@soropass/core 0.1.0 → 0.1.2

package/dist/testing.d.ts

@@ -1,8 +1,8 @@
 import { ConnectResult } from './connect.js';
 import { a as RecoverResult } from './recover-COnsxhYk.js';
-import { b as WebAuthnSigner, A as AssertionResult } from './sign-Cfg0NM0T.js';
+import { b as WebAuthnSigner, A as AssertionResult } from './sign-B4JV2Inn.js';
 import { W as WebAuthnClient, A as AccountDeployer, I as IndexerAdapter, S as SubmissionAdapter, C as CredentialStorage } from './types--WNl-Sda.js';
-import { P as PasskeyCredential } from './types-lW2h8Uxn.js';
+import { P as PasskeyCredential } from './types-C3VIw5Iu.js';
 import './checkAuth-C2AcXqFe.js';
 import '@stellar/stellar-sdk';
 
@@ -83,4 +83,12 @@ interface InMemoryBackend {
  */
 declare function createInMemoryBackend(): InMemoryBackend;
 
-export { type CreatePasskeyKitOptions, type InMemoryBackend, type MockAuthenticator, type MockAuthenticatorOptions, type PasskeyKit, createInMemoryBackend, createPasskeyKit, mockAuthenticator };
+/**
+ * A ready-to-sign `SorobanAuthorizationEntry` (base64 XDR) for a demo call on
+ * `contractId`. A convenience for smoke tests and examples, so you do not hand-
+ * build auth-entry XDR just to have something to sign. The nonce and expiration
+ * are fixed placeholders, so this is for local verification, not production.
+ */
+declare function sampleAuthEntry(contractId: string, functionName?: string): string;
+
+export { type CreatePasskeyKitOptions, type InMemoryBackend, type MockAuthenticator, type MockAuthenticatorOptions, type PasskeyKit, createInMemoryBackend, createPasskeyKit, mockAuthenticator, sampleAuthEntry };

package/dist/testing.js

@@ -1,13 +1,13 @@
 import { createPasskey } from './chunk-W75OQKHR.js';
 import { connect } from './chunk-AHFGTIBY.js';
 import { recover } from './chunk-MOLZIRIH.js';
-import { signAuthEntry } from './chunk-BIRF5I6I.js';
+import { signAuthEntry } from './chunk-FIRTUNWF.js';
 import { sha256, concatBytes } from './chunk-JNJ2FY45.js';
 import { utf8ToBytes, bytesToBase64Url } from './chunk-LB4HOTLV.js';
 import './chunk-TPBBZNPP.js';
 import './chunk-AMYFJQAC.js';
 import { p256 } from '@noble/curves/nist';
-import { StrKey } from '@stellar/stellar-sdk';
+import { StrKey, Address, xdr } from '@stellar/stellar-sdk';
 
 // src/internal/cborEncode.ts
 function head(major, arg) {
@@ -229,7 +229,27 @@ function createPasskeyKit(options) {
     signAuthEntry: (entryXdr) => signAuthEntry(entryXdr, { networkPassphrase, sign: signer })
   };
 }
+function sampleAuthEntry(contractId, functionName = "protected") {
+  const address = new Address(contractId).toScAddress();
+  const entry = new xdr.SorobanAuthorizationEntry({
+    credentials: xdr.SorobanCredentials.sorobanCredentialsAddress(
+      new xdr.SorobanAddressCredentials({
+        address,
+        nonce: new xdr.Int64(1),
+        signatureExpirationLedger: 1e3,
+        signature: xdr.ScVal.scvVoid()
+      })
+    ),
+    rootInvocation: new xdr.SorobanAuthorizedInvocation({
+      function: xdr.SorobanAuthorizedFunction.sorobanAuthorizedFunctionTypeContractFn(
+        new xdr.InvokeContractArgs({ contractAddress: address, functionName, args: [] })
+      ),
+      subInvocations: []
+    })
+  });
+  return entry.toXDR("base64");
+}
 
-export { createInMemoryBackend, createPasskeyKit, mockAuthenticator };
+export { createInMemoryBackend, createPasskeyKit, mockAuthenticator, sampleAuthEntry };
 //# sourceMappingURL=testing.js.map
 //# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/cborEncode.ts","../src/testing/mockAuthenticator.ts","../src/testing/inMemory.ts","../src/testing/kit.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,SAAS,IAAA,CAAK,OAAe,GAAA,EAAuB;AAClD,EAAA,MAAM,IAAI,KAAA,IAAS,CAAA;AACnB,EAAA,IAAI,GAAA,GAAM,EAAA,EAAI,OAAO,CAAC,IAAI,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,GAAA,EAAO,OAAO,CAAC,CAAA,GAAI,IAAI,GAAG,CAAA;AACpC,EAAA,IAAI,GAAA,GAAM,KAAA,EAAS,OAAO,CAAC,CAAA,GAAI,IAAK,GAAA,IAAO,CAAA,GAAK,GAAA,EAAM,GAAA,GAAM,GAAI,CAAA;AAChE,EAAA,OAAO,CAAC,CAAA,GAAI,EAAA,EAAK,GAAA,KAAQ,EAAA,GAAM,GAAA,EAAO,GAAA,IAAO,EAAA,GAAM,GAAA,EAAO,GAAA,IAAO,CAAA,GAAK,GAAA,EAAM,MAAM,GAAI,CAAA;AACxF;AAEA,SAAS,KAAA,CAAM,OAAkB,GAAA,EAAqB;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,EAAG;AACxD,IAAA,IAAI,KAAA,IAAS,GAAG,GAAA,CAAI,IAAA,CAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,aACjC,IAAA,CAAK,GAAG,KAAK,CAAA,EAAG,EAAA,GAAK,KAAK,CAAC,CAAA;AAAA,EACtC,CAAA,MAAA,IAAW,iBAAiB,UAAA,EAAY;AACtC,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,IAAA,MAAM,KAAA,GAAQ,YAAY,KAAK,CAAA;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,KAAA,CAAM,IAAA,EAAM,GAAG,CAAA;AAAA,EAC3C,CAAA,MAAA,IAAW,iBAAiB,GAAA,EAAK;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAC,CAAA;AAC/B,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,KAAA,EAAO;AAC1B,MAAA,KAAA,CAAM,GAAG,GAAG,CAAA;AACZ,MAAA,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,IACd;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACF;AAEO,SAAS,WAAW,KAAA,EAA8B;AACvD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAChB,EAAA,OAAO,UAAA,CAAW,KAAK,GAAG,CAAA;AAC5B;;;ACjBA,SAAS,aAAa,IAAA,EAA0B;AAC9C,EAAA,MAAM,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA;AACrB,EAAA,IAAI,MAAA,GAAS,MAAA,CAAO,IAAA,GAAO,eAAA,CAAgB,MAAA,CAAO,WAAA,CAAY,OAAA,GAAU,IAAI,CAAC,CAAC,CAAC,CAAA,GAAI,CAAA;AACnF,EAAA,IAAI,MAAA,KAAW,IAAI,MAAA,GAAS,EAAA;AAC5B,EAAA,MAAM,MAAM,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAChD,EAAA,OAAO,UAAA,CAAW,IAAA,CAAA,CAAM,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAC,CAAA;AAC7E;AACA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,kBAAkB,OAAA,EAAsD;AACtF,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,oBAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,CAAA,QAAA,EAAW,QAAQ,IAAI,CAAA,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,aAAa,IAAI,CAAA;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AACrD,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,OAAO,WAAA,CAAY,OAAA,GAAU,IAAI,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACnE,EAAA,MAAM,YAAA,GAAe,iBAAiB,WAAW,CAAA;AACjD,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,WAAA,CAAY,OAAA,CAAQ,IAAI,CAAC,CAAA;AAEjD,EAAA,MAAM,OAAA,GAAU,UAAA;AAAA,wBACV,GAAA,CAAgC;AAAA,MAClC,CAAC,GAAG,CAAC,CAAA;AAAA;AAAA,MACL,CAAC,GAAG,EAAE,CAAA;AAAA;AAAA,MACN,CAAC,IAAI,CAAC,CAAA;AAAA;AAAA,MACN,CAAC,IAAI,CAAC,CAAA;AAAA,MACN,CAAC,IAAI,CAAC;AAAA,KACP;AAAA,GACH;AAEA,EAAA,MAAM,gBAAA,GAAmB,WAAA;AAAA,IACvB,QAAA;AAAA,IACA,IAAI,UAAA,CAAW,CAAC,EAAI,CAAC,CAAA;AAAA;AAAA,IACrB,IAAI,UAAA,CAAW,CAAC,GAAG,CAAA,EAAG,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA;AAAA,IAC3B,IAAI,WAAW,EAAE,CAAA;AAAA;AAAA,IACjB,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG,WAAA,CAAY,MAAM,CAAC,CAAA;AAAA,IACtC,WAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,iBAAA,GAAoB,UAAA;AAAA,wBACpB,GAAA,CAAgC;AAAA,MAClC,CAAC,OAAO,MAAM,CAAA;AAAA,MACd,CAAC,SAAA,kBAAW,IAAI,GAAA,EAAiC,CAAA;AAAA,MACjD,CAAC,YAAY,gBAAgB;AAAA,KAC9B;AAAA,GACH;AAEA,EAAA,SAAS,cAAc,YAAA,EAIrB;AACA,IAAA,MAAM,iBAAA,GAAoB,WAAA;AAAA,MACxB,QAAA;AAAA,MACA,IAAI,UAAA,CAAW,CAAC,CAAI,CAAC,CAAA;AAAA,MACrB,IAAI,UAAA,CAAW,CAAC,GAAG,CAAA,EAAG,CAAA,EAAG,CAAC,CAAC;AAAA,KAC7B;AACA,IAAA,MAAM,cAAA,GAAiB,WAAA;AAAA,MACrB,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,gBAAgB,SAAA,EAAW,YAAA,EAAc,QAAQ;AAAA,KAC1E;AACA,IAAA,MAAM,UAAU,MAAA,CAAO,WAAA,CAAY,mBAAmB,MAAA,CAAO,cAAc,CAAC,CAAC,CAAA;AAC7E,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AACzC,IAAA,MAAM,CAAA,GAAI,QAAQ,UAAA,GAAa,IAAA,CAAK,MAAM,CAAA,GAAI,GAAA,CAAI,IAAI,GAAA,CAAI,CAAA;AAC1D,IAAA,MAAM,YAAA,GAAe,IAAI,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,CAAC,EAAE,aAAA,EAAc;AAChE,IAAA,OAAO,EAAE,iBAAA,EAAmB,cAAA,EAAgB,YAAA,EAAa;AAAA,EAC3D;AAEA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA,GAAwC;AACtC,MAAA,OAAO,OAAA,CAAQ,QAAQ,EAAE,EAAA,EAAI,cAAc,KAAA,EAAO,WAAA,EAAa,mBAAmB,CAAA;AAAA,IACpF,CAAA;AAAA,IACA,IAAI,UAAA,EAA4D;AAC9D,MAAA,MAAM,eAAe,UAAA,CAAW,SAAA,GAAY,gBAAA,CAAiB,UAAA,CAAW,SAAS,CAAA,GAAI,MAAA;AACrF,MAAA,MAAM,CAAA,GAAI,cAAc,YAAY,CAAA;AACpC,MAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,QACrB,EAAA,EAAI,YAAA;AAAA,QACJ,KAAA,EAAO,WAAA;AAAA,QACP,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE,cAAA;AAAA,QAClB,WAAW,CAAA,CAAE;AAAA,OACd,CAAA;AAAA,IACH,CAAA;AAAA,IACA,KAAK,SAAA,EAAoC;AACvC,MAAA,MAAM,CAAA,GAAI,cAAc,SAAS,CAAA;AACjC,MAAA,OAAO;AAAA,QACL,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE,cAAA;AAAA,QAClB,WAAW,CAAA,CAAE,YAAA;AAAA,QACb,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAAA,GACF;AACF;AChHO,SAAS,qBAAA,GAAyC;AACvD,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA2D;AAChF,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,EAAE,SAAA,EAAW,YAAA,EAAa,EAAG;AAClC,QAAA,MAAM,aAAa,MAAA,CAAO,cAAA;AAAA,UACxB,OAAO,IAAA,CAAK,MAAA,CAAO,YAAY,UAAA,GAAa,YAAY,CAAC,CAAC;AAAA,SAC5D;AACA,QAAA,QAAA,CAAS,GAAA,CAAI,YAAA,EAAc,EAAE,UAAA,EAAY,WAAW,CAAA;AACpD,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,eAAe,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA,CAAA,EAAI,CAAA;AAAA,MACjF;AAAA,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,oBAAoB,YAAA,EAAc;AAChC,QAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,YAAY,CAAA;AACzC,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,OAAA,GAAU,CAAC,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAY,CAAA,GAAI,EAAE,CAAA;AAAA,MAC5E;AAAA,KACF;AAAA,IACA,UAAA,EAAY;AAAA,MACV,IAAA,EAAM,MAAM,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW;AAAA;AACpE,GACF;AACF;;;ACtCA,IAAM,OAAA,GAAU,mCAAA;AA4BhB,SAAS,eAAA,GAAqC;AAC5C,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAoB;AACpC,EAAA,OAAO,EAAE,GAAA,EAAK,CAAC,SAAS,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA,EAAM,GAAA,EAAK,CAAC,MAAM,EAAA,KAAO,KAAK,IAAI,GAAA,CAAI,IAAA,EAAM,EAAE,CAAA,EAAE;AAC3F;AAQO,SAAS,iBAAiB,OAAA,EAA8C;AAC7E,EAAA,MAAM,iBAAA,GAAoB,QAAQ,iBAAA,IAAqB,OAAA;AACvD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,IAAA;AAEzC,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,MAAM,OAAO,iBAAA,CAAkB;AAAA,MAC7B,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,YAAY,OAAA,CAAQ;AAAA,KACrB,CAAA;AACD,IAAA,MAAM,UAAU,qBAAA,EAAsB;AACtC,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAClB,IAAA,MAAA,GAAS,IAAA,CAAK,IAAA;AACd,IAAA,OAAA,GAAU,eAAA,EAAgB;AAAA,EAC5B,CAAA,MAAO;AACL,IAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,CAAQ,OAAA,IAAW,CAAC,OAAA,CAAQ,MAAA,EAAQ;AACjF,MAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,IAC7E;AACA,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAClB,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,WAAW,eAAA,EAAgB;AAAA,EAC/C;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,aAAA,EAAe,CAAC,KAAA,KACd,aAAA,CAAsB;AAAA,MACpB,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAA;AAAA,MACA,QAAA,EAAU,OAAO,QAAA,IAAY,MAAA;AAAA,MAC7B,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,IACH,OAAA,EAAS,MACP,OAAA,CAAgB;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,OAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA;AAAA,MACA,wBAAA,EAA0B;AAAA,KAC3B,CAAA;AAAA,IACH,OAAA,EAAS,MAAM,OAAA,CAAgB,EAAE,MAAM,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,CAAA;AAAA,IACxE,aAAA,EAAe,CAAC,QAAA,KAAa,aAAA,CAAgB,UAAU,EAAE,iBAAA,EAAmB,IAAA,EAAM,MAAA,EAAQ;AAAA,GAC5F;AACF","file":"testing.js","sourcesContent":["import type { CborValue } from './cbor';\nimport { utf8ToBytes } from './encoding';\n\n/**\n * Minimal CBOR encoder — the inverse of `cbor.ts`, supporting the same major\n * types (uint, negint, byte string, text string, array, map). Used by the\n * deterministic mock authenticator (S15) to synthesize real attestationObject /\n * COSE-key bytes, so the mock create path goes through the exact same\n * `extractPublicKeyFromAttestationObject` as production. Not canonical-ordered\n * (our decoder is order-agnostic) and intentionally narrow.\n */\nfunction head(major: number, arg: number): number[] {\n  const m = major << 5;\n  if (arg < 24) return [m | arg];\n  if (arg < 0x100) return [m | 24, arg];\n  if (arg < 0x10000) return [m | 25, (arg >> 8) & 0xff, arg & 0xff];\n  return [m | 26, (arg >>> 24) & 0xff, (arg >> 16) & 0xff, (arg >> 8) & 0xff, arg & 0xff];\n}\n\nfunction write(value: CborValue, out: number[]): void {\n  if (typeof value === 'number' && Number.isInteger(value)) {\n    if (value >= 0) out.push(...head(0, value));\n    else out.push(...head(1, -1 - value));\n  } else if (value instanceof Uint8Array) {\n    out.push(...head(2, value.length));\n    for (const b of value) out.push(b);\n  } else if (typeof value === 'string') {\n    const bytes = utf8ToBytes(value);\n    out.push(...head(3, bytes.length));\n    for (const b of bytes) out.push(b);\n  } else if (Array.isArray(value)) {\n    out.push(...head(4, value.length));\n    for (const item of value) write(item, out);\n  } else if (value instanceof Map) {\n    out.push(...head(5, value.size));\n    for (const [k, v] of value) {\n      write(k, out);\n      write(v, out);\n    }\n  } else {\n    throw new Error('CBOR encode: unsupported value');\n  }\n}\n\nexport function encodeCbor(value: CborValue): Uint8Array {\n  const out: number[] = [];\n  write(value, out);\n  return Uint8Array.from(out);\n}\n","import { p256 } from '@noble/curves/nist';\nimport { sha256 } from '../internal/sha256';\nimport { concatBytes } from '../internal/bytes';\nimport { bytesToBase64Url, utf8ToBytes } from '../internal/encoding';\nimport { encodeCbor } from '../internal/cborEncode';\nimport type { CborValue } from '../internal/cbor';\nimport type {\n  WebAuthnClient,\n  WebAuthnCreateResult,\n  WebAuthnGetOptions,\n  WebAuthnGetResult,\n} from '../ceremonies/types';\nimport type { AssertionResult } from '../soroban/sign';\n\nexport interface MockAuthenticatorOptions {\n  rpId: string;\n  origin?: string;\n  /** Deterministic seed → keypair + credentialId. */\n  seed?: string;\n  /** Emit high-S signatures, to exercise the perpetual low-S guard (S04). */\n  forceHighS?: boolean;\n}\n\nexport interface MockAuthenticator extends WebAuthnClient {\n  readonly publicKey: Uint8Array; // 65-byte SEC-1\n  readonly credentialId: string; // base64url\n  readonly privateKey: Uint8Array;\n  /** WebAuthnSigner for the Soroban sign path (challenge already base64url). */\n  sign(challenge: string): AssertionResult;\n}\n\nfunction deriveScalar(seed: string): Uint8Array {\n  const n = p256.CURVE.n;\n  let scalar = BigInt('0x' + bytesToHexLocal(sha256(utf8ToBytes('priv:' + seed)))) % n;\n  if (scalar === 0n) scalar = 1n;\n  const hex = scalar.toString(16).padStart(64, '0');\n  return Uint8Array.from((hex.match(/../g) ?? []).map((h) => parseInt(h, 16)));\n}\nfunction bytesToHexLocal(bytes: Uint8Array): string {\n  let hex = '';\n  for (const b of bytes) hex += b.toString(16).padStart(2, '0');\n  return hex;\n}\n\n/**\n * A deterministic, in-memory WebAuthn authenticator for the mock kit (S15). It\n * synthesizes a REAL attestationObject / COSE key (so `createPasskey` runs the\n * exact production extraction path) and signs assertions with the same P-256\n * key — optionally as high-S to prove the low-S normalization guard.\n */\nexport function mockAuthenticator(options: MockAuthenticatorOptions): MockAuthenticator {\n  const seed = options.seed ?? 'mock-authenticator';\n  const origin = options.origin ?? `https://${options.rpId}`;\n  const privateKey = deriveScalar(seed);\n  const publicKey = p256.getPublicKey(privateKey, false); // 0x04 ‖ X ‖ Y\n  const x = publicKey.slice(1, 33);\n  const y = publicKey.slice(33, 65);\n  const credIdBytes = sha256(utf8ToBytes('cred:' + seed)).slice(0, 16);\n  const credentialId = bytesToBase64Url(credIdBytes);\n  const rpIdHash = sha256(utf8ToBytes(options.rpId));\n\n  const coseKey = encodeCbor(\n    new Map<number | string, CborValue>([\n      [1, 2], // kty EC2\n      [3, -7], // alg ES256\n      [-1, 1], // crv P-256\n      [-2, x],\n      [-3, y],\n    ]),\n  );\n\n  const attestedAuthData = concatBytes(\n    rpIdHash,\n    new Uint8Array([0x45]), // UP | UV | AT\n    new Uint8Array([0, 0, 0, 0]), // signCount\n    new Uint8Array(16), // aaguid\n    new Uint8Array([0, credIdBytes.length]),\n    credIdBytes,\n    coseKey,\n  );\n  const attestationObject = encodeCbor(\n    new Map<number | string, CborValue>([\n      ['fmt', 'none'],\n      ['attStmt', new Map<number | string, CborValue>()],\n      ['authData', attestedAuthData],\n    ]),\n  );\n\n  function signAssertion(challengeB64: string): {\n    authenticatorData: Uint8Array;\n    clientDataJSON: Uint8Array;\n    signatureDer: Uint8Array;\n  } {\n    const authenticatorData = concatBytes(\n      rpIdHash,\n      new Uint8Array([0x05]),\n      new Uint8Array([0, 0, 0, 1]),\n    );\n    const clientDataJSON = utf8ToBytes(\n      JSON.stringify({ type: 'webauthn.get', challenge: challengeB64, origin }),\n    );\n    const payload = sha256(concatBytes(authenticatorData, sha256(clientDataJSON)));\n    const sig = p256.sign(payload, privateKey); // low-S by default\n    const s = options.forceHighS ? p256.CURVE.n - sig.s : sig.s;\n    const signatureDer = new p256.Signature(sig.r, s).toDERRawBytes();\n    return { authenticatorData, clientDataJSON, signatureDer };\n  }\n\n  return {\n    publicKey,\n    credentialId,\n    privateKey,\n    create(): Promise<WebAuthnCreateResult> {\n      return Promise.resolve({ id: credentialId, rawId: credIdBytes, attestationObject });\n    },\n    get(getOptions: WebAuthnGetOptions): Promise<WebAuthnGetResult> {\n      const challengeB64 = getOptions.challenge ? bytesToBase64Url(getOptions.challenge) : 'mock';\n      const a = signAssertion(challengeB64);\n      return Promise.resolve({\n        id: credentialId,\n        rawId: credIdBytes,\n        authenticatorData: a.authenticatorData,\n        clientDataJSON: a.clientDataJSON,\n        signature: a.signatureDer,\n      });\n    },\n    sign(challenge: string): AssertionResult {\n      const a = signAssertion(challenge);\n      return {\n        authenticatorData: a.authenticatorData,\n        clientDataJSON: a.clientDataJSON,\n        signature: a.signatureDer,\n        credentialId: credIdBytes,\n      };\n    },\n  };\n}\n","import { StrKey } from '@stellar/stellar-sdk';\nimport { sha256 } from '../internal/sha256';\nimport { utf8ToBytes } from '../internal/encoding';\nimport type { AccountDeployer } from '../ceremonies/types';\nimport type { IndexerAdapter, SubmissionAdapter } from '../adapters/types';\n\nexport interface InMemoryBackend {\n  deployer: AccountDeployer;\n  indexer: IndexerAdapter;\n  submission: SubmissionAdapter;\n  /** credentialId → { contractId, publicKey } — shared so create/connect/recover agree. */\n  registry: Map<string, { contractId: string; publicKey: Uint8Array }>;\n}\n\n/**\n * Deterministic, zero-IO backend for the mock kit: the deployer derives a stable\n * C-address from the credentialId and records it; the indexer resolves from the\n * same registry; submission is a no-op SUCCESS.\n *\n * The address is a real StrKey contract id (checksummed, decodable), so a mock\n * account can be fed straight into `new Address(...)` / auth-entry XDR the same way\n * a deployed one is. It is deterministic but arbitrary: it is not the address the\n * factory would deploy for this credential (that is {@link deriveAccountAddress}).\n */\nexport function createInMemoryBackend(): InMemoryBackend {\n  const registry = new Map<string, { contractId: string; publicKey: Uint8Array }>();\n  let nonce = 0;\n  return {\n    registry,\n    deployer: {\n      deploy({ publicKey, credentialId }) {\n        const contractId = StrKey.encodeContract(\n          Buffer.from(sha256(utf8ToBytes('account:' + credentialId))),\n        );\n        registry.set(credentialId, { contractId, publicKey });\n        return Promise.resolve({ contractId, txHash: `mock-deploy-${String(nonce++)}` });\n      },\n    },\n    indexer: {\n      resolveByCredential(credentialId) {\n        const account = registry.get(credentialId);\n        return Promise.resolve(account ? [{ contractId: account.contractId }] : []);\n      },\n    },\n    submission: {\n      send: () => Promise.resolve({ status: 'SUCCESS', hash: 'mock-tx' }),\n    },\n  };\n}\n","import { createPasskey as createPasskeyCeremony } from '../ceremonies/create';\nimport { connect as connectCeremony, type ConnectResult } from '../ceremonies/connect';\nimport { recover as recoverCeremony, type RecoverResult } from '../ceremonies/recover';\nimport { signAuthEntry as signAuthEntryFn, type WebAuthnSigner } from '../soroban/sign';\nimport type { AccountDeployer, CredentialStorage, WebAuthnClient } from '../ceremonies/types';\nimport type { IndexerAdapter, SubmissionAdapter } from '../adapters/types';\nimport type { PasskeyCredential } from '../types';\nimport { mockAuthenticator } from './mockAuthenticator';\nimport { createInMemoryBackend } from './inMemory';\n\nconst TESTNET = 'Test SDF Network ; September 2015';\n\nexport interface CreatePasskeyKitOptions {\n  mode: 'mock' | 'live';\n  rpId: string;\n  rpName?: string;\n  networkPassphrase?: string;\n  // mock-mode knobs\n  seed?: string;\n  forceHighS?: boolean;\n  // live-mode dependencies\n  webauthn?: WebAuthnClient;\n  deployer?: AccountDeployer;\n  indexer?: IndexerAdapter;\n  submission?: SubmissionAdapter;\n  storage?: CredentialStorage;\n  signer?: WebAuthnSigner;\n}\n\nexport interface PasskeyKit {\n  readonly mode: 'mock' | 'live';\n  readonly rpId: string;\n  createPasskey(input?: { userName?: string }): Promise<PasskeyCredential>;\n  connect(): Promise<ConnectResult | null>;\n  recover(): Promise<RecoverResult[]>;\n  signAuthEntry(entryXdr: string): Promise<string>;\n}\n\nfunction inMemoryStorage(): CredentialStorage {\n  const map = new Map<string, string>();\n  return { get: (rpId) => map.get(rpId) ?? null, set: (rpId, id) => void map.set(rpId, id) };\n}\n\n/**\n * The downstream-adopter kit (S15, Deliverable #6). `mode:'mock'` wires a\n * deterministic in-memory authenticator + backend (zero network IO) so the\n * happy path matches the live path's SHAPE — swap `mock → live` and the demo\n * stays green. `mode:'live'` takes real adapters + a WebAuthn signer.\n */\nexport function createPasskeyKit(options: CreatePasskeyKitOptions): PasskeyKit {\n  const networkPassphrase = options.networkPassphrase ?? TESTNET;\n  const rpName = options.rpName ?? options.rpId;\n\n  let webauthn: WebAuthnClient;\n  let deployer: AccountDeployer;\n  let indexer: IndexerAdapter;\n  let storage: CredentialStorage;\n  let signer: WebAuthnSigner;\n\n  if (options.mode === 'mock') {\n    const auth = mockAuthenticator({\n      rpId: options.rpId,\n      seed: options.seed,\n      forceHighS: options.forceHighS,\n    });\n    const backend = createInMemoryBackend();\n    webauthn = auth;\n    deployer = backend.deployer;\n    indexer = backend.indexer;\n    signer = auth.sign;\n    storage = inMemoryStorage();\n  } else {\n    if (!options.webauthn || !options.deployer || !options.indexer || !options.signer) {\n      throw new Error('live mode requires webauthn, deployer, indexer and signer');\n    }\n    webauthn = options.webauthn;\n    deployer = options.deployer;\n    indexer = options.indexer;\n    signer = options.signer;\n    storage = options.storage ?? inMemoryStorage();\n  }\n\n  return {\n    mode: options.mode,\n    rpId: options.rpId,\n    createPasskey: (input) =>\n      createPasskeyCeremony({\n        rpId: options.rpId,\n        rpName,\n        userName: input?.userName ?? 'user',\n        deployer,\n        webauthn,\n        storage,\n      }),\n    connect: () =>\n      connectCeremony({\n        rpId: options.rpId,\n        indexer,\n        webauthn,\n        storage,\n        silentMediationSupported: false,\n      }),\n    recover: () => recoverCeremony({ rpId: options.rpId, indexer, webauthn }),\n    signAuthEntry: (entryXdr) => signAuthEntryFn(entryXdr, { networkPassphrase, sign: signer }),\n  };\n}\n"]}
+{"version":3,"sources":["../src/internal/cborEncode.ts","../src/testing/mockAuthenticator.ts","../src/testing/inMemory.ts","../src/testing/kit.ts","../src/testing/sampleAuthEntry.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,SAAS,IAAA,CAAK,OAAe,GAAA,EAAuB;AAClD,EAAA,MAAM,IAAI,KAAA,IAAS,CAAA;AACnB,EAAA,IAAI,GAAA,GAAM,EAAA,EAAI,OAAO,CAAC,IAAI,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,GAAA,EAAO,OAAO,CAAC,CAAA,GAAI,IAAI,GAAG,CAAA;AACpC,EAAA,IAAI,GAAA,GAAM,KAAA,EAAS,OAAO,CAAC,CAAA,GAAI,IAAK,GAAA,IAAO,CAAA,GAAK,GAAA,EAAM,GAAA,GAAM,GAAI,CAAA;AAChE,EAAA,OAAO,CAAC,CAAA,GAAI,EAAA,EAAK,GAAA,KAAQ,EAAA,GAAM,GAAA,EAAO,GAAA,IAAO,EAAA,GAAM,GAAA,EAAO,GAAA,IAAO,CAAA,GAAK,GAAA,EAAM,MAAM,GAAI,CAAA;AACxF;AAEA,SAAS,KAAA,CAAM,OAAkB,GAAA,EAAqB;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,EAAG;AACxD,IAAA,IAAI,KAAA,IAAS,GAAG,GAAA,CAAI,IAAA,CAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,aACjC,IAAA,CAAK,GAAG,KAAK,CAAA,EAAG,EAAA,GAAK,KAAK,CAAC,CAAA;AAAA,EACtC,CAAA,MAAA,IAAW,iBAAiB,UAAA,EAAY;AACtC,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,IAAA,MAAM,KAAA,GAAQ,YAAY,KAAK,CAAA;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,KAAA,CAAM,IAAA,EAAM,GAAG,CAAA;AAAA,EAC3C,CAAA,MAAA,IAAW,iBAAiB,GAAA,EAAK;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAC,CAAA;AAC/B,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,KAAA,EAAO;AAC1B,MAAA,KAAA,CAAM,GAAG,GAAG,CAAA;AACZ,MAAA,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,IACd;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACF;AAEO,SAAS,WAAW,KAAA,EAA8B;AACvD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAChB,EAAA,OAAO,UAAA,CAAW,KAAK,GAAG,CAAA;AAC5B;;;ACjBA,SAAS,aAAa,IAAA,EAA0B;AAC9C,EAAA,MAAM,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA;AACrB,EAAA,IAAI,MAAA,GAAS,MAAA,CAAO,IAAA,GAAO,eAAA,CAAgB,MAAA,CAAO,WAAA,CAAY,OAAA,GAAU,IAAI,CAAC,CAAC,CAAC,CAAA,GAAI,CAAA;AACnF,EAAA,IAAI,MAAA,KAAW,IAAI,MAAA,GAAS,EAAA;AAC5B,EAAA,MAAM,MAAM,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAChD,EAAA,OAAO,UAAA,CAAW,IAAA,CAAA,CAAM,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAC,CAAA;AAC7E;AACA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,kBAAkB,OAAA,EAAsD;AACtF,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,oBAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,CAAA,QAAA,EAAW,QAAQ,IAAI,CAAA,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,aAAa,IAAI,CAAA;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AACrD,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,OAAO,WAAA,CAAY,OAAA,GAAU,IAAI,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACnE,EAAA,MAAM,YAAA,GAAe,iBAAiB,WAAW,CAAA;AACjD,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,WAAA,CAAY,OAAA,CAAQ,IAAI,CAAC,CAAA;AAEjD,EAAA,MAAM,OAAA,GAAU,UAAA;AAAA,wBACV,GAAA,CAAgC;AAAA,MAClC,CAAC,GAAG,CAAC,CAAA;AAAA;AAAA,MACL,CAAC,GAAG,EAAE,CAAA;AAAA;AAAA,MACN,CAAC,IAAI,CAAC,CAAA;AAAA;AAAA,MACN,CAAC,IAAI,CAAC,CAAA;AAAA,MACN,CAAC,IAAI,CAAC;AAAA,KACP;AAAA,GACH;AAEA,EAAA,MAAM,gBAAA,GAAmB,WAAA;AAAA,IACvB,QAAA;AAAA,IACA,IAAI,UAAA,CAAW,CAAC,EAAI,CAAC,CAAA;AAAA;AAAA,IACrB,IAAI,UAAA,CAAW,CAAC,GAAG,CAAA,EAAG,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA;AAAA,IAC3B,IAAI,WAAW,EAAE,CAAA;AAAA;AAAA,IACjB,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG,WAAA,CAAY,MAAM,CAAC,CAAA;AAAA,IACtC,WAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,iBAAA,GAAoB,UAAA;AAAA,wBACpB,GAAA,CAAgC;AAAA,MAClC,CAAC,OAAO,MAAM,CAAA;AAAA,MACd,CAAC,SAAA,kBAAW,IAAI,GAAA,EAAiC,CAAA;AAAA,MACjD,CAAC,YAAY,gBAAgB;AAAA,KAC9B;AAAA,GACH;AAEA,EAAA,SAAS,cAAc,YAAA,EAIrB;AACA,IAAA,MAAM,iBAAA,GAAoB,WAAA;AAAA,MACxB,QAAA;AAAA,MACA,IAAI,UAAA,CAAW,CAAC,CAAI,CAAC,CAAA;AAAA,MACrB,IAAI,UAAA,CAAW,CAAC,GAAG,CAAA,EAAG,CAAA,EAAG,CAAC,CAAC;AAAA,KAC7B;AACA,IAAA,MAAM,cAAA,GAAiB,WAAA;AAAA,MACrB,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,gBAAgB,SAAA,EAAW,YAAA,EAAc,QAAQ;AAAA,KAC1E;AACA,IAAA,MAAM,UAAU,MAAA,CAAO,WAAA,CAAY,mBAAmB,MAAA,CAAO,cAAc,CAAC,CAAC,CAAA;AAC7E,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AACzC,IAAA,MAAM,CAAA,GAAI,QAAQ,UAAA,GAAa,IAAA,CAAK,MAAM,CAAA,GAAI,GAAA,CAAI,IAAI,GAAA,CAAI,CAAA;AAC1D,IAAA,MAAM,YAAA,GAAe,IAAI,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,CAAC,EAAE,aAAA,EAAc;AAChE,IAAA,OAAO,EAAE,iBAAA,EAAmB,cAAA,EAAgB,YAAA,EAAa;AAAA,EAC3D;AAEA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA,GAAwC;AACtC,MAAA,OAAO,OAAA,CAAQ,QAAQ,EAAE,EAAA,EAAI,cAAc,KAAA,EAAO,WAAA,EAAa,mBAAmB,CAAA;AAAA,IACpF,CAAA;AAAA,IACA,IAAI,UAAA,EAA4D;AAC9D,MAAA,MAAM,eAAe,UAAA,CAAW,SAAA,GAAY,gBAAA,CAAiB,UAAA,CAAW,SAAS,CAAA,GAAI,MAAA;AACrF,MAAA,MAAM,CAAA,GAAI,cAAc,YAAY,CAAA;AACpC,MAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,QACrB,EAAA,EAAI,YAAA;AAAA,QACJ,KAAA,EAAO,WAAA;AAAA,QACP,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE,cAAA;AAAA,QAClB,WAAW,CAAA,CAAE;AAAA,OACd,CAAA;AAAA,IACH,CAAA;AAAA,IACA,KAAK,SAAA,EAAoC;AACvC,MAAA,MAAM,CAAA,GAAI,cAAc,SAAS,CAAA;AACjC,MAAA,OAAO;AAAA,QACL,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE,cAAA;AAAA,QAClB,WAAW,CAAA,CAAE,YAAA;AAAA,QACb,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAAA,GACF;AACF;AChHO,SAAS,qBAAA,GAAyC;AACvD,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA2D;AAChF,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,EAAE,SAAA,EAAW,YAAA,EAAa,EAAG;AAClC,QAAA,MAAM,aAAa,MAAA,CAAO,cAAA;AAAA,UACxB,OAAO,IAAA,CAAK,MAAA,CAAO,YAAY,UAAA,GAAa,YAAY,CAAC,CAAC;AAAA,SAC5D;AACA,QAAA,QAAA,CAAS,GAAA,CAAI,YAAA,EAAc,EAAE,UAAA,EAAY,WAAW,CAAA;AACpD,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,eAAe,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA,CAAA,EAAI,CAAA;AAAA,MACjF;AAAA,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,oBAAoB,YAAA,EAAc;AAChC,QAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,YAAY,CAAA;AACzC,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,OAAA,GAAU,CAAC,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAY,CAAA,GAAI,EAAE,CAAA;AAAA,MAC5E;AAAA,KACF;AAAA,IACA,UAAA,EAAY;AAAA,MACV,IAAA,EAAM,MAAM,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW;AAAA;AACpE,GACF;AACF;;;ACtCA,IAAM,OAAA,GAAU,mCAAA;AA4BhB,SAAS,eAAA,GAAqC;AAC5C,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAoB;AACpC,EAAA,OAAO,EAAE,GAAA,EAAK,CAAC,SAAS,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA,EAAM,GAAA,EAAK,CAAC,MAAM,EAAA,KAAO,KAAK,IAAI,GAAA,CAAI,IAAA,EAAM,EAAE,CAAA,EAAE;AAC3F;AAQO,SAAS,iBAAiB,OAAA,EAA8C;AAC7E,EAAA,MAAM,iBAAA,GAAoB,QAAQ,iBAAA,IAAqB,OAAA;AACvD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,IAAA;AAEzC,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,MAAM,OAAO,iBAAA,CAAkB;AAAA,MAC7B,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,YAAY,OAAA,CAAQ;AAAA,KACrB,CAAA;AACD,IAAA,MAAM,UAAU,qBAAA,EAAsB;AACtC,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAClB,IAAA,MAAA,GAAS,IAAA,CAAK,IAAA;AACd,IAAA,OAAA,GAAU,eAAA,EAAgB;AAAA,EAC5B,CAAA,MAAO;AACL,IAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,CAAQ,OAAA,IAAW,CAAC,OAAA,CAAQ,MAAA,EAAQ;AACjF,MAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,IAC7E;AACA,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAClB,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,WAAW,eAAA,EAAgB;AAAA,EAC/C;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,aAAA,EAAe,CAAC,KAAA,KACd,aAAA,CAAsB;AAAA,MACpB,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAA;AAAA,MACA,QAAA,EAAU,OAAO,QAAA,IAAY,MAAA;AAAA,MAC7B,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,IACH,OAAA,EAAS,MACP,OAAA,CAAgB;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,OAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA;AAAA,MACA,wBAAA,EAA0B;AAAA,KAC3B,CAAA;AAAA,IACH,OAAA,EAAS,MAAM,OAAA,CAAgB,EAAE,MAAM,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,CAAA;AAAA,IACxE,aAAA,EAAe,CAAC,QAAA,KAAa,aAAA,CAAgB,UAAU,EAAE,iBAAA,EAAmB,IAAA,EAAM,MAAA,EAAQ;AAAA,GAC5F;AACF;ACjGO,SAAS,eAAA,CAAgB,UAAA,EAAoB,YAAA,GAAe,WAAA,EAAqB;AACtF,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,UAAU,EAAE,WAAA,EAAY;AACpD,EAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,yBAAA,CAA0B;AAAA,IAC9C,WAAA,EAAa,IAAI,kBAAA,CAAmB,yBAAA;AAAA,MAClC,IAAI,IAAI,yBAAA,CAA0B;AAAA,QAChC,OAAA;AAAA,QACA,KAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAA;AAAA,QACtB,yBAAA,EAA2B,GAAA;AAAA,QAC3B,SAAA,EAAW,GAAA,CAAI,KAAA,CAAM,OAAA;AAAQ,OAC9B;AAAA,KACH;AAAA,IACA,cAAA,EAAgB,IAAI,GAAA,CAAI,2BAAA,CAA4B;AAAA,MAClD,QAAA,EAAU,IAAI,yBAAA,CAA0B,uCAAA;AAAA,QACtC,IAAI,GAAA,CAAI,kBAAA,CAAmB,EAAE,eAAA,EAAiB,SAAS,YAAA,EAAc,IAAA,EAAM,EAAC,EAAG;AAAA,OACjF;AAAA,MACA,gBAAgB;AAAC,KAClB;AAAA,GACF,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,MAAM,QAAQ,CAAA;AAC7B","file":"testing.js","sourcesContent":["import type { CborValue } from './cbor';\nimport { utf8ToBytes } from './encoding';\n\n/**\n * Minimal CBOR encoder — the inverse of `cbor.ts`, supporting the same major\n * types (uint, negint, byte string, text string, array, map). Used by the\n * deterministic mock authenticator (S15) to synthesize real attestationObject /\n * COSE-key bytes, so the mock create path goes through the exact same\n * `extractPublicKeyFromAttestationObject` as production. Not canonical-ordered\n * (our decoder is order-agnostic) and intentionally narrow.\n */\nfunction head(major: number, arg: number): number[] {\n  const m = major << 5;\n  if (arg < 24) return [m | arg];\n  if (arg < 0x100) return [m | 24, arg];\n  if (arg < 0x10000) return [m | 25, (arg >> 8) & 0xff, arg & 0xff];\n  return [m | 26, (arg >>> 24) & 0xff, (arg >> 16) & 0xff, (arg >> 8) & 0xff, arg & 0xff];\n}\n\nfunction write(value: CborValue, out: number[]): void {\n  if (typeof value === 'number' && Number.isInteger(value)) {\n    if (value >= 0) out.push(...head(0, value));\n    else out.push(...head(1, -1 - value));\n  } else if (value instanceof Uint8Array) {\n    out.push(...head(2, value.length));\n    for (const b of value) out.push(b);\n  } else if (typeof value === 'string') {\n    const bytes = utf8ToBytes(value);\n    out.push(...head(3, bytes.length));\n    for (const b of bytes) out.push(b);\n  } else if (Array.isArray(value)) {\n    out.push(...head(4, value.length));\n    for (const item of value) write(item, out);\n  } else if (value instanceof Map) {\n    out.push(...head(5, value.size));\n    for (const [k, v] of value) {\n      write(k, out);\n      write(v, out);\n    }\n  } else {\n    throw new Error('CBOR encode: unsupported value');\n  }\n}\n\nexport function encodeCbor(value: CborValue): Uint8Array {\n  const out: number[] = [];\n  write(value, out);\n  return Uint8Array.from(out);\n}\n","import { p256 } from '@noble/curves/nist';\nimport { sha256 } from '../internal/sha256';\nimport { concatBytes } from '../internal/bytes';\nimport { bytesToBase64Url, utf8ToBytes } from '../internal/encoding';\nimport { encodeCbor } from '../internal/cborEncode';\nimport type { CborValue } from '../internal/cbor';\nimport type {\n  WebAuthnClient,\n  WebAuthnCreateResult,\n  WebAuthnGetOptions,\n  WebAuthnGetResult,\n} from '../ceremonies/types';\nimport type { AssertionResult } from '../soroban/sign';\n\nexport interface MockAuthenticatorOptions {\n  rpId: string;\n  origin?: string;\n  /** Deterministic seed → keypair + credentialId. */\n  seed?: string;\n  /** Emit high-S signatures, to exercise the perpetual low-S guard (S04). */\n  forceHighS?: boolean;\n}\n\nexport interface MockAuthenticator extends WebAuthnClient {\n  readonly publicKey: Uint8Array; // 65-byte SEC-1\n  readonly credentialId: string; // base64url\n  readonly privateKey: Uint8Array;\n  /** WebAuthnSigner for the Soroban sign path (challenge already base64url). */\n  sign(challenge: string): AssertionResult;\n}\n\nfunction deriveScalar(seed: string): Uint8Array {\n  const n = p256.CURVE.n;\n  let scalar = BigInt('0x' + bytesToHexLocal(sha256(utf8ToBytes('priv:' + seed)))) % n;\n  if (scalar === 0n) scalar = 1n;\n  const hex = scalar.toString(16).padStart(64, '0');\n  return Uint8Array.from((hex.match(/../g) ?? []).map((h) => parseInt(h, 16)));\n}\nfunction bytesToHexLocal(bytes: Uint8Array): string {\n  let hex = '';\n  for (const b of bytes) hex += b.toString(16).padStart(2, '0');\n  return hex;\n}\n\n/**\n * A deterministic, in-memory WebAuthn authenticator for the mock kit (S15). It\n * synthesizes a REAL attestationObject / COSE key (so `createPasskey` runs the\n * exact production extraction path) and signs assertions with the same P-256\n * key — optionally as high-S to prove the low-S normalization guard.\n */\nexport function mockAuthenticator(options: MockAuthenticatorOptions): MockAuthenticator {\n  const seed = options.seed ?? 'mock-authenticator';\n  const origin = options.origin ?? `https://${options.rpId}`;\n  const privateKey = deriveScalar(seed);\n  const publicKey = p256.getPublicKey(privateKey, false); // 0x04 ‖ X ‖ Y\n  const x = publicKey.slice(1, 33);\n  const y = publicKey.slice(33, 65);\n  const credIdBytes = sha256(utf8ToBytes('cred:' + seed)).slice(0, 16);\n  const credentialId = bytesToBase64Url(credIdBytes);\n  const rpIdHash = sha256(utf8ToBytes(options.rpId));\n\n  const coseKey = encodeCbor(\n    new Map<number | string, CborValue>([\n      [1, 2], // kty EC2\n      [3, -7], // alg ES256\n      [-1, 1], // crv P-256\n      [-2, x],\n      [-3, y],\n    ]),\n  );\n\n  const attestedAuthData = concatBytes(\n    rpIdHash,\n    new Uint8Array([0x45]), // UP | UV | AT\n    new Uint8Array([0, 0, 0, 0]), // signCount\n    new Uint8Array(16), // aaguid\n    new Uint8Array([0, credIdBytes.length]),\n    credIdBytes,\n    coseKey,\n  );\n  const attestationObject = encodeCbor(\n    new Map<number | string, CborValue>([\n      ['fmt', 'none'],\n      ['attStmt', new Map<number | string, CborValue>()],\n      ['authData', attestedAuthData],\n    ]),\n  );\n\n  function signAssertion(challengeB64: string): {\n    authenticatorData: Uint8Array;\n    clientDataJSON: Uint8Array;\n    signatureDer: Uint8Array;\n  } {\n    const authenticatorData = concatBytes(\n      rpIdHash,\n      new Uint8Array([0x05]),\n      new Uint8Array([0, 0, 0, 1]),\n    );\n    const clientDataJSON = utf8ToBytes(\n      JSON.stringify({ type: 'webauthn.get', challenge: challengeB64, origin }),\n    );\n    const payload = sha256(concatBytes(authenticatorData, sha256(clientDataJSON)));\n    const sig = p256.sign(payload, privateKey); // low-S by default\n    const s = options.forceHighS ? p256.CURVE.n - sig.s : sig.s;\n    const signatureDer = new p256.Signature(sig.r, s).toDERRawBytes();\n    return { authenticatorData, clientDataJSON, signatureDer };\n  }\n\n  return {\n    publicKey,\n    credentialId,\n    privateKey,\n    create(): Promise<WebAuthnCreateResult> {\n      return Promise.resolve({ id: credentialId, rawId: credIdBytes, attestationObject });\n    },\n    get(getOptions: WebAuthnGetOptions): Promise<WebAuthnGetResult> {\n      const challengeB64 = getOptions.challenge ? bytesToBase64Url(getOptions.challenge) : 'mock';\n      const a = signAssertion(challengeB64);\n      return Promise.resolve({\n        id: credentialId,\n        rawId: credIdBytes,\n        authenticatorData: a.authenticatorData,\n        clientDataJSON: a.clientDataJSON,\n        signature: a.signatureDer,\n      });\n    },\n    sign(challenge: string): AssertionResult {\n      const a = signAssertion(challenge);\n      return {\n        authenticatorData: a.authenticatorData,\n        clientDataJSON: a.clientDataJSON,\n        signature: a.signatureDer,\n        credentialId: credIdBytes,\n      };\n    },\n  };\n}\n","import { StrKey } from '@stellar/stellar-sdk';\nimport { sha256 } from '../internal/sha256';\nimport { utf8ToBytes } from '../internal/encoding';\nimport type { AccountDeployer } from '../ceremonies/types';\nimport type { IndexerAdapter, SubmissionAdapter } from '../adapters/types';\n\nexport interface InMemoryBackend {\n  deployer: AccountDeployer;\n  indexer: IndexerAdapter;\n  submission: SubmissionAdapter;\n  /** credentialId → { contractId, publicKey } — shared so create/connect/recover agree. */\n  registry: Map<string, { contractId: string; publicKey: Uint8Array }>;\n}\n\n/**\n * Deterministic, zero-IO backend for the mock kit: the deployer derives a stable\n * C-address from the credentialId and records it; the indexer resolves from the\n * same registry; submission is a no-op SUCCESS.\n *\n * The address is a real StrKey contract id (checksummed, decodable), so a mock\n * account can be fed straight into `new Address(...)` / auth-entry XDR the same way\n * a deployed one is. It is deterministic but arbitrary: it is not the address the\n * factory would deploy for this credential (that is {@link deriveAccountAddress}).\n */\nexport function createInMemoryBackend(): InMemoryBackend {\n  const registry = new Map<string, { contractId: string; publicKey: Uint8Array }>();\n  let nonce = 0;\n  return {\n    registry,\n    deployer: {\n      deploy({ publicKey, credentialId }) {\n        const contractId = StrKey.encodeContract(\n          Buffer.from(sha256(utf8ToBytes('account:' + credentialId))),\n        );\n        registry.set(credentialId, { contractId, publicKey });\n        return Promise.resolve({ contractId, txHash: `mock-deploy-${String(nonce++)}` });\n      },\n    },\n    indexer: {\n      resolveByCredential(credentialId) {\n        const account = registry.get(credentialId);\n        return Promise.resolve(account ? [{ contractId: account.contractId }] : []);\n      },\n    },\n    submission: {\n      send: () => Promise.resolve({ status: 'SUCCESS', hash: 'mock-tx' }),\n    },\n  };\n}\n","import { createPasskey as createPasskeyCeremony } from '../ceremonies/create';\nimport { connect as connectCeremony, type ConnectResult } from '../ceremonies/connect';\nimport { recover as recoverCeremony, type RecoverResult } from '../ceremonies/recover';\nimport { signAuthEntry as signAuthEntryFn, type WebAuthnSigner } from '../soroban/sign';\nimport type { AccountDeployer, CredentialStorage, WebAuthnClient } from '../ceremonies/types';\nimport type { IndexerAdapter, SubmissionAdapter } from '../adapters/types';\nimport type { PasskeyCredential } from '../types';\nimport { mockAuthenticator } from './mockAuthenticator';\nimport { createInMemoryBackend } from './inMemory';\n\nconst TESTNET = 'Test SDF Network ; September 2015';\n\nexport interface CreatePasskeyKitOptions {\n  mode: 'mock' | 'live';\n  rpId: string;\n  rpName?: string;\n  networkPassphrase?: string;\n  // mock-mode knobs\n  seed?: string;\n  forceHighS?: boolean;\n  // live-mode dependencies\n  webauthn?: WebAuthnClient;\n  deployer?: AccountDeployer;\n  indexer?: IndexerAdapter;\n  submission?: SubmissionAdapter;\n  storage?: CredentialStorage;\n  signer?: WebAuthnSigner;\n}\n\nexport interface PasskeyKit {\n  readonly mode: 'mock' | 'live';\n  readonly rpId: string;\n  createPasskey(input?: { userName?: string }): Promise<PasskeyCredential>;\n  connect(): Promise<ConnectResult | null>;\n  recover(): Promise<RecoverResult[]>;\n  signAuthEntry(entryXdr: string): Promise<string>;\n}\n\nfunction inMemoryStorage(): CredentialStorage {\n  const map = new Map<string, string>();\n  return { get: (rpId) => map.get(rpId) ?? null, set: (rpId, id) => void map.set(rpId, id) };\n}\n\n/**\n * The downstream-adopter kit (S15, Deliverable #6). `mode:'mock'` wires a\n * deterministic in-memory authenticator + backend (zero network IO) so the\n * happy path matches the live path's SHAPE — swap `mock → live` and the demo\n * stays green. `mode:'live'` takes real adapters + a WebAuthn signer.\n */\nexport function createPasskeyKit(options: CreatePasskeyKitOptions): PasskeyKit {\n  const networkPassphrase = options.networkPassphrase ?? TESTNET;\n  const rpName = options.rpName ?? options.rpId;\n\n  let webauthn: WebAuthnClient;\n  let deployer: AccountDeployer;\n  let indexer: IndexerAdapter;\n  let storage: CredentialStorage;\n  let signer: WebAuthnSigner;\n\n  if (options.mode === 'mock') {\n    const auth = mockAuthenticator({\n      rpId: options.rpId,\n      seed: options.seed,\n      forceHighS: options.forceHighS,\n    });\n    const backend = createInMemoryBackend();\n    webauthn = auth;\n    deployer = backend.deployer;\n    indexer = backend.indexer;\n    signer = auth.sign;\n    storage = inMemoryStorage();\n  } else {\n    if (!options.webauthn || !options.deployer || !options.indexer || !options.signer) {\n      throw new Error('live mode requires webauthn, deployer, indexer and signer');\n    }\n    webauthn = options.webauthn;\n    deployer = options.deployer;\n    indexer = options.indexer;\n    signer = options.signer;\n    storage = options.storage ?? inMemoryStorage();\n  }\n\n  return {\n    mode: options.mode,\n    rpId: options.rpId,\n    createPasskey: (input) =>\n      createPasskeyCeremony({\n        rpId: options.rpId,\n        rpName,\n        userName: input?.userName ?? 'user',\n        deployer,\n        webauthn,\n        storage,\n      }),\n    connect: () =>\n      connectCeremony({\n        rpId: options.rpId,\n        indexer,\n        webauthn,\n        storage,\n        silentMediationSupported: false,\n      }),\n    recover: () => recoverCeremony({ rpId: options.rpId, indexer, webauthn }),\n    signAuthEntry: (entryXdr) => signAuthEntryFn(entryXdr, { networkPassphrase, sign: signer }),\n  };\n}\n","import { Address, xdr } from '@stellar/stellar-sdk';\n\n/**\n * A ready-to-sign `SorobanAuthorizationEntry` (base64 XDR) for a demo call on\n * `contractId`. A convenience for smoke tests and examples, so you do not hand-\n * build auth-entry XDR just to have something to sign. The nonce and expiration\n * are fixed placeholders, so this is for local verification, not production.\n */\nexport function sampleAuthEntry(contractId: string, functionName = 'protected'): string {\n  const address = new Address(contractId).toScAddress();\n  const entry = new xdr.SorobanAuthorizationEntry({\n    credentials: xdr.SorobanCredentials.sorobanCredentialsAddress(\n      new xdr.SorobanAddressCredentials({\n        address,\n        nonce: new xdr.Int64(1),\n        signatureExpirationLedger: 1000,\n        signature: xdr.ScVal.scvVoid(),\n      }),\n    ),\n    rootInvocation: new xdr.SorobanAuthorizedInvocation({\n      function: xdr.SorobanAuthorizedFunction.sorobanAuthorizedFunctionTypeContractFn(\n        new xdr.InvokeContractArgs({ contractAddress: address, functionName, args: [] }),\n      ),\n      subInvocations: [],\n    }),\n  });\n  return entry.toXDR('base64');\n}\n"]}

package/dist/{types-lW2h8Uxn.d.ts → types-C3VIw5Iu.d.ts}

@@ -1,6 +1,6 @@
 import './checkAuth-C2AcXqFe.js';
 import './types--WNl-Sda.js';
-import './sign-Cfg0NM0T.js';
+import './sign-B4JV2Inn.js';
 
 /**
  * The frozen taxonomy of error codes the SDK can throw. This union is

package/dist/{types-dMRWEEo0.d.cts → types-DLcXrud8.d.cts}

@@ -1,6 +1,6 @@
 import './checkAuth-C2AcXqFe.cjs';
 import './types--WNl-Sda.cjs';
-import './sign-Cfg0NM0T.cjs';
+import './sign-B4JV2Inn.cjs';
 
 /**
  * The frozen taxonomy of error codes the SDK can throw. This union is

package/dist/types.d.cts

@@ -1,5 +1,5 @@
-export { B as BATTLE_TESTED_ANCHORS, a as BattleTestedAnchor, K as KIT_ERROR_CODES, b as KitError, c as KitErrorCode, P as PasskeyCredential, i as isKitError } from './types-dMRWEEo0.cjs';
+export { B as BATTLE_TESTED_ANCHORS, a as BattleTestedAnchor, K as KIT_ERROR_CODES, b as KitError, c as KitErrorCode, P as PasskeyCredential, i as isKitError } from './types-DLcXrud8.cjs';
 export { A as AuthenticatorDataFlags, C as CheckAuthResult, a as ClientData, P as ParsedAuthenticatorData, V as VerifyAssertionInput } from './checkAuth-C2AcXqFe.cjs';
 export { A as AccountDeployer, B as BuildCreateOptionsInput, C as CredentialStorage, I as IndexerAdapter, P as PubKeyCredParam, a as PublicKeyCredentialCreationOptionsJSON, R as ResidentKeyRequirement, b as ResolvedAccount, S as SubmissionAdapter, c as SubmitResult, U as UserVerificationRequirement, W as WebAuthnClient, d as WebAuthnCreateResult, e as WebAuthnGetOptions, f as WebAuthnGetResult } from './types--WNl-Sda.cjs';
-export { A as AssertionResult, a as SorobanSignOptions, b as WebAuthnSigner } from './sign-Cfg0NM0T.cjs';
+export { A as AssertionResult, a as SorobanSignOptions, b as WebAuthnSigner } from './sign-B4JV2Inn.cjs';
 import '@stellar/stellar-sdk';

package/dist/types.d.ts

@@ -1,5 +1,5 @@
-export { B as BATTLE_TESTED_ANCHORS, a as BattleTestedAnchor, K as KIT_ERROR_CODES, b as KitError, c as KitErrorCode, P as PasskeyCredential, i as isKitError } from './types-lW2h8Uxn.js';
+export { B as BATTLE_TESTED_ANCHORS, a as BattleTestedAnchor, K as KIT_ERROR_CODES, b as KitError, c as KitErrorCode, P as PasskeyCredential, i as isKitError } from './types-C3VIw5Iu.js';
 export { A as AuthenticatorDataFlags, C as CheckAuthResult, a as ClientData, P as ParsedAuthenticatorData, V as VerifyAssertionInput } from './checkAuth-C2AcXqFe.js';
 export { A as AccountDeployer, B as BuildCreateOptionsInput, C as CredentialStorage, I as IndexerAdapter, P as PubKeyCredParam, a as PublicKeyCredentialCreationOptionsJSON, R as ResidentKeyRequirement, b as ResolvedAccount, S as SubmissionAdapter, c as SubmitResult, U as UserVerificationRequirement, W as WebAuthnClient, d as WebAuthnCreateResult, e as WebAuthnGetOptions, f as WebAuthnGetResult } from './types--WNl-Sda.js';
-export { A as AssertionResult, a as SorobanSignOptions, b as WebAuthnSigner } from './sign-Cfg0NM0T.js';
+export { A as AssertionResult, a as SorobanSignOptions, b as WebAuthnSigner } from './sign-B4JV2Inn.js';
 import '@stellar/stellar-sdk';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soropass/core",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Minimal, headless, ES256-only passkey SDK for Stellar smart accounts.",
   "license": "Apache-2.0",
   "publishConfig": {

package/dist/chunk-BIRF5I6I.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/webauthn/signature.ts","../src/webauthn/payload.ts","../src/webauthn/verify.ts","../src/soroban/preimage.ts","../src/soroban/assemble.ts","../src/soroban/smartWallet.ts","../src/soroban/sign.ts"],"names":["p256","xdr"],"mappings":";;;;;;AAIA,IAAM,cAAA,GAAiB,EAAA;AAUhB,SAAS,aAAa,GAAA,EAA6B;AACxD,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC/B,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,uBAAA;AAAA,MACA,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,oBAAA,EAAuB,cAAc,CAAA;AAAA,KACrE;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,EAAE,iBAAA,EAAkB;AAAA,EACvD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,uBAAA,EAAyB,+BAAA,EAAiC,EAAE,OAAO,CAAA;AAAA,EACxF;AACF;AAEA,SAAS,oBAAoB,gBAAA,EAAoC;AAC/D,EAAA,IAAI,gBAAA,CAAiB,WAAW,EAAA,EAAI;AAClC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,uBAAA;AAAA,MACA,CAAA,wCAAA,EAA2C,iBAAiB,MAAM,CAAA;AAAA,KACpE;AAAA,EACF;AACF;AAGO,SAAS,OAAO,gBAAA,EAAuC;AAC5D,EAAA,mBAAA,CAAoB,gBAAgB,CAAA;AACpC,EAAA,OAAO,CAAC,IAAA,CAAK,SAAA,CAAU,WAAA,CAAY,gBAAgB,EAAE,QAAA,EAAS;AAChE;AASO,SAAS,cAAc,gBAAA,EAA0C;AACtE,EAAA,mBAAA,CAAoB,gBAAgB,CAAA;AACpC,EAAA,OAAO,KAAK,SAAA,CAAU,WAAA,CAAY,gBAAgB,CAAA,CAAE,UAAA,GAAa,iBAAA,EAAkB;AACrF;AAGO,SAAS,iBAAiB,GAAA,EAA6B;AAC5D,EAAA,OAAO,aAAA,CAAc,YAAA,CAAa,GAAG,CAAC,CAAA;AACxC;;;ACjDO,SAAS,yBAAyB,KAAA,EAG1B;AACb,EAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,KAAA,CAAM,cAAc,CAAA;AAClD,EAAA,OAAO,MAAA,CAAO,WAAA,CAAY,KAAA,CAAM,iBAAA,EAAmB,cAAc,CAAC,CAAA;AACpE;ACIO,SAAS,yBAAyB,KAAA,EAAsC;AAC7E,EAAA,MAAM,OAAA,GAAU,yBAAyB,KAAK,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,MAAA,KAAW,KAAK,KAAA,CAAM,SAAA,GAAY,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA;AAG9F,EAAA,OAAOA,IAAAA,CAAK,MAAA,CAAO,OAAA,EAAS,OAAA,EAAS,KAAA,CAAM,SAAA,EAAW,EAAE,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,CAAA;AAC1F;ACdO,SAAS,uBAAA,CACd,OACA,iBAAA,EACY;AACZ,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,EAAY;AACtC,EAAA,IAAI,WAAA,CAAY,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AAC7D,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,MAAM,OAAA,GAAU,YAAY,OAAA,EAAQ;AACpC,EAAA,MAAM,QAAA,GAAW,IAAI,cAAA,CAAe,gCAAA;AAAA,IAClC,IAAI,IAAI,kCAAA,CAAmC;AAAA,MACzC,SAAA,EAAW,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,KAAK,WAAA,CAAY,iBAAiB,CAAC,CAAC,CAAC,CAAA;AAAA,MACxE,KAAA,EAAO,QAAQ,KAAA,EAAM;AAAA,MACrB,yBAAA,EAA2B,QAAQ,yBAAA,EAA0B;AAAA,MAC7D,UAAA,EAAY,MAAM,cAAA;AAAe,KAClC;AAAA,GACH;AACA,EAAA,OAAO,IAAI,UAAA,CAAW,IAAA,CAAK,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC9C;AAGO,SAAS,kBAAA,CACd,OACA,iBAAA,EACQ;AACR,EAAA,OAAO,gBAAA,CAAiB,uBAAA,CAAwB,KAAA,EAAO,iBAAiB,CAAC,CAAA;AAC3E;ACtBO,SAAS,qBAAA,CACd,OACA,SAAA,EAC+B;AAC/B,EAAA,KAAA,CAAM,aAAY,CAAE,OAAA,GAAU,SAAA,CAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,oBAAoB,SAAA,EAAuC;AACzE,EAAA,OAAOC,GAAAA,CAAI,MAAM,MAAA,CAAO;AAAA,IACtB,UAAA,CAAW,oBAAA,EAAsB,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC5D,UAAA,CAAW,kBAAA,EAAoB,SAAA,CAAU,cAAc,CAAA;AAAA,IACvD,UAAA,CAAW,WAAA,EAAa,SAAA,CAAU,SAAS;AAAA,GAC5C,CAAA;AACH;AAEA,SAAS,UAAA,CAAW,MAAc,KAAA,EAAmC;AACnE,EAAA,OAAO,IAAIA,IAAI,UAAA,CAAW;AAAA,IACxB,GAAA,EAAKA,GAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,CAAA;AAAA,IAC7B,KAAKA,GAAAA,CAAI,KAAA,CAAM,SAAS,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC;AAAA,GAC3C,CAAA;AACH;ACdO,SAAS,oBAAoB,YAAA,EAAqC;AACvE,EAAA,OAAOA,GAAAA,CAAI,MAAM,MAAA,CAAO;AAAA,IACtBA,GAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,WAAW,CAAA;AAAA,IAC/BA,IAAI,KAAA,CAAM,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,YAAY,CAAC;AAAA,GAC7C,CAAA;AACH;AAGO,SAAS,iCAAiC,SAAA,EAAuC;AACtF,EAAA,OAAOA,GAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,CAACA,GAAAA,CAAI,KAAA,CAAM,SAAA,CAAU,WAAW,CAAA,EAAG,mBAAA,CAAoB,SAAS,CAAC,CAAC,CAAA;AAC5F;AAEA,SAAS,mBAAmB,GAAA,EAA0D;AACpF,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,EAAI;AACpB,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,MAAA,GAAS,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,4CAA4C,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,UAAU,GAAA,CAAI,CAAC,CAAA,CAAG,GAAA,GAAM,QAAA,EAAS;AACvC,EAAA,MAAM,EAAA,GAAK,IAAI,CAAC,CAAA;AAGhB,EAAA,MAAM,UACJ,EAAA,CAAG,MAAA,EAAO,CAAE,IAAA,KAAS,aAAa,IAAI,UAAA,CAAW,EAAA,CAAG,KAAA,EAAO,CAAA,GAAI,IAAI,UAAA,CAAW,EAAA,CAAG,OAAO,CAAA;AAC1F,EAAA,OAAO,EAAE,SAAS,OAAA,EAAQ;AAC5B;AAEA,SAAS,YAAA,CAAa,GAAe,CAAA,EAAuB;AAC1D,EAAA,MAAM,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,MAAA,EAAQ,EAAE,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,CAAA,CAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA,GAAK,CAAA,CAAE,CAAC,IAAK,EAAA,GAAK,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,CAAA,CAAE,SAAS,CAAA,CAAE,MAAA;AACtB;AAgBO,SAAS,qBAAA,CAAsB,GAAc,CAAA,EAAsB;AACxE,EAAA,MAAM,EAAA,GAAK,mBAAmB,CAAC,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,mBAAmB,CAAC,CAAA;AAC/B,EAAA,IAAI,EAAA,CAAG,YAAY,EAAA,CAAG,OAAA,SAAgB,EAAA,CAAG,OAAA,GAAU,EAAA,CAAG,OAAA,GAAU,EAAA,GAAK,CAAA;AACrE,EAAA,OAAO,YAAA,CAAa,EAAA,CAAG,OAAA,EAAS,EAAA,CAAG,OAAO,CAAA;AAC5C;AAaO,SAAS,gCAAA,CACd,OACA,SAAA,EAC+B;AAC/B,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,EAAY;AACtC,EAAA,IAAI,WAAA,CAAY,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AAC7D,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,SAAA,CAAU,YAAY,CAAA;AACtD,EAAA,MAAM,QAAA,GAAW,IAAIA,GAAAA,CAAI,UAAA,CAAW,EAAE,KAAK,GAAA,EAAK,gCAAA,CAAiC,SAAS,CAAA,EAAG,CAAA;AAE7F,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,OAAA,EAAQ,CAAE,SAAA,EAAU;AAChD,EAAA,IAAI,UAAA;AACJ,EAAA,QAAQ,OAAA,CAAQ,MAAA,EAAO,CAAE,IAAA;AAAM,IAC7B,KAAK,SAAA;AACH,MAAA,UAAA,GAAa,CAAC,QAAQ,CAAA;AACtB,MAAA;AAAA,IACF,KAAK,QAAA,EAAU;AAEb,MAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,EAAI,GAAI,CAAC,CAAA,EAAG,GAAA,MAAS,EAAC;AAC/C,MAAA,UAAA,GAAa,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAM,qBAAA,CAAsB,EAAE,GAAA,EAAI,EAAG,GAAG,CAAA,KAAM,CAAC,CAAA;AAC7E,MAAA,UAAA,CAAW,KAAK,QAAQ,CAAA;AACxB,MAAA;AAAA,IACF;AAAA,IACA;AACE,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA;AAEJ,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,qBAAA,CAAsB,CAAA,CAAE,GAAA,EAAI,EAAG,CAAA,CAAE,GAAA,EAAK,CAAC,CAAA;AACjE,EAAA,WAAA,CAAY,OAAA,EAAQ,CAAE,SAAA,CAAUA,GAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,CAACA,GAAAA,CAAI,KAAA,CAAM,MAAA,CAAO,UAAU,CAAC,CAAC,CAAC,CAAA;AAChF,EAAA,OAAO,KAAA;AACT;AC/CA,SAAS,kBAAA,CACP,SAAA,EACA,SAAA,EACA,MAAA,EACM;AAEN,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,MAAA,CAAO,WAAW,MAAA,EAAW;AAC/B,IAAA,UAAA,GAAa,oBAAA,CAAqB,UAAU,cAAA,EAAgB;AAAA,MAC1D,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf;AAAA,KACD,CAAA;AAAA,EACH,CAAA,MAAO;AACL,IAAA,UAAA,GAAa,mBAAA,CAAoB,UAAU,cAAc,CAAA;AACzD,IAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA,CAAA,qBAAA,EAAwB,WAAW,IAAI,CAAA,uBAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,IAAI,UAAA,CAAW,cAAc,SAAA,EAAW;AACtC,MAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,mDAAmD,CAAA;AAAA,IAC9F;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,WAAA,KAAgB,IAAA,IAAQ,CAAC,OAAO,gBAAA,EAAkB;AAC/D,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,iBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,SAAA,CAAU,iBAAiB,CAAA;AACjE,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,EAAA,EAAI;AACpB,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,uBAAA,IAA2B,CAAC,MAAA,CAAO,MAAM,EAAA,EAAI;AACtD,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAW;AAC7B,IAAA,cAAA,CAAe,SAAA,CAAU,iBAAA,EAAmB,MAAA,CAAO,IAAI,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,MAAA,CAAO,cAAc,MAAA,EAAW;AAClC,IAAA,MAAM,KAAK,wBAAA,CAAyB;AAAA,MAClC,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,mBAAmB,SAAA,CAAU,iBAAA;AAAA,MAC7B,gBAAgB,SAAA,CAAU,cAAA;AAAA,MAC1B,WAAW,SAAA,CAAU;AAAA,KACtB,CAAA;AACD,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gBAAA,CACb,OACA,OAAA,EACe;AAGf,EAAA,IAAI,OAAA,CAAQ,8BAA8B,MAAA,EAAW;AACnD,IAAA,MAAM,KAAA,GAAQ,MAAM,WAAA,EAAY;AAChC,IAAA,IAAI,KAAA,CAAM,MAAA,EAAO,CAAE,IAAA,KAAS,2BAAA,EAA6B;AACvD,MAAA,KAAA,CAAM,OAAA,EAAQ,CAAE,yBAAA,CAA0B,OAAA,CAAQ,yBAAyB,CAAA;AAAA,IAC7E;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAY,kBAAA,CAAmB,KAAA,EAAO,OAAA,CAAQ,iBAAiB,CAAA;AACrE,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAC9C,EAAA,IAAI,QAAQ,MAAA,EAAQ,kBAAA,CAAmB,SAAA,EAAW,SAAA,EAAW,QAAQ,MAAM,CAAA;AAC3E,EAAA,MAAM,SAAA,GACJ,UAAU,SAAA,CAAU,MAAA,KAAW,KAAK,SAAA,CAAU,SAAA,GAAY,gBAAA,CAAiB,SAAA,CAAU,SAAS,CAAA;AAChG,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,cAAc,SAAA,CAAU,YAAA;AAAA,IACxB,mBAAmB,SAAA,CAAU,iBAAA;AAAA,IAC7B,gBAAgB,SAAA,CAAU,cAAA;AAAA,IAC1B;AAAA,GACF;AACA,EAAA,IAAI,OAAA,CAAQ,WAAW,cAAA,EAAgB;AACrC,IAAA,gCAAA,CAAiC,OAAO,UAAU,CAAA;AAAA,EACpD,CAAA,MAAO;AACL,IAAA,qBAAA,CAAsB,OAAO,UAAU,CAAA;AAAA,EACzC;AACF;AAOA,eAAsB,aAAA,CACpB,UACA,OAAA,EACiB;AACjB,EAAA,MAAM,KAAA,GAAQA,GAAAA,CAAI,yBAAA,CAA0B,OAAA,CAAQ,UAAU,QAAQ,CAAA;AACtE,EAAA,MAAM,gBAAA,CAAiB,OAAO,OAAO,CAAA;AACrC,EAAA,OAAO,KAAA,CAAM,MAAM,QAAQ,CAAA;AAC7B;AAQA,SAAS,qBAAqB,QAAA,EAAoD;AAChF,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,EAAO,CAAE,IAAA;AAC/B,EAAA,IAAI,IAAA,KAAS,kBAAkB,OAAO,QAAA,CAAS,IAAG,CAAE,EAAA,GAAK,UAAA,EAAW;AACpE,EAAA,IAAI,SAAS,uBAAA,EAAyB;AACpC,IAAA,MAAM,QAAQ,QAAA,CAAS,OAAA,EAAQ,CAAE,EAAA,GAAK,OAAA,EAAQ;AAC9C,IAAA,IAAI,KAAA,CAAM,MAAA,EAAO,CAAE,IAAA,KAAS,gBAAA,EAAkB;AAC5C,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,KAAA,CAAM,EAAA,EAAG,CAAE,EAAA,GAAK,UAAA,EAAW;AAAA,EACpC;AACA,EAAA,MAAM,IAAI,QAAA;AAAA,IACR,sBAAA;AAAA,IACA,+CAA+C,IAAI,CAAA,2BAAA;AAAA,GACrD;AACF;AAOA,eAAsB,eAAA,CAAgB,OAAe,OAAA,EAA8C;AACjG,EAAA,MAAM,QAAA,GAAWA,GAAAA,CAAI,mBAAA,CAAoB,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAChE,EAAA,KAAA,MAAW,EAAA,IAAM,oBAAA,CAAqB,QAAQ,CAAA,EAAG;AAC/C,IAAA,IAAI,GAAG,IAAA,EAAK,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAA,EAAsB;AACtD,IAAA,MAAM,UAAU,EAAA,CAAG,IAAA,EAAK,CAAE,oBAAA,GAAuB,IAAA,EAAK;AACtD,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,IAAI,MAAM,WAAA,EAAY,CAAE,MAAA,EAAO,CAAE,SAAS,2BAAA,EAA6B;AACvE,MAAA,MAAM,gBAAA,CAAiB,OAAO,OAAO,CAAA;AAAA,IACvC;AAAA,EACF;AACA,EAAA,OAAO,QAAA,CAAS,MAAM,QAAQ,CAAA;AAChC","file":"chunk-BIRF5I6I.js","sourcesContent":["import { p256 } from '@noble/curves/nist';\nimport { KitError } from '../errors';\n\n/** Maximum DER length of a P-256 ECDSA signature: SEQ + two 33-byte INTEGERs. */\nconst MAX_DER_LENGTH = 72;\n\n/**\n * Convert an ASN.1 DER ECDSA signature to the 64-byte raw `R‖S` form Soroban's\n * `secp256r1_verify` expects, using noble's audited DER parser (R and S are\n * left-padded to 32 bytes big-endian). Rejects malformed or over-long input.\n *\n * Note: this does NOT enforce low-S — that normalization is added in S04\n * (YK-430). The output here mirrors the signature exactly as parsed.\n */\nexport function derToCompact(der: Uint8Array): Uint8Array {\n  if (der.length > MAX_DER_LENGTH) {\n    throw new KitError(\n      'INVALID_SIGNATURE_DER',\n      `DER signature is ${der.length} bytes, exceeds max ${MAX_DER_LENGTH}`,\n    );\n  }\n  try {\n    return p256.Signature.fromDER(der).toCompactRawBytes();\n  } catch (cause) {\n    throw new KitError('INVALID_SIGNATURE_DER', 'failed to parse DER signature', { cause });\n  }\n}\n\nfunction assertCompactLength(compactSignature: Uint8Array): void {\n  if (compactSignature.length !== 64) {\n    throw new KitError(\n      'INVALID_SIGNATURE_DER',\n      `compact signature must be 64 bytes, got ${compactSignature.length}`,\n    );\n  }\n}\n\n/** True if a 64-byte compact signature is in canonical low-S form (S ≤ n/2). */\nexport function isLowS(compactSignature: Uint8Array): boolean {\n  assertCompactLength(compactSignature);\n  return !p256.Signature.fromCompact(compactSignature).hasHighS();\n}\n\n/**\n * Normalize a 64-byte compact signature to canonical low-S: if S > n/2, replace\n * S with n − S (anchor LOW_S_NORMALIZATION, invariant #2). ~50% of Apple Touch\n * ID / Face ID assertions are high-S and Soroban's `secp256r1_verify` does not\n * enforce low-S, so the SDK MUST emit low-S before a signature reaches a\n * contract. Idempotent: low-S input is returned unchanged.\n */\nexport function normalizeLowS(compactSignature: Uint8Array): Uint8Array {\n  assertCompactLength(compactSignature);\n  return p256.Signature.fromCompact(compactSignature).normalizeS().toCompactRawBytes();\n}\n\n/** DER → 64-byte canonical low-S compact — the conversion the signing ceremony uses. */\nexport function derToCompactLowS(der: Uint8Array): Uint8Array {\n  return normalizeLowS(derToCompact(der));\n}\n","import { sha256 } from '../internal/sha256';\nimport { concatBytes } from '../internal/bytes';\n\n/**\n * Reconstruct the 32-byte payload the authenticator signed and that Soroban's\n * `__check_auth` re-derives on-chain:\n *\n *   SHA256( authenticatorData ‖ SHA256(clientDataJSON) )\n */\nexport function reconstructSignedPayload(input: {\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n}): Uint8Array {\n  const clientDataHash = sha256(input.clientDataJSON);\n  return sha256(concatBytes(input.authenticatorData, clientDataHash));\n}\n","import { p256 } from '@noble/curves/nist';\nimport { reconstructSignedPayload } from './payload';\nimport { derToCompact } from './signature';\n\nexport interface VerifyAssertionInput {\n  /** SEC-1 uncompressed public key (65 bytes, `0x04 ‖ X ‖ Y`). */\n  publicKey: Uint8Array;\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n  /** DER-encoded (≤72 B) or already-compact (64 B) signature. */\n  signature: Uint8Array;\n}\n\n/**\n * Verify a WebAuthn assertion the way the on-chain `secp256r1_verify` does:\n * reconstruct `SHA256(authData ‖ SHA256(cdj))` and check ECDSA. `lowS: false`\n * mirrors the host function, which does NOT enforce low-S (we normalize\n * separately before submitting — see S04/YK-430).\n */\nexport function verifyAssertionSignature(input: VerifyAssertionInput): boolean {\n  const payload = reconstructSignedPayload(input);\n  const compact = input.signature.length === 64 ? input.signature : derToCompact(input.signature);\n  // `format: 'compact'` pins the 64-byte interpretation — without it noble tries\n  // DER-first and could misread a compact signature that happens to start 0x30.\n  return p256.verify(compact, payload, input.publicKey, { lowS: false, format: 'compact' });\n}\n","import { xdr, hash } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { bytesToBase64Url, utf8ToBytes } from '../internal/encoding';\n\n/**\n * Compute the auth-entry preimage hash that `__check_auth` reconstructs and that\n * becomes the WebAuthn `challenge`:\n *   SHA256( XDR( HashIdPreimage::SorobanAuthorization{ networkId, nonce,\n *   signatureExpirationLedger, invocation } ) )\n * where networkId = SHA256(networkPassphrase).\n */\nexport function authEntryChallengeBytes(\n  entry: xdr.SorobanAuthorizationEntry,\n  networkPassphrase: string,\n): Uint8Array {\n  const credentials = entry.credentials();\n  if (credentials.switch().name !== 'sorobanCredentialsAddress') {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'auth entry has no address credentials to sign');\n  }\n  const address = credentials.address();\n  const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(\n    new xdr.HashIdPreimageSorobanAuthorization({\n      networkId: Buffer.from(hash(Buffer.from(utf8ToBytes(networkPassphrase)))),\n      nonce: address.nonce(),\n      signatureExpirationLedger: address.signatureExpirationLedger(),\n      invocation: entry.rootInvocation(),\n    }),\n  );\n  return new Uint8Array(hash(preimage.toXDR()));\n}\n\n/** The base64url challenge string the authenticator signs (43 chars). */\nexport function authEntryChallenge(\n  entry: xdr.SorobanAuthorizationEntry,\n  networkPassphrase: string,\n): string {\n  return bytesToBase64Url(authEntryChallengeBytes(entry, networkPassphrase));\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport type { AssertionResult } from './sign';\n\n/**\n * Set an address-credential auth entry's signature to the `Secp256r1Signature`\n * struct the on-chain `__check_auth` consumes:\n *\n *   ScVal::Map { authenticator_data: Bytes, client_data_json: Bytes, signature: BytesN<64> }\n *\n * Map keys are alphabetical, so the ScMap is canonically sorted as Soroban\n * requires. `signature` MUST already be 64-byte low-S compact (`signAuthEntry`\n * normalizes before calling this). This is the exact shape the audited\n * webauthn-verifier reference expects — proven on testnet by the on-chain\n * integration test (scripts/onchain-e2e.ts).\n */\nexport function applyAssertionToEntry(\n  entry: xdr.SorobanAuthorizationEntry,\n  assertion: AssertionResult,\n): xdr.SorobanAuthorizationEntry {\n  entry.credentials().address().signature(buildSignatureScVal(assertion));\n  return entry;\n}\n\n/** The `Secp256r1Signature` ScVal — a contracttype struct → sorted ScMap. */\nexport function buildSignatureScVal(assertion: AssertionResult): xdr.ScVal {\n  return xdr.ScVal.scvMap([\n    bytesField('authenticator_data', assertion.authenticatorData),\n    bytesField('client_data_json', assertion.clientDataJSON),\n    bytesField('signature', assertion.signature),\n  ]);\n}\n\nfunction bytesField(name: string, bytes: Uint8Array): xdr.ScMapEntry {\n  return new xdr.ScMapEntry({\n    key: xdr.ScVal.scvSymbol(name),\n    val: xdr.ScVal.scvBytes(Buffer.from(bytes)),\n  });\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { buildSignatureScVal } from './assemble';\nimport type { AssertionResult } from './sign';\n\n/**\n * The passkey-kit / `webauthn-wallet` smart-wallet ABI target.\n *\n * Our own single-signer account declares `type Signature = Secp256r1Signature`\n * and consumes the bare struct (see `assemble.ts`). passkey-kit's smart-wallet\n * declares `type Signature = Signatures`, so authorizing it needs the assertion\n * wrapped as `Signatures(Map<SignerKey, Signature>)`. The exact shape, the raw-\n * credential-id key, and the canonical map ordering below are confirmed by\n * kalepail (passkey-kit author) in issue #32 against v1 / v0.13.0 (Protocol 27,\n * independently audited); the wire shape is unchanged from v0.12.\n */\n\n/**\n * `SignerKey::Secp256r1(Bytes)` → `scvVec([Symbol(\"Secp256r1\"), Bytes(rawId)])`.\n * The key is the RAW WebAuthn credential-id bytes (base64url-decoded `rawId`):\n * never hashed, never the UTF-8 of the base64url string, and never the public\n * key — the SEC-1 public key lives in `SignerVal` on-chain, not in the key.\n */\nexport function buildSignerKeyScVal(credentialId: Uint8Array): xdr.ScVal {\n  return xdr.ScVal.scvVec([\n    xdr.ScVal.scvSymbol('Secp256r1'),\n    xdr.ScVal.scvBytes(Buffer.from(credentialId)),\n  ]);\n}\n\n/** `Signature::Secp256r1(Secp256r1Signature)` → `scvVec([Symbol(\"Secp256r1\"), <bare struct map>])`. */\nexport function buildSmartWalletSignatureVariant(assertion: AssertionResult): xdr.ScVal {\n  return xdr.ScVal.scvVec([xdr.ScVal.scvSymbol('Secp256r1'), buildSignatureScVal(assertion)]);\n}\n\nfunction decomposeSignerKey(key: xdr.ScVal): { variant: string; payload: Uint8Array } {\n  const vec = key.vec();\n  if (!vec || vec.length < 2) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'malformed SignerKey (expected an enum vec)');\n  }\n  const variant = vec[0]!.sym().toString();\n  const el = vec[1]!;\n  // Secp256r1(Bytes) and Ed25519(BytesN<32>) are scvBytes; Policy(Address) falls\n  // back to its XDR bytes (rare in a passkey SDK — see the ordering note below).\n  const payload =\n    el.switch().name === 'scvBytes' ? new Uint8Array(el.bytes()) : new Uint8Array(el.toXDR());\n  return { variant, payload };\n}\n\nfunction compareBytes(a: Uint8Array, b: Uint8Array): number {\n  const n = Math.min(a.length, b.length);\n  for (let i = 0; i < n; i++) {\n    if (a[i] !== b[i]) return a[i]! < b[i]! ? -1 : 1;\n  }\n  return a.length - b.length;\n}\n\n/**\n * Canonical Soroban-host ordering for `SignerKey` map keys. The host requires\n * `Map<SignerKey, _>` entries sorted by ScVal `Ord` — an **element-wise byte\n * comparison**, NOT a length-major XDR-hex / `localeCompare` string sort. This is\n * the one correctness landmine kalepail flagged in #32: passkey-kit v1 replaced\n * its old string sort with exactly this because the old approach could mis-order\n * same-variant keys of differing length, producing a map the host rejects.\n *\n * We compare the enum variant symbol first, then the payload bytes element-wise,\n * so homogeneous `Secp256r1` keys (the multi-passkey case) sort purely by their\n * raw credential-id bytes. (Ordering across mixed variant types relies on the\n * variant names being capitalized single words, which matches the host's symbol\n * order; a Policy/Address-keyed multi-sig is out of scope for this passkey SDK.)\n */\nexport function compareSignerKeyScVal(a: xdr.ScVal, b: xdr.ScVal): number {\n  const ka = decomposeSignerKey(a);\n  const kb = decomposeSignerKey(b);\n  if (ka.variant !== kb.variant) return ka.variant < kb.variant ? -1 : 1;\n  return compareBytes(ka.payload, kb.payload);\n}\n\n/**\n * Assemble/merge a passkey assertion into an address-credential auth entry as the\n * smart-wallet `Signatures(Map<SignerKey, Signature>)` wire shape\n * (`ScVal::Vec([ScVal::Map(...)])`). `assertion.signature` MUST already be 64-byte\n * low-S compact (`signAuthEntry` normalizes first). Existing map entries — a\n * partially-signed multi-sig entry — are preserved; an entry for the same signer\n * key is replaced; then the whole map is canonically sorted.\n *\n * Use this for the passkey-kit / webauthn-wallet ABI. For our own single-signer\n * account (`type Signature = Secp256r1Signature`) use `applyAssertionToEntry`.\n */\nexport function applyAssertionToSmartWalletEntry(\n  entry: xdr.SorobanAuthorizationEntry,\n  assertion: AssertionResult,\n): xdr.SorobanAuthorizationEntry {\n  const credentials = entry.credentials();\n  if (credentials.switch().name !== 'sorobanCredentialsAddress') {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'auth entry has no address credentials to sign');\n  }\n  const key = buildSignerKeyScVal(assertion.credentialId);\n  const newEntry = new xdr.ScMapEntry({ key, val: buildSmartWalletSignatureVariant(assertion) });\n\n  const current = credentials.address().signature();\n  let mapEntries: xdr.ScMapEntry[];\n  switch (current.switch().name) {\n    case 'scvVoid':\n      mapEntries = [newEntry];\n      break;\n    case 'scvVec': {\n      // Preserve any existing signatures (partial multi-sig); replace same key.\n      const existing = current.vec()?.[0]?.map() ?? [];\n      mapEntries = existing.filter((e) => compareSignerKeyScVal(e.key(), key) !== 0);\n      mapEntries.push(newEntry);\n      break;\n    }\n    default:\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'unexpected existing signature shape for a smart-wallet entry',\n      );\n  }\n  mapEntries.sort((a, b) => compareSignerKeyScVal(a.key(), b.key()));\n  credentials.address().signature(xdr.ScVal.scvVec([xdr.ScVal.scvMap(mapEntries)]));\n  return entry;\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport { KitError } from '../errors';\nimport { derToCompactLowS } from '../webauthn/signature';\nimport { parseClientDataJSON, verifyClientDataJSON, type ClientData } from '../webauthn/clientData';\nimport { parseAuthenticatorData, verifyRpIdHash } from '../webauthn/authData';\nimport { verifyAssertionSignature } from '../webauthn/verify';\nimport { authEntryChallenge } from './preimage';\nimport { applyAssertionToEntry } from './assemble';\nimport { applyAssertionToSmartWalletEntry } from './smartWallet';\n\n/**\n * Which contract ABI the assembled signature targets:\n *  - `single-signer` (default): the bare `Secp256r1Signature` struct our own\n *    webauthn-account consumes (`type Signature = Secp256r1Signature`).\n *  - `smart-wallet`: passkey-kit's `Signatures(Map<SignerKey, Signature>)`\n *    (`type Signature = Signatures`) — see `smartWallet.ts` / kalepail #32.\n * Both reuse the identical low-S, field-packing, and challenge-binding core;\n * only the outer wrapper differs, so the two stay separate ABI targets behind\n * one signing interface.\n */\nexport type WalletTarget = 'single-signer' | 'smart-wallet';\n\n/** The raw WebAuthn assertion a signer returns for a given challenge. */\nexport interface AssertionResult {\n  authenticatorData: Uint8Array;\n  clientDataJSON: Uint8Array;\n  /** DER-encoded (≤72B) or already-compact (64B) ECDSA signature. */\n  signature: Uint8Array;\n  /** base64url credential id → the SignerKey. */\n  credentialId: Uint8Array;\n}\n\n/** Produce a WebAuthn assertion over the base64url `challenge` (e.g. navigator.credentials.get). */\nexport type WebAuthnSigner = (challenge: string) => Promise<AssertionResult> | AssertionResult;\n\n/**\n * Opt-in pre-flight validation of the returned assertion, run BEFORE the entry\n * is assembled and submitted. On-chain `__check_auth` is the real gate, but\n * catching these client-side turns an opaque on-chain failure into a typed\n * `KitError` at the call site. Providing this object always enforces the\n * `webauthn.get` type, the User-Present (UP) flag (required by passkey-kit v1),\n * and challenge-binding; `rpId` / `origin` / `publicKey` add their checks when\n * supplied. Omit the object entirely to skip pre-flight (the default).\n */\nexport interface SignVerifyOptions {\n  /** Verify `authenticatorData.rpIdHash === SHA-256(rpId)`. */\n  rpId?: string;\n  /** Verify `clientDataJSON.origin` is one of these exact origins. */\n  origin?: string | string[];\n  /** SEC-1 (65-byte) public key → verify the ECDSA assertion signature. */\n  publicKey?: Uint8Array;\n  /** Also require the User-Verified (UV) flag (biometric / PIN). Default false. */\n  requireUserVerification?: boolean;\n  /** Allow an assertion made in a cross-origin context (crossOrigin=true). Default false. */\n  allowCrossOrigin?: boolean;\n}\n\nexport interface SorobanSignOptions {\n  networkPassphrase: string;\n  sign: WebAuthnSigner;\n  /** Contract ABI to assemble for. Defaults to `single-signer` (our account). */\n  target?: WalletTarget;\n  /** Opt-in pre-flight assertion validation. Omit to skip. */\n  verify?: SignVerifyOptions;\n  /**\n   * Stamp this `signatureExpirationLedger` onto every address-credential auth\n   * entry BEFORE the challenge is computed, so the signature binds the exact\n   * expiration the contract re-derives in `__check_auth`. Needed for smart-wallet\n   * writes (add/remove signer) where the caller learns the ledger at sign time;\n   * omit when the entry already carries the intended expiration.\n   */\n  signatureExpirationLedger?: number;\n}\n\n/** Validate an assertion against the expected challenge + RP context. Throws KitError. */\nfunction preflightAssertion(\n  assertion: AssertionResult,\n  challenge: string,\n  verify: SignVerifyOptions,\n): void {\n  // Ceremony type + challenge-binding (+ origin when provided).\n  let clientData: ClientData;\n  if (verify.origin !== undefined) {\n    clientData = verifyClientDataJSON(assertion.clientDataJSON, {\n      origin: verify.origin,\n      challenge,\n    });\n  } else {\n    clientData = parseClientDataJSON(assertion.clientDataJSON);\n    if (clientData.type !== 'webauthn.get') {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        `clientDataJSON.type \"${clientData.type}\" is not \"webauthn.get\"`,\n      );\n    }\n    if (clientData.challenge !== challenge) {\n      throw new KitError('CHALLENGE_MISMATCH', 'assertion challenge does not match the auth entry');\n    }\n  }\n  if (clientData.crossOrigin === true && !verify.allowCrossOrigin) {\n    throw new KitError(\n      'ORIGIN_MISMATCH',\n      'assertion was made in a cross-origin context (crossOrigin=true)',\n    );\n  }\n  // User-Present is mandatory (passkey-kit v1 hardening); UV is opt-in.\n  const parsed = parseAuthenticatorData(assertion.authenticatorData);\n  if (!parsed.flags.up) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'assertion is missing the User-Present (UP) flag',\n    );\n  }\n  if (verify.requireUserVerification && !parsed.flags.uv) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'assertion is missing the required User-Verified (UV) flag',\n    );\n  }\n  if (verify.rpId !== undefined) {\n    verifyRpIdHash(assertion.authenticatorData, verify.rpId);\n  }\n  if (verify.publicKey !== undefined) {\n    const ok = verifyAssertionSignature({\n      publicKey: verify.publicKey,\n      authenticatorData: assertion.authenticatorData,\n      clientDataJSON: assertion.clientDataJSON,\n      signature: assertion.signature,\n    });\n    if (!ok) {\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'assertion signature failed pre-flight verification',\n      );\n    }\n  }\n}\n\nasync function signEntryInPlace(\n  entry: xdr.SorobanAuthorizationEntry,\n  options: SorobanSignOptions,\n): Promise<void> {\n  // Stamp the expiration first: the challenge preimage includes\n  // signatureExpirationLedger, so it must be final before we compute it.\n  if (options.signatureExpirationLedger !== undefined) {\n    const creds = entry.credentials();\n    if (creds.switch().name === 'sorobanCredentialsAddress') {\n      creds.address().signatureExpirationLedger(options.signatureExpirationLedger);\n    }\n  }\n  const challenge = authEntryChallenge(entry, options.networkPassphrase);\n  const assertion = await options.sign(challenge);\n  if (options.verify) preflightAssertion(assertion, challenge, options.verify);\n  const signature =\n    assertion.signature.length === 64 ? assertion.signature : derToCompactLowS(assertion.signature);\n  const normalized = {\n    credentialId: assertion.credentialId,\n    authenticatorData: assertion.authenticatorData,\n    clientDataJSON: assertion.clientDataJSON,\n    signature,\n  };\n  if (options.target === 'smart-wallet') {\n    applyAssertionToSmartWalletEntry(entry, normalized);\n  } else {\n    applyAssertionToEntry(entry, normalized);\n  }\n}\n\n/**\n * Sign a single `SorobanAuthorizationEntry` (base64 XDR): compute the challenge,\n * obtain a WebAuthn assertion, low-S-normalize, and assemble the contract\n * signature. Returns the signed entry as base64 XDR.\n */\nexport async function signAuthEntry(\n  entryXdr: string,\n  options: SorobanSignOptions,\n): Promise<string> {\n  const entry = xdr.SorobanAuthorizationEntry.fromXDR(entryXdr, 'base64');\n  await signEntryInPlace(entry, options);\n  return entry.toXDR('base64');\n}\n\n/**\n * The operations whose Soroban auth entries we sign, for a v1 or a fee-bump\n * envelope. (Sign the Soroban auth entries before adding classic tx signatures\n * or fee-bumping; a fee-bump around an already-classic-signed inner tx is the\n * caller's sequencing concern.)\n */\nfunction operationsForSigning(envelope: xdr.TransactionEnvelope): xdr.Operation[] {\n  const kind = envelope.switch().name;\n  if (kind === 'envelopeTypeTx') return envelope.v1().tx().operations();\n  if (kind === 'envelopeTypeTxFeeBump') {\n    const inner = envelope.feeBump().tx().innerTx();\n    if (inner.switch().name !== 'envelopeTypeTx') {\n      throw new KitError(\n        'CONTRACT_AUTH_FAILED',\n        'signTransaction: fee-bump inner transaction is not a v1 transaction',\n      );\n    }\n    return inner.v1().tx().operations();\n  }\n  throw new KitError(\n    'CONTRACT_AUTH_FAILED',\n    `signTransaction: unsupported envelope type \"${kind}\" (expected v1 or fee-bump)`,\n  );\n}\n\n/**\n * Sign every address-credential Soroban auth entry carried by the InvokeHostFunction\n * operations of a transaction (base64 XDR envelope — v1 or fee-bump). Returns the\n * signed envelope XDR.\n */\nexport async function signTransaction(txXdr: string, options: SorobanSignOptions): Promise<string> {\n  const envelope = xdr.TransactionEnvelope.fromXDR(txXdr, 'base64');\n  for (const op of operationsForSigning(envelope)) {\n    if (op.body().switch().name !== 'invokeHostFunction') continue;\n    const entries = op.body().invokeHostFunctionOp().auth();\n    for (const entry of entries) {\n      if (entry.credentials().switch().name !== 'sorobanCredentialsAddress') continue;\n      await signEntryInPlace(entry, options);\n    }\n  }\n  return envelope.toXDR('base64');\n}\n"]}