@soropass/core 0.1.0

package/dist/checkAuth-C2AcXqFe.d.cts

@@ -0,0 +1,110 @@
+import { xdr } from '@stellar/stellar-sdk';
+
+/** The subset of clientDataJSON fields we rely on. */
+interface ClientData {
+    type: string;
+    /** base64url-encoded challenge as embedded by the client. */
+    challenge: string;
+    origin: string;
+    crossOrigin?: boolean;
+}
+/** Encode a raw challenge as the base64url string embedded in clientDataJSON. */
+declare function encodeChallenge(challenge: Uint8Array): string;
+/** Decode the base64url challenge embedded in clientDataJSON back to bytes. */
+declare function decodeChallenge(challenge: string): Uint8Array;
+/** Parse clientDataJSON bytes into a typed, validated-shape object. */
+declare function parseClientDataJSON(clientDataJSON: Uint8Array): ClientData;
+/**
+ * Parse and verify clientDataJSON for an authentication (`webauthn.get`)
+ * assertion: the ceremony type, the origin (exact match against one or more
+ * allowed origins), and the embedded challenge (base64url string).
+ */
+declare function verifyClientDataJSON(clientDataJSON: Uint8Array, expected: {
+    origin: string | string[];
+    challenge: string;
+}): ClientData;
+
+interface AuthenticatorDataFlags {
+    /** User Present */
+    up: boolean;
+    /** User Verified */
+    uv: boolean;
+    /** Backup Eligible */
+    be: boolean;
+    /** Backup State */
+    bs: boolean;
+    /** Attested credential data present */
+    at: boolean;
+    /** Extension data present */
+    ed: boolean;
+    /** Raw flags byte. */
+    bits: number;
+}
+interface ParsedAuthenticatorData {
+    rpIdHash: Uint8Array;
+    flags: AuthenticatorDataFlags;
+    signCount: number;
+    aaguid?: Uint8Array;
+    credentialId?: Uint8Array;
+    /** Raw CBOR-encoded COSE public key (exact bytes), if attested data present. */
+    credentialPublicKey?: Uint8Array;
+}
+/** Parse the authenticatorData byte structure (WebAuthn §6.1). */
+declare function parseAuthenticatorData(authData: Uint8Array): ParsedAuthenticatorData;
+/** Verify that authenticatorData's rpIdHash equals SHA-256(rpId). */
+declare function verifyRpIdHash(authData: Uint8Array, rpId: string): void;
+
+interface VerifyAssertionInput {
+    /** SEC-1 uncompressed public key (65 bytes, `0x04 ‖ X ‖ Y`). */
+    publicKey: Uint8Array;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    /** DER-encoded (≤72 B) or already-compact (64 B) signature. */
+    signature: Uint8Array;
+}
+/**
+ * Verify a WebAuthn assertion the way the on-chain `secp256r1_verify` does:
+ * reconstruct `SHA256(authData ‖ SHA256(cdj))` and check ECDSA. `lowS: false`
+ * mirrors the host function, which does NOT enforce low-S (we normalize
+ * separately before submitting — see S04/YK-430).
+ */
+declare function verifyAssertionSignature(input: VerifyAssertionInput): boolean;
+
+interface CheckAuthResult {
+    success: boolean;
+    /** clientDataJSON.challenge === base64url(preimage hash). */
+    challengeBound: boolean;
+    /** secp256r1_verify over SHA256(authData ‖ SHA256(cdj)) passed. */
+    signatureValid: boolean;
+    reason?: string;
+}
+/**
+ * A faithful JavaScript model of the on-chain `__check_auth` (kalepail
+ * `webauthn-wallet` `verify.rs`): reconstruct `SHA256(authenticator_data ‖
+ * SHA256(client_data_json))`, run `secp256r1_verify` (which does NOT enforce
+ * low-S — hence the client-side normalization), and assert challenge-binding
+ * (`clientDataJSON.challenge === base64url(signature_payload)`). Lets us prove
+ * the assembly without a live Soroban RPC; the real on-chain run is exercised
+ * by the kit integration (S17) and the demo (S21).
+ */
+declare function referenceCheckAuth(entry: xdr.SorobanAuthorizationEntry, publicKey: Uint8Array, networkPassphrase: string): CheckAuthResult;
+interface SmartWalletCheckAuthResult {
+    success: boolean;
+    signers: {
+        credentialId: string;
+        challengeBound: boolean;
+        signatureValid: boolean;
+    }[];
+    reason?: string;
+}
+/**
+ * A reference model of passkey-kit's smart-wallet `__check_auth`: unwrap the
+ * `Signatures(Map<SignerKey, Signature>)` value (`ScVal::Vec([ScVal::Map(...)])`),
+ * and for each `SignerKey::Secp256r1(id) => Signature::Secp256r1(struct)` entry,
+ * look up that credential id's SEC-1 public key and verify the struct. Succeeds
+ * only when the map is non-empty and every signer verifies + is challenge-bound.
+ * `publicKeyFor` receives the lowercase-hex credential id.
+ */
+declare function referenceSmartWalletCheckAuth(entry: xdr.SorobanAuthorizationEntry, publicKeyFor: (credentialIdHex: string) => Uint8Array | undefined, networkPassphrase: string): SmartWalletCheckAuthResult;
+
+export { type AuthenticatorDataFlags as A, type CheckAuthResult as C, type ParsedAuthenticatorData as P, type SmartWalletCheckAuthResult as S, type VerifyAssertionInput as V, type ClientData as a, parseClientDataJSON as b, referenceSmartWalletCheckAuth as c, decodeChallenge as d, encodeChallenge as e, verifyClientDataJSON as f, verifyRpIdHash as g, parseAuthenticatorData as p, referenceCheckAuth as r, verifyAssertionSignature as v };

package/dist/checkAuth-C2AcXqFe.d.ts

@@ -0,0 +1,110 @@
+import { xdr } from '@stellar/stellar-sdk';
+
+/** The subset of clientDataJSON fields we rely on. */
+interface ClientData {
+    type: string;
+    /** base64url-encoded challenge as embedded by the client. */
+    challenge: string;
+    origin: string;
+    crossOrigin?: boolean;
+}
+/** Encode a raw challenge as the base64url string embedded in clientDataJSON. */
+declare function encodeChallenge(challenge: Uint8Array): string;
+/** Decode the base64url challenge embedded in clientDataJSON back to bytes. */
+declare function decodeChallenge(challenge: string): Uint8Array;
+/** Parse clientDataJSON bytes into a typed, validated-shape object. */
+declare function parseClientDataJSON(clientDataJSON: Uint8Array): ClientData;
+/**
+ * Parse and verify clientDataJSON for an authentication (`webauthn.get`)
+ * assertion: the ceremony type, the origin (exact match against one or more
+ * allowed origins), and the embedded challenge (base64url string).
+ */
+declare function verifyClientDataJSON(clientDataJSON: Uint8Array, expected: {
+    origin: string | string[];
+    challenge: string;
+}): ClientData;
+
+interface AuthenticatorDataFlags {
+    /** User Present */
+    up: boolean;
+    /** User Verified */
+    uv: boolean;
+    /** Backup Eligible */
+    be: boolean;
+    /** Backup State */
+    bs: boolean;
+    /** Attested credential data present */
+    at: boolean;
+    /** Extension data present */
+    ed: boolean;
+    /** Raw flags byte. */
+    bits: number;
+}
+interface ParsedAuthenticatorData {
+    rpIdHash: Uint8Array;
+    flags: AuthenticatorDataFlags;
+    signCount: number;
+    aaguid?: Uint8Array;
+    credentialId?: Uint8Array;
+    /** Raw CBOR-encoded COSE public key (exact bytes), if attested data present. */
+    credentialPublicKey?: Uint8Array;
+}
+/** Parse the authenticatorData byte structure (WebAuthn §6.1). */
+declare function parseAuthenticatorData(authData: Uint8Array): ParsedAuthenticatorData;
+/** Verify that authenticatorData's rpIdHash equals SHA-256(rpId). */
+declare function verifyRpIdHash(authData: Uint8Array, rpId: string): void;
+
+interface VerifyAssertionInput {
+    /** SEC-1 uncompressed public key (65 bytes, `0x04 ‖ X ‖ Y`). */
+    publicKey: Uint8Array;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    /** DER-encoded (≤72 B) or already-compact (64 B) signature. */
+    signature: Uint8Array;
+}
+/**
+ * Verify a WebAuthn assertion the way the on-chain `secp256r1_verify` does:
+ * reconstruct `SHA256(authData ‖ SHA256(cdj))` and check ECDSA. `lowS: false`
+ * mirrors the host function, which does NOT enforce low-S (we normalize
+ * separately before submitting — see S04/YK-430).
+ */
+declare function verifyAssertionSignature(input: VerifyAssertionInput): boolean;
+
+interface CheckAuthResult {
+    success: boolean;
+    /** clientDataJSON.challenge === base64url(preimage hash). */
+    challengeBound: boolean;
+    /** secp256r1_verify over SHA256(authData ‖ SHA256(cdj)) passed. */
+    signatureValid: boolean;
+    reason?: string;
+}
+/**
+ * A faithful JavaScript model of the on-chain `__check_auth` (kalepail
+ * `webauthn-wallet` `verify.rs`): reconstruct `SHA256(authenticator_data ‖
+ * SHA256(client_data_json))`, run `secp256r1_verify` (which does NOT enforce
+ * low-S — hence the client-side normalization), and assert challenge-binding
+ * (`clientDataJSON.challenge === base64url(signature_payload)`). Lets us prove
+ * the assembly without a live Soroban RPC; the real on-chain run is exercised
+ * by the kit integration (S17) and the demo (S21).
+ */
+declare function referenceCheckAuth(entry: xdr.SorobanAuthorizationEntry, publicKey: Uint8Array, networkPassphrase: string): CheckAuthResult;
+interface SmartWalletCheckAuthResult {
+    success: boolean;
+    signers: {
+        credentialId: string;
+        challengeBound: boolean;
+        signatureValid: boolean;
+    }[];
+    reason?: string;
+}
+/**
+ * A reference model of passkey-kit's smart-wallet `__check_auth`: unwrap the
+ * `Signatures(Map<SignerKey, Signature>)` value (`ScVal::Vec([ScVal::Map(...)])`),
+ * and for each `SignerKey::Secp256r1(id) => Signature::Secp256r1(struct)` entry,
+ * look up that credential id's SEC-1 public key and verify the struct. Succeeds
+ * only when the map is non-empty and every signer verifies + is challenge-bound.
+ * `publicKeyFor` receives the lowercase-hex credential id.
+ */
+declare function referenceSmartWalletCheckAuth(entry: xdr.SorobanAuthorizationEntry, publicKeyFor: (credentialIdHex: string) => Uint8Array | undefined, networkPassphrase: string): SmartWalletCheckAuthResult;
+
+export { type AuthenticatorDataFlags as A, type CheckAuthResult as C, type ParsedAuthenticatorData as P, type SmartWalletCheckAuthResult as S, type VerifyAssertionInput as V, type ClientData as a, parseClientDataJSON as b, referenceSmartWalletCheckAuth as c, decodeChallenge as d, encodeChallenge as e, verifyClientDataJSON as f, verifyRpIdHash as g, parseAuthenticatorData as p, referenceCheckAuth as r, verifyAssertionSignature as v };

package/dist/chunk-AHFGTIBY.js

@@ -0,0 +1,36 @@
+import { defaultCredentialStorage, browserWebAuthnClient } from './chunk-LB4HOTLV.js';
+
+// src/ceremonies/connect.ts
+async function probeConditionalMediation() {
+  const pkc = globalThis.PublicKeyCredential;
+  if (!pkc?.isConditionalMediationAvailable) return false;
+  try {
+    return await pkc.isConditionalMediationAvailable();
+  } catch {
+    return false;
+  }
+}
+async function connect(options) {
+  const storage = options.storage ?? defaultCredentialStorage();
+  const credentialId = storage.get(options.rpId);
+  if (!credentialId) return null;
+  const silentSupported = options.silentMediationSupported ?? await probeConditionalMediation();
+  if (silentSupported) {
+    const webauthn = options.webauthn ?? browserWebAuthnClient();
+    try {
+      await webauthn.get({
+        rpId: options.rpId,
+        allowCredentials: [credentialId],
+        mediation: "silent"
+      });
+    } catch {
+    }
+  }
+  const accounts = await options.indexer.resolveByCredential(credentialId);
+  const contractId = accounts[0]?.contractId;
+  return contractId ? { contractId, credentialId } : null;
+}
+
+export { connect };
+//# sourceMappingURL=chunk-AHFGTIBY.js.map
+//# sourceMappingURL=chunk-AHFGTIBY.js.map

package/dist/chunk-AHFGTIBY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ceremonies/connect.ts"],"names":[],"mappings":";;;AAkBA,eAAe,yBAAA,GAA8C;AAC3D,EAAA,MAAM,MACJ,UAAA,CAGA,mBAAA;AACF,EAAA,IAAI,CAAC,GAAA,EAAK,+BAAA,EAAiC,OAAO,KAAA;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAI,+BAAA,EAAgC;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AASA,eAAsB,QAAQ,OAAA,EAAwD;AACpF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,wBAAA,EAAyB;AAC5D,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA;AAC7C,EAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,wBAAA,IAA6B,MAAM,yBAAA,EAA0B;AAC7F,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAC3D,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,GAAA,CAAI;AAAA,QACjB,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,gBAAA,EAAkB,CAAC,YAAY,CAAA;AAAA,QAC/B,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA,CAAQ,oBAAoB,YAAY,CAAA;AACvE,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,CAAC,CAAA,EAAG,UAAA;AAChC,EAAA,OAAO,UAAA,GAAa,EAAE,UAAA,EAAY,YAAA,EAAa,GAAI,IAAA;AACrD","file":"chunk-AHFGTIBY.js","sourcesContent":["import type { IndexerAdapter } from '../adapters/types';\nimport { browserWebAuthnClient, defaultCredentialStorage } from './browserClient';\nimport type { CredentialStorage, WebAuthnClient } from './types';\n\nexport interface ConnectOptions {\n  rpId: string;\n  indexer: IndexerAdapter;\n  webauthn?: WebAuthnClient;\n  storage?: CredentialStorage;\n  /** Override silent-mediation detection (default: probe isConditionalMediationAvailable). */\n  silentMediationSupported?: boolean;\n}\n\nexport interface ConnectResult {\n  contractId: string;\n  credentialId: string;\n}\n\nasync function probeConditionalMediation(): Promise<boolean> {\n  const pkc = (\n    globalThis as {\n      PublicKeyCredential?: { isConditionalMediationAvailable?: () => Promise<boolean> };\n    }\n  ).PublicKeyCredential;\n  if (!pkc?.isConditionalMediationAvailable) return false;\n  try {\n    return await pkc.isConditionalMediationAvailable();\n  } catch {\n    return false;\n  }\n}\n\n/**\n * `connect` — silent reconnect using the stored credential id. Where conditional\n * mediation is available, does a best-effort `mediation:'silent'` liveness check;\n * the C-address is resolved via the IndexerAdapter regardless, so connect\n * degrades gracefully where silent mediation is unsupported. Returns null when\n * there is no stored credential (the caller should `recover`) or no account.\n */\nexport async function connect(options: ConnectOptions): Promise<ConnectResult | null> {\n  const storage = options.storage ?? defaultCredentialStorage();\n  const credentialId = storage.get(options.rpId);\n  if (!credentialId) return null;\n\n  const silentSupported = options.silentMediationSupported ?? (await probeConditionalMediation());\n  if (silentSupported) {\n    const webauthn = options.webauthn ?? browserWebAuthnClient();\n    try {\n      await webauthn.get({\n        rpId: options.rpId,\n        allowCredentials: [credentialId],\n        mediation: 'silent',\n      });\n    } catch {\n      // A silent get may no-op or reject; resolution is via the indexer.\n    }\n  }\n\n  const accounts = await options.indexer.resolveByCredential(credentialId);\n  const contractId = accounts[0]?.contractId;\n  return contractId ? { contractId, credentialId } : null;\n}\n"]}

package/dist/chunk-AMYFJQAC.js

@@ -0,0 +1,29 @@
+// src/errors.ts
+var KIT_ERROR_CODES = Object.freeze([
+  "USER_CANCELLED",
+  "ES256_NOT_SUPPORTED",
+  "RP_ID_MISMATCH",
+  "ORIGIN_MISMATCH",
+  "CHALLENGE_MISMATCH",
+  "INVALID_SIGNATURE_DER",
+  "INVALID_PUBLIC_KEY",
+  "CONTRACT_AUTH_FAILED",
+  "NETWORK_ERROR",
+  "UNSUPPORTED_AUTHENTICATOR"
+]);
+var KitError = class _KitError extends Error {
+  code;
+  name = "KitError";
+  constructor(code, message, options) {
+    super(message ?? code, options);
+    this.code = code;
+    Object.setPrototypeOf(this, _KitError.prototype);
+  }
+};
+function isKitError(value) {
+  return value instanceof KitError;
+}
+
+export { KIT_ERROR_CODES, KitError, isKitError };
+//# sourceMappingURL=chunk-AMYFJQAC.js.map
+//# sourceMappingURL=chunk-AMYFJQAC.js.map

package/dist/chunk-AMYFJQAC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts"],"names":[],"mappings":";AAIO,IAAM,eAAA,GAAkB,OAAO,MAAA,CAAO;AAAA,EAC3C,gBAAA;AAAA,EACA,qBAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA,oBAAA;AAAA,EACA,uBAAA;AAAA,EACA,oBAAA;AAAA,EACA,sBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAU;AAKH,IAAM,QAAA,GAAN,MAAM,SAAA,SAAiB,KAAA,CAAM;AAAA,EACzB,IAAA;AAAA,EACS,IAAA,GAAO,UAAA;AAAA,EAEzB,WAAA,CAAY,IAAA,EAAoB,OAAA,EAAkB,OAAA,EAA+B;AAC/E,IAAA,KAAA,CAAM,OAAA,IAAW,MAAM,OAAO,CAAA;AAC9B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAGZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,SAAA,CAAS,SAAS,CAAA;AAAA,EAChD;AACF;AAEO,SAAS,WAAW,KAAA,EAAmC;AAC5D,EAAA,OAAO,KAAA,YAAiB,QAAA;AAC1B","file":"chunk-AMYFJQAC.js","sourcesContent":["/**\n * The frozen taxonomy of error codes the SDK can throw. This union is\n * deliberately closed — every failure path maps to exactly one of these.\n */\nexport const KIT_ERROR_CODES = Object.freeze([\n  'USER_CANCELLED',\n  'ES256_NOT_SUPPORTED',\n  'RP_ID_MISMATCH',\n  'ORIGIN_MISMATCH',\n  'CHALLENGE_MISMATCH',\n  'INVALID_SIGNATURE_DER',\n  'INVALID_PUBLIC_KEY',\n  'CONTRACT_AUTH_FAILED',\n  'NETWORK_ERROR',\n  'UNSUPPORTED_AUTHENTICATOR',\n] as const);\n\nexport type KitErrorCode = (typeof KIT_ERROR_CODES)[number];\n\n/** Structured error carrying a machine-readable {@link KitErrorCode}. */\nexport class KitError extends Error {\n  readonly code: KitErrorCode;\n  override readonly name = 'KitError';\n\n  constructor(code: KitErrorCode, message?: string, options?: { cause?: unknown }) {\n    super(message ?? code, options);\n    this.code = code;\n    // Restore the prototype chain so `instanceof KitError` works after\n    // down-level transpilation to CJS.\n    Object.setPrototypeOf(this, KitError.prototype);\n  }\n}\n\nexport function isKitError(value: unknown): value is KitError {\n  return value instanceof KitError;\n}\n"]}

package/dist/chunk-BIRF5I6I.js

@@ -0,0 +1,265 @@
+import { sha256, concatBytes, verifyClientDataJSON, parseClientDataJSON, parseAuthenticatorData, verifyRpIdHash } from './chunk-JNJ2FY45.js';
+import { utf8ToBytes, bytesToBase64Url } from './chunk-LB4HOTLV.js';
+import { KitError } from './chunk-AMYFJQAC.js';
+import { p256 } from '@noble/curves/nist';
+import { xdr, hash } from '@stellar/stellar-sdk';
+
+var MAX_DER_LENGTH = 72;
+function derToCompact(der) {
+  if (der.length > MAX_DER_LENGTH) {
+    throw new KitError(
+      "INVALID_SIGNATURE_DER",
+      `DER signature is ${der.length} bytes, exceeds max ${MAX_DER_LENGTH}`
+    );
+  }
+  try {
+    return p256.Signature.fromDER(der).toCompactRawBytes();
+  } catch (cause) {
+    throw new KitError("INVALID_SIGNATURE_DER", "failed to parse DER signature", { cause });
+  }
+}
+function assertCompactLength(compactSignature) {
+  if (compactSignature.length !== 64) {
+    throw new KitError(
+      "INVALID_SIGNATURE_DER",
+      `compact signature must be 64 bytes, got ${compactSignature.length}`
+    );
+  }
+}
+function isLowS(compactSignature) {
+  assertCompactLength(compactSignature);
+  return !p256.Signature.fromCompact(compactSignature).hasHighS();
+}
+function normalizeLowS(compactSignature) {
+  assertCompactLength(compactSignature);
+  return p256.Signature.fromCompact(compactSignature).normalizeS().toCompactRawBytes();
+}
+function derToCompactLowS(der) {
+  return normalizeLowS(derToCompact(der));
+}
+
+// src/webauthn/payload.ts
+function reconstructSignedPayload(input) {
+  const clientDataHash = sha256(input.clientDataJSON);
+  return sha256(concatBytes(input.authenticatorData, clientDataHash));
+}
+function verifyAssertionSignature(input) {
+  const payload = reconstructSignedPayload(input);
+  const compact = input.signature.length === 64 ? input.signature : derToCompact(input.signature);
+  return p256.verify(compact, payload, input.publicKey, { lowS: false, format: "compact" });
+}
+function authEntryChallengeBytes(entry, networkPassphrase) {
+  const credentials = entry.credentials();
+  if (credentials.switch().name !== "sorobanCredentialsAddress") {
+    throw new KitError("CONTRACT_AUTH_FAILED", "auth entry has no address credentials to sign");
+  }
+  const address = credentials.address();
+  const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
+    new xdr.HashIdPreimageSorobanAuthorization({
+      networkId: Buffer.from(hash(Buffer.from(utf8ToBytes(networkPassphrase)))),
+      nonce: address.nonce(),
+      signatureExpirationLedger: address.signatureExpirationLedger(),
+      invocation: entry.rootInvocation()
+    })
+  );
+  return new Uint8Array(hash(preimage.toXDR()));
+}
+function authEntryChallenge(entry, networkPassphrase) {
+  return bytesToBase64Url(authEntryChallengeBytes(entry, networkPassphrase));
+}
+function applyAssertionToEntry(entry, assertion) {
+  entry.credentials().address().signature(buildSignatureScVal(assertion));
+  return entry;
+}
+function buildSignatureScVal(assertion) {
+  return xdr.ScVal.scvMap([
+    bytesField("authenticator_data", assertion.authenticatorData),
+    bytesField("client_data_json", assertion.clientDataJSON),
+    bytesField("signature", assertion.signature)
+  ]);
+}
+function bytesField(name, bytes) {
+  return new xdr.ScMapEntry({
+    key: xdr.ScVal.scvSymbol(name),
+    val: xdr.ScVal.scvBytes(Buffer.from(bytes))
+  });
+}
+function buildSignerKeyScVal(credentialId) {
+  return xdr.ScVal.scvVec([
+    xdr.ScVal.scvSymbol("Secp256r1"),
+    xdr.ScVal.scvBytes(Buffer.from(credentialId))
+  ]);
+}
+function buildSmartWalletSignatureVariant(assertion) {
+  return xdr.ScVal.scvVec([xdr.ScVal.scvSymbol("Secp256r1"), buildSignatureScVal(assertion)]);
+}
+function decomposeSignerKey(key) {
+  const vec = key.vec();
+  if (!vec || vec.length < 2) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "malformed SignerKey (expected an enum vec)");
+  }
+  const variant = vec[0].sym().toString();
+  const el = vec[1];
+  const payload = el.switch().name === "scvBytes" ? new Uint8Array(el.bytes()) : new Uint8Array(el.toXDR());
+  return { variant, payload };
+}
+function compareBytes(a, b) {
+  const n = Math.min(a.length, b.length);
+  for (let i = 0; i < n; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return a.length - b.length;
+}
+function compareSignerKeyScVal(a, b) {
+  const ka = decomposeSignerKey(a);
+  const kb = decomposeSignerKey(b);
+  if (ka.variant !== kb.variant) return ka.variant < kb.variant ? -1 : 1;
+  return compareBytes(ka.payload, kb.payload);
+}
+function applyAssertionToSmartWalletEntry(entry, assertion) {
+  const credentials = entry.credentials();
+  if (credentials.switch().name !== "sorobanCredentialsAddress") {
+    throw new KitError("CONTRACT_AUTH_FAILED", "auth entry has no address credentials to sign");
+  }
+  const key = buildSignerKeyScVal(assertion.credentialId);
+  const newEntry = new xdr.ScMapEntry({ key, val: buildSmartWalletSignatureVariant(assertion) });
+  const current = credentials.address().signature();
+  let mapEntries;
+  switch (current.switch().name) {
+    case "scvVoid":
+      mapEntries = [newEntry];
+      break;
+    case "scvVec": {
+      const existing = current.vec()?.[0]?.map() ?? [];
+      mapEntries = existing.filter((e) => compareSignerKeyScVal(e.key(), key) !== 0);
+      mapEntries.push(newEntry);
+      break;
+    }
+    default:
+      throw new KitError(
+        "CONTRACT_AUTH_FAILED",
+        "unexpected existing signature shape for a smart-wallet entry"
+      );
+  }
+  mapEntries.sort((a, b) => compareSignerKeyScVal(a.key(), b.key()));
+  credentials.address().signature(xdr.ScVal.scvVec([xdr.ScVal.scvMap(mapEntries)]));
+  return entry;
+}
+function preflightAssertion(assertion, challenge, verify) {
+  let clientData;
+  if (verify.origin !== void 0) {
+    clientData = verifyClientDataJSON(assertion.clientDataJSON, {
+      origin: verify.origin,
+      challenge
+    });
+  } else {
+    clientData = parseClientDataJSON(assertion.clientDataJSON);
+    if (clientData.type !== "webauthn.get") {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        `clientDataJSON.type "${clientData.type}" is not "webauthn.get"`
+      );
+    }
+    if (clientData.challenge !== challenge) {
+      throw new KitError("CHALLENGE_MISMATCH", "assertion challenge does not match the auth entry");
+    }
+  }
+  if (clientData.crossOrigin === true && !verify.allowCrossOrigin) {
+    throw new KitError(
+      "ORIGIN_MISMATCH",
+      "assertion was made in a cross-origin context (crossOrigin=true)"
+    );
+  }
+  const parsed = parseAuthenticatorData(assertion.authenticatorData);
+  if (!parsed.flags.up) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "assertion is missing the User-Present (UP) flag"
+    );
+  }
+  if (verify.requireUserVerification && !parsed.flags.uv) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "assertion is missing the required User-Verified (UV) flag"
+    );
+  }
+  if (verify.rpId !== void 0) {
+    verifyRpIdHash(assertion.authenticatorData, verify.rpId);
+  }
+  if (verify.publicKey !== void 0) {
+    const ok = verifyAssertionSignature({
+      publicKey: verify.publicKey,
+      authenticatorData: assertion.authenticatorData,
+      clientDataJSON: assertion.clientDataJSON,
+      signature: assertion.signature
+    });
+    if (!ok) {
+      throw new KitError(
+        "CONTRACT_AUTH_FAILED",
+        "assertion signature failed pre-flight verification"
+      );
+    }
+  }
+}
+async function signEntryInPlace(entry, options) {
+  if (options.signatureExpirationLedger !== void 0) {
+    const creds = entry.credentials();
+    if (creds.switch().name === "sorobanCredentialsAddress") {
+      creds.address().signatureExpirationLedger(options.signatureExpirationLedger);
+    }
+  }
+  const challenge = authEntryChallenge(entry, options.networkPassphrase);
+  const assertion = await options.sign(challenge);
+  if (options.verify) preflightAssertion(assertion, challenge, options.verify);
+  const signature = assertion.signature.length === 64 ? assertion.signature : derToCompactLowS(assertion.signature);
+  const normalized = {
+    credentialId: assertion.credentialId,
+    authenticatorData: assertion.authenticatorData,
+    clientDataJSON: assertion.clientDataJSON,
+    signature
+  };
+  if (options.target === "smart-wallet") {
+    applyAssertionToSmartWalletEntry(entry, normalized);
+  } else {
+    applyAssertionToEntry(entry, normalized);
+  }
+}
+async function signAuthEntry(entryXdr, options) {
+  const entry = xdr.SorobanAuthorizationEntry.fromXDR(entryXdr, "base64");
+  await signEntryInPlace(entry, options);
+  return entry.toXDR("base64");
+}
+function operationsForSigning(envelope) {
+  const kind = envelope.switch().name;
+  if (kind === "envelopeTypeTx") return envelope.v1().tx().operations();
+  if (kind === "envelopeTypeTxFeeBump") {
+    const inner = envelope.feeBump().tx().innerTx();
+    if (inner.switch().name !== "envelopeTypeTx") {
+      throw new KitError(
+        "CONTRACT_AUTH_FAILED",
+        "signTransaction: fee-bump inner transaction is not a v1 transaction"
+      );
+    }
+    return inner.v1().tx().operations();
+  }
+  throw new KitError(
+    "CONTRACT_AUTH_FAILED",
+    `signTransaction: unsupported envelope type "${kind}" (expected v1 or fee-bump)`
+  );
+}
+async function signTransaction(txXdr, options) {
+  const envelope = xdr.TransactionEnvelope.fromXDR(txXdr, "base64");
+  for (const op of operationsForSigning(envelope)) {
+    if (op.body().switch().name !== "invokeHostFunction") continue;
+    const entries = op.body().invokeHostFunctionOp().auth();
+    for (const entry of entries) {
+      if (entry.credentials().switch().name !== "sorobanCredentialsAddress") continue;
+      await signEntryInPlace(entry, options);
+    }
+  }
+  return envelope.toXDR("base64");
+}
+
+export { applyAssertionToEntry, applyAssertionToSmartWalletEntry, authEntryChallenge, authEntryChallengeBytes, buildSignerKeyScVal, buildSmartWalletSignatureVariant, compareSignerKeyScVal, derToCompact, derToCompactLowS, isLowS, normalizeLowS, reconstructSignedPayload, signAuthEntry, signTransaction, verifyAssertionSignature };
+//# sourceMappingURL=chunk-BIRF5I6I.js.map
+//# sourceMappingURL=chunk-BIRF5I6I.js.map

package/dist/chunk-BIRF5I6I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webauthn/signature.ts","../src/webauthn/payload.ts","../src/webauthn/verify.ts","../src/soroban/preimage.ts","../src/soroban/assemble.ts","../src/soroban/smartWallet.ts","../src/soroban/sign.ts"],"names":["p256","xdr"],"mappings":";;;;;;AAIA,IAAM,cAAA,GAAiB,EAAA;AAUhB,SAAS,aAAa,GAAA,EAA6B;AACxD,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC/B,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,uBAAA;AAAA,MACA,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,oBAAA,EAAuB,cAAc,CAAA;AAAA,KACrE;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,EAAE,iBAAA,EAAkB;AAAA,EACvD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,uBAAA,EAAyB,+BAAA,EAAiC,EAAE,OAAO,CAAA;AAAA,EACxF;AACF;AAEA,SAAS,oBAAoB,gBAAA,EAAoC;AAC/D,EAAA,IAAI,gBAAA,CAAiB,WAAW,EAAA,EAAI;AAClC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,uBAAA;AAAA,MACA,CAAA,wCAAA,EAA2C,iBAAiB,MAAM,CAAA;AAAA,KACpE;AAAA,EACF;AACF;AAGO,SAAS,OAAO,gBAAA,EAAuC;AAC5D,EAAA,mBAAA,CAAoB,gBAAgB,CAAA;AACpC,EAAA,OAAO,CAAC,IAAA,CAAK,SAAA,CAAU,WAAA,CAAY,gBAAgB,EAAE,QAAA,EAAS;AAChE;AASO,SAAS,cAAc,gBAAA,EAA0C;AACtE,EAAA,mBAAA,CAAoB,gBAAgB,CAAA;AACpC,EAAA,OAAO,KAAK,SAAA,CAAU,WAAA,CAAY,gBAAgB,CAAA,CAAE,UAAA,GAAa,iBAAA,EAAkB;AACrF;AAGO,SAAS,iBAAiB,GAAA,EAA6B;AAC5D,EAAA,OAAO,aAAA,CAAc,YAAA,CAAa,GAAG,CAAC,CAAA;AACxC;;;ACjDO,SAAS,yBAAyB,KAAA,EAG1B;AACb,EAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,KAAA,CAAM,cAAc,CAAA;AAClD,EAAA,OAAO,MAAA,CAAO,WAAA,CAAY,KAAA,CAAM,iBAAA,EAAmB,cAAc,CAAC,CAAA;AACpE;ACIO,SAAS,yBAAyB,KAAA,EAAsC;AAC7E,EAAA,MAAM,OAAA,GAAU,yBAAyB,KAAK,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,MAAA,KAAW,KAAK,KAAA,CAAM,SAAA,GAAY,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA;AAG9F,EAAA,OAAOA,IAAAA,CAAK,MAAA,CAAO,OAAA,EAAS,OAAA,EAAS,KAAA,CAAM,SAAA,EAAW,EAAE,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,CAAA;AAC1F;ACdO,SAAS,uBAAA,CACd,OACA,iBAAA,EACY;AACZ,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,EAAY;AACtC,EAAA,IAAI,WAAA,CAAY,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AAC7D,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,MAAM,OAAA,GAAU,YAAY,OAAA,EAAQ;AACpC,EAAA,MAAM,QAAA,GAAW,IAAI,cAAA,CAAe,gCAAA;AAAA,IAClC,IAAI,IAAI,kCAAA,CAAmC;AAAA,MACzC,SAAA,EAAW,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,KAAK,WAAA,CAAY,iBAAiB,CAAC,CAAC,CAAC,CAAA;AAAA,MACxE,KAAA,EAAO,QAAQ,KAAA,EAAM;AAAA,MACrB,yBAAA,EAA2B,QAAQ,yBAAA,EAA0B;AAAA,MAC7D,UAAA,EAAY,MAAM,cAAA;AAAe,KAClC;AAAA,GACH;AACA,EAAA,OAAO,IAAI,UAAA,CAAW,IAAA,CAAK,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC9C;AAGO,SAAS,kBAAA,CACd,OACA,iBAAA,EACQ;AACR,EAAA,OAAO,gBAAA,CAAiB,uBAAA,CAAwB,KAAA,EAAO,iBAAiB,CAAC,CAAA;AAC3E;ACtBO,SAAS,qBAAA,CACd,OACA,SAAA,EAC+B;AAC/B,EAAA,KAAA,CAAM,aAAY,CAAE,OAAA,GAAU,SAAA,CAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,oBAAoB,SAAA,EAAuC;AACzE,EAAA,OAAOC,GAAAA,CAAI,MAAM,MAAA,CAAO;AAAA,IACtB,UAAA,CAAW,oBAAA,EAAsB,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC5D,UAAA,CAAW,kBAAA,EAAoB,SAAA,CAAU,cAAc,CAAA;AAAA,IACvD,UAAA,CAAW,WAAA,EAAa,SAAA,CAAU,SAAS;AAAA,GAC5C,CAAA;AACH;AAEA,SAAS,UAAA,CAAW,MAAc,KAAA,EAAmC;AACnE,EAAA,OAAO,IAAIA,IAAI,UAAA,CAAW;AAAA,IACxB,GAAA,EAAKA,GAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,CAAA;AAAA,IAC7B,KAAKA,GAAAA,CAAI,KAAA,CAAM,SAAS,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC;AAAA,GAC3C,CAAA;AACH;ACdO,SAAS,oBAAoB,YAAA,EAAqC;AACvE,EAAA,OAAOA,GAAAA,CAAI,MAAM,MAAA,CAAO;AAAA,IACtBA,GAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,WAAW,CAAA;AAAA,IAC/BA,IAAI,KAAA,CAAM,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,YAAY,CAAC;AAAA,GAC7C,CAAA;AACH;AAGO,SAAS,iCAAiC,SAAA,EAAuC;AACtF,EAAA,OAAOA,GAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,CAACA,GAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,WAAW,CAAA,EAAG,mBAAA,CAAoB,SAAS,CAAC,CAAC,CAAA;AAC5F;AAEA,SAAS,mBAAmB,GAAA,EAA0D;AACpF,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,EAAI;AACpB,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,MAAA,GAAS,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,4CAA4C,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,UAAU,GAAA,CAAI,CAAC,CAAA,CAAG,GAAA,GAAM,QAAA,EAAS;AACvC,EAAA,MAAM,EAAA,GAAK,IAAI,CAAC,CAAA;AAGhB,EAAA,MAAM,UACJ,EAAA,CAAG,MAAA,EAAO,CAAE,IAAA,KAAS,aAAa,IAAI,UAAA,CAAW,EAAA,CAAG,KAAA,EAAO,CAAA,GAAI,IAAI,UAAA,CAAW,EAAA,CAAG,OAAO,CAAA;AAC1F,EAAA,OAAO,EAAE,SAAS,OAAA,EAAQ;AAC5B;AAEA,SAAS,YAAA,CAAa,GAAe,CAAA,EAAuB;AAC1D,EAAA,MAAM,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,MAAA,EAAQ,EAAE,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,CAAA,CAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA,GAAK,CAAA,CAAE,CAAC,IAAK,EAAA,GAAK,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,CAAA,CAAE,SAAS,CAAA,CAAE,MAAA;AACtB;AAgBO,SAAS,qBAAA,CAAsB,GAAc,CAAA,EAAsB;AACxE,EAAA,MAAM,EAAA,GAAK,mBAAmB,CAAC,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,mBAAmB,CAAC,CAAA;AAC/B,EAAA,IAAI,EAAA,CAAG,YAAY,EAAA,CAAG,OAAA,SAAgB,EAAA,CAAG,OAAA,GAAU,EAAA,CAAG,OAAA,GAAU,EAAA,GAAK,CAAA;AACrE,EAAA,OAAO,YAAA,CAAa,EAAA,CAAG,OAAA,EAAS,EAAA,CAAG,OAAO,CAAA;AAC5C;AAaO,SAAS,gCAAA,CACd,OACA,SAAA,EAC+B;AAC/B,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,EAAY;AACtC,EAAA,IAAI,WAAA,CAAY,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AAC7D,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,SAAA,CAAU,YAAY,CAAA;AACtD,EAAA,MAAM,QAAA,GAAW,IAAIA,GAAAA,CAAI,UAAA,CAAW,EAAE,KAAK,GAAA,EAAK,gCAAA,CAAiC,SAAS,CAAA,EAAG,CAAA;AAE7F,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,OAAA,EAAQ,CAAE,SAAA,EAAU;AAChD,EAAA,IAAI,UAAA;AACJ,EAAA,QAAQ,OAAA,CAAQ,MAAA,EAAO,CAAE,IAAA;AAAM,IAC7B,KAAK,SAAA;AACH,MAAA,UAAA,GAAa,CAAC,QAAQ,CAAA;AACtB,MAAA;AAAA,IACF,KAAK,QAAA,EAAU;AAEb,MAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,EAAI,GAAI,CAAC,CAAA,EAAG,GAAA,MAAS,EAAC;AAC/C,MAAA,UAAA,GAAa,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAM,qBAAA,CAAsB,EAAE,GAAA,EAAI,EAAG,GAAG,CAAA,KAAM,CAAC,CAAA;AAC7E,MAAA,UAAA,CAAW,KAAK,QAAQ,CAAA;AACxB,MAAA;AAAA,IACF;AAAA,IACA;AACE,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA;AAEJ,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,qBAAA,CAAsB,CAAA,CAAE,GAAA,EAAI,EAAG,CAAA,CAAE,GAAA,EAAK,CAAC,CAAA;AACjE,EAAA,WAAA,CAAY,OAAA,EAAQ,CAAE,SAAA,CAAUA,GAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,CAACA,GAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,UAAU,CAAC,CAAC,CAAC,CAAA;AAChF,EAAA,OAAO,KAAA;AACT;AC/CA,SAAS,kBAAA,CACP,SAAA,EACA,SAAA,EACA,MAAA,EACM;AAEN,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,MAAA,CAAO,WAAW,MAAA,EAAW;AAC/B,IAAA,UAAA,GAAa,oBAAA,CAAqB,UAAU,cAAA,EAAgB;AAAA,MAC1D,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf;AAAA,KACD,CAAA;AAAA,EACH,CAAA,MAAO;AACL,IAAA,UAAA,GAAa,mBAAA,CAAoB,UAAU,cAAc,CAAA;AACzD,IAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA,CAAA,qBAAA,EAAwB,WAAW,IAAI,CAAA,uBAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,IAAI,UAAA,CAAW,cAAc,SAAA,EAAW;AACtC,MAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,mDAAmD,CAAA;AAAA,IAC9F;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,WAAA,KAAgB,IAAA,IAAQ,CAAC,OAAO,gBAAA,EAAkB;AAC/D,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,iBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,SAAA,CAAU,iBAAiB,CAAA;AACjE,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,EAAA,EAAI;AACpB,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,uBAAA,IAA2B,CAAC,MAAA,CAAO,MAAM,EAAA,EAAI;AACtD,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAW;AAC7B,IAAA,cAAA,CAAe,SAAA,CAAU,iBAAA,EAAmB,MAAA,CAAO,IAAI,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,MAAA,CAAO,cAAc,MAAA,EAAW;AAClC,IAAA,MAAM,KAAK,wBAAA,CAAyB;AAAA,MAClC,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,mBAAmB,SAAA,CAAU,iBAAA;AAAA,MAC7B,gBAAgB,SAAA,CAAU,cAAA;AAAA,MAC1B,WAAW,SAAA,CAAU;AAAA,KACtB,CAAA;AACD,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gBAAA,CACb,OACA,OAAA,EACe;AAGf,EAAA,IAAI,OAAA,CAAQ,8BAA8B,MAAA,EAAW;AACnD,IAAA,MAAM,KAAA,GAAQ,MAAM,WAAA,EAAY;AAChC,IAAA,IAAI,KAAA,CAAM,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AACvD,MAAA,KAAA,CAAM,OAAA,EAAQ,CAAE,yBAAA,CAA0B,OAAA,CAAQ,yBAAyB,CAAA;AAAA,IAC7E;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAY,kBAAA,CAAmB,KAAA,EAAO,OAAA,CAAQ,iBAAiB,CAAA;AACrE,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAC9C,EAAA,IAAI,QAAQ,MAAA,EAAQ,kBAAA,CAAmB,SAAA,EAAW,SAAA,EAAW,QAAQ,MAAM,CAAA;AAC3E,EAAA,MAAM,SAAA,GACJ,UAAU,SAAA,CAAU,MAAA,KAAW,KAAK,SAAA,CAAU,SAAA,GAAY,gBAAA,CAAiB,SAAA,CAAU,SAAS,CAAA;AAChG,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,cAAc,SAAA,CAAU,YAAA;AAAA,IACxB,mBAAmB,SAAA,CAAU,iBAAA;AAAA,IAC7B,gBAAgB,SAAA,CAAU,cAAA;AAAA,IAC1B;AAAA,GACF;AACA,EAAA,IAAI,OAAA,CAAQ,WAAW,cAAA,EAAgB;AACrC,IAAA,gCAAA,CAAiC,OAAO,UAAU,CAAA;AAAA,EACpD,CAAA,MAAO;AACL,IAAA,qBAAA,CAAsB,OAAO,UAAU,CAAA;AAAA,EACzC;AACF;AAOA,eAAsB,aAAA,CACpB,UACA,OAAA,EACiB;AACjB,EAAA,MAAM,KAAA,GAAQA,GAAAA,CAAI,yBAAA,CAA0B,OAAA,CAAQ,UAAU,QAAQ,CAAA;AACtE,EAAA,MAAM,gBAAA,CAAiB,OAAO,OAAO,CAAA;AACrC,EAAA,OAAO,KAAA,CAAM,MAAM,QAAQ,CAAA;AAC7B;AAQA,SAAS,qBAAqB,QAAA,EAAoD;AAChF,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,EAAO,CAAE,IAAA;AAC/B,EAAA,IAAI,IAAA,KAAS,kBAAkB,OAAO,QAAA,CAAS,IAAG,CAAE,EAAA,GAAK,UAAA,EAAW;AACpE,EAAA,IAAI,SAAS,uBAAA,EAAyB;AACpC,IAAA,MAAM,QAAQ,QAAA,CAAS,OAAA,EAAQ,CAAE,EAAA,GAAK,OAAA,EAAQ;AAC9C,IAAA,IAAI,KAAA,CAAM,MAAA,EAAO,CAAE,IAAA,KAAS,gBAAA,EAAkB;AAC5C,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,KAAA,CAAM,EAAA,EAAG,CAAE,EAAA,GAAK,UAAA,EAAW;AAAA,EACpC;AACA,EAAA,MAAM,IAAI,QAAA;AAAA,IACR,sBAAA;AAAA,IACA,+CAA+C,IAAI,CAAA,2BAAA;AAAA,GACrD;AACF;AAOA,eAAsB,eAAA,CAAgB,OAAe,OAAA,EAA8C;AACjG,EAAA,MAAM,QAAA,GAAWA,GAAAA,CAAI,mBAAA,CAAoB,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAChE,EAAA,KAAA,MAAW,EAAA,IAAM,oBAAA,CAAqB,QAAQ,CAAA,EAAG;AAC/C,IAAA,IAAI,GAAG,IAAA,EAAK,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAA,EAAsB;AACtD,IAAA,MAAM,UAAU,EAAA,CAAG,IAAA,EAAK,CAAE,oBAAA,GAAuB,IAAA,EAAK;AACtD,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,IAAI,MAAM,WAAA,EAAY,CAAE,MAAA,EAAO,CAAE,SAAS,2BAAA,EAA6B;AACvE,MAAA,MAAM,gBAAA,CAAiB,OAAO,OAAO,CAAA;AAAA,IACvC;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,MAAM,QAAQ,CAAA;AAChC","file":"chunk-BIRF5I6I.js","sourcesContent":["import { p256 } from '@noble/curves/nist';\nimport { KitError } from '../errors';\n\n/** Maximum DER length of a P-256 ECDSA signature: SEQ + two 33-byte INTEGERs. */\nconst MAX_DER_LENGTH = 72;\n\n/**\n * Convert an ASN.1 DER ECDSA signature to the 64-byte raw `R‖S` form Soroban's\n * `secp256r1_verify` expects, using noble's audited DER parser (R and S are\n * left-padded to 32 bytes big-endian). Rejects malformed or over-long input.\n *\n * Note: this does NOT enforce low-S — that normalization is added in S04\n * (YK-430). The output here mirrors the signature exactly as parsed.\n */\nexport function derToCompact(der: Uint8Array): Uint8Array {\n  if (der.length > MAX_DER_LENGTH) {\n    throw new KitError(\n      'INVALID_SIGNATURE_DER',\n      `DER signature is ${der.length} bytes, exceeds max ${MAX_DER_LENGTH}`,\n    );\n  }\n  try {\n    return p256.Signature.fromDER(der).toCompactRawBytes();\n  } catch (cause) {\n    throw new KitError('INVALID_SIGNATURE_DER', 'failed to parse DER signature', { cause });\n  }\n}\n\nfunction assertCompactLength(compactSignature: Uint8Array): void {\n  if (compactSignature.length !== 64) {\n    throw new KitError(\n      'INVALID_SIGNATURE_DER',\n      `compact signature must be 64 bytes, got ${compactSignature.length}`,\n    );\n  }\n}\n\n/** True if a 64-byte compact signature is in canonical low-S form (S ≤ n/2). */\nexport function isLowS(compactSignature: Uint8Array): boolean {\n  assertCompactLength(compactSignature);\n  return !p256.Signature.fromCompact(compactSignature).hasHighS();\n}\n\n/**\n * Normalize a 64-byte compact signature to canonical low-S: if S > n/2, replace\n * S with n − S (anchor LOW_S_NORMALIZATION, invariant #2). ~50% of Apple Touch\n * ID / Face ID assertions are high-S and Soroban's `secp256r1_verify` does not\n * enforce low-S, so the SDK MUST emit low-S before a signature reaches a\n * contract. Idempotent: low-S input is returned unchanged.\n */\nexport function normalizeLowS(compactSignature: Uint8Array): Uint8Array {\n  assertCompactLength(compactSignature);\n  return p256.Signature.fromCompact(compactSignature).normalizeS().toCompactRawBytes();\n}\n\n/** DER → 64-byte canonical low-S compact — the conversion the signing ceremony uses. */\nexport function derToCompactLowS(der: Uint8Array): Uint8Array {\n  return normalizeLowS(derToCompact(der));\n}\n","import { sha256 } from '../internal/sha256';\nimport { concatBytes } from '../internal/bytes';\n\n/**\n * Reconstruct the 32-byte payload the authenticator signed and that Soroban's\n * `__check_auth` re-derives on-chain:\n *\n *   SHA256( authenticatorData ‖ SHA256(clientDataJSON) )\n */\nexport function reconstructSignedPayload(input: {\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n}): Uint8Array {\n  const clientDataHash = sha256(input.clientDataJSON);\n  return sha256(concatBytes(input.authenticatorData, clientDataHash));\n}\n","import { p256 } from '@noble/curves/nist';\nimport { reconstructSignedPayload } from './payload';\nimport { derToCompact } from './signature';\n\nexport interface VerifyAssertionInput {\n  /** SEC-1 uncompressed public key (65 bytes, `0x04 ‖ X ‖ Y`). */\n  publicKey: Uint8Array;\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n  /** DER-encoded (≤72 B) or already-compact (64 B) signature. */\n  signature: Uint8Array;\n}\n\n/**\n * Verify a WebAuthn assertion the way the on-chain `secp256r1_verify` does:\n * reconstruct `SHA256(authData ‖ SHA256(cdj))` and check ECDSA. `lowS: false`\n * mirrors the host function, which does NOT enforce low-S (we normalize\n * separately before submitting — see S04/YK-430).\n */\nexport function verifyAssertionSignature(input: VerifyAssertionInput): boolean {\n  const payload = reconstructSignedPayload(input);\n  const compact = input.signature.length === 64 ? input.signature : derToCompact(input.signature);\n  // `format: 'compact'` pins the 64-byte interpretation — without it noble tries\n  // DER-first and could misread a compact signature that happens to start 0x30.\n  return p256.verify(compact, payload, input.publicKey, { lowS: false, format: 'compact' });\n}\n","import { xdr, hash } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { bytesToBase64Url, utf8ToBytes } from '../internal/encoding';\n\n/**\n * Compute the auth-entry preimage hash that `__check_auth` reconstructs and that\n * becomes the WebAuthn `challenge`:\n *   SHA256( XDR( HashIdPreimage::SorobanAuthorization{ networkId, nonce,\n *   signatureExpirationLedger, invocation } ) )\n * where networkId = SHA256(networkPassphrase).\n */\nexport function authEntryChallengeBytes(\n  entry: xdr.SorobanAuthorizationEntry,\n  networkPassphrase: string,\n): Uint8Array {\n  const credentials = entry.credentials();\n  if (credentials.switch().name !== 'sorobanCredentialsAddress') {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'auth entry has no address credentials to sign');\n  }\n  const address = credentials.address();\n  const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(\n    new xdr.HashIdPreimageSorobanAuthorization({\n      networkId: Buffer.from(hash(Buffer.from(utf8ToBytes(networkPassphrase)))),\n      nonce: address.nonce(),\n      signatureExpirationLedger: address.signatureExpirationLedger(),\n      invocation: entry.rootInvocation(),\n    }),\n  );\n  return new Uint8Array(hash(preimage.toXDR()));\n}\n\n/** The base64url challenge string the authenticator signs (43 chars). */\nexport function authEntryChallenge(\n  entry: xdr.SorobanAuthorizationEntry,\n  networkPassphrase: string,\n): string {\n  return bytesToBase64Url(authEntryChallengeBytes(entry, networkPassphrase));\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport type { AssertionResult } from './sign';\n\n/**\n * Set an address-credential auth entry's signature to the `Secp256r1Signature`\n * struct the on-chain `__check_auth` consumes:\n *\n *   ScVal::Map { authenticator_data: Bytes, client_data_json: Bytes, signature: BytesN<64> }\n *\n * Map keys are alphabetical, so the ScMap is canonically sorted as Soroban\n * requires. `signature` MUST already be 64-byte low-S compact (`signAuthEntry`\n * normalizes before calling this). This is the exact shape the audited\n * webauthn-verifier reference expects — proven on testnet by the on-chain\n * integration test (scripts/onchain-e2e.ts).\n */\nexport function applyAssertionToEntry(\n  entry: xdr.SorobanAuthorizationEntry,\n  assertion: AssertionResult,\n): xdr.SorobanAuthorizationEntry {\n  entry.credentials().address().signature(buildSignatureScVal(assertion));\n  return entry;\n}\n\n/** The `Secp256r1Signature` ScVal — a contracttype struct → sorted ScMap. */\nexport function buildSignatureScVal(assertion: AssertionResult): xdr.ScVal {\n  return xdr.ScVal.scvMap([\n    bytesField('authenticator_data', assertion.authenticatorData),\n    bytesField('client_data_json', assertion.clientDataJSON),\n    bytesField('signature', assertion.signature),\n  ]);\n}\n\nfunction bytesField(name: string, bytes: Uint8Array): xdr.ScMapEntry {\n  return new xdr.ScMapEntry({\n    key: xdr.ScVal.scvSymbol(name),\n    val: xdr.ScVal.scvBytes(Buffer.from(bytes)),\n  });\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { buildSignatureScVal } from './assemble';\nimport type { AssertionResult } from './sign';\n\n/**\n * The passkey-kit / `webauthn-wallet` smart-wallet ABI target.\n *\n * Our own single-signer account declares `type Signature = Secp256r1Signature`\n * and consumes the bare struct (see `assemble.ts`). passkey-kit's smart-wallet\n * declares `type Signature = Signatures`, so authorizing it needs the assertion\n * wrapped as `Signatures(Map<SignerKey, Signature>)`. The exact shape, the raw-\n * credential-id key, and the canonical map ordering below are confirmed by\n * kalepail (passkey-kit author) in issue #32 against v1 / v0.13.0 (Protocol 27,\n * independently audited); the wire shape is unchanged from v0.12.\n */\n\n/**\n * `SignerKey::Secp256r1(Bytes)` → `scvVec([Symbol(\"Secp256r1\"), Bytes(rawId)])`.\n * The key is the RAW WebAuthn credential-id bytes (base64url-decoded `rawId`):\n * never hashed, never the UTF-8 of the base64url string, and never the public\n * key — the SEC-1 public key lives in `SignerVal` on-chain, not in the key.\n */\nexport function buildSignerKeyScVal(credentialId: Uint8Array): xdr.ScVal {\n  return xdr.ScVal.scvVec([\n    xdr.ScVal.scvSymbol('Secp256r1'),\n    xdr.ScVal.scvBytes(Buffer.from(credentialId)),\n  ]);\n}\n\n/** `Signature::Secp256r1(Secp256r1Signature)` → `scvVec([Symbol(\"Secp256r1\"), <bare struct map>])`. */\nexport function buildSmartWalletSignatureVariant(assertion: AssertionResult): xdr.ScVal {\n  return xdr.ScVal.scvVec([xdr.ScVal.scvSymbol('Secp256r1'), buildSignatureScVal(assertion)]);\n}\n\nfunction decomposeSignerKey(key: xdr.ScVal): { variant: string; payload: Uint8Array } {\n  const vec = key.vec();\n  if (!vec || vec.length < 2) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'malformed SignerKey (expected an enum vec)');\n  }\n  const variant = vec[0]!.sym().toString();\n  const el = vec[1]!;\n  // Secp256r1(Bytes) and Ed25519(BytesN<32>) are scvBytes; Policy(Address) falls\n  // back to its XDR bytes (rare in a passkey SDK — see the ordering note below).\n  const payload =\n    el.switch().name === 'scvBytes' ? new Uint8Array(el.bytes()) : new Uint8Array(el.toXDR());\n  return { variant, payload };\n}\n\nfunction compareBytes(a: Uint8Array, b: Uint8Array): number {\n  const n = Math.min(a.length, b.length);\n  for (let i = 0; i < n; i++) {\n    if (a[i] !== b[i]) return a[i]! < b[i]! ? -1 : 1;\n  }\n  return a.length - b.length;\n}\n\n/**\n * Canonical Soroban-host ordering for `SignerKey` map keys. The host requires\n * `Map<SignerKey, _>` entries sorted by ScVal `Ord` — an **element-wise byte\n * comparison**, NOT a length-major XDR-hex / `localeCompare` string sort. This is\n * the one correctness landmine kalepail flagged in #32: passkey-kit v1 replaced\n * its old string sort with exactly this because the old approach could mis-order\n * same-variant keys of differing length, producing a map the host rejects.\n *\n * We compare the enum variant symbol first, then the payload bytes element-wise,\n * so homogeneous `Secp256r1` keys (the multi-passkey case) sort purely by their\n * raw credential-id bytes. (Ordering across mixed variant types relies on the\n * variant names being capitalized single words, which matches the host's symbol\n * order; a Policy/Address-keyed multi-sig is out of scope for this passkey SDK.)\n */\nexport function compareSignerKeyScVal(a: xdr.ScVal, b: xdr.ScVal): number {\n  const ka = decomposeSignerKey(a);\n  const kb = decomposeSignerKey(b);\n  if (ka.variant !== kb.variant) return ka.variant < kb.variant ? -1 : 1;\n  return compareBytes(ka.payload, kb.payload);\n}\n\n/**\n * Assemble/merge a passkey assertion into an address-credential auth entry as the\n * smart-wallet `Signatures(Map<SignerKey, Signature>)` wire shape\n * (`ScVal::Vec([ScVal::Map(...)])`). `assertion.signature` MUST already be 64-byte\n * low-S compact (`signAuthEntry` normalizes first). Existing map entries — a\n * partially-signed multi-sig entry — are preserved; an entry for the same signer\n * key is replaced; then the whole map is canonically sorted.\n *\n * Use this for the passkey-kit / webauthn-wallet ABI. For our own single-signer\n * account (`type Signature = Secp256r1Signature`) use `applyAssertionToEntry`.\n */\nexport function applyAssertionToSmartWalletEntry(\n  entry: xdr.SorobanAuthorizationEntry,\n  assertion: AssertionResult,\n): xdr.SorobanAuthorizationEntry {\n  const credentials = entry.credentials();\n  if (credentials.switch().name !== 'sorobanCredentialsAddress') {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'auth entry has no address credentials to sign');\n  }\n  const key = buildSignerKeyScVal(assertion.credentialId);\n  const newEntry = new xdr.ScMapEntry({ key, val: buildSmartWalletSignatureVariant(assertion) });\n\n  const current = credentials.address().signature();\n  let mapEntries: xdr.ScMapEntry[];\n  switch (current.switch().name) {\n    case 'scvVoid':\n      mapEntries = [newEntry];\n      break;\n    case 'scvVec': {\n      // Preserve any existing signatures (partial multi-sig); replace same key.\n      const existing = current.vec()?.[0]?.map() ?? [];\n      mapEntries = existing.filter((e) => compareSignerKeyScVal(e.key(), key) !== 0);\n      mapEntries.push(newEntry);\n      break;\n    }\n    default:\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'unexpected existing signature shape for a smart-wallet entry',\n      );\n  }\n  mapEntries.sort((a, b) => compareSignerKeyScVal(a.key(), b.key()));\n  credentials.address().signature(xdr.ScVal.scvVec([xdr.ScVal.scvMap(mapEntries)]));\n  return entry;\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { derToCompactLowS } from '../webauthn/signature';\nimport { parseClientDataJSON, verifyClientDataJSON, type ClientData } from '../webauthn/clientData';\nimport { parseAuthenticatorData, verifyRpIdHash } from '../webauthn/authData';\nimport { verifyAssertionSignature } from '../webauthn/verify';\nimport { authEntryChallenge } from './preimage';\nimport { applyAssertionToEntry } from './assemble';\nimport { applyAssertionToSmartWalletEntry } from './smartWallet';\n\n/**\n * Which contract ABI the assembled signature targets:\n *  - `single-signer` (default): the bare `Secp256r1Signature` struct our own\n *    webauthn-account consumes (`type Signature = Secp256r1Signature`).\n *  - `smart-wallet`: passkey-kit's `Signatures(Map<SignerKey, Signature>)`\n *    (`type Signature = Signatures`) — see `smartWallet.ts` / kalepail #32.\n * Both reuse the identical low-S, field-packing, and challenge-binding core;\n * only the outer wrapper differs, so the two stay separate ABI targets behind\n * one signing interface.\n */\nexport type WalletTarget = 'single-signer' | 'smart-wallet';\n\n/** The raw WebAuthn assertion a signer returns for a given challenge. */\nexport interface AssertionResult {\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n  /** DER-encoded (≤72B) or already-compact (64B) ECDSA signature. */\n  signature: Uint8Array;\n  /** base64url credential id → the SignerKey. */\n  credentialId: Uint8Array;\n}\n\n/** Produce a WebAuthn assertion over the base64url `challenge` (e.g. navigator.credentials.get). */\nexport type WebAuthnSigner = (challenge: string) => Promise<AssertionResult> | AssertionResult;\n\n/**\n * Opt-in pre-flight validation of the returned assertion, run BEFORE the entry\n * is assembled and submitted. On-chain `__check_auth` is the real gate, but\n * catching these client-side turns an opaque on-chain failure into a typed\n * `KitError` at the call site. Providing this object always enforces the\n * `webauthn.get` type, the User-Present (UP) flag (required by passkey-kit v1),\n * and challenge-binding; `rpId` / `origin` / `publicKey` add their checks when\n * supplied. Omit the object entirely to skip pre-flight (the default).\n */\nexport interface SignVerifyOptions {\n  /** Verify `authenticatorData.rpIdHash === SHA-256(rpId)`. */\n  rpId?: string;\n  /** Verify `clientDataJSON.origin` is one of these exact origins. */\n  origin?: string | string[];\n  /** SEC-1 (65-byte) public key → verify the ECDSA assertion signature. */\n  publicKey?: Uint8Array;\n  /** Also require the User-Verified (UV) flag (biometric / PIN). Default false. */\n  requireUserVerification?: boolean;\n  /** Allow an assertion made in a cross-origin context (crossOrigin=true). Default false. */\n  allowCrossOrigin?: boolean;\n}\n\nexport interface SorobanSignOptions {\n  networkPassphrase: string;\n  sign: WebAuthnSigner;\n  /** Contract ABI to assemble for. Defaults to `single-signer` (our account). */\n  target?: WalletTarget;\n  /** Opt-in pre-flight assertion validation. Omit to skip. */\n  verify?: SignVerifyOptions;\n  /**\n   * Stamp this `signatureExpirationLedger` onto every address-credential auth\n   * entry BEFORE the challenge is computed, so the signature binds the exact\n   * expiration the contract re-derives in `__check_auth`. Needed for smart-wallet\n   * writes (add/remove signer) where the caller learns the ledger at sign time;\n   * omit when the entry already carries the intended expiration.\n   */\n  signatureExpirationLedger?: number;\n}\n\n/** Validate an assertion against the expected challenge + RP context. Throws KitError. */\nfunction preflightAssertion(\n  assertion: AssertionResult,\n  challenge: string,\n  verify: SignVerifyOptions,\n): void {\n  // Ceremony type + challenge-binding (+ origin when provided).\n  let clientData: ClientData;\n  if (verify.origin !== undefined) {\n    clientData = verifyClientDataJSON(assertion.clientDataJSON, {\n      origin: verify.origin,\n      challenge,\n    });\n  } else {\n    clientData = parseClientDataJSON(assertion.clientDataJSON);\n    if (clientData.type !== 'webauthn.get') {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        `clientDataJSON.type \"${clientData.type}\" is not \"webauthn.get\"`,\n      );\n    }\n    if (clientData.challenge !== challenge) {\n      throw new KitError('CHALLENGE_MISMATCH', 'assertion challenge does not match the auth entry');\n    }\n  }\n  if (clientData.crossOrigin === true && !verify.allowCrossOrigin) {\n    throw new KitError(\n      'ORIGIN_MISMATCH',\n      'assertion was made in a cross-origin context (crossOrigin=true)',\n    );\n  }\n  // User-Present is mandatory (passkey-kit v1 hardening); UV is opt-in.\n  const parsed = parseAuthenticatorData(assertion.authenticatorData);\n  if (!parsed.flags.up) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'assertion is missing the User-Present (UP) flag',\n    );\n  }\n  if (verify.requireUserVerification && !parsed.flags.uv) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'assertion is missing the required User-Verified (UV) flag',\n    );\n  }\n  if (verify.rpId !== undefined) {\n    verifyRpIdHash(assertion.authenticatorData, verify.rpId);\n  }\n  if (verify.publicKey !== undefined) {\n    const ok = verifyAssertionSignature({\n      publicKey: verify.publicKey,\n      authenticatorData: assertion.authenticatorData,\n      clientDataJSON: assertion.clientDataJSON,\n      signature: assertion.signature,\n    });\n    if (!ok) {\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'assertion signature failed pre-flight verification',\n      );\n    }\n  }\n}\n\nasync function signEntryInPlace(\n  entry: xdr.SorobanAuthorizationEntry,\n  options: SorobanSignOptions,\n): Promise<void> {\n  // Stamp the expiration first: the challenge preimage includes\n  // signatureExpirationLedger, so it must be final before we compute it.\n  if (options.signatureExpirationLedger !== undefined) {\n    const creds = entry.credentials();\n    if (creds.switch().name === 'sorobanCredentialsAddress') {\n      creds.address().signatureExpirationLedger(options.signatureExpirationLedger);\n    }\n  }\n  const challenge = authEntryChallenge(entry, options.networkPassphrase);\n  const assertion = await options.sign(challenge);\n  if (options.verify) preflightAssertion(assertion, challenge, options.verify);\n  const signature =\n    assertion.signature.length === 64 ? assertion.signature : derToCompactLowS(assertion.signature);\n  const normalized = {\n    credentialId: assertion.credentialId,\n    authenticatorData: assertion.authenticatorData,\n    clientDataJSON: assertion.clientDataJSON,\n    signature,\n  };\n  if (options.target === 'smart-wallet') {\n    applyAssertionToSmartWalletEntry(entry, normalized);\n  } else {\n    applyAssertionToEntry(entry, normalized);\n  }\n}\n\n/**\n * Sign a single `SorobanAuthorizationEntry` (base64 XDR): compute the challenge,\n * obtain a WebAuthn assertion, low-S-normalize, and assemble the contract\n * signature. Returns the signed entry as base64 XDR.\n */\nexport async function signAuthEntry(\n  entryXdr: string,\n  options: SorobanSignOptions,\n): Promise<string> {\n  const entry = xdr.SorobanAuthorizationEntry.fromXDR(entryXdr, 'base64');\n  await signEntryInPlace(entry, options);\n  return entry.toXDR('base64');\n}\n\n/**\n * The operations whose Soroban auth entries we sign, for a v1 or a fee-bump\n * envelope. (Sign the Soroban auth entries before adding classic tx signatures\n * or fee-bumping; a fee-bump around an already-classic-signed inner tx is the\n * caller's sequencing concern.)\n */\nfunction operationsForSigning(envelope: xdr.TransactionEnvelope): xdr.Operation[] {\n  const kind = envelope.switch().name;\n  if (kind === 'envelopeTypeTx') return envelope.v1().tx().operations();\n  if (kind === 'envelopeTypeTxFeeBump') {\n    const inner = envelope.feeBump().tx().innerTx();\n    if (inner.switch().name !== 'envelopeTypeTx') {\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'signTransaction: fee-bump inner transaction is not a v1 transaction',\n      );\n    }\n    return inner.v1().tx().operations();\n  }\n  throw new KitError(\n    'CONTRACT_AUTH_FAILED',\n    `signTransaction: unsupported envelope type \"${kind}\" (expected v1 or fee-bump)`,\n  );\n}\n\n/**\n * Sign every address-credential Soroban auth entry carried by the InvokeHostFunction\n * operations of a transaction (base64 XDR envelope — v1 or fee-bump). Returns the\n * signed envelope XDR.\n */\nexport async function signTransaction(txXdr: string, options: SorobanSignOptions): Promise<string> {\n  const envelope = xdr.TransactionEnvelope.fromXDR(txXdr, 'base64');\n  for (const op of operationsForSigning(envelope)) {\n    if (op.body().switch().name !== 'invokeHostFunction') continue;\n    const entries = op.body().invokeHostFunctionOp().auth();\n    for (const entry of entries) {\n      if (entry.credentials().switch().name !== 'sorobanCredentialsAddress') continue;\n      await signEntryInPlace(entry, options);\n    }\n  }\n  return envelope.toXDR('base64');\n}\n"]}