@soropass/core 0.1.0

package/dist/testing.cjs

@@ -0,0 +1,955 @@
+'use strict';
+
+var nist = require('@noble/curves/nist');
+var sha256 = require('@noble/hashes/sha256');
+var stellarSdk = require('@stellar/stellar-sdk');
+
+// src/errors.ts
+var KitError = class _KitError extends Error {
+  code;
+  name = "KitError";
+  constructor(code, message, options) {
+    super(message ?? code, options);
+    this.code = code;
+    Object.setPrototypeOf(this, _KitError.prototype);
+  }
+};
+var ALG_ES256 = -7;
+function assertES256(alg) {
+  if (alg !== ALG_ES256) {
+    throw new KitError("ES256_NOT_SUPPORTED", `COSE alg ${alg} is not ES256 (-7)`);
+  }
+}
+function assertUserActivation(activation) {
+  const ua = activation ?? globalThis.navigator?.userActivation;
+  if (ua && !ua.isActive) {
+    throw new KitError(
+      "USER_CANCELLED",
+      "WebAuthn ceremony must be invoked inside a user activation (click/tap)"
+    );
+  }
+}
+
+// src/internal/encoding.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const binary = atob(padded);
+  const out = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function utf8ToBytes(text) {
+  return new TextEncoder().encode(text);
+}
+function bytesToUtf8(bytes) {
+  return new TextDecoder().decode(bytes);
+}
+
+// src/webauthn/createOptions.ts
+function buildCreateOptions(input) {
+  const residentKey = input.residentKey ?? "required";
+  return {
+    rp: { id: input.rpId, name: input.rpName },
+    user: {
+      id: bytesToBase64Url(input.userId ?? utf8ToBytes(input.userName)),
+      name: input.userName,
+      displayName: input.userDisplayName ?? input.userName
+    },
+    challenge: bytesToBase64Url(input.challenge),
+    pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+    authenticatorSelection: {
+      residentKey,
+      requireResidentKey: residentKey === "required",
+      userVerification: input.userVerification ?? "preferred"
+    },
+    attestation: "none",
+    timeout: input.timeout ?? 6e4
+  };
+}
+
+// src/internal/bytes.ts
+function concatBytes(...arrays) {
+  const total = arrays.reduce((n, a) => n + a.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const a of arrays) {
+    out.set(a, offset);
+    offset += a.length;
+  }
+  return out;
+}
+function equalBytes(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return diff === 0;
+}
+
+// src/internal/cbor.ts
+function byteAt(bytes, index) {
+  const value = bytes[index];
+  if (value === void 0) throw new Error(`CBOR: unexpected end of input at byte ${index}`);
+  return value;
+}
+var MAX_DEPTH = 16;
+function decodeCbor(bytes, offset = 0, depth = 0) {
+  if (depth > MAX_DEPTH) throw new Error("CBOR: maximum nesting depth exceeded");
+  const first = byteAt(bytes, offset);
+  const major = first >> 5;
+  const info = first & 31;
+  let pos = offset + 1;
+  let argument;
+  if (info < 24) {
+    argument = info;
+  } else if (info === 24) {
+    argument = byteAt(bytes, pos);
+    pos += 1;
+  } else if (info === 25) {
+    argument = byteAt(bytes, pos) << 8 | byteAt(bytes, pos + 1);
+    pos += 2;
+  } else if (info === 26) {
+    argument = byteAt(bytes, pos) * 16777216 + (byteAt(bytes, pos + 1) << 16) + (byteAt(bytes, pos + 2) << 8) + byteAt(bytes, pos + 3);
+    pos += 4;
+  } else {
+    throw new Error(`CBOR: unsupported length encoding (additional info ${info})`);
+  }
+  switch (major) {
+    case 0:
+      return { value: argument, length: pos - offset };
+    case 1:
+      return { value: -1 - argument, length: pos - offset };
+    case 2: {
+      const end = pos + argument;
+      if (end > bytes.length) throw new Error("CBOR: byte string exceeds input");
+      return { value: bytes.slice(pos, end), length: end - offset };
+    }
+    case 3: {
+      const end = pos + argument;
+      if (end > bytes.length) throw new Error("CBOR: text string exceeds input");
+      return { value: new TextDecoder().decode(bytes.slice(pos, end)), length: end - offset };
+    }
+    case 4: {
+      const items = [];
+      let cursor = pos;
+      for (let i = 0; i < argument; i += 1) {
+        const item = decodeCbor(bytes, cursor, depth + 1);
+        items.push(item.value);
+        cursor += item.length;
+      }
+      return { value: items, length: cursor - offset };
+    }
+    case 5: {
+      const map = /* @__PURE__ */ new Map();
+      let cursor = pos;
+      for (let i = 0; i < argument; i += 1) {
+        const key = decodeCbor(bytes, cursor, depth + 1);
+        cursor += key.length;
+        const val = decodeCbor(bytes, cursor, depth + 1);
+        cursor += val.length;
+        if (typeof key.value !== "number" && typeof key.value !== "string") {
+          throw new Error("CBOR: unsupported map key type");
+        }
+        if (map.has(key.value)) {
+          throw new Error("CBOR: duplicate map key (non-canonical)");
+        }
+        map.set(key.value, val.value);
+      }
+      return { value: map, length: cursor - offset };
+    }
+    default:
+      throw new Error(`CBOR: unsupported major type ${major}`);
+  }
+}
+function decodeCborFirst(bytes) {
+  return decodeCbor(bytes, 0).value;
+}
+
+// src/webauthn/authData.ts
+var MIN_LENGTH = 37;
+function parseAuthenticatorData(authData) {
+  if (authData.length < MIN_LENGTH) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      `authenticatorData is ${authData.length} bytes, expected at least ${MIN_LENGTH}`
+    );
+  }
+  const view = new DataView(authData.buffer, authData.byteOffset, authData.byteLength);
+  const rpIdHash = authData.slice(0, 32);
+  const bits = authData[32] ?? 0;
+  const flags = {
+    up: (bits & 1) !== 0,
+    uv: (bits & 4) !== 0,
+    be: (bits & 8) !== 0,
+    bs: (bits & 16) !== 0,
+    at: (bits & 64) !== 0,
+    ed: (bits & 128) !== 0,
+    bits
+  };
+  const signCount = view.getUint32(33, false);
+  const result = { rpIdHash, flags, signCount };
+  if (flags.at) {
+    if (authData.length < 55) {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        "authenticatorData truncated in attested data"
+      );
+    }
+    result.aaguid = authData.slice(37, 53);
+    const credIdLength = view.getUint16(53, false);
+    const credIdEnd = 55 + credIdLength;
+    if (authData.length < credIdEnd) {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        "authenticatorData truncated in credentialId"
+      );
+    }
+    result.credentialId = authData.slice(55, credIdEnd);
+    const rest = authData.slice(credIdEnd);
+    const { length } = decodeCbor(rest, 0);
+    result.credentialPublicKey = rest.slice(0, length);
+  }
+  return result;
+}
+function verifyRpIdHash(authData, rpId) {
+  const actual = parseAuthenticatorData(authData).rpIdHash;
+  const expected = sha256.sha256(utf8ToBytes(rpId));
+  if (!equalBytes(actual, expected)) {
+    throw new KitError(
+      "RP_ID_MISMATCH",
+      `authenticatorData rpIdHash does not match SHA-256("${rpId}")`
+    );
+  }
+}
+
+// src/webauthn/publicKey.ts
+var COSE_KTY = 1;
+var COSE_ALG = 3;
+var COSE_CRV = -1;
+var COSE_X = -2;
+var COSE_Y = -3;
+var KTY_EC2 = 2;
+var CRV_P256 = 1;
+function coseKeyToSec1(coseKey) {
+  let decoded;
+  try {
+    decoded = decodeCborFirst(coseKey);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "failed to CBOR-decode COSE key", { cause });
+  }
+  if (!(decoded instanceof Map)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key is not a CBOR map");
+  }
+  const map = decoded;
+  const alg = map.get(COSE_ALG);
+  if (typeof alg !== "number") {
+    throw new KitError("ES256_NOT_SUPPORTED", `COSE alg ${String(alg)} is not ES256 (-7)`);
+  }
+  assertES256(alg);
+  if (map.get(COSE_KTY) !== KTY_EC2) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      `COSE kty ${String(map.get(COSE_KTY))} is not EC2 (2)`
+    );
+  }
+  if (map.get(COSE_CRV) !== CRV_P256) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      `COSE crv ${String(map.get(COSE_CRV))} is not P-256 (1)`
+    );
+  }
+  const x = map.get(COSE_X);
+  const y = map.get(COSE_Y);
+  if (!(x instanceof Uint8Array) || x.length !== 32) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key X coordinate is not 32 bytes");
+  }
+  if (!(y instanceof Uint8Array) || y.length !== 32) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key Y coordinate is not 32 bytes");
+  }
+  const sec1 = concatBytes(new Uint8Array([4]), x, y);
+  try {
+    nist.p256.Point.fromHex(sec1);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "public key is not a valid P-256 point", { cause });
+  }
+  return sec1;
+}
+function extractPublicKeyFromAuthData(authData) {
+  const parsed = parseAuthenticatorData(authData);
+  if (!parsed.credentialPublicKey) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      "authenticatorData has no attested credential public key"
+    );
+  }
+  return coseKeyToSec1(parsed.credentialPublicKey);
+}
+function extractPublicKeyFromAttestationObject(attestationObject) {
+  let decoded;
+  try {
+    decoded = decodeCborFirst(attestationObject);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "failed to CBOR-decode attestationObject", { cause });
+  }
+  if (!(decoded instanceof Map)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "attestationObject is not a CBOR map");
+  }
+  const authData = decoded.get("authData");
+  if (!(authData instanceof Uint8Array)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "attestationObject has no authData byte string");
+  }
+  return extractPublicKeyFromAuthData(authData);
+}
+
+// src/ceremonies/random.ts
+function randomBytes(length) {
+  const webcrypto = globalThis.crypto;
+  if (typeof webcrypto?.getRandomValues !== "function") {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "no secure random source (globalThis.crypto.getRandomValues) is available in this environment"
+    );
+  }
+  const out = new Uint8Array(new ArrayBuffer(length));
+  webcrypto.getRandomValues(out);
+  return out;
+}
+
+// src/ceremonies/browserClient.ts
+function asKitError(error) {
+  if (error instanceof KitError) return error;
+  const name = typeof error === "object" && error !== null && "name" in error ? error.name : void 0;
+  if (name === "NotAllowedError") {
+    return new KitError("USER_CANCELLED", "The passkey prompt was dismissed.", { cause: error });
+  }
+  const message = error instanceof Error ? error.message : "WebAuthn request failed";
+  const detail = typeof name === "string" ? `${name}: ${message}` : message;
+  return new KitError("UNSUPPORTED_AUTHENTICATOR", detail, { cause: error });
+}
+function browserWebAuthnClient() {
+  const credentials = globalThis.navigator?.credentials;
+  if (!credentials) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "navigator.credentials is unavailable");
+  }
+  return {
+    async create(options) {
+      const publicKey = {
+        challenge: base64UrlToBytes(options.challenge),
+        rp: options.rp,
+        user: {
+          id: base64UrlToBytes(options.user.id),
+          name: options.user.name,
+          displayName: options.user.displayName
+        },
+        pubKeyCredParams: options.pubKeyCredParams,
+        authenticatorSelection: options.authenticatorSelection,
+        attestation: options.attestation,
+        timeout: options.timeout
+      };
+      let credential;
+      try {
+        credential = await credentials.create({ publicKey });
+      } catch (error) {
+        throw asKitError(error);
+      }
+      if (!credential) throw new KitError("USER_CANCELLED", "credential creation returned null");
+      const response = credential.response;
+      return {
+        id: credential.id,
+        rawId: new Uint8Array(credential.rawId),
+        attestationObject: new Uint8Array(response.attestationObject)
+      };
+    },
+    async get(options) {
+      const publicKey = {
+        rpId: options.rpId,
+        challenge: options.challenge ? new Uint8Array(options.challenge) : randomBytes(32),
+        allowCredentials: (options.allowCredentials ?? []).map((id) => ({
+          type: "public-key",
+          id: base64UrlToBytes(id)
+        })),
+        userVerification: options.userVerification
+      };
+      const request = { publicKey };
+      if (options.mediation) request.mediation = options.mediation;
+      let credential;
+      try {
+        credential = await credentials.get(request);
+      } catch (error) {
+        throw asKitError(error);
+      }
+      if (!credential) throw new KitError("USER_CANCELLED", "assertion returned null");
+      const response = credential.response;
+      return {
+        id: credential.id,
+        rawId: new Uint8Array(credential.rawId),
+        authenticatorData: new Uint8Array(response.authenticatorData),
+        clientDataJSON: new Uint8Array(response.clientDataJSON),
+        signature: new Uint8Array(response.signature)
+      };
+    }
+  };
+}
+function defaultCredentialStorage() {
+  const key = (rpId) => `stellar-passkey:${rpId}`;
+  const ls = globalThis.localStorage;
+  if (ls) {
+    return {
+      get: (rpId) => ls.getItem(key(rpId)),
+      set: (rpId, credentialId) => {
+        ls.setItem(key(rpId), credentialId);
+      }
+    };
+  }
+  const memory = /* @__PURE__ */ new Map();
+  return {
+    get: (rpId) => memory.get(rpId) ?? null,
+    set: (rpId, credentialId) => {
+      memory.set(rpId, credentialId);
+    }
+  };
+}
+
+// src/ceremonies/create.ts
+async function registerPasskey(options) {
+  assertUserActivation(options.userActivation);
+  const webauthn = options.webauthn ?? browserWebAuthnClient();
+  const creationOptions = buildCreateOptions({
+    rpId: options.rpId,
+    rpName: options.rpName,
+    userName: options.userName,
+    userId: options.userId,
+    challenge: options.challenge ?? randomBytes(32),
+    residentKey: options.residentKey,
+    userVerification: options.userVerification
+  });
+  const credential = await webauthn.create(creationOptions);
+  const publicKey = extractPublicKeyFromAttestationObject(credential.attestationObject);
+  return { credentialId: credential.id, publicKey };
+}
+async function createPasskey(options) {
+  const storage = options.storage ?? defaultCredentialStorage();
+  const { credentialId, publicKey } = await registerPasskey(options);
+  const { contractId } = await options.deployer.deploy({ publicKey, credentialId });
+  storage.set(options.rpId, credentialId);
+  return { contractId, credentialId, publicKey };
+}
+async function connect(options) {
+  const storage = options.storage ?? defaultCredentialStorage();
+  const credentialId = storage.get(options.rpId);
+  if (!credentialId) return null;
+  const accounts = await options.indexer.resolveByCredential(credentialId);
+  const contractId = accounts[0]?.contractId;
+  return contractId ? { contractId, credentialId } : null;
+}
+
+// src/ceremonies/recover.ts
+async function recover(options) {
+  assertUserActivation(options.userActivation);
+  const webauthn = options.webauthn ?? browserWebAuthnClient();
+  const assertion = await webauthn.get({
+    rpId: options.rpId,
+    allowCredentials: [],
+    challenge: options.challenge ?? randomBytes(32)
+  });
+  const accounts = await options.indexer.resolveByCredential(assertion.id);
+  return accounts.map((account) => ({
+    contractId: account.contractId,
+    credentialId: assertion.id
+  }));
+}
+var MAX_DER_LENGTH = 72;
+function derToCompact(der) {
+  if (der.length > MAX_DER_LENGTH) {
+    throw new KitError(
+      "INVALID_SIGNATURE_DER",
+      `DER signature is ${der.length} bytes, exceeds max ${MAX_DER_LENGTH}`
+    );
+  }
+  try {
+    return nist.p256.Signature.fromDER(der).toCompactRawBytes();
+  } catch (cause) {
+    throw new KitError("INVALID_SIGNATURE_DER", "failed to parse DER signature", { cause });
+  }
+}
+function assertCompactLength(compactSignature) {
+  if (compactSignature.length !== 64) {
+    throw new KitError(
+      "INVALID_SIGNATURE_DER",
+      `compact signature must be 64 bytes, got ${compactSignature.length}`
+    );
+  }
+}
+function normalizeLowS(compactSignature) {
+  assertCompactLength(compactSignature);
+  return nist.p256.Signature.fromCompact(compactSignature).normalizeS().toCompactRawBytes();
+}
+function derToCompactLowS(der) {
+  return normalizeLowS(derToCompact(der));
+}
+
+// src/webauthn/clientData.ts
+function parseClientDataJSON(clientDataJSON) {
+  let raw;
+  try {
+    raw = JSON.parse(bytesToUtf8(clientDataJSON));
+  } catch (cause) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is not valid JSON", { cause });
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is not a JSON object");
+  }
+  const obj = raw;
+  const { type, challenge, origin, crossOrigin } = obj;
+  if (typeof type !== "string" || typeof challenge !== "string" || typeof origin !== "string") {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is missing required fields");
+  }
+  return {
+    type,
+    challenge,
+    origin,
+    crossOrigin: typeof crossOrigin === "boolean" ? crossOrigin : void 0
+  };
+}
+function verifyClientDataJSON(clientDataJSON, expected) {
+  const data = parseClientDataJSON(clientDataJSON);
+  if (data.type !== "webauthn.get") {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      `clientDataJSON.type "${data.type}" is not "webauthn.get"`
+    );
+  }
+  const allowed = Array.isArray(expected.origin) ? expected.origin : [expected.origin];
+  if (!allowed.includes(data.origin)) {
+    throw new KitError("ORIGIN_MISMATCH", `origin "${data.origin}" not in [${allowed.join(", ")}]`);
+  }
+  if (data.challenge !== expected.challenge) {
+    throw new KitError("CHALLENGE_MISMATCH", "clientDataJSON challenge does not match expected");
+  }
+  return data;
+}
+
+// src/webauthn/payload.ts
+function reconstructSignedPayload(input) {
+  const clientDataHash = sha256.sha256(input.clientDataJSON);
+  return sha256.sha256(concatBytes(input.authenticatorData, clientDataHash));
+}
+
+// src/webauthn/verify.ts
+function verifyAssertionSignature(input) {
+  const payload = reconstructSignedPayload(input);
+  const compact = input.signature.length === 64 ? input.signature : derToCompact(input.signature);
+  return nist.p256.verify(compact, payload, input.publicKey, { lowS: false, format: "compact" });
+}
+function authEntryChallengeBytes(entry, networkPassphrase) {
+  const credentials = entry.credentials();
+  if (credentials.switch().name !== "sorobanCredentialsAddress") {
+    throw new KitError("CONTRACT_AUTH_FAILED", "auth entry has no address credentials to sign");
+  }
+  const address = credentials.address();
+  const preimage = stellarSdk.xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
+    new stellarSdk.xdr.HashIdPreimageSorobanAuthorization({
+      networkId: Buffer.from(stellarSdk.hash(Buffer.from(utf8ToBytes(networkPassphrase)))),
+      nonce: address.nonce(),
+      signatureExpirationLedger: address.signatureExpirationLedger(),
+      invocation: entry.rootInvocation()
+    })
+  );
+  return new Uint8Array(stellarSdk.hash(preimage.toXDR()));
+}
+function authEntryChallenge(entry, networkPassphrase) {
+  return bytesToBase64Url(authEntryChallengeBytes(entry, networkPassphrase));
+}
+function applyAssertionToEntry(entry, assertion) {
+  entry.credentials().address().signature(buildSignatureScVal(assertion));
+  return entry;
+}
+function buildSignatureScVal(assertion) {
+  return stellarSdk.xdr.ScVal.scvMap([
+    bytesField("authenticator_data", assertion.authenticatorData),
+    bytesField("client_data_json", assertion.clientDataJSON),
+    bytesField("signature", assertion.signature)
+  ]);
+}
+function bytesField(name, bytes) {
+  return new stellarSdk.xdr.ScMapEntry({
+    key: stellarSdk.xdr.ScVal.scvSymbol(name),
+    val: stellarSdk.xdr.ScVal.scvBytes(Buffer.from(bytes))
+  });
+}
+function buildSignerKeyScVal(credentialId) {
+  return stellarSdk.xdr.ScVal.scvVec([
+    stellarSdk.xdr.ScVal.scvSymbol("Secp256r1"),
+    stellarSdk.xdr.ScVal.scvBytes(Buffer.from(credentialId))
+  ]);
+}
+function buildSmartWalletSignatureVariant(assertion) {
+  return stellarSdk.xdr.ScVal.scvVec([stellarSdk.xdr.ScVal.scvSymbol("Secp256r1"), buildSignatureScVal(assertion)]);
+}
+function decomposeSignerKey(key) {
+  const vec = key.vec();
+  if (!vec || vec.length < 2) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "malformed SignerKey (expected an enum vec)");
+  }
+  const variant = vec[0].sym().toString();
+  const el = vec[1];
+  const payload = el.switch().name === "scvBytes" ? new Uint8Array(el.bytes()) : new Uint8Array(el.toXDR());
+  return { variant, payload };
+}
+function compareBytes(a, b) {
+  const n = Math.min(a.length, b.length);
+  for (let i = 0; i < n; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return a.length - b.length;
+}
+function compareSignerKeyScVal(a, b) {
+  const ka = decomposeSignerKey(a);
+  const kb = decomposeSignerKey(b);
+  if (ka.variant !== kb.variant) return ka.variant < kb.variant ? -1 : 1;
+  return compareBytes(ka.payload, kb.payload);
+}
+function applyAssertionToSmartWalletEntry(entry, assertion) {
+  const credentials = entry.credentials();
+  if (credentials.switch().name !== "sorobanCredentialsAddress") {
+    throw new KitError("CONTRACT_AUTH_FAILED", "auth entry has no address credentials to sign");
+  }
+  const key = buildSignerKeyScVal(assertion.credentialId);
+  const newEntry = new stellarSdk.xdr.ScMapEntry({ key, val: buildSmartWalletSignatureVariant(assertion) });
+  const current = credentials.address().signature();
+  let mapEntries;
+  switch (current.switch().name) {
+    case "scvVoid":
+      mapEntries = [newEntry];
+      break;
+    case "scvVec": {
+      const existing = current.vec()?.[0]?.map() ?? [];
+      mapEntries = existing.filter((e) => compareSignerKeyScVal(e.key(), key) !== 0);
+      mapEntries.push(newEntry);
+      break;
+    }
+    default:
+      throw new KitError(
+        "CONTRACT_AUTH_FAILED",
+        "unexpected existing signature shape for a smart-wallet entry"
+      );
+  }
+  mapEntries.sort((a, b) => compareSignerKeyScVal(a.key(), b.key()));
+  credentials.address().signature(stellarSdk.xdr.ScVal.scvVec([stellarSdk.xdr.ScVal.scvMap(mapEntries)]));
+  return entry;
+}
+
+// src/soroban/sign.ts
+function preflightAssertion(assertion, challenge, verify) {
+  let clientData;
+  if (verify.origin !== void 0) {
+    clientData = verifyClientDataJSON(assertion.clientDataJSON, {
+      origin: verify.origin,
+      challenge
+    });
+  } else {
+    clientData = parseClientDataJSON(assertion.clientDataJSON);
+    if (clientData.type !== "webauthn.get") {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        `clientDataJSON.type "${clientData.type}" is not "webauthn.get"`
+      );
+    }
+    if (clientData.challenge !== challenge) {
+      throw new KitError("CHALLENGE_MISMATCH", "assertion challenge does not match the auth entry");
+    }
+  }
+  if (clientData.crossOrigin === true && !verify.allowCrossOrigin) {
+    throw new KitError(
+      "ORIGIN_MISMATCH",
+      "assertion was made in a cross-origin context (crossOrigin=true)"
+    );
+  }
+  const parsed = parseAuthenticatorData(assertion.authenticatorData);
+  if (!parsed.flags.up) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "assertion is missing the User-Present (UP) flag"
+    );
+  }
+  if (verify.requireUserVerification && !parsed.flags.uv) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "assertion is missing the required User-Verified (UV) flag"
+    );
+  }
+  if (verify.rpId !== void 0) {
+    verifyRpIdHash(assertion.authenticatorData, verify.rpId);
+  }
+  if (verify.publicKey !== void 0) {
+    const ok = verifyAssertionSignature({
+      publicKey: verify.publicKey,
+      authenticatorData: assertion.authenticatorData,
+      clientDataJSON: assertion.clientDataJSON,
+      signature: assertion.signature
+    });
+    if (!ok) {
+      throw new KitError(
+        "CONTRACT_AUTH_FAILED",
+        "assertion signature failed pre-flight verification"
+      );
+    }
+  }
+}
+async function signEntryInPlace(entry, options) {
+  if (options.signatureExpirationLedger !== void 0) {
+    const creds = entry.credentials();
+    if (creds.switch().name === "sorobanCredentialsAddress") {
+      creds.address().signatureExpirationLedger(options.signatureExpirationLedger);
+    }
+  }
+  const challenge = authEntryChallenge(entry, options.networkPassphrase);
+  const assertion = await options.sign(challenge);
+  if (options.verify) preflightAssertion(assertion, challenge, options.verify);
+  const signature = assertion.signature.length === 64 ? assertion.signature : derToCompactLowS(assertion.signature);
+  const normalized = {
+    credentialId: assertion.credentialId,
+    authenticatorData: assertion.authenticatorData,
+    clientDataJSON: assertion.clientDataJSON,
+    signature
+  };
+  if (options.target === "smart-wallet") {
+    applyAssertionToSmartWalletEntry(entry, normalized);
+  } else {
+    applyAssertionToEntry(entry, normalized);
+  }
+}
+async function signAuthEntry(entryXdr, options) {
+  const entry = stellarSdk.xdr.SorobanAuthorizationEntry.fromXDR(entryXdr, "base64");
+  await signEntryInPlace(entry, options);
+  return entry.toXDR("base64");
+}
+
+// src/internal/cborEncode.ts
+function head(major, arg) {
+  const m = major << 5;
+  if (arg < 24) return [m | arg];
+  if (arg < 256) return [m | 24, arg];
+  if (arg < 65536) return [m | 25, arg >> 8 & 255, arg & 255];
+  return [m | 26, arg >>> 24 & 255, arg >> 16 & 255, arg >> 8 & 255, arg & 255];
+}
+function write(value, out) {
+  if (typeof value === "number" && Number.isInteger(value)) {
+    if (value >= 0) out.push(...head(0, value));
+    else out.push(...head(1, -1 - value));
+  } else if (value instanceof Uint8Array) {
+    out.push(...head(2, value.length));
+    for (const b of value) out.push(b);
+  } else if (typeof value === "string") {
+    const bytes = utf8ToBytes(value);
+    out.push(...head(3, bytes.length));
+    for (const b of bytes) out.push(b);
+  } else if (Array.isArray(value)) {
+    out.push(...head(4, value.length));
+    for (const item of value) write(item, out);
+  } else if (value instanceof Map) {
+    out.push(...head(5, value.size));
+    for (const [k, v] of value) {
+      write(k, out);
+      write(v, out);
+    }
+  } else {
+    throw new Error("CBOR encode: unsupported value");
+  }
+}
+function encodeCbor(value) {
+  const out = [];
+  write(value, out);
+  return Uint8Array.from(out);
+}
+
+// src/testing/mockAuthenticator.ts
+function deriveScalar(seed) {
+  const n = nist.p256.CURVE.n;
+  let scalar = BigInt("0x" + bytesToHexLocal(sha256.sha256(utf8ToBytes("priv:" + seed)))) % n;
+  if (scalar === 0n) scalar = 1n;
+  const hex = scalar.toString(16).padStart(64, "0");
+  return Uint8Array.from((hex.match(/../g) ?? []).map((h) => parseInt(h, 16)));
+}
+function bytesToHexLocal(bytes) {
+  let hex = "";
+  for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+  return hex;
+}
+function mockAuthenticator(options) {
+  const seed = options.seed ?? "mock-authenticator";
+  const origin = options.origin ?? `https://${options.rpId}`;
+  const privateKey = deriveScalar(seed);
+  const publicKey = nist.p256.getPublicKey(privateKey, false);
+  const x = publicKey.slice(1, 33);
+  const y = publicKey.slice(33, 65);
+  const credIdBytes = sha256.sha256(utf8ToBytes("cred:" + seed)).slice(0, 16);
+  const credentialId = bytesToBase64Url(credIdBytes);
+  const rpIdHash = sha256.sha256(utf8ToBytes(options.rpId));
+  const coseKey = encodeCbor(
+    /* @__PURE__ */ new Map([
+      [1, 2],
+      // kty EC2
+      [3, -7],
+      // alg ES256
+      [-1, 1],
+      // crv P-256
+      [-2, x],
+      [-3, y]
+    ])
+  );
+  const attestedAuthData = concatBytes(
+    rpIdHash,
+    new Uint8Array([69]),
+    // UP | UV | AT
+    new Uint8Array([0, 0, 0, 0]),
+    // signCount
+    new Uint8Array(16),
+    // aaguid
+    new Uint8Array([0, credIdBytes.length]),
+    credIdBytes,
+    coseKey
+  );
+  const attestationObject = encodeCbor(
+    /* @__PURE__ */ new Map([
+      ["fmt", "none"],
+      ["attStmt", /* @__PURE__ */ new Map()],
+      ["authData", attestedAuthData]
+    ])
+  );
+  function signAssertion(challengeB64) {
+    const authenticatorData = concatBytes(
+      rpIdHash,
+      new Uint8Array([5]),
+      new Uint8Array([0, 0, 0, 1])
+    );
+    const clientDataJSON = utf8ToBytes(
+      JSON.stringify({ type: "webauthn.get", challenge: challengeB64, origin })
+    );
+    const payload = sha256.sha256(concatBytes(authenticatorData, sha256.sha256(clientDataJSON)));
+    const sig = nist.p256.sign(payload, privateKey);
+    const s = options.forceHighS ? nist.p256.CURVE.n - sig.s : sig.s;
+    const signatureDer = new nist.p256.Signature(sig.r, s).toDERRawBytes();
+    return { authenticatorData, clientDataJSON, signatureDer };
+  }
+  return {
+    publicKey,
+    credentialId,
+    privateKey,
+    create() {
+      return Promise.resolve({ id: credentialId, rawId: credIdBytes, attestationObject });
+    },
+    get(getOptions) {
+      const challengeB64 = getOptions.challenge ? bytesToBase64Url(getOptions.challenge) : "mock";
+      const a = signAssertion(challengeB64);
+      return Promise.resolve({
+        id: credentialId,
+        rawId: credIdBytes,
+        authenticatorData: a.authenticatorData,
+        clientDataJSON: a.clientDataJSON,
+        signature: a.signatureDer
+      });
+    },
+    sign(challenge) {
+      const a = signAssertion(challenge);
+      return {
+        authenticatorData: a.authenticatorData,
+        clientDataJSON: a.clientDataJSON,
+        signature: a.signatureDer,
+        credentialId: credIdBytes
+      };
+    }
+  };
+}
+function createInMemoryBackend() {
+  const registry = /* @__PURE__ */ new Map();
+  let nonce = 0;
+  return {
+    registry,
+    deployer: {
+      deploy({ publicKey, credentialId }) {
+        const contractId = stellarSdk.StrKey.encodeContract(
+          Buffer.from(sha256.sha256(utf8ToBytes("account:" + credentialId)))
+        );
+        registry.set(credentialId, { contractId, publicKey });
+        return Promise.resolve({ contractId, txHash: `mock-deploy-${String(nonce++)}` });
+      }
+    },
+    indexer: {
+      resolveByCredential(credentialId) {
+        const account = registry.get(credentialId);
+        return Promise.resolve(account ? [{ contractId: account.contractId }] : []);
+      }
+    },
+    submission: {
+      send: () => Promise.resolve({ status: "SUCCESS", hash: "mock-tx" })
+    }
+  };
+}
+
+// src/testing/kit.ts
+var TESTNET = "Test SDF Network ; September 2015";
+function inMemoryStorage() {
+  const map = /* @__PURE__ */ new Map();
+  return { get: (rpId) => map.get(rpId) ?? null, set: (rpId, id) => void map.set(rpId, id) };
+}
+function createPasskeyKit(options) {
+  const networkPassphrase = options.networkPassphrase ?? TESTNET;
+  const rpName = options.rpName ?? options.rpId;
+  let webauthn;
+  let deployer;
+  let indexer;
+  let storage;
+  let signer;
+  if (options.mode === "mock") {
+    const auth = mockAuthenticator({
+      rpId: options.rpId,
+      seed: options.seed,
+      forceHighS: options.forceHighS
+    });
+    const backend = createInMemoryBackend();
+    webauthn = auth;
+    deployer = backend.deployer;
+    indexer = backend.indexer;
+    signer = auth.sign;
+    storage = inMemoryStorage();
+  } else {
+    if (!options.webauthn || !options.deployer || !options.indexer || !options.signer) {
+      throw new Error("live mode requires webauthn, deployer, indexer and signer");
+    }
+    webauthn = options.webauthn;
+    deployer = options.deployer;
+    indexer = options.indexer;
+    signer = options.signer;
+    storage = options.storage ?? inMemoryStorage();
+  }
+  return {
+    mode: options.mode,
+    rpId: options.rpId,
+    createPasskey: (input) => createPasskey({
+      rpId: options.rpId,
+      rpName,
+      userName: input?.userName ?? "user",
+      deployer,
+      webauthn,
+      storage
+    }),
+    connect: () => connect({
+      rpId: options.rpId,
+      indexer,
+      storage}),
+    recover: () => recover({ rpId: options.rpId, indexer, webauthn }),
+    signAuthEntry: (entryXdr) => signAuthEntry(entryXdr, { networkPassphrase, sign: signer })
+  };
+}
+
+exports.createInMemoryBackend = createInMemoryBackend;
+exports.createPasskeyKit = createPasskeyKit;
+exports.mockAuthenticator = mockAuthenticator;
+//# sourceMappingURL=testing.cjs.map
+//# sourceMappingURL=testing.cjs.map