options, or could not create a new assertion signature",code:"ERROR_AUTHENTICATOR_GENERAL_ERROR",cause:e})}return e}async function v(e){!e.optionsJSON&&e.challenge&&(console.warn("startAuthentication() was not called correctly. It will try to continue with the provided options, but this call should be refactored to use the expected call structure instead. See https://simplewebauthn.dev/docs/packages/browser#typeerror-cannot-read-properties-of-undefined-reading-challenge for more information."),e={optionsJSON:e});const{optionsJSON:t,useBrowserAutofill:n=!1,verifyBrowserAutofillInput:a=!0}=e;if(!R())throw new Error("WebAuthn is not supported in this browser");let r;t.allowCredentials?.length!==0&&(r=t.allowCredentials?.map(m));const l={...t,challenge:g(t.challenge),allowCredentials:r},d={};if(n){if(!await C())throw Error("Browser does not support WebAuthn autofill");if(document.querySelectorAll("input[autocomplete$='webauthn']").length<1&&a)throw Error('No <input> with "webauthn" as the only or last value in its `autocomplete` attribute was detected');d.mediation="conditional",l.allowCredentials=[]}d.publicKey=l,d.signal=O.createNewAbortSignal();let o;try{o=await navigator.credentials.get(d)}catch(b){throw N({error:b,options:d})}if(!o)throw new Error("Authentication was not completed");const{id:s,rawId:w,response:h,type:p}=o;let f;return h.userHandle&&(f=u(h.userHandle)),{id:s,rawId:u(w),response:{authenticatorData:u(h.authenticatorData),clientDataJSON:u(h.clientDataJSON),signature:u(h.signature),userHandle:f},type:p,clientExtensionResults:o.getClientExtensionResults(),authenticatorAttachment:_(o.authenticatorAttachment)}}function K(){return R()?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():new Promise(e=>e(!1))}export{O as WebAuthnAbortService,i as WebAuthnError,E as _browserSupportsWebAuthnAutofillInternals,S as _browserSupportsWebAuthnInternals,g as base64URLStringToBuffer,R as browserSupportsWebAuthn,C as browserSupportsWebAuthnAutofill,u as bufferToBase64URLString,K as platformAuthenticatorIsAvailable,v as startAuthentication,D as startRegistration};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.