@soropass/core 0.1.0

package/dist/testing.js

@@ -0,0 +1,235 @@
+import { createPasskey } from './chunk-W75OQKHR.js';
+import { connect } from './chunk-AHFGTIBY.js';
+import { recover } from './chunk-MOLZIRIH.js';
+import { signAuthEntry } from './chunk-BIRF5I6I.js';
+import { sha256, concatBytes } from './chunk-JNJ2FY45.js';
+import { utf8ToBytes, bytesToBase64Url } from './chunk-LB4HOTLV.js';
+import './chunk-TPBBZNPP.js';
+import './chunk-AMYFJQAC.js';
+import { p256 } from '@noble/curves/nist';
+import { StrKey } from '@stellar/stellar-sdk';
+
+// src/internal/cborEncode.ts
+function head(major, arg) {
+  const m = major << 5;
+  if (arg < 24) return [m | arg];
+  if (arg < 256) return [m | 24, arg];
+  if (arg < 65536) return [m | 25, arg >> 8 & 255, arg & 255];
+  return [m | 26, arg >>> 24 & 255, arg >> 16 & 255, arg >> 8 & 255, arg & 255];
+}
+function write(value, out) {
+  if (typeof value === "number" && Number.isInteger(value)) {
+    if (value >= 0) out.push(...head(0, value));
+    else out.push(...head(1, -1 - value));
+  } else if (value instanceof Uint8Array) {
+    out.push(...head(2, value.length));
+    for (const b of value) out.push(b);
+  } else if (typeof value === "string") {
+    const bytes = utf8ToBytes(value);
+    out.push(...head(3, bytes.length));
+    for (const b of bytes) out.push(b);
+  } else if (Array.isArray(value)) {
+    out.push(...head(4, value.length));
+    for (const item of value) write(item, out);
+  } else if (value instanceof Map) {
+    out.push(...head(5, value.size));
+    for (const [k, v] of value) {
+      write(k, out);
+      write(v, out);
+    }
+  } else {
+    throw new Error("CBOR encode: unsupported value");
+  }
+}
+function encodeCbor(value) {
+  const out = [];
+  write(value, out);
+  return Uint8Array.from(out);
+}
+
+// src/testing/mockAuthenticator.ts
+function deriveScalar(seed) {
+  const n = p256.CURVE.n;
+  let scalar = BigInt("0x" + bytesToHexLocal(sha256(utf8ToBytes("priv:" + seed)))) % n;
+  if (scalar === 0n) scalar = 1n;
+  const hex = scalar.toString(16).padStart(64, "0");
+  return Uint8Array.from((hex.match(/../g) ?? []).map((h) => parseInt(h, 16)));
+}
+function bytesToHexLocal(bytes) {
+  let hex = "";
+  for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+  return hex;
+}
+function mockAuthenticator(options) {
+  const seed = options.seed ?? "mock-authenticator";
+  const origin = options.origin ?? `https://${options.rpId}`;
+  const privateKey = deriveScalar(seed);
+  const publicKey = p256.getPublicKey(privateKey, false);
+  const x = publicKey.slice(1, 33);
+  const y = publicKey.slice(33, 65);
+  const credIdBytes = sha256(utf8ToBytes("cred:" + seed)).slice(0, 16);
+  const credentialId = bytesToBase64Url(credIdBytes);
+  const rpIdHash = sha256(utf8ToBytes(options.rpId));
+  const coseKey = encodeCbor(
+    /* @__PURE__ */ new Map([
+      [1, 2],
+      // kty EC2
+      [3, -7],
+      // alg ES256
+      [-1, 1],
+      // crv P-256
+      [-2, x],
+      [-3, y]
+    ])
+  );
+  const attestedAuthData = concatBytes(
+    rpIdHash,
+    new Uint8Array([69]),
+    // UP | UV | AT
+    new Uint8Array([0, 0, 0, 0]),
+    // signCount
+    new Uint8Array(16),
+    // aaguid
+    new Uint8Array([0, credIdBytes.length]),
+    credIdBytes,
+    coseKey
+  );
+  const attestationObject = encodeCbor(
+    /* @__PURE__ */ new Map([
+      ["fmt", "none"],
+      ["attStmt", /* @__PURE__ */ new Map()],
+      ["authData", attestedAuthData]
+    ])
+  );
+  function signAssertion(challengeB64) {
+    const authenticatorData = concatBytes(
+      rpIdHash,
+      new Uint8Array([5]),
+      new Uint8Array([0, 0, 0, 1])
+    );
+    const clientDataJSON = utf8ToBytes(
+      JSON.stringify({ type: "webauthn.get", challenge: challengeB64, origin })
+    );
+    const payload = sha256(concatBytes(authenticatorData, sha256(clientDataJSON)));
+    const sig = p256.sign(payload, privateKey);
+    const s = options.forceHighS ? p256.CURVE.n - sig.s : sig.s;
+    const signatureDer = new p256.Signature(sig.r, s).toDERRawBytes();
+    return { authenticatorData, clientDataJSON, signatureDer };
+  }
+  return {
+    publicKey,
+    credentialId,
+    privateKey,
+    create() {
+      return Promise.resolve({ id: credentialId, rawId: credIdBytes, attestationObject });
+    },
+    get(getOptions) {
+      const challengeB64 = getOptions.challenge ? bytesToBase64Url(getOptions.challenge) : "mock";
+      const a = signAssertion(challengeB64);
+      return Promise.resolve({
+        id: credentialId,
+        rawId: credIdBytes,
+        authenticatorData: a.authenticatorData,
+        clientDataJSON: a.clientDataJSON,
+        signature: a.signatureDer
+      });
+    },
+    sign(challenge) {
+      const a = signAssertion(challenge);
+      return {
+        authenticatorData: a.authenticatorData,
+        clientDataJSON: a.clientDataJSON,
+        signature: a.signatureDer,
+        credentialId: credIdBytes
+      };
+    }
+  };
+}
+function createInMemoryBackend() {
+  const registry = /* @__PURE__ */ new Map();
+  let nonce = 0;
+  return {
+    registry,
+    deployer: {
+      deploy({ publicKey, credentialId }) {
+        const contractId = StrKey.encodeContract(
+          Buffer.from(sha256(utf8ToBytes("account:" + credentialId)))
+        );
+        registry.set(credentialId, { contractId, publicKey });
+        return Promise.resolve({ contractId, txHash: `mock-deploy-${String(nonce++)}` });
+      }
+    },
+    indexer: {
+      resolveByCredential(credentialId) {
+        const account = registry.get(credentialId);
+        return Promise.resolve(account ? [{ contractId: account.contractId }] : []);
+      }
+    },
+    submission: {
+      send: () => Promise.resolve({ status: "SUCCESS", hash: "mock-tx" })
+    }
+  };
+}
+
+// src/testing/kit.ts
+var TESTNET = "Test SDF Network ; September 2015";
+function inMemoryStorage() {
+  const map = /* @__PURE__ */ new Map();
+  return { get: (rpId) => map.get(rpId) ?? null, set: (rpId, id) => void map.set(rpId, id) };
+}
+function createPasskeyKit(options) {
+  const networkPassphrase = options.networkPassphrase ?? TESTNET;
+  const rpName = options.rpName ?? options.rpId;
+  let webauthn;
+  let deployer;
+  let indexer;
+  let storage;
+  let signer;
+  if (options.mode === "mock") {
+    const auth = mockAuthenticator({
+      rpId: options.rpId,
+      seed: options.seed,
+      forceHighS: options.forceHighS
+    });
+    const backend = createInMemoryBackend();
+    webauthn = auth;
+    deployer = backend.deployer;
+    indexer = backend.indexer;
+    signer = auth.sign;
+    storage = inMemoryStorage();
+  } else {
+    if (!options.webauthn || !options.deployer || !options.indexer || !options.signer) {
+      throw new Error("live mode requires webauthn, deployer, indexer and signer");
+    }
+    webauthn = options.webauthn;
+    deployer = options.deployer;
+    indexer = options.indexer;
+    signer = options.signer;
+    storage = options.storage ?? inMemoryStorage();
+  }
+  return {
+    mode: options.mode,
+    rpId: options.rpId,
+    createPasskey: (input) => createPasskey({
+      rpId: options.rpId,
+      rpName,
+      userName: input?.userName ?? "user",
+      deployer,
+      webauthn,
+      storage
+    }),
+    connect: () => connect({
+      rpId: options.rpId,
+      indexer,
+      webauthn,
+      storage,
+      silentMediationSupported: false
+    }),
+    recover: () => recover({ rpId: options.rpId, indexer, webauthn }),
+    signAuthEntry: (entryXdr) => signAuthEntry(entryXdr, { networkPassphrase, sign: signer })
+  };
+}
+
+export { createInMemoryBackend, createPasskeyKit, mockAuthenticator };
+//# sourceMappingURL=testing.js.map
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/cborEncode.ts","../src/testing/mockAuthenticator.ts","../src/testing/inMemory.ts","../src/testing/kit.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,SAAS,IAAA,CAAK,OAAe,GAAA,EAAuB;AAClD,EAAA,MAAM,IAAI,KAAA,IAAS,CAAA;AACnB,EAAA,IAAI,GAAA,GAAM,EAAA,EAAI,OAAO,CAAC,IAAI,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,GAAA,EAAO,OAAO,CAAC,CAAA,GAAI,IAAI,GAAG,CAAA;AACpC,EAAA,IAAI,GAAA,GAAM,KAAA,EAAS,OAAO,CAAC,CAAA,GAAI,IAAK,GAAA,IAAO,CAAA,GAAK,GAAA,EAAM,GAAA,GAAM,GAAI,CAAA;AAChE,EAAA,OAAO,CAAC,CAAA,GAAI,EAAA,EAAK,GAAA,KAAQ,EAAA,GAAM,GAAA,EAAO,GAAA,IAAO,EAAA,GAAM,GAAA,EAAO,GAAA,IAAO,CAAA,GAAK,GAAA,EAAM,MAAM,GAAI,CAAA;AACxF;AAEA,SAAS,KAAA,CAAM,OAAkB,GAAA,EAAqB;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,EAAG;AACxD,IAAA,IAAI,KAAA,IAAS,GAAG,GAAA,CAAI,IAAA,CAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,aACjC,IAAA,CAAK,GAAG,KAAK,CAAA,EAAG,EAAA,GAAK,KAAK,CAAC,CAAA;AAAA,EACtC,CAAA,MAAA,IAAW,iBAAiB,UAAA,EAAY;AACtC,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,IAAA,MAAM,KAAA,GAAQ,YAAY,KAAK,CAAA;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,MAAM,CAAC,CAAA;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,KAAA,CAAM,IAAA,EAAM,GAAG,CAAA;AAAA,EAC3C,CAAA,MAAA,IAAW,iBAAiB,GAAA,EAAK;AAC/B,IAAA,GAAA,CAAI,KAAK,GAAG,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAC,CAAA;AAC/B,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,KAAA,EAAO;AAC1B,MAAA,KAAA,CAAM,GAAG,GAAG,CAAA;AACZ,MAAA,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,IACd;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACF;AAEO,SAAS,WAAW,KAAA,EAA8B;AACvD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAChB,EAAA,OAAO,UAAA,CAAW,KAAK,GAAG,CAAA;AAC5B;;;ACjBA,SAAS,aAAa,IAAA,EAA0B;AAC9C,EAAA,MAAM,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA;AACrB,EAAA,IAAI,MAAA,GAAS,MAAA,CAAO,IAAA,GAAO,eAAA,CAAgB,MAAA,CAAO,WAAA,CAAY,OAAA,GAAU,IAAI,CAAC,CAAC,CAAC,CAAA,GAAI,CAAA;AACnF,EAAA,IAAI,MAAA,KAAW,IAAI,MAAA,GAAS,EAAA;AAC5B,EAAA,MAAM,MAAM,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,IAAI,GAAG,CAAA;AAChD,EAAA,OAAO,UAAA,CAAW,IAAA,CAAA,CAAM,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAC,CAAA;AAC7E;AACA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,kBAAkB,OAAA,EAAsD;AACtF,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,oBAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,CAAA,QAAA,EAAW,QAAQ,IAAI,CAAA,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,aAAa,IAAI,CAAA;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AACrD,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,OAAO,WAAA,CAAY,OAAA,GAAU,IAAI,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACnE,EAAA,MAAM,YAAA,GAAe,iBAAiB,WAAW,CAAA;AACjD,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,WAAA,CAAY,OAAA,CAAQ,IAAI,CAAC,CAAA;AAEjD,EAAA,MAAM,OAAA,GAAU,UAAA;AAAA,wBACV,GAAA,CAAgC;AAAA,MAClC,CAAC,GAAG,CAAC,CAAA;AAAA;AAAA,MACL,CAAC,GAAG,EAAE,CAAA;AAAA;AAAA,MACN,CAAC,IAAI,CAAC,CAAA;AAAA;AAAA,MACN,CAAC,IAAI,CAAC,CAAA;AAAA,MACN,CAAC,IAAI,CAAC;AAAA,KACP;AAAA,GACH;AAEA,EAAA,MAAM,gBAAA,GAAmB,WAAA;AAAA,IACvB,QAAA;AAAA,IACA,IAAI,UAAA,CAAW,CAAC,EAAI,CAAC,CAAA;AAAA;AAAA,IACrB,IAAI,UAAA,CAAW,CAAC,GAAG,CAAA,EAAG,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA;AAAA,IAC3B,IAAI,WAAW,EAAE,CAAA;AAAA;AAAA,IACjB,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG,WAAA,CAAY,MAAM,CAAC,CAAA;AAAA,IACtC,WAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,iBAAA,GAAoB,UAAA;AAAA,wBACpB,GAAA,CAAgC;AAAA,MAClC,CAAC,OAAO,MAAM,CAAA;AAAA,MACd,CAAC,SAAA,kBAAW,IAAI,GAAA,EAAiC,CAAA;AAAA,MACjD,CAAC,YAAY,gBAAgB;AAAA,KAC9B;AAAA,GACH;AAEA,EAAA,SAAS,cAAc,YAAA,EAIrB;AACA,IAAA,MAAM,iBAAA,GAAoB,WAAA;AAAA,MACxB,QAAA;AAAA,MACA,IAAI,UAAA,CAAW,CAAC,CAAI,CAAC,CAAA;AAAA,MACrB,IAAI,UAAA,CAAW,CAAC,GAAG,CAAA,EAAG,CAAA,EAAG,CAAC,CAAC;AAAA,KAC7B;AACA,IAAA,MAAM,cAAA,GAAiB,WAAA;AAAA,MACrB,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,gBAAgB,SAAA,EAAW,YAAA,EAAc,QAAQ;AAAA,KAC1E;AACA,IAAA,MAAM,UAAU,MAAA,CAAO,WAAA,CAAY,mBAAmB,MAAA,CAAO,cAAc,CAAC,CAAC,CAAA;AAC7E,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AACzC,IAAA,MAAM,CAAA,GAAI,QAAQ,UAAA,GAAa,IAAA,CAAK,MAAM,CAAA,GAAI,GAAA,CAAI,IAAI,GAAA,CAAI,CAAA;AAC1D,IAAA,MAAM,YAAA,GAAe,IAAI,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,CAAC,EAAE,aAAA,EAAc;AAChE,IAAA,OAAO,EAAE,iBAAA,EAAmB,cAAA,EAAgB,YAAA,EAAa;AAAA,EAC3D;AAEA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA,GAAwC;AACtC,MAAA,OAAO,OAAA,CAAQ,QAAQ,EAAE,EAAA,EAAI,cAAc,KAAA,EAAO,WAAA,EAAa,mBAAmB,CAAA;AAAA,IACpF,CAAA;AAAA,IACA,IAAI,UAAA,EAA4D;AAC9D,MAAA,MAAM,eAAe,UAAA,CAAW,SAAA,GAAY,gBAAA,CAAiB,UAAA,CAAW,SAAS,CAAA,GAAI,MAAA;AACrF,MAAA,MAAM,CAAA,GAAI,cAAc,YAAY,CAAA;AACpC,MAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,QACrB,EAAA,EAAI,YAAA;AAAA,QACJ,KAAA,EAAO,WAAA;AAAA,QACP,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE,cAAA;AAAA,QAClB,WAAW,CAAA,CAAE;AAAA,OACd,CAAA;AAAA,IACH,CAAA;AAAA,IACA,KAAK,SAAA,EAAoC;AACvC,MAAA,MAAM,CAAA,GAAI,cAAc,SAAS,CAAA;AACjC,MAAA,OAAO;AAAA,QACL,mBAAmB,CAAA,CAAE,iBAAA;AAAA,QACrB,gBAAgB,CAAA,CAAE,cAAA;AAAA,QAClB,WAAW,CAAA,CAAE,YAAA;AAAA,QACb,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAAA,GACF;AACF;AChHO,SAAS,qBAAA,GAAyC;AACvD,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA2D;AAChF,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,QAAA,EAAU;AAAA,MACR,MAAA,CAAO,EAAE,SAAA,EAAW,YAAA,EAAa,EAAG;AAClC,QAAA,MAAM,aAAa,MAAA,CAAO,cAAA;AAAA,UACxB,OAAO,IAAA,CAAK,MAAA,CAAO,YAAY,UAAA,GAAa,YAAY,CAAC,CAAC;AAAA,SAC5D;AACA,QAAA,QAAA,CAAS,GAAA,CAAI,YAAA,EAAc,EAAE,UAAA,EAAY,WAAW,CAAA;AACpD,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,eAAe,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA,CAAA,EAAI,CAAA;AAAA,MACjF;AAAA,KACF;AAAA,IACA,OAAA,EAAS;AAAA,MACP,oBAAoB,YAAA,EAAc;AAChC,QAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,YAAY,CAAA;AACzC,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,OAAA,GAAU,CAAC,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAY,CAAA,GAAI,EAAE,CAAA;AAAA,MAC5E;AAAA,KACF;AAAA,IACA,UAAA,EAAY;AAAA,MACV,IAAA,EAAM,MAAM,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW;AAAA;AACpE,GACF;AACF;;;ACtCA,IAAM,OAAA,GAAU,mCAAA;AA4BhB,SAAS,eAAA,GAAqC;AAC5C,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAoB;AACpC,EAAA,OAAO,EAAE,GAAA,EAAK,CAAC,SAAS,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA,EAAM,GAAA,EAAK,CAAC,MAAM,EAAA,KAAO,KAAK,IAAI,GAAA,CAAI,IAAA,EAAM,EAAE,CAAA,EAAE;AAC3F;AAQO,SAAS,iBAAiB,OAAA,EAA8C;AAC7E,EAAA,MAAM,iBAAA,GAAoB,QAAQ,iBAAA,IAAqB,OAAA;AACvD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,IAAA;AAEzC,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,MAAM,OAAO,iBAAA,CAAkB;AAAA,MAC7B,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,YAAY,OAAA,CAAQ;AAAA,KACrB,CAAA;AACD,IAAA,MAAM,UAAU,qBAAA,EAAsB;AACtC,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAClB,IAAA,MAAA,GAAS,IAAA,CAAK,IAAA;AACd,IAAA,OAAA,GAAU,eAAA,EAAgB;AAAA,EAC5B,CAAA,MAAO;AACL,IAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,CAAQ,OAAA,IAAW,CAAC,OAAA,CAAQ,MAAA,EAAQ;AACjF,MAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,IAC7E;AACA,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,QAAA,GAAW,OAAA,CAAQ,QAAA;AACnB,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAA;AAClB,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AACjB,IAAA,OAAA,GAAU,OAAA,CAAQ,WAAW,eAAA,EAAgB;AAAA,EAC/C;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,aAAA,EAAe,CAAC,KAAA,KACd,aAAA,CAAsB;AAAA,MACpB,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAA;AAAA,MACA,QAAA,EAAU,OAAO,QAAA,IAAY,MAAA;AAAA,MAC7B,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,IACH,OAAA,EAAS,MACP,OAAA,CAAgB;AAAA,MACd,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,OAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA;AAAA,MACA,wBAAA,EAA0B;AAAA,KAC3B,CAAA;AAAA,IACH,OAAA,EAAS,MAAM,OAAA,CAAgB,EAAE,MAAM,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,CAAA;AAAA,IACxE,aAAA,EAAe,CAAC,QAAA,KAAa,aAAA,CAAgB,UAAU,EAAE,iBAAA,EAAmB,IAAA,EAAM,MAAA,EAAQ;AAAA,GAC5F;AACF","file":"testing.js","sourcesContent":["import type { CborValue } from './cbor';\nimport { utf8ToBytes } from './encoding';\n\n/**\n * Minimal CBOR encoder — the inverse of `cbor.ts`, supporting the same major\n * types (uint, negint, byte string, text string, array, map). Used by the\n * deterministic mock authenticator (S15) to synthesize real attestationObject /\n * COSE-key bytes, so the mock create path goes through the exact same\n * `extractPublicKeyFromAttestationObject` as production. Not canonical-ordered\n * (our decoder is order-agnostic) and intentionally narrow.\n */\nfunction head(major: number, arg: number): number[] {\n  const m = major << 5;\n  if (arg < 24) return [m | arg];\n  if (arg < 0x100) return [m | 24, arg];\n  if (arg < 0x10000) return [m | 25, (arg >> 8) & 0xff, arg & 0xff];\n  return [m | 26, (arg >>> 24) & 0xff, (arg >> 16) & 0xff, (arg >> 8) & 0xff, arg & 0xff];\n}\n\nfunction write(value: CborValue, out: number[]): void {\n  if (typeof value === 'number' && Number.isInteger(value)) {\n    if (value >= 0) out.push(...head(0, value));\n    else out.push(...head(1, -1 - value));\n  } else if (value instanceof Uint8Array) {\n    out.push(...head(2, value.length));\n    for (const b of value) out.push(b);\n  } else if (typeof value === 'string') {\n    const bytes = utf8ToBytes(value);\n    out.push(...head(3, bytes.length));\n    for (const b of bytes) out.push(b);\n  } else if (Array.isArray(value)) {\n    out.push(...head(4, value.length));\n    for (const item of value) write(item, out);\n  } else if (value instanceof Map) {\n    out.push(...head(5, value.size));\n    for (const [k, v] of value) {\n      write(k, out);\n      write(v, out);\n    }\n  } else {\n    throw new Error('CBOR encode: unsupported value');\n  }\n}\n\nexport function encodeCbor(value: CborValue): Uint8Array {\n  const out: number[] = [];\n  write(value, out);\n  return Uint8Array.from(out);\n}\n","import { p256 } from '@noble/curves/nist';\nimport { sha256 } from '../internal/sha256';\nimport { concatBytes } from '../internal/bytes';\nimport { bytesToBase64Url, utf8ToBytes } from '../internal/encoding';\nimport { encodeCbor } from '../internal/cborEncode';\nimport type { CborValue } from '../internal/cbor';\nimport type {\n  WebAuthnClient,\n  WebAuthnCreateResult,\n  WebAuthnGetOptions,\n  WebAuthnGetResult,\n} from '../ceremonies/types';\nimport type { AssertionResult } from '../soroban/sign';\n\nexport interface MockAuthenticatorOptions {\n  rpId: string;\n  origin?: string;\n  /** Deterministic seed → keypair + credentialId. */\n  seed?: string;\n  /** Emit high-S signatures, to exercise the perpetual low-S guard (S04). */\n  forceHighS?: boolean;\n}\n\nexport interface MockAuthenticator extends WebAuthnClient {\n  readonly publicKey: Uint8Array; // 65-byte SEC-1\n  readonly credentialId: string; // base64url\n  readonly privateKey: Uint8Array;\n  /** WebAuthnSigner for the Soroban sign path (challenge already base64url). */\n  sign(challenge: string): AssertionResult;\n}\n\nfunction deriveScalar(seed: string): Uint8Array {\n  const n = p256.CURVE.n;\n  let scalar = BigInt('0x' + bytesToHexLocal(sha256(utf8ToBytes('priv:' + seed)))) % n;\n  if (scalar === 0n) scalar = 1n;\n  const hex = scalar.toString(16).padStart(64, '0');\n  return Uint8Array.from((hex.match(/../g) ?? []).map((h) => parseInt(h, 16)));\n}\nfunction bytesToHexLocal(bytes: Uint8Array): string {\n  let hex = '';\n  for (const b of bytes) hex += b.toString(16).padStart(2, '0');\n  return hex;\n}\n\n/**\n * A deterministic, in-memory WebAuthn authenticator for the mock kit (S15). It\n * synthesizes a REAL attestationObject / COSE key (so `createPasskey` runs the\n * exact production extraction path) and signs assertions with the same P-256\n * key — optionally as high-S to prove the low-S normalization guard.\n */\nexport function mockAuthenticator(options: MockAuthenticatorOptions): MockAuthenticator {\n  const seed = options.seed ?? 'mock-authenticator';\n  const origin = options.origin ?? `https://${options.rpId}`;\n  const privateKey = deriveScalar(seed);\n  const publicKey = p256.getPublicKey(privateKey, false); // 0x04 ‖ X ‖ Y\n  const x = publicKey.slice(1, 33);\n  const y = publicKey.slice(33, 65);\n  const credIdBytes = sha256(utf8ToBytes('cred:' + seed)).slice(0, 16);\n  const credentialId = bytesToBase64Url(credIdBytes);\n  const rpIdHash = sha256(utf8ToBytes(options.rpId));\n\n  const coseKey = encodeCbor(\n    new Map<number | string, CborValue>([\n      [1, 2], // kty EC2\n      [3, -7], // alg ES256\n      [-1, 1], // crv P-256\n      [-2, x],\n      [-3, y],\n    ]),\n  );\n\n  const attestedAuthData = concatBytes(\n    rpIdHash,\n    new Uint8Array([0x45]), // UP | UV | AT\n    new Uint8Array([0, 0, 0, 0]), // signCount\n    new Uint8Array(16), // aaguid\n    new Uint8Array([0, credIdBytes.length]),\n    credIdBytes,\n    coseKey,\n  );\n  const attestationObject = encodeCbor(\n    new Map<number | string, CborValue>([\n      ['fmt', 'none'],\n      ['attStmt', new Map<number | string, CborValue>()],\n      ['authData', attestedAuthData],\n    ]),\n  );\n\n  function signAssertion(challengeB64: string): {\n    authenticatorData: Uint8Array;\n    clientDataJSON: Uint8Array;\n    signatureDer: Uint8Array;\n  } {\n    const authenticatorData = concatBytes(\n      rpIdHash,\n      new Uint8Array([0x05]),\n      new Uint8Array([0, 0, 0, 1]),\n    );\n    const clientDataJSON = utf8ToBytes(\n      JSON.stringify({ type: 'webauthn.get', challenge: challengeB64, origin }),\n    );\n    const payload = sha256(concatBytes(authenticatorData, sha256(clientDataJSON)));\n    const sig = p256.sign(payload, privateKey); // low-S by default\n    const s = options.forceHighS ? p256.CURVE.n - sig.s : sig.s;\n    const signatureDer = new p256.Signature(sig.r, s).toDERRawBytes();\n    return { authenticatorData, clientDataJSON, signatureDer };\n  }\n\n  return {\n    publicKey,\n    credentialId,\n    privateKey,\n    create(): Promise<WebAuthnCreateResult> {\n      return Promise.resolve({ id: credentialId, rawId: credIdBytes, attestationObject });\n    },\n    get(getOptions: WebAuthnGetOptions): Promise<WebAuthnGetResult> {\n      const challengeB64 = getOptions.challenge ? bytesToBase64Url(getOptions.challenge) : 'mock';\n      const a = signAssertion(challengeB64);\n      return Promise.resolve({\n        id: credentialId,\n        rawId: credIdBytes,\n        authenticatorData: a.authenticatorData,\n        clientDataJSON: a.clientDataJSON,\n        signature: a.signatureDer,\n      });\n    },\n    sign(challenge: string): AssertionResult {\n      const a = signAssertion(challenge);\n      return {\n        authenticatorData: a.authenticatorData,\n        clientDataJSON: a.clientDataJSON,\n        signature: a.signatureDer,\n        credentialId: credIdBytes,\n      };\n    },\n  };\n}\n","import { StrKey } from '@stellar/stellar-sdk';\nimport { sha256 } from '../internal/sha256';\nimport { utf8ToBytes } from '../internal/encoding';\nimport type { AccountDeployer } from '../ceremonies/types';\nimport type { IndexerAdapter, SubmissionAdapter } from '../adapters/types';\n\nexport interface InMemoryBackend {\n  deployer: AccountDeployer;\n  indexer: IndexerAdapter;\n  submission: SubmissionAdapter;\n  /** credentialId → { contractId, publicKey } — shared so create/connect/recover agree. */\n  registry: Map<string, { contractId: string; publicKey: Uint8Array }>;\n}\n\n/**\n * Deterministic, zero-IO backend for the mock kit: the deployer derives a stable\n * C-address from the credentialId and records it; the indexer resolves from the\n * same registry; submission is a no-op SUCCESS.\n *\n * The address is a real StrKey contract id (checksummed, decodable), so a mock\n * account can be fed straight into `new Address(...)` / auth-entry XDR the same way\n * a deployed one is. It is deterministic but arbitrary: it is not the address the\n * factory would deploy for this credential (that is {@link deriveAccountAddress}).\n */\nexport function createInMemoryBackend(): InMemoryBackend {\n  const registry = new Map<string, { contractId: string; publicKey: Uint8Array }>();\n  let nonce = 0;\n  return {\n    registry,\n    deployer: {\n      deploy({ publicKey, credentialId }) {\n        const contractId = StrKey.encodeContract(\n          Buffer.from(sha256(utf8ToBytes('account:' + credentialId))),\n        );\n        registry.set(credentialId, { contractId, publicKey });\n        return Promise.resolve({ contractId, txHash: `mock-deploy-${String(nonce++)}` });\n      },\n    },\n    indexer: {\n      resolveByCredential(credentialId) {\n        const account = registry.get(credentialId);\n        return Promise.resolve(account ? [{ contractId: account.contractId }] : []);\n      },\n    },\n    submission: {\n      send: () => Promise.resolve({ status: 'SUCCESS', hash: 'mock-tx' }),\n    },\n  };\n}\n","import { createPasskey as createPasskeyCeremony } from '../ceremonies/create';\nimport { connect as connectCeremony, type ConnectResult } from '../ceremonies/connect';\nimport { recover as recoverCeremony, type RecoverResult } from '../ceremonies/recover';\nimport { signAuthEntry as signAuthEntryFn, type WebAuthnSigner } from '../soroban/sign';\nimport type { AccountDeployer, CredentialStorage, WebAuthnClient } from '../ceremonies/types';\nimport type { IndexerAdapter, SubmissionAdapter } from '../adapters/types';\nimport type { PasskeyCredential } from '../types';\nimport { mockAuthenticator } from './mockAuthenticator';\nimport { createInMemoryBackend } from './inMemory';\n\nconst TESTNET = 'Test SDF Network ; September 2015';\n\nexport interface CreatePasskeyKitOptions {\n  mode: 'mock' | 'live';\n  rpId: string;\n  rpName?: string;\n  networkPassphrase?: string;\n  // mock-mode knobs\n  seed?: string;\n  forceHighS?: boolean;\n  // live-mode dependencies\n  webauthn?: WebAuthnClient;\n  deployer?: AccountDeployer;\n  indexer?: IndexerAdapter;\n  submission?: SubmissionAdapter;\n  storage?: CredentialStorage;\n  signer?: WebAuthnSigner;\n}\n\nexport interface PasskeyKit {\n  readonly mode: 'mock' | 'live';\n  readonly rpId: string;\n  createPasskey(input?: { userName?: string }): Promise<PasskeyCredential>;\n  connect(): Promise<ConnectResult | null>;\n  recover(): Promise<RecoverResult[]>;\n  signAuthEntry(entryXdr: string): Promise<string>;\n}\n\nfunction inMemoryStorage(): CredentialStorage {\n  const map = new Map<string, string>();\n  return { get: (rpId) => map.get(rpId) ?? null, set: (rpId, id) => void map.set(rpId, id) };\n}\n\n/**\n * The downstream-adopter kit (S15, Deliverable #6). `mode:'mock'` wires a\n * deterministic in-memory authenticator + backend (zero network IO) so the\n * happy path matches the live path's SHAPE — swap `mock → live` and the demo\n * stays green. `mode:'live'` takes real adapters + a WebAuthn signer.\n */\nexport function createPasskeyKit(options: CreatePasskeyKitOptions): PasskeyKit {\n  const networkPassphrase = options.networkPassphrase ?? TESTNET;\n  const rpName = options.rpName ?? options.rpId;\n\n  let webauthn: WebAuthnClient;\n  let deployer: AccountDeployer;\n  let indexer: IndexerAdapter;\n  let storage: CredentialStorage;\n  let signer: WebAuthnSigner;\n\n  if (options.mode === 'mock') {\n    const auth = mockAuthenticator({\n      rpId: options.rpId,\n      seed: options.seed,\n      forceHighS: options.forceHighS,\n    });\n    const backend = createInMemoryBackend();\n    webauthn = auth;\n    deployer = backend.deployer;\n    indexer = backend.indexer;\n    signer = auth.sign;\n    storage = inMemoryStorage();\n  } else {\n    if (!options.webauthn || !options.deployer || !options.indexer || !options.signer) {\n      throw new Error('live mode requires webauthn, deployer, indexer and signer');\n    }\n    webauthn = options.webauthn;\n    deployer = options.deployer;\n    indexer = options.indexer;\n    signer = options.signer;\n    storage = options.storage ?? inMemoryStorage();\n  }\n\n  return {\n    mode: options.mode,\n    rpId: options.rpId,\n    createPasskey: (input) =>\n      createPasskeyCeremony({\n        rpId: options.rpId,\n        rpName,\n        userName: input?.userName ?? 'user',\n        deployer,\n        webauthn,\n        storage,\n      }),\n    connect: () =>\n      connectCeremony({\n        rpId: options.rpId,\n        indexer,\n        webauthn,\n        storage,\n        silentMediationSupported: false,\n      }),\n    recover: () => recoverCeremony({ rpId: options.rpId, indexer, webauthn }),\n    signAuthEntry: (entryXdr) => signAuthEntryFn(entryXdr, { networkPassphrase, sign: signer }),\n  };\n}\n"]}

package/dist/types--WNl-Sda.d.cts

@@ -0,0 +1,125 @@
+type ResidentKeyRequirement = 'discouraged' | 'preferred' | 'required';
+type UserVerificationRequirement = 'discouraged' | 'preferred' | 'required';
+interface BuildCreateOptionsInput {
+    rpId: string;
+    rpName: string;
+    userName: string;
+    /** Stable, opaque user handle. Defaults to UTF-8 bytes of `userName`. */
+    userId?: Uint8Array;
+    userDisplayName?: string;
+    /** Raw challenge bytes (base64url-encoded into the options). */
+    challenge: Uint8Array;
+    residentKey?: ResidentKeyRequirement;
+    userVerification?: UserVerificationRequirement;
+    timeout?: number;
+}
+/** ES256-only credential parameter. The `alg: -7` literal is non-negotiable. */
+interface PubKeyCredParam {
+    type: 'public-key';
+    alg: -7;
+}
+interface PublicKeyCredentialCreationOptionsJSON {
+    rp: {
+        id: string;
+        name: string;
+    };
+    user: {
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    challenge: string;
+    pubKeyCredParams: PubKeyCredParam[];
+    authenticatorSelection: {
+        residentKey: ResidentKeyRequirement;
+        requireResidentKey: boolean;
+        userVerification: UserVerificationRequirement;
+    };
+    attestation: 'none';
+    timeout: number;
+}
+/**
+ * Build WebAuthn registration options that offer ES256 *and only* ES256
+ * (`pubKeyCredParams: [{ type: 'public-key', alg: -7 }]`) — invariant #1.
+ * Soroban verifies only secp256r1, so we never advertise any other algorithm.
+ */
+declare function buildCreateOptions(input: BuildCreateOptionsInput): PublicKeyCredentialCreationOptionsJSON;
+
+/**
+ * S12 (YK-438) — the two adapter interfaces. The ONLY infra coupling points, so
+ * the SDK is composable, not monolithic. Ceremonies (S13) depend on these
+ * interfaces, never on a concrete backend.
+ */
+interface SubmitResult {
+    status: 'SUCCESS' | 'PENDING' | 'FAILED';
+    /** Transaction hash (hex), when known. */
+    hash: string;
+    /** Decoded contract return value on success (implementation-defined). */
+    returnValue?: unknown;
+    /** base64 XDR of the failure result, when failed. */
+    errorResultXdr?: string;
+}
+/** How a signed operation reaches the network. */
+interface SubmissionAdapter {
+    send(signedTxXdr: string): Promise<SubmitResult>;
+}
+interface ResolvedAccount {
+    /** Soroban smart-account C-address. */
+    contractId: string;
+}
+/** credentialId → smart-account address lookup. */
+interface IndexerAdapter {
+    resolveByCredential(credentialId: string): Promise<ResolvedAccount[]>;
+}
+
+/** Normalized WebAuthn results + the pluggable dependencies the ceremonies use. */
+interface WebAuthnCreateResult {
+    /** base64url credential id. */
+    id: string;
+    rawId: Uint8Array;
+    attestationObject: Uint8Array;
+}
+interface WebAuthnGetResult {
+    id: string;
+    rawId: Uint8Array;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    /** DER signature as returned by the authenticator. */
+    signature: Uint8Array;
+}
+interface WebAuthnGetOptions {
+    rpId: string;
+    challenge?: Uint8Array;
+    /** base64url credential ids; empty/omitted ⇒ discoverable (recover path). */
+    allowCredentials?: string[];
+    mediation?: 'silent' | 'optional' | 'conditional' | 'required';
+    userVerification?: 'discouraged' | 'preferred' | 'required';
+}
+
+/** Abstraction over `navigator.credentials` so ceremonies are testable + isomorphic. */
+interface WebAuthnClient {
+    create(options: PublicKeyCredentialCreationOptionsJSON): Promise<WebAuthnCreateResult>;
+    get(options: WebAuthnGetOptions): Promise<WebAuthnGetResult>;
+}
+/** Per-rpId credential-id persistence (localStorage by default). */
+interface CredentialStorage {
+    get(rpId: string): string | null;
+    set(rpId: string, credentialId: string): void;
+}
+/**
+ * Deploys a smart account for a freshly-created passkey via the factory (through
+ * a SubmissionAdapter) and returns its C-address. Injected because the factory
+ * wiring is contract-specific (kalepail webauthn-wallet / OZ) — provided by the
+ * kit module (S17) / demo (S21); we don't reinvent the contract layer here.
+ */
+interface AccountDeployer {
+    deploy(input: {
+        publicKey: Uint8Array;
+        credentialId: string;
+    }): Promise<{
+        contractId: string;
+        txHash?: string;
+    }>;
+}
+
+export { type AccountDeployer as A, type BuildCreateOptionsInput as B, type CredentialStorage as C, type IndexerAdapter as I, type PubKeyCredParam as P, type ResidentKeyRequirement as R, type SubmissionAdapter as S, type UserVerificationRequirement as U, type WebAuthnClient as W, type PublicKeyCredentialCreationOptionsJSON as a, type ResolvedAccount as b, type SubmitResult as c, type WebAuthnCreateResult as d, type WebAuthnGetOptions as e, type WebAuthnGetResult as f, buildCreateOptions as g };

package/dist/types--WNl-Sda.d.ts

@@ -0,0 +1,125 @@
+type ResidentKeyRequirement = 'discouraged' | 'preferred' | 'required';
+type UserVerificationRequirement = 'discouraged' | 'preferred' | 'required';
+interface BuildCreateOptionsInput {
+    rpId: string;
+    rpName: string;
+    userName: string;
+    /** Stable, opaque user handle. Defaults to UTF-8 bytes of `userName`. */
+    userId?: Uint8Array;
+    userDisplayName?: string;
+    /** Raw challenge bytes (base64url-encoded into the options). */
+    challenge: Uint8Array;
+    residentKey?: ResidentKeyRequirement;
+    userVerification?: UserVerificationRequirement;
+    timeout?: number;
+}
+/** ES256-only credential parameter. The `alg: -7` literal is non-negotiable. */
+interface PubKeyCredParam {
+    type: 'public-key';
+    alg: -7;
+}
+interface PublicKeyCredentialCreationOptionsJSON {
+    rp: {
+        id: string;
+        name: string;
+    };
+    user: {
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    challenge: string;
+    pubKeyCredParams: PubKeyCredParam[];
+    authenticatorSelection: {
+        residentKey: ResidentKeyRequirement;
+        requireResidentKey: boolean;
+        userVerification: UserVerificationRequirement;
+    };
+    attestation: 'none';
+    timeout: number;
+}
+/**
+ * Build WebAuthn registration options that offer ES256 *and only* ES256
+ * (`pubKeyCredParams: [{ type: 'public-key', alg: -7 }]`) — invariant #1.
+ * Soroban verifies only secp256r1, so we never advertise any other algorithm.
+ */
+declare function buildCreateOptions(input: BuildCreateOptionsInput): PublicKeyCredentialCreationOptionsJSON;
+
+/**
+ * S12 (YK-438) — the two adapter interfaces. The ONLY infra coupling points, so
+ * the SDK is composable, not monolithic. Ceremonies (S13) depend on these
+ * interfaces, never on a concrete backend.
+ */
+interface SubmitResult {
+    status: 'SUCCESS' | 'PENDING' | 'FAILED';
+    /** Transaction hash (hex), when known. */
+    hash: string;
+    /** Decoded contract return value on success (implementation-defined). */
+    returnValue?: unknown;
+    /** base64 XDR of the failure result, when failed. */
+    errorResultXdr?: string;
+}
+/** How a signed operation reaches the network. */
+interface SubmissionAdapter {
+    send(signedTxXdr: string): Promise<SubmitResult>;
+}
+interface ResolvedAccount {
+    /** Soroban smart-account C-address. */
+    contractId: string;
+}
+/** credentialId → smart-account address lookup. */
+interface IndexerAdapter {
+    resolveByCredential(credentialId: string): Promise<ResolvedAccount[]>;
+}
+
+/** Normalized WebAuthn results + the pluggable dependencies the ceremonies use. */
+interface WebAuthnCreateResult {
+    /** base64url credential id. */
+    id: string;
+    rawId: Uint8Array;
+    attestationObject: Uint8Array;
+}
+interface WebAuthnGetResult {
+    id: string;
+    rawId: Uint8Array;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    /** DER signature as returned by the authenticator. */
+    signature: Uint8Array;
+}
+interface WebAuthnGetOptions {
+    rpId: string;
+    challenge?: Uint8Array;
+    /** base64url credential ids; empty/omitted ⇒ discoverable (recover path). */
+    allowCredentials?: string[];
+    mediation?: 'silent' | 'optional' | 'conditional' | 'required';
+    userVerification?: 'discouraged' | 'preferred' | 'required';
+}
+
+/** Abstraction over `navigator.credentials` so ceremonies are testable + isomorphic. */
+interface WebAuthnClient {
+    create(options: PublicKeyCredentialCreationOptionsJSON): Promise<WebAuthnCreateResult>;
+    get(options: WebAuthnGetOptions): Promise<WebAuthnGetResult>;
+}
+/** Per-rpId credential-id persistence (localStorage by default). */
+interface CredentialStorage {
+    get(rpId: string): string | null;
+    set(rpId: string, credentialId: string): void;
+}
+/**
+ * Deploys a smart account for a freshly-created passkey via the factory (through
+ * a SubmissionAdapter) and returns its C-address. Injected because the factory
+ * wiring is contract-specific (kalepail webauthn-wallet / OZ) — provided by the
+ * kit module (S17) / demo (S21); we don't reinvent the contract layer here.
+ */
+interface AccountDeployer {
+    deploy(input: {
+        publicKey: Uint8Array;
+        credentialId: string;
+    }): Promise<{
+        contractId: string;
+        txHash?: string;
+    }>;
+}
+
+export { type AccountDeployer as A, type BuildCreateOptionsInput as B, type CredentialStorage as C, type IndexerAdapter as I, type PubKeyCredParam as P, type ResidentKeyRequirement as R, type SubmissionAdapter as S, type UserVerificationRequirement as U, type WebAuthnClient as W, type PublicKeyCredentialCreationOptionsJSON as a, type ResolvedAccount as b, type SubmitResult as c, type WebAuthnCreateResult as d, type WebAuthnGetOptions as e, type WebAuthnGetResult as f, buildCreateOptions as g };

package/dist/types-dMRWEEo0.d.cts

@@ -0,0 +1,73 @@
+import './checkAuth-C2AcXqFe.cjs';
+import './types--WNl-Sda.cjs';
+import './sign-Cfg0NM0T.cjs';
+
+/**
+ * The frozen taxonomy of error codes the SDK can throw. This union is
+ * deliberately closed — every failure path maps to exactly one of these.
+ */
+declare const KIT_ERROR_CODES: readonly ["USER_CANCELLED", "ES256_NOT_SUPPORTED", "RP_ID_MISMATCH", "ORIGIN_MISMATCH", "CHALLENGE_MISMATCH", "INVALID_SIGNATURE_DER", "INVALID_PUBLIC_KEY", "CONTRACT_AUTH_FAILED", "NETWORK_ERROR", "UNSUPPORTED_AUTHENTICATOR"];
+type KitErrorCode = (typeof KIT_ERROR_CODES)[number];
+/** Structured error carrying a machine-readable {@link KitErrorCode}. */
+declare class KitError extends Error {
+    readonly code: KitErrorCode;
+    readonly name = "KitError";
+    constructor(code: KitErrorCode, message?: string, options?: {
+        cause?: unknown;
+    });
+}
+declare function isKitError(value: unknown): value is KitError;
+
+/**
+ * Stable identifiers for the three battle-tested anchors (S04 / YK-430) — the
+ * bugs that silently break ~50% of users. Referenced by stable name from the
+ * threat model (S14) and the compatibility matrix (S09) so each mitigation has
+ * one canonical id across code and docs.
+ */
+declare const BATTLE_TESTED_ANCHORS: Readonly<{
+    /** Apple Touch ID/Face ID emit high-S ~50% of the time; we normalize to low-S. */
+    readonly LOW_S_NORMALIZATION: "low-s-normalization";
+    /** Non-ES256 credentials (e.g. some Windows Hello configs) cannot verify on-chain. */
+    readonly RS256_HARD_FAIL: "rs256-hard-fail";
+    /** Safari requires create/get inside a user activation or it silently rejects. */
+    readonly APPLE_USER_GESTURE: "apple-user-gesture";
+}>;
+type BattleTestedAnchor = (typeof BATTLE_TESTED_ANCHORS)[keyof typeof BATTLE_TESTED_ANCHORS];
+/**
+ * Anchor `RS256_HARD_FAIL`. The Soroban webauthn-wallet verifies *only*
+ * secp256r1, so a non-ES256 credential would produce an unusable account.
+ * Hard-fail rather than continue (invariant #1).
+ */
+declare function assertES256(alg: number): void;
+interface UserActivationLike {
+    isActive: boolean;
+}
+/**
+ * Anchor `APPLE_USER_GESTURE`. `navigator.credentials.create/get` on
+ * Safari/WebKit must run inside a transient user activation (a real click/tap)
+ * or the promise silently rejects. Call this at the very top of a create/sign
+ * handler.
+ *
+ * UI pattern (for S18): never auto-trigger the ceremony from a mount/effect —
+ * always gate it behind an explicit user click, and surface `USER_CANCELLED`
+ * in the flow state machine. Lenient when `navigator.userActivation` is
+ * unavailable (non-browser / older engines) so the SDK stays isomorphic; pass
+ * an explicit `{ isActive }` to force the check.
+ */
+declare function assertUserActivation(activation?: UserActivationLike): void;
+
+/**
+ * `@soropass/core/types` — the shared type surface + error taxonomy.
+ */
+
+/** A passkey-backed Stellar smart account (populated by the S13 ceremonies). */
+interface PasskeyCredential {
+    /** Soroban contract (C…) address of the smart account. */
+    contractId: string;
+    /** base64url credential id returned by the authenticator. */
+    credentialId: string;
+    /** SEC-1 uncompressed public key (65 bytes). */
+    publicKey: Uint8Array;
+}
+
+export { BATTLE_TESTED_ANCHORS as B, KIT_ERROR_CODES as K, type PasskeyCredential as P, type BattleTestedAnchor as a, KitError as b, type KitErrorCode as c, assertES256 as d, assertUserActivation as e, isKitError as i };

package/dist/types-lW2h8Uxn.d.ts

@@ -0,0 +1,73 @@
+import './checkAuth-C2AcXqFe.js';
+import './types--WNl-Sda.js';
+import './sign-Cfg0NM0T.js';
+
+/**
+ * The frozen taxonomy of error codes the SDK can throw. This union is
+ * deliberately closed — every failure path maps to exactly one of these.
+ */
+declare const KIT_ERROR_CODES: readonly ["USER_CANCELLED", "ES256_NOT_SUPPORTED", "RP_ID_MISMATCH", "ORIGIN_MISMATCH", "CHALLENGE_MISMATCH", "INVALID_SIGNATURE_DER", "INVALID_PUBLIC_KEY", "CONTRACT_AUTH_FAILED", "NETWORK_ERROR", "UNSUPPORTED_AUTHENTICATOR"];
+type KitErrorCode = (typeof KIT_ERROR_CODES)[number];
+/** Structured error carrying a machine-readable {@link KitErrorCode}. */
+declare class KitError extends Error {
+    readonly code: KitErrorCode;
+    readonly name = "KitError";
+    constructor(code: KitErrorCode, message?: string, options?: {
+        cause?: unknown;
+    });
+}
+declare function isKitError(value: unknown): value is KitError;
+
+/**
+ * Stable identifiers for the three battle-tested anchors (S04 / YK-430) — the
+ * bugs that silently break ~50% of users. Referenced by stable name from the
+ * threat model (S14) and the compatibility matrix (S09) so each mitigation has
+ * one canonical id across code and docs.
+ */
+declare const BATTLE_TESTED_ANCHORS: Readonly<{
+    /** Apple Touch ID/Face ID emit high-S ~50% of the time; we normalize to low-S. */
+    readonly LOW_S_NORMALIZATION: "low-s-normalization";
+    /** Non-ES256 credentials (e.g. some Windows Hello configs) cannot verify on-chain. */
+    readonly RS256_HARD_FAIL: "rs256-hard-fail";
+    /** Safari requires create/get inside a user activation or it silently rejects. */
+    readonly APPLE_USER_GESTURE: "apple-user-gesture";
+}>;
+type BattleTestedAnchor = (typeof BATTLE_TESTED_ANCHORS)[keyof typeof BATTLE_TESTED_ANCHORS];
+/**
+ * Anchor `RS256_HARD_FAIL`. The Soroban webauthn-wallet verifies *only*
+ * secp256r1, so a non-ES256 credential would produce an unusable account.
+ * Hard-fail rather than continue (invariant #1).
+ */
+declare function assertES256(alg: number): void;
+interface UserActivationLike {
+    isActive: boolean;
+}
+/**
+ * Anchor `APPLE_USER_GESTURE`. `navigator.credentials.create/get` on
+ * Safari/WebKit must run inside a transient user activation (a real click/tap)
+ * or the promise silently rejects. Call this at the very top of a create/sign
+ * handler.
+ *
+ * UI pattern (for S18): never auto-trigger the ceremony from a mount/effect —
+ * always gate it behind an explicit user click, and surface `USER_CANCELLED`
+ * in the flow state machine. Lenient when `navigator.userActivation` is
+ * unavailable (non-browser / older engines) so the SDK stays isomorphic; pass
+ * an explicit `{ isActive }` to force the check.
+ */
+declare function assertUserActivation(activation?: UserActivationLike): void;
+
+/**
+ * `@soropass/core/types` — the shared type surface + error taxonomy.
+ */
+
+/** A passkey-backed Stellar smart account (populated by the S13 ceremonies). */
+interface PasskeyCredential {
+    /** Soroban contract (C…) address of the smart account. */
+    contractId: string;
+    /** base64url credential id returned by the authenticator. */
+    credentialId: string;
+    /** SEC-1 uncompressed public key (65 bytes). */
+    publicKey: Uint8Array;
+}
+
+export { BATTLE_TESTED_ANCHORS as B, KIT_ERROR_CODES as K, type PasskeyCredential as P, type BattleTestedAnchor as a, KitError as b, type KitErrorCode as c, assertES256 as d, assertUserActivation as e, isKitError as i };