@soropass/core 0.1.0

package/dist/chunk-JNJ2FY45.js

@@ -0,0 +1,209 @@
+import { utf8ToBytes, bytesToBase64Url, base64UrlToBytes, bytesToUtf8 } from './chunk-LB4HOTLV.js';
+import { KitError } from './chunk-AMYFJQAC.js';
+import { sha256 } from '@noble/hashes/sha256';
+export { sha256 } from '@noble/hashes/sha256';
+
+// src/internal/cbor.ts
+function byteAt(bytes, index) {
+  const value = bytes[index];
+  if (value === void 0) throw new Error(`CBOR: unexpected end of input at byte ${index}`);
+  return value;
+}
+var MAX_DEPTH = 16;
+function decodeCbor(bytes, offset = 0, depth = 0) {
+  if (depth > MAX_DEPTH) throw new Error("CBOR: maximum nesting depth exceeded");
+  const first = byteAt(bytes, offset);
+  const major = first >> 5;
+  const info = first & 31;
+  let pos = offset + 1;
+  let argument;
+  if (info < 24) {
+    argument = info;
+  } else if (info === 24) {
+    argument = byteAt(bytes, pos);
+    pos += 1;
+  } else if (info === 25) {
+    argument = byteAt(bytes, pos) << 8 | byteAt(bytes, pos + 1);
+    pos += 2;
+  } else if (info === 26) {
+    argument = byteAt(bytes, pos) * 16777216 + (byteAt(bytes, pos + 1) << 16) + (byteAt(bytes, pos + 2) << 8) + byteAt(bytes, pos + 3);
+    pos += 4;
+  } else {
+    throw new Error(`CBOR: unsupported length encoding (additional info ${info})`);
+  }
+  switch (major) {
+    case 0:
+      return { value: argument, length: pos - offset };
+    case 1:
+      return { value: -1 - argument, length: pos - offset };
+    case 2: {
+      const end = pos + argument;
+      if (end > bytes.length) throw new Error("CBOR: byte string exceeds input");
+      return { value: bytes.slice(pos, end), length: end - offset };
+    }
+    case 3: {
+      const end = pos + argument;
+      if (end > bytes.length) throw new Error("CBOR: text string exceeds input");
+      return { value: new TextDecoder().decode(bytes.slice(pos, end)), length: end - offset };
+    }
+    case 4: {
+      const items = [];
+      let cursor = pos;
+      for (let i = 0; i < argument; i += 1) {
+        const item = decodeCbor(bytes, cursor, depth + 1);
+        items.push(item.value);
+        cursor += item.length;
+      }
+      return { value: items, length: cursor - offset };
+    }
+    case 5: {
+      const map = /* @__PURE__ */ new Map();
+      let cursor = pos;
+      for (let i = 0; i < argument; i += 1) {
+        const key = decodeCbor(bytes, cursor, depth + 1);
+        cursor += key.length;
+        const val = decodeCbor(bytes, cursor, depth + 1);
+        cursor += val.length;
+        if (typeof key.value !== "number" && typeof key.value !== "string") {
+          throw new Error("CBOR: unsupported map key type");
+        }
+        if (map.has(key.value)) {
+          throw new Error("CBOR: duplicate map key (non-canonical)");
+        }
+        map.set(key.value, val.value);
+      }
+      return { value: map, length: cursor - offset };
+    }
+    default:
+      throw new Error(`CBOR: unsupported major type ${major}`);
+  }
+}
+function decodeCborFirst(bytes) {
+  return decodeCbor(bytes, 0).value;
+}
+
+// src/internal/bytes.ts
+function concatBytes(...arrays) {
+  const total = arrays.reduce((n, a) => n + a.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const a of arrays) {
+    out.set(a, offset);
+    offset += a.length;
+  }
+  return out;
+}
+function equalBytes(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return diff === 0;
+}
+
+// src/webauthn/authData.ts
+var MIN_LENGTH = 37;
+function parseAuthenticatorData(authData) {
+  if (authData.length < MIN_LENGTH) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      `authenticatorData is ${authData.length} bytes, expected at least ${MIN_LENGTH}`
+    );
+  }
+  const view = new DataView(authData.buffer, authData.byteOffset, authData.byteLength);
+  const rpIdHash = authData.slice(0, 32);
+  const bits = authData[32] ?? 0;
+  const flags = {
+    up: (bits & 1) !== 0,
+    uv: (bits & 4) !== 0,
+    be: (bits & 8) !== 0,
+    bs: (bits & 16) !== 0,
+    at: (bits & 64) !== 0,
+    ed: (bits & 128) !== 0,
+    bits
+  };
+  const signCount = view.getUint32(33, false);
+  const result = { rpIdHash, flags, signCount };
+  if (flags.at) {
+    if (authData.length < 55) {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        "authenticatorData truncated in attested data"
+      );
+    }
+    result.aaguid = authData.slice(37, 53);
+    const credIdLength = view.getUint16(53, false);
+    const credIdEnd = 55 + credIdLength;
+    if (authData.length < credIdEnd) {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        "authenticatorData truncated in credentialId"
+      );
+    }
+    result.credentialId = authData.slice(55, credIdEnd);
+    const rest = authData.slice(credIdEnd);
+    const { length } = decodeCbor(rest, 0);
+    result.credentialPublicKey = rest.slice(0, length);
+  }
+  return result;
+}
+function verifyRpIdHash(authData, rpId) {
+  const actual = parseAuthenticatorData(authData).rpIdHash;
+  const expected = sha256(utf8ToBytes(rpId));
+  if (!equalBytes(actual, expected)) {
+    throw new KitError(
+      "RP_ID_MISMATCH",
+      `authenticatorData rpIdHash does not match SHA-256("${rpId}")`
+    );
+  }
+}
+
+// src/webauthn/clientData.ts
+function encodeChallenge(challenge) {
+  return bytesToBase64Url(challenge);
+}
+function decodeChallenge(challenge) {
+  return base64UrlToBytes(challenge);
+}
+function parseClientDataJSON(clientDataJSON) {
+  let raw;
+  try {
+    raw = JSON.parse(bytesToUtf8(clientDataJSON));
+  } catch (cause) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is not valid JSON", { cause });
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is not a JSON object");
+  }
+  const obj = raw;
+  const { type, challenge, origin, crossOrigin } = obj;
+  if (typeof type !== "string" || typeof challenge !== "string" || typeof origin !== "string") {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is missing required fields");
+  }
+  return {
+    type,
+    challenge,
+    origin,
+    crossOrigin: typeof crossOrigin === "boolean" ? crossOrigin : void 0
+  };
+}
+function verifyClientDataJSON(clientDataJSON, expected) {
+  const data = parseClientDataJSON(clientDataJSON);
+  if (data.type !== "webauthn.get") {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      `clientDataJSON.type "${data.type}" is not "webauthn.get"`
+    );
+  }
+  const allowed = Array.isArray(expected.origin) ? expected.origin : [expected.origin];
+  if (!allowed.includes(data.origin)) {
+    throw new KitError("ORIGIN_MISMATCH", `origin "${data.origin}" not in [${allowed.join(", ")}]`);
+  }
+  if (data.challenge !== expected.challenge) {
+    throw new KitError("CHALLENGE_MISMATCH", "clientDataJSON challenge does not match expected");
+  }
+  return data;
+}
+
+export { concatBytes, decodeCborFirst, decodeChallenge, encodeChallenge, parseAuthenticatorData, parseClientDataJSON, verifyClientDataJSON, verifyRpIdHash };
+//# sourceMappingURL=chunk-JNJ2FY45.js.map
+//# sourceMappingURL=chunk-JNJ2FY45.js.map

package/dist/chunk-JNJ2FY45.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/cbor.ts","../src/internal/bytes.ts","../src/webauthn/authData.ts","../src/webauthn/clientData.ts"],"names":[],"mappings":";;;;;;AAkBA,SAAS,MAAA,CAAO,OAAmB,KAAA,EAAuB;AACxD,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAK,CAAA;AACzB,EAAA,IAAI,UAAU,MAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,KAAK,CAAA,CAAE,CAAA;AACzF,EAAA,OAAO,KAAA;AACT;AAGA,IAAM,SAAA,GAAY,EAAA;AAEX,SAAS,UAAA,CAAW,KAAA,EAAmB,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,EAAY;AAC5E,EAAA,IAAI,KAAA,GAAQ,SAAA,EAAW,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAC7E,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AAClC,EAAA,MAAM,QAAQ,KAAA,IAAS,CAAA;AACvB,EAAA,MAAM,OAAO,KAAA,GAAQ,EAAA;AACrB,EAAA,IAAI,MAAM,MAAA,GAAS,CAAA;AAEnB,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAO,EAAA,EAAI;AACb,IAAA,QAAA,GAAW,IAAA;AAAA,EACb,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GAAW,MAAA,CAAO,OAAO,GAAG,CAAA;AAC5B,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GAAY,MAAA,CAAO,OAAO,GAAG,CAAA,IAAK,IAAK,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA;AAC5D,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GACE,MAAA,CAAO,OAAO,GAAG,CAAA,GAAI,YACpB,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA,IAAK,OAC1B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA,IAAK,KAC3B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA;AACvB,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mDAAA,EAAsD,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/E;AAEA,EAAA,QAAQ,KAAA;AAAO,IACb,KAAK,CAAA;AACH,MAAA,OAAO,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACjD,KAAK,CAAA;AACH,MAAA,OAAO,EAAE,KAAA,EAAO,EAAA,GAAK,QAAA,EAAU,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACtD,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,MAAM,GAAA,GAAM,QAAA;AAClB,MAAA,IAAI,MAAM,KAAA,CAAM,MAAA,EAAQ,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACzE,MAAA,OAAO,EAAE,OAAO,KAAA,CAAM,KAAA,CAAM,KAAK,GAAG,CAAA,EAAG,MAAA,EAAQ,GAAA,GAAM,MAAA,EAAO;AAAA,IAC9D;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,MAAM,GAAA,GAAM,QAAA;AAClB,MAAA,IAAI,MAAM,KAAA,CAAM,MAAA,EAAQ,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACzE,MAAA,OAAO,EAAE,KAAA,EAAO,IAAI,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,GAAA,EAAK,GAAG,CAAC,CAAA,EAAG,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACxF;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,QAAqB,EAAC;AAC5B,MAAA,IAAI,MAAA,GAAS,GAAA;AACb,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,EAAU,KAAK,CAAA,EAAG;AACpC,QAAA,MAAM,IAAA,GAAO,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAChD,QAAA,KAAA,CAAM,IAAA,CAAK,KAAK,KAAK,CAAA;AACrB,QAAA,MAAA,IAAU,IAAA,CAAK,MAAA;AAAA,MACjB;AACA,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,SAAS,MAAA,EAAO;AAAA,IACjD;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,GAAA,uBAAmB,GAAA,EAAI;AAC7B,MAAA,IAAI,MAAA,GAAS,GAAA;AACb,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,EAAU,KAAK,CAAA,EAAG;AACpC,QAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAC/C,QAAA,MAAA,IAAU,GAAA,CAAI,MAAA;AACd,QAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAC/C,QAAA,MAAA,IAAU,GAAA,CAAI,MAAA;AACd,QAAA,IAAI,OAAO,GAAA,CAAI,KAAA,KAAU,YAAY,OAAO,GAAA,CAAI,UAAU,QAAA,EAAU;AAClE,UAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,QAClD;AACA,QAAA,IAAI,GAAA,CAAI,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AACtB,UAAA,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAAA,QAC3D;AACA,QAAA,GAAA,CAAI,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,GAAA,CAAI,KAAK,CAAA;AAAA,MAC9B;AACA,MAAA,OAAO,EAAE,KAAA,EAAO,GAAA,EAAK,MAAA,EAAQ,SAAS,MAAA,EAAO;AAAA,IAC/C;AAAA,IACA;AACE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,KAAK,CAAA,CAAE,CAAA;AAAA;AAE7D;AAEO,SAAS,gBAAgB,KAAA,EAA8B;AAC5D,EAAA,OAAO,UAAA,CAAW,KAAA,EAAO,CAAC,CAAA,CAAE,KAAA;AAC9B;;;AC3GO,SAAS,eAAe,MAAA,EAAkC;AAC/D,EAAA,MAAM,KAAA,GAAQ,OAAO,MAAA,CAAO,CAAC,GAAG,CAAA,KAAM,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,GAAA,CAAI,GAAA,CAAI,GAAG,MAAM,CAAA;AACjB,IAAA,MAAA,IAAU,CAAA,CAAE,MAAA;AAAA,EACd;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,UAAA,CAAW,GAAe,CAAA,EAAwB;AAChE,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,IAAK,CAAA,EAAG,IAAA,IAAA,CAAS,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA,CAAA;AACrE,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;;;ACeA,IAAM,UAAA,GAAa,EAAA;AAGZ,SAAS,uBAAuB,QAAA,EAA+C;AACpF,EAAA,IAAI,QAAA,CAAS,SAAS,UAAA,EAAY;AAChC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA,CAAA,qBAAA,EAAwB,QAAA,CAAS,MAAM,CAAA,0BAAA,EAA6B,UAAU,CAAA;AAAA,KAChF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAI,QAAA,CAAS,QAAA,CAAS,QAAQ,QAAA,CAAS,UAAA,EAAY,SAAS,UAAU,CAAA;AACnF,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACrC,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,EAAE,CAAA,IAAK,CAAA;AAC7B,EAAA,MAAM,KAAA,GAAgC;AAAA,IACpC,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,EAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,EAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,GAAA,MAAU,CAAA;AAAA,IACtB;AAAA,GACF;AACA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,EAAA,EAAI,KAAK,CAAA;AAE1C,EAAA,MAAM,MAAA,GAAkC,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAU;AAErE,EAAA,IAAI,MAAM,EAAA,EAAI;AACZ,IAAA,IAAI,QAAA,CAAS,SAAS,EAAA,EAAI;AACxB,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AACrC,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,SAAA,CAAU,EAAA,EAAI,KAAK,CAAA;AAC7C,IAAA,MAAM,YAAY,EAAA,GAAK,YAAA;AACvB,IAAA,IAAI,QAAA,CAAS,SAAS,SAAA,EAAW;AAC/B,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,YAAA,GAAe,QAAA,CAAS,KAAA,CAAM,EAAA,EAAI,SAAS,CAAA;AAGlD,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA;AACrC,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACrC,IAAA,MAAA,CAAO,mBAAA,GAAsB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,cAAA,CAAe,UAAsB,IAAA,EAAoB;AACvE,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,QAAQ,CAAA,CAAE,QAAA;AAChD,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,WAAA,CAAY,IAAI,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,UAAA,CAAW,MAAA,EAAQ,QAAQ,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,gBAAA;AAAA,MACA,sDAAsD,IAAI,CAAA,EAAA;AAAA,KAC5D;AAAA,EACF;AACF;;;ACnFO,SAAS,gBAAgB,SAAA,EAA+B;AAC7D,EAAA,OAAO,iBAAiB,SAAS,CAAA;AACnC;AAGO,SAAS,gBAAgB,SAAA,EAA+B;AAC7D,EAAA,OAAO,iBAAiB,SAAS,CAAA;AACnC;AAGO,SAAS,oBAAoB,cAAA,EAAwC;AAC1E,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,cAAc,CAAC,CAAA;AAAA,EAC9C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,kCAAA,EAAoC,EAAE,OAAO,CAAA;AAAA,EAC/F;AACA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC3C,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,qCAAqC,CAAA;AAAA,EACvF;AACA,EAAA,MAAM,GAAA,GAAM,GAAA;AACZ,EAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,aAAY,GAAI,GAAA;AACjD,EAAA,IAAI,OAAO,SAAS,QAAA,IAAY,OAAO,cAAc,QAAA,IAAY,OAAO,WAAW,QAAA,EAAU;AAC3F,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,2CAA2C,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,WAAA,EAAa,OAAO,WAAA,KAAgB,SAAA,GAAY,WAAA,GAAc;AAAA,GAChE;AACF;AAOO,SAAS,oBAAA,CACd,gBACA,QAAA,EACY;AACZ,EAAA,MAAM,IAAA,GAAO,oBAAoB,cAAc,CAAA;AAC/C,EAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA,CAAA,qBAAA,EAAwB,KAAK,IAAI,CAAA,uBAAA;AAAA,KACnC;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,MAAM,IAAI,QAAA,CAAS,MAAA,GAAS,CAAC,QAAA,CAAS,MAAM,CAAA;AACnF,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,QAAA,CAAS,iBAAA,EAAmB,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,CAAA,UAAA,EAAa,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,IAAA,CAAK,SAAA,KAAc,QAAA,CAAS,SAAA,EAAW;AACzC,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,kDAAkD,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-JNJ2FY45.js","sourcesContent":["/**\n * A minimal CBOR (RFC 8949) decoder — only the major types WebAuthn needs:\n * unsigned ints, negative ints, byte strings, text strings, arrays and maps,\n * with 1/2/4-byte length prefixes. Indefinite lengths, tags, floats and\n * 8-byte lengths are intentionally unsupported (COSE keys and attestation\n * objects never use them) and throw. This keeps the SDK dependency-free while\n * staying robust — it is fully fixture-tested. It replaces passkey-kit's\n * hardcoded byte-offset scanning, which had no bounds checks.\n */\nexport type CborValue = number | bigint | Uint8Array | string | CborValue[] | CborMap;\nexport type CborMap = Map<number | string, CborValue>;\n\ninterface Decoded {\n  value: CborValue;\n  /** Total bytes consumed starting at the requested offset. */\n  length: number;\n}\n\nfunction byteAt(bytes: Uint8Array, index: number): number {\n  const value = bytes[index];\n  if (value === undefined) throw new Error(`CBOR: unexpected end of input at byte ${index}`);\n  return value;\n}\n\n/** Decode the first CBOR item at `offset`, returning its value and byte length. */\nconst MAX_DEPTH = 16; // COSE keys / attestation objects nest at most ~3 levels.\n\nexport function decodeCbor(bytes: Uint8Array, offset = 0, depth = 0): Decoded {\n  if (depth > MAX_DEPTH) throw new Error('CBOR: maximum nesting depth exceeded');\n  const first = byteAt(bytes, offset);\n  const major = first >> 5;\n  const info = first & 0x1f;\n  let pos = offset + 1;\n\n  let argument: number;\n  if (info < 24) {\n    argument = info;\n  } else if (info === 24) {\n    argument = byteAt(bytes, pos);\n    pos += 1;\n  } else if (info === 25) {\n    argument = (byteAt(bytes, pos) << 8) | byteAt(bytes, pos + 1);\n    pos += 2;\n  } else if (info === 26) {\n    argument =\n      byteAt(bytes, pos) * 0x1000000 +\n      (byteAt(bytes, pos + 1) << 16) +\n      (byteAt(bytes, pos + 2) << 8) +\n      byteAt(bytes, pos + 3);\n    pos += 4;\n  } else {\n    throw new Error(`CBOR: unsupported length encoding (additional info ${info})`);\n  }\n\n  switch (major) {\n    case 0: // unsigned integer\n      return { value: argument, length: pos - offset };\n    case 1: // negative integer\n      return { value: -1 - argument, length: pos - offset };\n    case 2: {\n      // byte string\n      const end = pos + argument;\n      if (end > bytes.length) throw new Error('CBOR: byte string exceeds input');\n      return { value: bytes.slice(pos, end), length: end - offset };\n    }\n    case 3: {\n      // text string (UTF-8)\n      const end = pos + argument;\n      if (end > bytes.length) throw new Error('CBOR: text string exceeds input');\n      return { value: new TextDecoder().decode(bytes.slice(pos, end)), length: end - offset };\n    }\n    case 4: {\n      // array\n      const items: CborValue[] = [];\n      let cursor = pos;\n      for (let i = 0; i < argument; i += 1) {\n        const item = decodeCbor(bytes, cursor, depth + 1);\n        items.push(item.value);\n        cursor += item.length;\n      }\n      return { value: items, length: cursor - offset };\n    }\n    case 5: {\n      // map\n      const map: CborMap = new Map();\n      let cursor = pos;\n      for (let i = 0; i < argument; i += 1) {\n        const key = decodeCbor(bytes, cursor, depth + 1);\n        cursor += key.length;\n        const val = decodeCbor(bytes, cursor, depth + 1);\n        cursor += val.length;\n        if (typeof key.value !== 'number' && typeof key.value !== 'string') {\n          throw new Error('CBOR: unsupported map key type');\n        }\n        if (map.has(key.value)) {\n          throw new Error('CBOR: duplicate map key (non-canonical)');\n        }\n        map.set(key.value, val.value);\n      }\n      return { value: map, length: cursor - offset };\n    }\n    default:\n      throw new Error(`CBOR: unsupported major type ${major}`);\n  }\n}\n\nexport function decodeCborFirst(bytes: Uint8Array): CborValue {\n  return decodeCbor(bytes, 0).value;\n}\n","/** Concatenate byte arrays into one. */\nexport function concatBytes(...arrays: Uint8Array[]): Uint8Array {\n  const total = arrays.reduce((n, a) => n + a.length, 0);\n  const out = new Uint8Array(total);\n  let offset = 0;\n  for (const a of arrays) {\n    out.set(a, offset);\n    offset += a.length;\n  }\n  return out;\n}\n\n/** Length-safe, constant-time-ish byte equality. */\nexport function equalBytes(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i += 1) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);\n  return diff === 0;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n  let hex = '';\n  for (const byte of bytes) hex += byte.toString(16).padStart(2, '0');\n  return hex;\n}\n","import { KitError } from '../errors';\nimport { decodeCbor } from '../internal/cbor';\nimport { sha256 } from '../internal/sha256';\nimport { equalBytes } from '../internal/bytes';\nimport { utf8ToBytes } from '../internal/encoding';\n\nexport interface AuthenticatorDataFlags {\n  /** User Present */\n  up: boolean;\n  /** User Verified */\n  uv: boolean;\n  /** Backup Eligible */\n  be: boolean;\n  /** Backup State */\n  bs: boolean;\n  /** Attested credential data present */\n  at: boolean;\n  /** Extension data present */\n  ed: boolean;\n  /** Raw flags byte. */\n  bits: number;\n}\n\nexport interface ParsedAuthenticatorData {\n  rpIdHash: Uint8Array;\n  flags: AuthenticatorDataFlags;\n  signCount: number;\n  aaguid?: Uint8Array;\n  credentialId?: Uint8Array;\n  /** Raw CBOR-encoded COSE public key (exact bytes), if attested data present. */\n  credentialPublicKey?: Uint8Array;\n}\n\nconst MIN_LENGTH = 37; // rpIdHash(32) + flags(1) + signCount(4)\n\n/** Parse the authenticatorData byte structure (WebAuthn §6.1). */\nexport function parseAuthenticatorData(authData: Uint8Array): ParsedAuthenticatorData {\n  if (authData.length < MIN_LENGTH) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      `authenticatorData is ${authData.length} bytes, expected at least ${MIN_LENGTH}`,\n    );\n  }\n  const view = new DataView(authData.buffer, authData.byteOffset, authData.byteLength);\n  const rpIdHash = authData.slice(0, 32);\n  const bits = authData[32] ?? 0;\n  const flags: AuthenticatorDataFlags = {\n    up: (bits & 0x01) !== 0,\n    uv: (bits & 0x04) !== 0,\n    be: (bits & 0x08) !== 0,\n    bs: (bits & 0x10) !== 0,\n    at: (bits & 0x40) !== 0,\n    ed: (bits & 0x80) !== 0,\n    bits,\n  };\n  const signCount = view.getUint32(33, false);\n\n  const result: ParsedAuthenticatorData = { rpIdHash, flags, signCount };\n\n  if (flags.at) {\n    if (authData.length < 55) {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        'authenticatorData truncated in attested data',\n      );\n    }\n    result.aaguid = authData.slice(37, 53);\n    const credIdLength = view.getUint16(53, false);\n    const credIdEnd = 55 + credIdLength;\n    if (authData.length < credIdEnd) {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        'authenticatorData truncated in credentialId',\n      );\n    }\n    result.credentialId = authData.slice(55, credIdEnd);\n    // The COSE public key is the next CBOR item; capture its exact bytes so we\n    // stop cleanly before any extension data (when flags.ed is set).\n    const rest = authData.slice(credIdEnd);\n    const { length } = decodeCbor(rest, 0);\n    result.credentialPublicKey = rest.slice(0, length);\n  }\n\n  return result;\n}\n\n/** Verify that authenticatorData's rpIdHash equals SHA-256(rpId). */\nexport function verifyRpIdHash(authData: Uint8Array, rpId: string): void {\n  const actual = parseAuthenticatorData(authData).rpIdHash;\n  const expected = sha256(utf8ToBytes(rpId));\n  if (!equalBytes(actual, expected)) {\n    throw new KitError(\n      'RP_ID_MISMATCH',\n      `authenticatorData rpIdHash does not match SHA-256(\"${rpId}\")`,\n    );\n  }\n}\n","import { KitError } from '../errors';\nimport { base64UrlToBytes, bytesToBase64Url, bytesToUtf8 } from '../internal/encoding';\n\n/** The subset of clientDataJSON fields we rely on. */\nexport interface ClientData {\n  type: string;\n  /** base64url-encoded challenge as embedded by the client. */\n  challenge: string;\n  origin: string;\n  crossOrigin?: boolean;\n}\n\n/** Encode a raw challenge as the base64url string embedded in clientDataJSON. */\nexport function encodeChallenge(challenge: Uint8Array): string {\n  return bytesToBase64Url(challenge);\n}\n\n/** Decode the base64url challenge embedded in clientDataJSON back to bytes. */\nexport function decodeChallenge(challenge: string): Uint8Array {\n  return base64UrlToBytes(challenge);\n}\n\n/** Parse clientDataJSON bytes into a typed, validated-shape object. */\nexport function parseClientDataJSON(clientDataJSON: Uint8Array): ClientData {\n  let raw: unknown;\n  try {\n    raw = JSON.parse(bytesToUtf8(clientDataJSON));\n  } catch (cause) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is not valid JSON', { cause });\n  }\n  if (typeof raw !== 'object' || raw === null) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is not a JSON object');\n  }\n  const obj = raw as Record<string, unknown>;\n  const { type, challenge, origin, crossOrigin } = obj;\n  if (typeof type !== 'string' || typeof challenge !== 'string' || typeof origin !== 'string') {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is missing required fields');\n  }\n  return {\n    type,\n    challenge,\n    origin,\n    crossOrigin: typeof crossOrigin === 'boolean' ? crossOrigin : undefined,\n  };\n}\n\n/**\n * Parse and verify clientDataJSON for an authentication (`webauthn.get`)\n * assertion: the ceremony type, the origin (exact match against one or more\n * allowed origins), and the embedded challenge (base64url string).\n */\nexport function verifyClientDataJSON(\n  clientDataJSON: Uint8Array,\n  expected: { origin: string | string[]; challenge: string },\n): ClientData {\n  const data = parseClientDataJSON(clientDataJSON);\n  if (data.type !== 'webauthn.get') {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      `clientDataJSON.type \"${data.type}\" is not \"webauthn.get\"`,\n    );\n  }\n  const allowed = Array.isArray(expected.origin) ? expected.origin : [expected.origin];\n  if (!allowed.includes(data.origin)) {\n    throw new KitError('ORIGIN_MISMATCH', `origin \"${data.origin}\" not in [${allowed.join(', ')}]`);\n  }\n  if (data.challenge !== expected.challenge) {\n    throw new KitError('CHALLENGE_MISMATCH', 'clientDataJSON challenge does not match expected');\n  }\n  return data;\n}\n"]}

package/dist/chunk-LB4HOTLV.js

@@ -0,0 +1,135 @@
+import { KitError } from './chunk-AMYFJQAC.js';
+
+// src/internal/encoding.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const binary = atob(padded);
+  const out = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function utf8ToBytes(text) {
+  return new TextEncoder().encode(text);
+}
+function bytesToUtf8(bytes) {
+  return new TextDecoder().decode(bytes);
+}
+
+// src/ceremonies/random.ts
+function randomBytes(length) {
+  const webcrypto = globalThis.crypto;
+  if (typeof webcrypto?.getRandomValues !== "function") {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "no secure random source (globalThis.crypto.getRandomValues) is available in this environment"
+    );
+  }
+  const out = new Uint8Array(new ArrayBuffer(length));
+  webcrypto.getRandomValues(out);
+  return out;
+}
+
+// src/ceremonies/browserClient.ts
+function asKitError(error) {
+  if (error instanceof KitError) return error;
+  const name = typeof error === "object" && error !== null && "name" in error ? error.name : void 0;
+  if (name === "NotAllowedError") {
+    return new KitError("USER_CANCELLED", "The passkey prompt was dismissed.", { cause: error });
+  }
+  const message = error instanceof Error ? error.message : "WebAuthn request failed";
+  const detail = typeof name === "string" ? `${name}: ${message}` : message;
+  return new KitError("UNSUPPORTED_AUTHENTICATOR", detail, { cause: error });
+}
+function browserWebAuthnClient() {
+  const credentials = globalThis.navigator?.credentials;
+  if (!credentials) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "navigator.credentials is unavailable");
+  }
+  return {
+    async create(options) {
+      const publicKey = {
+        challenge: base64UrlToBytes(options.challenge),
+        rp: options.rp,
+        user: {
+          id: base64UrlToBytes(options.user.id),
+          name: options.user.name,
+          displayName: options.user.displayName
+        },
+        pubKeyCredParams: options.pubKeyCredParams,
+        authenticatorSelection: options.authenticatorSelection,
+        attestation: options.attestation,
+        timeout: options.timeout
+      };
+      let credential;
+      try {
+        credential = await credentials.create({ publicKey });
+      } catch (error) {
+        throw asKitError(error);
+      }
+      if (!credential) throw new KitError("USER_CANCELLED", "credential creation returned null");
+      const response = credential.response;
+      return {
+        id: credential.id,
+        rawId: new Uint8Array(credential.rawId),
+        attestationObject: new Uint8Array(response.attestationObject)
+      };
+    },
+    async get(options) {
+      const publicKey = {
+        rpId: options.rpId,
+        challenge: options.challenge ? new Uint8Array(options.challenge) : randomBytes(32),
+        allowCredentials: (options.allowCredentials ?? []).map((id) => ({
+          type: "public-key",
+          id: base64UrlToBytes(id)
+        })),
+        userVerification: options.userVerification
+      };
+      const request = { publicKey };
+      if (options.mediation) request.mediation = options.mediation;
+      let credential;
+      try {
+        credential = await credentials.get(request);
+      } catch (error) {
+        throw asKitError(error);
+      }
+      if (!credential) throw new KitError("USER_CANCELLED", "assertion returned null");
+      const response = credential.response;
+      return {
+        id: credential.id,
+        rawId: new Uint8Array(credential.rawId),
+        authenticatorData: new Uint8Array(response.authenticatorData),
+        clientDataJSON: new Uint8Array(response.clientDataJSON),
+        signature: new Uint8Array(response.signature)
+      };
+    }
+  };
+}
+function defaultCredentialStorage() {
+  const key = (rpId) => `stellar-passkey:${rpId}`;
+  const ls = globalThis.localStorage;
+  if (ls) {
+    return {
+      get: (rpId) => ls.getItem(key(rpId)),
+      set: (rpId, credentialId) => {
+        ls.setItem(key(rpId), credentialId);
+      }
+    };
+  }
+  const memory = /* @__PURE__ */ new Map();
+  return {
+    get: (rpId) => memory.get(rpId) ?? null,
+    set: (rpId, credentialId) => {
+      memory.set(rpId, credentialId);
+    }
+  };
+}
+
+export { base64UrlToBytes, browserWebAuthnClient, bytesToBase64Url, bytesToUtf8, defaultCredentialStorage, randomBytes, utf8ToBytes };
+//# sourceMappingURL=chunk-LB4HOTLV.js.map
+//# sourceMappingURL=chunk-LB4HOTLV.js.map

package/dist/chunk-LB4HOTLV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/encoding.ts","../src/ceremonies/random.ts","../src/ceremonies/browserClient.ts"],"names":[],"mappings":";;;AAOO,SAAS,iBAAiB,KAAA,EAA2B;AAC1D,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,iBAAiB,KAAA,EAAwC;AACvE,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,SAAS,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,MAAA,CAAO,MAAA,GAAS,KAAM,CAAC,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAA,CAAO,MAAM,CAAC,CAAA;AACzD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,YAAY,IAAA,EAA0B;AACpD,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA;AACtC;AAEO,SAAS,YAAY,KAAA,EAA2B;AACrD,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AACvC;;;ACtBO,SAAS,YAAY,MAAA,EAAyC;AACnE,EAAA,MAAM,YAAY,UAAA,CAAW,MAAA;AAC7B,EAAA,IAAI,OAAO,SAAA,EAAW,eAAA,KAAoB,UAAA,EAAY;AACpD,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAM,CAAC,CAAA;AAClD,EAAA,SAAA,CAAU,gBAAgB,GAAG,CAAA;AAC7B,EAAA,OAAO,GAAA;AACT;;;ACAA,SAAS,WAAW,KAAA,EAA0B;AAC5C,EAAA,IAAI,KAAA,YAAiB,UAAU,OAAO,KAAA;AACtC,EAAA,MAAM,IAAA,GACJ,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,IAAA,IAAQ,MAAA,IAAU,KAAA,GACpD,KAAA,CAA6B,IAAA,GAC9B,MAAA;AACN,EAAA,IAAI,SAAS,iBAAA,EAAmB;AAC9B,IAAA,OAAO,IAAI,QAAA,CAAS,gBAAA,EAAkB,qCAAqC,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,yBAAA;AAGzD,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,KAAS,QAAA,GAAW,GAAG,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,GAAK,OAAA;AAClE,EAAA,OAAO,IAAI,QAAA,CAAS,2BAAA,EAA6B,QAAQ,EAAE,KAAA,EAAO,OAAO,CAAA;AAC3E;AAGO,SAAS,qBAAA,GAAwC;AACtD,EAAA,MAAM,WAAA,GAAe,WAAyC,SAAA,EAAW,WAAA;AACzE,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,sCAAsC,CAAA;AAAA,EACxF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,OAAO,OAAA,EAAgF;AAC3F,MAAA,MAAM,SAAA,GAAgD;AAAA,QACpD,SAAA,EAAW,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAAA,QAC7C,IAAI,OAAA,CAAQ,EAAA;AAAA,QACZ,IAAA,EAAM;AAAA,UACJ,EAAA,EAAI,gBAAA,CAAiB,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAA;AAAA,UACpC,IAAA,EAAM,QAAQ,IAAA,CAAK,IAAA;AAAA,UACnB,WAAA,EAAa,QAAQ,IAAA,CAAK;AAAA,SAC5B;AAAA,QACA,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,QAC1B,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,QAChC,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,SAAS,OAAA,CAAQ;AAAA,OACnB;AACA,MAAA,IAAI,UAAA;AACJ,MAAA,IAAI;AACF,QAAA,UAAA,GAAc,MAAM,WAAA,CAAY,MAAA,CAAO,EAAE,WAAW,CAAA;AAAA,MACtD,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,WAAW,KAAK,CAAA;AAAA,MACxB;AACA,MAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,QAAA,CAAS,kBAAkB,mCAAmC,CAAA;AACzF,MAAA,MAAM,WAAW,UAAA,CAAW,QAAA;AAC5B,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,KAAA,EAAO,IAAI,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA;AAAA,QACtC,iBAAA,EAAmB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB;AAAA,OAC9D;AAAA,IACF,CAAA;AAAA,IACA,MAAM,IAAI,OAAA,EAAyD;AACjE,MAAA,MAAM,SAAA,GAA+C;AAAA,QACnD,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,SAAA,EAAW,QAAQ,SAAA,GAAY,IAAI,WAAW,OAAA,CAAQ,SAAS,CAAA,GAAI,WAAA,CAAY,EAAE,CAAA;AAAA,QACjF,mBAAmB,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA,CAAI,CAAC,EAAA,MAAQ;AAAA,UAC9D,IAAA,EAAM,YAAA;AAAA,UACN,EAAA,EAAI,iBAAiB,EAAE;AAAA,SACzB,CAAE,CAAA;AAAA,QACF,kBAAkB,OAAA,CAAQ;AAAA,OAC5B;AACA,MAAA,MAAM,OAAA,GAAoC,EAAE,SAAA,EAAU;AACtD,MAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,OAAA,CAAQ,SAAA,GAAY,OAAA,CAAQ,SAAA;AACnD,MAAA,IAAI,UAAA;AACJ,MAAA,IAAI;AACF,QAAA,UAAA,GAAc,MAAM,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MAC7C,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,WAAW,KAAK,CAAA;AAAA,MACxB;AACA,MAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,QAAA,CAAS,kBAAkB,yBAAyB,CAAA;AAC/E,MAAA,MAAM,WAAW,UAAA,CAAW,QAAA;AAC5B,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,KAAA,EAAO,IAAI,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA;AAAA,QACtC,iBAAA,EAAmB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB,CAAA;AAAA,QAC5D,cAAA,EAAgB,IAAI,UAAA,CAAW,QAAA,CAAS,cAAc,CAAA;AAAA,QACtD,SAAA,EAAW,IAAI,UAAA,CAAW,QAAA,CAAS,SAAS;AAAA,OAC9C;AAAA,IACF;AAAA,GACF;AACF;AAGO,SAAS,wBAAA,GAA8C;AAC5D,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAyB,CAAA,gBAAA,EAAmB,IAAI,CAAA,CAAA;AAC7D,EAAA,MAAM,KAAM,UAAA,CAA0C,YAAA;AACtD,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,OAAO;AAAA,MACL,KAAK,CAAC,IAAA,KAAS,GAAG,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,MACnC,GAAA,EAAK,CAAC,IAAA,EAAM,YAAA,KAAiB;AAC3B,QAAA,EAAA,CAAG,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,YAAY,CAAA;AAAA,MACpC;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,OAAO;AAAA,IACL,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA;AAAA,IACnC,GAAA,EAAK,CAAC,IAAA,EAAM,YAAA,KAAiB;AAC3B,MAAA,MAAA,CAAO,GAAA,CAAI,MAAM,YAAY,CAAA;AAAA,IAC/B;AAAA,GACF;AACF","file":"chunk-LB4HOTLV.js","sourcesContent":["/**\n * Isomorphic base64url + UTF-8 codecs. `atob`/`btoa`/`TextEncoder`/`TextDecoder`\n * are globals in modern browsers and Node >= 16, so no platform branch is\n * needed and nothing is bundled.\n */\n\n/** Encode bytes as unpadded base64url. */\nexport function bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Decode base64 or base64url (padding optional) to bytes. */\nexport function base64UrlToBytes(input: string): Uint8Array<ArrayBuffer> {\n  const base64 = input.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n  const binary = atob(padded);\n  const out = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\n\nexport function utf8ToBytes(text: string): Uint8Array {\n  return new TextEncoder().encode(text);\n}\n\nexport function bytesToUtf8(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes);\n}\n","import { KitError } from '../errors';\n\n/**\n * Cryptographically-random bytes, isomorphic (browser + Node global crypto).\n * Throws instead of silently returning all-zero bytes when no secure RNG is\n * present — an all-zero challenge would be catastrophic, not a soft fallback.\n */\nexport function randomBytes(length: number): Uint8Array<ArrayBuffer> {\n  const webcrypto = globalThis.crypto as Crypto | undefined;\n  if (typeof webcrypto?.getRandomValues !== 'function') {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'no secure random source (globalThis.crypto.getRandomValues) is available in this environment',\n    );\n  }\n  const out = new Uint8Array(new ArrayBuffer(length));\n  webcrypto.getRandomValues(out);\n  return out;\n}\n","import { KitError } from '../errors';\nimport { base64UrlToBytes } from '../internal/encoding';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '../webauthn/createOptions';\nimport { randomBytes } from './random';\nimport type {\n  CredentialStorage,\n  WebAuthnClient,\n  WebAuthnCreateResult,\n  WebAuthnGetOptions,\n  WebAuthnGetResult,\n} from './types';\n\n/**\n * Map a `navigator.credentials` rejection to a `KitError`. Dismissing the OS\n * passkey sheet rejects with a `NotAllowedError` (a DOMException) — surface that\n * as `USER_CANCELLED` so the UI shows the true \"you cancelled\" copy instead of\n * the generic unsupported-authenticator fallback (S20 / S04 polish).\n */\nfunction asKitError(error: unknown): KitError {\n  if (error instanceof KitError) return error;\n  const name =\n    typeof error === 'object' && error !== null && 'name' in error\n      ? (error as { name?: unknown }).name\n      : undefined;\n  if (name === 'NotAllowedError') {\n    return new KitError('USER_CANCELLED', 'The passkey prompt was dismissed.', { cause: error });\n  }\n  const message = error instanceof Error ? error.message : 'WebAuthn request failed';\n  // Preserve the original DOMException name (e.g. InvalidStateError / ConstraintError)\n  // in the message so diagnostics show the true cause, not just the generic bucket.\n  const detail = typeof name === 'string' ? `${name}: ${message}` : message;\n  return new KitError('UNSUPPORTED_AUTHENTICATOR', detail, { cause: error });\n}\n\n/** The browser `WebAuthnClient` backed by `navigator.credentials`. */\nexport function browserWebAuthnClient(): WebAuthnClient {\n  const credentials = (globalThis as { navigator?: Navigator }).navigator?.credentials;\n  if (!credentials) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'navigator.credentials is unavailable');\n  }\n  return {\n    async create(options: PublicKeyCredentialCreationOptionsJSON): Promise<WebAuthnCreateResult> {\n      const publicKey: PublicKeyCredentialCreationOptions = {\n        challenge: base64UrlToBytes(options.challenge),\n        rp: options.rp,\n        user: {\n          id: base64UrlToBytes(options.user.id),\n          name: options.user.name,\n          displayName: options.user.displayName,\n        },\n        pubKeyCredParams: options.pubKeyCredParams,\n        authenticatorSelection: options.authenticatorSelection,\n        attestation: options.attestation,\n        timeout: options.timeout,\n      };\n      let credential: PublicKeyCredential | null;\n      try {\n        credential = (await credentials.create({ publicKey })) as PublicKeyCredential | null;\n      } catch (error) {\n        throw asKitError(error);\n      }\n      if (!credential) throw new KitError('USER_CANCELLED', 'credential creation returned null');\n      const response = credential.response as AuthenticatorAttestationResponse;\n      return {\n        id: credential.id,\n        rawId: new Uint8Array(credential.rawId),\n        attestationObject: new Uint8Array(response.attestationObject),\n      };\n    },\n    async get(options: WebAuthnGetOptions): Promise<WebAuthnGetResult> {\n      const publicKey: PublicKeyCredentialRequestOptions = {\n        rpId: options.rpId,\n        challenge: options.challenge ? new Uint8Array(options.challenge) : randomBytes(32),\n        allowCredentials: (options.allowCredentials ?? []).map((id) => ({\n          type: 'public-key',\n          id: base64UrlToBytes(id),\n        })),\n        userVerification: options.userVerification,\n      };\n      const request: CredentialRequestOptions = { publicKey };\n      if (options.mediation) request.mediation = options.mediation;\n      let credential: PublicKeyCredential | null;\n      try {\n        credential = (await credentials.get(request)) as PublicKeyCredential | null;\n      } catch (error) {\n        throw asKitError(error);\n      }\n      if (!credential) throw new KitError('USER_CANCELLED', 'assertion returned null');\n      const response = credential.response as AuthenticatorAssertionResponse;\n      return {\n        id: credential.id,\n        rawId: new Uint8Array(credential.rawId),\n        authenticatorData: new Uint8Array(response.authenticatorData),\n        clientDataJSON: new Uint8Array(response.clientDataJSON),\n        signature: new Uint8Array(response.signature),\n      };\n    },\n  };\n}\n\n/** localStorage-backed credential store, with an in-memory fallback (Node/SSR). */\nexport function defaultCredentialStorage(): CredentialStorage {\n  const key = (rpId: string): string => `stellar-passkey:${rpId}`;\n  const ls = (globalThis as { localStorage?: Storage }).localStorage;\n  if (ls) {\n    return {\n      get: (rpId) => ls.getItem(key(rpId)),\n      set: (rpId, credentialId) => {\n        ls.setItem(key(rpId), credentialId);\n      },\n    };\n  }\n  const memory = new Map<string, string>();\n  return {\n    get: (rpId) => memory.get(rpId) ?? null,\n    set: (rpId, credentialId) => {\n      memory.set(rpId, credentialId);\n    },\n  };\n}\n"]}

package/dist/chunk-LM2AZXKZ.js

@@ -0,0 +1,108 @@
+import { authEntryChallengeBytes } from './chunk-BIRF5I6I.js';
+import { sha256, concatBytes } from './chunk-JNJ2FY45.js';
+import { browserWebAuthnClient, base64UrlToBytes, bytesToUtf8, bytesToBase64Url } from './chunk-LB4HOTLV.js';
+import '@stellar/stellar-sdk';
+import { p256 } from '@noble/curves/nist';
+
+// src/ceremonies/browserSigner.ts
+function browserPasskeySigner(options) {
+  const webauthn = options.webauthn ?? browserWebAuthnClient();
+  return async (challenge) => {
+    const assertion = await webauthn.get({
+      rpId: options.rpId,
+      challenge: base64UrlToBytes(challenge),
+      allowCredentials: options.allowCredentials ?? [],
+      userVerification: options.userVerification ?? "preferred"
+    });
+    return {
+      authenticatorData: assertion.authenticatorData,
+      clientDataJSON: assertion.clientDataJSON,
+      signature: assertion.signature,
+      credentialId: assertion.rawId
+    };
+  };
+}
+function fail(reason) {
+  return { success: false, challengeBound: false, signatureValid: false, reason };
+}
+function verifySecp256r1StructMap(structMap, publicKey, signaturePayload) {
+  const field = (name) => {
+    const e = structMap.find((x) => x.key().sym().toString() === name);
+    return e ? new Uint8Array(e.val().bytes()) : void 0;
+  };
+  const authenticatorData = field("authenticator_data");
+  const clientDataJSON = field("client_data_json");
+  const signature = field("signature");
+  if (!authenticatorData || !clientDataJSON || !signature) {
+    return { ok: false, challengeBound: false, signatureValid: false, reason: "missing fields" };
+  }
+  if (signature.length !== 64) {
+    return {
+      ok: false,
+      challengeBound: false,
+      signatureValid: false,
+      reason: "not 64-byte compact"
+    };
+  }
+  let challengeBound = false;
+  try {
+    const cdj = JSON.parse(bytesToUtf8(clientDataJSON));
+    challengeBound = cdj.challenge === bytesToBase64Url(signaturePayload);
+  } catch {
+    challengeBound = false;
+  }
+  const digest = sha256(concatBytes(authenticatorData, sha256(clientDataJSON)));
+  const signatureValid = p256.verify(signature, digest, publicKey, {
+    lowS: false,
+    format: "compact"
+  });
+  return { ok: challengeBound && signatureValid, challengeBound, signatureValid };
+}
+function referenceCheckAuth(entry, publicKey, networkPassphrase) {
+  if (entry.credentials().switch().name !== "sorobanCredentialsAddress") {
+    return fail("no address credentials");
+  }
+  const structMap = entry.credentials().address().signature().map();
+  if (!structMap) return fail("signature is not a Secp256r1Signature map");
+  const signaturePayload = authEntryChallengeBytes(entry, networkPassphrase);
+  const r = verifySecp256r1StructMap(structMap, publicKey, signaturePayload);
+  return { success: r.ok, challengeBound: r.challengeBound, signatureValid: r.signatureValid };
+}
+function referenceSmartWalletCheckAuth(entry, publicKeyFor, networkPassphrase) {
+  if (entry.credentials().switch().name !== "sorobanCredentialsAddress") {
+    return { success: false, signers: [], reason: "no address credentials" };
+  }
+  const sig = entry.credentials().address().signature();
+  const map = sig.switch().name === "scvVec" ? sig.vec()?.[0]?.map() : void 0;
+  if (!map) {
+    return { success: false, signers: [], reason: "signature is not a Signatures(Map) vec" };
+  }
+  if (map.length === 0) return { success: false, signers: [], reason: "empty signatures map" };
+  const signaturePayload = authEntryChallengeBytes(entry, networkPassphrase);
+  const signers = [];
+  let allOk = true;
+  for (const e of map) {
+    const keyVec = e.key().vec();
+    const idBytes = keyVec?.[1]?.bytes();
+    const credentialId = idBytes ? Buffer.from(idBytes).toString("hex") : "";
+    const structMap = e.val().vec()?.[1]?.map();
+    const publicKey = publicKeyFor(credentialId);
+    if (!structMap || !publicKey) {
+      allOk = false;
+      signers.push({ credentialId, challengeBound: false, signatureValid: false });
+      continue;
+    }
+    const r = verifySecp256r1StructMap(structMap, publicKey, signaturePayload);
+    if (!r.ok) allOk = false;
+    signers.push({
+      credentialId,
+      challengeBound: r.challengeBound,
+      signatureValid: r.signatureValid
+    });
+  }
+  return { success: allOk, signers };
+}
+
+export { browserPasskeySigner, referenceCheckAuth, referenceSmartWalletCheckAuth };
+//# sourceMappingURL=chunk-LM2AZXKZ.js.map
+//# sourceMappingURL=chunk-LM2AZXKZ.js.map

package/dist/chunk-LM2AZXKZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ceremonies/browserSigner.ts","../src/soroban/checkAuth.ts"],"names":[],"mappings":";;;;;;;AAiCO,SAAS,qBAAqB,OAAA,EAAsD;AACzF,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAC3D,EAAA,OAAO,OAAO,SAAA,KAAgD;AAC5D,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,GAAA,CAAI;AAAA,MACnC,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,SAAA,EAAW,iBAAiB,SAAS,CAAA;AAAA,MACrC,gBAAA,EAAkB,OAAA,CAAQ,gBAAA,IAAoB,EAAC;AAAA,MAC/C,gBAAA,EAAkB,QAAQ,gBAAA,IAAoB;AAAA,KAC/C,CAAA;AACD,IAAA,OAAO;AAAA,MACL,mBAAmB,SAAA,CAAU,iBAAA;AAAA,MAC7B,gBAAgB,SAAA,CAAU,cAAA;AAAA,MAC1B,WAAW,SAAA,CAAU,SAAA;AAAA,MACrB,cAAc,SAAA,CAAU;AAAA,KAC1B;AAAA,EACF,CAAA;AACF;ACjCA,SAAS,KAAK,MAAA,EAAiC;AAC7C,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,gBAAgB,KAAA,EAAO,cAAA,EAAgB,OAAO,MAAA,EAAO;AAChF;AAOA,SAAS,wBAAA,CACP,SAAA,EACA,SAAA,EACA,gBAAA,EACoF;AACpF,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAyC;AACtD,IAAA,MAAM,CAAA,GAAI,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,EAAI,CAAE,GAAA,EAAI,CAAE,QAAA,EAAS,KAAM,IAAI,CAAA;AACjE,IAAA,OAAO,CAAA,GAAI,IAAI,UAAA,CAAW,CAAA,CAAE,KAAI,CAAE,KAAA,EAAO,CAAA,GAAI,MAAA;AAAA,EAC/C,CAAA;AACA,EAAA,MAAM,iBAAA,GAAoB,MAAM,oBAAoB,CAAA;AACpD,EAAA,MAAM,cAAA,GAAiB,MAAM,kBAAkB,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAM,WAAW,CAAA;AACnC,EAAA,IAAI,CAAC,iBAAA,IAAqB,CAAC,cAAA,IAAkB,CAAC,SAAA,EAAW;AACvD,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,cAAA,EAAgB,OAAO,cAAA,EAAgB,KAAA,EAAO,QAAQ,gBAAA,EAAiB;AAAA,EAC7F;AACA,EAAA,IAAI,SAAA,CAAU,WAAW,EAAA,EAAI;AAC3B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,cAAA,EAAgB,KAAA;AAAA,MAChB,cAAA,EAAgB,KAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AACA,EAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,cAAc,CAAC,CAAA;AAClD,IAAA,cAAA,GAAiB,GAAA,CAAI,SAAA,KAAc,gBAAA,CAAiB,gBAAgB,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AACN,IAAA,cAAA,GAAiB,KAAA;AAAA,EACnB;AAEA,EAAA,MAAM,SAAS,MAAA,CAAO,WAAA,CAAY,mBAAmB,MAAA,CAAO,cAAc,CAAC,CAAC,CAAA;AAC5E,EAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,QAAQ,SAAA,EAAW;AAAA,IAC/D,IAAA,EAAM,KAAA;AAAA,IACN,MAAA,EAAQ;AAAA,GACT,CAAA;AACD,EAAA,OAAO,EAAE,EAAA,EAAI,cAAA,IAAkB,cAAA,EAAgB,gBAAgB,cAAA,EAAe;AAChF;AAWO,SAAS,kBAAA,CACd,KAAA,EACA,SAAA,EACA,iBAAA,EACiB;AACjB,EAAA,IAAI,MAAM,WAAA,EAAY,CAAE,MAAA,EAAO,CAAE,SAAS,2BAAA,EAA6B;AACrE,IAAA,OAAO,KAAK,wBAAwB,CAAA;AAAA,EACtC;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,WAAA,EAAY,CAAE,SAAQ,CAAE,SAAA,GAAY,GAAA,EAAI;AAChE,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,IAAA,CAAK,2CAA2C,CAAA;AAEvE,EAAA,MAAM,gBAAA,GAAmB,uBAAA,CAAwB,KAAA,EAAO,iBAAiB,CAAA;AACzE,EAAA,MAAM,CAAA,GAAI,wBAAA,CAAyB,SAAA,EAAW,SAAA,EAAW,gBAAgB,CAAA;AACzE,EAAA,OAAO,EAAE,SAAS,CAAA,CAAE,EAAA,EAAI,gBAAgB,CAAA,CAAE,cAAA,EAAgB,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe;AAC7F;AAgBO,SAAS,6BAAA,CACd,KAAA,EACA,YAAA,EACA,iBAAA,EAC4B;AAC5B,EAAA,IAAI,MAAM,WAAA,EAAY,CAAE,MAAA,EAAO,CAAE,SAAS,2BAAA,EAA6B;AACrE,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,SAAS,EAAC,EAAG,QAAQ,wBAAA,EAAyB;AAAA,EACzE;AACA,EAAA,MAAM,MAAM,KAAA,CAAM,WAAA,EAAY,CAAE,OAAA,GAAU,SAAA,EAAU;AACpD,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,EAAO,CAAE,IAAA,KAAS,QAAA,GAAW,GAAA,CAAI,GAAA,EAAI,GAAI,CAAC,CAAA,EAAG,GAAA,EAAI,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,SAAS,EAAC,EAAG,QAAQ,wCAAA,EAAyC;AAAA,EACzF;AACA,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,EAAC,EAAG,MAAA,EAAQ,sBAAA,EAAuB;AAE3F,EAAA,MAAM,gBAAA,GAAmB,uBAAA,CAAwB,KAAA,EAAO,iBAAiB,CAAA;AACzE,EAAA,MAAM,UAAiD,EAAC;AACxD,EAAA,IAAI,KAAA,GAAQ,IAAA;AAEZ,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,EAAI,CAAE,GAAA,EAAI;AAC3B,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,CAAC,CAAA,EAAG,KAAA,EAAM;AACnC,IAAA,MAAM,YAAA,GAAe,UAAU,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA,GAAI,EAAA;AAEtE,IAAA,MAAM,SAAA,GAAY,EAAE,GAAA,EAAI,CAAE,KAAI,GAAI,CAAC,GAAG,GAAA,EAAI;AAC1C,IAAA,MAAM,SAAA,GAAY,aAAa,YAAY,CAAA;AAC3C,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,SAAA,EAAW;AAC5B,MAAA,KAAA,GAAQ,KAAA;AACR,MAAA,OAAA,CAAQ,KAAK,EAAE,YAAA,EAAc,gBAAgB,KAAA,EAAO,cAAA,EAAgB,OAAO,CAAA;AAC3E,MAAA;AAAA,IACF;AACA,IAAA,MAAM,CAAA,GAAI,wBAAA,CAAyB,SAAA,EAAW,SAAA,EAAW,gBAAgB,CAAA;AACzE,IAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,KAAA,GAAQ,KAAA;AACnB,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,YAAA;AAAA,MACA,gBAAgB,CAAA,CAAE,cAAA;AAAA,MAClB,gBAAgB,CAAA,CAAE;AAAA,KACnB,CAAA;AAAA,EACH;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAQ;AACnC","file":"chunk-LM2AZXKZ.js","sourcesContent":["import { base64UrlToBytes } from '../internal/encoding';\nimport type { AssertionResult, WebAuthnSigner } from '../soroban/sign';\nimport { browserWebAuthnClient } from './browserClient';\nimport type { WebAuthnClient } from './types';\n\nexport interface BrowserPasskeySignerOptions {\n  /** The Relying Party ID (your site's registrable domain). */\n  rpId: string;\n  /**\n   * Restrict the prompt to specific credential ids (base64url) — pass the\n   * `credentialId` from `create` / `connect` so the OS offers the right passkey.\n   * Omit (or leave empty) for a discoverable prompt over any resident passkey.\n   */\n  allowCredentials?: string[];\n  userVerification?: 'discouraged' | 'preferred' | 'required';\n  /** Inject a custom client (tests / non-browser). Defaults to `browserWebAuthnClient()`. */\n  webauthn?: WebAuthnClient;\n}\n\n/**\n * Adapt `navigator.credentials.get` into the `WebAuthnSigner` that\n * `signTransaction` / `signAuthEntry` expect — so wiring a passkey is one line:\n *\n * ```ts\n * const sign = browserPasskeySigner({ rpId, allowCredentials: [credentialId] });\n * const signedXdr = await signTransaction(txXdr, { networkPassphrase, sign });\n * ```\n *\n * The SDK hands the signer a base64url challenge (the Soroban auth preimage);\n * this decodes it to the raw bytes WebAuthn signs over, runs the assertion, and\n * returns the fields the auth assembler needs. The DER signature is low-S\n * normalized downstream (invariant #2) — nothing here weakens that.\n */\nexport function browserPasskeySigner(options: BrowserPasskeySignerOptions): WebAuthnSigner {\n  const webauthn = options.webauthn ?? browserWebAuthnClient();\n  return async (challenge: string): Promise<AssertionResult> => {\n    const assertion = await webauthn.get({\n      rpId: options.rpId,\n      challenge: base64UrlToBytes(challenge),\n      allowCredentials: options.allowCredentials ?? [],\n      userVerification: options.userVerification ?? 'preferred',\n    });\n    return {\n      authenticatorData: assertion.authenticatorData,\n      clientDataJSON: assertion.clientDataJSON,\n      signature: assertion.signature,\n      credentialId: assertion.rawId,\n    };\n  };\n}\n","import { xdr } from '@stellar/stellar-sdk';\nimport { p256 } from '@noble/curves/nist';\nimport { sha256 } from '../internal/sha256';\nimport { concatBytes } from '../internal/bytes';\nimport { bytesToBase64Url, bytesToUtf8 } from '../internal/encoding';\nimport { authEntryChallengeBytes } from './preimage';\n\nexport interface CheckAuthResult {\n  success: boolean;\n  /** clientDataJSON.challenge === base64url(preimage hash). */\n  challengeBound: boolean;\n  /** secp256r1_verify over SHA256(authData ‖ SHA256(cdj)) passed. */\n  signatureValid: boolean;\n  reason?: string;\n}\n\nfunction fail(reason: string): CheckAuthResult {\n  return { success: false, challengeBound: false, signatureValid: false, reason };\n}\n\n/**\n * Verify a bare `Secp256r1Signature` ScMap ({ authenticator_data,\n * client_data_json, signature }) against a public key + the expected signature\n * payload. Shared by the single-signer and smart-wallet reference verifiers.\n */\nfunction verifySecp256r1StructMap(\n  structMap: xdr.ScMapEntry[],\n  publicKey: Uint8Array,\n  signaturePayload: Uint8Array,\n): { ok: boolean; challengeBound: boolean; signatureValid: boolean; reason?: string } {\n  const field = (name: string): Uint8Array | undefined => {\n    const e = structMap.find((x) => x.key().sym().toString() === name);\n    return e ? new Uint8Array(e.val().bytes()) : undefined;\n  };\n  const authenticatorData = field('authenticator_data');\n  const clientDataJSON = field('client_data_json');\n  const signature = field('signature');\n  if (!authenticatorData || !clientDataJSON || !signature) {\n    return { ok: false, challengeBound: false, signatureValid: false, reason: 'missing fields' };\n  }\n  if (signature.length !== 64) {\n    return {\n      ok: false,\n      challengeBound: false,\n      signatureValid: false,\n      reason: 'not 64-byte compact',\n    };\n  }\n  let challengeBound = false;\n  try {\n    const cdj = JSON.parse(bytesToUtf8(clientDataJSON)) as { challenge?: string };\n    challengeBound = cdj.challenge === bytesToBase64Url(signaturePayload);\n  } catch {\n    challengeBound = false;\n  }\n  // Host fn semantics: no low-S enforcement (lowS:false), compact format.\n  const digest = sha256(concatBytes(authenticatorData, sha256(clientDataJSON)));\n  const signatureValid = p256.verify(signature, digest, publicKey, {\n    lowS: false,\n    format: 'compact',\n  });\n  return { ok: challengeBound && signatureValid, challengeBound, signatureValid };\n}\n\n/**\n * A faithful JavaScript model of the on-chain `__check_auth` (kalepail\n * `webauthn-wallet` `verify.rs`): reconstruct `SHA256(authenticator_data ‖\n * SHA256(client_data_json))`, run `secp256r1_verify` (which does NOT enforce\n * low-S — hence the client-side normalization), and assert challenge-binding\n * (`clientDataJSON.challenge === base64url(signature_payload)`). Lets us prove\n * the assembly without a live Soroban RPC; the real on-chain run is exercised\n * by the kit integration (S17) and the demo (S21).\n */\nexport function referenceCheckAuth(\n  entry: xdr.SorobanAuthorizationEntry,\n  publicKey: Uint8Array,\n  networkPassphrase: string,\n): CheckAuthResult {\n  if (entry.credentials().switch().name !== 'sorobanCredentialsAddress') {\n    return fail('no address credentials');\n  }\n  // The signature is the Secp256r1Signature struct directly: a sorted ScMap\n  // { authenticator_data, client_data_json, signature } (see assemble.ts).\n  const structMap = entry.credentials().address().signature().map();\n  if (!structMap) return fail('signature is not a Secp256r1Signature map');\n\n  const signaturePayload = authEntryChallengeBytes(entry, networkPassphrase);\n  const r = verifySecp256r1StructMap(structMap, publicKey, signaturePayload);\n  return { success: r.ok, challengeBound: r.challengeBound, signatureValid: r.signatureValid };\n}\n\nexport interface SmartWalletCheckAuthResult {\n  success: boolean;\n  signers: { credentialId: string; challengeBound: boolean; signatureValid: boolean }[];\n  reason?: string;\n}\n\n/**\n * A reference model of passkey-kit's smart-wallet `__check_auth`: unwrap the\n * `Signatures(Map<SignerKey, Signature>)` value (`ScVal::Vec([ScVal::Map(...)])`),\n * and for each `SignerKey::Secp256r1(id) => Signature::Secp256r1(struct)` entry,\n * look up that credential id's SEC-1 public key and verify the struct. Succeeds\n * only when the map is non-empty and every signer verifies + is challenge-bound.\n * `publicKeyFor` receives the lowercase-hex credential id.\n */\nexport function referenceSmartWalletCheckAuth(\n  entry: xdr.SorobanAuthorizationEntry,\n  publicKeyFor: (credentialIdHex: string) => Uint8Array | undefined,\n  networkPassphrase: string,\n): SmartWalletCheckAuthResult {\n  if (entry.credentials().switch().name !== 'sorobanCredentialsAddress') {\n    return { success: false, signers: [], reason: 'no address credentials' };\n  }\n  const sig = entry.credentials().address().signature();\n  const map = sig.switch().name === 'scvVec' ? sig.vec()?.[0]?.map() : undefined;\n  if (!map) {\n    return { success: false, signers: [], reason: 'signature is not a Signatures(Map) vec' };\n  }\n  if (map.length === 0) return { success: false, signers: [], reason: 'empty signatures map' };\n\n  const signaturePayload = authEntryChallengeBytes(entry, networkPassphrase);\n  const signers: SmartWalletCheckAuthResult['signers'] = [];\n  let allOk = true;\n\n  for (const e of map) {\n    const keyVec = e.key().vec();\n    const idBytes = keyVec?.[1]?.bytes();\n    const credentialId = idBytes ? Buffer.from(idBytes).toString('hex') : '';\n    // Signature::Secp256r1(struct) → scvVec([Symbol, structMap]).\n    const structMap = e.val().vec()?.[1]?.map();\n    const publicKey = publicKeyFor(credentialId);\n    if (!structMap || !publicKey) {\n      allOk = false;\n      signers.push({ credentialId, challengeBound: false, signatureValid: false });\n      continue;\n    }\n    const r = verifySecp256r1StructMap(structMap, publicKey, signaturePayload);\n    if (!r.ok) allOk = false;\n    signers.push({\n      credentialId,\n      challengeBound: r.challengeBound,\n      signatureValid: r.signatureValid,\n    });\n  }\n  return { success: allOk, signers };\n}\n"]}

package/dist/chunk-LUDXP56M.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-LUDXP56M.js.map
+//# sourceMappingURL=chunk-LUDXP56M.js.map

package/dist/chunk-LUDXP56M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-LUDXP56M.js"}

package/dist/chunk-MMB4ZIW3.js

@@ -0,0 +1,48 @@
+import { decodeChallenge } from './chunk-JNJ2FY45.js';
+import { KitError } from './chunk-AMYFJQAC.js';
+import { hash, Address, xdr, StrKey } from '@stellar/stellar-sdk';
+import { sha256 } from '@noble/hashes/sha256';
+
+function contractIdFromDeployerSalt(deployer, salt, networkPassphrase) {
+  let address;
+  try {
+    address = Address.fromString(deployer).toScAddress();
+  } catch (cause) {
+    throw new KitError("CONTRACT_AUTH_FAILED", `invalid deployer address "${deployer}"`, { cause });
+  }
+  const preimage = xdr.HashIdPreimage.envelopeTypeContractId(
+    new xdr.HashIdPreimageContractId({
+      networkId: hash(Buffer.from(networkPassphrase)),
+      contractIdPreimage: xdr.ContractIdPreimage.contractIdPreimageFromAddress(
+        new xdr.ContractIdPreimageFromAddress({
+          address,
+          salt: Buffer.from(salt)
+        })
+      )
+    })
+  );
+  return StrKey.encodeContract(hash(preimage.toXDR()));
+}
+function deriveAccountAddress(options) {
+  const { factoryContractId, credentialId, networkPassphrase } = options;
+  if (credentialId.length === 0) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "deriveAccountAddress: empty credential id");
+  }
+  return contractIdFromDeployerSalt(
+    factoryContractId,
+    hash(Buffer.from(credentialId)),
+    // e.crypto().sha256(credential_id)
+    networkPassphrase
+  );
+}
+function deriveSmartWalletAddress(options) {
+  const raw = decodeChallenge(options.credentialId);
+  if (raw.length === 0) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "deriveSmartWalletAddress: empty credential id");
+  }
+  return contractIdFromDeployerSalt(options.deployer, sha256(raw), options.networkPassphrase);
+}
+
+export { deriveAccountAddress, deriveSmartWalletAddress };
+//# sourceMappingURL=chunk-MMB4ZIW3.js.map
+//# sourceMappingURL=chunk-MMB4ZIW3.js.map

package/dist/chunk-MMB4ZIW3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/soroban/address.ts"],"names":[],"mappings":";;;;;AAMA,SAAS,0BAAA,CACP,QAAA,EACA,IAAA,EACA,iBAAA,EACQ;AACR,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAA,CAAE,WAAA,EAAY;AAAA,EACrD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,SAAS,sBAAA,EAAwB,CAAA,0BAAA,EAA6B,QAAQ,CAAA,CAAA,CAAA,EAAK,EAAE,OAAO,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,QAAA,GAAW,IAAI,cAAA,CAAe,sBAAA;AAAA,IAClC,IAAI,IAAI,wBAAA,CAAyB;AAAA,MAC/B,SAAA,EAAW,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,MAC9C,kBAAA,EAAoB,IAAI,kBAAA,CAAmB,6BAAA;AAAA,QACzC,IAAI,IAAI,6BAAA,CAA8B;AAAA,UACpC,OAAA;AAAA,UACA,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAI;AAAA,SACvB;AAAA;AACH,KACD;AAAA,GACH;AACA,EAAA,OAAO,OAAO,cAAA,CAAe,IAAA,CAAK,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACrD;AAkBO,SAAS,qBAAqB,OAAA,EAA8C;AACjF,EAAA,MAAM,EAAE,iBAAA,EAAmB,YAAA,EAAc,iBAAA,EAAkB,GAAI,OAAA;AAC/D,EAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,2CAA2C,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,0BAAA;AAAA,IACL,iBAAA;AAAA,IACA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA;AAAA,IAC9B;AAAA,GACF;AACF;AAyBO,SAAS,yBAAyB,OAAA,EAAkD;AACzF,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,OAAA,CAAQ,YAAY,CAAA;AAChD,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,2BAA2B,OAAA,CAAQ,QAAA,EAAU,OAAO,GAAG,CAAA,EAAG,QAAQ,iBAAiB,CAAA;AAC5F","file":"chunk-MMB4ZIW3.js","sourcesContent":["import { Address, StrKey, hash, xdr } from '@stellar/stellar-sdk';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { KitError } from '../errors';\nimport { decodeChallenge } from '../webauthn/clientData';\n\n/** The createCustomContract C-address from a deployer address + 32-byte salt (no network round-trip). */\nfunction contractIdFromDeployerSalt(\n  deployer: string,\n  salt: Uint8Array,\n  networkPassphrase: string,\n): string {\n  let address: xdr.ScAddress;\n  try {\n    address = Address.fromString(deployer).toScAddress();\n  } catch (cause) {\n    throw new KitError('CONTRACT_AUTH_FAILED', `invalid deployer address \"${deployer}\"`, { cause });\n  }\n  const preimage = xdr.HashIdPreimage.envelopeTypeContractId(\n    new xdr.HashIdPreimageContractId({\n      networkId: hash(Buffer.from(networkPassphrase)),\n      contractIdPreimage: xdr.ContractIdPreimage.contractIdPreimageFromAddress(\n        new xdr.ContractIdPreimageFromAddress({\n          address,\n          salt: Buffer.from(salt),\n        }),\n      ),\n    }),\n  );\n  return StrKey.encodeContract(hash(preimage.toXDR()));\n}\n\nexport interface DeriveAccountAddressOptions {\n  /** The AccountFactory contract C-address — the deployer. */\n  factoryContractId: string;\n  /** The credential-id bytes the factory salts by SHA-256 (utf-8 of the base64url id in our factory). */\n  credentialId: Uint8Array;\n  networkPassphrase: string;\n}\n\n/**\n * Derive the deterministic C-address of the `webauthn-account` our AccountFactory\n * deploys for a passkey — with NO network round-trip. The factory salts by\n * `sha256(credential_id)` and deploys with `deployer().with_current_contract(salt)`.\n * Verified against the on-chain `factoryDeployProof` in `contracts/deployments.json`\n * (credential `democred` → `CAGWE36M…`). For the passkey-kit v1 smart-wallet, use\n * {@link deriveSmartWalletAddress} instead (different deployer + salt-input scheme).\n */\nexport function deriveAccountAddress(options: DeriveAccountAddressOptions): string {\n  const { factoryContractId, credentialId, networkPassphrase } = options;\n  if (credentialId.length === 0) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'deriveAccountAddress: empty credential id');\n  }\n  return contractIdFromDeployerSalt(\n    factoryContractId,\n    hash(Buffer.from(credentialId)), // e.crypto().sha256(credential_id)\n    networkPassphrase,\n  );\n}\n\nexport interface DeriveSmartWalletAddressOptions {\n  /**\n   * The account that deploys the wallet via `createCustomContract` — a classic\n   * G-address (or a factory C-address). MUST be stable for offline `getAddress`.\n   */\n  deployer: string;\n  /** base64url WebAuthn credential id of the FOUNDING passkey — its RAW bytes are salted. */\n  credentialId: string;\n  networkPassphrase: string;\n}\n\n/**\n * Derive the deterministic C-address of a passkey-kit **v1 smart-wallet** — offline,\n * no network. Mirrors passkey-kit's scheme exactly: `salt = sha256(rawCredentialId)`\n * (the base64url-decoded credential-id bytes), deployed by a fixed `deployer`\n * account via `createCustomContract`. Proven on-chain (`scripts/v1-events-probe.ts`:\n * derived id === deployed id).\n *\n * This only recovers the address for the wallet's FOUNDING credential (the one used\n * as the deploy salt). Signers added later via `add_signer` do not change the\n * address and cannot be reversed into it — resolve those through the events indexer\n * ({@link smartWalletV1Indexer}).\n */\nexport function deriveSmartWalletAddress(options: DeriveSmartWalletAddressOptions): string {\n  const raw = decodeChallenge(options.credentialId);\n  if (raw.length === 0) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'deriveSmartWalletAddress: empty credential id');\n  }\n  return contractIdFromDeployerSalt(options.deployer, sha256(raw), options.networkPassphrase);\n}\n"]}

package/dist/chunk-MOLZIRIH.js

@@ -0,0 +1,22 @@
+import { browserWebAuthnClient, randomBytes } from './chunk-LB4HOTLV.js';
+import { assertUserActivation } from './chunk-TPBBZNPP.js';
+
+// src/ceremonies/recover.ts
+async function recover(options) {
+  assertUserActivation(options.userActivation);
+  const webauthn = options.webauthn ?? browserWebAuthnClient();
+  const assertion = await webauthn.get({
+    rpId: options.rpId,
+    allowCredentials: [],
+    challenge: options.challenge ?? randomBytes(32)
+  });
+  const accounts = await options.indexer.resolveByCredential(assertion.id);
+  return accounts.map((account) => ({
+    contractId: account.contractId,
+    credentialId: assertion.id
+  }));
+}
+
+export { recover };
+//# sourceMappingURL=chunk-MOLZIRIH.js.map
+//# sourceMappingURL=chunk-MOLZIRIH.js.map

package/dist/chunk-MOLZIRIH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ceremonies/recover.ts"],"names":[],"mappings":";;;;AAwBA,eAAsB,QAAQ,OAAA,EAAmD;AAC/E,EAAA,oBAAA,CAAqB,QAAQ,cAAc,CAAA;AAC3C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAC3D,EAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,GAAA,CAAI;AAAA,IACnC,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,kBAAkB,EAAC;AAAA,IACnB,SAAA,EAAW,OAAA,CAAQ,SAAA,IAAa,WAAA,CAAY,EAAE;AAAA,GAC/C,CAAA;AACD,EAAA,MAAM,WAAW,MAAM,OAAA,CAAQ,OAAA,CAAQ,mBAAA,CAAoB,UAAU,EAAE,CAAA;AACvE,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,MAAa;AAAA,IAChC,YAAY,OAAA,CAAQ,UAAA;AAAA,IACpB,cAAc,SAAA,CAAU;AAAA,GAC1B,CAAE,CAAA;AACJ","file":"chunk-MOLZIRIH.js","sourcesContent":["import { assertUserActivation } from '../anchors';\nimport type { IndexerAdapter } from '../adapters/types';\nimport { browserWebAuthnClient } from './browserClient';\nimport { randomBytes } from './random';\nimport type { WebAuthnClient } from './types';\n\nexport interface RecoverOptions {\n  rpId: string;\n  indexer: IndexerAdapter;\n  webauthn?: WebAuthnClient;\n  challenge?: Uint8Array;\n  userActivation?: { isActive: boolean };\n}\n\nexport interface RecoverResult {\n  contractId: string;\n  credentialId: string;\n}\n\n/**\n * `recover` — the lost-localStorage / new-device path. Performs a\n * discoverable-credential `get()` (no allowCredentials), then resolves every\n * smart account controlled by that credential via the IndexerAdapter.\n */\nexport async function recover(options: RecoverOptions): Promise<RecoverResult[]> {\n  assertUserActivation(options.userActivation); // anchor: apple-user-gesture (S04)\n  const webauthn = options.webauthn ?? browserWebAuthnClient();\n  const assertion = await webauthn.get({\n    rpId: options.rpId,\n    allowCredentials: [],\n    challenge: options.challenge ?? randomBytes(32),\n  });\n  const accounts = await options.indexer.resolveByCredential(assertion.id);\n  return accounts.map((account) => ({\n    contractId: account.contractId,\n    credentialId: assertion.id,\n  }));\n}\n"]}